feat: use cross-compilation to build images (#1833)

mayeut · web-flow · commit 5b0ba32b764e · 2025-10-18T10:05:25.000+02:00
* feat: use cross-compilation to build images

* update clang
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -50,6 +50,8 @@ jobs:
               ("i686", "ubuntu-24.04", ("manylinux2014", "manylinux_2_28", "manylinux_2_34", "musllinux_1_2")),
               ("armv7l", "ubuntu-24.04-arm", ("manylinux_2_31", "musllinux_1_2")),
               ("riscv64", "ubuntu-24.04", ("manylinux_2_39", "musllinux_1_2")),
+              ("ppc64le", "ubuntu-24.04", ("manylinux2014", "manylinux_2_28", "manylinux_2_34", "musllinux_1_2",)),
+              ("s390x", "ubuntu-24.04", ("musllinux_1_2",)),
           ]
           expanded = [{"policy": policy, "platform": platform, "runner": runner} for platform, runner, policies in reduced for policy in policies]
           print(json.dumps(expanded, indent=2))
@@ -79,7 +81,7 @@ jobs:
           fetch-depth: 50
 
       - name: Set up QEMU
-        if: matrix.platform == 'riscv64'
+        if: matrix.platform == 'ppc64le' || matrix.platform == 'riscv64' || matrix.platform == 's390x'
         uses: docker/setup-qemu-action@v3
 
       - name: Set up Docker Buildx
diff --git a/.travis.yml b/.travis.yml
@@ -28,20 +28,10 @@ jobs:
    include:
     - arch: s390x
       env: POLICY="manylinux2014" PLATFORM="s390x"
-    - arch: ppc64le
-      env: POLICY="manylinux2014" PLATFORM="ppc64le"
     - arch: s390x
       env: POLICY="manylinux_2_28" PLATFORM="s390x"
-    - arch: ppc64le
-      env: POLICY="manylinux_2_28" PLATFORM="ppc64le"
     - arch: s390x
       env: POLICY="manylinux_2_34" PLATFORM="s390x"
-    - arch: ppc64le
-      env: POLICY="manylinux_2_34" PLATFORM="ppc64le"
-    - arch: s390x
-      env: POLICY="musllinux_1_2" PLATFORM="s390x"
-    - arch: ppc64le
-      env: POLICY="musllinux_1_2" PLATFORM="ppc64le"
 
 before_install:
   - if [ -d "${HOME}/buildx-cache/.buildx-cache-${POLICY}_${PLATFORM}" ]; then cp -rlf ${HOME}/buildx-cache/.buildx-cache-${POLICY}_${PLATFORM} ./; fi
diff --git a/build.sh b/build.sh
@@ -80,13 +80,58 @@ export DEVTOOLSET_ROOTPATH
 export PREPEND_PATH
 export LD_LIBRARY_PATH_ARG
 
