Skip to content

ci: add riscv64 to static Node.js build matrix#754

Open
gounthar wants to merge 3 commits intopyca:mainfrom
gounthar:feat/riscv64-static-nodejs
Open

ci: add riscv64 to static Node.js build matrix#754
gounthar wants to merge 3 commits intopyca:mainfrom
gounthar:feat/riscv64-static-nodejs

Conversation

@gounthar
Copy link
Copy Markdown

Prerequisite for #749.

The cryptography-linux/Dockerfile pulls ghcr.io/pyca/static-nodejs-riscv64:{version} at build time, but that image does not exist yet because build-static-node.yml only covers x86_64, aarch64, and ppc64le.

Changes:

  • Add ubuntu-24.04-riscv to the build matrix
  • Update Dockerfile-test to accept a full MANYLINUX_IMAGE arg rather than constructing quay.io/pypa/manylinux2014_{arch} (manylinux2014 has no riscv64 image; riscv64 uses manylinux_2_39_riscv64)
  • Update the test step accordingly

The main unknown is build time. Node.js does not ship riscv64 prebuilt binaries, so this builds from source inside Alpine on the RISE runner. Alex noted other platforms already take over an hour; the riscv64 result will show whether it is in a similar range.

Signed-off-by: Bruno Verachten gounthar@gmail.com

Uses ubuntu-24.04-riscv runner and manylinux_2_39_riscv64 for testing
(manylinux2014 has no riscv64 image). Dockerfile-test updated to take
a full MANYLINUX_IMAGE arg instead of constructing from MANYLINUX_ARCH.

Signed-off-by: Bruno Verachten <gounthar@gmail.com>
binutils-gold is not available as a separate Alpine package on riscv64.
Standard binutils (ld.bfd) is sufficient for the static Node.js build.

Signed-off-by: Bruno Verachten <gounthar@gmail.com>
Node.js bundled OpenSSL hardcodes linux-x86_64 config paths and
passes -m64 even when --dest-cpu=riscv64 is set. --openssl-no-asm
skips arch-specific OpenSSL assembly and uses the generic config.

Signed-off-by: Bruno Verachten <gounthar@gmail.com>
@gounthar
Copy link
Copy Markdown
Author

The v24.5.0 riscv64 job failed immediately with open /docker-certs/client/ca.pem: no such file or directory before any build steps ran. This is a runner-level Docker TLS issue, not a Dockerfile problem. The v20.19.4 riscv64 job ran normally on the same runner type.

Could someone re-run the failed job when there is a chance? Happy to report build times once both complete.

@gounthar
Copy link
Copy Markdown
Author

The ppc64le + v24.5.0 job also failed, but not from our changes. The error is in deps/v8/third_party/highway/hwy/ops/ppc_vsx-inl.h: VSX intrinsics (__builtin_vsx_xvcvspsxds) failing with -Wtemplate-body on Alpine/musl GCC. The ppc64le + v20.19.4 job passes fine. Looks like a Node v24.5.0-specific regression on ppc64le unrelated to this PR.

@alex
Copy link
Copy Markdown
Member

alex commented Apr 15, 2026

Just re-ran. It's surprising to me that we'd hit an issue with ppc64le, it'd have to be a regression in the manylinux2014 image I guess?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants