cmd/go: errors when compiling for iOS simulator when using "crypto/x509" package

[lobianco]

Please answer these questions before submitting your issue. Thanks!

What version of Go are you using (go version)?

go version go1.11 darwin/amd64 (also applies to go version go1.10.3 darwin/amd64)

Does this issue reproduce with the latest release?

Yes.

What operating system and processor architecture are you using (go env)?

macOS High Sierra - 10.13.6

GOARCH="amd64"
GOBIN=""
GOCACHE="/Users/xxx/Library/Caches/go-build"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOOS="darwin"
GOPATH="/Users/xxx/go"
GOPROXY=""
GORACE=""
GOROOT="/usr/local/opt/go/libexec"
GOTMPDIR=""
GOTOOLDIR="/usr/local/opt/go/libexec/pkg/tool/darwin_amd64"
GCCGO="gccgo"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
GOMOD=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/f6/h4tbgc1d4f918mtxllg3cxtr0000gn/T/go-build676255332=/tmp/go-build -gno-record-gcc-switches -fno-common"

What did you do?

We've been building a shared library for macOS and iOS for several months now without issues, but recently our simulator build step began to fail. After several days of debugging and googling similar issues, I'm still at a loss.

Our workflow consists of building three separate binaries: one each for macOS, iOS (device), and iOS (simulator). We lipo the two iOS binaries to create a fat binary that can run on both platforms.

We use go build with supplementary flags rather than gomobile. Here's the command that now fails:

❌ iOS (simulator)

env \
GOOS='darwin' \
CC=cc \
CXX=c++ \
CGO_ENABLED=1 \
CGO_CFLAGS="-arch x86_64 -isysroot /Applications/Xcode-beta.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator12.0.sdk -mios-simulator-version-min=12.0" \
CGO_LDFLAGS="-arch x86_64 -isysroot /Applications/Xcode-beta.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator12.0.sdk -mios-simulator-version-min=12.0" \
go build -ldflags -w -v -installsuffix gos -o "dist/apple/go-sim.a" -buildmode=c-archive apple/mainc.go

For reference, here are the other two commands that work fine:

✅ iOS (device)

env \
GOOS='darwin' \
CC=cc \
CXX=c++ \
CGO_ENABLED=1 \
GOARCH=arm64 \
CGO_CFLAGS="-arch arm64 -isysroot /Applications/Xcode-beta.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS12.0.sdk -miphoneos-version-min=12.0" \
CGO_LDFLAGS="-arch arm64 -isysroot /Applications/Xcode-beta.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS12.0.sdk -miphoneos-version-min=12.0" \
go build -ldflags -w -v -installsuffix goi -o "dist/apple/go-iphone.a" -buildmode=c-archive apple/mainc.go

✅ macOS

env \
GOOS='darwin' \
CC=cc \
CXX=c++ \
CGO_ENABLED=1 \
GOARCH=amd64 \
CGO_CFLAGS="-isysroot /Applications/Xcode-beta.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX10.14.sdk -mmacosx-version-min=10.12.6" \
CGO_LDFLAGS="-isysroot /Applications/Xcode-beta.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX10.14.sdk -mmacosx-version-min=10.12.6" \
go build -ldflags -w -v -installsuffix gom -o "dist/apple/go-mac.a" -buildmode=c-archive apple/mainc.go

What did you expect to see?

A successful compile.

What did you see instead?

# crypto/x509
clang: error: invalid argument '-mmacosx-version-min=10.10' not allowed with '-mios-simulator-version-min=12.0'
clang: warning: using sysroot for 'iPhoneSimulator' but targeting 'MacOSX' [-Wincompatible-sysroot]
make: *** [dist/apple/xplatform-sim.a] Error 2

Things I've tried, to no avail

• Building with SDK tools from both Xcode 9 stable and the latest Xcode 10 beta
• Reinstalling Command Line Tools (suggested here:
  crypto/x509: macOS -framework Security produces link warning #26073 (comment))
• Editing root_cgo_darwin.go (referenced from here:
  crypto/x509: contradictory Mac OS X version requirements #17732 (comment))
• Attempting build with both the system-supplied clang and clang++ as well as the ones found in /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin

I've seen similar issues (#25944, #24437, #17732, #26073) but some are either old and already addressed in the latest release of golang, or the proposed solutions did not work.

Completely stuck and banging my head - any ideas?

[lobianco]

Just noticed that #25944 was apparently fixed in golang/mobile@6621de0. It looks to be almost exactly the same as this issue, except that it involves gomobile. Are the two related? Is it possible to cherrypick portions of that fix and apply them in the context of this issue?

[MrRooni]

Following on from Anthony's comments above, we just re-ran a CI pipeline that was previously successful and now fails with the error referenced above:

env \
	GOOS='darwin' \
	CC=cc \
	CXX=c++ \
	CGO_ENABLED=1 \
	GOARCH= \
	CGO_CFLAGS="-arch x86_64 -isysroot /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator11.4.sdk -mios-simulator-version-min=11.0" \
	CGO_LDFLAGS="-arch x86_64 -isysroot /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator11.4.sdk -mios-simulator-version-min=11.0" \
	go build -ldflags -w -v -installsuffix opsim -o ".apple/xplatform-sim.a" -buildmode=c-archive mainc.go
runtime/cgo
os/user
net
vendor/golang_org/x/net/lex/httplex
vendor/golang_org/x/net/proxy
net/textproto
crypto/x509
# crypto/x509
clang: error: invalid argument '-mmacosx-version-min=10.6' not allowed with '-mios-simulator-version-min=11.0'
clang: warning: using sysroot for 'iPhoneSimulator' but targeting 'MacOSX' [-Wincompatible-sysroot]
make: *** [.apple/xplatform-sim.a] Error 2
rm .apple/xplatform-iphone.a
section_end:1536246034:build_script
�[0Ksection_start:1536246034:after_script
�[0Ksection_end:1536246034:after_script
�[0K�[31;1mERROR: Job failed: exit status 1
�[0;m

[rsc]

It looks to me like the -mmacosx-version-min=10.10 is coming from crypto/x509/root_cgo_darwin.go, which says:

// +build cgo,!arm,!arm64,!ios

package x509

/*
#cgo CFLAGS: -mmacosx-version-min=10.10 -D__MAC_OS_X_VERSION_MAX_ALLOWED=101300
#cgo LDFLAGS: -framework CoreFoundation -framework Security
...

Should the iOS builds be using -tags ios or something like that? It sure looks like that file is not meant for use with iOS.

[rsc]

The min=10.6 is what you'd get with an old version of Go. This was changed in 11f6cb4. Same issue.

The fix here seems to be just use -tags ios when building outside gomobile.

[MrRooni]

Thanks @rsc ! This is what we ended up doing.