From 25a757da3ee35b343d6c0cf5a9cd98c5b9527485 Mon Sep 17 00:00:00 2001 From: Ryan Macnak Date: Wed, 20 May 2026 11:33:39 -0700 Subject: [PATCH] Reland "[build] Generate AOT snapshots in the SDK as dylibs on Mac." Also apply code signing like we do for C++ binaries. Cq-Include-Trybots: luci.dart.try:dart-sdk-mac-try,dart-sdk-mac-arm64-try Change-Id: If2a379c0cde556ad3198cafc5b53a386bd265197 Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/504721 Reviewed-by: Alexander Markov Commit-Queue: Ryan Macnak --- runtime/tools/dart_copy_and_codesign.py | 52 +++++++++ samples/embedder/BUILD.gn | 8 -- utils/aot_snapshot.gni | 138 +++++++++--------------- 3 files changed, 104 insertions(+), 94 deletions(-) create mode 100644 runtime/tools/dart_copy_and_codesign.py diff --git a/runtime/tools/dart_copy_and_codesign.py b/runtime/tools/dart_copy_and_codesign.py new file mode 100644 index 00000000000..42cdff629e9 --- /dev/null +++ b/runtime/tools/dart_copy_and_codesign.py @@ -0,0 +1,52 @@ +#!/usr/bin/env python3 +# +# Copyright (c) 2026, the Dart project authors. Please see the AUTHORS file +# for details. All rights reserved. Use of this source code is governed by a +# BSD-style license that can be found in the LICENSE file. +# +# Copies a binary and signs with using the specified signing identity. + +import optparse +import subprocess + +parser = optparse.OptionParser() +parser.add_option("--identity", type="string", help="Code signing identity") +parser.add_option("--input", type="string") +parser.add_option("--output", type="string") +options = parser.parse_args()[0] + +if not options.identity: + raise Exception("Missing code signing identity (--identity)") + +if not options.input: + raise Exception("Missing binaries to sign (--input)") + +if not options.output: + raise Exception("Missing binaries to sign (--input)") + +# Not cp. Compare tool("copy") in mac_toolchain.gni. +cmd = ["ln", "-f", options.input, options.output] +result = subprocess.run(cmd, capture_output=True, encoding="utf8") +if result.returncode != 0: + print("failed to run: " + " ".join(cmd)) + print(f"exit code: {result.returncode}") + print("stdout:") + print(result.stdout) + print("stdout:") + print(result.stderr) + raise Exception("failed to copy") + +codesign_args = [ + "--deep", "--force", "--verify", "--verbose", "--timestamp", "--options", + "runtime", "--sign", options.identity +] +cmd = ["codesign"] + codesign_args + [options.output] +result = subprocess.run(cmd, capture_output=True, encoding="utf8") +if result.returncode != 0: + print("failed to run: " + " ".join(cmd)) + print(f"exit code: {result.returncode}") + print("stdout:") + print(result.stdout) + print("stdout:") + print(result.stderr) + raise Exception("failed to codesign") diff --git a/samples/embedder/BUILD.gn b/samples/embedder/BUILD.gn index 0b416107c14..885be5f6ab6 100644 --- a/samples/embedder/BUILD.gn +++ b/samples/embedder/BUILD.gn @@ -70,14 +70,6 @@ _all_configs = [ dart_shared_lib = "../../runtime/engine:dart_engine_aot_shared" dart_static_lib = "../../runtime/engine:dart_engine_aot_static" snapshot_target = "aot_snapshot" - - # AOT snapshots as shared libraries on Windows are not - # supported, and in fact we don't build AOT samples on - # Windows. However, GN evaluation model will still - # evaluate the `aot_snapshot` template on Windows, - # and it will fail the assert if as_shared_library is - # true, and the current platform is Windows. - as_shared_library = !is_win }, ] diff --git a/utils/aot_snapshot.gni b/utils/aot_snapshot.gni index 25e84edfd56..51c65cc63a4 100644 --- a/utils/aot_snapshot.gni +++ b/utils/aot_snapshot.gni @@ -3,6 +3,7 @@ # BSD-style license that can be found in the LICENSE file. import("../build/dart/dart_action.gni") +import("../build/toolchain/signing.gni") import("../sdk_args.gni") _dart_root = get_path_info("..", "abspath") @@ -44,10 +45,13 @@ template("aot_snapshot") { } dill = "$target_gen_dir/$name.dart.dill" + unsigned_snapshot = "$target_gen_dir/$name.dart.snapshot.unsigned" + signed_snapshot = output # Build the kernel file using the prebuilt VM to speed up the debug and # simulator builds. - prebuilt_dart_action(target_name + "_dill") { + kernel_label = target_name + "_dill" + prebuilt_dart_action(kernel_label) { if (defined(invoker.pool)) { pool = invoker.pool } @@ -73,7 +77,8 @@ template("aot_snapshot") { depfile = "$output.d" vm_args = [ - # Ensure gen_kernel.dart will use this SDK hash when consuming/producing kernel. + # Ensure gen_kernel.dart will use this SDK hash when consuming/producing + # kernel. "-Dsdk_hash=$sdk_hash", ] @@ -104,104 +109,65 @@ template("aot_snapshot") { } } - # Whether to build an AOT snapshot, which can be opened by dlopen. - # Ignore this option on Linux, as the default app-aot-elf AOT - # snapshot already can be used with dlopen on Linux. - as_shared_library = defined(invoker.as_shared_library) && - invoker.as_shared_library && !is_linux + # Create a snapshot from kernel built above. + gen_snapshot_label = "${target_name}_gen_snapshot" + gen_snapshot_action(gen_snapshot_label) { + if (defined(invoker.pool)) { + pool = invoker.pool + } + deps = extra_deps + [ ":$kernel_label" ] - assert(!(as_shared_library && is_win), - "AOT Snapshots as shared libraries are not supported on Windows") + inputs = [ dill ] + extra_inputs - if (!as_shared_library) { - # Create a snapshot from kernel built above. - gen_snapshot_action(target_name) { - if (defined(invoker.pool)) { - pool = invoker.pool - } - deps = extra_deps + [ ":${target_name}_dill" ] + outputs = [ unsigned_snapshot ] - inputs = extra_inputs - - outputs = [ output ] - - abs_output = rebase_path(output) + abs_output = rebase_path(unsigned_snapshot) + # TODO(60813): Generate PE DLL on Windows. + if (is_mac) { + vm_args = [ + "--deterministic", + "--snapshot-kind=app-aot-macho-dylib", + "--macho=$abs_output", + ] + gen_snapshot_args + } else { vm_args = [ "--deterministic", "--snapshot-kind=app-aot-elf", "--elf=$abs_output", ] + gen_snapshot_args - if (defined(invoker.vm_args)) { - vm_args += invoker.vm_args - } + } + if (defined(invoker.vm_args)) { + vm_args += invoker.vm_args + } - args = [ rebase_path(dill) ] + args = [ rebase_path(dill) ] - force_product_mode = product_mode + force_product_mode = product_mode + } + + if (is_mac && codesigning_identity != "") { + action(target_name) { + deps = [ ":$gen_snapshot_label" ] + + inputs = [ unsigned_snapshot ] + outputs = [ signed_snapshot ] + + script = "$_dart_root/runtime/tools/dart_copy_and_codesign.py" + args = [ + "--identity", + codesigning_identity, + "--input", + rebase_path(unsigned_snapshot), + "--output", + rebase_path(signed_snapshot), + ] } } else { - assembly = "$target_gen_dir/$name.S" - dill_target_name = ":${target_name}_dill" - - # Create an assembly snapshot from kernel built above. - assembly_target_name = target_name + "_assembly" - gen_snapshot_action(assembly_target_name) { - if (defined(invoker.pool)) { - pool = invoker.pool - } - deps = extra_deps + [ dill_target_name ] - - inputs = extra_inputs - - outputs = [ assembly ] - - abs_output = rebase_path(assembly) - vm_args = [ - "--deterministic", - "--snapshot-kind=app-aot-assembly", - "--assembly=$abs_output", - ] + gen_snapshot_args - - args = [ rebase_path(dill) ] - - force_product_mode = product_mode - } - - # build a shared library from assembly. - shared_library_target_name = target_name + "_shared_library" - shared_library(shared_library_target_name) { - sources = [ assembly ] - deps = [ ":${assembly_target_name}" ] - } - - output_prefix = "lib" - output_extension = "" - - if (current_os == "mac" || current_os == "ios" || current_os == "watchos") { - output_extension = "dylib" - } else if (current_os == "win") { - output_extension = "dll" - output_prefix = "" - } else if (current_os == "unknown" && current_cpu == "wasm32") { - output_extension = "wasm" - } else { - output_extension = "so" - } - - shared_library_output_file_name = - "$output_prefix$shared_library_target_name" - if (output_extension != "") { - shared_library_output_file_name += ".$output_extension" - } - - # copy shared library to the same output, as when - # `as_shared_library` is False. copy(target_name) { - sources = [ "$root_out_dir/$shared_library_output_file_name" ] - outputs = [ output ] - - deps = [ ":${shared_library_target_name}" ] + deps = [ ":$gen_snapshot_label" ] + sources = [ unsigned_snapshot ] + outputs = [ signed_snapshot ] } } }