+# cross-compilation tools platform, installed in any case
+if [ "${MANYLINUX_BUILDARCH:-}" == "" ]; then
+	if [ "${MANYLINUX_BUILD_FRONTEND}" == "podman" ]; then
+		MANYLINUX_BUILDARCH=$(podman version -f "{{.Server.Arch}}")
+	else
+		MANYLINUX_BUILDARCH=$(docker version -f "{{.Server.Arch}}")
+	fi
+	if [ "${MANYLINUX_BUILDARCH}" == "arm" ]; then
+		MANYLINUX_BUILDARCH="arm/v7"
+	fi
+fi
+export MANYLINUX_BUILDARCH
+
+# cross-compilation tools usage, by default, only on amd64/arm64
+if [ "${MANYLINUX_DISABLE_CLANG:-}" == "" ]; then
+	if [ "${MANYLINUX_BUILDARCH}" == "amd64" ] || [ "${MANYLINUX_BUILDARCH}" == "arm64" ]; then
+		MANYLINUX_DISABLE_CLANG=0
+	else
+		MANYLINUX_DISABLE_CLANG=1
+	fi
+fi
+if [ "${MANYLINUX_DISABLE_CLANG}" != "0" ]; then
+	MANYLINUX_DISABLE_CLANG=1  # integer bool like
+fi
+export MANYLINUX_DISABLE_CLANG
+
+# cross-compilation tools usage when building cpython, default depends on PEP11
+if [ "${MANYLINUX_DISABLE_CLANG_FOR_CPYTHON:-}" == "" ]; then
+	MANYLINUX_DISABLE_CLANG_FOR_CPYTHON=0
+	if [ "${POLICY:0:9}" == "manylinux" ]; then
+		case "${PLATFORM}" in
+			aarch64|x86_64) MANYLINUX_DISABLE_CLANG_FOR_CPYTHON=1;; # gcc is Tier-1, clang is Tier-2
+			armv7l) MANYLINUX_DISABLE_CLANG_FOR_CPYTHON=1;; # gcc is Tier-3, clang not supported at all
+			s390x) MANYLINUX_DISABLE_CLANG_FOR_CPYTHON=1;; # gcc is Tier-3, clang not supported at all
+			*) ;;
+		esac
+	fi
+fi
+if [ "${MANYLINUX_DISABLE_CLANG_FOR_CPYTHON}" != "0" ]; then
+	MANYLINUX_DISABLE_CLANG_FOR_CPYTHON=1  # integer bool like
+fi
+export MANYLINUX_DISABLE_CLANG_FOR_CPYTHON
+
+
 MANYLINUX_IMAGE="quay.io/pypa/${POLICY}_${PLATFORM}:${COMMIT_SHA}"
 
 BUILD_ARGS_COMMON=(
 	"--platform=linux/${GOARCH}"
 	"--pull=true"
 	--build-arg POLICY --build-arg PLATFORM --build-arg BASEIMAGE
 	--build-arg DEVTOOLSET_ROOTPATH --build-arg PREPEND_PATH --build-arg LD_LIBRARY_PATH_ARG
+	--build-arg MANYLINUX_BUILDARCH --build-arg MANYLINUX_DISABLE_CLANG --build-arg MANYLINUX_DISABLE_CLANG_FOR_CPYTHON
 	--rm -t "${MANYLINUX_IMAGE}"
 	-f docker/Dockerfile docker/
 )
diff --git a/docker/Dockerfile b/docker/Dockerfile
@@ -5,8 +5,12 @@ ARG PLATFORM=x86_64
 ARG DEVTOOLSET_ROOTPATH=/opt/rh/gcc-toolset-14/root
 ARG LD_LIBRARY_PATH_ARG=${DEVTOOLSET_ROOTPATH}/usr/lib64:${DEVTOOLSET_ROOTPATH}/usr/lib:${DEVTOOLSET_ROOTPATH}/usr/lib64/dyninst:${DEVTOOLSET_ROOTPATH}/usr/lib/dyninst
 ARG PREPEND_PATH=/usr/local/bin:${DEVTOOLSET_ROOTPATH}/usr/bin:
+ARG MANYLINUX_BUILDARCH=${BUILDARCH}
+ARG MANYLINUX_DISABLE_CLANG=0
+ARG MANYLINUX_DISABLE_CLANG_FOR_CPYTHON=0
 
-FROM $BASEIMAGE AS runtime_base
+
+FROM $BASEIMAGE AS runtime_base_packages
 ARG POLICY
 ARG PLATFORM
 ARG DEVTOOLSET_ROOTPATH
@@ -42,29 +46,49 @@ RUN manylinux-entrypoint /build_scripts/install-runtime-packages.sh && rm -rf /b
 
