[PATCH 0/3] Xen: CI changes for new toolchain baseline

[PATCH 0/3] Xen: CI changes for new toolchain baseline

[Andrew Cooper]

Prep work to allow us to start making changes based on the toolchain
requirements.

https://gitlab.com/xen-project/people/andyhhp/xen/-/pipelines/1726628670
https://cirrus-ci.com/build/5232741505040384

Andrew Cooper (3):
  CI: Update build tests based on new minimum toolchain requirements
  Xen: Update compiler checks
  CHANGELOG: Minimum toolchain requirements

 CHANGELOG.md                         |  3 ++
 automation/build/centos/7.dockerfile | 72 ----------------------------
 automation/gitlab-ci/build.yaml      | 30 ++++--------
 xen/include/xen/compiler.h           | 16 ++-----
 4 files changed, 17 insertions(+), 104 deletions(-)
 delete mode 100644 automation/build/centos/7.dockerfile


base-commit: 6e5fed7cb67c9f84653cdbd3924b8a119ef653be
-- 
2.39.5

[PATCH 2/3] Xen: Update compiler checks

[Andrew Cooper]

We didn't really have a Clang check before, so add one while adjusting the GCC
check.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
---
CC: Anthony PERARD <anthony.perard@vates.tech>
CC: Michal Orzel <michal.orzel@amd.com>
CC: Jan Beulich <jbeulich@suse.com>
CC: Julien Grall <julien@xen.org>
CC: Roger Pau Monné <roger.pau@citrix.com>
CC: Stefano Stabellini <sstabellini@kernel.org>
CC: Oleksii Kurochko <oleksii.kurochko@gmail.com>
---
 xen/include/xen/compiler.h | 16 ++++------------
 1 file changed, 4 insertions(+), 12 deletions(-)

diff --git a/xen/include/xen/compiler.h b/xen/include/xen/compiler.h
index b118e4ba62eb..cc955be32664 100644
--- a/xen/include/xen/compiler.h
+++ b/xen/include/xen/compiler.h
@@ -1,18 +1,10 @@
 #ifndef __LINUX_COMPILER_H
 #define __LINUX_COMPILER_H
 
-#if !defined(__GNUC__) || (__GNUC__ < 4)
-#error Sorry, your compiler is too old/not recognized.
-#elif CONFIG_CC_IS_GCC
-# if defined(CONFIG_ARM_32) && CONFIG_GCC_VERSION < 40900
-#  error Sorry, your version of GCC is too old - please use 4.9 or newer.
-# elif defined(CONFIG_ARM_64) && CONFIG_GCC_VERSION < 50100
-/*
- * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63293
- * https://lore.kernel.org/r/20210107111841.GN1551@shell.armlinux.org.uk
- */
-#  error Sorry, your version of GCC is too old - please use 5.1 or newer.
-# endif
+#if CONFIG_CC_IS_GCC && CONFIG_GCC_VERSION < 50100
+# error Sorry, your version of GCC is too old - please use 5.1 or newer
+#elif CONFIG_CC_IS_CLANG && CONFIG_CLANG_VERSION < 110000
+# error Sorry, your version of Clang is too old - please use 11 or newer
 #endif
 
 #define barrier()     __asm__ __volatile__("": : :"memory")
-- 
2.39.5

Re: [PATCH 2/3] Xen: Update compiler checks

[Jan Beulich]

On 20.03.2025 16:32, Andrew Cooper wrote:
> --- a/xen/include/xen/compiler.h
> +++ b/xen/include/xen/compiler.h
> @@ -1,18 +1,10 @@
>  #ifndef __LINUX_COMPILER_H
>  #define __LINUX_COMPILER_H
>  
> -#if !defined(__GNUC__) || (__GNUC__ < 4)
> -#error Sorry, your compiler is too old/not recognized.
> -#elif CONFIG_CC_IS_GCC
> -# if defined(CONFIG_ARM_32) && CONFIG_GCC_VERSION < 40900
> -#  error Sorry, your version of GCC is too old - please use 4.9 or newer.
> -# elif defined(CONFIG_ARM_64) && CONFIG_GCC_VERSION < 50100
> -/*
> - * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63293
> - * https://lore.kernel.org/r/20210107111841.GN1551@shell.armlinux.org.uk
> - */
> -#  error Sorry, your version of GCC is too old - please use 5.1 or newer.
> -# endif
> +#if CONFIG_CC_IS_GCC && CONFIG_GCC_VERSION < 50100
> +# error Sorry, your version of GCC is too old - please use 5.1 or newer
> +#elif CONFIG_CC_IS_CLANG && CONFIG_CLANG_VERSION < 110000
> +# error Sorry, your version of Clang is too old - please use 11 or newer
>  #endif

