Statically linked spin

.github/actions/spin-ci-dependencies/action.yml

@@ -8,7 +8,7 @@ inputs:
     type: bool
   rust-version:
     description: 'Rust version to setup'
-    default: '1.71'
+    default: '1.73'
     required: false
     type: string
 
@@ -17,6 +17,11 @@ inputs:
     required: false
     default: 'false'
     type: bool
+  rust-cross:
+    description: 'setup rust cross'
+    required: false
+    default: 'false'
+    type: bool
   rust-cache:
     description: 'setup rust cache'
     required: false
@@ -82,6 +87,11 @@ runs:
       if: ${{ inputs.rust-wasm == 'true' }}
       shell: bash
 
+    - name: "Install cross-rs"
+      run: cargo install cross
+      if: ${{ inputs.rust-cross == 'true' }}
+      shell: bash
+
     - uses: Swatinem/rust-cache@v2
       if: ${{ inputs.rust-cache == 'true' }}
       with:

.github/workflows/build.yml

@@ -73,6 +73,58 @@ jobs:
           name: spin-ubuntu-latest
           path: target/release/spin
 
+  build-rust-static:
+    name: Build Spin static
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: setup dependencies
+        uses: ./.github/actions/spin-ci-dependencies
+        with:
+          rust: true
+          rust-cross: true
+          rust-cache: true
+
+      - name: Cargo Build
+        run: cross build --target x86_64-unknown-linux-musl --workspace --release --all-targets --features openssl/vendored
+        env:
+          CARGO_INCREMENTAL: 0
+          BUILD_SPIN_EXAMPLES: 0
+          RUSTFLAGS: '-C target-feature=+crt-static -C link-self-contained=yes'
+
+      - name: "Archive executable artifact"
+        uses: actions/upload-artifact@v3
+        with:
+          name: spin-static-x86_64
+          path: target/x86_64-unknown-linux-musl/release/spin
+
+  build-rust-static-aarch64:
+    name: Build Spin static (aarch64)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: setup dependencies
+        uses: ./.github/actions/spin-ci-dependencies
+        with:
+          rust: true
+          rust-cross: true
+          rust-cache: true
+
+      - name: Cargo Build
+        run: cross build --target aarch64-unknown-linux-musl --workspace --release --all-targets --features openssl/vendored
+        env:
+          CARGO_INCREMENTAL: 0
+          BUILD_SPIN_EXAMPLES: 0
+          RUSTFLAGS: '-C target-feature=+fp16 -C target-feature=+crt-static -C link-self-contained=yes'
+
+      - name: "Archive executable artifact"
+        uses: actions/upload-artifact@v3
+        with:
+          name: spin-static-aarch64
+          path: target/aarch64-unknown-linux-musl/release/spin
+
   build-rust:
     name: Build Spin
     runs-on: ${{ matrix.os }}

.github/workflows/release.yml

@@ -11,7 +11,7 @@ on:
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
 env:
-  RUST_VERSION: 1.71
+  RUST_VERSION: 1.73
 
