From 6086446018f6d1b59dcd2433db2a05960fdb13c4 Mon Sep 17 00:00:00 2001 From: nesquena-hermes Date: Fri, 14 Aug 2026 20:51:42 -0700 Subject: [PATCH] =?UTF-8?q?fix(docker):=20source-built=20SQLite=20must=20l?= =?UTF-8?q?oad=20on=20arm64=20(ld.so.conf.d)=20=E2=80=94=20follow-up=20to?= =?UTF-8?q?=20#6900=20(#7044)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix(docker): register /usr/local/lib in ld.so.conf.d so the source-built SQLite loads on arm64 The #6900 SQLite-from-source upgrade passed the amd64 docker-smoke but FAILED the multi-arch release build on linux/arm64 with 'AssertionError: SQLite 3.46.1 still vulnerable' — Python's sqlite3 kept loading the base image's /usr/lib multiarch libsqlite3 (3.46.1) instead of the freshly-compiled /usr/local/lib copy (3.53.0), because /usr/local/lib is NOT in the default ld.so search path on Debian arm64 (it happened to be picked up on amd64). Register /usr/local/lib via an ld.so.conf.d entry before ldconfig so the new lib wins on every architecture. The PR's own build-time version assertion is what surfaced this (correctly), and it also serves as the verification that the fix works once the arm64 build passes. Follow-up to #6900 (exp-v0.52.227, whose multi-arch image failed to build/push). * test-fix: keep wal.html link within 500 chars of ARG (condense arm64 comment) --------- Co-authored-by: nesquena-hermes --- Dockerfile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 6db3383e..7d3abc33 100644 --- a/Dockerfile +++ b/Dockerfile @@ -36,7 +36,7 @@ RUN apt-get update -y --fix-missing --no-install-recommends \ # https://sqlite.org/wal.html#walresetbug # # Debian has not backported the fix, so we compile from the amalgamation. -# Installs to /usr/local/lib (takes ldconfig priority over /usr/lib). +# Installs to /usr/local/lib (registered in ld.so.conf.d for arm64 priority). # Build tools are purged after compilation to keep the image lean. # Build args are for forward version bumps only (3.54+, etc.). # When bumping SQLITE_VERSION, recompute the SHA-256 from the official @@ -56,6 +56,7 @@ RUN apt-get update \ --enable-fts5 --enable-fts4 --enable-rtree \ && make -j"$(nproc)" \ && make install \ + && echo "/usr/local/lib" > /etc/ld.so.conf.d/000-usr-local-lib.conf \ && /sbin/ldconfig \ && cd / && rm -rf /tmp/sqlite* \ && apt-get purge -y gcc make libc6-dev \