feat: Statically link libiconv on aarch64-darwin; Test static binary in CI

[shivaraj-bh]

Note: macOS system libraries will not be statically linked

resolves #149

Before

❯ otool -L ./result/bin/om
./result/bin/om:
        /System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration (compatibility version 1.0.0, current version 1109.60.2)
        /System/Library/Frameworks/Security.framework/Versions/A/Security (compatibility version 1.0.0, current version 59754.60.13)
        /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit (compatibility version 1.0.0, current version 275.0.0)
        /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation (compatibility version 150.0.0, current version 1770.255.0)
        /nix/store/0rsh55ighfv3fxidf3xz8vl3abiika0i-libiconv-99/lib/libiconv.2.dylib (compatibility version 7.0.0, current version 7.0.0)
        /usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1292.60.1)

After

❯ otool -L ./result/bin/om
./result/bin/om:
        /System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration (compatibility version 1.0.0, current version 1109.60.2)
        /System/Library/Frameworks/Security.framework/Versions/A/Security (compatibility version 1.0.0, current version 59754.60.13)
        /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit (compatibility version 1.0.0, current version 275.0.0)
        /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation (compatibility version 150.0.0, current version 1770.255.0)
        /usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1292.60.1)

In After, libiconv is statically linked.

TODO:

• Use libiconv static on darwin, after meson: use _accumFlagsArray NixOS/nixpkgs#322497 reaches nixpkgs-unstable (Also see: Build failure: libiconv-darwin (static) NixOS/nixpkgs#320448 (comment))
• feat: Statically link libiconv on aarch64-darwin; Test static binary in CI #158 (comment)
  - [ ] Consider how Use flake-schemas #166 will impact this. (see feat: Statically link libiconv on aarch64-darwin; Test static binary in CI #158 (comment))

[shivaraj-bh]

macOS still has a dylib dependency on libiconv apart from system libraries (see TODO in the description for solution):

❯ otool -L ./result/bin/om
./result/bin/om:
        /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit (compatibility version 1.0.0, current version 275.0.0)
        /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation (compatibility version 150.0.0, current version 1770.255.0)
        /nix/store/0rsh55ighfv3fxidf3xz8vl3abiika0i-libiconv-99/lib/libiconv.2.dylib (compatibility version 7.0.0, current version 7.0.0)
        /usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1292.60.1)

[srid]

We should also test in Github Actions CI (public runner, not self-hosted) that the static binary runs (without Nix installed) on both platforms.

[srid]

We should also test in Github Actions CI (public runner, not self-hosted) that the static binary runs (without Nix installed) on both platforms.

Down the line, we may even re-use #160 tests to use the static binary rather than the cargo bin.

[srid]

• Consider how Use flake-schemas #166 will impact this.

Just added this to the todo list.

[shivaraj-bh]

• Consider how Use flake-schemas #166 will impact this.

Just added this to the todo list.

I guess it should be fine if we wrap static nix instead of the default one.

[srid]

There's also nix bundle but I don't know if it (or a variation of it) works on macOS.

[srid]

I think we should gets this PR into main anyway, without considering the nix-flake-schemas dependency:

[ ] Consider how Use flake-schemas #166 will impact this.

This PR will reduce the closure size of nix run ... when retrieved from cachix (#172), and omnix will continue to work as long as nix-flake-schemas is in the closure of omnix.

[srid]

@shivaraj-bh Let's get the Linux static binary part merged to main before we do the same for macOS. This will help with switching GitHub actions from nixci to om ci. Currently, it takes 3 minutes just to install omnix.

[shivaraj-bh]

[shivaraj-bh]

[srid]

@shivaraj-bh How should I test the binary on macOS? Currently getting:

[shivaraj-bh]

@shivaraj-bh How should I test the binary on macOS? Currently getting:

I would assume, just copying and running the binary (after providing execute permissions using chmod), like in CI.

[shivaraj-bh]

I believe it’s complete now. In another PR we should also look at releasing a tarball of these static binaries and provide a curl that users can use to download and run om.

[srid]

In another PR we should also look at releasing a tarball of these static binaries and provide a curl that users can use to download and run om.

Yup.

I would assume, just copying and running the binary (after providing execute permissions using chmod), like in CI.

That's what I did. Anyway, let's deal with it (the user-level usage instructions) in the aforementioned another PR.

[shivaraj-bh]

@shivaraj-bh How should I test the binary on macOS? Currently getting:

I was able to reproduce this. This happens when you download artifacts from a browser or any other app and try to run it. As in such a case Apple requires the binary to be notarized by them. But this is not a problem when you get the binary using curl.
You can try it:

curl -L \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-PAT-TOKEN>" \
  -H "X-GitHub-Api-Version: 2022-11-28" \
  https://api.github.com/repos/juspay/omnix/actions/artifacts/1780161532/zip --output om.zip
unzip om.zip
./om