Merge pull request #548 from roc-lang/feat/linker-inputs

Publish independently built linker inputs

Author: lukewilliamboswell

.github/workflows/linker-inputs.yml

@@ -0,0 +1,66 @@
+name: Linker inputs
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - '.github/workflows/linker-inputs.yml'
+      - 'native/linker-inputs/**'
+      - 'native/windows/**'
+      - 'scripts/linker_inputs.py'
+      - 'scripts/windows_runtime.py'
+      - 'scripts/test_linker_inputs.py'
+permissions: {}
+jobs:
+  build:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - {target: x64musl, os: ubuntu-24.04}
+          - {target: arm64musl, os: ubuntu-24.04-arm}
+          - {target: x64win, os: windows-2025}
+    runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v6
+        with:
+          python-version: '3.12'
+      - uses: mlugg/setup-zig@8d6198c65fb0feaa111df26e6b467fea8345e46f
+        with:
+          version: 0.17.0
+      - name: Test artifact verification and caching
+        run: python -m unittest scripts/test_linker_inputs.py
+      - name: Build runtime inputs
+        run: python scripts/linker_inputs.py build --target ${{ matrix.target }} --directory dist/linker-inputs
+      - uses: actions/upload-artifact@v7
+        with:
+          name: linker-inputs-${{ matrix.target }}
+          path: dist/linker-inputs/*
+          if-no-files-found: error
+  publish:
+    needs: build
+    if: github.event_name == 'workflow_dispatch' && github.ref_name == github.event.repository.default_branch
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/download-artifact@v8
+        with:
+          pattern: linker-inputs-*
+          merge-multiple: true
+          path: dist/linker-inputs
+      - name: Verify and publish immutable runtime release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          tag=$(python3 scripts/linker_inputs.py manifest --directory dist/linker-inputs --repository "$GITHUB_REPOSITORY")
+          if gh release view "$tag" >/dev/null 2>&1; then
+            mkdir -p target/published-inputs
+            gh release download "$tag" --dir target/published-inputs
+            diff -r dist/linker-inputs target/published-inputs
+          else
+            gh release create "$tag" dist/linker-inputs/* --target "$GITHUB_SHA" --prerelease --latest=false --title "Linker inputs ${tag#linker-inputs-}" --notes "Independently built native runtime inputs. Consumers pin the attached manifest and archive SHA-256 hashes."
+          fi

native/linker-inputs/README.md

@@ -0,0 +1,27 @@
+# Linker inputs
+
+The Linker inputs workflow builds runtime archives independently of the Rust
+host. Run it manually on the default branch to publish a content-addressed
+prerelease. The attached `linker-inputs.lock.json` pins each target archive by
+URL, SHA-256, and size. Platform builds will consume that lock after migration.
+
+The producer pins musl 1.2.6's source archive and Zig 0.17.0's libunwind source
+tree. Linux libraries are PIC and use baseline CPUs. The recorded musl change
+allows an absent dynamic section in `rcrt1.o`, supporting fixed-address static
+executables as well as static PIE. Native producer checks exercise both forms,
+including stored function pointers, thread-local data, and threads.
+
+Windows uses the existing source-verified startup and import-library producer.
+Its native check exercises initializer tables, TLS, security cookies, and
+MSVC type-info support. Source hashes and original licenses accompany each
+archive. Rust host libraries are built by the platform consumer workflows.
+
+For local production, use Python 3.12, Zig 0.17.0, and GNU make. Linux native
+checks also use the platform GNU linker and readelf. For example,
+
+```sh
+python3 scripts/linker_inputs.py build --target x64musl --directory dist/linker-inputs
+```
+
+Publication requires each target to have passed validation on its native OS and
+architecture. The workflow publishes only after all three producers succeed.

native/linker-inputs/recipe.json

@@ -0,0 +1,18 @@
+{
+  "format_version": 1,
+  "zig_version": "0.17.0",
+  "musl": {
+    "version": "1.2.6",
+    "url": "https://musl.libc.org/releases/musl-1.2.6.tar.gz",
+    "sha256": "d585fd3b613c66151fc3249e8ed44f77020cb5e6c1e635a616d3f9f82460512a"
+  },
+  "unwind": {
+    "source": "Zig 0.17.0 bundled LLVM libunwind",
+    "tree_sha256": "672d3a4e64506cbe64b50742748afba1a84ac8090ba90419202214012fe8e8b6"
+  },
+  "targets": {
+    "x64musl": "x86_64-linux-musl",
+    "arm64musl": "aarch64-linux-musl",
+    "x64win": "x86_64-windows-msvc"
+  }
+}

native/linker-inputs/startup.c

@@ -0,0 +1,19 @@
+#include <pthread.h>
+#include <stdio.h>
+static const char *text(void) { return "startup passed"; }
+static const char *(*volatile callback)(void) = text;
+static _Thread_local int value = 42;
+static void *worker(void *unused) {
+    (void)unused;
+    if (value != 42) return (void *)1;
+    value = 99;
+    return 0;
+}
+int main(void) {
+    pthread_t thread;
+    void *result;
+    if (pthread_create(&thread, 0, worker, 0) || pthread_join(thread, &result)) return 1;
+    if (result || value != 42) return 2;
+    puts(callback());
+    return 0;
+}

native/linker-inputs/unwind.cpp

@@ -0,0 +1,16 @@
+// Exercise exception handling and destructor execution in the producer toolchain.
+#include <stdio.h>
+static int destroyed;
+struct Cleanup { ~Cleanup() { destroyed = 1; } };
+int main() {
+    try {
+        Cleanup cleanup;
+        throw 42;
+    } catch (int value) {
+        if (value == 42 && destroyed) {
+            puts("unwind passed");
+            return 0;
+        }
+    }
+    return 1;
+}