Merge pull request #25 from TheBlueMatt/main

Fix glibc compat tweaks, make jars deterministic

Author: TheBlueMatt

.github/workflows/build.yml

@@ -15,7 +15,7 @@ jobs:
         run: |
           apt-get update
           apt-get -y dist-upgrade
-          apt-get -y install cargo libstd-rust-dev-wasm32 valgrind lld git g++ clang openjdk-11-jdk maven
+          apt-get -y install cargo libstd-rust-dev-wasm32 valgrind lld git g++ clang openjdk-11-jdk maven faketime zip unzip llvm
       - name: Checkout source code
         uses: actions/checkout@v2
         with:
@@ -26,11 +26,10 @@ jobs:
         run: |
           git config --global user.email "[email protected]"
           git config --global user.name "LDK CI"
-          git clone https://github.com/rust-bitcoin/rust-lightning
+          # Note this is a different endpoint, as we need one non-upstream commit!
+          git clone https://git.bitcoin.ninja/rust-lightning
           cd rust-lightning
-          git remote add matt https://git.bitcoin.ninja/rust-lightning
-          git fetch matt
-          git merge matt/2021-03-java-bindings-base
+          git checkout origin/2021-03-java-bindings-base
           cd ..
           git clone https://github.com/lightningdevkit/ldk-c-bindings
       - name: Rebuild C bindings without STD for WASM
@@ -54,7 +53,7 @@ jobs:
           mv liblightningjni_debug_Linux-amd64.so liblightningjni.so
           export ASAN_OPTIONS=detect_leaks=0
           LD_PRELOAD=/usr/lib/llvm-11/lib/clang/11.0.1/lib/linux/libclang_rt.asan-x86_64.so LD_LIBRARY_PATH=. mvn test
-      - name: Build Java/TS Release Bindings
+      - name: Detect current git version
         run: |
           # We assume the top commit is just a bindings update commit, so we
           # check out the previous commit to use as the commit we git describe.
@@ -68,18 +67,37 @@ jobs:
             export LDK_GARBAGECOLLECTED_GIT_OVERRIDE="$(git describe --tag $MERGE_HEAD^1)"
           fi
           echo "Using $LDK_GARBAGECOLLECTED_GIT_OVERRIDE as git version"
-          ./genbindings.sh ./ldk-c-bindings/ "-I/usr/lib/jvm/java-11-openjdk-amd64/include/ -I/usr/lib/jvm/java-11-openjdk-amd64/include/linux/" false false
-      - name: Check latest headers and release lib are in git
+          echo "$LDK_GARBAGECOLLECTED_GIT_OVERRIDE" > .git_ver
+      - name: Checkout latest MacOS binaries
         run: |
-          git diff --exit-code
+          export LDK_GARBAGECOLLECTED_GIT_OVERRIDE="$(cat .git_ver)"
+          git clone https://git.bitcoin.ninja/ldk-java-bins
+          mkdir -p src/main/resources/
+          cp "ldk-java-bins/${LDK_GARBAGECOLLECTED_GIT_OVERRIDE}/liblightningjni_MacOSX-"* src/main/resources/
+      - name: Build Java/TS Release Bindings
+        run: |
+          export LDK_GARBAGECOLLECTED_GIT_OVERRIDE="$(cat .git_ver)"
+          ./genbindings.sh ./ldk-c-bindings/ "-I/usr/lib/jvm/java-11-openjdk-amd64/include/ -I/usr/lib/jvm/java-11-openjdk-amd64/include/linux/" false false
+      - name: Build deterministic release jar
+        run: ./build-release-jar.sh
       - name: Run Java Tests against built release jar
         run: |
-          mvn -DskipTests=true package
           mvn install:install-file -Dfile=target/ldk-java-1.0-SNAPSHOT.jar -DgroupId=org.ldk -DartifactId=ldk-java -Dversion=1.0-SNAPSHOT -Dpackaging=jar
           cd javatester
           mvn package
           java -ea -jar target/ldk-java-tests-1.0-SNAPSHOT-jar-with-dependencies.jar
           cd ..
+      - name: Check latest headers are in git
+        run: |
+          git diff --exit-code
+      - name: Check latest library and jars are in bins repo
+        run: |
+          export LDK_GARBAGECOLLECTED_GIT_OVERRIDE="$(cat .git_ver)"
+          cp src/main/resources/liblightningjni_Linux-amd64.nativelib "ldk-java-bins/${LDK_GARBAGECOLLECTED_GIT_OVERRIDE}/"
+          cp target/ldk-java-1.0-SNAPSHOT.jar "ldk-java-bins/${LDK_GARBAGECOLLECTED_GIT_OVERRIDE}/"
+          cp target/ldk-java-1.0-SNAPSHOT-sources.jar "ldk-java-bins/${LDK_GARBAGECOLLECTED_GIT_OVERRIDE}/"
+          cd ldk-java-bins
+          git diff --exit-code
 