While the Arm special cases can now indeed go away, shouldn't a RISC-V one
appear instead, seeing what ./README says?

Jan

[PATCH 3/3] CHANGELOG: Minimum toolchain requirements

[Andrew Cooper]

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
---
CC: Anthony PERARD <anthony.perard@vates.tech>
CC: Michal Orzel <michal.orzel@amd.com>
CC: Jan Beulich <jbeulich@suse.com>
CC: Julien Grall <julien@xen.org>
CC: Roger Pau Monné <roger.pau@citrix.com>
CC: Stefano Stabellini <sstabellini@kernel.org>
CC: Oleksii Kurochko <oleksii.kurochko@gmail.com>
---
 CHANGELOG.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9a5919585d43..4e333e608a96 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 ## [4.21.0 UNRELEASED](https://xenbits.xenproject.org/gitweb/?p=xen.git;a=shortlog;h=staging) - TBD
 
 ### Changed
+ - The minimum toolchain requirements have been increased to either:
+   - GCC 5.1 and Binutils 2.25, or
+   - Clang/LLVM 11
 
 ### Added
  - On x86:
-- 
2.39.5

Re: [PATCH 3/3] CHANGELOG: Minimum toolchain requirements

[Jan Beulich]

On 20.03.2025 16:32, Andrew Cooper wrote:
> --- a/CHANGELOG.md
> +++ b/CHANGELOG.md
> @@ -7,6 +7,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
>  ## [4.21.0 UNRELEASED](https://xenbits.xenproject.org/gitweb/?p=xen.git;a=shortlog;h=staging) - TBD
>  
>  ### Changed
> + - The minimum toolchain requirements have been increased to either:
> +   - GCC 5.1 and Binutils 2.25, or
> +   - Clang/LLVM 11

Like for the previous patch, take the opportunity and mention RISC-V here
as well?

Jan

Re: [PATCH 3/3] CHANGELOG: Minimum toolchain requirements

[Oleksii Kurochko]

[-- Attachment #1: Type: text/plain, Size: 1101 bytes --]


On 3/20/25 4:32 PM, Andrew Cooper wrote:
> Signed-off-by: Andrew Cooper<andrew.cooper3@citrix.com>
> ---
> CC: Anthony PERARD<anthony.perard@vates.tech>
> CC: Michal Orzel<michal.orzel@amd.com>
> CC: Jan Beulich<jbeulich@suse.com>
> CC: Julien Grall<julien@xen.org>
> CC: Roger Pau Monné<roger.pau@citrix.com>
> CC: Stefano Stabellini<sstabellini@kernel.org>
> CC: Oleksii Kurochko<oleksii.kurochko@gmail.com>
> ---
>   CHANGELOG.md | 3 +++
>   1 file changed, 3 insertions(+)
>
> diff --git a/CHANGELOG.md b/CHANGELOG.md
> index 9a5919585d43..4e333e608a96 100644
> --- a/CHANGELOG.md
> +++ b/CHANGELOG.md
> @@ -7,6 +7,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
>   ## [4.21.0 UNRELEASED](https://xenbits.xenproject.org/gitweb/?p=xen.git;a=shortlog;h=staging) - TBD
>   
>   ### Changed
> + - The minimum toolchain requirements have been increased to either:
> +   - GCC 5.1 and Binutils 2.25, or
> +   - Clang/LLVM 11

I think we have to specify here for which architectures as RISC-V support different minimal versions.