 COPY build_scripts/build_utils.sh /build_scripts/
 
+
+# prepare cross-compilation support
+FROM --platform=linux/${MANYLINUX_BUILDARCH} ghcr.io/mayeut/static-clang:21.1.3.0 AS static_clang_bin
+FROM runtime_base_packages AS static_clang_prepare
+ARG MANYLINUX_DISABLE_CLANG
+COPY build_scripts/install-clang-static.sh /build_scripts/
+RUN --mount=type=bind,target=/clang,from=static_clang_bin \
+    mkdir -p /tmp/cross-compiler && \
+    cp -rf /clang/opt/clang/* /tmp/cross-compiler/ && \
+    /build_scripts/install-clang-static.sh /tmp/cross-compiler
+FROM scratch AS static_clang
+COPY --from=static_clang_prepare /tmp/cross-compiler /
+
+
+FROM runtime_base_packages AS runtime_base
 COPY build_scripts/install-autoconf.sh /build_scripts/
-RUN export AUTOCONF_ROOT=autoconf-2.72 && \
+RUN --mount=type=bind,from=static_clang,target=/tmp/cross-compiler,ro \
+    export AUTOCONF_ROOT=autoconf-2.72 && \
     export AUTOCONF_HASH=afb181a76e1ee72832f6581c0eddf8df032b83e2e0239ef79ebedc4467d92d6e && \
     export AUTOCONF_DOWNLOAD_URL=http://ftp.gnu.org/gnu/autoconf && \
-    manylinux-entrypoint /build_scripts/install-autoconf.sh
+    /tmp/cross-compiler/entrypoint /build_scripts/install-autoconf.sh
 
 COPY build_scripts/install-automake.sh /build_scripts/
-RUN export AUTOMAKE_ROOT=automake-1.18.1 && \
+RUN --mount=type=bind,from=static_clang,target=/tmp/cross-compiler,ro \
+    export AUTOMAKE_ROOT=automake-1.18.1 && \
     export AUTOMAKE_HASH=63e585246d0fc8772dffdee0724f2f988146d1a3f1c756a3dc5cfbefa3c01915 && \
     export AUTOMAKE_DOWNLOAD_URL=http://ftp.gnu.org/gnu/automake && \
-    manylinux-entrypoint /build_scripts/install-automake.sh
+    /tmp/cross-compiler/entrypoint /build_scripts/install-automake.sh
 
 COPY build_scripts/install-libtool.sh /build_scripts/
-RUN export LIBTOOL_ROOT=libtool-2.5.4 && \
+RUN --mount=type=bind,from=static_clang,target=/tmp/cross-compiler,ro \
+    export LIBTOOL_ROOT=libtool-2.5.4 && \
     export LIBTOOL_HASH=da8ebb2ce4dcf46b90098daf962cffa68f4b4f62ea60f798d0ef12929ede6adf && \
     export LIBTOOL_DOWNLOAD_URL=http://ftp.gnu.org/gnu/libtool && \
-    manylinux-entrypoint /build_scripts/install-libtool.sh
+    /tmp/cross-compiler/entrypoint /build_scripts/install-libtool.sh
 
 COPY build_scripts/install-libxcrypt.sh /build_scripts/
-RUN export LIBXCRYPT_VERSION=4.4.38 && \
+RUN --mount=type=bind,from=static_clang,target=/tmp/cross-compiler,ro \
+    export LIBXCRYPT_VERSION=4.4.38 && \
     export LIBXCRYPT_HASH=80304b9c306ea799327f01d9a7549bdb28317789182631f1b54f4511b4206dd6 && \
     export LIBXCRYPT_DOWNLOAD_URL=https://github.com/besser82/libxcrypt/releases/download && \
-    manylinux-entrypoint /build_scripts/install-libxcrypt.sh
+    /tmp/cross-compiler/entrypoint /build_scripts/install-libxcrypt.sh
+
 
 FROM runtime_base AS build_base
 COPY build_scripts/install-build-packages.sh /build_scripts/
@@ -73,81 +97,111 @@ RUN manylinux-entrypoint /build_scripts/install-build-packages.sh
 
