build(guix): add aarch64-unknown-linux-gnu cross-compilation

Adds a new supported target triple, cross-compiled from x86_64 Linux
using Guix's old-glibc toolchain machinery (same approach as the
existing x86_64-linux-gnu build):

* manifest.scm: aarch64-linux-gnu-toolchain built via
  make-ckb-cross-toolchain (glibc 2.31); openssl-aarch64-glibc-2.31
  cross-compiled against that toolchain; the host-dependent branch
  now selects x86_64 or aarch64 packages based on the target, and
  aarch64 pulls in a Rust sysroot via make-rust-sysroot/implementation
  (rustc only ships libstd for the build host).

* guix-build: aarch64-unknown-linux-gnu added to SUPPORTED_HOSTS and
  mapped to the aarch64-linux-gnu GNU triple.

* libexec/build.sh: new HOST case with
  DYNAMIC_LINKER=/lib/ld-linux-aarch64.so.1 and the right
  TARGET_ENV_SUFFIX.  Because cross-arch cross-compile differs from
  the existing same-arch glibc-downgrade, build scripts (build.rs,
  proc-macros) get CC_x86_64_unknown_linux_gnu/HOST_CC pointed at
  native gcc, and AARCH64_UNKNOWN_LINUX_GNU_OPENSSL_{INCLUDE,LIB}_DIR
  is set directly so openssl-sys doesn't try to use the host
  pkg-config for a differing target arch.  Hardcoded x86_64
  interpreter in the patchelf call replaced with ${DYNAMIC_LINKER}.

* symbol-check.py: recognise AARCH64 for the glibc 2.31 cap, the
  expected interpreter, and the ld-linux-aarch64.so.1 allow-list
  entry.

Verified reproducible:
  x86_64-unknown-linux-gnu: 3c7d003ca216fbb31173e0da5d965f472243ef4f8b6e1288d37e6053eb566d2d
  aarch64-unknown-linux-gnu: 37b1b69faa879ab0f00188c51ab156df0f011912550708a5e400677c30443633
x86_64 hash is identical with and without this commit applied.

Author: eval-exec

contrib/guix/guix-build

@@ -89,7 +89,7 @@ EOF
 }
 
 HOSTS="${HOSTS:-x86_64-unknown-linux-gnu}"
-SUPPORTED_HOSTS="x86_64-unknown-linux-gnu x86_64-pc-windows-gnu aarch64-apple-darwin"
+SUPPORTED_HOSTS="x86_64-unknown-linux-gnu aarch64-unknown-linux-gnu x86_64-pc-windows-gnu aarch64-apple-darwin"
 for host in $HOSTS; do
     if ! echo "$SUPPORTED_HOSTS" | grep -qw "$host"; then
         echo "ERR: Unsupported HOST '$host'. Supported: $SUPPORTED_HOSTS" >&2
@@ -179,6 +179,7 @@ for HOST in $HOSTS; do
     # Map Rust target triples to GNU triples for the Guix manifest.
     case "$HOST" in
         x86_64-unknown-linux-gnu)  MANIFEST_HOST="x86_64-linux-gnu" ;;
+        aarch64-unknown-linux-gnu) MANIFEST_HOST="aarch64-linux-gnu" ;;
         x86_64-pc-windows-gnu)     MANIFEST_HOST="x86_64-w64-mingw32" ;;
         *)                         MANIFEST_HOST="$HOST" ;;
     esac

contrib/guix/libexec/build.sh

@@ -91,6 +91,11 @@ case "$HOST" in
         DYNAMIC_LINKER="/lib64/ld-linux-x86-64.so.2"
         TARGET_ENV_SUFFIX="X86_64_UNKNOWN_LINUX_GNU"
         ;;
+    aarch64-linux-gnu)
+        GNU_HOST="aarch64-linux-gnu"
+        DYNAMIC_LINKER="/lib/ld-linux-aarch64.so.1"
+        TARGET_ENV_SUFFIX="AARCH64_UNKNOWN_LINUX_GNU"
+        ;;
     x86_64-w64-mingw32)
         GNU_HOST="x86_64-w64-mingw32"
         DYNAMIC_LINKER=""
@@ -338,6 +343,23 @@ HOSTCXXEOF
         export AR_x86_64_unknown_linux_gnu="${NATIVE_GCC}/bin/gcc-ar"
         export RANLIB_x86_64_unknown_linux_gnu="${NATIVE_GCC}/bin/gcc-ranlib"
         ;;
+    aarch64-linux-gnu)
+        # Cross-compiling from x86_64 to aarch64: CC has been set to the
+        # aarch64 cross-wrapper, but build scripts (build.rs, proc-macros)
+        # still run on the x86_64 build host and must produce native x86_64
+        # objects.  Point the HOST-side CC at the native gcc.
+        export CC_x86_64_unknown_linux_gnu="${NATIVE_GCC}/bin/gcc"
+        export CXX_x86_64_unknown_linux_gnu="${NATIVE_GCC}/bin/g++"
+        export AR_x86_64_unknown_linux_gnu="${NATIVE_GCC}/bin/gcc-ar"
+        export RANLIB_x86_64_unknown_linux_gnu="${NATIVE_GCC}/bin/gcc-ranlib"
+        export HOST_CC="${NATIVE_GCC}/bin/gcc"
+        export HOST_CXX="${NATIVE_GCC}/bin/g++"
+        # openssl-sys's host pkg-config would refuse to return paths when
+        # target arch differs from host arch.  Point it directly at the
+        # aarch64 openssl in the Guix profile via target-specific env vars.
+        export AARCH64_UNKNOWN_LINUX_GNU_OPENSSL_INCLUDE_DIR="${GUIX_ENVIRONMENT}/include"
+        export AARCH64_UNKNOWN_LINUX_GNU_OPENSSL_LIB_DIR="${GUIX_ENVIRONMENT}/lib"
+        ;;
     *darwin*)
         # Darwin CC wrapper uses Clang with Apple SDK — build scripts must
         # use native GCC instead to compile host C code (e.g., SQLite).
@@ -447,8 +469,9 @@ RUSTFLAGS="--remap-path-prefix=${DISTSRC}=. --remap-path-prefix=/gnu/store=/usr"
 
 # For cross-compilation targets, set up the Rust sysroot.
 case "$HOST" in
-    *mingw*)
-        # Windows: Guix's make-rust-sysroot built libstd; use the profile.
+    *mingw*|aarch64-linux-gnu)
+        # Windows / aarch64 Linux: Guix's make-rust-sysroot built libstd;
+        # use the profile as the sysroot.
         RUSTFLAGS="${RUSTFLAGS} --sysroot=${GUIX_ENVIRONMENT}"
         ;;
     *darwin*)
@@ -674,7 +697,7 @@ cp "$binary" "${INSTALLPATH}/${BINARY_NAME}"
 
 case "$HOST" in
     *linux*)
-        patchelf --set-interpreter /lib64/ld-linux-x86-64.so.2 --remove-rpath "${INSTALLPATH}/${BINARY_NAME}"
+        patchelf --set-interpreter "${DYNAMIC_LINKER}" --remove-rpath "${INSTALLPATH}/${BINARY_NAME}"
 
         interp="$(readelf -l "${INSTALLPATH}/${BINARY_NAME}" | sed -n 's@.*Requesting program interpreter: \(.*\)]@\1@p')"
         runpath="$(readelf -d "${INSTALLPATH}/${BINARY_NAME}" | sed -n 's@.*Library runpath: \[\(.*\)\]@\1@p')"

contrib/guix/manifest.scm

@@ -197,6 +197,9 @@ FILE-NAME found in ./patches relative to the current file."
 (define-public x86_64-linux-gnu-toolchain
   (make-ckb-cross-toolchain "x86_64-linux-gnu"))
 
+(define-public aarch64-linux-gnu-toolchain
+  (make-ckb-cross-toolchain "aarch64-linux-gnu"))
+
 ;;;
 ;;; Windows (MinGW-w64) cross-toolchain.
 ;;; Reference: https://github.com/bitcoin/bitcoin/blob/master/contrib/guix/manifest.scm
@@ -275,6 +278,14 @@ FILE-NAME found in ./patches relative to the current file."
                                           #:xbinutils (cross-binutils "x86_64-linux-gnu"))
                         #:xbinutils (cross-binutils "x86_64-linux-gnu")))
 
