2.35-r0: Missing symbols `__*_chk`

[syphernl]

When updating a Docker container to use glibc 2.35-r0 (previously used 2.34-r0) I am seeing the following errors during the container build:

#9 12.18 Error relocating /aws/dist/aws: __strcat_chk: symbol not found
#9 12.19 Error relocating /aws/dist/aws: __snprintf_chk: symbol not found
#9 12.19 Error relocating /aws/dist/aws: __vfprintf_chk: symbol not found
#9 12.19 Error relocating /aws/dist/aws: __realpath_chk: symbol not found
#9 12.19 Error relocating /aws/dist/aws: __memcpy_chk: symbol not found
#9 12.19 Error relocating /aws/dist/aws: __vsnprintf_chk: symbol not found
#9 12.19 Error relocating /aws/dist/aws: __strcpy_chk: symbol not found
#9 12.19 Error relocating /aws/dist/aws: __fprintf_chk: symbol not found

These errors weren't there with 2.34-r0 so it is likely something that has changed in 2.35-r0?

[TechRabb1t]

Can confirm this, we had to roll back to 2.34-r0 as well as otherwise our pipeline breaks

[hatchcanon]

Our developers have just noticed this as well. Thanks @TechRabb1t rolling back worked.

[j0rzsh]

Happened the same to me and roll back to 2.34-r0 as previous comments mentioned. Thanks!

[prantlf]

The same as #175 and #181.

[sgerrand]

You're referencing symbols which shouldn't be available in the C library at runtime. From the look of it they're in the glibc-dev package – have you tried installing that as well?

[chadlwilson]

I believe these symbols are all normally there and part of glibc, e.g

• https://refspecs.linuxfoundation.org/LSB_5.0.0/LSB-Core-generic/LSB-Core-generic/libc.html#TBL-LIBC-WIDE-INTS
• https://refspecs.linuxfoundation.org/LSB_5.0.0/LSB-Core-generic/LSB-Core-generic/baselib---strcat-chk-1.html
• https://refspecs.linuxfoundation.org/LSB_5.0.0/LSB-Core-generic/LSB-Core-generic/baselib---vsnprintf-chk-1.html

I agree with @prantlf that this seems to be essentially the same as the other issues. This seems to happen when

• things are still pointing to musl rather than the glibc package installed
• alongside installation of something like libc6-compat that "pretends" to be glibc and creates the /lib64/ld-linux-x86-64.so.2 symlink back to musl libc: https://pkgs.alpinelinux.org/contents?branch=edge&name=libc6-compat&arch=x86_64&repo=main. You get these errors with libc6-compat (and similar for Adelie's gcompat) because those compatibility libraries are incomplete and dont have implementations for all of these glibc-specific things. Which is kind of the reason some folks still use this alpine-glibc package :-)

Can replicate with the below where both glibc and glibc-bin are installed. Works fine on 2.34-r0.

