Build audit

5-target build matrix

The matrix is split into two workflows (ljh-sh dist regime):

• build-and-test.yml — fires on push to main + every PR. Runs the matrix + smoke + uploads per-target artifacts.
• release.yml — fires on v* tags + workflow_dispatch. Runs the same matrix, downloads all artifacts, and creates a GitHub Release with the SHA256SUMS file.

What scripts/build.sh does

1. Sub-build 1: ICU 78.3 — out-of-tree runConfigureICU Linux with --enable-static --disable-shared --disable-icuio --disable-icusnfp --disable-icuscriptbreaks --disable-extras --disable-samples --disable-tests, then make. ~10 min on a 4-core runner. Produces build/icu/lib/libicuuc.a + build/icu/lib/libicudata.a.
2. Sub-build 2: dwdiff — in-source ./configure --without-gettext --prefix=/usr/local + make. Detects ICU via pkg-config; we write a shim build/pkgconfig/icu-uc.pc that points dwdiff's icu-uc lookup at the vendored static ICU. ~3 s. Produces upstream/dwdiff/dwdiff + dwfilter.
3. Copy + distclean — copy the freshly-built binaries to build/dwdiff/ (so smoke.sh + package.sh can find them in a stable location), then make distclean in the source dir to restore the upstream tree.

dwdiff's configure writes config.pkg in the source dir, so the build is in-source by necessity. We restore the tree after build via make distclean + an explicit cp config.pkg from the tarball at vendor-refresh time.

Why the binary is so big

A static dwdiff binary with bundled ICU 78.3 is ~30-35 MB. The bulk is the ICU Unicode database (~15 MB of libicudata.a) + the ICU normalisation tables. We disable --disable-icuio --disable-icusnfp --disable-icuscriptbreaks --disable-extras to trim ~20% of that. Further reduction is possible with the ICU_DATA_SIZE_WHEN_STATIC build option, but requires custom data-build tooling and is deferred to a v0.2.0 build-script patch.

The size is the price of a fully self-contained CJK + Unicode-segmentation diff tool. Distroless / scratch containers that don't have system ICU get full support.

Verifying a release

Each GitHub Release ships:

• 5 per-target archives (dwdiff-<target>.tar.gz or .zip)
• 5 per-archive .sha256 files
• 1 top-level SHA256SUMS file (basename-keyed, no dist/ prefix)

To verify the Linux x86_64 musl binary:

curl -L -O https://github.com/ljh-sh/dwdiff/releases/latest/download/dwdiff-x86_64-linux-musl.tar.gz
curl -L -O https://github.com/ljh-sh/dwdiff/releases/latest/download/dwdiff-x86_64-linux-musl.tar.gz.sha256
sha256sum -c dwdiff-x86_64-linux-musl.tar.gz.sha256

To verify all 5 archives against the top-level SHA256SUMS:

curl -L -O https://github.com/ljh-sh/dwdiff/releases/latest/download/SHA256SUMS
for f in dwdiff-*.tar.gz dwdiff-*.zip; do sha256sum -c <(grep "  $f$" SHA256SUMS); done