build: finish cross-platform release tooling

scripts/package_linux.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+# Static musl build of cst-agent for one architecture, packed as
+# dist/cst-agent-VERSION-linux-ARCH.tar.gz (+ .sha256).
+#   scripts/package_linux.sh x86_64|x86|aarch64
+# CST_LINUX_CHECK=1 also runs `make check` (only where the binaries can run).
+# Builds in the source tree, so the tree is cleaned first.
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+ARCH="${1:?usage: $0 x86_64|x86|aarch64}"
+PREFIX="$ROOT/third_party/prefix-linux-$ARCH"
+cd "$ROOT"
+
+read -r LINUX_HOST bindir < <(bash scripts/ci_linux_toolchain.sh "$ARCH")
+export PATH="$bindir:$PATH" LINUX_HOST
+T="$LINUX_HOST-"
+
+if [[ ! -f "$PREFIX/lib/libcurl.a" || ! -f "$PREFIX/lib/libncursesw.a" ]]; then
+  bash scripts/build_third_party_linux.sh "$ARCH"
+fi
+
+# Only the static prefix: no host .pc file may leak into the link.
+export PKG_CONFIG_LIBDIR="$PREFIX/lib/pkgconfig"
+unset PKG_CONFIG_PATH CC CFLAGS LDFLAGS
+mk=(make CC="${T}gcc" AR="${T}ar" STATIC=1
+  CFLAGS="-std=c11 -Wall -Wextra -O2 -g -Werror")
+
+make clean >/dev/null
+make -C vendor/sashidown clean >/dev/null 2>&1 || true
+"${mk[@]}" -j"$(nproc)" cst-agent
+if "${T}readelf" -l cst-agent | grep -q 'Requesting program interpreter'; then
+  echo "cst-agent is dynamically linked" >&2
+  exit 1
+fi
+if [[ "${CST_LINUX_CHECK:-0}" == 1 ]]; then
+  "${mk[@]}" check
+fi
+
+ver="$(sed -n 's/^#define CST_VERSION_\(MAJOR\|MINOR\|PATCH\) \([0-9]*\)$/\2/p' include/cst_version.h | paste -sd.)"
+name="cst-agent-$ver-linux-$ARCH"
+rel="dist/$name"
+rm -rf "$rel"
+mkdir -p "$rel"
+cp -f cst-agent "$rel/cst-agent"
+"${T}strip" "$rel/cst-agent"
+cp -f README.md "$rel/README.md"
+echo "$ver" >"$rel/VERSION"
+tgz="dist/$name.tar.gz"
+tar -C dist -czf "$tgz" "$name"
+(cd dist && sha256sum "$name.tar.gz" >"$name.tar.gz.sha256")
+ls -la "$rel"
+echo "$ROOT/$tgz"