   osx:
     strategy:
@@ -137,7 +155,7 @@ jobs:
           tar xvvf openjdk-16.0.1_osx-x64_bin.tar.gz
           export JAVA_HOME=`pwd`/jdk-16.0.1.jdk/Contents/Home
           export PATH=$JAVA_HOME/bin:$PATH
-      - name: Build Java/TS Release Bindings
+      - name: Detect current git version
         run: |
           # We assume the top commit is just a bindings update commit, so we
           # check out the previous commit to use as the commit we git describe.
@@ -151,10 +169,19 @@ jobs:
             export LDK_GARBAGECOLLECTED_GIT_OVERRIDE="$(git describe --tag $MERGE_HEAD^1)"
           fi
           echo "Using $LDK_GARBAGECOLLECTED_GIT_OVERRIDE as git version"
+          echo "$LDK_GARBAGECOLLECTED_GIT_OVERRIDE" > .git_ver
+      - name: Checkout latest Linux binaries
+        run: |
+          export LDK_GARBAGECOLLECTED_GIT_OVERRIDE="$(cat .git_ver)"
+          git clone https://git.bitcoin.ninja/ldk-java-bins
+          mkdir -p src/main/resources/
+          cp "ldk-java-bins/${LDK_GARBAGECOLLECTED_GIT_OVERRIDE}/liblightningjni_Linux-"* src/main/resources/
+      - name: Build Java/TS Release Bindings
+        run: |
+          export LDK_GARBAGECOLLECTED_GIT_OVERRIDE="$(cat .git_ver)"
           # genbindings.sh always fails as there is no wasm32-wasi library
-          # available, so instead we delete the expected JNI library and check
-          # that it was created.
-          rm src/main/resources/liblightningjni_MacOSX-x86_64.nativelib
+          # available, so instead we check that the expected JNI library
+          # is created.
           ./genbindings.sh ./ldk-c-bindings/ "-I$JAVA_HOME/include/ -I$JAVA_HOME/include/darwin -isysroot$(xcrun --show-sdk-path)" false false || echo
           cat src/main/resources/liblightningjni_MacOSX-x86_64.nativelib > /dev/null
       - name: Fetch Maven 3.8.1
@@ -174,8 +201,11 @@ jobs:
           mvn package
           java -ea -jar target/ldk-java-tests-1.0-SNAPSHOT-jar-with-dependencies.jar
           cd ..
-      - name: Check latest headers and release lib are in git
+      - name: Check latest release libs are in git
         run: |
           if [ "${{ matrix.platform }}" = "macos-11" ]; then
+            export LDK_GARBAGECOLLECTED_GIT_OVERRIDE="$(cat .git_ver)"
+            cp src/main/resources/liblightningjni_MacOS-amd64.nativelib "ldk-java-bins/${LDK_GARBAGECOLLECTED_GIT_OVERRIDE}/"
+            cd ldk-java-bins
             git diff --exit-code
           fi

