feat: add ubuntu 24.04 to build matrix

.github/matrix-commitly.yml

@@ -1,15 +1,23 @@
 # please see matrix-full.yml for meaning of each field
 build-packages:
-- label: ubuntu-22.04
-  image: ubuntu:22.04
+- label: ubuntu-24.04
+  image: ubuntu:24.04
   package: deb
-  check-manifest-suite: ubuntu-22.04-amd64
+  check-manifest-suite: ubuntu-24.04-amd64
+- label: ubuntu-24.04-arm64
+  image: ubuntu:24.04
+  package: deb
+  bazel-args: --platforms=//:generic-crossbuild-aarch64
+  check-manifest-suite: ubuntu-24.04-arm64
 
 build-images:
 - label: ubuntu
-  base-image: ubuntu:22.04
+  base-image: ubuntu:24.04
   package: deb
-  artifact-from: ubuntu-22.04
+  artifact-from: ubuntu-24.04
+  artifact-from-alt: ubuntu-24.04-arm64
+  docker-platforms: linux/amd64, linux/arm64
+  check-manifest-suite: docker-image-ubuntu-24.04
 
 smoke-tests:
 - label: ubuntu

.github/matrix-full.yml

@@ -20,6 +20,15 @@ build-packages:
   package: deb
   bazel-args: --platforms=//:generic-crossbuild-aarch64
   check-manifest-suite: ubuntu-22.04-arm64
+- label: ubuntu-24.04
+  image: ubuntu:24.04
+  package: deb
+  check-manifest-suite: ubuntu-24.04-amd64
+- label: ubuntu-24.04-arm64
+  image: ubuntu:24.04
+  package: deb
+  bazel-args: --platforms=//:generic-crossbuild-aarch64
+  check-manifest-suite: ubuntu-24.04-arm64
 
 # Debian
 - label: debian-11
@@ -78,11 +87,12 @@ build-images:
 
 # Ubuntu
 - label: ubuntu
-  base-image: ubuntu:22.04
+  base-image: ubuntu:24.04
   package: deb
-  artifact-from: ubuntu-22.04
-  artifact-from-alt: ubuntu-22.04-arm64
+  artifact-from: ubuntu-24.04
+  artifact-from-alt: ubuntu-24.04-arm64
   docker-platforms: linux/amd64, linux/arm64
+  check-manifest-suite: docker-image-ubuntu-24.04
 
 # Debian
 - label: debian
@@ -129,6 +139,18 @@ release-packages:
   artifact-version: 22.04
   artifact-type: ubuntu
   artifact: kong.arm64.deb
+- label: ubuntu-24.04
+  package: deb
+  artifact-from: ubuntu-24.04
+  artifact-version: 24.04
+  artifact-type: ubuntu
+  artifact: kong.amd64.deb
+- label: ubuntu-24.04-arm64
+  package: deb
+  artifact-from: ubuntu-24.04-arm64
+  artifact-version: 24.04
+  artifact-type: ubuntu
+  artifact: kong.arm64.deb
 
 # Debian
 - label: debian-11

.github/workflows/release.yml

@@ -419,17 +419,19 @@ jobs:
         cache: 'pip' # caching pip dependencies
 
     - name: Verify
+      env:
+        SUITE: ${{ matrix.check-manifest-suite || 'docker-image' }}
       run: |
         cd scripts/explain_manifest
         # docker image verify requires sudo to set correct permissions, so we
         # also install deps for root
-        sudo -E pip install -r requirements.txt
+        sudo -H -E pip install -r requirements.txt
         IMAGE=${{ env.PRERELEASE_DOCKER_REPOSITORY }}:${{ needs.metadata.outputs.commit-sha }}-${{ matrix.label }}
 
