[WIP] Implement Option B to fix failing GitHub Actions job for PR #21188

[Copilot]

• Investigate CI failure and understand root cause (vendored libtirpc 1.3.2 fails to compile on Ubuntu 24.04 due to prototype conflicts)
• Review Dockerfile.template and NVIDIA Makefile to understand build flags
• Modify tools/libnvidia-container/Dockerfile.template:
  • Add libtirpc-dev to apt-get install list
  • Remove export WITH_TIRPC=yes so vendored libtirpc is not built
• Run parallel validation (code review + CodeQL)

Original prompt

Create a PR implementing Option B to fix the failing GitHub Actions job for PR #21188.

Context

The workflow .github/workflows/check.yml (ref a15842958c8bbae57b390268eda1d4e17a43857a) fails when building the libnvidia-container tool image.

Failing job logs: https://github.com/uniget-org/tools/actions/runs/25047753931/job/73416100199?pr=21188

The build fails while compiling vendored libtirpc 1.3.2 as part of NVIDIA/libnvidia-container v1.19.0 deps build:

• auth_none.c:65:15: error: conflicting types for 'xdr_opaque_auth'
• additional errors indicating old-style prototype mismatch vs tirpc/rpc/auth.h

Goal

Implement Option B: avoid building the vendored libtirpc and instead use the distro-provided libtirpc development package in the image build.

Requirements

1. Locate where libnvidia-container Docker image build is defined (likely tools/libnvidia-container/Dockerfile.template and/or generated tools/libnvidia-container/Dockerfile).
2. Modify the build so it installs system libtirpc-dev (and any required build deps like pkg-config) via apt in the build stage.
3. Adjust environment variables / make flags so that libnvidia-container does not build the vendored libtirpc (deps/src/libtirpc-*).
   • The current build (from logs) runs something like:

     export WITH_LIBELF=yes
     export WITH_TIRPC=yes
     make deps
     make shared static
     make tools
     make install DESTDIR="${prefix}" prefix=""

   • Change this so that tirpc is satisfied by system packages and the vendored build is skipped.
4. Keep changes minimal and scoped only to the libnvidia-container tool build.
5. Ensure the CI build still succeeds on ubuntu-24.04.
6. If needed, update documentation/comments in the Dockerfile template to explain why system libtirpc is used.

Validation

• The make libnvidia-container--push step in CI should no longer attempt to compile deps/src/libtirpc-1.3.2.
• libnvidia-container image build completes successfully.

Notes

• The repository uses a generated Dockerfile approach: make/tool.mk generates tools/<tool>/Dockerfile from Dockerfile.template.
• Ensure the change is applied in the template source, not only the generated file.

The following is the prior conversation context from the user's chat exploration (may be truncated):

User: Please find a solution for this failing job. Use the logs, job definition, and any referenced files where the failure occurred. Keep your response focused on the solution and include code suggestions when appropriate.

Assistant: The job is failing while building the libnvidia-container tool image. The build breaks inside make deps when compiling the vendored libtirpc 1.3.2 sources:

• Error (from the job log): auth_none.c:65:15: error: conflicting types for 'xdr_opaque_auth' ...
• This typically happens with newer toolchains / headers (Ubuntu 24.04’s gcc/glibc) where old-style function prototypes (extern bool_t xdr_opaque_auth();) become incompatible with the actual prototype from tirpc/rpc/auth.h.

Fix: update libtirpc used by libnvidia-container (or stop building the vendored one)

You’re currently building NVIDIA/libnvidia-container v1.19.0 in the Docker build step (log shows --branch "v1.19.0" and export WITH_TIRPC=yes then make deps). That version pulls in libtirpc 1.3.2, which is too old for the runner/toolchain.

You have two practical options; I recommend option A.

---

Option A (recommended): bump the libnvidia-container version

Update the tool definition to use a newer libnvidia-container release where dependency/toolchain compatibility is fixed (or where the dependency versions were updated).

What to change
In tools/libnvidia-container/manifest.yaml, bump .version from 1.19.0 to a newer known-good release (e.g. 1.19.1+ or whatever is current/works for you).

That will flow into the build because your Docker build step uses --branch "v${version}" (as shown in the failing log), so simply changing the manifest version changes what gets cloned and built.

Why this works
Newer upstream versions generally refresh vendored deps and/or carry compatibility fixes for newer compilers/headers.

---

Option B: avoid building vendored libtirpc; use distro libtirpc instead

If your Dockerfile/template currently forces vendored tirpc via:

export WITH_TIRPC=yes
make deps

…then change the build to install libtirpc-dev from apt and disable vendored tirpc builds (exact flags depend on upstream’s makefiles, but the idea is: don’t build deps/src/libtirpc-* at all).

Concrete change (pattern)
In the tools/libnvidia-container/Dockerfile.template (or the generated Dockerfile), in the “prepare” stage:

1. Install system packages:

RUN apt-get update && apt-get install -y --no-install-recommends \
    libtirpc-dev \
    pkg-config \
 && rm -rf /var/lib/apt/lists/*

2. Drop WITH_TIRPC=yes (or set it to no...

This pull request was created from Copilot chat.