NLnetLabs · wcawijngaards · Mar 5, 2020 · Mar 4, 2020
diff --git a/.travis.yml b/.travis.yml
@@ -1,5 +1,4 @@
 language: c
-sudo: false
 
 git:
   depth: 5
@@ -80,6 +79,48 @@ jobs:
       compiler: clang
       arch: s390x
       dist: bionic
+    - os: osx
+      osx_image: xcode10
+      name: Apple iPhone, OS X, Amd64
+      compiler: clang
+      env:
+        - TEST_IOS=yes
+        - AUTOTOOLS_HOST=armv7-apple-ios
+        - OPENSSL_HOST=ios-cross
+        - IOS_SDK=iPhoneOS
+        - IOS_CPU=armv7s
+        - IOS_PREFIX="$HOME/iPhoneOS-$IOS_CPU"
+    - os: osx
+      osx_image: xcode10
+      name: Apple iPad, OS X, Amd64
+      compiler: clang
+      env:
+        - TEST_IOS=yes
+        - AUTOTOOLS_HOST=aarch64-apple-ios
+        - OPENSSL_HOST=ios64-cross
+        - IOS_SDK=iPhoneOS
+        - IOS_CPU=arm64
+        - IOS_PREFIX="$HOME/iPhoneOS-$IOS_CPU"
+    - os: osx
+      osx_image: xcode10
+      name: Apple TV, OS X, Amd64
+      compiler: clang
+      env:
+        - TEST_IOS=yes
+        - AUTOTOOLS_HOST=aarch64-apple-ios
+        - OPENSSL_HOST=ios64-cross
+        - IOS_SDK=AppleTVOS
+        - IOS_PREFIX="$HOME/AppleTVOS"
+    - os: osx
+      osx_image: xcode10
+      name: Apple Watch, OS X, Amd64
+      compiler: clang
+      env:
+        - TEST_IOS=yes
+        - AUTOTOOLS_HOST=armv7-apple-ios
+        - OPENSSL_HOST=ios-cross
+        - IOS_SDK=WatchOS
+        - IOS_PREFIX="$HOME/WatchOS"
     - os: linux
       name: Android armv7a, Linux, Amd64
       compiler: clang
@@ -91,6 +132,7 @@ jobs:
         - OPENSSL_HOST=android-arm
         - ANDROID_CPU=armv7a
         - ANDROID_API=23
+        - ANDROID_PREFIX="$HOME/android$ANDROID_API-$ANDROID_CPU"
         - ANDROID_SDK_ROOT="$HOME/android-sdk"
         - ANDROID_NDK_ROOT="$HOME/android-ndk"
     - os: linux
@@ -104,6 +146,7 @@ jobs:
         - OPENSSL_HOST=android-arm64
         - ANDROID_CPU=aarch64
         - ANDROID_API=23
+        - ANDROID_PREFIX="$HOME/android$ANDROID_API-$ANDROID_CPU"
         - ANDROID_SDK_ROOT="$HOME/android-sdk"
         - ANDROID_NDK_ROOT="$HOME/android-ndk"
     - os: linux
@@ -117,6 +160,7 @@ jobs:
         - OPENSSL_HOST=android-x86
         - ANDROID_CPU=x86
         - ANDROID_API=23
+        - ANDROID_PREFIX="$HOME/android$ANDROID_API-$ANDROID_CPU"
         - ANDROID_SDK_ROOT="$HOME/android-sdk"
         - ANDROID_NDK_ROOT="$HOME/android-ndk"
     - os: linux
@@ -130,10 +174,15 @@ jobs:
         - OPENSSL_HOST=android-x86_64
         - ANDROID_CPU=x86_64
         - ANDROID_API=23
+        - ANDROID_PREFIX="$HOME/android$ANDROID_API-$ANDROID_CPU"
         - ANDROID_SDK_ROOT="$HOME/android-sdk"
         - ANDROID_NDK_ROOT="$HOME/android-ndk"
 
