Building on alpine

[ulrichard]

Problem:

After upgrading some dependencies, aws-lc-rs is pulled in as a sub-dependency, and I am now getting the following error messages:

   Compiling aws-lc-sys v0.24.1
The following warnings were emitted during compilation:

warning: [email protected]: Building with: CMake
warning: [email protected]: Symbol Prefix: Some("aws_lc_0_24_1")
warning: [email protected]: CMAKE environment variable set: cmake
warning: [email protected]: Generating bindings - external bindgen. Platform: x86_64-alpine-linux-musl

error: failed to run custom build command for `aws-lc-sys v0.24.1`

Caused by:
  process didn't exit successfully: `/home/satoshi/target/debug/build/aws-lc-sys-b95fd8f0c5480cc1/build-script-main` (exit status: 101)
  --- stdout
  cargo:rerun-if-env-changed=AWS_LC_SYS_NO_PREFIX
  cargo:rerun-if-env-changed=AWS_LC_SYS_PREGENERATING_BINDINGS
  cargo:rerun-if-env-changed=AWS_LC_SYS_EXTERNAL_BINDGEN
  cargo:rerun-if-env-changed=AWS_LC_SYS_NO_ASM
  cargo:rerun-if-env-changed=AWS_LC_SYS_CFLAGS
  cargo:rerun-if-env-changed=AWS_LC_SYS_PREBUILT_NASM
  cargo:rerun-if-env-changed=AWS_LC_SYS_C_STD
  cargo:rerun-if-env-changed=AWS_LC_SYS_CMAKE_BUILDER
  cargo:rerun-if-env-changed=AWS_LC_SYS_STATIC
  cargo:rerun-if-env-changed=CMAKE
  cargo:warning=Building with: CMake
  cargo:warning=Symbol Prefix: Some("aws_lc_0_24_1")
  cargo:rerun-if-env-changed=CMAKE
  cargo:warning=CMAKE environment variable set: cmake
  cargo:warning=Generating bindings - external bindgen. Platform: x86_64-alpine-linux-musl

  --- stderr
  Consider installing the bindgen-cli: `cargo install --force --locked bindgen-cli`
  See our User Guide for more information about bindgen:https://aws.github.io/aws-lc-rs/index.html
  Failure invoking external bindgen! External bindgen command failed.
  thread 'main' panicked at /home/satoshi/.cargo/registry/src/index.crates.io-6f17d22bba15001f/aws-lc-sys-0.24.1/builder/main.rs:621:5:
  aws-lc-sys build failed. Please enable the 'bindgen' feature on aws-lc-rs or aws-lc-sys.For more information, see the aws-lc-rs User Guide: https://aws.github.io/aws-lc-rs/index.html
  note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
warning: build failed, waiting for other jobs to finish...

Relevant details

The Docker file where the build is happening looks roughly like this:

FROM alpine:3.20

RUN apk add \
	alpine-sdk \
	bash \
	boost-dev \
	build-base \
	busybox-suid \
	cargo \
	clang-dev \
	cmake \
	openssl-dev

ARG UID
RUN adduser -u $UID -S -s /bin/sh -G abuild satoshi
USER satoshi
WORKDIR /home/satoshi
ENV CARGO_HTTP_MULTIPLEXING=false

Since it is a sub-dependency, my options are a bit limited. In https://aws.github.io/aws-lc-rs/requirements/linux.html I see that with the x86_64-unknown-linux-musl it should be smooth sailing, but the error message states that x86_64-alpine-linux-musl is used. Can I set an environment variable to make it use the unknown target instead?
Or maybe you can tell me what I should report to the developers of the intermittent dependency. From analyzing the dependency graph it seems to be rustls with the aws-lc-sys feature.

[justsmth]

Hello!

The issue here appears to be with bindings generation. The error message provides one option that might fix it:

cargo install --force --locked bindgen-cli

That target is unexpected: x86_64-alpine-linux-musl -- I don't see it listed as a supported platform for the Rust compiler. I don't know how the target could get set like that in the environment.

Is this build for an open source project that I could attempt to build myself? Is there any other information that might allow me to reproduce this failure? Thanks!

[ulrichard]

Thanks for looking into this. Installing bindgen-cli as suggested by the error message didn't change anything. The easiest way to reproduce is to check out rustls, put the two attached files into the directory, remove the .txt extensions, and run "make".

Dockerfile.txt
Makefile.txt

[justsmth]

I looked at this again. I am able to reproduce the failure you had. I think the issue is that the build environment is not properly setup to perform the build.

I was able to get it to work using the following Dockerfile that sets up Rust specifically for the user ("satoshi") performing the build (instead of using the system's "cargo" package).

