cmake: support dynamic linking

This commit replaces the Makefile.pkg-config script that was testing
using our client/server with a dynamically linked librustls on macOS and
Linux. Now, the CMake based build script can be used for this purpose by
activating `-DDYN_LINK=on` when configuring the cmake build.

TODO:
* Windows CI coverage for dyn linking (need to debug this)

Author: cpu

.github/workflows/pkg-config.yaml

@@ -12,7 +12,7 @@ on:
 
 jobs:
   build:
-    name: "Build+Test (${{ matrix.os }}, ${{ matrix.cc }}, ${{ matrix.crypto }}, ${{ matrix.rust }}${{ matrix.cert_compression == 'on' && ', cert compression' || '' }})"
+    name: "Build+Test (${{ matrix.os }}, ${{ matrix.cc }}, ${{ matrix.rust }}, ${{ matrix.crypto }}${{ matrix.cert_compression == 'on' && ', cert compression' || '' }}${{ matrix.dyn_link == 'on' && ', dynamic linking' || '' }})"
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
@@ -30,6 +30,12 @@ jobs:
         # Include a few MacOS and cert-compression builds to ensure they're tested without
         # bloating the matrix or slowing down CI.
         include:
+          # Linux dyn link build
+          - os: ubuntu-latest
+            cc: clang
+            crypto: aws-lc-rs
+            rust: stable
+            dyn_link: on
           # Linux cert compression build
           - os: ubuntu-latest
             cc: clang
@@ -42,6 +48,12 @@ jobs:
             crypto: aws-lc-rs
             rust: stable
             cert_compression: off
+          # MacOS dyn link build
+          - os: macos-latest
+            cc: clang
+            crypto: aws-lc-rs
+            rust: stable
+            dyn_link: on
           # MacOS cert compression build
           - os: macos-latest
             cc: clang
@@ -85,6 +97,7 @@ jobs:
           cmake \
             -DCRYPTO_PROVIDER=${{matrix.crypto}} \
             -DCERT_COMPRESSION=${{matrix.cert_compression}} \
+            -DDYN_LINK=${{matrix.dyn_link}} \
             -DCMAKE_BUILD_TYPE=Debug \
             ${{ matrix.os == 'macos-latest' && '-DCMAKE_OSX_DEPLOYMENT_TARGET=14.5' || '' }} \
             -S . -B build
@@ -173,15 +186,21 @@ jobs:
         run: cmake --build build --target integration-test
 
   test-windows:
-    name: "Windows (${{ matrix.crypto }}, ${{ matrix.config }}${{ matrix.cert_compression == 'on' && ', cert compression' || '' }})"
+    name: "Windows (${{ matrix.crypto }}, ${{ matrix.config }}${{ matrix.cert_compression == 'on' && ', cert compression' || '' }}${{ matrix.dyn_link == 'on' && ', dynamic linking' || '' }})"
     runs-on: windows-latest
     strategy:
       matrix:
         crypto: [ aws-lc-rs, ring ]
         config: [ Debug, Release ]
         cert_compression: [ off ]
+        dyn_link: [ off ]
         include:
-          # Just one build with cert_compression on to reduce build times.
+          # One build with dynamic linking.
+          # TODO(@cpu): debug broken dyn-link build on Windows.
+          # - crypto: aws-lc-rs
+          #   config: Release
+          #   dyn_link: on
+          # One build with cert_compression.
           - crypto: aws-lc-rs
             config: Release
             cert_compression: on
@@ -202,12 +221,16 @@ jobs:
         with:
           arch: x64
 
-      # TODO(@cpu): install pre-built cargo-c similar to other platforms. This is slowww.
       - name: Install cargo-c
-        run: cargo install cargo-c
+        env:
+          LINK: https://github.com/lu-zero/cargo-c/releases/latest/download
+          CARGO_C_FILE: cargo-c-windows-msvc.zip
+        run: |
+          curl -L "$env:LINK/$env:CARGO_C_FILE" -o cargo-c-windows-msvc.zip
+          powershell -Command "Expand-Archive -Path cargo-c-windows-msvc.zip -DestinationPath $env:USERPROFILE\\.cargo\\bin -Force"
 
