fix(plugin): attribute musl version checks to their libraries

Author: kmbroai

plugins/codex-security/native/README.md

@@ -29,7 +29,7 @@ Build outputs stay under ignored `target` and `dist` directories. Linux output d
 node plugins/codex-security/native/check.mjs
 ```
 
-GNU Linux artifacts must import no glibc version newer than 2.28. Musl artifacts must be ELF images for the current architecture, depend on that architecture's musl library, and import no glibc symbols. Musl has no glibc-style symbol version floor, so its runtime compatibility also requires the load proofs below. macOS artifacts must declare a deployment target of 11.0 or earlier. A build from a newer GNU Linux workstation can pass the behavioral proof and still fail this distribution check.
+GNU Linux artifacts must import no glibc version newer than 2.28. Musl artifacts must be ELF images for the current architecture, depend on that architecture's musl library, and have no version requirements from glibc. GCC's own `GLIBC_2.0` compatibility exports are attributed to `libgcc_s.so.1`, not the C library. Musl has no glibc-style symbol version floor, so its runtime compatibility also requires the load proofs below. macOS artifacts must declare a deployment target of 11.0 or earlier. A build from a newer GNU Linux workstation can pass the behavioral proof and still fail this distribution check.
 
 The `native-unix` workflow builds Linux artifacts in digest-pinned manylinux 2.28 images. It mounts the pinned Rust toolchain and fetched Cargo registry, builds offline, and blocks Python commands during compilation. macOS builds set `MACOSX_DEPLOYMENT_TARGET=11.0`. CI verifies separate x64 and arm64 artifacts on both platforms using Node 20.0.0 and 22.13.0. These artifacts are inputs to the later universal-package gate.
 

plugins/codex-security/native/check.mts

@@ -66,14 +66,21 @@ if (
       const dependencies = [
         ...dynamic.matchAll(/\(NEEDED\)[^\n]*\[([^\]]+)\]/gu),
       ].map((match) => match[1]!);
+      // libgcc uses GLIBC_2.0 for its own compatibility exports on aarch64.
+      const requiresGlibc = [
+        ...versions.matchAll(/\bFile:\s+(\S+)([\s\S]*?)(?=\bFile:|$)/gu),
+      ].some(
+        (match) =>
+          match[1] !== "libgcc_s.so.1" && /\bName:\s+GLIBC_/u.test(match[2]!),
+      );
       if (
         architecture === undefined ||
         bytes.toString("latin1", 0, 4) !== "\x7fELF" ||
         bytes[4] !== 2 ||
         bytes[5] !== 1 ||
         bytes.readUInt16LE(18) !== architecture.machine ||
         !dependencies.includes(`libc.musl-${architecture.name}.so.1`) ||
-        /\bGLIBC_/u.test(versions)
+        requiresGlibc
       ) {
         throw new Error(
           "Native payload is not a musl ELF image for this architecture, or imports glibc.",