[Buildroot] [PATCH v2 2/2] package/sysdig: bump to version 0.41.4

[Angelo Compagnucci <angelo.compagnucci@gmail.com>]

sysdig 0.41.4 needs falcosecurity-libs 0.21.0 (whose driver is the same
as the 8.1.0+driver one sysdig requires), and links to libsinsp through
pkg-config, as supported upstream since sysdig 0.40.0, with all the
bundled dependencies disabled.

lua, which runs the chisels, is now a direct dependency. The chisels
use luaL_setfuncs(), so luajit or lua >= 5.3 is needed: lua 5.1 is not
supported anymore.

Patches:
- allow to disable the container plugin, which is either downloaded as
  a prebuilt binary or built with Go; it can be provided by a separate
  package in a following patch
- only include the zlib CMake module with the bundled falcosecurity
  libs, as it comes from them

Release notes:
https://github.com/draios/sysdig/releases/tag/0.41.4

Signed-off-by: Angelo Compagnucci <angelo.compagnucci@gmail.com>
---
Changes v1 -> v2:
  - move the lua dependency change here from the falcosecurity-libs
    bump [Thomas]
  - require luajit or lua >= 5.3, lua 5.1 lacks luaL_setfuncs()
---
 ...llow-to-disable-the-container-plugin.patch | 37 ++++++++++++++++
 ...-only-include-zlib-with-the-bundled-.patch | 43 +++++++++++++++++++
 package/sysdig/Config.in                      |  9 ++--
 package/sysdig/sysdig.hash                    |  2 +-
 package/sysdig/sysdig.mk                      | 32 +++++++-------
 5 files changed, 101 insertions(+), 22 deletions(-)
 create mode 100644 package/sysdig/0001-CMakeLists.txt-allow-to-disable-the-container-plugin.patch
 create mode 100644 package/sysdig/0002-userspace-sysdig-only-include-zlib-with-the-bundled-.patch