 FROM build_base AS build_git
 COPY build_scripts/build-curl.sh /build_scripts/
-RUN export CURL_ROOT=curl-8.16.0 && \
+RUN --mount=type=bind,from=static_clang,target=/tmp/cross-compiler,ro \
+    export CURL_ROOT=curl-8.16.0 && \
     export CURL_HASH=a21e20476e39eca5a4fc5cfb00acf84bbc1f5d8443ec3853ad14c26b3c85b970 && \
     export CURL_DOWNLOAD_URL=https://curl.haxx.se/download && \
-    manylinux-entrypoint /build_scripts/build-curl.sh
+    /tmp/cross-compiler/entrypoint /build_scripts/build-curl.sh
 COPY build_scripts/build-git.sh /build_scripts/
-RUN export GIT_ROOT=git-2.51.0 && \
+RUN --mount=type=bind,from=static_clang,target=/tmp/cross-compiler,ro \
+    export GIT_ROOT=git-2.51.0 && \
     export GIT_HASH=3d531799d2cf2cac8e294ec6e3229e07bfca60dc6c783fe69e7712738bef7283 && \
     export GIT_DOWNLOAD_URL=https://www.kernel.org/pub/software/scm/git && \
-    manylinux-entrypoint /build_scripts/build-git.sh
+    /tmp/cross-compiler/entrypoint /build_scripts/build-git.sh
+
 
 FROM build_base AS build_sqlite3
 COPY build_scripts/build-sqlite3.sh /build_scripts/
-RUN export SQLITE_AUTOCONF_ROOT=sqlite-autoconf-3500400 && \
+RUN --mount=type=bind,from=static_clang,target=/tmp/cross-compiler,ro \
+    export SQLITE_AUTOCONF_ROOT=sqlite-autoconf-3500400 && \
     export SQLITE_AUTOCONF_HASH=a3db587a1b92ee5ddac2f66b3edb41b26f9c867275782d46c3a088977d6a5b18 && \
     export SQLITE_AUTOCONF_DOWNLOAD_URL=https://www.sqlite.org/2025 && \
-    manylinux-entrypoint /build_scripts/build-sqlite3.sh
+    /tmp/cross-compiler/entrypoint /build_scripts/build-sqlite3.sh
+
 
 FROM build_base AS build_tcl_tk
 COPY build_scripts/build-tcltk.sh /build_scripts/
-RUN export TCL_ROOT=tcl8.6.17 && \
+RUN --mount=type=bind,from=static_clang,target=/tmp/cross-compiler,ro \
+    export TCL_ROOT=tcl8.6.17 && \
     export TCL_HASH=a3903371efcce8a405c5c245d029e9f6850258a60fa3761c4d58995610949b31 && \
     export TCL_DOWNLOAD_URL=https://prdownloads.sourceforge.net/tcl && \
     export TK_ROOT=tk8.6.17 && \
     export TK_HASH=e4982df6f969c08bf9dd858a6891059b4a3f50dc6c87c10abadbbe2fc4838946 && \
-    manylinux-entrypoint /build_scripts/build-tcltk.sh
+    /tmp/cross-compiler/entrypoint /build_scripts/build-tcltk.sh
+
 
 FROM build_base AS build_mpdecimal
 COPY build_scripts/build-mpdecimal.sh /build_scripts/
-RUN export MPDECIMAL_ROOT=mpdecimal-4.0.0 && \
+RUN --mount=type=bind,from=static_clang,target=/tmp/cross-compiler,ro \
+    export MPDECIMAL_ROOT=mpdecimal-4.0.0 && \
     export MPDECIMAL_HASH=942445c3245b22730fd41a67a7c5c231d11cb1b9936b9c0f76334fb7d0b4468c && \
     export MPDECIMAL_DOWNLOAD_URL=https://www.bytereef.org/software/mpdecimal/releases && \
-    manylinux-entrypoint /build_scripts/build-mpdecimal.sh
+    /tmp/cross-compiler/entrypoint /build_scripts/build-mpdecimal.sh
 
 
 FROM --platform=${BUILDPLATFORM} ghcr.io/sigstore/cosign/cosign:v2.5.0 AS cosign-bin
 
