Add cell-aware cross-compilation arguments

checks/cell-aware-cross-inputs/Cargo.toml

@@ -0,0 +1,9 @@
+[package]
+name = "cell-aware-cross-inputs"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+openssl = "0.10"
+
+[workspace]

checks/cell-aware-cross-inputs/default.nix

@@ -0,0 +1,73 @@
+{ pkgs, flakeboxLib }:
+let
+  inherit (pkgs) lib;
+
+  crossPkgs = pkgs.pkgsCross.aarch64-multiplatform;
+  expectedPkgConfig = crossPkgs.pkgsBuildHost.pkg-config;
+  expectedOpenSsl = crossPkgs.pkgsHostTarget.openssl;
+  targetOpenSsl = lib.getLib expectedOpenSsl;
+  toolchains = lib.getAttrs [
+    "default"
+    "aarch64-linux"
+  ] (flakeboxLib.mkStdToolchains { });
+
+  outputs =
+    (flakeboxLib.craneMultiBuild {
+      inherit toolchains;
+      profiles = [ "release" ];
+      argsFor =
+        {
+          packages,
+          toolchainName,
+          ...
+        }:
+        lib.optionalAttrs (toolchainName == "aarch64-linux") (
+          assert toString packages.nativeBuildInputs.pkg-config == toString expectedPkgConfig;
+          assert toString packages.buildInputs.openssl == toString expectedOpenSsl;
+          {
+            buildInputs = [ packages.buildInputs.openssl ];
+            nativeBuildInputs = [ packages.nativeBuildInputs.pkg-config ];
+          }
+        );
+    })
+      (craneLib: {
+        package = craneLib.buildPackage {
+          pname = "cell-aware-cross-inputs";
+          version = "0.1.0";
+          src = craneLib.cleanCargoSource ./.;
+          strictDeps = true;
+        };
+      });
+
+  crossPackage = outputs.aarch64-linux.release.package;
+in
+pkgs.runCommand "cell-aware-cross-inputs-check"
+  {
+    nativeBuildInputs = [
+      pkgs.binutils
+      pkgs.file
+    ];
+  }
+  ''
+    binary=${crossPackage}/bin/cell-aware-cross-inputs
+    ${expectedPkgConfig}/bin/aarch64-unknown-linux-gnu-pkg-config --version > pkg-config-version.txt
+    file "$binary" > binary-file.txt
+    readelf -h "$binary" > binary-elf-header.txt
+    readelf -d "$binary" > binary-dynamic.txt
+
+    grep -Fq "ELF 64-bit LSB pie executable, ARM aarch64" binary-file.txt
+    grep -Eq "Machine:[[:space:]]+AArch64" binary-elf-header.txt
+    grep -Eq "Shared library: \\[libssl\\.so" binary-dynamic.txt
+    grep -F "(RUNPATH)" binary-dynamic.txt > binary-runpath.txt
+    grep -Fq "${targetOpenSsl}/lib" binary-runpath.txt
+
+    target_libssl=$(readlink -f ${targetOpenSsl}/lib/libssl.so)
+    file "$target_libssl" > dependency-file.txt
+    readelf -h "$target_libssl" > dependency-elf-header.txt
+
+    grep -Fq "ELF 64-bit LSB shared object, ARM aarch64" dependency-file.txt
+    grep -Eq "Machine:[[:space:]]+AArch64" dependency-elf-header.txt
+
+    mkdir "$out"
+    cp ./*.txt "$out/"
+  ''

checks/cell-aware-cross-inputs/src/main.rs

@@ -0,0 +1,5 @@
+use openssl::ssl::{SslConnector, SslMethod};
+
+fn main() {
+    let _connector = SslConnector::builder(SslMethod::tls()).unwrap().build();
+}

checks/crane-multi-build-eval-fixture.nix

@@ -0,0 +1,84 @@
+# `builtins.tryEval` discards error text, and pure Nix evaluation cannot expose
+# how often it forced a function. This minimal Crane-shaped adapter exists only
+# so the check can capture those two `craneMultiBuild` contracts from a nested
+# evaluator. All package-role and merge behavior uses the real Crane library in
+# `crane-multi-build-tests.nix`; do not reproduce it here.
+{
+  craneMultiBuildPath,
+  nixpkgsLibPath,
+  scenario,
+}:
+let
+  lib = import nixpkgsLibPath;
+
+  mkCraneLib = args: {
+    inherit args;
+    overrideArgs = newArgs: mkCraneLib (args // newArgs);
+    mapWithProfiles = outputsFn: profiles: lib.genAttrs profiles (_: outputsFn (mkCraneLib args));
+  };
+
+  baseToolchain = {
+    craneLib = mkCraneLib { };
+  };
+  unsupportedToolchain =
+    cellKind:
+    baseToolchain
+    // {
+      dependencyContext = {
+        packages.depsBuildBuild = { };
+        unavailablePackages.buildInputs = "this ${cellKind} cell has no truthful target Nixpkgs package universe";
+      };
+    };
+
+  craneMultiBuild = import craneMultiBuildPath {
+    craneMkLib = _: throw "unused craneMkLib";
+    mkStdToolchains = _: throw "unused mkStdToolchains";
+    inherit lib;
+    pkgs = { };
+  };
+
+  cell =
+    if scenario == "custom" then
+      "custom"
+    else if scenario == "wasm" then
+      "wasm32-unknown"
+    else
+      "aarch64-android";
+  cellToolchain =
+    if scenario == "custom" then
+      baseToolchain
+    else if scenario == "wasm" then
+      unsupportedToolchain "wasm32-unknown-unknown"
+    else
+      unsupportedToolchain "Android";
+
+  outputs =
+    (craneMultiBuild {
+      profiles = [
+        "dev"
+        "release"
+      ];
+      toolchains = {
+        default = baseToolchain;
+        ${if scenario == "scope" then "cross" else cell} =
+          if scenario == "scope" then baseToolchain else cellToolchain;
+      };
+      argsFor =
+        { toolchainName, packages, ... }:
+        if scenario == "scope" then
+          builtins.trace "argsFor invocation: ${toolchainName}" {
+            marker = toolchainName;
+          }
+        else
+          {
+            marker = packages.buildInputs.openssl;
+          };
+    })
+      (craneLib: {
+        probe = craneLib.args.marker;
+      });
+in
+if scenario == "scope" then
+  builtins.deepSeq outputs true
+else
+  builtins.seq outputs.${cell}.dev.probe true