Dockerfile.macos

# Cross-compiles JavaScriptCore (PORT=JSCOnly) for macOS on a Linux host:
# clang --target=<arch>-apple-macosx against a pinned macOS SDK, linked with
# ld64.lld. Produces the same bun-webkit tarball layout as mac-release.bash
# does on a real Mac, plus LTO variants the native lanes don't build.
#
# Differences from the native macOS build:
#   - The linker is ld64.lld instead of Apple's ld (required: there is no
#     Apple ld for Linux). Only executables (LLIntOffsetsExtractor, jsc) are
#     linked; the shipped artifacts are static archives.
#   - `mig` is Apple's migcom rebuilt as a Linux host tool (see macos-cross/).
#   - libc++ headers come from the SDK (Apple's libc++), forced via
#     -nostdinc++ so the host LLVM's libc++ can never leak in.
#   - ICU resolves to the SDK's libicucore.tbd + WebKit's bundled headers
#     (USE_APPLE_ICU), same as the native build. No ICU is built or bundled.

ARG MACOS_ARCH="arm64"
# The SDK version + the Command Line Tools release that contains it, as served
# by Apple's software-update catalog (`bun macos-cross/xmac.mjs list`). The
# deployment target — not the SDK — controls the oldest macOS the artifacts
# run on, so this tracks the newest SDK Apple serves. Apple's catalog is a
# rolling window: when this release stops being served, run `list` and bump
# both pins.
ARG MACOS_SDK_VERSION="26.5"
ARG MACOS_SDK_CLT_RELEASE="26.5"
ARG MACOS_DEPLOYMENT_TARGET="13.0"
# Bun runs the vendored xmac tool that fetches the SDK from Apple. Same R2
# mirror .github/actions/setup-bun uses.
ARG BUN_DOWNLOAD_URL="https://pub-5e11e972747a44bf9aaf9394f185a982.r2.dev/releases/latest"
ARG WEBKIT_RELEASE_TYPE=Release
ARG LTO_FLAG=""
ARG MARCH_FLAG="-mcpu=apple-m1"
ARG LLVM_VERSION="21"
ARG LLVM_DEBS_SHA256="4a79b0eae89af72b082997d361198f16aaefce3fa8ad3c56c8e97311ff31dd5f"
ARG BOOTSTRAP_CMDS_TAG="bootstrap_cmds-138"
# Matches the native macOS lane's CMAKE_C_FLAGS (build-reusable.yml) plus -g
# from mac-release.bash. Cross-only additions live in the build stage.
ARG DEFAULT_CFLAGS="-fno-exceptions -fvisibility=hidden -fvisibility-inlines-hidden -O3 -g -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer -faddrsig "
# Per-variant extras (the native lanes' matrix.cpp_flags), e.g.
# -D_LIBCXX_ENABLE_ASSERTIONS=1 for Debug.
ARG CPP_FLAGS=""
ARG ENABLE_MALLOC_HEAP_BREAKDOWN="OFF"
# "address,undefined" for the -asan variants. Linking sanitized executables
# for a darwin target needs the darwin sanitizer runtime dylibs, which a
# Linux LLVM install doesn't ship — they're extracted from the mirrored
# compiler-rt tarball below into clang's resource dir. arm64-only (the
# official LLVM macOS release is arm64-only), so x86_64 ASAN variants would
# fail to link.
ARG ENABLE_SANITIZERS=""
ARG USE_MIMALLOC="OFF"
ARG USE_EXTERNAL_MIMALLOC="OFF"
ARG COMPILER_RT_DARWIN_TAG="compiler-rt-darwin-21.1.8"
ARG COMPILER_RT_DARWIN_SHA256="f9bab8191d63873682ec69492d06cfdf0807a7335c4e9b188ef013b3cc3c9dbc"

FROM ubuntu:24.04 AS base
SHELL ["/bin/bash", "-o", "pipefail", "-c"]

ARG LLVM_VERSION
ARG LLVM_DEBS_SHA256
ARG MACOS_ARCH
ARG MACOS_SDK_VERSION
ARG MACOS_SDK_CLT_RELEASE
ARG MACOS_DEPLOYMENT_TARGET
ARG BUN_DOWNLOAD_URL
ARG COMPILER_RT_DARWIN_TAG
ARG COMPILER_RT_DARWIN_SHA256

RUN apt-get update && apt-get install -y --no-install-recommends \
    wget unzip xz-utils ca-certificates \
    cmake ninja-build make git \
    ruby ruby-getoptlong perl python3 rsync file cpio \
    flex bison \
    lsb-release software-properties-common gnupg \
    && rm -rf /var/lib/apt/lists/*