+
 FROM build_base AS build_cpython
 COPY --from=build_tcl_tk /manylinux-buildfs /
 COPY --from=build_mpdecimal /manylinux-buildfs /
 COPY --from=build_sqlite3 /manylinux-buildfs /
 RUN if command -v apk >/dev/null 2>&1; then ldconfig /; else ldconfig; fi
 COPY build_scripts/build-openssl.sh /build_scripts/
-RUN export OPENSSL_ROOT=openssl-3.5.4 && \
+RUN --mount=type=bind,from=static_clang,target=/tmp/cross-compiler,ro \
+    export OPENSSL_ROOT=openssl-3.5.4 && \
     export OPENSSL_HASH=967311f84955316969bdb1d8d4b983718ef42338639c621ec4c34fddef355e99 && \
     export OPENSSL_DOWNLOAD_URL=https://github.com/openssl/openssl/releases/download/${OPENSSL_ROOT} && \
-    manylinux-entrypoint /build_scripts/build-openssl.sh
+    /tmp/cross-compiler/entrypoint /build_scripts/build-openssl.sh
 COPY --from=cosign-bin /ko-app/cosign /usr/local/bin/cosign
 COPY build_scripts/build-cpython.sh /build_scripts/
 
+
 FROM build_cpython AS build_cpython38
-RUN manylinux-entrypoint /build_scripts/build-cpython.sh lukasz@langa.pl https://github.com/login/oauth 3.8.20
+ARG MANYLINUX_DISABLE_CLANG_FOR_CPYTHON
+RUN --mount=type=bind,from=static_clang,target=/tmp/cross-compiler,ro \
+    /tmp/cross-compiler/entrypoint /build_scripts/build-cpython.sh lukasz@langa.pl https://github.com/login/oauth 3.8.20
 
 FROM build_cpython AS build_cpython39
-RUN manylinux-entrypoint /build_scripts/build-cpython.sh lukasz@langa.pl https://github.com/login/oauth 3.9.24
+ARG MANYLINUX_DISABLE_CLANG_FOR_CPYTHON
+RUN --mount=type=bind,from=static_clang,target=/tmp/cross-compiler,ro \
+    /tmp/cross-compiler/entrypoint /build_scripts/build-cpython.sh lukasz@langa.pl https://github.com/login/oauth 3.9.24
 
 FROM build_cpython AS build_cpython310
-RUN manylinux-entrypoint /build_scripts/build-cpython.sh pablogsal@python.org https://accounts.google.com 3.10.19
+ARG MANYLINUX_DISABLE_CLANG_FOR_CPYTHON
+RUN --mount=type=bind,from=static_clang,target=/tmp/cross-compiler,ro \
+    /tmp/cross-compiler/entrypoint /build_scripts/build-cpython.sh pablogsal@python.org https://accounts.google.com 3.10.19
 
 FROM build_cpython AS build_cpython311
-RUN manylinux-entrypoint /build_scripts/build-cpython.sh pablogsal@python.org https://accounts.google.com 3.11.14
+ARG MANYLINUX_DISABLE_CLANG_FOR_CPYTHON
+RUN --mount=type=bind,from=static_clang,target=/tmp/cross-compiler,ro \
+    /tmp/cross-compiler/entrypoint /build_scripts/build-cpython.sh pablogsal@python.org https://accounts.google.com 3.11.14
 
 FROM build_cpython AS build_cpython312
-RUN manylinux-entrypoint /build_scripts/build-cpython.sh thomas@python.org https://accounts.google.com 3.12.12
+ARG MANYLINUX_DISABLE_CLANG_FOR_CPYTHON
+RUN --mount=type=bind,from=static_clang,target=/tmp/cross-compiler,ro \
+    /tmp/cross-compiler/entrypoint /build_scripts/build-cpython.sh thomas@python.org https://accounts.google.com 3.12.12
 