       - name: Configure CMake
-        run: cmake -DCRYPTO_PROVIDER="${{ matrix.crypto }}" -DCERT_COMPRESSION="${{ matrix.cert_compression }}" -S . -B build
+        run: cmake -DCRYPTO_PROVIDER="${{ matrix.crypto }}" -DCERT_COMPRESSION="${{ matrix.cert_compression }}" -DDYN_LINK="${{ matrix.dyn_link }}" -S . -B build
 
       - name: Build
         run: cmake --build build --config "${{ matrix.config }}"

.github/workflows/test.yaml

@@ -215,6 +215,9 @@ Use `-DCERT_COMPRESSION=on` to enable certificate compression.
 
 Use `-DFIPS=on` to enable FIPS mode.
 
+Use `-DDYN_LINK=on` to dynamically link Rustls to the test programs instead of
+statically linking (the default).
+
 Use `cmake --build build --target integration_test` to build and run the
 client/server integration tests.
 

Makefile.pkg-config

@@ -20,6 +20,15 @@ option(
 
 option(FIPS "Whether to enable aws-lc-rs and FIPS support")
 
+option(DYN_LINK "Use dynamic linking for rustls library" OFF)
+
+if(DYN_LINK AND FIPS AND (APPLE OR WIN32))
+    message(
+        FATAL_ERROR
+        "Dynamic linking is not supported with FIPS on MacOS or Windows"
+    )
+endif()
+
 set(CARGO_FEATURES --no-default-features)
 if(CRYPTO_PROVIDER STREQUAL "aws-lc-rs")
     list(APPEND CARGO_FEATURES --features=aws-lc-rs)

README.md

@@ -32,6 +32,17 @@ else()
     set(sanitizer_flags "$<$<CONFIG:Debug>:-fsanitize=address>")
 endif()
 
+set(lib_extension "a") # Static linking (default) for both MacOS and Linux
+if(WIN32 AND DYN_LINK)
+    set(lib_extension "dll.lib") # Dynamic linking for Windows
+elseif(WIN32)
+    set(lib_extension "lib") # Static linking (default) for Windows
+elseif(APPLE AND DYN_LINK)
+    set(lib_extension "dylib") # Dynamic linking for MacOS
+elseif(UNIX AND DYN_LINK)
+    set(lib_extension "so") # Dynamic linking for Linux
+endif()
+
 function(test_binary target_name)
     add_executable(${target_name})
     target_sources(${target_name} PRIVATE ${target_name}.c common.c common.h)
@@ -46,10 +57,10 @@ function(test_binary target_name)
         target_compile_options(${target_name} PRIVATE ${sanitizer_flags})
         target_link_libraries(
             ${target_name}
-            debug
-            "${CMAKE_BINARY_DIR}/rust/lib/rustls.lib"
-            optimized
-            "${CMAKE_BINARY_DIR}/rust/lib/rustls.lib"
+            "${CMAKE_BINARY_DIR}/rust/lib/rustls.${lib_extension}"
+        )
+        target_link_libraries(
+            ${target_name}
             advapi32.lib
             bcrypt.lib
             crypt32.lib
@@ -80,10 +91,7 @@ function(test_binary target_name)
         target_link_options(${target_name} PRIVATE ${sanitizer_flags})
         target_link_libraries(
             ${target_name}
-            debug
-            "${CMAKE_BINARY_DIR}/rust/lib/librustls.a"
-            optimized
-            "${CMAKE_BINARY_DIR}/rust/lib/librustls.a"
+            "${CMAKE_BINARY_DIR}/rust/lib/librustls.${lib_extension}"
         )
         if(CERT_COMPRESSION)
             target_link_libraries(${target_name} m)