fix(quic): statically link MsQuic for Alpine nodes [CI]

backend/agent/src/MoShiro.Agent/MoShiro.Agent.csproj

@@ -23,4 +23,6 @@
   <Import Project="Sdk.targets" Sdk="Microsoft.NET.Sdk" />
   <Import Project="Sdk.targets" Sdk="StuDev.AotAnywhere"
           Condition="'$(UseAotAnywhere)' == 'true'" />
+  <Import Project="..\..\..\shared\MoShiro.Measurement\StaticMsQuic.targets"
+          Condition="'$(StaticMsQuic)' == 'true'" />
 </Project>

backend/fleet/tools/fleet-enroll/fleet-enroll.csproj

@@ -33,4 +33,6 @@
   <Import Project="Sdk.targets" Sdk="Microsoft.NET.Sdk" />
   <Import Project="Sdk.targets" Sdk="StuDev.AotAnywhere"
           Condition="'$(UseAotAnywhere)' == 'true'" />
+  <Import Project="..\..\..\shared\MoShiro.Measurement\StaticMsQuic.targets"
+          Condition="'$(StaticMsQuic)' == 'true'" />
 </Project>

backend/probe/src/MoShiro.Probe/MoShiro.Probe.csproj

@@ -23,4 +23,6 @@
   <Import Project="Sdk.targets" Sdk="Microsoft.NET.Sdk" />
   <Import Project="Sdk.targets" Sdk="StuDev.AotAnywhere"
           Condition="'$(UseAotAnywhere)' == 'true'" />
+  <Import Project="..\..\..\shared\MoShiro.Measurement\StaticMsQuic.targets"
+          Condition="'$(StaticMsQuic)' == 'true'" />
 </Project>

backend/shared/MoShiro.Measurement/MoShiro.Measurement.csproj

@@ -3,6 +3,9 @@
     <IsAotCompatible>true</IsAotCompatible>
     <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
   </PropertyGroup>
+  <PropertyGroup Condition="'$(StaticMsQuic)' == 'true'">
+    <DefineConstants>$(DefineConstants);MOSHIRO_STATIC_MSQUIC</DefineConstants>
+  </PropertyGroup>
   <ItemGroup>
     <InternalsVisibleTo Include="MoShiro.Measurement.Tests" />
     <AdditionalFiles Include="$(MSBuildThisFileDirectory)../../BannedSymbols.Node.txt" />

backend/shared/MoShiro.Measurement/Net/MsQuicRuntime.cs

@@ -7,11 +7,13 @@ internal static class MsQuicRuntime
 {
     private const uint ApiVersion = 2;
     private static readonly object s_gate = new();
+#if !MOSHIRO_STATIC_MSQUIC
     private static nint s_library;
-    private static nint s_api;
     private static OpenVersionDelegate? s_open;
     private static CloseDelegate? s_close;
     private static readonly List<nint> s_supportLibraries = [];
+#endif
+    private static nint s_api;
 
     public static nint Api
     {
@@ -19,6 +21,19 @@ internal static class MsQuicRuntime
         {
             lock (s_gate)
             {
+#if MOSHIRO_STATIC_MSQUIC
+                if (s_api == 0)
+                {
+                    int status = OpenStatic(ApiVersion, out s_api);
+                    if (status != 0 || s_api == 0)
+                    {
+                        s_api = 0;
+                        throw new InvalidOperationException($"MsQuic API v{ApiVersion} could not be opened (status {status}).");
+                    }
+                }
+
+                return s_api;
+#else
                 if (s_api != 0)
                 {
                     return s_api;
@@ -57,6 +72,7 @@ internal static class MsQuicRuntime
                 }
 
                 return s_api;
+#endif
             }
         }
     }
@@ -65,6 +81,13 @@ internal static class MsQuicRuntime
     {
         lock (s_gate)
         {
+#if MOSHIRO_STATIC_MSQUIC
+            if (s_api != 0)
+            {
+                CloseStatic(s_api);
+                s_api = 0;
+            }
+#else
             if (s_api != 0)
             {
                 s_close!(s_api);
@@ -83,9 +106,11 @@ internal static class MsQuicRuntime
             }
 