   allow_failures:
+    - os: osx
+      name: Apple TV, OS X, Amd64
+    - os: osx
+      name: Apple Watch, OS X, Amd64
     - os: linux
       arch: amd64
       name: Android armv7a, Linux, Amd64
@@ -162,18 +211,35 @@ script:
       ./configure
       make -j 2
       make test
+    elif [ "$TEST_IOS" = "yes" ]; then
+      export AUTOTOOLS_BUILD="$(./config.guess)"
+      export PKG_CONFIG_PATH="$IOS_PREFIX/lib/pkgconfig"
+      source ./contrib/ios/setenv_ios.sh
+      ./contrib/ios/install_tools.sh
+      ./contrib/ios/install_openssl.sh
+      ./contrib/ios/install_expat.sh
+      ./configure \
+        --build="$AUTOTOOLS_BUILD" --host="$AUTOTOOLS_HOST" \
+        --prefix="$IOS_PREFIX" \
+        --with-ssl="$IOS_PREFIX" --disable-gost \
+        --with-libexpat="$IOS_PREFIX";
+      make -j 2
+      make install
     elif [ "$TEST_ANDROID" = "yes" ]; then
       export AUTOTOOLS_BUILD="$(./config.guess)"
+      export PKG_CONFIG_PATH="$ANDROID_PREFIX/lib/pkgconfig"
       ./contrib/android/install_ndk.sh
-      source ./contrib/android/setenv_android.sh "$ANDROID_CPU"
+      source ./contrib/android/setenv_android.sh
+      ./contrib/android/install_tools.sh
       ./contrib/android/install_openssl.sh
       ./contrib/android/install_expat.sh
       ./configure \
         --build="$AUTOTOOLS_BUILD" --host="$AUTOTOOLS_HOST" \
-        --prefix="$ANDROID_SYSROOT" \
-        --with-ssl="$ANDROID_SYSROOT" --disable-gost \
-        --with-libexpat="$ANDROID_SYSROOT";
+        --prefix="$ANDROID_PREFIX" \
+        --with-ssl="$ANDROID_PREFIX" --disable-gost \
+        --with-libexpat="$ANDROID_PREFIX";
       make -j 2
+      make install
     elif [ "$TRAVIS_OS_NAME" = "osx" ]; then
       ./configure --enable-debug --disable-flto --with-ssl=/usr/local/opt/openssl/
       make -j 2

diff --git a/README-Travis.md b/README-Travis.md
@@ -1,8 +1,10 @@
 # Travis Testing
 
-Unbound 1.10 and above leverage Travis CI to increase coverage of compilers and platforms. Compilers include Clang and GCC; while platforms include Android, Linux, and OS X on AMD64, Aarch64, PowerPC and s390x hardware.
+Unbound 1.10 and above leverage Travis CI to increase coverage of compilers and platforms. Compilers include Clang and GCC; while platforms include Android, iOS, Linux, and OS X on AMD64, Aarch64, PowerPC and s390x hardware.
 
-Android is tested on armv7a, aarch64, x86 and x86_64. Mips and Mips64 is no longer supported under current NDKs. The Android recipes build and install OpenSSL and Expat, and then builds Unbound. The testing is tailored for Android NDK-r19 and above, and includes NDK-r20 and NDK-r21.
+Android is tested on armv7a, aarch64, x86 and x86_64. The Android recipes build and install OpenSSL and Expat, and then builds Unbound. The testing is tailored for Android NDK-r19 and above, and includes NDK-r20 and NDK-r21. Mips and Mips64 are not tested because they are no longer supported under current NDKs.
+
+iOS is tested for iPhoneOS, WatchOS and AppleTVOS. The testing uses Xcode 10.0 on OS X 10.13.
 
 The Unbound Travis configuration file `.travis.yml` does not use top-level keys like `os:` and `compiler:` so there is no matrix expansion. Instead Unbound specifies the exact job to run under the `jobs:` and `include:` keys.
 
