[tae898]

Closes the glibc, Python 3.15, notices and platform-docs gaps found in the production audit of the native arcadedb wheels. The ranked list of the remaining gaps is in .notes/PRODUCTION-GAPS.md of the working copy (not part of this PR).

Linux wheels: manylinux_2_34 to manylinux_2_28

The Linux legs now build the image in quay.io/pypa/manylinux_2_28_{x86_64,aarch64} (AlmaLinux 8, glibc 2.28, gcc 14). This adds RHEL 8 and Rocky 8, Debian 10 and 11, and Ubuntu 20.04 to the supported systems.

Evidence that the floor was only a link-time property of the 2.34 container:

• The current artifact (run 40238118922, libarcadedb.so, x86_64 and aarch64) references only two glibc symbols above 2.17 that matter: pthread_getattr_np@GLIBC_2.32 and the GLIBC_2.34 group (dlopen, dlsym, dlclose, dladdr and the pthread_* calls). glibc 2.34 merged libpthread and libdl into libc, so a build against 2.34 versions those symbols as 2.32 and 2.34. Built against 2.28 they bind to libpthread and libdl with their old versions.
• GraalVM CE 25.4.4.1.1 itself runs on old glibc (bin/java needs GLIBC_2.2.5, libjvm.so GLIBC_2.7, libjava.so GLIBC_2.9).
• Checked in the manylinux_2_28 container with the same GraalVM CE: a native-image --shared -march=compatibility library links and needs glibc 2.17 at most (NEEDED: libz, libpthread, libdl, libm, librt, libc).

Changes: containers and plat_re in scripts/select_native_matrix.py; the glibc gate of test-native.yml is 2.28 now; build_wheel.py gets --glibc-policy (default 2.28) so the tag is never below the policy of the build container (the symbols alone would say 2.17, which would be an unverified promise because libjvector-x86_64.so needs GLIBCXX_3.4.21); the auditwheel gate checks that the tag auditwheel grants is not above the wheel's tag instead of requiring equality; the dnf install of the container is skipped when zlib-devel unzip which are installed (they are in the 2_28 image, and the AlmaLinux 8 appstream metadata failed in my test); a new gate runs scripts/smoke_wheel.py (import, SQL, openCypher) inside the manylinux_2_28 container with only the wheel installed, so the glibc 2.28 claim is run, not only inferred from symbols.

arcadedb-jvm stays at manylinux_2_34 (the bundled Amazon Corretto JRE sets that floor); it is not touched here.

Python 3.15

uv 0.12.0 (the pinned version) lists cpython-3.15.0. The wheel is py3-none and loads its library with ctypes. On Python 3.15.0, with the linux-x86_64 wheel of run 40238118922, the pyver subset gave 269 passed, 0 failed locally. The only 4 errors were tests of test_vector.py that build Java arrays with jpype1, which has no cp315 wheel (1.7.1; the sdist needs a JDK and cmake). ladybug, used by the full suite, has no cp315 wheel either.

So 3.15 is added to the pyver legs (informational, never gates a release) with jpype: false, which drops test_parameter_binding.py and test_vector.py and does not install jpype1. The full parity run stays on 3.11 to 3.14. The wheel gets the 3.15 classifier. arcadedb-jvm cannot install on 3.15 until JPype ships a wheel for it (it depends on jpype1>=1.5.0).

Notices

native/wheel/NOTICE: arcadedb_native.ENGINE_VERSION was a stale name (now arcadedb.ENGINE_VERSION); the GraalVM source line names the substratevm commit from the release file of the GraalVM CE build; the list of dynamically linked and not shipped system libraries now covers Linux (including libpthread, libdl, librt of the 2.28 build), macOS and Windows (the dumpbin record of run 40238118922 lists VCRUNTIME140.dll, VCRUNTIME140_1.dll and the api-ms-win-crt-* DLLs). THIRD_PARTY_NOTICES.md is generated and unchanged.

Docs

The install page now has a Requirements table with both wheel tags and the glibc floors, the platforms that are not built (Intel Mac, Alpine and other musl systems, Windows on ARM, older Linux) with what to do instead, the wheel size, and the Python 3.15 note. The which-package table, the index and the CI page follow. Intel Macs are not supported by decision: Apple has sold only Apple Silicon since 2023, macOS 26 is the last release for Intel Macs, and GitHub is phasing out Intel macOS runners.

Checks run

• tests/test_select_native_matrix.py: 10 passed (it pins the new legs, the 2.28 containers and the workflow floor).
• actionlint on test-native.yml: clean.
• smoke_wheel.py run against the linux-x86_64 wheel of run 40238118922 on Python 3.12: ok.
• The new glibc and auditwheel gates dry-run against the recorded auditwheel.txt: 2_28 tag fails on the old 2_34 wheel as it should.
• test-native.yml dispatched on this branch for all four platforms: https://github.com/ArcadeData/arcadedb-python/actions/runs/40249725819. Do not merge unless linux-x86_64 and linux-aarch64 show the manylinux_2_28 tag, the new glibc 2.28 smoke gate passes, and the parity gate is 0 failed on every platform.

🤖 Generated with Claude Code