Support cross-compiling to aarch64-darwin from linux in CI

Build the android unit-test megazords with support for darwin-aarch64 to make
it easier to run tests locally that use Nimbus, etc. Since our NSS CI doesn't
have darwin-aarch64 artifacts, this patch builds NSPR/NSS directly similar to
how libs/build-nss-ios.sh does.

Author: moztcampbell

libs/build-all.sh

@@ -18,7 +18,7 @@ fi
 if [[ "${#}" -ne 1 ]]
 then
     echo "Usage:"
-    echo "./build-all.sh [ios|android|desktop|darwin-x86-64]"
+    echo "./build-all.sh [ios|android|desktop|darwin-x86-64|darwin-aarch64]"
     exit 1
 fi
 
@@ -113,6 +113,9 @@ then
 elif [[ "${PLATFORM}" == "darwin-x86-64" ]]
 then
   ./build-nss-desktop.sh "${NSS_SRC_PATH}" "${PLATFORM}"
+elif [[ "${PLATFORM}" == "darwin-aarch64" ]]
+then
+  ./build-nss-macos-cross.sh "${NSS_SRC_PATH}" "${PLATFORM}"
 else
   echo "Unrecognized platform"
   exit 1

libs/build-nss-macos-cross.sh

@@ -0,0 +1,114 @@
+#!/usr/bin/env bash
+
+# This script cross-compiles NSS and NSPR for macOS from Linux.
+# It is specifically designed for darwin cross-compilation in CI.
+
+set -euvx
+
+if [[ "${#}" -lt 1 ]] || [[ "${#}" -gt 2 ]]
+then
+  echo "Usage:"
+  echo "./build-nss-macos-cross.sh <ABSOLUTE_SRC_DIR> [CROSS_COMPILE_TARGET]"
+  exit 1
+fi
+
+NSS_SRC_DIR=${1}
+CROSS_COMPILE_TARGET=${2:-darwin-aarch64}
+
+# Set architecture-specific variables based on target
+if [[ "${CROSS_COMPILE_TARGET}" == "darwin-aarch64" ]]; then
+  DIST_DIR=$(abspath "desktop/darwin-aarch64/nss")
+  NSS_TARGET="aarch64-apple-darwin"
+  GYP_ARCH="arm64"
+elif [[ "${CROSS_COMPILE_TARGET}" == "darwin-x86-64" ]]; then
+  DIST_DIR=$(abspath "desktop/darwin-x86-64/nss")
+  NSS_TARGET="x86_64-apple-darwin"
+  GYP_ARCH="x64"
+else
+  echo "Unsupported cross-compile target: ${CROSS_COMPILE_TARGET}"
+  exit 1
+fi
+
+if [[ -d "${DIST_DIR}" ]]; then
+  echo "${DIST_DIR} folder already exists. Skipping build."
+  exit 0
+fi
+
+# Read toolchain configuration from ORG_GRADLE_PROJECT environment variables
+# These are set by cross-compile-setup.sh in CI
+RUST_ANDROID_PREFIX=$(echo "ORG_GRADLE_PROJECT_RUST_ANDROID_GRADLE_TARGET_${NSS_TARGET}" | tr '[:lower:]-' '[:upper:]_')
+
+# Check that NSS_DIR is set to detect CI environment
+nss_dir_var="${RUST_ANDROID_PREFIX}_NSS_DIR"
+if [[ -z "${!nss_dir_var}" ]]; then
+  echo "Error: ${nss_dir_var} is not set"
+  echo "This script must be run in a CI environment with cross-compile-setup.sh sourced"
+  exit 1
+fi
+
+# Use toolchain configuration from environment
+eval "CC=\$${RUST_ANDROID_PREFIX}_CC"
+eval "AR=\$${RUST_ANDROID_PREFIX}_AR"
+eval "RANLIB=\$${RUST_ANDROID_PREFIX}_RANLIB"
+eval "STRIP=\$${RUST_ANDROID_PREFIX}_TOOLCHAIN_PREFIX/${NSS_TARGET}-strip"
+eval "CFLAGS=\$${RUST_ANDROID_PREFIX}_CFLAGS_${NSS_TARGET//-/_}"
+eval "LDFLAGS=\$${RUST_ANDROID_PREFIX}_LDFLAGS_${NSS_TARGET//-/_}"
+
+# Build NSPR
+NSPR_BUILD_DIR=$(mktemp -d)
+pushd "${NSPR_BUILD_DIR}"
+"${NSS_SRC_DIR}"/nspr/configure \
+  STRIP="${STRIP}" \
+  RANLIB="${RANLIB}" \
+  AR="${AR}" \
+  AS="${AS:-${AR}}" \
+  LD="${LD:-${AR}}" \
+  CC="${CC}" \
+  CCC="${CC}" \
+  CFLAGS="${CFLAGS}" \
+  LDFLAGS="${LDFLAGS}" \
+  --target="${NSS_TARGET}" \
+  --enable-64bit \
+  --disable-debug \
+  --enable-optimize
+make
+popd
+
+# Build NSS using gyp
+NSS_BUILD_DIR=$(mktemp -d)
+rm -rf "${NSS_SRC_DIR}/nss/out"
+
+gyp -f ninja "${NSS_SRC_DIR}/nss/nss.gyp" \
+  --depth "${NSS_SRC_DIR}/nss/" \
+  --generator-output=. \
+  -DOS=mac \
+  -Dnspr_lib_dir="${NSPR_BUILD_DIR}/dist/lib" \
+  -Dnspr_include_dir="${NSPR_BUILD_DIR}/dist/include/nspr" \
+  -Dnss_dist_dir="${NSS_BUILD_DIR}" \
+  -Dnss_dist_obj_dir="${NSS_BUILD_DIR}" \
+  -Dhost_arch="${GYP_ARCH}" \
+  -Dtarget_arch="${GYP_ARCH}" \
+  -Dstatic_libs=1 \
+  -Ddisable_dbm=1 \
+  -Dsign_libs=0 \
+  -Denable_sslkeylogfile=0 \
+  -Ddisable_tests=1 \
+  -Ddisable_libpkix=1 \
+  -Dpython=python3
+
+GENERATED_DIR="${NSS_SRC_DIR}/nss/out/Release/"
+ninja -C "${GENERATED_DIR}"
+
+# Assemble the DIST_DIR with relevant libraries and headers
+./copy-nss-libs.sh \
+  "mac" \
+  "${GYP_ARCH}" \
+  "${DIST_DIR}" \
+  "${NSS_BUILD_DIR}/lib" \
+  "${NSPR_BUILD_DIR}/dist/lib" \
+  "${NSS_BUILD_DIR}/public/nss" \
+  "${NSPR_BUILD_DIR}/dist/include/nspr"
+
+# Cleanup
+rm -rf "${NSS_BUILD_DIR}"
+rm -rf "${NSPR_BUILD_DIR}"