@@ -52,15 +54,19 @@ When the Travis script encounters a sanitizer it uses different `CFLAGS` and con
 if [ "$TEST_UBSAN" = "yes" ]; then
   export CFLAGS="-DNDEBUG -g2 -O3 -fsanitize=undefined -fno-sanitize-recover"
   ./configure
+  make -j 2
+  make test
 elif [ "$TEST_ASAN" = "yes" ]; then
   export CFLAGS="-DNDEBUG -g2 -O3 -fsanitize=address"
   ./configure
+  make -j 2
+  make test
 ...
 ```
 
 ## Android builds
 
-Travis tests Android builds for the armv7a, aarch64, x86 and x86_64 architectures. The builds are trickier than other builds for several reasons. The testing requires installation of the Android NDK and SDK, it requires a cross-compile, and requires OpenSSL and Expat prerequisites. The Android cross-compiles also require care to set the Autotools triplet, the OpenSSL triplet, the toolchain path, the tool variables, and the sysroot. The steps below detail the pieces of the Android recipes.
+Travis tests Android builds for the armv7a, aarch64, x86 and x86_64 architectures. The builds are trickier than other builds for several reasons. The testing requires installation of the Android NDK and SDK, it requires a cross-compile, and requires OpenSSL and Expat prerequisites. The Android cross-compiles also require care to set the Autotools triplet, the OpenSSL triplet, the toolchain path, the tool variables, and the sysroot. The discussion below detail the steps of the Android recipes.
 
 ### ANDROID_NDK_ROOT
 
@@ -115,52 +121,136 @@ armv8a|aarch64|arm64|arm64-v8a)
   CXXFLAGS="-funwind-tables -fexceptions -frtti"
 ```
 
+### Tool installation
+
+The fourth step installs tools needed for OpenSSL, Expat and Unbound. This step is handled in by the script `contrib/android/install_tools.sh`. The tools include curl, tar, zip, unzip and java.
+
+If you are working from a developer machine you probably already have the necessary tools installed.
+
 ### OpenSSL and Expat
 
-OpenSSL and Expat are built for Android using the scripts `contrib/android/install_openssl.sh` and `contrib/android/install_expat.sh`. The scripts download, configure and install the latest release version of the libraries. The libraries are configured with `--prefix="$ANDROID_SYSROOT"` so the output artifacts are placed in the sysroot `$ANDROID_SYSROOT/usr/lib` directory. (Also see *Developer Workstation* section below).
+The fifth step builds OpenSSL and Expat. OpenSSL and Expat are built for Android using the scripts `contrib/android/install_openssl.sh` and `contrib/android/install_expat.sh`. The scripts download, configure and install the latest release version of the libraries. The libraries are configured with `--prefix="$ANDROID_PREFIX"` so the headers are placed in `$ANDROID_PREFIX/include` directory, and the libraries are placed in the `$ANDROID_PREFIX/lib` directory.
+
+`ANDROID_PREFIX` is the value `$HOME/android$ANDROID_API-$ANDROID_CPU`. The libraries will be installed in `$HOME/android23-armv7a`, `$HOME/android23-aarch64`, etc. For Autotools projects, the appropriate `PKG_CONFIG_PATH` is exported. A typical `PKG_CONFIG_PATH` is `$HOME/android23-armv7a/lib/pkgconfig`.
 
-OpenSSL also uses a custom configuration file called `15-android.conf`. It is a copy of the OpenSSL's project file and located at `contrib/android/15-android.conf`. The Unbound version is copied to the OpenSSL source files after unpacking the OpenSSL distribution. The Unbound version has legacy NDK support removed and some other fixes, like `ANDROID_NDK_ROOT` awareness. The changes mean Unbound's `15-android.conf` will only work with Unbound and with NDK-r19 and above.
+OpenSSL also uses a custom configuration file called `15-android.conf`. It is a copy of the OpenSSL's project file and located at `contrib/android/15-android.conf`. The Unbound version is copied to the OpenSSL source files after unpacking the OpenSSL distribution. The Unbound version has legacy NDK support removed and some other fixes, like `ANDROID_NDK_ROOT` awareness. The changes mean Unbound's `15-android.conf` will only work with Unbound, with NDK-r19 and above, and a properly set environment.
 
 OpenSSL is configured with `no-engine`. If you want to include OpenSSL engines then edit `contrib/android/install_openssl.sh` and remove the config option.
 
