chore(compass, hadron-build): only run electron-rebuild on linux

packages/compass/package.json

@@ -140,7 +140,7 @@
   },
   "scripts": {
     "install": "node scripts/download-fonts.js && node scripts/download-csfle.js",
-    "electron-rebuild": "electron-rebuild --only kerberos,keytar,interruptor,os-dns-native,win-export-certificate-and-key,macos-export-certificate-and-key --prebuild-tag-prefix not-real-prefix-to-force-rebuild",
+    "electron-rebuild": "node scripts/electron-rebuild.js",
     "prestart": "npm run electron-rebuild && npm run compile --workspace=@mongodb-js/webpack-config-compass",
     "start": "HADRON_DISTRIBUTION=${HADRON_DISTRIBUTION:-compass} npm run webpack serve -- --mode development",
     "test-electron": "npm run test-main && npm run test-renderer",
@@ -240,6 +240,7 @@
     "chalk": "^4.1.2",
     "clean-stack": "^2.0.0",
     "compass-preferences-model": "^2.29.1",
+    "cross-spawn": "^7.0.3",
     "debug": "^4.3.4",
     "depcheck": "^1.4.1",
     "electron": "^30.5.1",

packages/compass/scripts/electron-rebuild.js

@@ -0,0 +1,40 @@
+'use strict';
+const spawn = require('cross-spawn');
+const path = require('path');
+
+const modulesToRebuild =
+  require('../package.json').config.hadron.rebuild.onlyModules;
+
+// We only want to force rebuild on linux to make sure that the version of glibc
+// is matching the platform we're running this on instead of the platform the
+// prebuilt was generated on, for other platforms it's okay to just download the
+// prebuilt modules when available
+const forceRebuildFromSource = process.platform === 'linux';
+
+/** @type {[string, string[]]} */
+const rebuildArgs = [
+  'electron-rebuild',
+  [
+    '--only',
+    modulesToRebuild.join(','),
+    ...(forceRebuildFromSource
+      ? [
+          // electron-rebuild doesn't allow to force rebuild from source, but we
+          // can force it by passing a fake tag that would not allow prebuilt to
+          // download the asset
+          '--prebuild-tag-prefix',
+          'not-real-prefix-to-force-rebuild',
+        ]
+      : []),
+    ...process.argv.slice(2),
+  ],
+];
+
+// eslint-disable-next-line no-console
+console.log('> %s', rebuildArgs.flat().join(' '));
+
+spawn(...rebuildArgs, {
+  cwd: path.resolve(__dirname, '..'),
+  stdio: 'inherit',
+  env: process.env,
+});

packages/hadron-build/commands/release.js

@@ -384,15 +384,24 @@ const installDependencies = util.callbackify(async (CONFIG) => {
     force: true,
   };
 
+  const forceRebuildFromSourceOptions =
+    // We only want to force rebuild on linux to make sure that the version of
+    // glibc is matching the platform we're running this on instead of the
+    // platform the prebuilt was generated on, for other platforms it's okay to
+    // just download the prebuilt modules when available
+    process.platform === 'linux'
+      ? {
+          // electron-rebuild doesn't allow to force rebuild from source, but we
+          // can force it by passing a fake tag that would not allow prebuilt to
+          // download the asset
+          prebuildTagPrefix: 'not-real-prefix-to-force-rebuild',
+        }
+      : {};
+
   const allModulesRebuildConfig = {
     ...sharedRebuildConfig,
     ...CONFIG.rebuild,
-    // We want to ensure that we are actually rebuilding native modules on the
-    // platform we are packaging. There is currently no direct way of passing a
-    // --build-from-source flag to rebuild-install package, but we can force
-    // rebuild by providing a tag prefix that will make prebuild think that
-    // prebuilt files don't exist
-    prebuildTagPrefix: 'totally-not-a-real-prefix-to-force-rebuild',
+    ...forceRebuildFromSourceOptions,
   };
 
   // We can not force rebuild mongodb-client-encryption locally, but we need to