From f9e136ad87ab74a7fbd98a25c77d25367cb942fe Mon Sep 17 00:00:00 2001
From: Matteo Benedetto <me@enne2.net>
Date: Sun, 8 Mar 2026 16:10:09 +0100
Subject: [PATCH] build: add Ubuntu 22.04 portable binary pipeline

---
 Dockerfile.build          | 32 ++++++++++++++++++++++++++++
 scripts/build-binaries.sh | 44 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 76 insertions(+)
 create mode 100644 Dockerfile.build
 create mode 100755 scripts/build-binaries.sh

diff --git a/Dockerfile.build b/Dockerfile.build
new file mode 100644
index 0000000..aed27b6
--- /dev/null
+++ b/Dockerfile.build
@@ -0,0 +1,32 @@
+# Build image for Cellar binaries, targeting glibc 2.35 (Ubuntu 22.04).
+# This keeps the binaries compatible with older systems than the host Fedora
+# build, while still providing GTK4/libadwaita packages.
+FROM ubuntu:22.04
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+# ── System deps ──────────────────────────────────────────────────────────────
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    python3 python3-dev python3-pip python3-venv \
+    # GTK4 / Adwaita
+    libgtk-4-dev libadwaita-1-dev python3-gi python3-gi-cairo \
+    gir1.2-gtk-4.0 gir1.2-adw-1 libglib2.0-dev \
+    # Misc build deps
+    build-essential git libffi-dev libssl-dev \
+    # UPX
+    upx-ucl \
+    # binutils for strip
+    binutils \
+    && rm -rf /var/lib/apt/lists/*
+
+# ── Python environment ───────────────────────────────────────────────────────
+RUN python3 -m venv --system-site-packages /opt/venv
+ENV PATH="/opt/venv/bin:$PATH"
+RUN python -m pip install --no-cache-dir --upgrade pip setuptools wheel \
+    && python -m pip install --no-cache-dir pyinstaller requests
+
+# ── Build ─────────────────────────────────────────────────────────────────────
+WORKDIR /src
+COPY . .
+
+CMD ["/bin/bash", "/src/scripts/build-binaries.sh"]
diff --git a/scripts/build-binaries.sh b/scripts/build-binaries.sh
new file mode 100755
index 0000000..219f2ba
--- /dev/null
+++ b/scripts/build-binaries.sh
@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+export HOME="${HOME:-/tmp}"
+export PYINSTALLER_CONFIG_DIR="${PYINSTALLER_CONFIG_DIR:-/tmp/pyinstaller-cache}"
+
+cd /src
+
+echo "==> Python"
+python --version
+echo
+
+echo "==> Cleaning previous artifacts"
+rm -rf build dist
+mkdir -p dist
+echo
+
+echo "==> Building cellar-cli"
+python -m PyInstaller cellar-cli.spec --clean --noconfirm
+echo
+
+echo "==> Building cellar GTK"
+python -m PyInstaller cellar.spec --clean --noconfirm
+echo
+
+echo "==> Built files"
+ls -lh dist
+echo
+
+show_glibc_requirement() {
+    local binary="$1"
+    echo "-- $(basename "$binary")"
+    objdump -p "$binary" 2>/dev/null \
+        | grep -oE 'GLIBC_[0-9]+\.[0-9]+' \
+        | sort -Vu \
+        | tail -1
+}
+
+echo "==> GLIBC requirements"
+show_glibc_requirement dist/cellar-cli
+show_glibc_requirement dist/cellar
+echo
+
+echo "==> Done"
\ No newline at end of file