 ### Android build
 
-Once all the variables are set and OpenSSL and Expat are built, then the Travis script configures and builds Unbound. The recipe looks as follows.
+Finally, once OpenSSL and Expat are built, then the Travis script configures and builds Unbound. The recipe looks as follows.
 
 ```
 elif [ "$TEST_ANDROID" = "yes" ]; then
   export AUTOTOOLS_BUILD="$(./config.guess)"
+  export PKG_CONFIG_PATH="$ANDROID_PREFIX/lib/pkgconfig"
   ./contrib/android/install_ndk.sh
-  source ./contrib/android/setenv_android.sh "$ANDROID_CPU"
+  source ./contrib/android/setenv_android.sh
+  ./contrib/android/install_tools.sh
   ./contrib/android/install_openssl.sh
   ./contrib/android/install_expat.sh
   ./configure \
     --build="$AUTOTOOLS_BUILD" --host="$AUTOTOOLS_HOST" \
-    --prefix="$ANDROID_SYSROOT" \
-    --with-ssl="$ANDROID_SYSROOT" --disable-gost \
-    --with-libexpat="$ANDROID_SYSROOT";
+    --prefix="$ANDROID_PREFIX" \
+    --with-ssl="$ANDROID_PREFIX" --disable-gost \
+    --with-libexpat="$ANDROID_PREFIX";
   make -j 2
+  make install
 ```
 
 Travis only smoke tests an Android build using a compile and link. The self tests are not run. TODO: figure out how to fire up an emulator, push the tests to the device and run them.
 
-Note the `--prefix="$ANDROID_SYSROOT"` used by OpenSSL, Expat and Unbound. This is a hack that makes it easy to find libraries and headers because `CFLAGS` and `CXXFLAGS` already use `--sysroot="$ANDROID_SYSROOT"`. By performing a `make install` and installing into `$ANDROID_SYSROOT`, all the libraries needed by Unbound are present without extra flags or searching. (Also see *Developer Workstation* section below).
-
 ### Android flags
 
-`contrib/android/setenv_android.sh` uses specific flags for `CFLAGS` and `CXXFLAGS`. The flags are not arbitrary, and they are taken from the `ndk-build` tool. It is important to use the same flags across projects to avoid subtle problems due to mixing and matching different flags.
+`contrib/android/setenv_android.sh` uses specific flags for `CFLAGS` and `CXXFLAGS`. They are taken from `ndk-build`, so we consider them the official flag set. It is important to use the same flags across projects to avoid subtle problems due to mixing and matching different flags.
 
-`CXXFLAGS` includes `-fexceptions` and `-frtti` because exceptions and runtime type info are disabled by default. `CFLAGS` include `-funwind-tables` and `-fexceptions` to ensure C++ exceptions pass through C code, if needed. Also see `docs/CPLUSPLUS—SUPPORT.html` in the NDK docs.
+`CXXFLAGS` includes `-fexceptions` and `-frtti` because exceptions and runtime type info are disabled by default. `CFLAGS` include `-funwind-tables` and `-fexceptions` to ensure C++ exceptions pass through C code, if needed. Also see `docs/CPLUSPLUS-SUPPORT.html` in the NDK docs.
 
 To inspect the flags used by `ndk-build` for a platform clone ASOP's [ndk-samples](https://github.com/android/ndk-samples/tree/master/hello-jni) and build the `hello-jni` project. Use the `V=1` flag to see the full compiler output from `ndk-build`.
 
