{"id":28597837,"url":"https://github.com/osquery/osquery-toolchain","last_synced_at":"2025-06-11T11:20:47.101Z","repository":{"id":53722167,"uuid":"206423124","full_name":"osquery/osquery-toolchain","owner":"osquery","description":"A LLVM-based toolchain for Linux designed to build a portable osquery","archived":false,"fork":false,"pushed_at":"2024-10-23T15:28:02.000Z","size":84,"stargazers_count":38,"open_issues_count":10,"forks_count":21,"subscribers_count":12,"default_branch":"master","last_synced_at":"2024-10-23T20:26:47.979Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/osquery.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-09-04T22:04:08.000Z","updated_at":"2024-10-23T15:28:07.000Z","dependencies_parsed_at":"2024-10-23T17:35:15.911Z","dependency_job_id":null,"html_url":"https://github.com/osquery/osquery-toolchain","commit_stats":null,"previous_names":[],"tags_count":2,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/osquery%2Fosquery-toolchain","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/osquery%2Fosquery-toolchain/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/osquery%2Fosquery-toolchain/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/osquery%2Fosquery-toolchain/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/osquery","download_url":"https://codeload.github.com/osquery/osquery-toolchain/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/osquery%2Fosquery-toolchain/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":259253756,"owners_count":22829151,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-06-11T11:19:20.836Z","updated_at":"2025-06-11T11:20:47.083Z","avatar_url":"https://github.com/osquery.png","language":"Shell","readme":"# osquery-toolchain\nThe script in this repository is used to build the LLVM/Clang toolchain which is used in the osquery project to create portable binaries of it.  \nThe procedure to build such a toolchain has been based on the build-anywhere project: https://github.com/theopolis/build-anywhere\n\nFollowing the main goals of the toolchain:\n- Obtain a LLVM/Clang toolchain which is portable and which doesn't depend from libstdc++ or libgcc.\n- The toolchain is compiled with a specific glibc version, so that it runs on a wide range of distributions.\n- The toolchain lives in a sysroot folder which should be self sufficient.\n- The toolchain should be able to produce binaries that are portable and run on libc \u003e= 2.12.\n  To do so, the output binary should depend only on shared libraries which are deeply connected with the environment they run on,\n  typically libc, libdl, librt, libpthread.\n\nThe rough steps used to achieve the above goals:\n- Use crosstool-ng to compile a stage0 GCC static toolchain, which might be newer than the one available in the system.\n- Compile an older libz/zlib which is compatible with the old glibc.\n- Link all GCC binaries into the sysroot created by crosstool-ng, so that the sysroot can be used for the next steps\n- Compile a first Clang and lld (stage1), which uses libstdc++.\n- Use the stage1 Clang to compile a stage1 compiler-rt (builtins only).\n- Use the stage1 Clang/lld to compile a stage1 libc++, which will use the previously compiled compiler-rt\n- Use the stage1 Clang/lld to compile the rest of compiler-rt (\\*san libraries) and link them to the stage1 compiler-rt builtins\n- Use the stage1 Clang to compile a stage1 libunwind (static only)\n- Use the stage1 Clang, libunwind, libc++/c++abi, compiler-rt builtins, to build a final/full toolchain\n\nThe version of crosstool-ng used is 1.24.0\nThe version of the GCC compiler built by crosstool-ng is 8.3.0\nThe version of the libc library built by crosstool-ng is 2.12.2\nThe version of LLVM/Clang built by the script is 11.0.0\nThe version of the zlib library built by the script is 1.2.11\n\nAmong other, the toolchain LLVM/Clang includes the clang static analyzer, scan-build, clang-format, clang-tidy.\n\n# How to build\nUsing a recent distribution with GCC 8 is suggested to reduce the possible crashes and issues that may happen when compiling\nthe portable GCC toolchain.  \nFor the instructions we will use Ubuntu 18.04.\n\n## Prerequisites\n```\nsudo apt install g++-8 gcc-8 automake autoconf gettext bison flex unzip help2man libtool-bin libncurses-dev make ninja-build patch txinfo gawk wget git texinfo xz-utils python\n```\nThen use `update-alternatives` to tell the system that the version of GCC/G++ and CPP is the default we would like to use:\n```\nsudo update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-8 20\nsudo update-alternatives --install /usr/bin/g++ g++ /usr/bin/g++-8 20\nsudo update-alternatives --install /usr/bin/cpp cpp /usr/bin/cpp-8 20\n```\nDownload and install CMake 3.17.5\n```\nwget https://github.com/Kitware/CMake/releases/download/v3.17.5/cmake-3.17.5-Linux-x86_64.tar.gz\nsudo tar xvf cmake-3.17.5-Linux-x86_64.tar.gz -C /usr/local --strip 1\n```\n\n## Customize the configuration\nThe default configuration is ready to go, though if customization is needed, there are two files that can be modified: config and crosstool-ng-config.