Skip to content

ci: add Android cross-compile workflow (aarch64, both backends) - #2474

Merged
ni4 merged 6 commits into
mainfrom
add-android-cross-compile
Sep 1, 2026
Merged

ci: add Android cross-compile workflow (aarch64, both backends)#2474
ni4 merged 6 commits into
mainfrom
add-android-cross-compile

Conversation

@ronaldtse

Copy link
Copy Markdown
Contributor

Summary

Adds aarch64-linux-android cross-compile smoke tests for both the Botan and OpenSSL backends, preventing the class of bug fixed in #2473 (missing CMAKE_DL_LIBS on Android cross-compile with static OpenSSL).

Why both this and the existing OHOS workflow?

OHOS (#2438) Android (this PR)
Backend coverage Botan only Botan + OpenSSL
Emulator none (build-only) qemu-aarch64-static (runs the probe)
SDK access geo-restricted (needs mirror) freely downloadable
libc musl bionic
json-c needed (pre-#2439) not needed (nlohmann)

The CMAKE_CROSSCOMPILING_EMULATOR flag is the critical piece: it triggers the -static build of the findopensslfeatures probe and executes it under qemu, catching linkage gaps that a build-only check misses.

What it catches

Without this workflow, the #2473 bug (static libcrypto.adso_dlfcn.odlopen undefined on bare sysroots) was invisible to CI. With it:

  • The OpenSSL probe builds with -static → fails to link if CMAKE_DL_LIBS is missing
  • The Botan leg covers the standard cross-compile path independently

Design

  • NDK r29 via nttld/setup-ndk@v1 (no geo-restriction)
  • qemu-user-static from Ubuntu repos (no manual setup)
  • OpenSSL 1.1.1n / Botan 3.13.0 cross-built statically (cached per backend)
  • Standard android.toolchain.cmake with ANDROID_ABI=arm64-v8a, ANDROID_PLATFORM=android-24
  • Architecture verification + artifact upload per backend

CI-only change (new workflow file, no code changes).

Closes the CI coverage gap that allowed #2473 to reach users.

Adds aarch64-linux-android cross-compile smoke tests for both the
Botan and OpenSSL backends, mirroring the OHOS workflow (#2438) but
with key additions:

- Tests the OpenSSL backend, which the OHOS workflow does not cover;
  this is where the CMAKE_DL_LIBS linkage gap (#2473) manifested
- Sets CMAKE_CROSSCOMPILING_EMULATOR=qemu-aarch64-static so the
  findopensslfeatures probe actually runs under emulation, catching
  the '-static' + dlopen linkage class of bugs
- Post-nlohmann (#2439): no json-c dependency to cross-build
- No SDK geo-restriction (unlike OHOS): the NDK downloads freely

The NDK toolchain file, qemu-user-static, and cacheable dependency
builds keep the workflow simple. Each backend is a separate matrix
leg so a failure in one doesn't mask the other.
@codecov

codecov Bot commented Aug 31, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.46%. Comparing base (ce33cc6) to head (b43b79d).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #2474      +/-   ##
==========================================
- Coverage   85.46%   85.46%   -0.01%     
==========================================
  Files         125      125              
  Lines       22964    22962       -2     
==========================================
- Hits        19627    19625       -2     
  Misses       3337     3337              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

The piped curl|tar failed on redirects: botan.randombit.net and
openssl.org redirect to CDN URLs that don't stream cleanly through
the pipe, leaving tar with an HTML error page instead of the archive.
The version strings are defined in the matrix include block, not as
job-level environment variables; env.botan_version resolved to empty,
making the download URLs 404.
FindBotan couldn't locate the cross-built library because the Android
toolchain restricts find_library to the sysroot via
CMAKE_FIND_ROOT_PATH_MODE_LIBRARY ONLY; adding the dependency prefix
to CMAKE_FIND_ROOT_PATH lets it search there.

OpenSSL 1.1.1's Configure expects the old-style NDK gcc wrapper names;
exporting CC/AR/RANLIB pointing at the modern clang toolchain and
prepending it to PATH makes the android-arm64 target find its
compiler.
…figure

Cross toolchain files (e.g. Android NDK) restrict find_path/find_library
to the sysroot and CMAKE_FIND_ROOT_PATH, so the nested configure failed
to rediscover the cross-built OpenSSL (missing OPENSSL_INCLUDE_DIR /
OPENSSL_CRYPTO_LIBRARY) even when the parent find_package succeeded.
…nfigure

The NDK toolchain file derives the target ABI and API level from these
cache variables, not the environment; without them the nested configure
silently built the probe for the default 32-bit ARM ABI and failed to
link against the cross-built arm64 libcrypto.a.
@ronaldtse

Copy link
Copy Markdown
Contributor Author

@ni4 All checks are green now (only the fleet-wide known fuzzing/fuzzers-openssl exception remains). Could you take a look when you have a moment?

Two notes for review:

  • FindOpenSSLFeatures.cmake needed to forward CMAKE_FIND_ROOT_PATH, ANDROID_ABI and ANDROID_PLATFORM to its nested configure -- without them the NDK toolchain either can't rediscover the cross-built OpenSSL (find_* restricted to sysroot) or silently targets 32-bit ARM. Same cross-compile bug class as cmake: link CMAKE_DL_LIBS into the static findopensslfeatures probe #2473, so it's a genuine build-system fix, not just CI plumbing.
  • The workflow itself cross-builds Botan 3.13 / OpenSSL 1.1.1 for arm64 and smoke-tests via qemu-aarch64-static + CMAKE_CROSSCOMPILING_EMULATOR, with an ELF-arch check on the produced librnp.a.

@ronaldtse
ronaldtse requested a review from ni4 August 31, 2026 18:43

@ni4 ni4 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@ni4
ni4 merged commit bd738ac into main Sep 1, 2026
159 of 166 checks passed
@ni4

ni4 commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

Merged with single approval as CI only.

@ronaldtse

Copy link
Copy Markdown
Contributor Author

Follow-up note now that this has landed: this workflow exists thanks to @jolavillette's report and fix in #2473 (itself a follow-up to #2396, the original cross-compilation work by @G10h4ck). His Android NDK build failure showed we had no CI coverage for Android cross-compilation at all - so beyond merging his one-line CMAKE_DL_LIBS fix, we added this leg to keep aarch64-linux-android (both the Botan and OpenSSL backends, smoke-tested via qemu) permanently green. It immediately paid off by surfacing two more FindOpenSSLFeatures cross-compile bugs (the nested configure not inheriting CMAKE_FIND_ROOT_PATH, and silently targeting 32-bit ARM without ANDROID_ABI), which are fixed here as well.

@jolavillette - thank you for the careful report and the correct fix; Android is now a first-class CI platform for rnp because of it. If you hit anything else on the RetroShare Android toolchain side, please do report back.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants