GeezerVison

Description

PyInstaller bundles the build interpreter's libpython and stdlib extension modules. The setup-python build for ubuntu-24.04 needs GLIBC_2.38, so the released Linux binaries fail to start on RHEL/Rocky/Alma Linux 8 and 9, Debian 12 and Ubuntu 22.04.

A correction to the premise in the issue: #2931 only corrected the declared floor in install.sh from 2.35 to 2.38 and did not change the release runners. The 2.38 requirement comes from building on ubuntu-24.04 with setup-python 3.12, whose bundled libpython needs GLIBC_2.38.

Changes:

• build-release.yml: the Linux jobs build with uv-managed python-build-standalone (UV_PYTHON_PREFERENCE=only-managed), which targets glibc 2.17. A Linux-only step sets the variables, so the Windows job gets no new environment and the macOS jobs are untouched.
• scripts/build-binary.sh: when APM_MAX_GLIBC is set, the build reads every bundled ELF file with objdump -T and fails if any of them needs a newer GLIBC_* symbol version. Release builds set it to 2.28.
• build-release.yml: both Linux binaries (x86_64 and arm64) run apm --version, apm init and apm install microsoft/apm-sample-package in a rockylinux:8 container. The container installs git-core first because apm imports GitPython at startup.
• ci.yml: the non-required pr-binary-smoke job builds the same way, so PRs build the binary the way releases do and run the glibc check. The approved scope does not list this file. Without the change, PR CI would keep building with setup-python and never exercise the release path. I can drop it if you prefer.
• install.sh: REQUIRED_GLIBC is 2.28. Hosts below 2.28 still go to the existing pip fallback.
• Docs: installation.md, the apm-usage commands.md, devcontainer/README.md and CHANGELOG state 2.28.

Issue and approved scope

Issue: Closes #3399

Human scope-approval comment: #3399 (comment)

This PR completes the issue. Against the "Done when" list:

• The release build fails when any ELF file in the Linux x86_64 or arm64 bundle needs a GLIBC symbol version above 2.28: the build-binary.sh check, enabled for both Linux matrix entries.
• Both Linux binaries run apm --version and apm install of a sample package in a Rocky Linux 8 container in CI: the smoke step in build-release.yml.
• install.sh installs the prebuilt binary on glibc 2.28+ hosts and routes older hosts to the pip fallback: covered by the installer unit tests.
• installation.md, commands.md and the installer unit tests state 2.28.
• Windows and macOS builds are unchanged.

build-release.yml runs on push to main, tags, schedule and dispatch, so the first run after merge is the first CI evidence for arm64 and for the Rocky 8 container step. PR CI covers the x86_64 build and the glibc check.

Type of change

• Bug fix
• New feature
• Documentation
• Maintenance / refactor

Testing

• Tested locally
• All existing tests pass
• Added tests for new functionality (if applicable)

Local results on Rocky Linux 8.10 (glibc 2.28, x86_64):

• UV_PYTHON_PREFERENCE=only-managed UV_PYTHON=3.12 APM_MAX_GLIBC=2.28 uv run ./scripts/build-binary.sh on this branch passes. The check reads 6 ELF files, and the highest symbol version any of them needs is GLIBC_2.17.
• With that binary on the same host, apm --version, apm init -y and apm install microsoft/apm-sample-package --target claude succeed, and apm_modules/microsoft/apm-sample-package/apm.yml exists.
• The same check against the v0.35.0 release bundle fails as expected: libpython3.12.so.1.0, math, _pickle, _decimal and pyexpat need GLIBC_2.38, and five more extension modules need 2.29 to 2.34.
• tests/unit/install: 3100 passed. The glibc cases now cover 2.17 to 2.39. With REQUIRED_GLIBC set back to 2.38, 16 of the 20 glibc cases fail.
• Full unit suite (tests/unit tests/test_console.py): 25532 passed, 7 failed. The same 7 fail on unmodified main in my container. They depend on CODEX_HOME and proxy settings there and do not touch the files in this PR.
• Workflow contract tests (180 passed), tests/unit/policy/test_help_consistency.py (6 passed), ruff, and actionlint 1.7.12 with no findings (shellcheck was not installed, so run: scripts were not linted).
• Not tested locally: arm64, and the docker run step itself. I ran the same commands directly on the Rocky 8.10 host.

Notes for reviewers:

• CI installs UPX, and my local build had none. The v0.35.0 release bundle contains no UPX-packed ELF files, so the check reads real symbol tables today. If UPX ever packs a bundled .so, objdump -T may report nothing for that file, and the Rocky 8 smoke step is the backstop.
• While testing I found that apm --version exits with a GitPython error when git is not on PATH, although installation.md says it works without Git. This already happens on main and is out of scope here. I can open a separate issue.

Spec conformance (OpenAPM v0.1)

If this PR changes behaviour that an OpenAPM v0.1 req-XXX covers,
confirm the three-step ritual in the
development guide:

• Spec edit: docs/src/content/docs/specs/openapm-v0.1.md updated
  (new/changed <a id="req-XXX"></a> anchor + prose + Appendix C
  row).
• Manifest edit: docs/src/content/docs/specs/manifests/openapm-v0.1.requirements.yml
  updated.
• Test edit: a @pytest.mark.req("req-XXX") test under
  tests/spec_conformance/ added or extended.
• CONFORMANCE.{md,json} regenerated via
  uv run --extra dev python -m tests.spec_conformance.gen_statement
  and committed.
• N/A -- this PR does not change OpenAPM-observable behaviour.