             s_supportLibraries.Clear();
+#endif
         }
     }
 
+#if !MOSHIRO_STATIC_MSQUIC
     private static void LoadBundledSupportLibraries()
     {
         if (OperatingSystem.IsLinux())
@@ -106,13 +131,22 @@ internal static class MsQuicRuntime
             s_supportLibraries.Add(handle);
         }
     }
+#else
+    [DllImport("__Internal", EntryPoint = "MsQuicOpenVersion", CallingConvention = CallingConvention.Cdecl)]
+    private static extern int OpenStatic(uint version, out nint api);
+
+    [DllImport("__Internal", EntryPoint = "MsQuicClose", CallingConvention = CallingConvention.Cdecl)]
+    private static extern void CloseStatic(nint api);
+#endif
 
     public static T Function<T>(int index)
         where T : Delegate => Marshal.GetDelegateForFunctionPointer<T>(Marshal.ReadIntPtr(Api, checked(index * IntPtr.Size)));
 
+#if !MOSHIRO_STATIC_MSQUIC
     [UnmanagedFunctionPointer(CallingConvention.Cdecl)]
     private delegate int OpenVersionDelegate(uint version, out nint api);
 
     [UnmanagedFunctionPointer(CallingConvention.Cdecl)]
     private delegate void CloseDelegate(nint api);
+#endif
 }

backend/shared/MoShiro.Measurement/StaticMsQuic.targets

@@ -0,0 +1,32 @@
+<Project>
+  <PropertyGroup>
+    <_MoShiroStaticMsQuicLibrary>$(MSBuildThisFileDirectory)../../../packaging/native/msquic/$(RuntimeIdentifier)/libmsquic.a</_MoShiroStaticMsQuicLibrary>
+  </PropertyGroup>
+
+  <PropertyGroup Condition="$(RuntimeIdentifier.StartsWith('linux-musl-'))">
+    <StaticExecutable>true</StaticExecutable>
+    <InvariantGlobalization>true</InvariantGlobalization>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <NativeLibrary Include="$(_MoShiroStaticMsQuicLibrary)" />
+    <DirectPInvoke Include="__Internal" />
+    <DirectPInvoke Include="System.Security.Cryptography.Native.OpenSsl" />
+  </ItemGroup>
+
+  <!-- The archive includes MsQuic, OpenSSL, and the .NET OpenSSL shim. -->
+  <Target Name="StaticMsQuicFixLinker" AfterTargets="SetupOSSpecificProps" BeforeTargets="AotAnywhereDirectLinkNative">
+    <ItemGroup>
+      <LinkerArg Remove="-Wl,--defsym,__xmknod=mknod" />
+      <NativeLibrary Remove="$(IlcFrameworkNativePath)libSystem.Security.Cryptography.Native.OpenSsl.a" />
+      <LinkerArg Remove="$(IlcFrameworkNativePath)libSystem.Security.Cryptography.Native.OpenSsl.a" />
+    </ItemGroup>
+  </Target>
+
+  <Target Name="ValidateStaticMsQuicArchive" BeforeTargets="AotAnywhereDirectLinkNative">
+    <Error Condition="!Exists('$(_MoShiroStaticMsQuicLibrary)')"
+           Text="Static MsQuic archive is missing for $(RuntimeIdentifier)." />
+    <Error Condition="'$(RuntimeFrameworkVersion)' != '10.0.12'"
+           Text="The vendored static MsQuic and crypto archive is validated with .NET runtime 10.0.12." />
+  </Target>
+</Project>

ci/build-dev-image.sh

@@ -113,7 +113,7 @@ mkdir -p "$nuget_cache"
 commit_epoch="$(git -C "$root" show -s --format=%ct "$CI_COMMIT_SHA")"
 built_at="$(date -u -d "@$commit_epoch" +%Y-%m-%dT%H:%M:%SZ)"
 
