crypto/x509/internal/macos: link errors on ios/arm64 due to missing symbols _SecItemExport and _SecTrustEvaluateWithError #49616

bcmills · 2021-11-16T17:25:08Z

ios-arm64-corellium at f041c7e3028545ba39c60d6e20ab9b74c01bbf33

:: Running /bin/bash with args ["bash" "/tmp/workdir-host-ios-arm64-corellium-ios/go/src/make.bash"] and env ["SHELL=/bin/sh" "XPC_FLAGS=0x0" "DYLD_INSERT_LIBRARIES=/usr/lib/pspawn_payload.dylib:/usr/lib/TweakInject.dylib" "TMUX=/tmp//tmux-0/default,132,0" "HOME=/var/root" "GO_BUILDER_ENV=host-ios-arm64-corellium-ios" "SANDBOX_TOKENS=c1bd94996a72965db5823ac10e7459ccbbce059e20ee4152d9bdb34ddecabc09;00;00000000;00000000;00000000;000000000000001c;com.apple.sandbox.executable;01;01000002;0fffffff000054ee;01;/Library:a248e92ac291deec804d9e560eaef74783cf366457936fc3e6130d34d96a62cf;00;00000000;00000000;00000000;000000000000001c;com.apple.sandbox.executable;01;01000002;0fffffff000618a2;01;/Library/MobileSubstrate/DynamicLibraries:3e8bbc2027b091b3cafd0a9984d8638a18b3e629c8e74742aef25894d9c8b54f;00;00000000;00000000;00000000;000000000000001c;com.apple.sandbox.executable;01;01000002;0fffffff00006626;01;/System:fcb11e3fbd53a5a56715b3d49a2803c7f25685efec12787b048c8455ae7c40e4;00;00000000;00000000;00000000;000000000000001c;com.apple.sandbox.executable;00;01000003;0000000000000002;01;/private/var/mnt:e7234a7dd77bbb3ebfbf3cb09706481a1126720066bff5f7ed41a0311ebf1030;00;00000000;00000000;00000000;000000000000001c;com.apple.sandbox.executable;01;01000003;000000000000002e;01;/private/var/mobile/Library:98e3a25a1a068ca7adbfd9c379772de487265a01ace7cfdb48d5f458ffdcf3af;00;00000000;00000000;00000000;0000000000000020;com.apple.app-sandbox.read-write;01;01000003;0000000000000036;01;/private/var/mobile/Library/Preferences" "TERM=screen" "TMUX_PANE=%0" "SHLVL=1" "XPC_SERVICE_NAME=org.golang.builder" "PATH=/var/root/bin:/usr/bin:/bin:/usr/sbin:/sbin" "CC=/var/root/bin/clangwrap" "_=/var/root/go/bin/buildlet" "WORKDIR=/tmp/workdir-host-ios-arm64-corellium-ios" "GO_BUILDER_NAME=ios-arm64-corellium" "GOROOT_BOOTSTRAP=/var/root/go-ios-arm64-bootstrap" "GOBIN=" "TMPDIR=/tmp/workdir-host-ios-arm64-corellium-ios/tmp" "GOCACHE=/tmp/workdir-host-ios-arm64-corellium-ios/gocache" "PWD=/tmp/workdir-host-ios-arm64-corellium-ios/go/src"] in dir /tmp/workdir-host-ios-arm64-corellium-ios/go/src

Building Go cmd/dist using /var/root/go-ios-arm64-bootstrap. (devel +694025e74f Tue Oct 6 01:14:39 2020 +0000 ios/arm64)
Building Go toolchain1 using /var/root/go-ios-arm64-bootstrap.
Building Go bootstrap cmd/go (go_bootstrap) using Go toolchain1.
warning: unable to find runtime/cgo.a
Building Go toolchain2 using go_bootstrap and Go toolchain1.
Building Go toolchain3 using go_bootstrap and Go toolchain2.
Building packages and commands for ios/arm64.
# cmd/go
/tmp/workdir-host-ios-arm64-corellium-ios/go/pkg/tool/ios_arm64/link: running /var/root/bin/clangwrap failed: exit status 1
Undefined symbols for architecture arm64:
  "_SecItemExport", referenced from:
      _crypto/x509/internal/macos.x509_SecItemExport_trampoline.abi0 in go.o
  "_SecTrustEvaluateWithError", referenced from:
      _crypto/x509/internal/macos.x509_SecTrustEvaluateWithError_trampoline.abi0 in go.o
ld: symbol(s) not found for architecture arm64
Not signing file
clang-5.0: error: linker command failed with exit code 1 (use -v to see invocation)

