From 3df9ad631bed8741cc0f0293406d3e4e3daec875 Mon Sep 17 00:00:00 2001
From: Filip Leonarski <filip.leonarski@psi.ch>
Date: Mon, 13 Jul 2026 19:26:45 +0200
Subject: [PATCH] docker: fix build_in_rocky9.sh shed-check for RHEL9's
 glib/selinux sources

The old check flagged glib/selinux/pcre as failures, inheriting a rocky8-host
assumption (glib is Qt-only, selinux is dbus-only) that does not hold on RHEL9:

- libglib is pulled by the system harfbuzz/fontconfig/freetype text stack
  (glib-linked on RHEL9), not by Qt. QT_FEATURE_glib=OFF is honoured (Qt's
  enabled_features has no glib) but cannot drop the font stack's libglib.
- libselinux/libpcre2-8 come from the krb5/GSSAPI stack (libgssapi_krb5 ->
  libselinux) that static curl links for auth -- kept for the reverse-proxy
  Kerberos plan, same bucket as libcrypto.

So hard-fail only on the dbus/systemd tail we actually remove (libdbus/
libsystemd/zstd/lz4/cap/gcrypt/gpg-error), and just report glib/selinux as
expected residuals with the reason. Verified in the rocky9 image: that tail is
gone; the survivors trace to the font stack and krb5.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 docker/build_in_rocky9.sh | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/docker/build_in_rocky9.sh b/docker/build_in_rocky9.sh
index 71aa71b0..6f02a7a9 100755
--- a/docker/build_in_rocky9.sh
+++ b/docker/build_in_rocky9.sh
@@ -42,12 +42,20 @@ docker run --rm \
 
         echo "===================== ldd jfjoch_viewer ====================="
         ldd "$bin" | sort
-        echo "===================== shed-lib check ========================"
-        # These should ALL be gone now (libpcre2-16 is Qt s own and legitimately stays).
-        shed="dbus|systemd|zstd|lz4|selinux|glib|gthread|libpcre\.|libpcre2-8|gcrypt|gpg-error"
-        if ldd "$bin" | grep -Ei "$shed"; then
-            echo ">>> UNEXPECTED: the above libs are still linked"
+        echo "========== dbus/systemd tail (what the static libdbus removes) =========="
+        # These only ever entered via the system libdbus-1.so -> libsystemd chain, so they MUST be gone.
+        tail_re="libdbus-1|libsystemd|libzstd|liblz4|libgcrypt|libgpg-error|libcap\."
+        if ldd "$bin" | grep -Ei "$tail_re"; then
+            echo ">>> FAIL: the dbus/systemd tail is still linked"
         else
-            echo ">>> CLEAN: dbus / systemd / glib / selinux tail all gone"
+            echo ">>> OK: libdbus/libsystemd/zstd/lz4/cap/gcrypt/gpg-error all gone"
         fi
+        echo "========== residual glib/selinux (expected on RHEL9, NOT from us) =========="
+        # libglib here is pulled by the system harfbuzz/fontconfig/freetype text stack (glib-linked on
+        # RHEL9), not by Qt -- QT_FEATURE_glib=OFF is honoured (Qt is off the glib event loop) but cannot
+        # drop the font-stack glib. libselinux/libpcre2-8 come from the krb5/GSSAPI stack that static
+        # curl links for auth (kept for the reverse-proxy Kerberos plan) -- same bucket as libcrypto.
+        # Shedding these would mean static-linking the whole font stack / dropping krb5. (libpcre2-16 is
+        # Qt-owned and legitimately stays.)
+        ldd "$bin" | grep -Ei "libglib|gthread|selinux|libpcre\.|libpcre2-8" || echo "(none)"
     '