From 42dd07cfd33f40fd6bf204c86c9f38a555f236cb Mon Sep 17 00:00:00 2001
From: Alex Gaynor <alex.gaynor@gmail.com>
Date: Sun, 9 Feb 2025 12:25:34 -0500
Subject: [PATCH 1/4] build armv7l images (#669)

* build armv7l images

* Update build-docker-images.yml

* Don't use `enable-ec_nistp_64_gcc_128` on armv7l

* hack?

* We are an armv4 build

(cherry picked from commit 519b16bd0803ea22dbd0a4525c641060581c0215)
---
 build-scripts/manylinux-container-image/install_openssl.sh | 5 +++++
 build-scripts/manylinux-container-image/openssl-version.sh | 1 +
 2 files changed, 6 insertions(+)

diff --git a/build-scripts/manylinux-container-image/install_openssl.sh b/build-scripts/manylinux-container-image/install_openssl.sh
index 4db36ef0e..577f2e838 100755
--- a/build-scripts/manylinux-container-image/install_openssl.sh
+++ b/build-scripts/manylinux-container-image/install_openssl.sh
@@ -21,6 +21,11 @@ BUILD_FLAGS="$OPENSSL_BUILD_FLAGS"
 if [[ "$1" =~ '^manylinux1_.*$' ]]; then
   PATH=/opt/perl/bin:$PATH
 fi
+# Can't use `$(uname -m) = "armv7l"` because that returns what kernel we're
+# using, and we build for armv7l with an ARM64 host.
+if [ "$(readelf -h /proc/self/exe | grep -o 'Machine:.* ARM')" ]; then
+    BUILD_FLAGS="$OPENSSL_BUILD_FLAGS_ARMV7L"
+fi
 if [ "$(readelf -h /proc/self/exe | grep -o 'Machine:.* S/390')" ]; then
     BUILD_FLAGS="$OPENSSL_BUILD_FLAGS_S390X"
     export CFLAGS="$CFLAGS -march=z10"
diff --git a/build-scripts/manylinux-container-image/openssl-version.sh b/build-scripts/manylinux-container-image/openssl-version.sh
index e9d5e95f1..df84da34c 100644
--- a/build-scripts/manylinux-container-image/openssl-version.sh
+++ b/build-scripts/manylinux-container-image/openssl-version.sh
@@ -3,5 +3,6 @@ export OPENSSL_SHA256="344d0a79f1a9b08029b0744e2cc401a43f9c90acd1044d09a530b4885
 # We need a base set of flags because on Windows using MSVC
 # enable-ec_nistp_64_gcc_128 doesn't work since there's no 128-bit type
 export OPENSSL_BUILD_FLAGS_WINDOWS="no-ssl3 no-ssl3-method no-zlib no-shared no-module no-comp no-dynamic-engine no-apps no-docs no-sm2-precomp no-atexit"
+export OPENSSL_BUILD_FLAGS_ARMV7L="linux-armv4 ${OPENSSL_BUILD_FLAGS_WINDOWS}"
 export OPENSSL_BUILD_FLAGS_S390X="${OPENSSL_BUILD_FLAGS_WINDOWS}"
 export OPENSSL_BUILD_FLAGS="${OPENSSL_BUILD_FLAGS_WINDOWS} enable-ec_nistp_64_gcc_128"

From b5f0964a9618521ddfdb4830d7ee1372717dcf89 Mon Sep 17 00:00:00 2001
From: Sviatoslav Sydorenko <webknjaz@redhat.com>
Date: Fri, 9 May 2025 16:32:40 +0200
Subject: [PATCH 2/4] =?UTF-8?q?=F0=9F=A7=AA=20Pre-build=20armv7l=20images?=
 =?UTF-8?q?=20for=20building=20wheels?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These are relatively recent upstream and only exist for glibc 2.31.
---
 .../workflows/build-manylinux-container-images.yml | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/build-manylinux-container-images.yml b/.github/workflows/build-manylinux-container-images.yml
index 8c67d4f45..fb5292797 100644
--- a/.github/workflows/build-manylinux-container-images.yml
+++ b/.github/workflows/build-manylinux-container-images.yml
@@ -38,17 +38,15 @@ jobs:
         - ARCH: ppc64le
         # Build containers for s390x
         - ARCH: s390x
-        # There are no base containers for these archs
-        # at https://quay.io/organization/pypa.
-        # Build containers for armv7l (ARM v7)
-        # - ARCH: armv7l
-        #   QEMU_ARCH: arm/v7
-        # Build containers for ppc64
-        # - ARCH: ppc64
         YEAR:
         - _2_24
         - _2_28
         - _2_34
+        include:
+        - IMAGE:
+            ARCH: armv7l
+            HOST_OS: ubuntu-24.04-arm
+          YEAR: _2_31  # There are no base images prior to 2.31 for this arch
 
     env:
       LIBSSH_VERSION: 0.11.1
@@ -78,7 +76,7 @@ jobs:
         Set up QEMU ${{ env.QEMU_ARCH }} arch emulation
         with Podman
       if: >-
-        !contains(fromJSON('["aarch64", "amd64"]'), env.QEMU_ARCH)
+        !contains(fromJSON('["aarch64", "amd64", "armv7l"]'), env.QEMU_ARCH)
       run: >
         sudo podman run
         --rm --privileged

From c8fed62a456f4e20528378aaa4266b5c8c8407c3 Mon Sep 17 00:00:00 2001
From: Sviatoslav Sydorenko <webknjaz@redhat.com>
Date: Tue, 17 Jun 2025 19:16:23 +0200
Subject: [PATCH 3/4] Build libssh without examples

Apparently, building the examples somehow attempts linking against
`libdl` that it can't locate. But we don't need them regardless.
---
 build-scripts/manylinux-container-image/install_libssh.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/build-scripts/manylinux-container-image/install_libssh.sh b/build-scripts/manylinux-container-image/install_libssh.sh
index 5fa161dbd..baa8e85b7 100755
--- a/build-scripts/manylinux-container-image/install_libssh.sh
+++ b/build-scripts/manylinux-container-image/install_libssh.sh
@@ -104,6 +104,7 @@ cmake "${LIB_CLONE_DIR}" \
     -DCLIENT_TESTING=OFF \
     -DSERVER_TESTING=OFF \
     -DUNIT_TESTING=OFF \
+    -DWITH_EXAMPLES=OFF \
     -DWITH_GSSAPI=ON \
     -DWITH_SERVER=OFF \
     -DWITH_PCAP=OFF \

From e2931a5696b045734bf73bcf0e813ce8ae41c39f Mon Sep 17 00:00:00 2001
From: Sviatoslav Sydorenko <webknjaz@redhat.com>
Date: Tue, 17 Jun 2025 19:55:36 +0200
Subject: [PATCH 4/4] =?UTF-8?q?=F0=9F=93=9D=20Add=20a=20change=20note=20fo?=
 =?UTF-8?q?r=20PR=20#740?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 docs/changelog-fragments/740.contrib.rst | 3 +++
 1 file changed, 3 insertions(+)
 create mode 100644 docs/changelog-fragments/740.contrib.rst

diff --git a/docs/changelog-fragments/740.contrib.rst b/docs/changelog-fragments/740.contrib.rst
new file mode 100644
index 000000000..815a4d99c
--- /dev/null
+++ b/docs/changelog-fragments/740.contrib.rst
@@ -0,0 +1,3 @@
+The CI infrastructure now produces ``manylinux_2_31_armv7l`` base images
+with ``libssh`` and ``openssl`` pre-built -- by :user:`Jakuje` and
+:user:`webknjaz`.