diff --git a/package/sysdig/0001-CMakeLists.txt-allow-to-disable-the-container-plugin.patch b/package/sysdig/0001-CMakeLists.txt-allow-to-disable-the-container-plugin.patch
new file mode 100644
index 0000000000..e13ed4bb65
--- /dev/null
+++ b/package/sysdig/0001-CMakeLists.txt-allow-to-disable-the-container-plugin.patch
@@ -0,0 +1,37 @@
+From 64f286b765da1335369c3d27fad298f0b3f525c5 Mon Sep 17 00:00:00 2001
+From: Angelo Compagnucci <angelo.compagnucci@gmail.com>
+Date: Fri, 30 Oct 2026 10:15:11 +0100
+Subject: [PATCH] CMakeLists.txt: allow to disable the container plugin
+
+The container plugin is either downloaded as a prebuilt binary, for the
+build host architecture, or built from sources using Go, and both can't
+be done when cross-compiling or without network access.
+
+As the container plugin is only loaded when available, add an option to
+not download nor build it.
+
+Upstream: https://github.com/draios/sysdig/pull/2191
+Signed-off-by: Angelo Compagnucci <angelo.compagnucci@gmail.com>
+---
+ CMakeLists.txt | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 68344a3..9ef0f9a 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -163,7 +163,10 @@ endif()
+ include(falcosecurity-libs)
+ include(yaml-cpp)
+ include(nlohmann-json)
+-include(container_plugin)
++option(BUILD_SYSDIG_CONTAINER_PLUGIN "Download or build the container plugin" ON)
++if(BUILD_SYSDIG_CONTAINER_PLUGIN)
++	include(container_plugin)
++endif()
+ 
+ if(CMAKE_SYSTEM_NAME MATCHES "Linux")
+ 	if(NOT DEFINED DRIVER_VERSION)
+-- 
+2.34.1
+
diff --git a/package/sysdig/0002-userspace-sysdig-only-include-zlib-with-the-bundled-.patch b/package/sysdig/0002-userspace-sysdig-only-include-zlib-with-the-bundled-.patch
new file mode 100644
index 0000000000..e4f580dbd5
--- /dev/null
+++ b/package/sysdig/0002-userspace-sysdig-only-include-zlib-with-the-bundled-.patch
@@ -0,0 +1,43 @@
+From f61de224af8121847cd3aa9b1745b87fce52e351 Mon Sep 17 00:00:00 2001
+From: Angelo Compagnucci <angelo.compagnucci@gmail.com>
+Date: Fri, 30 Oct 2026 11:05:48 +0100
+Subject: [PATCH] userspace/sysdig: only include zlib with the bundled
+ falcosecurity libs
+
+When building with shared falcosecurity libs, the falcosecurity libs
+CMake modules are not added to CMAKE_MODULE_PATH, so including the zlib
+module fails:
+
+  include could not find requested file:
+
+    zlib
+
+sysdig doesn't use zlib directly, the module is only needed to build the
+bundled falcosecurity libs, so only include it in that case.
+
+Upstream: https://github.com/draios/sysdig/pull/2190
+Signed-off-by: Angelo Compagnucci <angelo.compagnucci@gmail.com>
+---
+ userspace/sysdig/CMakeLists.txt | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/userspace/sysdig/CMakeLists.txt b/userspace/sysdig/CMakeLists.txt
+index 4acbb030..416b8f83 100644
+--- a/userspace/sysdig/CMakeLists.txt
++++ b/userspace/sysdig/CMakeLists.txt
+@@ -20,7 +20,11 @@ if(NOT WIN32)
+ 	include(ncurses)
+ endif() # NOT WIN32
+ 
+-include(zlib)
++# zlib is only needed to build the bundled falcosecurity libs, and its
++# CMake module comes from them.
++if(USE_BUNDLED_FALCOSECURITY_LIBS)
++	include(zlib)
++endif()
+ include(luajit)
+ 
+ include_directories("${PROJECT_BINARY_DIR}/userspace/sinspui")
+-- 
+2.34.1
+
diff --git a/package/sysdig/Config.in b/package/sysdig/Config.in
index 2c72431d94..b50741aeed 100644
--- a/package/sysdig/Config.in
+++ b/package/sysdig/Config.in
@@ -9,7 +9,8 @@ config BR2_PACKAGE_SYSDIG
 	depends on !BR2_STATIC_LIBS # falcosecurity-libs
 	depends on !BR2_TOOLCHAIN_USES_UCLIBC # falcosecurity-libs
 	depends on !BR2_TOOLCHAIN_HAS_GCC_BUG_64735 # falcosecurity-libs
-	depends on BR2_PACKAGE_LUAINTERPRETER_ABI_VERSION_5_1 # falcosecurity-libs
+	# chisels, luaL_setfuncs() is not available in lua 5.1
+	depends on BR2_PACKAGE_LUAJIT || (BR2_PACKAGE_LUA && !BR2_PACKAGE_LUA_5_1)
 	select BR2_PACKAGE_FALCOSECURITY_LIBS
 	select BR2_PACKAGE_NCURSES
 	select BR2_PACKAGE_JSON_FOR_MODERN_CPP
@@ -21,13 +22,13 @@ config BR2_PACKAGE_SYSDIG
 	  Think of it as strace + tcpdump + lsof + awesome sauce.
 	  With a little Lua cherry on top.
 
