feat(android): cross-build core libdb for aarch64-linux-android + CI gate

[gburd]

Can libdb be built for Android? Yes — the core library cross-builds clean.

This adds a working Android cross-build path and a CI workflow that gates it.

Answer

• GitHub CI: yes. .github/workflows/android.yml cross-compiles the core C
  library for aarch64-linux-android with the NDK's clang and asserts the
  artifact is an ARM aarch64 ELF. No emulator/device needed — it's a cross-BUILD
  test.
• EC2 / any Linux host: yes, identically. The NDK clang is a plain
  cross-compiler; ANDROID_NDK_ROOT=/path/to/ndk dist/android/build_android.sh
  works on any Linux (or macOS) host. No EC2 launch required — the CI job is the
  concrete deliverable; EC2 is the same command on a different box.

Approach (meson cross-file, not the stale Android.mk)

Rather than resurrect build_android/Android.mk (frozen at db-5.3.28, 2013,
and it builds the SQL adapter), this cross-compiles the core libdb via the
existing root meson.build:

• dist/android/build_android.sh derives the NDK clang paths from
  ANDROID_NDK_ROOT (as exported by nttld/setup-ndk / android-actions/setup-android;
  ANDROID_NDK_HOME/NDK fallbacks; nixpkgs ndk-bundle nesting handled),
  writes a meson cross-file, and runs meson setup --cross-file … && ninja.
• The NDK clang is just a cross-compiler. Meson's HAVE_* probes are all
  compile/link checks (which succeed cross) and sizeof/alignment resolve via
  compile-only probes — so no target execution and no db_config.h
  hand-patching are needed.

Portability gaps found: none

The core C library cross-builds clean against bionic with zero source
changes. Only the usual K&R-prototype -Wdeprecated-non-prototype warnings
(same on any modern compiler against this old codebase); no errors, no bionic
vs glibc header/symbol breakage in the core sources. No #if defined(__ANDROID__)
guards were required.

Evidence (local build, nixpkgs ndk-bundle, NDK r29, API 24)

$ ANDROID_NDK_ROOT=<ndk> dist/android/build_android.sh aarch64 24
[274/274] Linking target libdb.so
$ file build-android/libdb.so
build-android/libdb.so: ELF 64-bit LSB shared object, ARM aarch64, version 1
  (SYSV), dynamically linked, for Android 24, built by NDK r29 (14206865)
$ readelf -h … | grep Machine     ->  Machine: AArch64
102 exported db_* symbols.

CI workflow

.github/workflows/android.yml: schedule (weekly) + workflow_dispatch +
PRs touching src/** / meson.build / dist/android/**. Sets up the NDK
(nttld/setup-ndk@v1, r29), runs the cross-build, and asserts the artifact
is ELF 64-bit LSB shared object, ARM aarch64 (that assert step is a real red
signal). The job is continue-on-error (advisory tier — Android is not yet a
release target) and uploads libdb.so as an artifact. Modeled on
fuzz.yml/ci.yml.

Does not break the normal build

No source or meson.build changes — only a new script + workflow + two
.gitignore lines. Confirmed the native meson build still produces an x86-64
libdb.so (no-op for the normal Linux build).

Files

• dist/android/build_android.sh — cross-build driver (meson cross-file)
• .github/workflows/android.yml — CI gate
• .gitignore — ignore build-android/

[github-actions]

Coccinelle convention checks

No new violations. ✅

Resolved since baseline (2) -- update dist/cocci/baseline.txt to lock these in.

rule_mutex_unbalanced|MUTEX_UNBALANCED|src/crypto/mersenne/mt19937db.c|return (ret);
rule_mutex_unbalanced|MUTEX_UNBALANCED|src/mp/mp_register.c|return (ret);

[github-actions]

ABI diff vs v5.3.33 (libabigail — authoritative)

Removed exported symbols (nm -D, _NNNN version suffix normalized)

None.

---

Advisory: libabigail/nm is the authoritative binary-ABI check; Coccinelle is complementary source-level early warning. See dist/cocci/README.md.