>   
>   ### Added
>    - On x86:

[-- Attachment #2: Type: text/html, Size: 2447 bytes --]

[PATCH RESEND 0/3] Xen: CI changes for new toolchain baseline

[Andrew Cooper]

Prep work to allow us to start making changes based on the toolchain
requirements.

https://gitlab.com/xen-project/people/andyhhp/xen/-/pipelines/1726628670
https://cirrus-ci.com/build/5232741505040384

Andrew Cooper (3):
  CI: Update build tests based on new minimum toolchain requirements
  Xen: Update compiler checks
  CHANGELOG: Minimum toolchain requirements

 CHANGELOG.md                         |  3 ++
 automation/build/centos/7.dockerfile | 72 ----------------------------
 automation/gitlab-ci/build.yaml      | 30 ++++--------
 xen/include/xen/compiler.h           | 16 ++-----
 4 files changed, 17 insertions(+), 104 deletions(-)
 delete mode 100644 automation/build/centos/7.dockerfile


base-commit: 6e5fed7cb67c9f84653cdbd3924b8a119ef653be
-- 
2.39.5

[PATCH 3/3] CHANGELOG: Minimum toolchain requirements

[Andrew Cooper]

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
---
CC: Anthony PERARD <anthony.perard@vates.tech>
CC: Michal Orzel <michal.orzel@amd.com>
CC: Jan Beulich <jbeulich@suse.com>
CC: Julien Grall <julien@xen.org>
CC: Roger Pau Monné <roger.pau@citrix.com>
CC: Stefano Stabellini <sstabellini@kernel.org>
CC: Oleksii Kurochko <oleksii.kurochko@gmail.com>
---
 CHANGELOG.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9a5919585d43..4e333e608a96 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 ## [4.21.0 UNRELEASED](https://xenbits.xenproject.org/gitweb/?p=xen.git;a=shortlog;h=staging) - TBD
 
 ### Changed
+ - The minimum toolchain requirements have been increased to either:
+   - GCC 5.1 and Binutils 2.25, or
+   - Clang/LLVM 11
 
 ### Added
  - On x86:
-- 
2.39.5

Re: [PATCH 3/3] CHANGELOG: Minimum toolchain requirements

[Oleksii Kurochko]

[-- Attachment #1: Type: text/plain, Size: 1546 bytes --]


On 3/20/25 4:59 PM, Andrew Cooper wrote:
> Signed-off-by: Andrew Cooper<andrew.cooper3@citrix.com>
> ---
> CC: Anthony PERARD<anthony.perard@vates.tech>
> CC: Michal Orzel<michal.orzel@amd.com>
> CC: Jan Beulich<jbeulich@suse.com>
> CC: Julien Grall<julien@xen.org>
> CC: Roger Pau Monné<roger.pau@citrix.com>
> CC: Stefano Stabellini<sstabellini@kernel.org>
> CC: Oleksii Kurochko<oleksii.kurochko@gmail.com>
> ---
>   CHANGELOG.md | 3 +++
>   1 file changed, 3 insertions(+)
>
> diff --git a/CHANGELOG.md b/CHANGELOG.md
> index 9a5919585d43..4e333e608a96 100644
> --- a/CHANGELOG.md
> +++ b/CHANGELOG.md
> @@ -7,6 +7,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
>   ## [4.21.0 UNRELEASED](https://xenbits.xenproject.org/gitweb/?p=xen.git;a=shortlog;h=staging) - TBD
>   
>   ### Changed
> + - The minimum toolchain requirements have been increased to either:
> +   - GCC 5.1 and Binutils 2.25, or
> +   - Clang/LLVM 11

I think we want here to specify for which architectures it was done as RISC-V, for example, uses
different versions:
  - GCC 12.2 or later
  - GNU Binutils 2.39 or later
And for clang the version will be 17 as:
   f873029386dd415cd9caa78f600a593d9570c9ae("[BOLT] Add minimal RISC-V 64-bit support")
   $ git tag --contains f873029386dd415cd9caa78f600a593d9570c9ae
     llvmorg-17.0.0
   ...
I have some patch to build Xen RISC-V using clang-17 but I haven't sent to upstream yet as I am not
really sure that if we need (or why we need) clang support just from the start.