 FROM build_cpython AS build_cpython313
-RUN manylinux-entrypoint /build_scripts/build-cpython.sh thomas@python.org https://accounts.google.com 3.13.8
+ARG MANYLINUX_DISABLE_CLANG_FOR_CPYTHON
+RUN --mount=type=bind,from=static_clang,target=/tmp/cross-compiler,ro \
+    /tmp/cross-compiler/entrypoint /build_scripts/build-cpython.sh thomas@python.org https://accounts.google.com 3.13.8
 
 FROM build_cpython AS build_cpython313_nogil
-RUN manylinux-entrypoint /build_scripts/build-cpython.sh thomas@python.org https://accounts.google.com 3.13.8 nogil
+ARG MANYLINUX_DISABLE_CLANG_FOR_CPYTHON
+RUN --mount=type=bind,from=static_clang,target=/tmp/cross-compiler,ro \
+    /tmp/cross-compiler/entrypoint /build_scripts/build-cpython.sh thomas@python.org https://accounts.google.com 3.13.8 nogil
 
 FROM build_cpython AS build_cpython314
-RUN manylinux-entrypoint /build_scripts/build-cpython.sh hugo@python.org https://github.com/login/oauth 3.14.0
+ARG MANYLINUX_DISABLE_CLANG_FOR_CPYTHON
+RUN --mount=type=bind,from=static_clang,target=/tmp/cross-compiler,ro \
+    /tmp/cross-compiler/entrypoint /build_scripts/build-cpython.sh hugo@python.org https://github.com/login/oauth 3.14.0
 
 FROM build_cpython AS build_cpython314_nogil
-RUN manylinux-entrypoint /build_scripts/build-cpython.sh hugo@python.org https://github.com/login/oauth 3.14.0 nogil
+ARG MANYLINUX_DISABLE_CLANG_FOR_CPYTHON
+RUN --mount=type=bind,from=static_clang,target=/tmp/cross-compiler,ro \
+    /tmp/cross-compiler/entrypoint /build_scripts/build-cpython.sh hugo@python.org https://github.com/login/oauth 3.14.0 nogil
+
 
 FROM runtime_base
 COPY --from=build_tcl_tk /manylinux-rootfs /
diff --git a/docker/build_scripts/build-cpython.sh b/docker/build_scripts/build-cpython.sh
@@ -35,7 +35,7 @@ tar -xJf "Python-${CPYTHON_VERSION}.tar.xz"
 pushd "Python-${CPYTHON_VERSION}"
 PREFIX="/opt/_internal/cpython-${CPYTHON_VERSION}"
 mkdir -p "${PREFIX}/lib"
-CFLAGS_EXTRA=""
+LDFLAGS_EXTRA=""
 CONFIGURE_ARGS=(--disable-shared --with-ensurepip=no)
 
 if [ "${4:-}" == "nogil" ]; then
@@ -45,7 +45,7 @@ fi
 
 if [ "${AUDITWHEEL_POLICY}" == "manylinux2014" ] ; then
 	# Python 3.11+
-	export TCLTK_LIBS="-ltk8.6 -ltcl8.6"
+	export TCLTK_LIBS="-L/usr/local/lib -ltk8.6 -ltcl8.6"
 fi
 
 if [ "${BASE_POLICY}_${AUDITWHEEL_ARCH}" == "manylinux_armv7l" ]; then
@@ -55,30 +55,26 @@ elif [ "${BASE_POLICY}_${AUDITWHEEL_ARCH}" == "musllinux_armv7l" ]; then
 fi
 
 case "${CPYTHON_VERSION}" in
-	3.8.*|3.9.*|3.10.*) sed -i "s|/usr/local/include/sqlite3|/opt/_internal/sqlite3/include|g ; s|sqlite_extra_link_args = ()|sqlite_extra_link_args = ('-Wl,--enable-new-dtags,-rpath=/opt/_internal/sqlite3/lib',)|g" setup.py;;
+	3.8.*|3.9.*|3.10.*) sed -i "s|/usr/local/include/sqlite3|/opt/_internal/sqlite3/include|g ; s|sqlite_extra_link_args = ()|sqlite_extra_link_args = ('-Wl,-rpath=/opt/_internal/sqlite3/lib',)|g" setup.py;;
 	*) ;;
 esac
 
