glibc.yaml: Add openssf-options (and disable it)

[justinvreeland]

No description provided.

[dannf]

Thanks @justinvreeland. I haven't had time to dig into the root cause yet, so let's go with this.

Would you mind adding a link to https://github.com/chainguard-dev/internal-dev/issues/7756 above the GCC_SPEC_FILE setting?

Should we guard this to only apply to the ARM builds?

[justinvreeland]

Would you mind adding a link to https://github.com/chainguard-dev/internal-dev/issues/7756 above the GCC_SPEC_FILE setting?

Done.

Should we guard this to only apply to the ARM builds?

I'm not sure if we can do that in the yaml tbh. But in general I prefer keeping things as close as possible in the architectures. Don't have particularly strong feelings about that though.

[dannf]

Would you mind adding a link to chainguard-dev/internal-dev#7756 above the GCC_SPEC_FILE setting?

Done.

Should we guard this to only apply to the ARM builds?

I'm not sure if we can do that in the yaml tbh.

Yeah, probably not in the environment section, so we'd have to do something like this in a runs:

[ "${{build.arch}}" = "aarch64" ] || export GCC_SPEC_FILE=/dev/null

But in general I prefer keeping things as close as possible in the architectures. Don't have particularly strong feelings about that though.

Fair enough, let's just merge this as-is. Thanks!

[justinvreeland]

Rebasing to see if that fixes whatever is stopping the merge

[xnox]

@justinvreeland it seems that "maintainers can modify this PR" has been turned off; and we have no ability to re-run ci-sbom-validity. Either you need to rebase this PR, or I guess i can create a new one with hope of it passing ci checks.

[xnox]

rebased PR here #38280 hopefully it will pass CI.