docker build . --platform linux/amd64 --progress=plain

FROM alpine:3.17
RUN apk add --no-cache tzdata --virtual .build-deps curl binutils zstd && \
    GLIBC_VER="2.35-r1" && \
    ALPINE_GLIBC_REPO="https://github.com/sgerrand/alpine-pkg-glibc/releases/download" && \
    ZLIB_URL="https://archive.archlinux.org/packages/z/zlib/zlib-1%3A1.2.13-2-x86_64.pkg.tar.zst" && \
    ZLIB_SHA256=c4f394724b20b84d7304b23bbb58442b6ef53e5cbac89eb51e39d7f0a46abafd && \
    curl -LfsS https://alpine-pkgs.sgerrand.com/sgerrand.rsa.pub -o /etc/apk/keys/sgerrand.rsa.pub && \
    SGERRAND_RSA_SHA256="823b54589c93b02497f1ba4dc622eaef9c813e6b0f0ebbb2f771e32adf9f4ef2" && \
    echo "${SGERRAND_RSA_SHA256} */etc/apk/keys/sgerrand.rsa.pub" | sha256sum -c - && \
    curl -LfsS ${ALPINE_GLIBC_REPO}/${GLIBC_VER}/glibc-${GLIBC_VER}.apk > /tmp/glibc-${GLIBC_VER}.apk && \
    apk add --no-cache --force-overwrite /tmp/glibc-${GLIBC_VER}.apk && \
#    mkdir -p /lib64 && ln -sf /usr/glibc-compat/lib/ld-linux-x86-64.so.2 /lib64/ld-linux-x86-64.so.2 && \
    curl -LfsS ${ZLIB_URL} -o /tmp/libz.tar.zst && \
    echo "${ZLIB_SHA256} */tmp/libz.tar.zst" | sha256sum -c - && \
    curl -LfsS ${ALPINE_GLIBC_REPO}/${GLIBC_VER}/glibc-bin-${GLIBC_VER}.apk > /tmp/glibc-bin-${GLIBC_VER}.apk && \
    apk add --no-cache --force-overwrite /tmp/glibc-bin-${GLIBC_VER}.apk && \
    mkdir /tmp/libz && \
    zstd -d /tmp/libz.tar.zst --output-dir-flat /tmp && \
    tar -xf /tmp/libz.tar -C /tmp/libz && \
    curl --silent --fail --location https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip --output /tmp/awscliv2.zip && \
    unzip -q /tmp/awscliv2.zip && \
    ls -al /lib64 && /aws/dist/aws --version

2.34.r0 (OK)

#5 17.03 total 8
#5 17.03 drwxr-xr-x    2 root     root          4096 Apr 14 04:26 .
#5 17.03 drwxr-xr-x    1 root     root          4096 Apr 14 04:26 ..
#5 17.03 lrwxrwxrwx    1 root     root            42 Apr 14 04:26 ld-linux-x86-64.so.2 -> /usr/glibc-compat/lib/ld-linux-x86-64.so.2
#5 19.29 aws-cli/2.11.12 Python/3.11.2 Linux/5.15.82-0-virt exe/x86_64.alpine.3 prompt/off
#5 DONE 19.6s

2.35-r1 (Not OK)

#6 52.36 lrwxrwxrwx    1 root     root            26 Apr 14 04:37 ld-linux-x86-64.so.2 -> /lib/libc.musl-x86_64.so.1
#6 52.36 Error relocating /aws/dist/aws: __strcat_chk: symbol not found
#6 52.36 Error relocating /aws/dist/aws: __snprintf_chk: symbol not found
#6 52.36 Error relocating /aws/dist/aws: __vfprintf_chk: symbol not found
#6 52.36 Error relocating /aws/dist/aws: __realpath_chk: symbol not found
#6 52.36 Error relocating /aws/dist/aws: __strdup: symbol not found
#6 52.36 Error relocating /aws/dist/aws: __memcpy_chk: symbol not found
#6 52.36 Error relocating /aws/dist/aws: __vsnprintf_chk: symbol not found
#6 52.36 Error relocating /aws/dist/aws: __strcpy_chk: symbol not found
#6 52.36 Error relocating /aws/dist/aws: __fprintf_chk: symbol not found

This seems to be happening with 2.35-r1 more commonly due to the combination of

1) glibc-bin having added libc6-compat added as a dependency https://github.com/sgerrand/alpine-pkg-glibc/blob/0d226ba64a85574fd22ddc626fda2a51af18e18b/APKBUILD#L33-L34

2) And the lib64 symlink being gone

https://github.com/sgerrand/alpine-pkg-glibc/commit/ddfe092f3d91c19f6cf8cb9f2938e088db4bfa8f#diff-9d02a9f5b32ef57f03edeea2673bf874facd3f51789e70184f4488e4fe89541cL17-R18

These issues seem to have been partially addressed in https://github.com/sgerrand/alpine-pkg-glibc/pull/180 which got stuck (and still not sure why it makes sense to install libc6-compat alongside glibc, since generally the intention of installing "real" glibc is to NOT rely on musl<->glibc compatibility layers)

Hope this helps clarify.

[lockieluke]

still does not work

ImportError: Error relocating /usr/local/bin/../lib/libcurl-impersonate-chrome.so.4: __memcpy_chk: symbol not found