build-release-jar.sh

@@ -0,0 +1,36 @@
+#/bin/sh
+set -e
+set -x
+
+# zips are not generally deterministic without some tweaking, which we do here.
+
+echo "Checking that required release native libraries are present..."
+ls src/main/resources/liblightningjni_Linux-amd64.nativelib
+ls src/main/resources/liblightningjni_MacOSX-x86_64.nativelib
+ls src/main/resources/liblightningjni_MacOSX-aarch64.nativelib
+
+export LANG=C
+
+mvn clean
+faketime 2021-01-01 mvn -DskipTests=true package
+
+mkdir ziptmp
+cd ziptmp
+unzip ../target/ldk-java-1.0-SNAPSHOT-sources.jar | grep inflating | awk '{ print $2 }' | sort > ../sources-zip-files.txt
+sed -i 's/#Fri Jan 01 00:.* UTC 2021/#Fri Jan 01 00:00:00 UTC 2021/' META-INF/maven/org.ldk/ldk-java/pom.properties
+touch -d "2021-01-01 00:00 UTC" $(cat ../sources-zip-files.txt)
+cat ../sources-zip-files.txt | zip -X@ ../ldk-java-1.0-SNAPSHOT-sources-deterministic.jar
+cd ..
+rm -r ziptmp
+mv ldk-java-1.0-SNAPSHOT-sources-deterministic.jar target/ldk-java-1.0-SNAPSHOT-sources.jar
+
+mkdir ziptmp
+cd ziptmp
+unzip ../target/ldk-java-1.0-SNAPSHOT.jar | grep inflating | awk '{ print $2 }' | sort > ../classes-zip-files.txt
+sed -i 's/#Fri Jan 01 00:.* UTC 2021/#Fri Jan 01 00:00:00 UTC 2021/' META-INF/maven/org.ldk/ldk-java/pom.properties
+sed -i 's/Built-By: .*/Built-By: ldk-deterministic-builds/' META-INF/MANIFEST.MF
+touch -d "2021-01-01 00:00 UTC" $(cat ../classes-zip-files.txt)
+cat ../classes-zip-files.txt | zip -X@ ../ldk-java-1.0-SNAPSHOT-deterministic.jar
+cd ..
+rm -r ziptmp
+mv ldk-java-1.0-SNAPSHOT-deterministic.jar target/ldk-java-1.0-SNAPSHOT.jar