# cmd/pprof
/tmp/workdir-host-ios-arm64-corellium-ios/go/pkg/tool/ios_arm64/link: running /var/root/bin/clangwrap failed: exit status 1
Undefined symbols for architecture arm64:
  "_SecItemExport", referenced from:
      _crypto/x509/internal/macos.x509_SecItemExport_trampoline.abi0 in go.o
  "_SecTrustEvaluateWithError", referenced from:
      _crypto/x509/internal/macos.x509_SecTrustEvaluateWithError_trampoline.abi0 in go.o
ld: symbol(s) not found for architecture arm64
Not signing file
clang-5.0: error: linker command failed with exit code 1 (use -v to see invocation)

# cmd/trace
/tmp/workdir-host-ios-arm64-corellium-ios/go/pkg/tool/ios_arm64/link: running /var/root/bin/clangwrap failed: exit status 1
Undefined symbols for architecture arm64:
  "_SecItemExport", referenced from:
      _crypto/x509/internal/macos.x509_SecItemExport_trampoline.abi0 in go.o
  "_SecTrustEvaluateWithError", referenced from:
      _crypto/x509/internal/macos.x509_SecTrustEvaluateWithError_trampoline.abi0 in go.o
ld: symbol(s) not found for architecture arm64
Not signing file
clang-5.0: error: linker command failed with exit code 1 (use -v to see invocation)

go tool dist: FAILED: /tmp/workdir-host-ios-arm64-corellium-ios/go/pkg/tool/ios_arm64/go_bootstrap install -gcflags=all= -ldflags=all= std cmd: exit status 2

greplogs --dashboard -md -l -e '(?m)Undefined symbols for architecture arm64:\n\s*"_SecItemExport"'

The text was updated successfully, but these errors were encountered:

bcmills · 2021-11-16T17:27:47Z

@rolandshoemaker, @FiloSottile: I suspect that this is closely related to CL 362294 / CL 353403.

bcmills · 2021-11-16T17:28:27Z

(This is a release-blocker for Go 1.18 via #11811.)

bcmills · 2021-11-16T17:32:15Z

(See previously #42459, which also reported a link error for _SecItemExport; CC @cherrymui.)

gopherbot · 2021-11-16T18:09:06Z

Change https://golang.org/cl/363985 mentions this issue: dashboard: remove known issue for iOS and Android builders

The old known issue has been resolved: the builders have been restarted and are back. That uncovered what appears to be a recent regression, reported as golang/go#49616. Also add a new builder owner based on conversation at https://groups.google.com/g/golang-dev/c/oiuIE7qrWp0. Updates golang/go#48772. Updates golang/go#49048. Updates golang/go#49616. Change-Id: I7a6a89b7fb088373a70bd3496ad2091ec7a3d79f Reviewed-on: https://go-review.googlesource.com/c/build/+/363985 Trust: Dmitri Shuralyov <dmitshur@golang.org> Reviewed-by: Alexander Rakoczy <alex@golang.org>

gopherbot · 2021-11-16T20:43:33Z

Change https://golang.org/cl/364554 mentions this issue: crypto/x509/internal/macos: use APIs available on ios

rolandshoemaker · 2021-11-16T21:20:29Z

This is a two part issue:

(1) we used an API which is only available on macOS, so it's obviously unavailable on iOS. CL364554 switches to an API available on both.
(2) SecTrustEvaluateWithError is available on iOS, as of 12.0. The builders use iOS 14.6, but the clang wrapper sets the minimum version to 6.0, and the SDK in use is for 11.2 (there appears to be no real documentation of this. Bumping the minimum version to 12.0, and updating the SDK to a modern one (14.5) appears to fix these issues.

