Pin Linux release runner to ubuntu-22.04, bump to 0.2.3

[gordonwoodhull]

Summary

• Pin the x86_64-unknown-linux-gnu and aarch64-unknown-linux-gnu release jobs to ubuntu-22.04 (was ubuntu-latest).
• Bump version to 0.2.3.

Why

Reported in quarto-dev/quarto-cli#14445: typst-gather v0.2.2 binaries fail on Ubuntu 22.04, Debian 12, and RHEL 9 with:

/lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.38' not found

This breaks Quarto 1.10's Typst pipeline, including in Quarto's own first-party container image (ghcr.io/quarto-dev/quarto:1.10.3, based on Ubuntu 22.04).

Root cause

objdump -T on the v0.2.2 release artefacts (both x64 and arm64) shows a single symbol holding the GLIBC floor at 2.38: __isoc23_strtol. Every other libc symbol is <= 2.34.

All three call sites land inside vendored OpenSSL — two in DRBG seed-source code (seed_src_*) and one in X.509 verification (verify_chain neighbourhood). No other dep contributes.

ubuntu-latest now resolves to Ubuntu 24.04 (glibc 2.39). Starting in glibc 2.38, the headers redirect strtol (and friends) to __isoc23_strtol for C23 conformance. OpenSSL's static archive picks up that redirect at compile time and bakes the symbol into our binary.

v0.1.x was unaffected because it had no vendored-openssl feature — openssl-sys dynamic-linked to the system libssl, so the strtol call resolved at the user's runtime against the user's libc. The static-vendor switch landed in 7f33d8c (March 2026) to fix aarch64 cross-compile linking; that's when the floor appeared. The runner image bump (22 -> 24) had to happen too, which is why this only bit Quarto 1.10.

The fix

Pin the Linux release matrix entries to ubuntu-22.04. That image ships glibc 2.35, whose headers do not define the C23 strtol redirect macros, so OpenSSL compiles plain strtol calls. The binary's floor drops to glibc 2.34 (the next-highest symbol used), restoring compatibility with the distros Quarto documents.

ubuntu-22.04 runners are supported until June 2027. We should plan a more durable answer (cargo-zigbuild with a pinned glibc target, or a manylinux-style container build) before the runner is retired. Filed as a follow-up.

Test plan

• cargo build --release clean locally
• cargo test --release — 41 passed, 5 ignored (network), 0 failed
• Smoke-tested typst-gather analyze end-to-end on a sample config + .typ file with @preview imports
• CI green on this PR (Linux/macOS/Windows)
• After merge + tag, verify release artefact objdump -T | grep GLIBC_2.38 returns nothing
• After merge + tag, smoke-test the new binary inside ghcr.io/quarto-dev/quarto:1.10.3 (Ubuntu 22.04)

[gordonwoodhull]

Pushed a small cleanup commit (696d9f1): switched our vendored-openssl feature from a direct openssl dep to typst-kit's own vendor-openssl feature. Same vendored OpenSSL ends up in the binary, but one less version to track on typst-kit upgrades.