Fix Linux release ABI baseline

Author: tucktuckg00se

.github/workflows/release.yml

@@ -43,7 +43,7 @@ jobs:
           path: INTERSECT-${{ github.ref_name }}-Windows-x64.zip
 
   build-linux:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - name: Install dependencies
         run: |
@@ -64,6 +64,104 @@ jobs:
       - name: Build
         run: cmake --build build --config Release --target Intersect_All
 
+      - name: Audit Linux ABI baseline
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          ART_ROOT=build/Intersect_artefacts
+          if [ -d "$ART_ROOT/Release" ]; then
+            ART_ROOT="$ART_ROOT/Release"
+          fi
+
+          STANDALONE="$ART_ROOT/Standalone/INTERSECT"
+          VST3="$ART_ROOT/VST3/INTERSECT.vst3/Contents/x86_64-linux/INTERSECT.so"
+          MAX_GLIBC="2.35"
+
+          ldd --version
+
+          find_linked_library() {
+            local binary="$1"
+            local soname="$2"
+            ldd "$binary" | awk -v soname="$soname" '$1 == soname { print $3; exit }'
+          }
+
+          fail_newer_glibc() {
+            local binary="$1"
+            local bad_versions=""
+            local version
+
+            while IFS= read -r version; do
+              if [ "$(printf '%s\n%s\n' "$MAX_GLIBC" "$version" | sort -V | tail -n 1)" != "$MAX_GLIBC" ]; then
+                bad_versions="${bad_versions}GLIBC_${version}"$'\n'
+              fi
+            done < <(readelf --version-info "$binary" | grep -oE 'GLIBC_[0-9]+(\.[0-9]+)+' | sed 's/^GLIBC_//' | sort -Vu)
+
+            if [ -n "$bad_versions" ]; then
+              echo "::error file=$binary::Requires glibc newer than GLIBC_$MAX_GLIBC"
+              printf '%s' "$bad_versions"
+              return 1
+            fi
+          }
+
+          fail_unavailable_symbols() {
+            local binary="$1"
+            local soname="$2"
+            local pattern="$3"
+            local provider
+            local symbols
+            local missing=""
+
+            symbols=$(readelf --version-info "$binary" | grep -oE "$pattern" | sort -Vu || true)
+            if [ -z "$symbols" ]; then
+              return 0
+            fi
+
+            provider=$(find_linked_library "$binary" "$soname")
+            if [ -z "$provider" ] || [ ! -f "$provider" ]; then
+              echo "::error file=$binary::Could not locate $soname via ldd"
+              return 1
+            fi
+
+            while IFS= read -r symbol; do
+              if ! grep -Fxq "$symbol" < <(strings "$provider"); then
+                missing="${missing}${symbol}"$'\n'
+              fi
+            done <<< "$symbols"
+
+            if [ -n "$missing" ]; then
+              echo "::error file=$binary::Requires symbols not provided by $provider"
+              printf '%s' "$missing"
+              return 1
+            fi
+          }
+
+          audit_binary() {
+            local binary="$1"
+            local ldd_output
+
+            echo "Auditing $binary"
+            test -f "$binary"
+            if ! ldd_output=$(ldd "$binary" 2>&1); then
+              echo "$ldd_output"
+              echo "::error file=$binary::ldd failed"
+              return 1
+            fi
+
+            echo "$ldd_output"
+            if echo "$ldd_output" | grep -q 'not found'; then
+              echo "::error file=$binary::Unresolved shared library dependency"
+              return 1
+            fi
+
+            fail_newer_glibc "$binary"
+            fail_unavailable_symbols "$binary" libstdc++.so.6 'GLIBCXX_[0-9]+(\.[0-9]+)+|CXXABI_[0-9]+(\.[0-9]+)+'
+            fail_unavailable_symbols "$binary" libasound.so.2 'ALSA_[0-9]+(\.[0-9]+)+([a-z0-9]+)?'
+          }
+
+          audit_binary "$STANDALONE"
+          audit_binary "$VST3"
+
       - name: Package
         run: |
           ART_ROOT=build/Intersect_artefacts

CMakeLists.txt

@@ -49,12 +49,15 @@ endif()
 if(_intersect_ort_supported)
     if(INTERSECT_ORT_HEADERS_ROOT STREQUAL "")
         include(FetchContent)
-        # Use the smallest official tarball just for headers. The CPU Linux package
-        # is ~8 MB and contains the full public include tree shared by every platform.
-        FetchContent_Declare(onnxruntime_headers
+        set(_intersect_ort_fetch_args
             URL "https://github.com/microsoft/onnxruntime/releases/download/v${INTERSECT_ORT_VERSION}/onnxruntime-linux-x64-${INTERSECT_ORT_VERSION}.tgz"
-            DOWNLOAD_EXTRACT_TIMESTAMP TRUE
         )
+        if(CMAKE_VERSION VERSION_GREATER_EQUAL "3.24")
+            list(APPEND _intersect_ort_fetch_args DOWNLOAD_EXTRACT_TIMESTAMP TRUE)
+        endif()
+        # Use the smallest official tarball just for headers. The CPU Linux package
+        # is ~8 MB and contains the full public include tree shared by every platform.
+        FetchContent_Declare(onnxruntime_headers ${_intersect_ort_fetch_args})
         FetchContent_MakeAvailable(onnxruntime_headers)
         set(INTERSECT_ORT_HEADERS_ROOT "${onnxruntime_headers_SOURCE_DIR}")
     endif()