-python3 "$root/ci/stage-node-image.py" "$component" "$context"
+python3 "$root/ci/stage-node-image.py" "$component" "$node_rid" "$context"
 run_bounded 30m buildah bud --layers --network host --tls-verify=true --arch "$arch" \
   --volume "$nuget_cache:/root/.nuget/packages:rw" \
   --build-arg "APP_VERSION=$image_version" \

ci/stage-node-image.py

@@ -9,6 +9,7 @@ from pathlib import Path
 
 ROOT = Path(__file__).resolve().parents[1]
 BACKEND = ROOT / "backend"
+STATIC_MSQUIC = ROOT / "packaging/native/msquic"
 IGNORED_PARTS = {".git", ".release", "artifacts", "bin", "obj", "TestResults", "tests"}
 GLOBAL_BACKEND_FILES = {
     "Directory.Build.props",
@@ -27,7 +28,7 @@ CONTAINERFILES = {
 }
 
 
-def stage(component: str, destination: Path) -> None:
+def stage(component: str, runtime_identifier: str, destination: Path) -> None:
     if destination.exists():
         shutil.rmtree(destination)
     restore = destination / "restore/backend"
@@ -57,6 +58,13 @@ def stage(component: str, destination: Path) -> None:
         for directory in (restore, source):
             shutil.copy2(ROOT / name, directory / name)
 
+    static_library = STATIC_MSQUIC / runtime_identifier / "libmsquic.a"
+    if not static_library.is_file():
+        raise FileNotFoundError(f"static MsQuic archive is missing for {runtime_identifier}: {static_library}")
+    staged_library = destination / "source/packaging/native/msquic" / runtime_identifier / "libmsquic.a"
+    staged_library.parent.mkdir(parents=True, exist_ok=True)
+    shutil.copy2(static_library, staged_library)
+
     config = destination / "config"
     config.mkdir()
     (config / ".keep").write_text("", encoding="utf-8")
@@ -68,9 +76,10 @@ def stage(component: str, destination: Path) -> None:
 def main() -> None:
     parser = argparse.ArgumentParser()
     parser.add_argument("component", choices=tuple(CONTAINERFILES))
+    parser.add_argument("runtime_identifier", choices=("linux-musl-x64", "linux-musl-arm64"))
     parser.add_argument("destination", type=Path)
     args = parser.parse_args()
-    stage(args.component, args.destination)
+    stage(args.component, args.runtime_identifier, args.destination)
 
 
 if __name__ == "__main__":

docs/ops/deployment.md

@@ -1,6 +1,6 @@
 # 部署
 
-节点（Agent、Probe）使用 NativeAOT。QUIC 通过应用目录优先加载 MsQuic v2。Linux standalone 归档会附带 MsQuic、NUMA、zstd、zlib 和 musl 所需的 LTTng 共享库；运行主机仍需提供 OpenSSL 3（`libcrypto.so.3`）和对应 libc。Agent/Probe OCI 镜像以 Alpine 为运行基底，从对应架构归档复制这些共享库到可执行文件旁边；运行容器时不需要安装 MsQuic 系统包。启动时会检查 MsQuic 是否可加载。
+节点（Agent、Probe）使用 NativeAOT。Linux standalone 归档会附带 MsQuic、NUMA、zstd、zlib 和 musl 所需的 LTTng 共享库；运行主机仍需提供 OpenSSL 3（`libcrypto.so.3`）和对应 libc。Release Agent/Probe OCI 镜像以 Alpine 为运行基底，从对应架构归档复制这些共享库到可执行文件旁边。`moshiro-dev` 镜像则从 `packaging/native/msquic` 链接对应架构的静态 MsQuic、OpenSSL 和 .NET 加密 shim，并使用静态 musl 可执行文件；这两类镜像都不需要安装 MsQuic 系统包。
 