I've sent a CL for (1), but I'm not sure how best to go about fixing (2). I can send a CL which bumps the min version, but the SDK on the builders needs to be bumped, but that appears to be supplied OOB (and the only instructions appear to be for a new instance, and I can't see any documentation for what to do if we need to make changes? Possibly wipe the instance and re-initialize?)

dmitshur · 2021-11-17T14:39:57Z

CC @steeve, @changkun Are you able to help with updating the SDK on the ios-arm64-corellium builder? Thanks very much.

steeve · 2021-11-17T14:58:17Z

I am not sure how to bump the SDK on the builders, @eliasnaur do you recall where this is kept?
Also, bumping ios-version-min=12 might require some discussion (but I think it's okay) as some folks might still be distributing on ios 11 (we do, but we could bump I guess).

bcmills · 2021-11-17T15:13:16Z

bumping ios-version-min=12 might require some discussion

That seems to be #48076?

rolandshoemaker · 2021-11-17T17:14:14Z

The SDK lives at /var/root/iPhoneOS.sdk and the clang wrapper lives at /var/root/bin/clangwrap on the builders.

rolandshoemaker · 2021-11-17T17:15:10Z

The builders are initialized using https://github.com/golang/build/blob/master/env/corellium/ios/install.sh

bcmills · 2021-11-17T17:29:41Z

Would it make sense to add a build constraint (maybe ios-11) that replaces the function that calls SecTrustEvaluateWithError with one that fails unconditionally? That might allow users who really want to support older iOS to do so at the expense of not being able to verify certificates (which I'm guessing may not have up-to-date revocations on older iOS anyway).

rolandshoemaker · 2021-11-17T18:15:25Z

That is a viable approach if we want to continue to support older iOS versions. Another option is that we could implement a special pre-iOS version which uses the older APIs for certificate verification which have been deprecated, but that is a significant amount of work, since a lot of the old APIs don't interoperate well with the new ones.

FiloSottile · 2021-11-18T18:52:37Z

Looking at #48076, it feels like raising the minimum version to iOS 12 is the right choice for Go 1.18, regardless of the complete policy. This fortunately solves our problem here, too.

Use SecCertificateCopyData instead of SecItemExport, which is only available on macOS. Updates #49616 Change-Id: Ieda33894930d23c6dab6112ee18120f8a440083b Reviewed-on: https://go-review.googlesource.com/c/go/+/364554 Trust: Roland Shoemaker <roland@golang.org> Run-TryBot: Roland Shoemaker <roland@golang.org> Reviewed-by: Bryan C. Mills <bcmills@google.com> Reviewed-by: Filippo Valsorda <filippo@golang.org>

changkun · 2021-11-24T12:45:06Z

If iOS 12 is decided (as in #48076) to be the minimum targeting version for 1.18, I can help with updating the SDKs inside the builders.

gopherbot · 2021-11-24T16:11:59Z

Change https://golang.org/cl/366914 mentions this issue: doc/go1.18: document that iOS 12 or newer is required

dmitshur · 2021-11-24T16:13:32Z

@changkun Yes, I think we'll go with iOS 12 for Go 1.18. I've mailed CL 366914 to document it in the release notes. Thank you for your help with with updating the builders accordingly, and in turn resolving this release-blocking issue.

For #47694. Updates #49616. Updates #48076. Change-Id: I570564c3a54d3cd9cfc9b8267df9fbee3363b650 Reviewed-on: https://go-review.googlesource.com/c/go/+/366914 Trust: Dmitri Shuralyov <dmitshur@golang.org> Reviewed-by: Cherry Mui <cherryyz@google.com>

changkun · 2021-11-29T08:02:31Z

I've updated the SDK in one of the three iOS builders. The other two seem to have trouble connecting to them (still waiting for Corellium's response). But according to the log, there might be another issue.

rolandshoemaker · 2021-11-30T19:14:44Z

@changkun what SDK did you update to? (and were there any other steps you took?)

From the most recent builder logs I see a panic due to bad syscall, which I didn't see when I was testing against the 14.5 SDK on the builder.

changkun · 2021-11-30T19:28:07Z

@rolandshoemaker Yes, the iPhone SDK is updated to 12.4, and the go bootstrap is updated 1.17.3

I don't know if the bad syscall panic is caused by the SDK version. But should I further bump the SDK version to 14.5 so that we could learn more experience on the error? or could it be another issue?

rolandshoemaker · 2021-11-30T19:40:27Z

I don't really have enough experience with iOS to know, I'd suggest bumping it to 14.5 just to check if that's it, but it could also be the bootstrap version change, or something else entirely 🤷.

rolandshoemaker · 2021-11-30T19:43:38Z

(out of interest, what was the reason for bumping the bootstrap version? did it break without?)

cherrymui · 2021-11-30T22:25:45Z

I tried with gomote that disabling sendfile makes all.bash pass on the iOS builder.

