ci: serialize make distcheck

[pbrezina]

I saw make distcheck fail recently with linker due to a race condition when libsss_util.so was not available for libsss_ldap.

I let AI handle it:

  Root cause: Parallel libtool relink race condition during make distcheck install phase

  The failure is on line 27479-27480:
  libsss_util.so: file not recognized: file format not recognized
  collect2: error: ld returned 1 exit status

  What happened — two libtool relink commands ran in parallel during make install:

  1. Line 27474 (at 27.133s): libtool starts relinking libsss_util.so, writing to _build/sub/.libs/libsss_util.so
  2. Line 27478 (at 27.229s, ~100ms later): libtool starts relinking libsss_ldap.so, which links against -lsss_util via -L_build/sub/.libs
  3. Line 27479 (at 27.240s, ~10ms later): the libsss_ldap linker tries to read libsss_util.so from .libs/ — but that file is still being written by the concurrent libsss_util relink, so the linker sees a partially-written
  (truncated/corrupt) .so file

---

Libtool relinks shared libraries during install. With parallel make,
install-sssdlibLTLIBRARIES and install-pkglibLTLIBRARIES run
concurrently, causing provider plugin relinks to read half-written
base library .so files (e.g. libsss_ldap reads libsss_util.so
mid-relink). Serialize the install targets to prevent this.

Assisted-By: Claude Code (Opus 4.6)

[gemini-code-assist]

Code Review

This pull request modifies Makefile.am to serialize install-sssdlibLTLIBRARIES after install-pkglibLTLIBRARIES and install-libLTLIBRARIES to prevent parallel installation race conditions during Libtool relinking. The reviewer suggests extending this serialization to other library groups (such as ldblib, py3exec, cifsplugin, and winbindplugin) that also link against these base libraries and are susceptible to the same race condition.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[alexey-tikhonov]

I let AI handle it:

I tried this in the past and gave up after several iterations. But maybe it got better.

There is also bcf84e1 that I was going to extract from #8847 to see if it helps.

[pbrezina]

I let AI handle it:

I tried this in the past and gave up after several iterations. But maybe it got better.

There is also bcf84e1 that I was going to extract from #8847 to see if it helps.

It's basically the same fix, this PR is just more complete. I also addressed gemini notes, let's see what CI will look like.

[alexey-tikhonov]

Btw, for some (unknown to me) reason, branches other than 'master' fail distcheck much more often.

[pbrezina]

Well, fixing one problem revealed another one. The first version where only install-sssdlibLTLIBRARIES: install-pkglibLTLIBRARIES install-libLTLIBRARIES seem to work, but since there are other dependencies that needs to be ordered it is not complete. All other fixes just revelead another issues and eventually AI started guessing and looping. So serializing the distcheck is the easiest fix for CI.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[ikerexxe]

@pbrezina can you set the backport labels? This problem has been hitting heavily sssd-2-9 and I'd like to see it ported there

[sssd-bot]

The pull request was accepted by @alexey-tikhonov with the following PR CI status:

---

🟢 CodeQL (success)
🟢 osh-diff-scan:fedora-rawhide-x86_64:upstream (success)
🟢 rpm-build:centos-stream-10-x86_64:upstream (success)
🟢 rpm-build:fedora-43-x86_64:upstream (success)
🟢 rpm-build:fedora-44-x86_64:upstream (success)
🟢 rpm-build:fedora-rawhide-x86_64:upstream (success)
🟢 testing-farm:centos-stream-10-x86_64:upstream (success)
🔴 testing-farm:fedora-43-x86_64:upstream (failure)
🔴 testing-farm:fedora-44-x86_64:upstream (failure)
🔴 testing-farm:fedora-rawhide-x86_64:upstream (failure)
🟢 Build / freebsd (success)
🟢 Build / make-distcheck (success)
🟢 ci / intgcheck (centos-10) (success)
🟢 ci / intgcheck (fedora-43) (success)
🟢 ci / intgcheck (fedora-44) (success)
🟢 ci / intgcheck (fedora-45) (success)
🟢 ci / prepare (success)
🟢 ci / system (centos-10) (success)
🟢 ci / system (fedora-43) (success)
🔴 ci / system (fedora-44) (failure)
🔴 ci / system (fedora-45) (failure)
➖ Coverity scan / coverity (skipped)
🟢 Static code analysis / codeql (success)
🟢 Static code analysis / pre-commit (success)
🟢 Static code analysis / python-system-tests (success)

---

There are unsuccessful or unfinished checks. Make sure that the failures are not related to this pull request before merging.