 ## 1. 构建与打包
 

packaging/container/Agent.NativeBuild.Containerfile

@@ -1,35 +1,19 @@
-# Run all build commands on the native amd64 runner. AotAnywhere cross-links
-# the NativeAOT output, so an ARM64 build never needs QEMU.
-FROM --platform=linux/arm64 alpine:3.24 AS arm64-apk-keys
-
-FROM --platform=linux/amd64 alpine:3.24 AS runtime-libs
-ARG NODE_RID=linux-musl-x64
-COPY --from=arm64-apk-keys /usr/share/apk/keys/ /tmp/apk-keys-arm64/
-RUN set -eu; \
-    apk_arch=x86_64; \
-    case "$NODE_RID" in *arm64) apk_arch=aarch64 ;; esac; \
-    mkdir -p /tmp/runtime-apks /tmp/runtime-root /out/runtime; \
-    if [ "$apk_arch" = aarch64 ]; then \
-      apk --keys-dir /tmp/apk-keys-arm64 --arch "$apk_arch" fetch --recursive --output /tmp/runtime-apks libmsquic numactl lttng-ust zlib; \
-    else \
-      apk --arch "$apk_arch" fetch --recursive --output /tmp/runtime-apks libmsquic numactl lttng-ust zlib; \
-    fi; \
-    set -- /tmp/runtime-apks/*.apk; \
-    [ -f "$1" ]; \
-    for package do tar -xzf "$package" -C /tmp/runtime-root; done; \
-    cp -a /tmp/runtime-root/usr/lib/*.so* /out/runtime/
-
+# AotAnywhere cross-links both Alpine architectures on the native amd64 runner.
 FROM --platform=linux/amd64 mcr.microsoft.com/dotnet/sdk:10.0-noble-aot AS build
 
 WORKDIR /src/backend
 COPY restore/backend/ ./
 ARG NODE_RID=linux-musl-x64
 ENV NUGET_PACKAGES=/root/.nuget/packages
-# restore 也要带 PublishAot：不然不会还原 ILCompiler，之后 --no-restore 的发布就悄悄变成「裁剪过的框架依赖程序」
-RUN dotnet restore agent/src/MoShiro.Agent -r "$NODE_RID" -p:PublishAot=true -p:UseAotAnywhere=true --artifacts-path /artifacts \
-    && dotnet restore fleet/tools/fleet-enroll -r "$NODE_RID" -p:PublishAot=true -p:UseAotAnywhere=true --artifacts-path /artifacts
+RUN dotnet restore agent/src/MoShiro.Agent -r "$NODE_RID" -p:PublishAot=true -p:UseAotAnywhere=true \
+    -p:StaticMsQuic=true -p:StaticExecutable=true -p:RuntimeFrameworkVersion=10.0.12 \
+    -p:InvariantGlobalization=true --artifacts-path /artifacts \
+    && dotnet restore fleet/tools/fleet-enroll -r "$NODE_RID" -p:PublishAot=true -p:UseAotAnywhere=true \
+    -p:StaticMsQuic=true -p:StaticExecutable=true -p:RuntimeFrameworkVersion=10.0.12 -p:InvariantGlobalization=true \
+    --artifacts-path /artifacts
 
