feat: implement static builds for Mithril nodes in CI

.github/workflows/actions/build-upload-mithril-artifact/action.yml

@@ -10,6 +10,15 @@ inputs:
   common-build-args:
     description: Arguments that will be passed to both bin & lib 'cargo build'
     required: false
+  binaries-to-check-static:
+    description: Comma-separated list of binaries to check for static builds (e.g., mithril-client,mithril-aggregator). Leave empty to skip static build checks.
+    required: false
+    default: ""
+  binaries-build-target:
+    description: Build target directory name (e.g., x86_64-unknown-linux-musl). Leave empty for default target/release
+    required: false
+    default: ""
+
 runs:
   using: "composite"
   steps:
@@ -18,6 +27,16 @@ runs:
       shell: bash
       run: echo "short_sha=$(echo ${{ github.sha }} | cut -c1-7)" >> $GITHUB_OUTPUT
 
+    - name: Resolve build target path
+      id: build-path
+      shell: bash
+      run: |
+        if [ -z "${{ inputs.binaries-build-target }}" ]; then
+          echo "path=target/release" >> $GITHUB_OUTPUT
+        else
+          echo "path=target/${{ inputs.binaries-build-target }}/release" >> $GITHUB_OUTPUT
+        fi
+
     - name: Set up Python
       uses: actions/setup-python@v6
       with:
@@ -38,19 +57,32 @@ runs:
       # Build only the libraries for the crates that are published to crates.io
       run: cargo build --lib --release ${{ inputs.libraries-build-args }} ${{ inputs.common-build-args }}
 
+    - name: Verification of static compilation
+      uses: ./.github/workflows/actions/check-static-binaries
+      with:
+        binaries: ${{ inputs.binaries-to-check-static }}
+        target-path: ${{ steps.build-path.outputs.path }}
+
+    - name: Move binaries before upload
+      shell: bash
+      # Put all binaries in a single folder to avoid upload-artifact action keeping the least common ancestor as the root directory
+      run: |
+        mkdir -p binaries
+        cp target/release/libmithril_stm.* binaries/ || true
+        cp target/release/libmithril_client.* binaries/ || true
+        cp ${{ steps.build-path.outputs.path }}/mithril-aggregator binaries/ || true
+        cp ${{ steps.build-path.outputs.path }}/mithril-aggregator.exe binaries/ || true
+        cp ${{ steps.build-path.outputs.path }}/mithril-client binaries/ || true
+        cp ${{ steps.build-path.outputs.path }}/mithril-client.exe binaries/ || true
+        cp ${{ steps.build-path.outputs.path }}/mithril-signer binaries/ || true
+        cp ${{ steps.build-path.outputs.path }}/mithril-signer.exe binaries/ || true
+        cp ${{ steps.build-path.outputs.path }}/mithril-relay binaries/ || true
+        cp ${{ steps.build-path.outputs.path }}/mithril-relay.exe binaries/ || true
+
     - name: Publish Mithril Distribution (${{ runner.os }}-${{ runner.arch }})
       uses: actions/upload-artifact@v5
       with:
         name: mithril-distribution-${{ runner.os }}-${{ runner.arch }}
         path: |
-          target/release/libmithril_stm.*
-          target/release/libmithril_client.*
-          target/release/mithril-aggregator
-          target/release/mithril-aggregator.exe
-          target/release/mithril-client
-          target/release/mithril-client.exe
-          target/release/mithril-signer
-          target/release/mithril-signer.exe
-          target/release/mithril-relay
-          target/release/mithril-relay.exe
+          binaries/*
         if-no-files-found: error

