feat: enhance GDBM and Python build scripts for compatibility

- Updated build_gdbm.sh to include --enable-libgdbm-compat, allowing Python's _dbm module to build against GDBM.
- Modified build_python_py2.sh and build_python.sh to specify --with-dbmliborder=gdbm:ndbm, ensuring proper library order during Python builds.
- Enhanced rpath-patcher.sh to cover all ELF files, improving the handling of shared libraries and maintaining install relocatability.

Author: scc-tw

common/build/deplib/build_gdbm.sh

@@ -8,5 +8,10 @@ wget https://ftp.gnu.org/gnu/gdbm/gdbm-${GDBM_VERSION}.tar.gz
 tar -xzf gdbm-${GDBM_VERSION}.tar.gz && cd gdbm-${GDBM_VERSION}
 
 export CFLAGS="${CFLAGS} -fPIC"
-./configure --prefix=/opt/shared_libraries
+# --enable-libgdbm-compat exposes gdbm-ndbm.h and libgdbm_compat.so so
+# Python's _dbm module (driven by --with-dbmliborder=gdbm:ndbm) can build
+# against gdbm. Without it _dbm shows up in the "failed" list at the end
+# of `make` — `dbm.gnu` still works (that uses _gdbm), but `dbm.ndbm` and
+# the plain `dbm` dispatch path both need this.
+./configure --prefix=/opt/shared_libraries --enable-libgdbm-compat
 make -j $(nproc) && make install

common/build/deplib/build_python.sh

@@ -21,7 +21,15 @@ export LOCAL_INCLUDES="${LOCAL_INCLUDES} -I/opt/shared_libraries/include/" # som
 
 export CFLAGS="${CFLAGS} ${LOCAL_INCLUDES}"
 export CPPFLAGS="${CPPFLAGS} ${LOCAL_INCLUDES}"
-export LDFLAGS="${LDFLAGS} -L/opt/shared_libraries/lib -lffi"
+# Bake an absolute rpath to /opt/shared_libraries/lib into every C extension
+# linked during this build. --with-openssl-rpath=auto only handles OpenSSL;
+# other extensions (_curses→libtinfo, _sqlite3→libsqlite3, readline→libreadline,
+# _ctypes→libffi, …) have no CPython-level flag to set their rpath, so
+# without this the build's own `sysconfig --generate-posix-vars` import test
+# fails with "Error loading shared library libtinfo.so.6: No such file".
+# rpath-patcher.sh rewrites this to $ORIGIN-relative after packing, so the
+# final image stays relocatable.
+export LDFLAGS="${LDFLAGS} -L/opt/shared_libraries/lib -lffi -Wl,-rpath,/opt/shared_libraries/lib"
 
 # Free-threaded build (PEP 703 / "no-GIL"), added in Python 3.13. Enabled
 # per-Dockerfile with `ENV DISABLE_GIL=1` in the python_builder stage. The
@@ -37,6 +45,7 @@ fi
 ./configure --build="$gnuArch" --enable-loadable-sqlite-extensions \
     --enable-optimizations --enable-option-checking=fatal --enable-shared \
     --with-lto --with-system-expat --without-ensurepip \
+    --with-dbmliborder=gdbm:ndbm \
     --prefix="$INSTALL_PREFIX" --with-openssl-rpath=auto \
     --with-openssl=/opt/shared_libraries \
     $CONFIGURE_EXTRA

common/build/deplib/build_python_py2.sh

@@ -54,6 +54,7 @@ export LDFLAGS="${LDFLAGS} -L/opt/shared_libraries/lib -Wl,-rpath,/opt/shared_li
     --enable-option-checking=fatal \
     --enable-shared \
     --enable-unicode=ucs4 \
+    --with-dbmliborder=gdbm:ndbm \
     --prefix="$INSTALL_PREFIX"
 
 make -j $(nproc)

common/build/wrappers/rpath-patcher.sh

@@ -45,13 +45,21 @@ patch_elf_rpath() {
     shared_lib_dir=/opt/python/shared_libraries/lib
     python_lib_dir=/opt/python/lib
 
-    # Cover both `bin/` binaries (python*-real, pip*-real, pure C helpers
-    # like python-config) and `lib-dynload/` C extensions (_ssl.so,
-    # _hashlib.so, _ctypes.so, …). lib-dynload/*.so isn't marked
-    # executable, so drop the -executable filter and let the ELF-magic
-    # grep do the filtering instead.
+    # Cover every ELF we ship:
+    #   * `bin/*`              python*-real, pip*-real, python-config, …
+    #   * `*/lib-dynload/*`    C extensions (_ssl, _curses, _ctypes, …)
+    #   * `*.so` / `*.so.*`    libpython3.N.so.1.0 and any other shared libs
+    #                          (libpython picks up the LDFLAGS rpath too, so
+    #                          we rewrite it here to keep the install
+    #                          relocatable).
+    # Name-based pre-filter avoids running `file` on thousands of .py files
+    # under lib/python*/; the ELF-magic grep still filters anything that
+    # slips through.
     find /opt/python -type f \
-         \( -path "*/bin/*" -o -path "*/lib-dynload/*" \) \
+         \( -path "*/bin/*" \
+            -o -path "*/lib-dynload/*" \
+            -o -name "*.so" \
+            -o -name "*.so.*" \) \
          -exec file {} \; \
         | grep 'ELF' | grep 'dynamically linked' | cut -d: -f1 \
         | while read -r elf_file; do