+(define aarch64-linux-gnu-kernel-headers
+  (cross-kernel-headers "aarch64-linux-gnu"
+                        #:linux-headers base-linux-kernel-headers
+                        #:xgcc (cross-gcc "aarch64-linux-gnu"
+                                          #:xgcc linux-base-gcc
+                                          #:xbinutils (cross-binutils "aarch64-linux-gnu"))
+                        #:xbinutils (cross-binutils "aarch64-linux-gnu")))
+
 (define-public openssl-glibc-2.31
   (package
     (inherit openssl)
@@ -319,6 +330,44 @@ FILE-NAME found in ./patches relative to the current file."
           ;; This is expected; the final binary handles RUNPATH via patchelf.
           (delete 'validate-runpath))))))
 
+(define-public openssl-aarch64-glibc-2.31
+  (package
+    (inherit openssl)
+    (name "openssl-aarch64-glibc-2.31")
+    (native-inputs
+     `(("cross-toolchain" ,aarch64-linux-gnu-toolchain)
+       ("cross-kernel-headers" ,aarch64-linux-gnu-kernel-headers)
+       ("perl" ,perl)))
+    (arguments
+     (list
+      #:tests? #f
+      #:configure-flags #~'()
+      #:phases
+      #~(modify-phases %standard-phases
+          (replace 'configure
+            (lambda* (#:key outputs #:allow-other-keys)
+              (let ((out (assoc-ref outputs "out")))
+                (invoke "perl" "./Configure"
+                        "linux-aarch64"
+                        (string-append "--prefix=" out)
+                        "--cross-compile-prefix=aarch64-linux-gnu-"
+                        "shared"
+                        "no-tests"))))
+          (replace 'build
+            (lambda* (#:key inputs parallel-build? #:allow-other-keys)
+              (let* ((kernel-headers
+                      (assoc-ref inputs "cross-kernel-headers"))
+                     (jobs (if parallel-build?
+                               (number->string (parallel-job-count))
+                               "1")))
+                (apply invoke "make" "-j" jobs
+                       (if kernel-headers
+                           (list (string-append
+                                  "CPPFLAGS=-I" kernel-headers "/include"))
+                           '())))))
+          (delete 'check)
+          (delete 'validate-runpath))))))
+
 ;;;
 ;;; Final manifest — select packages based on the HOST environment variable.
 ;;;
@@ -357,9 +406,23 @@ FILE-NAME found in ./patches relative to the current file."
   (let ((target (or (getenv "HOST") "")))
     (cond
      ((string-contains target "-linux-")
-      (list x86_64-linux-gnu-toolchain
-            openssl-glibc-2.31
-            patchelf))
+      (cond
+       ((string-prefix? "x86_64-" target)
+        (list x86_64-linux-gnu-toolchain
+              openssl-glibc-2.31
+              patchelf))
+       ((string-prefix? "aarch64-" target)
+        ;; aarch64 cross: rustc ships std for the build host only
+        ;; (x86_64-unknown-linux-gnu), so we need a Rust sysroot containing
+        ;; library/std for aarch64.  make-rust-sysroot/implementation builds
+        ;; it via x.py using the pinned rust-1.92 source.
+        (let ((make-rust-sysroot/impl
+               (@@ (gnu packages rust) make-rust-sysroot/implementation)))
+          (list aarch64-linux-gnu-toolchain
+                (make-rust-sysroot/impl "aarch64-linux-gnu" rust-1.92)
+                openssl-aarch64-glibc-2.31
+                patchelf)))
+       (else '())))
      ((string-suffix? "-mingw32" target)
       ;; Rust sysroot (libstd) for Windows, built from source via x.py.
       ;; Must use the same Rust version as the compiler (rust-1.92) —

contrib/guix/symbol-check.py

@@ -17,13 +17,17 @@
 MAX_VERSIONS = {
     "GLIBC": {
         lief.ELF.ARCH.X86_64: (2, 31),
+        lief.ELF.ARCH.AARCH64: (2, 31),
     },
 }
 
 ELF_INTERPRETER_NAMES = {
     lief.ELF.ARCH.X86_64: {
         lief.Header.ENDIANNESS.LITTLE: "/lib64/ld-linux-x86-64.so.2",
     },
+    lief.ELF.ARCH.AARCH64: {
+        lief.Header.ENDIANNESS.LITTLE: "/lib/ld-linux-aarch64.so.1",
+    },
 }
 
 ELF_ALLOWED_LIBRARIES = {
@@ -35,6 +39,7 @@
     "libgcc_s.so.1",
     "libstdc++.so.6",
     "ld-linux-x86-64.so.2",
+    "ld-linux-aarch64.so.1",
     "libssl.so.3",
     "libcrypto.so.3",
 }