Linux release binaries require glibc 2.38+ — fail on Debian 12 / Ubuntu 22.04 / Amazon Linux 2023

[0xMassi]

Summary

The prebuilt Linux release binaries (webclaw, webclaw-mcp, webclaw-server) require glibc 2.38+, so they fail to start on common server distros whose glibc is older — Debian 12, Ubuntu 22.04 LTS, Amazon Linux 2023, RHEL/Rocky 9, etc.

$ webclaw-mcp
webclaw-mcp: /lib/aarch64-linux-gnu/libc.so.6: version `GLIBC_2.38' not found (required by webclaw-mcp)

Confirmed on node:20-bookworm (Debian 12, glibc 2.36). The binary's max required symbol version:

$ objdump -T webclaw-mcp | grep -o 'GLIBC_[0-9.]*' | sort -V | tail -1
GLIBC_2.38

Root cause

release.yml builds the Linux targets on ubuntu-latest:

- target: x86_64-unknown-linux-gnu
  os: ubuntu-latest
- target: aarch64-unknown-linux-gnu
  os: ubuntu-latest

ubuntu-latest is now Ubuntu 24.04 (glibc 2.39), so the binaries link against GLIBC_2.38 symbols. glibc is forward-compatible but not backward-compatible: a binary built against 2.39 won't run on a host with 2.36.

Affected distros (glibc < 2.38)

Distro	glibc
Ubuntu 22.04 LTS	2.35
Debian 12 (bookworm)	2.36
Amazon Linux 2023	2.34
RHEL 9 / Rocky 9	2.34

Impact

Worse now that create-webclaw actually downloads the prebuilt binary (#71 / #72): on these hosts the install succeeds (download + extract + config all work), but the binary then fails at runtime when the MCP client launches it. The scaffolder's verify step swallows the error, so it looks installed but silently doesn't run.

Suggested fixes (pick one)

1. Pin the Linux build to ubuntu-22.04 (glibc 2.35) — smallest change, covers everything down to ~2.35.
2. Build in a manylinux-style container with an older glibc baseline for a wider floor.
3. Statically link musl (x86_64-unknown-linux-musl / aarch64-unknown-linux-musl) — zero glibc dependency, runs anywhere. Note: BoringSSL / wreq and any C deps need to build under musl, so this needs a test build.

Option 1 is the quick win; option 3 is the most robust long-term.

Context

Surfaced while verifying #71 (create-webclaw Windows install). Independent of that fix — this is a release-build issue, not a scaffolder issue.

[0xMassi]

Partial fix (#74) verified in Docker

Built webclaw-mcp from source on a real Ubuntu 22.04 / glibc 2.35 container (replicating what #74 makes the release workflow do), then ran the current v0.6.13 release binary vs the new build across four distros with a real MCP initialize handshake:

Distro	glibc	OLD release (GLIBC_2.38)	NEW build (GLIBC_2.35)
Ubuntu 24.04	2.39	✅ PASS	✅ PASS
Debian 12 (bookworm)	2.36	❌ FAIL	✅ PASS
Ubuntu 22.04	2.35	❌ FAIL	✅ PASS
Debian 11 (bullseye)	2.31	❌ FAIL	❌ FAIL (floor)

Confirmed:

• The workspace builds on the older toolchain (BoringSSL / bindgen / wreq all compile on glibc 2.35).
• objdump -T on the new binary shows max symbol GLIBC_2.35 (down from 2.38), and it runs (full MCP handshake) on Debian 12 + Ubuntu 22.04 where the current release fails.
• The floor is exactly 2.35 — still fails on anything older (Debian 11 / 2.31, and by extension Amazon Linux 2023 / RHEL 9 at 2.34).

So #74 covers the common LTS targets (Debian 12, Ubuntu 22.04+) but not glibc < 2.35. Full coverage needs a musl static build — keeping this issue open to track that.