-        sudo -E python ./main.py --image $IMAGE -f docker_image_filelist.txt -s docker-image
+        sudo -H -E python ./main.py --image $IMAGE -f docker_image_filelist.txt -s "$SUITE"
 
         if [[ ! -z "${{ matrix.docker-platforms }}" ]]; then
-          DOCKER_DEFAULT_PLATFORM=linux/arm64 sudo -E python ./main.py --image $IMAGE -f docker_image_filelist.txt -s docker-image
+          DOCKER_DEFAULT_PLATFORM=linux/arm64 sudo -E python ./main.py --image $IMAGE -f docker_image_filelist.txt -s "$SUITE"
         fi
 
   scan-images:

build/README.md

@@ -220,7 +220,7 @@ time to control how the ngx_wasm_module repository is sourced:
 
 ## Cross compiling
 
-Cross compiling is currently only tested on Ubuntu 22.04 x86_64 with following targeting platforms:
+Cross compiling is currently only tested on Ubuntu 22.04/24.04 x86_64 with following targeting platforms:
 
 - **//:generic-crossbuild-aarch64** Use the system installed aarch64 toolchain.
   - Requires user to manually install `crossbuild-essential-arm64` on Debian/Ubuntu.

build/cross_deps/README.md

@@ -17,6 +17,7 @@ We currently do cross compile on following platforms:
 - Amazonlinux 2023
 - Ubuntu 18.04 (Version 3.4.x.x only)
 - Ubuntu 22.04
+- Ubuntu 24.04
 - RHEL 9
 - Debian 12
 

build/cross_deps/libxcrypt/001-4.4.27-enable-hash-all.patch

@@ -0,0 +1,70 @@
+This is roughly adapted from https://patchwork.yoctoproject.org/project/oe-core/patch/20230726131331.2239727-1-Martin.Jansa@gmail.com
+Which is a patch adopted around 4.4.30 upstream.
+
+diff --color -Naur a/build-aux/scripts/BuildCommon.pm b/build-aux/scripts/BuildCommon.pm
+--- a/build-aux/scripts/BuildCommon.pm	2021-12-17 07:16:06.000000000 -0800
++++ b/build-aux/scripts/BuildCommon.pm	2024-09-05 12:47:53.534533364 -0700
+@@ -519,19 +519,19 @@
+     my $COMPAT_ABI;
+     local $_;
+     for (@args) {
+-        when (/^SYMVER_MIN=(.+)$/) {
++        if (/^SYMVER_MIN=(.+)$/) {
+             $usage_error->() if defined $SYMVER_MIN;
+             $SYMVER_MIN = $1;
+         }
+-        when (/^SYMVER_FLOOR=(.+)$/) {
++        elsif (/^SYMVER_FLOOR=(.+)$/) {
+             $usage_error->() if defined $SYMVER_FLOOR;
+             $SYMVER_FLOOR = $1;
+         }
+-        when (/^COMPAT_ABI=(.+)$/) {
++        elsif (/^COMPAT_ABI=(.+)$/) {
+             $usage_error->() if defined $COMPAT_ABI;
+             $COMPAT_ABI = $1;
+         }
+-        default {
++        else {
+             $usage_error->() if defined $map_in;
+             $map_in = $_;
+         }
+diff --color -Naur a/build-aux/scripts/gen-crypt-h b/build-aux/scripts/gen-crypt-h
+--- a/build-aux/scripts/gen-crypt-h	2021-12-17 07:16:06.000000000 -0800
++++ b/build-aux/scripts/gen-crypt-h	2024-09-05 12:48:58.446980478 -0700
+@@ -37,22 +37,20 @@
+     local $_;
+     while (<$fh>) {
+         chomp;
+-        # Yes, 'given $_' is really required here.
+-        given ($_) {
+-            when ('#define HAVE_SYS_CDEFS_H 1') {
+-                $have_sys_cdefs_h = 1;
+-            }
+-            when ('#define HAVE_SYS_CDEFS_BEGIN_END_DECLS 1') {
+-                $have_sys_cdefs_begin_end_decls = 1;
+-            }
+-            when ('#define HAVE_SYS_CDEFS_THROW 1') {
+-                $have_sys_cdefs_throw = 1;
+-            }
+-            when (/^#define PACKAGE_VERSION "((\d+)\.(\d+)\.\d+)"$/) {
+-                $substs{XCRYPT_VERSION_STR}   = $1;
+-                $substs{XCRYPT_VERSION_MAJOR} = $2;
+-                $substs{XCRYPT_VERSION_MINOR} = $3;
+-            }
++
++        if ($_ eq '#define HAVE_SYS_CDEFS_H 1') {
++            $have_sys_cdefs_h = 1;
++        }
++        elsif ($_ eq '#define HAVE_SYS_CDEFS_BEGIN_END_DECLS 1') {
++            $have_sys_cdefs_begin_end_decls = 1;
++        }
++        elsif ($_ eq '#define HAVE_SYS_CDEFS_THROW 1') {
++            $have_sys_cdefs_throw = 1;
++        }
++        elsif (/^#define PACKAGE_VERSION "((\d+)\.(\d+)\.\d+)"$/) {
++            $substs{XCRYPT_VERSION_STR}   = $1;
++            $substs{XCRYPT_VERSION_MAJOR} = $2;
++            $substs{XCRYPT_VERSION_MINOR} = $3;
+         }
+     }
+