\n- *config* contains global configuration values like, versions of llvm, zlib, how many parallel jobs to use, which build system to use and such.\n- *crosstool-ng-config* contains the configuration that is feed into the crosstool-ng tool, which compiles the portable GCC.  \nIt controls the GCC version built, libc and kernel headers version to build everything.  \nThis is config normally generated by another tool that crosstool-ng provides, but the config can be manually modified after being generated.\n\n## Build\nThe script has to be run as a normal user and accepts one argument, which is the folder where the various stages and the final toolchain will be built:\n```\n./build.sh /opt/osquery-toolchain\n```\nThis should output the sysroot under `/opt/osquery-toolchain/final` and the LLVM toolchain will be under `/opt/osquery-toolchain/final/sysroot/usr`\n\n## Redistributing and usage\n1. Enter inside the **final** folder within the destination path\n2. Rename the **sysroot** folder to **osquery-toolchain**\n3. Compress the folder with the following command: `tar -pcvJf osquery-toolchain-\u003cVERSION\u003e.tar.xz osquery-toolchain`\n\nMake sure that the **\u003cVERSION\u003e** field matches a valid tag, for example: `osquery-toolchain-1.0.1.tar.xz`.\n\nThe generated tarball can then be uncompressed wherever you like on the target machine.\n\nThe toolchain defaults to using libc++ as the C++ standard library, compiler-rt as part of the builtins it needs, instead of relying on libgcc and lld as the linker; so these are implicit.\nlibc++abi has to be explicitly linked when compiling C++ with `l:libc++abi.a` instead; merged with it there's also libunwind, which is therefore implicit.\nSometimes explicitly adding `-ldl` and/or `-lrt` is needed, depending on what functions the binary is using.\nThe only other flag that's needed is `--sysroot=\u003csysroot path\u003e`, so that the toolchain searches what it needs in the correct path.\n\n## Troubleshooting\nIf the compilation stops at any point in time, just relaunching the script should restart it.  \nThe script doesn't delete anything when it restarts the build, so if you want to start clean from some substep, you need to do that manually.\n\nSo for more advanced troubleshooting, following the build example in general we have:\n- `/opt/osquery-toolchain/stage0`: here lives crosstool-ng source code, build, zlib source code, build and GCC/G++ toolchain compiled by crosstool-ng. The GCC/G++ toolchain folder is also copied on the next stages\n- `/opt/osquery-toolchain/stage1`: here lives the intermediate LLVM/Clang toolchain, together with a copy of the previous step GCC/G++ toolchain and it's used to build the final toolchain\n- `/opt/osquery-toolchain/final`: here lives the final sysroot containing only the LLVM/Clang toolchain we want to use\n- `/opt/osquery-toolchain/llvm`: here lives the source code for the LLVM/Clang and the various build folders for the LLVM build substeps\n\nThe script decides it has to build one of the stages if it doesn't find a specific file in one of the install folders (stage0, stage1, final).\n- For crosstool-ng is `/opt/osquery-toolchain/stage0/crosstool-ng/ct-ng`.\n- For GCC is `/opt/osquery-toolchain/stage0/x86_64-osquery-linux-gnu/bin/x86_64-osquery-linux-gnu-gcc`\n- For zlib is `/opt/osquery-toolchain/stage0/x86_64-osquery-linux-gnu/x86_64-osquery-linux-gnu/usr/lib/libz.a`\n- For LLVM/Clang stage1 is `/opt/osquery-toolchain/stage0/x86_64-osquery-linux-gnu/x86_64-osquery-linux-gnu/sysroot/usr/bin/clang`\n- For compiler-rt builtins is `/opt/osquery-toolchain/x86_64-osquery-linux-gnu/x86_64-osquery-linux-gnu/sysroot/usr/lib/clang/\u003cclang version\u003e/lib/linux/libclang_rt.builtins-x86_64.a`\n- For libc++, libc++abi, libunwind, which are compiled together, is one of `/opt/osquery-toolchain/x86_64-osquery-linux-gnu/x86_64-osquery-linux-gnu/sysroot/usr/lib/libc++.a` `/opt/osquery-toolchain/x86_64-osquery-linux-gnu/x86_64-osquery-linux-gnu/sysroot/usr/lib/libc++abi.a` `/opt/osquery-toolchain/x86_64-osquery-linux-gnu/x86_64-osquery-linux-gnu/sysroot/usr/lib/libunwind.a`\n- For the LLVM/Clang and respective libraries of the final stage is `/opt/osquery-toolchain/final/sysroot/usr/bin/clang`, because the install step is a single unit.\n","funding_links":[],"categories":[],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fosquery%2Fosquery-toolchain","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fosquery%2Fosquery-toolchain","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fosquery%2Fosquery-toolchain/lists"}