~ Oleksii

[-- Attachment #2: Type: text/html, Size: 2728 bytes --]

Re: [PATCH 3/3] CHANGELOG: Minimum toolchain requirements

[Andrew Cooper]

On 21/03/2025 4:24 pm, Oleksii Kurochko wrote:
>
>
> On 3/20/25 4:59 PM, Andrew Cooper wrote:
>> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
>> ---
>> CC: Anthony PERARD <anthony.perard@vates.tech>
>> CC: Michal Orzel <michal.orzel@amd.com>
>> CC: Jan Beulich <jbeulich@suse.com>
>> CC: Julien Grall <julien@xen.org>
>> CC: Roger Pau Monné <roger.pau@citrix.com>
>> CC: Stefano Stabellini <sstabellini@kernel.org>
>> CC: Oleksii Kurochko <oleksii.kurochko@gmail.com>
>> ---
>>  CHANGELOG.md | 3 +++
>>  1 file changed, 3 insertions(+)
>>
>> diff --git a/CHANGELOG.md b/CHANGELOG.md
>> index 9a5919585d43..4e333e608a96 100644
>> --- a/CHANGELOG.md
>> +++ b/CHANGELOG.md
>> @@ -7,6 +7,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
>>  ## [4.21.0 UNRELEASED](https://xenbits.xenproject.org/gitweb/?p=xen.git;a=shortlog;h=staging) - TBD
>>  
>>  ### Changed
>> + - The minimum toolchain requirements have been increased to either:
>> +   - GCC 5.1 and Binutils 2.25, or
>> +   - Clang/LLVM 11
> I think we want here to specify for which architectures it was done as RISC-V, for example, uses
> different versions:
>  - GCC 12.2 or later
>  - GNU Binutils 2.39 or later
> And for clang the version will be 17 as:
>   f873029386dd415cd9caa78f600a593d9570c9ae("[BOLT] Add minimal RISC-V 64-bit support")
>   $ git tag --contains f873029386dd415cd9caa78f600a593d9570c9ae
>     llvmorg-17.0.0
>   ...
> I have some patch to build Xen RISC-V using clang-17 but I haven't sent to upstream yet as I am not
> really sure that if we need (or why we need) clang support just from the start.

The same reason why we got an almost-nothing build in CI first, and are
currently looking for a "hello world" message on boot.

Keeping it working as you go is much easier than retrofitting at a later
point, and supporting more than 1 of any $THING (not just compilers) is
good to prevent accidental reliance on an implementation specific property.

The only question is what version of Clang exists in Debian bookworm, as
that affects how easy/hard it is to add to CI.

According to https://packages.debian.org/search?keywords=clang, bookworm
has Clang 14, while trixie has Clang 19.

So, how hard a limit is Clang-17?  Is Clang-14 doable or not?

Alternatively, we could start adding some trixie containers.  We have
passed the toolchain freeze (was 15th March), so the build container
should be stable now, even if it isn't quite released yet.

~Andrew

Re: [PATCH 3/3] CHANGELOG: Minimum toolchain requirements

[Oleksii Kurochko]

[-- Attachment #1: Type: text/plain, Size: 3877 bytes --]


