Utilities/Release: Update docker specs for linux-aarch64 to centos 8 vault

Update the centos base image from centos 7 to centos 8.  The latter is
available in `vault.centos.org` repositories, so we can rebuild in the
future.  The resulting binaries require GLIBC 2.28.

While at it, update to OpenSSL 3.6.0.

.gitlab-ci.yml

@@ -234,7 +234,7 @@ b:centos7-x86_64:
     variables:
         CMAKE_CI_ARTIFACTS_NAME: "artifacts-centos7-x86_64"
 
-b:centos7-aarch64:
+b:centos8-aarch64:
     extends:
         - .linux_release_aarch64
         - .cmake_build_linux_release
@@ -242,7 +242,7 @@ b:centos7-aarch64:
         - .linux_aarch64_tags
         - .run_manually
     variables:
-        CMAKE_CI_ARTIFACTS_NAME: "artifacts-centos7-aarch64"
+        CMAKE_CI_ARTIFACTS_NAME: "artifacts-centos8-aarch64"
         CMAKE_CI_NO_MR: "true"
 
 t:debian13-ninja:
@@ -263,7 +263,7 @@ t:debian13-aarch64-ninja:
         - .linux_aarch64_tags
         - .cmake_junit_artifacts
         - .run_dependent
-        - .needs_centos7_aarch64
+        - .needs_centos8_aarch64
     variables:
         CMAKE_CI_NO_MR: "true"
 
@@ -551,7 +551,7 @@ t:cuda13.0-aarch64-nvidia:
         - .linux_aarch64_tags_cuda_arch_75
         - .cmake_junit_artifacts
         - .run_dependent
-        - .needs_centos7_aarch64
+        - .needs_centos8_aarch64
     variables:
         CMAKE_CI_JOB_NIGHTLY: "true"
 

.gitlab/os-linux.yml

@@ -19,11 +19,10 @@
         CMAKE_ARCH: x86_64
 
 .linux_release_aarch64:
-    image: "kitware/cmake:build-linux-aarch64-deps-2020-12-21@sha256:0bd7dfe4e45593b04e39cd21e44011034610cfd376900558c5ef959bb1af15af"
+    image: "kitware/cmake:build-linux-aarch64-deps-2026-01-13@sha256:7373fe775ea571a3113251b3e8b5857ef321f6e9b5dfa5963f6e44d062349244"
 
     variables:
         GIT_CLONE_PATH: "$CI_BUILDS_DIR/cmake ci"
-        LAUNCHER: "scl enable devtoolset-7 --"
         CMAKE_ARCH: aarch64
 
 .linux_package:
@@ -52,9 +51,9 @@
     needs:
         - b:centos7-x86_64
 
-.needs_centos7_aarch64:
+.needs_centos8_aarch64:
     needs:
-        - b:centos7-aarch64
+        - b:centos8-aarch64
 
 ### Debian
 

Help/release/dev/rel-linux.rst

@@ -0,0 +1,5 @@
+rel-linux
+---------
+
+* The precompiled Linux ``aarch64`` binaries provided on
+  `cmake.org <https://cmake.org/download/>`_ now require GLIBC 2.28 or higher.

Utilities/Release/linux/aarch64/Dockerfile

@@ -6,8 +6,8 @@
 # The resulting image will have an '/out' directory containing the package.
 
 # Keep this in sync with the `.gitlab/os-linux.yml` `.linux_release_aarch64` image.
-ARG FROM_IMAGE_NAME=kitware/cmake:build-linux-aarch64-deps-2020-12-21
-ARG FROM_IMAGE_DIGEST=@sha256:0bd7dfe4e45593b04e39cd21e44011034610cfd376900558c5ef959bb1af15af
+ARG FROM_IMAGE_NAME=kitware/cmake:build-linux-aarch64-deps-2026-01-13
+ARG FROM_IMAGE_DIGEST=@sha256:7373fe775ea571a3113251b3e8b5857ef321f6e9b5dfa5963f6e44d062349244
 ARG FROM_IMAGE=$FROM_IMAGE_NAME$FROM_IMAGE_DIGEST
 FROM $FROM_IMAGE
 
@@ -19,7 +19,6 @@ RUN : \
  && mkdir -p /opt/cmake/src/cmake-build \
  && cd /opt/cmake/src/cmake-build \
  && cp ../cmake/Utilities/Release/linux/aarch64/cache.txt CMakeCache.txt \
- && source /opt/rh/devtoolset-7/enable \
  && set -x \
  && ../cmake/bootstrap --parallel=$(nproc) --docdir=doc/cmake \
  && nice make -j $(nproc) \

Utilities/Release/linux/aarch64/base/Dockerfile

@@ -4,28 +4,33 @@
 # Produce a base image with a build environment for portable CMake binaries.
 # Build using the directory containing this file as its own build context.
 