genbindings.sh

@@ -26,13 +26,19 @@ if [ "$TARGET_STRING" = "" ]; then
 fi
 case "$TARGET_STRING" in
 	"x86_64-pc-linux"*)
-		LDK_TARGET_SUFFIX="_Linux-amd64" ;;
+		LDK_TARGET_SUFFIX="_Linux-amd64"
+		LDK_JAR_TARGET=true
+		;;
 	"x86_64-apple-darwin"*)
-		LDK_TARGET_SUFFIX="_MacOSX-x86_64" ;;
+		LDK_TARGET_SUFFIX="_MacOSX-x86_64"
+		LDK_JAR_TARGET=true
+		;;
 	"aarch64-apple-darwin"*)
-		LDK_TARGET_SUFFIX="_MacOSX-aarch64" ;;
+		LDK_TARGET_SUFFIX="_MacOSX-aarch64"
+		LDK_JAR_TARGET=true
+		;;
 	*)
-		LDK_TARGET_SUFFIX=""
+		LDK_TARGET_SUFFIX="_${TARGET_STRING}"
 esac
 if [ "$LDK_TARGET_CPU" = "" ]; then
 	LDK_TARGET_CPU="sandybridge"
@@ -78,26 +84,58 @@ if [ "$3" = "true" ]; then
 	[ "$IS_MAC" = "false" ] && COMPILE="$COMPILE -Wl,-wrap,calloc -Wl,-wrap,realloc -Wl,-wrap,reallocarray -Wl,-wrap,malloc -Wl,-wrap,free"
 	$COMPILE -o liblightningjni_debug$LDK_TARGET_SUFFIX.so -g -fsanitize=address -shared-libasan -rdynamic -I"$1"/lightning-c-bindings/include/ $2 src/main/jni/bindings.c "$1"/lightning-c-bindings/target/$LDK_TARGET/debug/libldk.a -lm
 else
+	LDK_LIB="$1"/lightning-c-bindings/target/$LDK_TARGET/release/libldk.a
 	if [ "$IS_MAC" = "false" ]; then
 		COMPILE="$COMPILE -Wl,--version-script=libcode.version -fuse-ld=lld"
 		echo "// __cxa_thread_atexit_impl is used to more effeciently cleanup per-thread local storage by rust libstd." >> src/main/jni/bindings.c
 		echo "// However, it is not available on glibc versions 2.17 or earlier, and rust libstd has a null-check and fallback in case it is missing." >> src/main/jni/bindings.c
-		echo "// Because it is weak-linked on the rust side, we can simply define it explicitly here, forcing rust to use the fallback." >> src/main/jni/bindings.c
+		echo "// Because it is weak-linked on the rust side, we should be able to simply define it explicitly here, forcing rust to use the fallback." >> src/main/jni/bindings.c
 		echo "void *__cxa_thread_atexit_impl = NULL;" >> src/main/jni/bindings.c
+		# Note that the above is not sufficient. For some reason involving ancient dark magic and
+		# haunted code segments, overriding the weak symbol only impacts sites which *call* the
+		# symbol in question, not sites which *compare with* the symbol in question.
+		# This means that the NULL check in rust's libstd will always think the function is
+		# callable while the function which is called ends up being NULL (leading to a jmp to the
+		# zero page and a quick SEGFAULT).
+		# This issue persists not only with directly providing a symbol, but also ld.lld's -wrap
+		# and --defsym arguments.
+		# In smaller programs, it appears to be possible to work around this with -Bsymbolic and
+		# -nostdlib, however when applied the full-sized JNI library here it no longer works.
+		# After exhausting nearly every flag documented in lld, the only reliable method appears
+		# to be editing the LDK binary. Luckily, LLVM's tooling makes this rather easy as we can
+		# disassemble it into very readable code, edit it, and then reassemble it.
+		[ ! -f "$1"/lightning-c-bindings/target/$LDK_TARGET/release/libldk.a ] && exit 1
+		if [ "$(ar t "$1"/lightning-c-bindings/target/$LDK_TARGET/release/libldk.a | grep -v "\.o$" || echo)" != "" ]; then
+			echo "Archive contained non-object files!"
+			exit 1
+		fi
+		if [ "$(ar t "$1"/lightning-c-bindings/target/$LDK_TARGET/release/libldk.a | grep ldk.ldk.*-cgu.*.rcgu.o | wc -l)" != "1" ]; then
+			echo "Archive contained more than one LDK object file"
+			exit 1
+		fi
+		mkdir -p tmp
+		rm -f tmp/*
+		ar x --output=tmp "$1"/lightning-c-bindings/target/$LDK_TARGET/release/libldk.a
+		pushd tmp
+		llvm-dis ldk.ldk.*-cgu.*.rcgu.o
+		sed -i 's/br i1 icmp eq (i8\* @__cxa_thread_atexit_impl, i8\* null)/br i1 icmp eq (i8* null, i8* null)/g' ldk.ldk.*-cgu.*.rcgu.o.ll
+		llvm-as ldk.ldk.*-cgu.*.rcgu.o.ll -o ./libldk.bc
+		ar q libldk.a *.o
+		popd
+		LDK_LIB="tmp/libldk.bc tmp/libldk.a"
 	fi
-	$COMPILE -o liblightningjni_release$LDK_TARGET_SUFFIX.so -flto -O3 -I"$1"/lightning-c-bindings/include/ $2 src/main/jni/bindings.c "$1"/lightning-c-bindings/target/$LDK_TARGET/release/libldk.a
+	$COMPILE -o liblightningjni_release$LDK_TARGET_SUFFIX.so -flto -O3 -I"$1"/lightning-c-bindings/include/ $2 src/main/jni/bindings.c $LDK_LIB
 	if [ "$IS_MAC" = "false" ]; then
-		set +e # grep exits with 1 if no lines were left, which is our success condition
-		GLIBC_SYMBS="$(objdump -T liblightningjni_release$LDK_TARGET_SUFFIX.so | grep GLIBC_ | grep -v "GLIBC_2\.2\." | grep -v "GLIBC_2\.3\(\.\| \)" | grep -v "GLIBC_2.\(14\|17\) ")"
-		set -e
+		GLIBC_SYMBS="$(objdump -T liblightningjni_release$LDK_TARGET_SUFFIX.so | grep GLIBC_ | grep -v "GLIBC_2\.2\." | grep -v "GLIBC_2\.3\(\.\| \)" | grep -v "GLIBC_2.\(14\|17\) " || echo)"
 		if [ "$GLIBC_SYMBS" != "" ]; then
 			echo "Unexpected glibc version dependency! Some users need glibc 2.17 support, symbols for newer glibcs cannot be included."
 			echo "$GLIBC_SYMBS"
 			exit 1
 		fi
 	fi
-	if [ "$LDK_TARGET_SUFFIX" != "" ]; then
+	if [ "$LDK_JAR_TARGET" = "true" ]; then
 		# Copy to JNI native directory for inclusion in JARs
+		mkdir -p src/main/resources/
 		cp liblightningjni_release$LDK_TARGET_SUFFIX.so src/main/resources/liblightningjni$LDK_TARGET_SUFFIX.nativelib
 	fi
 fi