-### Developer workstation
+## iOS builds
+
+Travis tests iOS builds for the armv7a. armv7s and aarch64 architectures for iPhoneOS, iPhoneOS, AppleTV and WatchOS.iPhone OS is tested using both 32-bit builds (iPhones) and 64-bit builds (iPads). The builds are trickier than other builds for several reasons. The testing requires a cross-compile, and requires OpenSSL and Expat prerequisites. The iOS cross-compiles also require care to set the Autotools triplet, the OpenSSL triplet, the toolchain path, the tool variables, and the sysroot. The discussion below detail the steps of the iOS recipes.
+
+### iOS environment
+
+The first step sets the iOS cross-compile environment using the script `contrib/ios/setenv_ios.sh`. The script is `sourced` so the variables in the script are available to the calling shell. The script sets variables like `CC`, `CXX`, `AS` and `AR`; sets `CFLAGS` and `CXXFLAGS`; sets a `sysroot` so iOS headers and libraries are found; and adds the path to the toolchain to `PATH`.
+
+`contrib/ios/setenv_ios.sh` knows which toolchain and architecture to select by inspecting environmental variables set by Travis for the job. In particular, the variables `IOS_SDK` and `IOS_CPU` tell `contrib/ios/setenv_ios.sh` what tools and libraries to select. For example, below is part of the Aarch64 recipe.
+
+```
+os: osx
+osx_image: xcode10
+name: Apple iPhone, OS X, Amd64
+compiler: clang
+env:
+  - TEST_IOS=yes
+  - AUTOTOOLS_HOST=armv7-apple-ios
+  - OPENSSL_HOST=ios-cross
+  - IOS_SDK=iPhoneOS
+  - IOS_CPU=armv7s
+```
+
+The `contrib/ios/setenv_ios.sh` script specifies the tools in a `case` statement like the following. There is a case for each of the architectures armv7a, aarch64, x86 and x86_64.
+
+```
+iphone|iphoneos)
+  CPP="cpp"
+  CC="clang"
+  CXX="clang++"
+  LD="ld"
+  AS="as"
+  AR="ar"
+  RANLIB="ranlib"
+  STRIP="strip"
+
+  # Default armv7. Also allowed armv7a, armv7s, arm64
+  if [ -z "$IOS_CPU" ]; then IOS_CPU=armv7; fi
+
+  CFLAGS="-arch $IOS_CPU -mios-version-min=6"
+  CXXFLAGS="-arch $IOS_CPU -stdlib=libc++ -mios-version-min=6"
+```
+
+### Tool installation
+
+The second step installs tools needed for OpenSSL, Expat and Unbound. This step is handled in by the script `contrib/ios/install_tools.sh`. The tools include autotools, curl and perl.
+
+If you are working from a developer machine you probably already have the necessary tools installed.
+
+### OpenSSL and Expat
+
+The third step builds OpenSSL and Expat. OpenSSL and Expat are built for iOS using the scripts `contrib/ios/install_openssl.sh` and `contrib/ios/install_expat.sh`. The scripts download, configure and install the latest release version of the libraries. The libraries are configured with `--prefix="$IOS_PREFIX"` so the headers are placed in `$IOS_PREFIX/include` directory, and the libraries are placed in the `$IOS_PREFIX/lib` directory.
+
+`IOS_PREFIX` is the value `$HOME/iPhoneOS-$IOS_CPU`, `$HOME/AppleTVOS` or `$HOME/WatchOS`. So the libraries will be installed in `$HOME/iPhoneOS-armv7s`, `$HOME/iPhoneOS-arm64`, etc. For Autotools projects, the appropriate `PKG_CONFIG_PATH` is exported. A typical `PKG_CONFIG_PATH` is `$HOME/iPhoneOS-armv7s/lib/pkgconfig`.
+
+OpenSSL also uses a custom configuration file called `15-ios.conf`. It is a copy of the OpenSSL's project file and located at `contrib/ios/15-ios.conf`. The Unbound version is copied to the OpenSSL source files after unpacking the OpenSSL distribution. The changes mean Unbound's `15-ios.conf` will only work with Unbound and a properly set environment.
+
+OpenSSL is configured with `no-engine`. Engines require dynamic loading so engines are disabled permanently in the script.
+
+### iOS build
+
+Finally, once OpenSSL and Expat are built, then the Travis script configures and builds Unbound. The recipe looks as follows.
+
+```
+elif [ "$TEST_IOS" = "yes" ]; then
+  export AUTOTOOLS_BUILD="$(./config.guess)"
+  export PKG_CONFIG_PATH="$IOS_PREFIX/lib/pkgconfig"
+  source ./contrib/ios/setenv_ios.sh
+  ./contrib/ios/install_tools.sh
+  ./contrib/ios/install_openssl.sh
+  ./contrib/ios/install_expat.sh
+  ./configure \
+    --build="$AUTOTOOLS_BUILD" --host="$AUTOTOOLS_HOST" \
+    --prefix="$IOS_PREFIX" \
+    --with-ssl="$IOS_PREFIX" --disable-gost \
+    --with-libexpat="$IOS_PREFIX";
+  make -j 2
+  make install
+```
 