 COPY source/backend/ ./
+COPY source/packaging/native/msquic/ /src/packaging/native/msquic/
 # 构建信息：CI 通过 --build-arg 传入；不传就是空（放在 restore 之后，每次构建都变的时间不会让依赖还原的缓存失效）
 ARG MOSHIRO_TAG=
 ARG MOSHIRO_COMMIT=
@@ -37,16 +21,21 @@ ARG MOSHIRO_BUILT_AT=
 ENV MOSHIRO_TAG=$MOSHIRO_TAG MOSHIRO_COMMIT=$MOSHIRO_COMMIT MOSHIRO_BUILT_AT=$MOSHIRO_BUILT_AT
 RUN dotnet publish agent/src/MoShiro.Agent -m:3 -c Release -r "$NODE_RID" \
     --self-contained true --no-restore -p:PublishAot=true -p:UseAotAnywhere=true \
-    -p:UseAppHost=true -p:StripSymbols=true \
+    -p:StaticMsQuic=true -p:StaticExecutable=true -p:RuntimeFrameworkVersion=10.0.12 \
+    -p:InvariantGlobalization=true -p:UseAppHost=true -p:StripSymbols=true \
     -p:DebugType=none -p:DebugSymbols=false --artifacts-path /artifacts -o /out/agent \
     && dotnet publish fleet/tools/fleet-enroll -m:3 -c Release -r "$NODE_RID" \
     --self-contained true --no-restore -p:PublishAot=true -p:UseAotAnywhere=true \
+    -p:StaticMsQuic=true -p:StaticExecutable=true -p:RuntimeFrameworkVersion=10.0.12 -p:InvariantGlobalization=true \
     -p:UseAppHost=true -p:StripSymbols=true \
     -p:DebugType=none -p:DebugSymbols=false --artifacts-path /artifacts -o /out/enroll
-# 原生程序有几 MB；几十 KB 的是只会去找 .dll 的启动器
 RUN test -x /out/agent/moshiro-agent && test -x /out/enroll/fleet-enroll \
-    && test "$(stat -c%s /out/agent/moshiro-agent)" -gt 2000000 && test "$(stat -c%s /out/enroll/fleet-enroll)" -gt 2000000
-COPY --from=runtime-libs /out/runtime/ /out/runtime/
+    && test "$(stat -c%s /out/agent/moshiro-agent)" -gt 2000000 \
+    && test "$(stat -c%s /out/enroll/fleet-enroll)" -gt 2000000 \
+    && ! readelf -l /out/agent/moshiro-agent | grep -q INTERP \
+    && ! readelf -d /out/agent/moshiro-agent 2>&1 | grep -q NEEDED \
+    && ! readelf -l /out/enroll/fleet-enroll | grep -q INTERP \
+    && ! readelf -d /out/enroll/fleet-enroll 2>&1 | grep -q NEEDED
 
 FROM mcr.microsoft.com/dotnet/runtime-deps:10.0-alpine
 
@@ -58,12 +47,10 @@ LABEL org.opencontainers.image.title="MoShiro Agent" \
 
 COPY --chown=1654:1654 --from=build /out/agent/moshiro-agent /usr/local/bin/moshiro-agent
 COPY --chown=1654:1654 --from=build /out/enroll/fleet-enroll /usr/local/bin/fleet-enroll
-COPY --from=build /out/runtime/ /usr/local/bin/
 COPY --chown=1654:1654 config/ /etc/moshiro/
 COPY --chown=1654:1654 --chmod=0755 entrypoint.sh /usr/local/bin/moshiro-entrypoint
 
 ENV MOSHIRO_ROLE=agent
-ENV LD_LIBRARY_PATH=/usr/local/bin
 USER 1654:1654
 WORKDIR /etc/moshiro
 VOLUME ["/etc/moshiro"]

packaging/container/Probe.NativeBuild.Containerfile

@@ -1,35 +1,19 @@
-# Run all build commands on the native amd64 runner. AotAnywhere cross-links
-# the NativeAOT output, so an ARM64 build never needs QEMU.
-FROM --platform=linux/arm64 alpine:3.24 AS arm64-apk-keys
-
-FROM --platform=linux/amd64 alpine:3.24 AS runtime-libs
-ARG NODE_RID=linux-musl-x64
-COPY --from=arm64-apk-keys /usr/share/apk/keys/ /tmp/apk-keys-arm64/
-RUN set -eu; \
-    apk_arch=x86_64; \
-    case "$NODE_RID" in *arm64) apk_arch=aarch64 ;; esac; \
-    mkdir -p /tmp/runtime-apks /tmp/runtime-root /out/runtime; \
-    if [ "$apk_arch" = aarch64 ]; then \
-      apk --keys-dir /tmp/apk-keys-arm64 --arch "$apk_arch" fetch --recursive --output /tmp/runtime-apks libmsquic numactl lttng-ust zlib; \
-    else \
-      apk --arch "$apk_arch" fetch --recursive --output /tmp/runtime-apks libmsquic numactl lttng-ust zlib; \
-    fi; \
-    set -- /tmp/runtime-apks/*.apk; \
-    [ -f "$1" ]; \
-    for package do tar -xzf "$package" -C /tmp/runtime-root; done; \
-    cp -a /tmp/runtime-root/usr/lib/*.so* /out/runtime/
-
+# AotAnywhere cross-links both Alpine architectures on the native amd64 runner.
 FROM --platform=linux/amd64 mcr.microsoft.com/dotnet/sdk:10.0-noble-aot AS build
 