src/main/java/org/ldk/impl/bindings.java

@@ -48,7 +48,7 @@ public VecOrSliceDef(long dataptr, long datalen, long stride) {
 	static native String get_lib_version_string();
 
 	public static String get_ldk_java_bindings_version() {
-		return "v0.0.98.3";
+		return "v0.0.98.4";
 	}
 	public static native String get_ldk_c_bindings_version();
 	public static native String get_ldk_version();

src/main/jni/bindings.c

@@ -133,7 +133,7 @@ static inline LDKStr java_to_owned_str(JNIEnv *env, jstring str) {
 }
 
 JNIEXPORT jstring JNICALL Java_org_ldk_impl_bindings_get_1lib_1version_1string(JNIEnv *env, jclass _c) {
-	return str_ref_to_java(env, "v0.0.98.3", strlen("v0.0.98.3"));
+	return str_ref_to_java(env, "v0.0.98.4", strlen("v0.0.98.4"));
 }
 JNIEXPORT jstring JNICALL Java_org_ldk_impl_bindings_get_1ldk_1c_1bindings_1version(JNIEnv *env, jclass _c) {
 	return str_ref_to_java(env, check_get_ldk_bindings_version(), strlen(check_get_ldk_bindings_version()));
@@ -25884,5 +25884,5 @@ JNIEXPORT jstring JNICALL Java_org_ldk_impl_bindings_SiPrefix_1to_1str(JNIEnv *e
 
 // __cxa_thread_atexit_impl is used to more effeciently cleanup per-thread local storage by rust libstd.
 // However, it is not available on glibc versions 2.17 or earlier, and rust libstd has a null-check and fallback in case it is missing.
-// Because it is weak-linked on the rust side, we can simply define it explicitly here, forcing rust to use the fallback.
+// Because it is weak-linked on the rust side, we should be able to simply define it explicitly here, forcing rust to use the fallback.
 void *__cxa_thread_atexit_impl = NULL;

src/main/jni/bindings.c.body

@@ -131,7 +131,7 @@ static inline LDKStr java_to_owned_str(JNIEnv *env, jstring str) {
 }
 
 JNIEXPORT jstring JNICALL Java_org_ldk_impl_bindings_get_1lib_1version_1string(JNIEnv *env, jclass _c) {
-	return str_ref_to_java(env, "v0.0.98.3", strlen("v0.0.98.3"));
+	return str_ref_to_java(env, "v0.0.98.4", strlen("v0.0.98.4"));
 }
 JNIEXPORT jstring JNICALL Java_org_ldk_impl_bindings_get_1ldk_1c_1bindings_1version(JNIEnv *env, jclass _c) {
 	return str_ref_to_java(env, check_get_ldk_bindings_version(), strlen(check_get_ldk_bindings_version()));