Fix musl release builds with vendored SASL and static deps

Vendor Cyrus SASL (PLAIN/SCRAM), OpenSSL, and zlib for x86_64-unknown-linux-musl so the release binary links fully statically without glibc or shared libsasl2.

Author: mumoshu

.github/workflows/release.yml

@@ -7,6 +7,18 @@ on:
     tags:
       - 'v*.*.*'
   workflow_dispatch:
+    inputs:
+      only_target:
+        description: 'Build only this target (empty = all)'
+        required: false
+        type: choice
+        options:
+          - ''
+          - x86_64-unknown-linux-gnu
+          - aarch64-unknown-linux-gnu
+          - x86_64-unknown-linux-musl
+          - aarch64-apple-darwin
+        default: ''
 
 env:
   CARGO_TERM_COLOR: always
@@ -15,6 +27,7 @@ jobs:
   build:
     name: Build ${{ matrix.target }}
     runs-on: ${{ matrix.os }}
+    if: ${{ github.event_name != 'workflow_dispatch' || inputs.only_target == '' || inputs.only_target == matrix.target }}
     continue-on-error: ${{ matrix.continue-on-error || false }}
     permissions:
       contents: read
@@ -32,7 +45,6 @@ jobs:
           - target: x86_64-unknown-linux-musl
             os: ubuntu-latest
             binary_name: surreal-sync
-            continue-on-error: true
           # - target: aarch64-unknown-linux-musl
           #   os: ubuntu-latest
           #   binary_name: surreal-sync
@@ -79,12 +91,25 @@ jobs:
           FEATURES=""
           case "${{ matrix.target }}" in
             *-musl)
-              FEATURES="--features vendored-openssl"
+              FEATURES="--features static-musl"
               export CC=musl-gcc
               ;;
           esac
           cargo build --release --target ${{ matrix.target }} $FEATURES
 
+      - name: Verify static linking (musl)
+        if: contains(matrix.target, 'musl')
+        run: |
+          BIN="target/${{ matrix.target }}/release/${{ matrix.binary_name }}"
+          file "$BIN"
+          if readelf -d "$BIN" | grep -q 'NEEDED'; then
+            echo "Error: musl binary has dynamic library dependencies:"
+            readelf -d "$BIN" | grep 'NEEDED' || true
+            ldd "$BIN" || true
+            exit 1
+          fi
+          echo "OK: no dynamic NEEDED entries (fully static)"
+
       - name: Create archive
         shell: bash
         run: |

Cargo.lock

@@ -45,6 +45,8 @@ publish = false
 [features]
 default = []
 vendored-openssl = ["dep:openssl"]
+# Fully static musl builds: vendored OpenSSL + Kafka static-native (SASL PLAIN/SCRAM, zlib).
+static-musl = ["vendored-openssl", "surreal-sync-kafka/static-native"]
 
 [dependencies]
 # CLI framework

Cargo.toml

@@ -43,6 +43,12 @@ producer = [
     "dep:tempfile",
     "dep:tracing-subscriber",
 ]
+# Static/vendored native deps for musl (and similar) builds: OpenSSL, zlib, Cyrus SASL PLAIN+SCRAM.
+static-native = [
+    "rdkafka/ssl-vendored",
+    "rdkafka/libz-static",
+    "dep:sasl2-sys",
+]
 
 [dependencies]
 # types
@@ -69,6 +75,9 @@ clap = { version = "4.5", features = ["derive", "env"], optional = true }
 rdkafka = { version = "0.39", features = ["tokio", "sasl"], optional = true }
 tokio = { version = "1.49", features = ["full"], optional = true }
 tempfile = { version = "3.27", optional = true }
+# Feature-unified with rdkafka-sys's sasl2-sys when static-native is enabled.
+# plain/scram imply vendored and enable the plugins Kafka SASL auth needs.
+sasl2-sys = { version = "0.1.22", features = ["plain", "scram"], optional = true }
 
 # producer
 tracing-subscriber = { version = "0.3", features = ["env-filter"], optional = true }

crates/kafka/Cargo.toml

@@ -82,6 +82,8 @@ For secured Kafka clusters, set `--security-protocol` to `SASL_PLAINTEXT` or `SA
 | `--sasl-password <PASS>` | `KAFKA_SASL_PASSWORD` | SASL password |
 | `--sasl-mechanism <MECH>` | — | `SCRAM-SHA-256`, `SCRAM-SHA-512`, or `PLAIN` |
 
+Kerberos (GSSAPI) is intentionally not supported.
+
 ### TLS / mTLS
 
 When `--security-protocol` is `SSL` or `SASL_SSL`, you can configure TLS trust and optional mutual TLS (mTLS) client authentication. These flags map to librdkafka `ssl.*` settings and are ignored for `PLAINTEXT` and `SASL_PLAINTEXT`.