-	  https://github.com/draios/sysdig/wiki
+	  https://github.com/draios/sysdig
 
-comment "sysdig needs a glibc or musl toolchain w/ C++, threads, wchar, gcc >= 10, dynamic library, a Linux kernel, and luajit or lua 5.1 to be built"
+comment "sysdig needs a glibc or musl toolchain w/ C++, threads, wchar, gcc >= 10, dynamic library, a Linux kernel, and luajit or lua >= 5.3 to be built"
 	depends on BR2_PACKAGE_FALCOSECURITY_LIBS_ARCH_SUPPORTS
 	depends on !BR2_LINUX_KERNEL || !BR2_INSTALL_LIBSTDCPP \
 		|| !BR2_TOOLCHAIN_HAS_THREADS \
 		|| !BR2_TOOLCHAIN_GCC_AT_LEAST_10 || !BR2_USE_WCHAR \
 		|| BR2_STATIC_LIBS \
 		|| BR2_TOOLCHAIN_USES_UCLIBC \
-		|| !BR2_PACKAGE_LUAINTERPRETER_ABI_VERSION_5_1
+		|| !(BR2_PACKAGE_LUAJIT || (BR2_PACKAGE_LUA && !BR2_PACKAGE_LUA_5_1))
diff --git a/package/sysdig/sysdig.hash b/package/sysdig/sysdig.hash
index cda3de5e7c..4a55afe1da 100644
--- a/package/sysdig/sysdig.hash
+++ b/package/sysdig/sysdig.hash
@@ -1,3 +1,3 @@
 # sha256 locally computed
-sha256  6b96797859002ab69a2bed4fdba1c7fe8064ecf8661621ae7d8fbf8599ffa636  sysdig-0.29.3.tar.gz
+sha256  36daa6a06705569fcc9b0579992e2457494003aea0065eabf54b3e16d67511f7  sysdig-0.41.4.tar.gz
 sha256  a88fbf820b38b1c7fabc6efe291b8259e02ae21326f56fe31c6c9adf374b2702  COPYING
diff --git a/package/sysdig/sysdig.mk b/package/sysdig/sysdig.mk
index bafe534a16..d04f67a97b 100644
--- a/package/sysdig/sysdig.mk
+++ b/package/sysdig/sysdig.mk
@@ -4,35 +4,33 @@
 #
 ################################################################################
 
-SYSDIG_VERSION = 0.29.3
+SYSDIG_VERSION = 0.41.4
 SYSDIG_SITE = $(call github,draios,sysdig,$(SYSDIG_VERSION))
 SYSDIG_LICENSE = Apache-2.0
 SYSDIG_LICENSE_FILES = COPYING
 SYSDIG_CPE_ID_VENDOR = sysdig
-SYSDIG_CONF_OPTS = \
-	-DENABLE_DKMS=OFF \
-	-DUSE_BUNDLED_DEPS=OFF \
-	-DCREATE_TEST_TARGETS=OFF
 SYSDIG_SUPPORTS_IN_SOURCE_BUILD = NO
 
 SYSDIG_DEPENDENCIES = \
 	falcosecurity-libs \
-	ncurses \
+	host-pkgconf \
 	json-for-modern-cpp \
+	luainterpreter \
+	ncurses \
 	yaml-cpp
 
-# Don't build the driver as part of the 'standard' procedure, it has been built
-# by falcosecurity-libs.mk.
-# grpc_cpp_plugin is needed to build falcosecurity libs, so we give the host
-# one there.
-SYSDIG_CONF_OPTS += -DFALCOSECURITY_LIBS_SOURCE_DIR=$(FALCOSECURITY_LIBS_SRCDIR) \
-	-DBUILD_DRIVER=OFF \
-	-DGRPC_CPP_PLUGIN=$(HOST_DIR)/bin/grpc_cpp_plugin \
-	-DDRIVER_NAME=$(FALCOSECURITY_LIBS_DRIVER_NAME) \
-	-DENABLE_DKMS=OFF \
+# The driver is built by falcosecurity-libs, which only supports the
+# kernel module.
+SYSDIG_CONF_OPTS = \
 	-DUSE_BUNDLED_DEPS=OFF \
-	-DWITH_CHISEL=ON \
-	-DVALIJSON_INCLUDE=$(BUILD_DIR)/valijson-0.6/include/valijson \
+	-DCREATE_TEST_TARGETS=OFF \
+	-DBUILD_SYSDIG_MODERN_BPF=OFF \
 	-DSYSDIG_VERSION=$(SYSDIG_VERSION)
 
+# 0001-CMakeLists.txt-allow-to-disable-the-container-plugin.patch
+# The container plugin is either downloaded as a prebuilt binary or
+# built with Go, so it is disabled. It can be provided by a separate
+# package in a following patch.
+SYSDIG_CONF_OPTS += -DBUILD_SYSDIG_CONTAINER_PLUGIN=OFF
+
 $(eval $(cmake-package))
-- 
2.34.1

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot