Skip to content

ci: add riscv64 to static Node.js build matrix#754

Open
gounthar wants to merge 5 commits intopyca:mainfrom
gounthar:feat/riscv64-static-nodejs
Open

ci: add riscv64 to static Node.js build matrix#754
gounthar wants to merge 5 commits intopyca:mainfrom
gounthar:feat/riscv64-static-nodejs

Conversation

@gounthar
Copy link
Copy Markdown

Prerequisite for #749.

The cryptography-linux/Dockerfile pulls ghcr.io/pyca/static-nodejs-riscv64:{version} at build time, but that image does not exist yet because build-static-node.yml only covers x86_64, aarch64, and ppc64le.

Changes:

  • Add ubuntu-24.04-riscv to the build matrix
  • Update Dockerfile-test to accept a full MANYLINUX_IMAGE arg rather than constructing quay.io/pypa/manylinux2014_{arch} (manylinux2014 has no riscv64 image; riscv64 uses manylinux_2_39_riscv64)
  • Update the test step accordingly

The main unknown is build time. Node.js does not ship riscv64 prebuilt binaries, so this builds from source inside Alpine on the RISE runner. Alex noted other platforms already take over an hour; the riscv64 result will show whether it is in a similar range.

Signed-off-by: Bruno Verachten gounthar@gmail.com

@gounthar
Copy link
Copy Markdown
Author

The v24.5.0 riscv64 job failed immediately with open /docker-certs/client/ca.pem: no such file or directory before any build steps ran. This is a runner-level Docker TLS issue, not a Dockerfile problem. The v20.19.4 riscv64 job ran normally on the same runner type.

Could someone re-run the failed job when there is a chance? Happy to report build times once both complete.

@gounthar
Copy link
Copy Markdown
Author

The ppc64le + v24.5.0 job also failed, but not from our changes. The error is in deps/v8/third_party/highway/hwy/ops/ppc_vsx-inl.h: VSX intrinsics (__builtin_vsx_xvcvspsxds) failing with -Wtemplate-body on Alpine/musl GCC. The ppc64le + v20.19.4 job passes fine. Looks like a Node v24.5.0-specific regression on ppc64le unrelated to this PR.

@alex
Copy link
Copy Markdown
Member

alex commented Apr 15, 2026

Just re-ran. It's surprising to me that we'd hit an issue with ppc64le, it'd have to be a regression in the manylinux2014 image I guess?

@gounthar
Copy link
Copy Markdown
Author

Both v24.5.0 failures trace back to alpine:latest now resolving to Alpine 3.22, which ships GCC 15.2.0.

  • riscv64: GCC 15 ICE (segfault) while compiling deps/v8/src/execution/thread-id.cc, ~5 hours in
  • ppc64le: GCC 15 turns -Wtemplate-body diagnostics in deps/v8/third_party/highway/hwy/ops/ppc_vsx-inl.h into hard errors, failing at ~9 minutes

The v20.19.4 jobs pass because those code paths don't trigger either issue.

Pinned FROM alpine:3.21 (GCC 14.2.0) in the latest commit.

@alex
Copy link
Copy Markdown
Member

alex commented Apr 16, 2026 via email

@gounthar
Copy link
Copy Markdown
Author

Both riscv64 jobs failed for unrelated reasons:

  • v20.19.4: Docker TLS cert missing on the runner (open /docker-certs/client/ca.pem: no such file or directory), same transient runner issue as the first run
  • v24.5.0: Build was progressing normally but hit GitHub's default 6-hour job timeout - V8 on riscv64 just takes that long to compile

Added timeout-minutes: 480 in the latest commit to give the build room to finish. The ppc64le + v24.5.0 job passed in this run, so the alpine:3.21 fix is confirmed working there.

@reaperhulk
Copy link
Copy Markdown
Member

reaperhulk commented Apr 16, 2026

We've merged a separate ppc64le fix and I have another PR up that attempts to make this a bit less painful for building with some flags disabling node.js features we don't care about. Once that lands hopefully that'll drop the build time significantly for riscv.

@gounthar
Copy link
Copy Markdown
Author

gounthar commented Apr 16, 2026

That sounds promising; dropping ICU in particular should cut a lot of build time on riscv64. Once #755 lands I'll rebase this on top of it and pick up those flags.

@gounthar gounthar force-pushed the feat/riscv64-static-nodejs branch from 23ec431 to c5dce91 Compare April 17, 2026 13:45
gounthar added 5 commits May 1, 2026 18:52
Uses ubuntu-24.04-riscv runner and manylinux_2_39_riscv64 for testing
(manylinux2014 has no riscv64 image). Dockerfile-test updated to take
a full MANYLINUX_IMAGE arg instead of constructing from MANYLINUX_ARCH.

Signed-off-by: Bruno Verachten <gounthar@gmail.com>
binutils-gold is not available as a separate Alpine package on riscv64.
Standard binutils (ld.bfd) is sufficient for the static Node.js build.

Signed-off-by: Bruno Verachten <gounthar@gmail.com>
Node.js bundled OpenSSL hardcodes linux-x86_64 config paths and
passes -m64 even when --dest-cpu=riscv64 is set. --openssl-no-asm
skips arch-specific OpenSSL assembly and uses the generic config.

Signed-off-by: Bruno Verachten <gounthar@gmail.com>
alpine:latest now resolves to GCC 15.2.0 which causes two separate
failures when building Node.js v24.5.0:
- riscv64: GCC 15 internal compiler error (segfault) in V8's
  thread-id.cc after ~5 hours of build time
- ppc64le: GCC 15 treats highway's ppc_vsx-inl.h template-body
  diagnostics as errors, failing at ~9 minutes

Pin to alpine:3.21 (GCC 14.2.0) to restore stable builds across all
architectures.

Signed-off-by: Bruno Verachten <gounthar@gmail.com>
Node.js v24.5.0 on riscv64 takes more than 6 hours to compile V8,
hitting the default GitHub Actions timeout. Set timeout-minutes to
480 (8h) to let the build complete.

Signed-off-by: Bruno Verachten <gounthar@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

3 participants