-ARG FROM_IMAGE_NAME=centos:7
-ARG FROM_IMAGE_DIGEST=@sha256:43964203bf5d7fe38c6fca6166ac89e4c095e2b0c0a28f6c7c678a1348ddc7fa
+ARG FROM_IMAGE_NAME=centos:8
+ARG FROM_IMAGE_DIGEST=@sha256:a27fd8080b517143cbbbab9dfb7c8571c40d67d534bbdee55bd6c473f432b177
 ARG FROM_IMAGE=$FROM_IMAGE_NAME$FROM_IMAGE_DIGEST
 FROM $FROM_IMAGE
 
+COPY repo-vault.sed /root/
+
 RUN : \
- && yum install -y centos-release-scl \
- && yum install -y \
+ && sed -f /root/repo-vault.sed -i /etc/yum.repos.d/*.repo \
+ && sed -i '/^enabled=0/s/0/1/' /etc/yum.repos.d/CentOS-Linux-PowerTools.repo \
+ && dnf install -y \
         ca-certificates \
         curl \
-        devtoolset-7-gcc \
-        devtoolset-7-gcc-c++ \
         fontconfig-devel \
         freetype-devel \
+        gcc \
+        gcc-c++ \
         git \
+        libstdc++-static \
         libX11-devel \
         libxcb-devel \
         make \
         patch \
         perl \
+        perl-core \
         python3-pip \
         xz \
         which \
- && yum clean all \
+ && dnf clean all \
  && :

Utilities/Release/linux/aarch64/base/repo-vault.sed

@@ -0,0 +1,3 @@
+# Switch to CentOS vault repositories.
+/^mirrorlist=/d
+s|^# *baseurl=http://mirror.centos.org|baseurl=http://vault.centos.org|

Utilities/Release/linux/aarch64/deps/Dockerfile

@@ -4,16 +4,11 @@
 # Produce an image with custom-built dependencies for portable CMake binaries.
 # Build using the directory containing this file as its own build context.
 
-ARG FROM_IMAGE_NAME=kitware/cmake:build-linux-aarch64-base-2020-12-21
-ARG FROM_IMAGE_DIGEST=@sha256:c8d9fa279ef09c26e74ff28770ae0db1f4cb75ef53b782ace604daba71a41f65
+ARG FROM_IMAGE_NAME=kitware/cmake:build-linux-aarch64-base-2026-01-13
+ARG FROM_IMAGE_DIGEST=@sha256:8385631a7999a04d59aff527cf20302526c0d42e4d4c0d3db05e20c09d297fc5
 ARG FROM_IMAGE=$FROM_IMAGE_NAME$FROM_IMAGE_DIGEST
 FROM $FROM_IMAGE
 
-# Sphinx
-RUN : \
- && pip3 install sphinx==2.1.2 \
- && :
-
 # Qt
 # Version 5.12.0 was the last to bundle xkbcommon.
 COPY qt-install.patch /opt/qt/src/
@@ -24,7 +19,6 @@ RUN : \
  && sha512sum qt-everywhere-src-5.12.0.tar.xz | grep -q 0dd03d2645fb6dac5b58c8caf92b4a0a6900131f1ccfb02443a0df4702b5da0458f4c45e758d1b929ec709b0f4b36900df2fd60a058af9cc8c1a0748b6d57aae \
  && tar xJf qt-everywhere-src-5.12.0.tar.xz \
  && cd qt-build \
- && source /opt/rh/devtoolset-7/enable \
  && ../qt-everywhere-src-5.12.0/configure \
       -prefix /opt/qt \
       -static \
@@ -111,7 +105,6 @@ RUN : \
  && sha512sum ncurses-6.1.tar.gz | grep -q e308af43f8b7e01e98a55f4f6c4ee4d1c39ce09d95399fa555b3f0cdf5fd0db0f4c4d820b4af78a63f6cf6d8627587114a40af48cfc066134b600520808a77ee \
  && tar xzf ncurses-6.1.tar.gz \
  && cd ncurses-build \
- && source /opt/rh/devtoolset-7/enable \
  && ../ncurses-6.1/configure \
       --prefix=/opt/ncurses \
       --with-terminfo-dirs=/etc/terminfo:/lib/terminfo:/usr/share/terminfo \
@@ -128,12 +121,11 @@ COPY openssl-source.patch /opt/openssl/src/
 RUN : \
  && mkdir -p /opt/openssl/src \
  && cd /opt/openssl/src \
- && curl -O https://www.openssl.org/source/openssl-1.1.1f.tar.gz \
- && sha512sum openssl-1.1.1f.tar.gz | grep -q b00bd9b5ad5298fbceeec6bb19c1ab0c106ca5cfb31178497c58bf7e0e0cf30fcc19c20f84e23af31cc126bf2447d3e4f8461db97bafa7bd78f69561932f000c \
- && tar xzf openssl-1.1.1f.tar.gz \
- && cd openssl-1.1.1f \
+ && curl -OL https://github.com/openssl/openssl/releases/download/openssl-3.6.0/openssl-3.6.0.tar.gz \
+ && sha256sum openssl-3.6.0.tar.gz | grep -q b6a5f44b7eb69e3fa35dbf15524405b44837a481d43d81daddde3ff21fcbb8e9 \
+ && tar xzf openssl-3.6.0.tar.gz \
+ && cd openssl-3.6.0 \
  && patch -p1 -i ../openssl-source.patch \
- && source /opt/rh/devtoolset-7/enable \
  && ./Configure --prefix=/opt/openssl linux-elf no-asm no-shared -D_POSIX_C_SOURCE=199506L -D_POSIX_SOURCE=1 -D_SVID_SOURCE=1 -D_BSD_SOURCE=1 \
  && make install_dev -j $(nproc) \
  && cd /opt \

Utilities/Release/linux/aarch64/deps/openssl-source.patch

@@ -8,5 +8,5 @@
 +#undef _POSIX_C_SOURCE
 +#undef _POSIX_SOURCE
 
- #include <openssl/crypto.h>
- #include "internal/cryptlib.h"
+ /* We need to use the OPENSSL_fork_*() deprecated APIs */
+ #define OPENSSL_SUPPRESS_DEPRECATED