1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
|
#!/bin/sh
# Build the rsh SSH transport for each Android ABI as a Bionic PIE executable
# named lib*.so (packaged inside the APK and exec'd from nativeLibraryDir),
# using the Android NDK. Also build a plain host binary for tests and manual
# debugging.
#
# Android needs PIE and the Bionic dynamic linker (/system/bin/linker64), so
# the on-device build is GOOS=android with cgo and the NDK clang. A GOOS=linux
# build targets glibc's linker and will not exec on a phone.
set -eu
root=$(CDPATH='' cd -- "$(dirname -- "$0")/.." && pwd)
# shellcheck source=versions
. "$root/versions"
command -v bash >/dev/null 2>&1 || {
echo "rsh: bash is required by the Android NDK compiler launchers" >&2
exit 1
}
# Locate the NDK toolchain.
ndk=${ANDROID_NDK_HOME:-${ANDROID_NDK_ROOT:-}}
if [ -z "$ndk" ] && [ -n "${ANDROID_HOME:-}" ]; then
ndk="$ANDROID_HOME/ndk/$ANDROID_NDK"
fi
if [ -z "$ndk" ] || [ ! -d "$ndk" ]; then
echo "rsh: Android NDK not found; set ANDROID_NDK_HOME" >&2
exit 1
fi
# NDK prebuilt toolchains are named by build host, not target. Pick the tag
# matching this machine (macOS ships an x86_64 clang that runs under Rosetta on
# Apple Silicon); the target ABI is selected separately below.
case "$(uname -s)" in
Linux) host_tag=linux-x86_64 ;;
Darwin) host_tag=darwin-x86_64 ;;
*) echo "rsh: unsupported build host $(uname -s)" >&2; exit 1 ;;
esac
tc="$ndk/toolchains/llvm/prebuilt/$host_tag/bin"
if [ ! -d "$tc" ]; then
echo "rsh: NDK toolchain not found at $tc" >&2
exit 1
fi
output=
trap 'if [ -n "$output" ]; then rm -f "$output"; fi' 0 1 2 3 15
# -buildvcs=false as well as -trimpath: Go otherwise stamps the commit, the
# commit time and a dirty flag into the binary, so the same source builds
# differently depending on the checkout it was built from, or on whether git is
# even installed. ci/verify-repro.sh cannot catch that, because it builds twice
# from one tree.
ldflags="-s -w -buildid="
# NDK r27 needs both page-size flags for 16 KB Android devices.
android_ldflags="$ldflags -extldflags=-Wl,-z,relro,-z,now,-z,noexecstack,-z,max-page-size=16384,-z,common-page-size=16384"
cd "$root/rsh"
for abi in $ABIS; do
case "$abi" in
arm64-v8a) goarch=arm64 goarm='' cc="aarch64-linux-android${ANDROID_MIN_SDK}-clang" ;;
armeabi-v7a) goarch=arm goarm=7 cc="armv7a-linux-androideabi${ANDROID_MIN_SDK}-clang" ;;
x86_64) goarch=amd64 goarm='' cc="x86_64-linux-android${ANDROID_MIN_SDK}-clang" ;;
x86) goarch=386 goarm='' cc="i686-linux-android${ANDROID_MIN_SDK}-clang" ;;
*) echo "rsh: unknown ABI $abi" >&2; exit 1 ;;
esac
dest="$root/app/src/main/jniLibs/$abi"
mkdir -p "$dest"
echo "rsh: building $abi (android/$goarch)"
output="$dest/libxrsh.so.part.$$"
CGO_ENABLED=1 GOOS=android GOARCH="$goarch" GOARM="$goarm" \
CC="$tc/$cc" GOFLAGS=-trimpath \
CGO_CFLAGS="-fstack-protector-strong -D_FORTIFY_SOURCE=2 -ffile-prefix-map=$root=." \
go build -buildvcs=false -buildmode=pie -ldflags "$android_ldflags" -o "$output" .
mv "$output" "$dest/libxrsh.so"
output=
done
# Host binary (no NDK, cgo off) for tests and manual debugging.
mkdir -p "$root/out"
echo "rsh: building host binary -> out/rsh"
output="$root/out/rsh.part.$$"
CGO_ENABLED=0 GOFLAGS=-trimpath go build -buildvcs=false -ldflags "$ldflags" -o "$output" .
mv "$output" "$root/out/rsh"
output=
|