On 3/27/25 4:45 PM, Andrew Cooper wrote:
> On 21/03/2025 4:24 pm, Oleksii Kurochko wrote:
>>
>> On 3/20/25 4:59 PM, Andrew Cooper wrote:
>>> Signed-off-by: Andrew Cooper<andrew.cooper3@citrix.com>
>>> ---
>>> CC: Anthony PERARD<anthony.perard@vates.tech>
>>> CC: Michal Orzel<michal.orzel@amd.com>
>>> CC: Jan Beulich<jbeulich@suse.com>
>>> CC: Julien Grall<julien@xen.org>
>>> CC: Roger Pau Monné<roger.pau@citrix.com>
>>> CC: Stefano Stabellini<sstabellini@kernel.org>
>>> CC: Oleksii Kurochko<oleksii.kurochko@gmail.com>
>>> ---
>>>   CHANGELOG.md | 3 +++
>>>   1 file changed, 3 insertions(+)
>>>
>>> diff --git a/CHANGELOG.md b/CHANGELOG.md
>>> index 9a5919585d43..4e333e608a96 100644
>>> --- a/CHANGELOG.md
>>> +++ b/CHANGELOG.md
>>> @@ -7,6 +7,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
>>>   ## [4.21.0 UNRELEASED](https://xenbits.xenproject.org/gitweb/?p=xen.git;a=shortlog;h=staging) - TBD
>>>   
>>>   ### Changed
>>> + - The minimum toolchain requirements have been increased to either:
>>> +   - GCC 5.1 and Binutils 2.25, or
>>> +   - Clang/LLVM 11
>> I think we want here to specify for which architectures it was done as RISC-V, for example, uses
>> different versions:
>>   - GCC 12.2 or later
>>   - GNU Binutils 2.39 or later
>> And for clang the version will be 17 as:
>>    f873029386dd415cd9caa78f600a593d9570c9ae("[BOLT] Add minimal RISC-V 64-bit support")
>>    $ git tag --contains f873029386dd415cd9caa78f600a593d9570c9ae
>>      llvmorg-17.0.0
>>    ...
>> I have some patch to build Xen RISC-V using clang-17 but I haven't sent to upstream yet as I am not
>> really sure that if we need (or why we need) clang support just from the start.
> The same reason why we got an almost-nothing build in CI first, and are
> currently looking for a "hello world" message on boot.
>
> Keeping it working as you go is much easier than retrofitting at a later
> point, and supporting more than 1 of any $THING (not just compilers) is
> good to prevent accidental reliance on an implementation specific property.
>
> The only question is what version of Clang exists in Debian bookworm, as
> that affects how easy/hard it is to add to CI.
>
> According tohttps://packages.debian.org/search?keywords=clang, bookworm
> has Clang 14, while trixie has Clang 19.
>
> So, how hard a limit is Clang-17?  Is Clang-14 doable or not?

I think it is pretty hard limit because:
1. I haven't checked all the extension but, for example, we required 'H' extension and
    the support for it was added in 16.0.0:
    [f4c887c3a8406d85f4f942c8350f10026994f4d8("RISCV] Add H extension")
    $ git tag --contains f4c887c3a8406d85f4f942c8350f10026994f4d8
      llvmorg-16.0.0
      ...
2. Minimal support for RISCV-64 was added in clang17:
    f873029386dd415cd9caa78f600a593d9570c9ae("[BOLT] Add minimal RISC-V 64-bit support")
    $ git tag --contains f873029386dd415cd9caa78f600a593d9570c9ae
      llvmorg-17.0.0
      ...
And, actually, the second one reason was the reason why I tried to build with clang17 and suggests to use
it as a baseline.

>
> Alternatively, we could start adding some trixie containers.  We have
> passed the toolchain freeze (was 15th March), so the build container
> should be stable now, even if it isn't quite released yet.

clang has nice script to add any version. I did that in the following way
for bookworm docker container:
+    DEPS=(
+        # Clang
+        wget
+        gnupg
+        ca-certificates
+        lsb-release
+        software-properties-common
...

+    update-ca-certificates
+
+    wget -O -https://apt.llvm.org/llvm.sh | bash -s 17
+    wget -O -https://apt.llvm.org/llvm.sh | bash -s 18
+    wget -O -https://apt.llvm.org/llvm.sh | bash -s 19
+    wget -O -https://apt.llvm.org/llvm.sh | bash -s 20
+    # ln -s /usr/bin/clang-17 /usr/bin/clang

~ Oleksii

[-- Attachment #2: Type: text/html, Size: 5806 bytes --]

Re: [PATCH 3/3] CHANGELOG: Minimum toolchain requirements

[Andrew Cooper]

