fix(quic): statically link MsQuic for Alpine nodes [CI]

packaging/container/Agent.NativeBuild.Containerfile

@@ -1,35 +1,19 @@
-# Run all build commands on the native amd64 runner. AotAnywhere cross-links
-# the NativeAOT output, so an ARM64 build never needs QEMU.
-FROM --platform=linux/arm64 alpine:3.24 AS arm64-apk-keys
-
-FROM --platform=linux/amd64 alpine:3.24 AS runtime-libs
-ARG NODE_RID=linux-musl-x64
-COPY --from=arm64-apk-keys /usr/share/apk/keys/ /tmp/apk-keys-arm64/
-RUN set -eu; \
-    apk_arch=x86_64; \
-    case "$NODE_RID" in *arm64) apk_arch=aarch64 ;; esac; \
-    mkdir -p /tmp/runtime-apks /tmp/runtime-root /out/runtime; \
-    if [ "$apk_arch" = aarch64 ]; then \
-      apk --keys-dir /tmp/apk-keys-arm64 --arch "$apk_arch" fetch --recursive --output /tmp/runtime-apks libmsquic numactl lttng-ust zlib; \
-    else \
-      apk --arch "$apk_arch" fetch --recursive --output /tmp/runtime-apks libmsquic numactl lttng-ust zlib; \
-    fi; \
-    set -- /tmp/runtime-apks/*.apk; \
-    [ -f "$1" ]; \
-    for package do tar -xzf "$package" -C /tmp/runtime-root; done; \
-    cp -a /tmp/runtime-root/usr/lib/*.so* /out/runtime/
-
+# AotAnywhere cross-links both Alpine architectures on the native amd64 runner.
 FROM --platform=linux/amd64 mcr.microsoft.com/dotnet/sdk:10.0-noble-aot AS build
 
 WORKDIR /src/backend
 COPY restore/backend/ ./
 ARG NODE_RID=linux-musl-x64
 ENV NUGET_PACKAGES=/root/.nuget/packages
-# restore 也要带 PublishAot：不然不会还原 ILCompiler，之后 --no-restore 的发布就悄悄变成「裁剪过的框架依赖程序」
-RUN dotnet restore agent/src/MoShiro.Agent -r "$NODE_RID" -p:PublishAot=true -p:UseAotAnywhere=true --artifacts-path /artifacts \
-    && dotnet restore fleet/tools/fleet-enroll -r "$NODE_RID" -p:PublishAot=true -p:UseAotAnywhere=true --artifacts-path /artifacts
+RUN dotnet restore agent/src/MoShiro.Agent -r "$NODE_RID" -p:PublishAot=true -p:UseAotAnywhere=true \
+    -p:StaticMsQuic=true -p:StaticExecutable=true -p:RuntimeFrameworkVersion=10.0.12 \
+    -p:InvariantGlobalization=true --artifacts-path /artifacts \
+    && dotnet restore fleet/tools/fleet-enroll -r "$NODE_RID" -p:PublishAot=true -p:UseAotAnywhere=true \
+    -p:StaticMsQuic=true -p:StaticExecutable=true -p:RuntimeFrameworkVersion=10.0.12 -p:InvariantGlobalization=true \
+    --artifacts-path /artifacts
 
 COPY source/backend/ ./
+COPY source/packaging/native/msquic/ /src/packaging/native/msquic/
 # 构建信息：CI 通过 --build-arg 传入；不传就是空（放在 restore 之后，每次构建都变的时间不会让依赖还原的缓存失效）
 ARG MOSHIRO_TAG=
 ARG MOSHIRO_COMMIT=
@@ -37,16 +21,21 @@ ARG MOSHIRO_BUILT_AT=
 ENV MOSHIRO_TAG=$MOSHIRO_TAG MOSHIRO_COMMIT=$MOSHIRO_COMMIT MOSHIRO_BUILT_AT=$MOSHIRO_BUILT_AT
 RUN dotnet publish agent/src/MoShiro.Agent -m:3 -c Release -r "$NODE_RID" \
     --self-contained true --no-restore -p:PublishAot=true -p:UseAotAnywhere=true \
-    -p:UseAppHost=true -p:StripSymbols=true \
+    -p:StaticMsQuic=true -p:StaticExecutable=true -p:RuntimeFrameworkVersion=10.0.12 \
+    -p:InvariantGlobalization=true -p:UseAppHost=true -p:StripSymbols=true \
     -p:DebugType=none -p:DebugSymbols=false --artifacts-path /artifacts -o /out/agent \
     && dotnet publish fleet/tools/fleet-enroll -m:3 -c Release -r "$NODE_RID" \
     --self-contained true --no-restore -p:PublishAot=true -p:UseAotAnywhere=true \
+    -p:StaticMsQuic=true -p:StaticExecutable=true -p:RuntimeFrameworkVersion=10.0.12 -p:InvariantGlobalization=true \
     -p:UseAppHost=true -p:StripSymbols=true \
     -p:DebugType=none -p:DebugSymbols=false --artifacts-path /artifacts -o /out/enroll
-# 原生程序有几 MB；几十 KB 的是只会去找 .dll 的启动器
 RUN test -x /out/agent/moshiro-agent && test -x /out/enroll/fleet-enroll \
-    && test "$(stat -c%s /out/agent/moshiro-agent)" -gt 2000000 && test "$(stat -c%s /out/enroll/fleet-enroll)" -gt 2000000
-COPY --from=runtime-libs /out/runtime/ /out/runtime/
+    && test "$(stat -c%s /out/agent/moshiro-agent)" -gt 2000000 \
+    && test "$(stat -c%s /out/enroll/fleet-enroll)" -gt 2000000 \
+    && ! readelf -l /out/agent/moshiro-agent | grep -q INTERP \
+    && ! readelf -d /out/agent/moshiro-agent 2>&1 | grep -q NEEDED \
+    && ! readelf -l /out/enroll/fleet-enroll | grep -q INTERP \
+    && ! readelf -d /out/enroll/fleet-enroll 2>&1 | grep -q NEEDED
 
 FROM mcr.microsoft.com/dotnet/runtime-deps:10.0-alpine
 
@@ -58,12 +47,10 @@ LABEL org.opencontainers.image.title="MoShiro Agent" \
 
 COPY --chown=1654:1654 --from=build /out/agent/moshiro-agent /usr/local/bin/moshiro-agent
 COPY --chown=1654:1654 --from=build /out/enroll/fleet-enroll /usr/local/bin/fleet-enroll
-COPY --from=build /out/runtime/ /usr/local/bin/
 COPY --chown=1654:1654 config/ /etc/moshiro/
 COPY --chown=1654:1654 --chmod=0755 entrypoint.sh /usr/local/bin/moshiro-entrypoint
 
 ENV MOSHIRO_ROLE=agent
-ENV LD_LIBRARY_PATH=/usr/local/bin
 USER 1654:1654
 WORKDIR /etc/moshiro
 VOLUME ["/etc/moshiro"]