 jobs:
   build-and-sign:
@@ -215,7 +215,7 @@ jobs:
   checksums:
     name: generate release checksums
     runs-on: ubuntu-latest
-    needs: build-and-sign
+    needs: [build-and-sign, build-spin-static]
     steps:
       - name: set the release version (tag)
         if: startsWith(github.ref, 'refs/tags/v')
@@ -368,3 +368,104 @@ jobs:
         run: |
           git tag ${{ env.TEMPLATE_TAG }} -f
           git push origin ${{ env.TEMPLATE_TAG }} -f
+
+  ## statically linked spin binaries
+  build-spin-static:
+    name: Build Spin static
+    runs-on: ubuntu-latest
+    permissions:
+      # cosign uses the GitHub OIDC token
+      id-token: write
+      # needed to upload artifacts to a GH release
+      contents: write
+    strategy:
+      matrix:
+        config:
+          - {
+              arch: "aarch64",
+              target: "aarch64-unknown-linux-musl",
+              rustflags: '-C target-feature=+fp16 -C target-feature=+crt-static -C link-self-contained=yes'
+            }
+          - {
+              arch: "amd64",
+              target: "x86_64-unknown-linux-musl",
+              rustflags: '-C target-feature=+crt-static -C link-self-contained=yes'
+            }
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: set the release version (tag)
+        if: startsWith(github.ref, 'refs/tags/v')
+        shell: bash
+        run: echo "RELEASE_VERSION=${GITHUB_REF/refs\/tags\//}" >> $GITHUB_ENV
+
+      - name: set the release version (main)
+        if: github.ref == 'refs/heads/main'
+        shell: bash
+        run: echo "RELEASE_VERSION=canary" >> $GITHUB_ENV
+
+      - name: lowercase the runner OS name
+        shell: bash
+        run: |
+          OS=$(echo "${{ runner.os }}" | tr '[:upper:]' '[:lower:]')
+          echo "RUNNER_OS=$OS" >> $GITHUB_ENV
+
+      - name: Check if pre-release
+        id: release-version
+        shell: bash
+        run: |
+          [[ "${{ env.RELEASE_VERSION }}" =~ ^v[0-9]+.[0-9]+.[0-9]+$ ]] && \
+            echo "prerelease=false" >> "$GITHUB_OUTPUT" || \
+            echo "prerelease=true" >> "$GITHUB_OUTPUT"
+
+      - name: setup dependencies
+        uses: ./.github/actions/spin-ci-dependencies
+        with:
+          rust: true
+          rust-cross: true
+          rust-cache: true
+
+      - name: Cargo Build
+        run: cross build --target ${{ matrix.config.target }} --workspace --release --all-targets --features openssl/vendored
+        env:
+          CARGO_INCREMENTAL: 0
+          BUILD_SPIN_EXAMPLES: 0
+          RUSTFLAGS: ${{ matrix.config.rustflags }}
+
+      - name: Install Cosign for signing Spin binary
+        uses: sigstore/[email protected]
+        with:
+          cosign-release: v2.0.0
+
+      - name: Sign the binary with GitHub OIDC token
+          shell: bash
+          run: |
+            cosign sign-blob \
+              --yes \
+              --output-certificate crt.pem \
+              --output-signature spin.sig \
+              target/${{ matrix.config.target }}/release/spin
+
+      - name: package release assets
+        shell: bash
+        run: |
+          mkdir _dist
+          cp crt.pem spin.sig README.md LICENSE target/${{ matrix.config.target }}/release/spin _dist/
+          cd _dist
+          tar czf \
+            spin-${{ env.RELEASE_VERSION }}-static-${{ env.RUNNER_OS }}-${{ matrix.config.arch }}.tar.gz \
+            crt.pem spin.sig README.md LICENSE spin
+
+      - name: upload binary as GitHub artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: spin
+          path: _dist/spin-${{ env.RELEASE_VERSION }}-static-${{ env.RUNNER_OS }}-${{ matrix.config.arch }}.tar.gz
+
+      - name: upload binary to Github release
+        uses: svenstaro/upload-release-action@v2
+        with:
+          repo_token: ${{ secrets.GITHUB_TOKEN }}
+          file: _dist/spin-${{ env.RELEASE_VERSION }}-static-${{ env.RUNNER_OS }}-${{ matrix.config.arch }}.tar.gz
+          tag: ${{ github.ref }}
+          prerelease: ${{ steps.release-version.outputs.prerelease == 'true' }}

Cargo.toml

@@ -90,7 +90,7 @@ http-body-util = { workspace = true }
 runtime-tests = { path = "tests/runtime-tests" }
 
 [build-dependencies]
-cargo-target-dep = { git = "https://github.com/fermyon/cargo-target-dep", rev = "b7b1989fe0984c0f7c4966398304c6538e52fe49" }
+cargo-target-dep = { git = "https://github.com/fermyon/cargo-target-dep", rev = "482f269eceb7b1a7e8fc618bf8c082dd24979cf1" }
 vergen = { version = "^8.2.1", default-features = false, features = [
   "build",
   "git",