It is interesting that it signals with SIGSYS, instead of returning ENOSYS, which one would expect if the syscall is not supported, and our code handles. Googling found ndfred/iperf-ios#17 . Maybe sendfile is just broken on (some version of) iOS?

Maybe it was not broken on the old version of iOS which the builder used to run? Or it wasn't available so it just returned ENOSYS?

gopherbot · 2021-11-30T22:36:56Z

Change https://golang.org/cl/368054 mentions this issue: net: do not use sendfile on iOS

changkun · 2021-11-30T22:43:12Z

Update: This build log is based on iPhoneSDK14.5, and as we see the build log is still failing, hence we can remove the reason from SDK versions.

I have replaced the SDK with 14.5.
We should need to wait for another commit on the master branch to see what will happen or so?

The bump of the bootstrap version was because the previous bootstrap was built on a commit between 1.16beta1 and 1.16 release, according to the log, the bootstrap was problematic and did not enable cgo in the build.

The actually selected version of go bootstrap has no particular reason and simply represents the latest release.

~~In terms of the iOS version, the current running iOS on the builder is 14.6, and it seems that the mentioned issue from @cherrymui is relatively old (although I don't have further supporting evidence)~~

Apparently, on the iOS builder sendfile causes a SIGSYS signal (instead of returning ENOSYS). Disabling it for now so we can make progress on iOS. We can revisit if sendfile is actually broken on iOS and whether it is beneficial. Updates #49616. Change-Id: I3883fad0ce35e3f0aa352301eb499a1afa0225a1 Reviewed-on: https://go-review.googlesource.com/c/go/+/368054 Trust: Cherry Mui <cherryyz@google.com> Reviewed-by: Emmanuel Odeke <emmanuel@orijtech.com> Reviewed-by: Michael Knyszek <mknyszek@google.com> Reviewed-by: Changkun Ou <mail@changkun.de> Reviewed-by: Roland Shoemaker <roland@golang.org>

dmitshur · 2021-12-03T23:17:26Z

With the builder updates that @changkun performed, and as of CL 368054 landing, the iOS builder is passing. If I understand correctly, there's nothing more to do for this issue, right?

If so, I'll send a CL that removes the builder's known issue.

gopherbot · 2021-12-03T23:27:00Z

Change https://golang.org/cl/369255 mentions this issue: dashboard: clear known issue for ios builder

cherrymui · 2021-12-03T23:33:28Z

SGTM. Thanks.

cherrymui · 2021-12-03T23:34:00Z

And I think we can close this issue.

The work needed to resolve go.dev/issue/49616 looks to be complete, and the builder is passing reliably. Updates golang/go#49616. Change-Id: I90253c7751f97f081496abe90b1e827992afaf6e Reviewed-on: https://go-review.googlesource.com/c/build/+/369255 Trust: Dmitri Shuralyov <dmitshur@golang.org> Reviewed-by: Cherry Mui <cherryyz@google.com>

dmitshur · 2021-12-03T23:34:55Z

Closed. Thanks very much for everyone's help resolving this.

The update to 1.18 broke hugo and golangci-lint. I wasn't really using hugo, so I'm just commenting it out for now. To fix golangci-lint, add an overlay which builds it with 1.17. See: * NixOS/nixpkgs#168984 * golang/go#49616

bcmills added NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. mobile Android, iOS, and x/mobile labels Nov 16, 2021

bcmills added the release-blocker label Nov 16, 2021

bcmills added this to the Go1.18 milestone Nov 16, 2021

bcmills added OS-Darwin arch-arm64 labels Nov 16, 2021

bcmills changed the title ~~crypto/x509/internal/macos: link errors on iOS due to missing symbols _SecItemExport and _SecTrustEvaluateWithError~~ crypto/x509/internal/macos: link errors on ios/arm64 due to missing symbols _SecItemExport and _SecTrustEvaluateWithError Nov 16, 2021

bcmills mentioned this issue Nov 17, 2021

all: decide and document iOS supported versions #48076

Closed

toothrot added the okay-after-beta1 Used by release team to mark a release-blocker issue as okay to resolve either before or after beta1 label Nov 19, 2021

dmitshur added NeedsFix The path to resolution is known, but the work has not been done. and removed NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. labels Nov 24, 2021

dmitshur closed this as completed Dec 3, 2021

arriven mentioned this issue Apr 17, 2022

golangci-lint does not build on darwin-x86_64 - undefined symbols NixOS/nixpkgs#168984