 WORKDIR /src/backend
 COPY restore/backend/ ./
 ARG NODE_RID=linux-musl-x64
 ENV NUGET_PACKAGES=/root/.nuget/packages
-# restore 也要带 PublishAot：不然不会还原 ILCompiler，之后 --no-restore 的发布就悄悄变成「裁剪过的框架依赖程序」
-RUN dotnet restore probe/src/MoShiro.Probe -r "$NODE_RID" -p:PublishAot=true -p:UseAotAnywhere=true --artifacts-path /artifacts \
-    && dotnet restore fleet/tools/fleet-enroll -r "$NODE_RID" -p:PublishAot=true -p:UseAotAnywhere=true --artifacts-path /artifacts
+RUN dotnet restore probe/src/MoShiro.Probe -r "$NODE_RID" -p:PublishAot=true -p:UseAotAnywhere=true \
+    -p:StaticMsQuic=true -p:StaticExecutable=true -p:RuntimeFrameworkVersion=10.0.12 \
+    -p:InvariantGlobalization=true --artifacts-path /artifacts \
+    && dotnet restore fleet/tools/fleet-enroll -r "$NODE_RID" -p:PublishAot=true -p:UseAotAnywhere=true \
+    -p:StaticMsQuic=true -p:StaticExecutable=true -p:RuntimeFrameworkVersion=10.0.12 -p:InvariantGlobalization=true \
+    --artifacts-path /artifacts
 
 COPY source/backend/ ./
+COPY source/packaging/native/msquic/ /src/packaging/native/msquic/
 # 构建信息：CI 通过 --build-arg 传入；不传就是空（放在 restore 之后，每次构建都变的时间不会让依赖还原的缓存失效）
 ARG MOSHIRO_TAG=
 ARG MOSHIRO_COMMIT=
@@ -37,16 +21,21 @@ ARG MOSHIRO_BUILT_AT=
 ENV MOSHIRO_TAG=$MOSHIRO_TAG MOSHIRO_COMMIT=$MOSHIRO_COMMIT MOSHIRO_BUILT_AT=$MOSHIRO_BUILT_AT
 RUN dotnet publish probe/src/MoShiro.Probe -m:3 -c Release -r "$NODE_RID" \
     --self-contained true --no-restore -p:PublishAot=true -p:UseAotAnywhere=true \
-    -p:UseAppHost=true -p:StripSymbols=true \
+    -p:StaticMsQuic=true -p:StaticExecutable=true -p:RuntimeFrameworkVersion=10.0.12 \
+    -p:InvariantGlobalization=true -p:UseAppHost=true -p:StripSymbols=true \
     -p:DebugType=none -p:DebugSymbols=false --artifacts-path /artifacts -o /out/probe \
     && dotnet publish fleet/tools/fleet-enroll -m:3 -c Release -r "$NODE_RID" \
     --self-contained true --no-restore -p:PublishAot=true -p:UseAotAnywhere=true \
+    -p:StaticMsQuic=true -p:StaticExecutable=true -p:RuntimeFrameworkVersion=10.0.12 -p:InvariantGlobalization=true \
     -p:UseAppHost=true -p:StripSymbols=true \
     -p:DebugType=none -p:DebugSymbols=false --artifacts-path /artifacts -o /out/enroll
-# 原生程序有几 MB；几十 KB 的是只会去找 .dll 的启动器
 RUN test -x /out/probe/moshiro-probe && test -x /out/enroll/fleet-enroll \
-    && test "$(stat -c%s /out/probe/moshiro-probe)" -gt 2000000 && test "$(stat -c%s /out/enroll/fleet-enroll)" -gt 2000000
-COPY --from=runtime-libs /out/runtime/ /out/runtime/
+    && test "$(stat -c%s /out/probe/moshiro-probe)" -gt 2000000 \
+    && test "$(stat -c%s /out/enroll/fleet-enroll)" -gt 2000000 \
+    && ! readelf -l /out/probe/moshiro-probe | grep -q INTERP \
+    && ! readelf -d /out/probe/moshiro-probe 2>&1 | grep -q NEEDED \
+    && ! readelf -l /out/enroll/fleet-enroll | grep -q INTERP \
+    && ! readelf -d /out/enroll/fleet-enroll 2>&1 | grep -q NEEDED
 
