# Shared Alpine/musl static builder pattern

This directory defines the common static build base used by `stack/*` C99 binaries.

## Why this exists

Per [F30](../../plans/threat_model.md#46-image-build-and-reproducibility), every n-OS-tr C binary must be built in Alpine and statically linked against musl so `ldd` reports `not a dynamic executable`.

## Files

- `Dockerfile.alpine-musl`: shared Alpine 3.19 base with common musl/static build dependencies.
- `build_static.sh`: generic wrapper that:
  - accepts `<target-dir>`
  - picks `linux/amd64` or `linux/arm64` using `uname -m` (or `ARCH=arm64` override)
  - builds the shared base image and the target app image
  - extracts the built binary to `<target-dir>/build/<basename>_static_<arch>`

## Invocation pattern from subtrees

Each stack component keeps its own `Dockerfile.alpine-musl` and a thin wrapper script:

```bash
./stack/<component>/build_static.sh
```

The component wrapper calls this shared script as:

```bash
../build-common/build_static.sh .
```

from inside that component directory.