On 27/03/2025 4:55 pm, Oleksii Kurochko wrote:
>
>
> On 3/27/25 4:45 PM, Andrew Cooper wrote:
>> On 21/03/2025 4:24 pm, Oleksii Kurochko wrote:
>>> On 3/20/25 4:59 PM, Andrew Cooper wrote:
>>>> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
>>>> ---
>>>> CC: Anthony PERARD <anthony.perard@vates.tech>
>>>> CC: Michal Orzel <michal.orzel@amd.com>
>>>> CC: Jan Beulich <jbeulich@suse.com>
>>>> CC: Julien Grall <julien@xen.org>
>>>> CC: Roger Pau Monné <roger.pau@citrix.com>
>>>> CC: Stefano Stabellini <sstabellini@kernel.org>
>>>> CC: Oleksii Kurochko <oleksii.kurochko@gmail.com>
>>>> ---
>>>>  CHANGELOG.md | 3 +++
>>>>  1 file changed, 3 insertions(+)
>>>>
>>>> diff --git a/CHANGELOG.md b/CHANGELOG.md
>>>> index 9a5919585d43..4e333e608a96 100644
>>>> --- a/CHANGELOG.md
>>>> +++ b/CHANGELOG.md
>>>> @@ -7,6 +7,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
>>>>  ## [4.21.0 UNRELEASED](https://xenbits.xenproject.org/gitweb/?p=xen.git;a=shortlog;h=staging) - TBD
>>>>  
>>>>  ### Changed
>>>> + - The minimum toolchain requirements have been increased to either:
>>>> +   - GCC 5.1 and Binutils 2.25, or
>>>> +   - Clang/LLVM 11
>>> I think we want here to specify for which architectures it was done as RISC-V, for example, uses
>>> different versions:
>>>  - GCC 12.2 or later
>>>  - GNU Binutils 2.39 or later
>>> And for clang the version will be 17 as:
>>>   f873029386dd415cd9caa78f600a593d9570c9ae("[BOLT] Add minimal RISC-V 64-bit support")
>>>   $ git tag --contains f873029386dd415cd9caa78f600a593d9570c9ae
>>>     llvmorg-17.0.0
>>>   ...
>>> I have some patch to build Xen RISC-V using clang-17 but I haven't sent to upstream yet as I am not
>>> really sure that if we need (or why we need) clang support just from the start.
>> The same reason why we got an almost-nothing build in CI first, and are
>> currently looking for a "hello world" message on boot.
>>
>> Keeping it working as you go is much easier than retrofitting at a later
>> point, and supporting more than 1 of any $THING (not just compilers) is
>> good to prevent accidental reliance on an implementation specific property.
>>
>> The only question is what version of Clang exists in Debian bookworm, as
>> that affects how easy/hard it is to add to CI.
>>
>> According to https://packages.debian.org/search?keywords=clang, bookworm
>> has Clang 14, while trixie has Clang 19.
>>
>> So, how hard a limit is Clang-17?  Is Clang-14 doable or not?
> I think it is pretty hard limit because:
> 1. I haven't checked all the extension but, for example, we required 'H' extension and
>    the support for it was added in 16.0.0:
>    [f4c887c3a8406d85f4f942c8350f10026994f4d8("RISCV] Add H extension")
>    $ git tag --contains f4c887c3a8406d85f4f942c8350f10026994f4d8
>      llvmorg-16.0.0
>      ...
> 2. Minimal support for RISCV-64 was added in clang17:
>    f873029386dd415cd9caa78f600a593d9570c9ae("[BOLT] Add minimal RISC-V 64-bit support")
>    $ git tag --contains f873029386dd415cd9caa78f600a593d9570c9ae
>      llvmorg-17.0.0
>      ...
> And, actually, the second one reason was the reason why I tried to build with clang17 and suggests to use
> it as a baseline.

That's fine.  It means we can't use Debian bookworm for this purpose.

>
>> Alternatively, we could start adding some trixie containers.  We have
>> passed the toolchain freeze (was 15th March), so the build container
>> should be stable now, even if it isn't quite released yet.
> clang has nice script to add any version. I did that in the following way
> for bookworm docker container:
> +    DEPS=(
> +        # Clang
> +        wget
> +        gnupg
> +        ca-certificates
> +        lsb-release
> +        software-properties-common
> ...
> +    update-ca-certificates
> +
> +    wget -O - https://apt.llvm.org/llvm.sh | bash -s 17
> +    wget -O - https://apt.llvm.org/llvm.sh | bash -s 18
> +    wget -O - https://apt.llvm.org/llvm.sh | bash -s 19
> +    wget -O - https://apt.llvm.org/llvm.sh | bash -s 20
> +    # ln -s /usr/bin/clang-17 /usr/bin/clang

We used to do this.

It backfired spectacularly when rebuilding a container after versions of
clang had been dropped, and took out testing on the stable-* trees as a
consequence.

Therefore, we don't do this any more.  (Or at least, not in a container
marked for blocking failures.)

~Andrew