This is an automated email from the ASF dual-hosted git repository.
jimjag pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/openoffice.git
The following commit(s) were added to refs/heads/trunk by this push:
new 7b0e10cf23 nss: set CPU_ARCH=aarch64 on Apple Silicon so freebl picks
64-bit HACL
7b0e10cf23 is described below
commit 7b0e10cf231204097c52931dd9077938d539c487
Author: Jim Jagielski <[email protected]>
AuthorDate: Thu Jun 11 17:07:28 2026 -0400
nss: set CPU_ARCH=aarch64 on Apple Silicon so freebl picks 64-bit HACL
The freebl crypto core fails to link libfreebl3.dylib on arm64:
Undefined symbols for architecture arm64:
"_Hacl_Poly1305_64_finish", referenced from: _Poly1305Do in
chacha20poly1305.o
"_Hacl_Poly1305_64_init", ... (and _mk_state/_update)
Two arch decisions disagree. chacha20poly1305.c selects the 64-bit Poly1305
API when (HAVE_INT128_SUPPORT && (NSS_X86_OR_X64 || __aarch64__));
__aarch64__
is a compiler macro always defined on arm64, so it calls Hacl_Poly1305_64_*.
But freebl's Makefile only *compiles* Hacl_Poly1305_64.c when
CPU_ARCH=aarch64,
and coreconf/Darwin.mk sets CPU_ARCH from 'uname -p', which on Apple Silicon
is 'arm' (not 'aarch64'). The 'arm' branch did nothing, so the 32-bit source
was built and the 64-bit references went unresolved.
Override CPU_ARCH=aarch64 in Darwin.mk's arm branch (added to
nss_macosx.patch).
This makes freebl build the 64-bit Hacl_Poly1305_64.c (and the faster
curve25519_64.c/Hacl_Curve25519.c), matching what the C code already
assumes.
No -arch flag is added: the build is native arm64.
Note this is a different token than the NSPR configure fix (f1b9c24444),
which
uses 'arm64' (Apple's -arch linker name); NSS coreconf/freebl use 'aarch64'.
The only CPU_ARCH==arm consumer in NSS is freebl/Makefile:239, which is
Linux-gated (32-bit ARM asm) and unreachable on Darwin, so the override is
safe.
Verified the full patch chain (nss.patch, nss_sizes.patch, nss_macosx.patch)
applies in order and yields CPU_ARCH=aarch64 -> Hacl_Poly1305_64.c selected.
---
main/nss/nss_macosx.patch | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git a/main/nss/nss_macosx.patch b/main/nss/nss_macosx.patch
index a6ccc1d011..15a2bac890 100644
--- a/main/nss/nss_macosx.patch
+++ b/main/nss/nss_macosx.patch
@@ -17,6 +17,24 @@ diff -ur misc/nss-3.39/nspr/configure
misc/build/nss-3.39/nspr/configure
;;
i*86*|x86_64)
if test -n "$USE_64"; then
+diff -ur misc/nss-3.39/nss/coreconf/Darwin.mk
misc/build/nss-3.39/nss/coreconf/Darwin.mk
+--- misc/nss-3.39/nss/coreconf/Darwin.mk 2018-08-31 05:55:53.000000000
-0700
++++ misc/build/nss-3.39/nss/coreconf/Darwin.mk 2020-10-06 07:51:49.590356560
-0700
+@@ -32,7 +32,13 @@
+ endif
+ else
+ ifeq (arm,$(CPU_ARCH))
+-# Nothing set for arm currently.
++# Apple Silicon: "uname -p" reports "arm", but NSS uses "aarch64" as its
++# 64-bit ARM token. freebl's Makefile selects the 64-bit HACL crypto
++# (e.g. Hacl_Poly1305_64.c) only for CPU_ARCH=aarch64, which also matches the
++# __aarch64__ macro the compiler defines and that chacha20poly1305.c keys on;
++# leaving it as "arm" builds the 32-bit sources and the 64-bit symbol refs go
++# unresolved. No -arch flag needed -- the build is native arm64.
++override CPU_ARCH = aarch64
+ else
+ OS_REL_CFLAGS = -Dppc
+ CC += -arch ppc
diff -ur misc/nss-3.39/nss/lib/sqlite/config.mk
misc/build/nss-3.39/nss/lib/sqlite/config.mk
--- misc/nss-3.39/nss/lib/sqlite/config.mk 2018-08-31 05:55:53.000000000
-0700
+++ misc/build/nss-3.39/nss/lib/sqlite/config.mk 2018-09-10
10:36:01.074375000 -0700
