fix appsec int tests fail on frankenphp

[cataphract]

Description

After the appsec image upgrade, the builds of ddappsec.so started targeting a version of glibc too recent for the frankenphp image.

• In appsec integration tests, build ddappsec.so portably. No separate musl/glibc builds now, like already happened for the tracer and libdatadog/components-rs
• Do away with elf patching which used to remove the libc dependency. The new toolchain image adds a libc dependency that need not be removed
• Fix some task input mismatches in build.gradle

Reviewer checklist

• Test coverage seems ok.
• Appropriate labels assigned.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-10T16:57:06.478705Z	61be8e7	PR opened
🔒 Security Review	✅ Completed 2026-09-10T16:57:06.477521Z	61be8e7	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[datadog-prod-us1-3]

 

✨ Unblock PR with BitsAI

⚠️ Warnings

❌ Your PR has failed checks. Please review the issues below and take necessary action before merging.

🚦 6 Pipeline jobs failed

DataDog/apm-reliability/dd-trace-php | check libxml2 version — 🔧 Needs a code fix, caused by this PR

View more details · View in GitLab

DataDog/apm-reliability/dd-trace-php | helper-rust integration coverage — 🔧 Needs a code fix, caused by this PR

View more details · View in GitLab

DataDog/apm-reliability/dd-trace-php | installer tests — 🔧 Needs a code fix, caused by this PR

View more details · View in GitLab

View all 6 failed jobs.

ℹ️ Info

No other issues found (see more)

🧪 All tests passed
❄️ No new flaky tests detected

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 55.03% (+0.00%)

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: ca499db | Docs | View more details | Give us feedback!}

[morrisonlevi]

Looks good to Claude, and it does fix the tests it aims to. I don't quite grasp it, but the way it makes it portable is instead of patching away glibc symbols, it builds them on musl to begin with. Something like that.

[cataphract]

@morrisonlevi

Looks good to Claude, and it does fix the tests it aims to. I don't quite grasp it, but the way it makes it portable is instead of patching away glibc symbols, it builds them on musl to begin with. Something like that.

Sorry, I gave a truncated explanation, but to be clear what fixes it is to build ddappsec against a patched musl. With some previous toolchains, doing so would leave a NEEDED entry in the ELF for the musl shared library's explicit name, which would have to be patched away with patchelf in order to load it on glibc. However, the new toolchain doesn't require this anymore for reasons not worth going into. So I removed the step that would do the patching as well.