build/cross_deps/libxcrypt/repositories.bzl

@@ -9,11 +9,14 @@ def libxcrypt_repositories():
     # thus crypt.h and libcrypt.so.1 are missing from cross tool chain
     # ubuntu2004: 4.4.10
     # ubuntu2204: 4.4.27
+    # ubuntu2204: 4.4.36
     # NOTE: do not bump the following version, see build/cross_deps/README.md for detail.
     http_archive(
         name = "cross_deps_libxcrypt",
         url = "https://github.com/besser82/libxcrypt/releases/download/v4.4.27/libxcrypt-4.4.27.tar.xz",
         sha256 = "500898e80dc0d027ddaadb5637fa2bf1baffb9ccd73cd3ab51d92ef5b8a1f420",
         strip_prefix = "libxcrypt-4.4.27",
         build_file = "//build/cross_deps/libxcrypt:BUILD.libxcrypt.bazel",
+        patches = ["//build/cross_deps/libxcrypt:001-4.4.27-enable-hash-all.patch"],
+        patch_args = ["-p1"],
     )

changelog/unreleased/kong/add-noble-numbat.yml

@@ -0,0 +1,2 @@
+message: "Add Ubuntu 24.04 (Noble Numbat) to build"
+type: dependency

scripts/explain_manifest/config.py

@@ -125,6 +125,19 @@ def transform(f: FileInfo):
             },
         }
     ),
+    "ubuntu-24.04-amd64": ExpectSuite(
+        name="Ubuntu 24.04 (amd64)",
+        manifest="fixtures/ubuntu-24.04-amd64.txt",
+        tests={
+            common_suites: {},
+            libc_libcpp_suites: {
+                "libc_max_version": "2.35",
+                # gcc 11.2.0
+                "libcxx_max_version": "3.4.29",
+                "cxxabi_max_version": "1.3.13",
+            },
+        }
+    ),
     "debian-11-amd64": ExpectSuite(
         name="Debian 11 (amd64)",
         manifest="fixtures/debian-11-amd64.txt",
@@ -158,6 +171,16 @@ def transform(f: FileInfo):
             docker_suites: {},
         }
     ),
+    "docker-image-ubuntu-24.04": ExpectSuite(
+        name="Ubuntu 24.04 Docker Image",
+        manifest=None,
+        tests={
+            docker_suites: {
+                "kong_uid": 1001,
+                "kong_gid": 1001,
+            },
+        }
+    ),
 }
 
 # populate arm64 and fips suites from amd64 suites