FROM alpine:3.20

RUN apk add \
	alpine-sdk \
	bash \
	boost-dev \
	build-base \
	busybox-suid \
	clang-dev \
    curl \
	cmake \
	openssl-dev

ARG UID
RUN adduser -u $UID -S -s /bin/sh -G abuild satoshi
USER satoshi
WORKDIR /home/satoshi
ENV CARGO_HTTP_MULTIPLEXING=false

RUN cd "${HOME}" && \
    curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs > ./rustup.sh && \
    chmod +x ./rustup.sh && \
    ./rustup.sh -y && \
    . "${HOME}/.cargo/env" && \
    echo '. "${HOME}/.cargo/env"' >> ${HOME}/.profile && \
    cargo install --locked bindgen-cli && \
    rustup component add rustfmt clippy && \
    rm ./rustup.sh

Then when running the docker image, be sure that the user's .profile has been run to setup the environment before starting the build:

❯ docker run -v `pwd`:`pwd` -w `pwd` -it --rm alpine:3.20
/Users/justsmth/repos/aws-lc-rs $ . ~/.profile
/Users/justsmth/repos/aws-lc-rs $ cargo build -p aws-lc-sys
    Updating crates.io index
  Downloaded cmake v0.1.52
...
   Compiling aws-lc-sys v0.25.0 (/Users/justsmth/repos/aws-lc-rs/aws-lc-sys)
warning: [email protected]: Building with: CC
warning: [email protected]: Symbol Prefix: Some("aws_lc_0_25_0")
warning: [email protected]: Compilation of 'c11.c' succeeded - Ok(["/Users/justsmth/repos/aws-lc-rs/target/debug/build/aws-lc-sys-f06f3a7b86521bb7/out/out-c11/7dfda64fdf5a526c-c11.o"]).
warning: [email protected]: Compilation of 'stdalign_check.c' succeeded - Ok(["/Users/justsmth/repos/aws-lc-rs/target/debug/build/aws-lc-sys-f06f3a7b86521bb7/out/out-stdalign_check/7dfda64fdf5a526c-stdalign_check.o"]).
warning: [email protected]: Compilation of 'builtin_swap_check.c' succeeded - Ok(["/Users/justsmth/repos/aws-lc-rs/target/debug/build/aws-lc-sys-f06f3a7b86521bb7/out/out-builtin_swap_check/7dfda64fdf5a526c-builtin_swap_check.o"]).
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 8.65s

I hope this helps! 😊

[ulrichard]

Thanks @justsmth for looking into this. It's good to know that there is a workaround that we might use for development. Unfortunately it is most likely not a solution that we could use for releases.

Actually, with this workaround in place, I cannot even compile most of the dependencies. I get SIGSEV errors all over the place.

[ulrichard]

How about adding the target as in #676 ?
With this in place I can build our application again.

Unfortunately that is not enough. I can build our application, but when I run the tests, I get the following error:
no process-level CryptoProvider available -- call CryptoProvider::install_default() before this point
This error seems to come from rustls and originates from changed behavior. It looks like I should be able to work this out.

[cpu]

Unfortunately that is not enough. I can build our application, but when I run the tests, I get the following error:
no process-level CryptoProvider available -- call CryptoProvider::install_default() before this point

As you correctly intuited this is an issue from your usage of rustls, and unrelated to aws-lc-rs. It's likely your dependency tree has activated the ring feature somewhere in addition to aws-lc-rs. You need to fix that to be unambiguous, or install aws-lc-rs as the default provider early in your application/tests lifecycle. See the rustls cryptoprovider documentation. We'd be happy to help more on the Rustls issue tracker.

[justsmth]

I think I found a simple way to support the ????-alpine-linux-musl targets...

I noticed that the bindings for x86_64-alpine-linux-musl in your PR are identical to the x86_64-unknown-linux-musl bindings, so there's no need to generate a separate file. We could either symlink the bindings filenames to their equivalent, or have the build script logic map the target we don't explicitly support (alpine) to an equivalent target that we do.

I updated my PR here with a build script logic change: #675

It just needs cleanup and a CI job setup and it should be ready for review.

[justsmth]

Actually, with this workaround in place, I cannot even compile most of the dependencies. I get SIGSEV errors all over the place.

I've seen numerous reports about compilations ending with a SIGSEGV. I believe this is the GCC compiler seg-faulting while compiling code. These seem related to a recent change to the GitHub runners. This link might have more information for you:

• "Segment fault with Ubuntu 24.04 20250120.5.0" -- Segment fault with Ubuntu 24.04 20250120.5.0 actions/runner-images#11471

[justsmth]

I've marked my PR as ready for review. You can see the alpine-linux CI job succeeds here: https://github.com/aws/aws-lc-rs/actions/runs/13054865236/job/36423300444?pr=675#step:4:1