fix(generic-snmp): fix glibc dependency issue

Author: omercier

.github/workflows/generic-plugins.yml

@@ -46,10 +46,30 @@ jobs:
           cargo test
         shell: bash
 
+      # The binary is built once and packaged for every supported distribution, so it must not
+      # depend on the glibc of the runner: the oldest distribution we ship to (el8) provides
+      # glibc 2.28 while ubuntu-24.04 provides 2.39, and glibc offers no forward compatibility.
+      # Linking statically against musl removes the dependency on the system libc entirely.
       - name: Build optimized binary
         run: |
           cd rust-plugins
-          cargo build --release
+          rustup target add x86_64-unknown-linux-musl
+          cargo build --release --target x86_64-unknown-linux-musl
+          # Keep the artifact where the cache, the nfpm configuration and the test job expect it.
+          mkdir -p target/release
+          cp target/x86_64-unknown-linux-musl/release/centreon-plugin-rust-snmp target/release/
+        shell: bash
+
+      - name: Check the binary has no dynamic dependency
+        run: |
+          cd rust-plugins
+          # A statically linked binary has no NEEDED entry. Do not rely on `file`, which reports
+          # "static-pie linked" rather than "statically linked" for this target.
+          if objdump -p target/release/centreon-plugin-rust-snmp | grep NEEDED; then
+            echo "::error::Binary links against shared libraries and will not run on every supported distribution"
+            exit 1
+          fi
+          echo "Binary is statically linked, it does not depend on the system libc"
         shell: bash
 
       - name: Save binary to cache

rust-plugins/README.md

@@ -9,6 +9,26 @@ Once done, you can compile it by running:
 cargo build
 ```
 
+# Static linking
+
+`cargo build` links the binary against the glibc of your own machine. The packaged binary has to
+run on every supported distribution, the oldest one being el8 with glibc 2.28, and glibc offers
+no forward compatibility: a binary built against a recent glibc fails to start on an older one.
+The CI therefore links statically against musl instead:
+
+```bash
+rustup target add x86_64-unknown-linux-musl
+cargo build --release --target x86_64-unknown-linux-musl
+```
+
+Use that command to reproduce a release binary locally. The CI fails the build if the produced
+binary still carries a dynamic dependency.
+
+A statically linked musl binary does not use the glibc Name Service Switch (NSS). Host names are
+resolved by the musl resolver, which reads `/etc/hosts` and `/etc/resolv.conf` only, so the
+`nsswitch.conf` backends such as sssd, LDAP or mDNS are ignored, unlike with the Perl plugins.
+Targets given as IP addresses are unaffected, and so are host names resolvable through plain DNS.
+
 # Description
 
 ## generic-snmp