fix: build.yaml

.gitea/workflows/build.yaml

@@ -44,9 +44,25 @@ jobs:
             echo "Releasing $NEXT (was $CURRENT)."
           fi
 
-      - name: Install UPX
+      - name: Install build deps (PAM headers + UPX + arm64 cross toolchain)
         if: steps.ver.outputs.release == 'true'
-        run: sudo apt-get update && sudo apt-get install -y upx-ucl
+        run: |
+          sudo dpkg --add-architecture arm64
+          # Ubuntu arm64 packages live on ports.ubuntu.com, not the default mirror.
+          # Restrict existing amd64 sources first so `apt update` doesn't 404 trying
+          # to fetch arm64 from there.
+          sudo sed -i 's/^deb /deb [arch=amd64] /' /etc/apt/sources.list /etc/apt/sources.list.d/*.list 2>/dev/null || true
+          sudo tee /etc/apt/sources.list.d/arm64.list >/dev/null <<'EOF'
+          deb [arch=arm64] http://ports.ubuntu.com/ubuntu-ports noble main universe
+          deb [arch=arm64] http://ports.ubuntu.com/ubuntu-ports noble-updates main universe
+          deb [arch=arm64] http://ports.ubuntu.com/ubuntu-ports noble-security main universe
+          EOF
+          sudo apt-get update
+          sudo apt-get install -y \
+            upx-ucl \
+            libpam0g-dev \
+            libpam0g-dev:arm64 \
+            gcc-aarch64-linux-gnu
 
       - name: Build binaries
         if: steps.ver.outputs.release == 'true'
@@ -55,8 +71,10 @@ jobs:
           LDFLAGS: -s -w -X nadir.Version=${{ steps.ver.outputs.next }}
         run: |
           mkdir -p dist
-          GOOS=linux GOARCH=amd64 go build -ldflags="$LDFLAGS" -o dist/nadir-$VERSION-linux-amd64 ./cmd/server
-          GOOS=linux GOARCH=arm64 go build -ldflags="$LDFLAGS" -o dist/nadir-$VERSION-linux-arm64 ./cmd/server
+          CGO_ENABLED=1 GOOS=linux GOARCH=amd64 \
+            go build -ldflags="$LDFLAGS" -o dist/nadir-$VERSION-linux-amd64 ./cmd/server
+          CGO_ENABLED=1 GOOS=linux GOARCH=arm64 CC=aarch64-linux-gnu-gcc \
+            go build -ldflags="$LDFLAGS" -o dist/nadir-$VERSION-linux-arm64 ./cmd/server
           upx --best --lzma dist/nadir-$VERSION-linux-amd64 dist/nadir-$VERSION-linux-arm64
 
       - name: Tag and release