.github/workflows/actions/check-static-binaries/action.yml

@@ -0,0 +1,193 @@
+name: check-static-binaries
+description: Verify that binaries are statically linked (cross-platform support)
+
+inputs:
+  binaries:
+    description: "Comma-separated list of binary names to check"
+    required: true
+  target-path:
+    description: "Path to the directory containing the binaries"
+    required: true
+    default: "target/release"
+
+runs:
+  using: composite
+  steps:
+    - name: Check Linux static binaries
+      if: runner.os == 'Linux'
+      shell: pwsh
+      run: |
+        $BINARIES = "${{ inputs.binaries }}"
+        $TARGET_PATH = "${{ inputs.target-path }}"
+
+        foreach ($bin in $BINARIES -split ",") {
+          $bin = $bin.Trim()
+          $BIN_PATH = "$TARGET_PATH/$bin"
+
+          Write-Host "Checking $bin is statically linked..."
+
+          if (-Not (Test-Path $BIN_PATH)) {
+            Write-Host "❌ Binary not found at $BIN_PATH"
+            exit 1
+          }
+
+          $output = & readelf -d $BIN_PATH 2>$null | Select-String NEEDED
+          if ($output) {
+            Write-Host "❌ $bin is NOT static (has dynamic dependencies)"
+            exit 1
+          }
+          Write-Host "✅ $bin is fully static"
+        }
+
+        Write-Host "🎉 All binaries are static!"
+        exit 0
+
+    - name: Check macOS static binaries
+      if: runner.os == 'macOS'
+      shell: pwsh
+      run: |
+        $BINARIES = "${{ inputs.binaries }}"
+        $TARGET_PATH = "${{ inputs.target-path }}"
+
+        $MACOS_ALLOWED_DEPS = @(
+          "/System/Library/Frameworks/Security.framework",
+          "/System/Library/Frameworks/SystemConfiguration.framework",
+          "/System/Library/Frameworks/CoreFoundation.framework",
+          "/usr/lib/libiconv",
+          "/usr/lib/libSystem"
+        )
+
+        function IsMacosAllowed {
+          param([string]$dep)
+          foreach ($allowed in $MACOS_ALLOWED_DEPS) {
+            if ($dep -like "$allowed*") {
+              return $true
+            }
+          }
+          return $false
+        }
+
+        foreach ($bin in $BINARIES -split ",") {
+          $bin = $bin.Trim()
+          $BIN_PATH = "$TARGET_PATH/$bin"
+
+          Write-Host "Checking $bin is statically linked..."
+
+          if (-Not (Test-Path $BIN_PATH)) {
+            Write-Host "❌ Binary not found at $BIN_PATH"
+            exit 1
+          }
+
+          $disallowed_deps = @()
+          $otool_output = & otool -L $BIN_PATH 2>$null | Select-Object -Skip 1
+
+          foreach ($line in $otool_output) {
+            $dep = ($line -split '\s+')[0]
+
+            if ([string]::IsNullOrWhiteSpace($dep) -or $dep -like "@*") {
+              continue
+            }
+
+            if (-Not (IsMacosAllowed $dep)) {
+              $disallowed_deps += $dep
+            }
+          }
+
+          if ($disallowed_deps.Count -gt 0) {
+            Write-Host "❌ $bin has disallowed dynamic dependencies:"
+            foreach ($dep in $disallowed_deps) {
+              Write-Host "  - $dep"
+            }
+            exit 1
+          }
+          Write-Host "✅ $bin is fully static (or has only whitelisted system dependencies)"
+        }
+
+        Write-Host "🎉 All binaries are static!"
+        exit 0
+
+    - name: Check Windows static binaries
+      if: runner.os == 'Windows'
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        BINARIES="${{ inputs.binaries }}"
+        TARGET_PATH="${{ inputs.target-path }}"
+
+        WHITELIST=(
+          "KERNEL32.dll"
+          "ntdll.dll"
+          "bcryptprimitives.dll"
+          "advapi32.dll"
+          "secur32.dll"
+          "ws2_32.dll"
+          "crypt32.dll"
+          "bcrypt.dll"
+          "api-ms-win-core-synch-l1-2-0.dll"
+          "userenv.dll"
+          "VCRUNTIME140.dll"
+          "api-ms-win-crt-math-l1-1-0.dll"
+          "api-ms-win-crt-string-l1-1-0.dll"
+          "api-ms-win-crt-heap-l1-1-0.dll"
+          "api-ms-win-crt-stdio-l1-1-0.dll"
+          "api-ms-win-crt-runtime-l1-1-0.dll"
+          "api-ms-win-crt-locale-l1-1-0.dll"
+        )
+
+        check_binary() {
+          local bin="$1"
+          local path="$TARGET_PATH/${bin}.exe"
+
+          echo "Checking $bin is statically linked..."
+
+          if [[ ! -f "$path" ]]; then
+            echo "❌ Binary not found at $path"
+            exit 1
+          fi
+
+          DLLS=$(objdump -p "$path" | grep "DLL Name" | awk '{print $3}' || true)
+
+          echo "Detected DLLs:"
+          echo "$DLLS"
+
+          local non_whitelisted=()
+
+          while IFS= read -r dll; do
+            [[ -z "$dll" ]] && continue
+
+            local allowed=false
+            for w in "${WHITELIST[@]}"; do
+              if [[ "${dll^^}" == "${w^^}" ]]; then
+                allowed=true
+                break
+              fi
+            done
+
+            if [[ "$allowed" == false ]]; then
+              non_whitelisted+=("$dll")
+            fi
+          done <<< "$DLLS"
+
+          if [[ ${#non_whitelisted[@]} -eq 0 ]]; then
+            echo "✅ $bin is fully static (or has only whitelisted system dependencies)"
+          else
+            echo "❌ $bin is NOT static"
+            echo "Unexpected DLLs:"
+            for dll in "${non_whitelisted[@]}"; do
+              echo "  - $dll"
+            done
+            exit 1
+          fi
+
+          echo
+        }
+
+        IFS=',' read -ra BIN_ARRAY <<< "$BINARIES"
+
+        for raw in "${BIN_ARRAY[@]}"; do
+          bin="$(echo "$raw" | xargs)"  # trim
+          check_binary "$bin"
+        done
+
+        echo "🎉 All binaries are static!"

.github/workflows/actions/prepare-distribution/action.yml

@@ -131,9 +131,6 @@ runs:
 
         ⁽\*⁾⚠️ Linux arm64 builds are provided on a best-effort basis and are not officially supported.
 
-        ### Linux Requirements
-        The Linux binaries target \`glibc\`: to run them or install the \`.deb\` packages you must have \`glibc\` version \`2.35+\` installed.
-        Compatible systems include, but are not limited to, \`Ubuntu 22.04+\` or \`Debian 12+\` (Bookworm)).
         EOF
 
     - name: Fetch the latest version of the unstable tag

.github/workflows/actions/toolchain-and-cache/action.yml

@@ -1,6 +1,9 @@
 name: toolchain-and-cache
 description: Install the stable cargo toolchain, the given cargo tools, and try to restore cache
 inputs:
+  targets:
+    description: Comma-separated list of rust target triples to install for this toolchain
+    required: false
   cache-version:
     description: Version of the current cache
     required: false
@@ -20,6 +23,7 @@ runs:
       with:
         toolchain: stable
         components: clippy, rustfmt
+        targets: ${{ inputs.targets }}
 
     - name: Rust Cache
       uses: Swatinem/rust-cache@v2