Closed

golang locked and limited conversation to collaborators Dec 4, 2022

gopherbot added the FrozenDueToAge label Dec 4, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

crypto/x509/internal/macos: link errors on ios/arm64 due to missing symbols _SecItemExport and _SecTrustEvaluateWithError #49616

crypto/x509/internal/macos: link errors on ios/arm64 due to missing symbols _SecItemExport and _SecTrustEvaluateWithError #49616

bcmills commented Nov 16, 2021

bcmills commented Nov 16, 2021 •

edited

bcmills commented Nov 16, 2021

bcmills commented Nov 16, 2021 •

edited

gopherbot commented Nov 16, 2021

gopherbot commented Nov 16, 2021

rolandshoemaker commented Nov 16, 2021

dmitshur commented Nov 17, 2021

steeve commented Nov 17, 2021

bcmills commented Nov 17, 2021

rolandshoemaker commented Nov 17, 2021

rolandshoemaker commented Nov 17, 2021

bcmills commented Nov 17, 2021 •

edited

rolandshoemaker commented Nov 17, 2021

FiloSottile commented Nov 18, 2021

changkun commented Nov 24, 2021

gopherbot commented Nov 24, 2021

dmitshur commented Nov 24, 2021 •

edited

changkun commented Nov 29, 2021

rolandshoemaker commented Nov 30, 2021

changkun commented Nov 30, 2021

rolandshoemaker commented Nov 30, 2021

rolandshoemaker commented Nov 30, 2021

cherrymui commented Nov 30, 2021 •

edited

gopherbot commented Nov 30, 2021

changkun commented Nov 30, 2021 •

edited

dmitshur commented Dec 3, 2021

gopherbot commented Dec 3, 2021

cherrymui commented Dec 3, 2021

cherrymui commented Dec 3, 2021

dmitshur commented Dec 3, 2021 •

edited

crypto/x509/internal/macos: link errors on ios/arm64 due to missing symbols _SecItemExport and _SecTrustEvaluateWithError #49616

crypto/x509/internal/macos: link errors on ios/arm64 due to missing symbols _SecItemExport and _SecTrustEvaluateWithError #49616

Comments

bcmills commented Nov 16, 2021

bcmills commented Nov 16, 2021 • edited

bcmills commented Nov 16, 2021

bcmills commented Nov 16, 2021 • edited

gopherbot commented Nov 16, 2021

gopherbot commented Nov 16, 2021

rolandshoemaker commented Nov 16, 2021

dmitshur commented Nov 17, 2021

steeve commented Nov 17, 2021

bcmills commented Nov 17, 2021

rolandshoemaker commented Nov 17, 2021

rolandshoemaker commented Nov 17, 2021

bcmills commented Nov 17, 2021 • edited

rolandshoemaker commented Nov 17, 2021

FiloSottile commented Nov 18, 2021

changkun commented Nov 24, 2021

gopherbot commented Nov 24, 2021

dmitshur commented Nov 24, 2021 • edited

changkun commented Nov 29, 2021

rolandshoemaker commented Nov 30, 2021

changkun commented Nov 30, 2021

rolandshoemaker commented Nov 30, 2021

rolandshoemaker commented Nov 30, 2021

cherrymui commented Nov 30, 2021 • edited

gopherbot commented Nov 30, 2021

changkun commented Nov 30, 2021 • edited

dmitshur commented Dec 3, 2021

gopherbot commented Dec 3, 2021

cherrymui commented Dec 3, 2021

cherrymui commented Dec 3, 2021

dmitshur commented Dec 3, 2021 • edited

bcmills commented Nov 16, 2021 •

edited

bcmills commented Nov 16, 2021 •

edited

bcmills commented Nov 17, 2021 •

edited

dmitshur commented Nov 24, 2021 •

edited

cherrymui commented Nov 30, 2021 •

edited

changkun commented Nov 30, 2021 •

edited

dmitshur commented Dec 3, 2021 •

edited