add static musl build

.github/workflows/build-static.yml

@@ -0,0 +1,64 @@
+name: Build static binaries
+
+on:
+  push:
+    branches:
+    - '*'
+    paths:
+    - .github/workflows/build-static.yml
+    - contrib/static/**
+    - daemon/**
+    - i18n/**
+    - libi2pd/**
+    - libi2pd_client/**
+    - Makefile
+    - Makefile.linux
+    tags:
+    - '*'
+  pull_request:
+    branches:
+    - '*'
+
+jobs:
+  build:
+    name: musl ${{ matrix.arch }}
+    runs-on: ${{ matrix.runner }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - arch: x86_64
+          runner: ubuntu-latest
+        - arch: aarch64
+          runner: ubuntu-24.04-arm
+
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+
+    - name: Build in Alpine
+      run: docker run --rm -v "$PWD":/src -w /src alpine:3.22 sh contrib/static/build-musl.sh
+
+    - name: Check binary
+      run: |
+        file i2pd | grep 'statically linked'
+        readelf -d i2pd | grep 'There is no dynamic section'
+        ./i2pd --version
+        ./i2pd --version | grep -E '^OpenSSL (3\.([5-9]|[1-9][0-9])|[4-9])\.'
+        ./i2pd --version | grep -E '^Boost version 1\.(8[1-9]|9[0-9])\.'
+
+    - name: Run
+      run: |
+        mkdir datadir
+        ./i2pd --datadir=datadir --log=file --logfile=datadir/i2pd.log --loglevel=info &
+        sleep 15
+        kill -0 $!
+        grep 'Daemon: Starting NetDB' datadir/i2pd.log
+        kill -9 $!
+
+    - name: Upload artifacts
+      uses: actions/upload-artifact@v4
+      with:
+        name: i2pd-static-${{ matrix.arch }}
+        path: i2pd

contrib/static/build-musl.sh

@@ -0,0 +1,27 @@
+#!/bin/sh
+# Fully static i2pd, run from the source tree inside an Alpine container
+set -e
+
+OPENSSL_VERSION=3.5.8
+JOBS=4
+
+apk add --no-cache build-base perl linux-headers boost-dev boost-static zlib-dev zlib-static miniupnpc-dev
+
+SRC=$(pwd)
+cd /tmp
+OPENSSL=openssl-$OPENSSL_VERSION
+wget -q https://github.com/openssl/openssl/releases/download/$OPENSSL/$OPENSSL.tar.gz
+wget -q https://github.com/openssl/openssl/releases/download/$OPENSSL/$OPENSSL.tar.gz.sha256
+echo "$(cut -d' ' -f1 $OPENSSL.tar.gz.sha256)  $OPENSSL.tar.gz" | sha256sum -c -
+tar xzf $OPENSSL.tar.gz
+cd $OPENSSL
+# no-autoload-config: a static binary must not read the host's openssl.cnf
+./Configure --prefix=/usr --libdir=lib --openssldir=/nonexistent \
+	no-autoload-config no-shared no-module no-dso no-engine no-tests no-docs
+make -j$JOBS
+make install_sw
+
+cd "$SRC"
+# USE_STATIC looks for archives in /usr/lib/$(SYS) and does not pass -static
+make -j$JOBS DEBUG=no USE_STATIC=yes USE_UPNP=yes LIBDIR=/usr/lib LDFLAGS=-static i2pd
+strip i2pd