From 3a5f8b1e80dd5e090cbd232d16204c85d11b8586 Mon Sep 17 00:00:00 2001
From: Ihor Aleksandrychiev <ihor.aleksandrychiev@northern.tech>
Date: Wed, 4 Nov 2026 20:39:01 +0200
Subject: [PATCH] Fixed building core from source on RHEL 8 and 9 in ci scripts

build_lmdb installed liblmdb into /usr/lib, which the runtime linker
does not search on lib64 distributions, so cf-key failed on RHEL 9.
It now installs into /usr/lib64 when that exists.

RHEL 8 ships pcre2 10.32, which lacks declarations libntech uses.
ensure_pcre2 reads them from libntech's AC_CHECK_DECLS line, and when
the system pcre2 lacks one, build_pcre2 builds the release pinned in
buildscripts deps-packaging into /opt/pcre2, which ci/configure.sh
then passes as --with-pcre2.

Ticket: ENT-14716
Changelog: none
Signed-off-by: Ihor Aleksandrychiev <ihor.aleksandrychiev@northern.tech>
---
 ci/configure.sh    |  5 +++++
 ci/dependencies.sh | 51 +++++++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 55 insertions(+), 1 deletion(-)

diff --git a/ci/configure.sh b/ci/configure.sh
index e47d02b6e12..067036da9f1 100755
--- a/ci/configure.sh
+++ b/ci/configure.sh
@@ -13,6 +13,11 @@ if [ -f /etc/os-release ]; then
   fi
 fi
 
+# ci/dependencies.sh builds a newer pcre2 into /opt/pcre2 where the system one is too old (rhel-8)
+if [ -d /opt/pcre2 ]; then
+    OPTS="$OPTS --with-pcre2=/opt/pcre2"
+fi
+
 if [ -n "$TERMUX_VERSION" ] || [ "$ID" = "alpine" ]; then
     OPTS="$OPTS --without-pam"
 fi
diff --git a/ci/dependencies.sh b/ci/dependencies.sh
index f3563ab676f..253a65f2c19 100755
--- a/ci/dependencies.sh
+++ b/ci/dependencies.sh
@@ -23,7 +23,12 @@ build_lmdb() {
         git clone --recursive --depth 1 https://github.com/LMDB/lmdb
         cd lmdb/libraries/liblmdb
         make
-        $GAINROOT make install prefix=/usr
+        # lmdb's Makefile defaults to /usr/lib which is not in the runtime linker path on lib64 distributions (rhel, suse)
+        libdir=/usr/lib
+        if [ -d /usr/lib64 ]; then
+            libdir=/usr/lib64
+        fi
+        $GAINROOT make install prefix=/usr libdir="$libdir"
     )
 }
 
@@ -40,6 +45,49 @@ build_librsync() {
     )
 }
 
+# Build pcre2 into /opt/pcre2, away from the system pcre2, and ci/configure.sh will use it from there.
+# Use the same pcre2 release and checksum as the CFEngine packages, from buildscripts deps-packaging.
+build_pcre2() {
+    if [ -f /opt/pcre2/include/pcre2.h ]; then
+        echo pcre2 already installed in /opt/pcre2, no-op.
+        return
+    fi
+    deps_url=https://raw.githubusercontent.com/cfengine/buildscripts/master/deps-packaging/pcre2
+    tmpdir="$(mktemp -d)"
+    echo building pcre2 in "$tmpdir"
+    (
+        cd "$tmpdir"
+        curl --fail --location --silent --show-error --output source "$deps_url"/source
+        curl --fail --location --silent --show-error --output distfiles "$deps_url"/distfiles
+        tarball="$(awk '{print $2}' distfiles)"
+        curl --fail --location --silent --show-error --output "$tarball" "$(cat source)$tarball"
+        sha256sum --check distfiles
+        tar --extract --gzip --file "$tarball"
+        cd "${tarball%.tar.gz}"
+        ./configure --prefix=/opt/pcre2 --libdir=/opt/pcre2/lib
+        make
+        $GAINROOT make install
+    )
+}
+
+# libntech's configure.ac lists the pcre2 declarations it needs (AC_CHECK_DECLS([PCRE2_...])).
+# Build a newer pcre2 when the system one lacks any of them (rhel-8 has 10.32).
+ensure_pcre2() {
+    decls="$(sed -n 's/^ *AC_CHECK_DECLS(\[\(PCRE2_[^]]*\)\].*/\1/p' "$(dirname "$0")"/../libntech/configure.ac | tr ',' ' ')"
+    if [ -z "$decls" ]; then
+        echo "AC_CHECK_DECLS([PCRE2_...]) not found in libntech/configure.ac"
+        exit 1
+    fi
+    system_macros="$(printf '#define PCRE2_CODE_UNIT_WIDTH 8\n#include <pcre2.h>\n' | gcc -E -dM -)"
+    for decl in $decls; do
+        if ! echo "$system_macros" | grep --quiet --word-regexp "#define $decl"; then
+            echo "system pcre2 $(pcre2-config --version) lacks $decl required by libntech"
+            build_pcre2
+            return
+        fi
+    done
+}
+
 # limited support here, focused on rhel-like on aarch64 which has no previous CFEngine version to leverage: ENT-13016
 if [ -f /etc/os-release ]; then
     source /etc/os-release
@@ -68,6 +116,7 @@ if [ -f /etc/os-release ]; then
                 build_lmdb
                 build_librsync
             fi
+            ensure_pcre2
         else
             echo "Unsupported version of redhat for $0"
             exit 1