-If you are setting up a developer workstation then `--prefix="$ANDROID_SYSROOT"` trick will not work. It will not work on a workstation because a previous install gets overwritten by the next install in `$ANDROID_SYSROOT/usr/lib`. In practice OpenSSL and Expat need to be installed in an architecture specific location. The sysroot-based locations are listed below.
+Travis only smoke tests an iOS build using a compile and link. The self tests are not run. TODO: figure out how to fire up an simulator, push the tests to the device and run them.
 
-* `$ANDROID_SYSROOT/usr/lib/aarch64-linux-android/`
-* `$ANDROID_SYSROOT/usr/lib/arm-linux-androideabi/`
-* `$ANDROID_SYSROOT/usr/lib/i686-linux-android/`
-* `$ANDROID_SYSROOT/usr/lib/x86_64-linux-android/`
+### iOS flags
 
-A second concern is the OpenSSL header files. At least two different defines are used in the OpenSSL headers based on the architecture. The first pair of defines are `RC4_CHAR` and `RC4_INT`. The second pair of defines are `SIXTY_FOUR_BIT_LONG` and `BN_LLONG`. As with libraries, a previous install gets overwritten by the next install in `$ANDROID_SYSROOT/usr/include`. To work around the problem see [Build Multiarch OpenSSL on OS X](https://stackoverflow.com/q/25530429) on Stack Overflow. Though it is a MacOS question, the same applies to Android in this situation.
+`contrib/ios/setenv_ios.sh` uses specific flags for `CFLAGS` and `CXXFLAGS`. They are taken from Xcode, so we consider them the official flag set. It is important to use the same flags across projects to avoid subtle problems due to mixing and matching different flags.
diff --git a/contrib/android/install_expat.sh b/contrib/android/install_expat.sh
@@ -1,9 +1,5 @@
 #!/usr/bin/env bash
 
-# install android deps
-sudo apt-get -qq update
-sudo apt-get -qq install --no-install-recommends curl tar
-
 echo "Downloading Expat"
 if ! curl -L -k -s -o expat-2.2.9.tar.gz https://github.com/libexpat/libexpat/releases/download/R_2_2_9/expat-2.2.9.tar.gz;
 then
@@ -22,13 +18,13 @@ fi
 cd expat-2.2.9 || exit 1
 
 echo "Configuring Expat"
-if ! ./configure --build="$AUTOTOOLS_BUILD" --host="$AUTOTOOLS_HOST" --prefix="$ANDROID_SYSROOT"; then
+if ! ./configure --build="$AUTOTOOLS_BUILD" --host="$AUTOTOOLS_HOST" --prefix="$ANDROID_PREFIX"; then
     echo "Error: Failed to configure Expat"
     exit 1
 fi
 
 # Cleanup warnings, https://github.com/libexpat/libexpat/issues/383
-echo "Fixing Makefiles..."
+echo "Fixing Makefiles"
 (IFS="" find "$PWD" -name 'Makefile' -print | while read -r file
 do
     cp -p "$file" "$file.fixed"

diff --git a/contrib/android/install_ndk.sh b/contrib/android/install_ndk.sh
@@ -1,9 +1,5 @@
 #!/usr/bin/env bash
 
-# install android deps
-sudo apt-get -qq update
-sudo apt-get -qq install --no-install-recommends curl openjdk-8-jdk zip unzip
-
 if [ -z "$ANDROID_SDK_ROOT" ]; then
     echo "ERROR: ANDROID_SDK_ROOT is not a valid path. Please set it."
     echo "SDK root is $ANDROID_SDK_ROOT"