Use glibc binary and runtime image

.github/dependabot.yml

@@ -8,6 +8,12 @@ updates:
   directory: "/"
   schedule:
     interval: daily
+- package-ecosystem: cargo
+  directory: "/versions/cargo-auditable"
+  allow:
+  - dependency-name: "cargo-auditable"
+  schedule:
+    interval: daily
 - package-ecosystem: cargo
   directory: "/versions/stable"
   allow:

.github/workflows/publish.yaml

@@ -56,6 +56,7 @@ jobs:
       base: ${{ steps.existing.outputs.base }}
       base-digest: ${{ steps.existing.outputs.base-digest }}
       wasmtime-commit-date: ${{ steps.existing.outputs.wasmtime-commit-date }}
+      cargo-auditable-version: ${{ steps.existing.outputs.cargo-auditable-version }}
     steps:
     - uses: actions/checkout@v6
     - name: Install crane
@@ -68,13 +69,17 @@ jobs:
         digest="$(crane digest "${{ env.image }}" || echo -n '')"
         echo "digest=${digest}" | tee -a "${GITHUB_OUTPUT}"
 
-        base="cgr.dev/chainguard/static:latest"
+        base="cgr.dev/chainguard/glibc-dynamic:latest"
         echo "base=${base}" | tee -a "${GITHUB_OUTPUT}"
         base_digest="$(crane digest "${base}")"
         echo "base-digest=${base_digest}" | tee -a "${GITHUB_OUTPUT}"
 
         wasmtime_commit_date="$(gh api "repos/bytecodealliance/wasmtime/commits/${{ inputs.wasmtime-git-sha }}" --template '{{.commit.committer.date}}')"
         echo "wasmtime-commit-date=${wasmtime_commit_date}" | tee -a "${GITHUB_OUTPUT}"
+
+        cargo_auditable_version="$(cd versions/cargo-auditable ; yq -p toml -oj -r '.package[] | select(.name == "cargo-auditable") | .version' Cargo.lock)"
+        echo "cargo-auditable-version=${cargo_auditable_version}" | tee -a "${GITHUB_OUTPUT}"
+
       env:
         GH_TOKEN: ${{ github.token }}
 
@@ -105,10 +110,10 @@ jobs:
         docker buildx build \
           --builder container \
           --output type=oci,dest="./wasmtime-${{ inputs.tag }}-${{ matrix.arch }}.tar" \
-          --platform "linux/${{ matrix.arch }}" \
           --build-arg "SOURCE_DATE_EPOCH=$(date -d "${{ needs.preflight.outputs.wasmtime-commit-date }}" +%s)" \
           --build-arg "wasmtime_crate=${{ inputs.wasmtime-crate }}" \
           --build-arg "wasmtime_git_rev=${{ inputs.wasmtime-git-sha }}" \
+          --build-arg "cargo_auditable_version=${{ needs.preflight.outputs.cargo-auditable-version }}" \
           --build-arg "from_base=${{ needs.preflight.outputs.base }}@${{ needs.preflight.outputs.base-digest }}" \
           --build-arg "from_build=rust:${{ inputs.rust-version }}" \
           --label org.opencontainers.image.authors="Bytecode Alliance <https://bytecodealliance.org>" \

Dockerfile

@@ -1,22 +1,17 @@
 ARG from_build from_base
 FROM ${from_build} AS build
-ARG wasmtime_crate wasmtime_git_rev
+ARG wasmtime_crate wasmtime_git_rev cargo_auditable_version
 RUN \
-  apt-get update ; \
-  apt-get install gcc-$(arch | tr _ -)-linux-gnu musl-tools -y ; \
-  rustup target add $(arch)-unknown-linux-musl ; \
-  cargo install --locked cargo-auditable ; \
+  cargo install --locked "cargo-auditable@${cargo_auditable_version}" ; \
   if [ "${wasmtime_crate}" = "" ] ; then \
     cargo auditable install \
-      --target "$(arch)-unknown-linux-musl" \
       --git https://github.com/bytecodealliance/wasmtime.git \
       --rev "${wasmtime_git_rev}" \
       --locked \
       wasmtime-cli \
     ; \
   else \
     cargo auditable install \
-      --target "$(arch)-unknown-linux-musl" \
       --locked \
       wasmtime-cli@${wasmtime_crate} \
     ; \

versions/cargo-auditable/Cargo.toml

@@ -0,0 +1,8 @@
+[package]
+name = "cargo-auditable-version"
+version = "0.1.0"
+edition = "2024"
+
+[dependencies]
+cargo-auditable = "=0.7.4"
+