megazords/full/android/build.gradle

@@ -47,7 +47,7 @@ configurations {
     // For libmegazord, we copy the desktop libs from the
     // [rust-android-gradle plugin](https://github.com/mozilla/rust-android-gradle), which is
     // configurable via `local.properties`. The official packages are built in taskcluster include
-    // `linux-x86-64` and `darwin-x86-64` and the list is controlled by
+    // `linux-x86-64`, `darwin-x86-64`, and `darwin-aarch64` and the list is controlled by
     // taskcluster/kinds/module-build/kind.yml
     //
     // For libjnidispatch, we include all libraries included in the official JAR file.

taskcluster/kinds/module-build/kind.yml

@@ -32,7 +32,7 @@ task-defaults:
       - [source, taskcluster/scripts/toolchain/setup-fetched-rust-toolchain.sh]
       - [source, taskcluster/scripts/toolchain/cross-compile-setup.sh]
       - [source, taskcluster/scripts/toolchain/copy-libs-dir.sh, libs]
-      - [bash, '-c', 'echo "rust.targets=arm,arm64,x86_64,darwin-x86-64,linux-x86-64\n" > local.properties']
+      - [bash, '-c', 'echo "rust.targets=arm,arm64,x86_64,darwin-x86-64,darwin-aarch64,linux-x86-64\n" > local.properties']
     gradlew:
       - ':{module_name}:assembleRelease'
       - ':{module_name}:publish'

taskcluster/scripts/toolchain/build-rust-toolchain.sh

@@ -28,6 +28,7 @@ cd "$VCS_PATH"
 rustup --version
 # cross-compilation targets
 rustup target add x86_64-apple-darwin
+rustup target add aarch64-apple-darwin
 rustup target add x86_64-pc-windows-gnu
 rustup target add x86_64-unknown-linux-musl
 rustup target add aarch64-unknown-linux-gnu

taskcluster/scripts/toolchain/cross-compile-setup.sh

@@ -32,7 +32,8 @@ for TARGET in x86_64-apple-darwin aarch64-apple-darwin; do
   export ${RUST_ANDROID_PREFIX}_RANLIB=${CCTOOL_BIN}/${TARGET}-ranlib
   export ${RUST_ANDROID_PREFIX}_LD_LIBRARY_PATH=${CLANG_LIB}
   export ${RUST_ANDROID_PREFIX}_RUSTFLAGS="-C linker=${CLANG_BIN}/clang-20 -C link-arg=-fuse-ld=${CCTOOL_BIN}/${TARGET}-ld -C link-arg=-B -C link-arg=${CCTOOL_BIN} -C link-arg=-target -C link-arg=${TARGET} -C link-arg=-isysroot -C link-arg=${SYSROOT} -C link-arg=-Wl,-syslibroot,${SYSROOT} -C link-arg=-Wl,-dead_strip"
-  export ${RUST_ANDROID_PREFIX}_CFLAGS_${TARGET//-/_}="-B ${CCTOOL_BIN} -target ${TARGET} -isysroot ${SYSROOT} -Wl,-syslibroot,${SYSROOT} -Wl,-dead_strip"
+  export ${RUST_ANDROID_PREFIX}_CFLAGS_${TARGET//-/_}="-B ${CCTOOL_BIN} -target ${TARGET} -isysroot ${SYSROOT}"
+  export ${RUST_ANDROID_PREFIX}_LDFLAGS_${TARGET//-/_}="-B ${CCTOOL_BIN} -target ${TARGET} -isysroot ${SYSROOT} -Wl,-syslibroot,${SYSROOT} -Wl,-dead_strip"
   export ${RUST_ANDROID_PREFIX}_BINDGEN_EXTRA_CLANG_ARGS="--sysroot ${SYSROOT}"
 done
 

taskcluster/scripts/toolchain/desktop-macos.sh

@@ -6,6 +6,7 @@ git submodule update --init
 . ./taskcluster/scripts/toolchain/cross-compile-setup.sh
 pushd libs
 ./build-all.sh darwin-x86-64
+./build-all.sh darwin-aarch64
 popd
 mkdir -p "$UPLOAD_DIR"
 tar -czf "$UPLOAD_DIR"/macos.tar.gz libs/desktop