Cross.toml

@@ -0,0 +1,9 @@
+[build]
+    default-target = "x86_64-unknown-linux-musl"
+
+[build.env]
+    passthrough = [ "BUILD_SPIN_EXAMPLES", "RUSTFLAGS", ]
+
+[target.aarch64-unknown-linux-musl]
+    dockerfile.file = "./cross/Dockerfile"
+    dockerfile.context = "./cross/"

cross/Dockerfile

@@ -0,0 +1,6 @@
+ARG CROSS_BASE_IMAGE
+FROM $CROSS_BASE_IMAGE
+
+RUN --mount=type=bind,source=/,target=/polyfill /polyfill/polyfill.sh
+
+

cross/README.md

@@ -0,0 +1,8 @@
+# Polyfill for missing SIMD intrinsics in `cross-rs` image for target `aarch64-unknown-linux-musl`
+
+A transitive dependency of spin (`llama.cpp` via `ggml`) uses the `vld1q_s8_x4` and `vld1q_u8_x4` compiler built-in SIMD intrinsics.
+These intrinsics are missing for `aarch64` in `gcc < 10.3`, while `cross-rs` ships with `gcc 9` for `aarch64-unknown-linux-musl` as of writing.
+
+The code in this folder does a feature check and patches the `arm_neon.h` header with polyfills if the functions are missing.
+
+See https://github.com/fermyon/spin/issues/1786 for the upstream issue.

cross/polyfill.sh

@@ -0,0 +1,16 @@
+#!/bin/sh
+
+ROOT="$(dirname "$0")"
+echo "ROOT=$ROOT"
+ARM_NEON_PATH="$(aarch64-linux-musl-gcc -E "$ROOT/test_vld1q_s8_x4.c" | grep -m1 "arm_neon.h" | sed -En 's|.*"(/usr/local/[^"]*/arm_neon.h)".*|\1|p')"
+echo "ARM_NEON_PATH=$ARM_NEON_PATH"
+if command -v aarch64-linux-musl-gcc > /dev/null; then
+    if ! aarch64-linux-musl-gcc -Werror=implicit-function-declaration -c -o /dev/null "$ROOT/test_vld1q_u8_x4.c"; then
+        echo "Polyfilling vld1q_u8_x4"
+        cat "$ROOT/polyfill_vld1q_u8_x4.h" >> $ARM_NEON_PATH
+    fi
+    if ! aarch64-linux-musl-gcc -Werror=implicit-function-declaration -c -o /dev/null "$ROOT/test_vld1q_s8_x4.c"; then
+        echo "Polyfilling vld1q_s8_x4"
+        cat "$ROOT/polyfill_vld1q_s8_x4.h" >> $ARM_NEON_PATH
+    fi
+fi

cross/polyfill_vld1q_s8_x4.h

@@ -0,0 +1,14 @@
+#ifndef __POLYFILL_VLD1Q_S8_X4__
+#define __POLYFILL_VLD1Q_S8_X4__
+
+inline int8x16x4_t vld1q_s8_x4(const int8_t *p)
+{
+    int8x16x4_t ret;
+    ret.val[0] = vld1q_s8(p + 0);
+    ret.val[1] = vld1q_s8(p + 16);
+    ret.val[2] = vld1q_s8(p + 32);
+    ret.val[3] = vld1q_s8(p + 48);
+    return ret;
+}
+
+#endif // __POLYFILL_VLD1Q_S8_X4__

cross/polyfill_vld1q_u8_x4.h

@@ -0,0 +1,14 @@
+#ifndef __POLYFILL_VLD1Q_U8_X4__
+#define __POLYFILL_VLD1Q_U8_X4__
+
+inline uint8x16x4_t vld1q_u8_x4(const uint8_t *p)
+{
+    uint8x16x4_t ret;
+    ret.val[0] = vld1q_u8(p + 0);
+    ret.val[1] = vld1q_u8(p + 16);
+    ret.val[2] = vld1q_u8(p + 32);
+    ret.val[3] = vld1q_u8(p + 48);
+    return ret;
+}
+
+#endif // __POLYFILL_VLD1Q_U8_X4__

cross/test_vld1q_s8_x4.c

@@ -0,0 +1,2 @@
+#include <arm_neon.h>
+void test() { vld1q_s8_x4(0); }

cross/test_vld1q_u8_x4.c

@@ -0,0 +1,2 @@
+#include <arm_neon.h>
+void test() { vld1q_u8_x4(0); }