 FROM mcr.microsoft.com/dotnet/runtime-deps:10.0-alpine
 
@@ -58,12 +47,10 @@ LABEL org.opencontainers.image.title="MoShiro Probe" \
 
 COPY --chown=1654:1654 --from=build /out/probe/moshiro-probe /usr/local/bin/moshiro-probe
 COPY --chown=1654:1654 --from=build /out/enroll/fleet-enroll /usr/local/bin/fleet-enroll
-COPY --from=build /out/runtime/ /usr/local/bin/
 COPY --chown=1654:1654 config/ /etc/moshiro/
 COPY --chown=1654:1654 --chmod=0755 entrypoint.sh /usr/local/bin/moshiro-entrypoint
 
 ENV MOSHIRO_ROLE=probe
-ENV LD_LIBRARY_PATH=/usr/local/bin
 USER 1654:1654
 WORKDIR /etc/moshiro
 VOLUME ["/etc/moshiro"]

packaging/native/msquic/README.md

@@ -0,0 +1,19 @@
+# Static musl MsQuic archive
+
+The two `libmsquic.a` files are extracted from `LightDl 0.4.4-h3-static.3`.
+The package identifies its source as `greepar/LightDl` commit
+`f16971a5254dacab049c6637ce52dc8d518b5a61` and includes the MsQuic MIT,
+OpenSSL Apache-2.0, and .NET MIT notices in `licenses/`.
+
+The archives contain MsQuic, OpenSSL, and the .NET OpenSSL crypto shim. They
+are linked into musl NativeAOT node executables with `StaticExecutable=true`;
+the `LightDl` NuGet package and its build targets are not used by MoShiro.
+
+The preview package SHA-256 was
+`91659183CF593ABE1C214AC18CB7B1B7CD2FB23513C2A871EA8180CB8E226D84`.
+Archive SHA-256 values:
+
+| RID | SHA-256 |
+| --- | --- |
+| `linux-musl-x64` | `5C56E1207ECEEFA990A2048789382CF971C6A0FB46B2C2EF0E7A8EE3F6777FD4` |
+| `linux-musl-arm64` | `0AD7ACABF4CE3AA2585C66BE97BF6B955E22F99271D12D7ED107770365C14838` |

packaging/native/msquic/licenses/MsQuic-MIT.txt

@@ -0,0 +1,21 @@
+Copyright (c) Microsoft Corporation.
+
+MIT License
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED *AS IS*, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

packaging/native/msquic/licenses/OpenSSL-Apache-2.0.txt

@@ -0,0 +1,177 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        https://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS

packaging/native/msquic/licenses/dotnet-MIT.txt

@@ -0,0 +1,23 @@
+The MIT License (MIT)
+
+Copyright (c) .NET Foundation and Contributors
+
+All rights reserved.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.