Can we add `manylinux_2_28` Linux build target for glibc 2.28 compatibility (CentOS/RHEL 8)

[chantsing]

Executive Summary / Preface

I have successfully built and verified a fully functional ActivityWatch release for glibc 2.28 (CentOS 8 / RHEL 8 compatible) via GitHub Actions in my fork:

🔗 https://github.com/chantsing/activitywatch/actions

The CI pipeline produces working ZIP and AppImage artifacts inside the standard quay.io/pypa/manylinux_2_28_x86_64 container. All core components—including aw-qt, aw-server (Python backend), aw-server-rust, aw-watcher-afk, aw-watcher-window, aw-watcher-input, and aw-notify—are correctly bundled and run on glibc 2.28 systems.

I am requesting that the upstream ActivityWatch project merge this additional build target into the official release.yml workflow. This change is purely additive: it introduces a parallel CI job without altering or breaking any existing build configurations or release artifacts for modern distributions.

---

1. Motivation / Background

Currently, the official ActivityWatch Linux binaries are built on Ubuntu 22.04 (or newer), which links against a relatively recent glibc (≥ 2.35). This makes the official releases unusable on enterprise Linux distributions that ship with older glibc versions, most notably:

• CentOS 8 / CentOS Stream 8 (glibc 2.28)
• RHEL 8 (glibc 2.28)
• AlmaLinux 8 / Rocky Linux 8
• Other LTS server distributions still on the 2.28 baseline

These systems are widely deployed in corporate, academic, and research environments where upgrading the base OS is not feasible. Users on these platforms currently receive version 'GLIBC_2.29' not found or similar errors when trying to run the official AppImage or ZIP builds.

2. Objective

Introduce an additional CI build job that produces Linux binaries compatible with glibc 2.28, without modifying or removing any existing build targets.

Key constraint: This is an additive change. The existing Ubuntu-based build matrix must remain untouched and continue producing binaries for modern distributions.

3. Proposed Solution

Add a new job build-qt-manylinux_2_28 (or an additional matrix dimension) to the official release.yml workflow that runs inside the quay.io/pypa/manylinux_2_28_x86_64 container.

Why manylinux_2_28?

• It is the standard, audited container maintained by the Python Packaging Authority (PyPA) for building portable Linux wheels.
• It provides a controlled environment with glibc 2.28, GCC 14 (via gcc-toolset-14), and compatible system libraries.
• It is the same toolchain used by the broader Python/Rust ecosystem, ensuring long-term maintainability.

Build artifacts produced:

• activitywatch-v<version>-linux-x86_64-manylinux_2_28.zip
• activitywatch-linux-x86_64-manylinux_2_28.AppImage (or equivalent naming)

4. Integration Strategy

To avoid any disruption to the existing pipeline, the change is implemented as a parallel, independent job:

Aspect	Existing Build	New Build
Runner	ubuntu-22.04	ubuntu-22.04 + manylinux_2_28 container
glibc baseline	~2.35	2.28
Target users	Desktop Ubuntu/Fedora/Arch	CentOS 8, RHEL 8, AlmaLinux 8
Artifact naming	activitywatch-*-linux-x86_64.*	activitywatch-*-linux-x86_64-manylinux_2_28.*
Release attachment	Included as before	Included alongside existing assets

CI Workflow changes:

1. New job: build-qt-manylinux_2_28 added to release.yml.
2. No matrix changes to the existing build-qt job.
3. Release step update: The final release job downloads artifacts from both jobs and attaches them to the same draft release.

5. Verified Implementation Details

The following has already been validated in a fork and produces fully functional binaries:

• Container: quay.io/pypa/manylinux_2_28_x86_64
• Python: /opt/python/cp39-cp39/bin/python3 (manylinux-provided CPython 3.9)
• Rust: dtolnay/rust-toolchain@stable (works inside container)
• Node: actions/setup-node@v6 (works inside container)
• System deps: dnf install of Qt5/X11/OpenSSL/kernel-headers development packages.
• PyInstaller: Successfully bundles aw-qt, aw-server, aw-watcher-afk, aw-watcher-window, aw-watcher-input, aw-notify.
• AppImage: Built via linuxdeployqt with APPIMAGE_EXTRACT_AND_RUN=1.
• Critical fix: git config --global --add safe.directory "$GITHUB_WORKSPACE" is required inside the manylinux container to prevent Git’s “dubious ownership” check from breaking aw-server version detection during packaging.

6. Backwards Compatibility & Risk Assessment

Risk	Mitigation
Breaks existing Ubuntu build	No. The new job is completely separate; existing build-qt job is unchanged.
Increases CI time	Acceptable. The new job runs in parallel. Total wall-clock time is determined by the slower of the two parallel tracks, not the sum.
Artifact naming collision	New artifacts use a distinct suffix (-manylinux_2_28) to avoid overwriting official assets.
Maintenance burden	The container is a standard PyPA image. Dependency installation uses dnf, which is well-documented for RHEL 8 derivatives.

7. Request for Upstream

We propose that the official ActivityWatch repository adopt this additional build target so that:

1. Users on CentOS 8 / RHEL 8 / glibc 2.28 systems can run ActivityWatch without compiling from source.
2. The project gains broader enterprise/server adoption without sacrificing the desktop-focused official builds.
3. The release page clearly distinguishes between the “standard” (modern glibc) and “manylinux_2_28” (legacy glibc) Linux assets.

Suggested asset names on the release page:

• activitywatch-v0.13.0-linux-x86_64.zip (existing, modern glibc)
• activitywatch-v0.13.0-linux-x86_64-manylinux_2_28.zip (new, glibc 2.28 compatible)

release_glibc2_28.yml

[github-actions]

Hi there!
As you're new to this repo, please make sure you've used an appropriate issue template and searched for duplicates (it helps us focus on actual development!). We'd also like to suggest that you read our contribution guidelines and our code of conduct.
Thanks a bunch for opening your first issue! 🙏

[chantsing]

https://github.com/chantsing/activitywatch/actions