 OPENSSL_PREFIX=$(find /opt/_internal -maxdepth 1 -name 'openssl*')
 if [ "${OPENSSL_PREFIX}" != "" ]; then
 	CONFIGURE_ARGS+=("--with-openssl=${OPENSSL_PREFIX}")
 	case "${CPYTHON_VERSION}" in
-		3.8.*|3.9.*) export LD_RUN_PATH=${OPENSSL_PREFIX}/lib;;
+		3.8.*|3.9.*) export LDFLAGS_EXTRA="-Wl,-rpath,${OPENSSL_PREFIX}/lib";;
 		*) CONFIGURE_ARGS+=(--with-openssl-rpath=auto);;
 	esac
 fi
 
 unset _PYTHON_HOST_PLATFORM
 
-if [ "${AUDITWHEEL_ARCH}" == "x86_64" ] && echo | gcc -S -x c -v - 2>&1 | grep 'march=x86-64-v' > /dev/null; then
-	export EXTRA_CFLAGS="-mtune=generic -march=x86-64"
-fi
-
 # configure with hardening options only for the interpreter & stdlib C extensions
 # do not change the default for user built extension (yet?)
 ./configure \
-	CFLAGS_NODIST="${MANYLINUX_CFLAGS} ${MANYLINUX_CPPFLAGS} ${CFLAGS_EXTRA}" \
-	LDFLAGS_NODIST="${MANYLINUX_LDFLAGS}" \
+	CFLAGS_NODIST="${MANYLINUX_CFLAGS} ${MANYLINUX_CPPFLAGS}" \
+	LDFLAGS_NODIST="${MANYLINUX_LDFLAGS} ${LDFLAGS_EXTRA}" \
 	"--prefix=${PREFIX}" "${CONFIGURE_ARGS[@]}" > /dev/null
 make > /dev/null
 make install > /dev/null
diff --git a/docker/build_scripts/build-openssl.sh b/docker/build_scripts/build-openssl.sh
@@ -47,11 +47,16 @@ if [ "$(nproc)" -ge 2 ]; then
 	PARALLEL_BUILDS=-j2
 fi
 
+LIBATOMIC=
+if [ "${AUDITWHEEL_ARCH}" == "i686" ]; then
+	LIBATOMIC=-latomic
+fi
+
 fetch_source "${OPENSSL_ROOT}.tar.gz" "${OPENSSL_DOWNLOAD_URL}"
 check_sha256sum "${OPENSSL_ROOT}.tar.gz" "${OPENSSL_HASH}"
 tar -xzf "${OPENSSL_ROOT}.tar.gz"
 pushd "${OPENSSL_ROOT}"
-./Configure "--prefix=${PREFIX}" "--openssldir=${PREFIX}" --libdir=lib CPPFLAGS="${MANYLINUX_CPPFLAGS}" CFLAGS="${MANYLINUX_CFLAGS}" CXXFLAGS="${MANYLINUX_CXXFLAGS}" LDFLAGS="${MANYLINUX_LDFLAGS} -Wl,-rpath,\$(LIBRPATH)" > /dev/null
+./Configure "--prefix=${PREFIX}" "--openssldir=${PREFIX}" --libdir=lib no-afalgeng CPPFLAGS="${MANYLINUX_CPPFLAGS}" CFLAGS="${MANYLINUX_CFLAGS}" CXXFLAGS="${MANYLINUX_CXXFLAGS}" LDFLAGS="${MANYLINUX_LDFLAGS} -Wl,-rpath,\$(LIBRPATH) ${LIBATOMIC}" > /dev/null
 make ${PARALLEL_BUILDS} > /dev/null
 make install_sw > /dev/null
 popd
diff --git a/docker/build_scripts/install-clang-static.sh b/docker/build_scripts/install-clang-static.sh
diff --git a/docker/build_scripts/install-libxcrypt.sh b/docker/build_scripts/install-libxcrypt.sh