# Host clang (same version Bun uses) — we cross-compile via --target/-isysroot
# and link with ld64.lld (lld's Mach-O port). The debs are mirrored from
# apt.llvm.org to a GitHub release (see scripts/mirror-llvm-debs.sh) so the
# build doesn't depend on it.
ADD --checksum=sha256:${LLVM_DEBS_SHA256} \
    https://github.com/oven-sh/WebKit/releases/download/llvm-${LLVM_VERSION}-debs/llvm-${LLVM_VERSION}-noble-amd64.tar.gz /tmp/llvm.tar.gz
RUN mkdir -p /tmp/llvm && tar xzf /tmp/llvm.tar.gz -C /tmp/llvm && \
    apt-get update && apt-get install -y /tmp/llvm/*.deb && \
    rm -rf /tmp/llvm /tmp/llvm.tar.gz /var/lib/apt/lists/* && \
    for t in clang clang++ ld64.lld lld llvm-ar llvm-ranlib llvm-nm llvm-cxxfilt; do \
      ln -sf /usr/bin/${t}-${LLVM_VERSION} /usr/local/bin/${t}; \
    done
ENV CC=clang-${LLVM_VERSION}
ENV CXX=clang++-${LLVM_VERSION}
ENV AR=llvm-ar-${LLVM_VERSION}
ENV RANLIB=llvm-ranlib-${LLVM_VERSION}

# Bun — only used to run the vendored xmac tool below.
RUN case "$(uname -m)" in arm64|aarch64) arch=aarch64;; *) arch=x64;; esac && \
    wget -q "${BUN_DOWNLOAD_URL}/bun-linux-${arch}.zip" -O /tmp/bun.zip && \
    unzip -q /tmp/bun.zip -d /tmp && \
    install -m 0755 /tmp/bun-linux-${arch}/bun /usr/local/bin/bun && \
    rm -rf /tmp/bun.zip /tmp/bun-linux-${arch} && \
    bun --version

# macOS SDK — headers, libc++, framework headers, and the .tbd linker stubs
# for libSystem/libicucore/etc. Downloaded directly from Apple's public
# software-update CDN (the Command Line Tools SDK sub-package) by xmac — the
# same tool Bun's own macOS cross-compile uses (scripts/build/macos-sdk.ts) and
# the same model xwin uses for the Windows SDK: every build downloads from
# Apple itself, nothing is redistributed. Integrity is verified against the
# SHA-1 checksums in the package's signed xar table of contents.
COPY macos-cross/xmac.mjs /xmac.mjs
RUN bun /xmac.mjs splat --accept-license --sdk-only \
      --release "${MACOS_SDK_CLT_RELEASE}" --sdk "${MACOS_SDK_VERSION}" \
      --output /tmp/xmac-out --cache-dir /tmp/xmac-cache && \
    mkdir -p /opt && \
    mv /tmp/xmac-out/SDKs/MacOSX${MACOS_SDK_VERSION}.sdk /opt/MacOSX${MACOS_SDK_VERSION}.sdk && \
    rm -rf /tmp/xmac-out /tmp/xmac-cache && \
    test -f /opt/MacOSX${MACOS_SDK_VERSION}.sdk/usr/include/sys/syscall.h
ENV MACOS_SDK=/opt/MacOSX${MACOS_SDK_VERSION}.sdk

# Darwin compiler-rt runtimes (sanitizers + builtins), needed to link
# -fsanitize=address executables for the target. Extracted from the official
# LLVM macOS release and mirrored to a GitHub release so the build doesn't
# pull the full 1.5 GB LLVM distribution (same pattern as gcc-13-focal-debs
# in Dockerfile). Installed into clang's resource dir where the darwin
# driver looks for libclang_rt.*_osx*.
ADD --checksum=sha256:${COMPILER_RT_DARWIN_SHA256} \
    https://github.com/oven-sh/WebKit/releases/download/${COMPILER_RT_DARWIN_TAG}/compiler-rt-darwin-21.1.8-arm64.tar.gz /compiler-rt-darwin.tar.gz
RUN tar -xzf /compiler-rt-darwin.tar.gz -C /usr/lib/llvm-${LLVM_VERSION}/lib/clang/${LLVM_VERSION}/lib/ && \
    rm /compiler-rt-darwin.tar.gz && \
    test -f /usr/lib/llvm-${LLVM_VERSION}/lib/clang/${LLVM_VERSION}/lib/darwin/libclang_rt.asan_osx_dynamic.dylib

# Sanity check: compile + link a Mach-O executable for the target.
RUN echo 'int main(void){return 0;}' | \
      $CC --target=${MACOS_ARCH}-apple-macosx -isysroot $MACOS_SDK \
          -mmacosx-version-min=${MACOS_DEPLOYMENT_TARGET} \
          --ld-path=$(which ld64.lld) -mlinker-version=705 -xc - -o /tmp/t && \
    file /tmp/t | grep -q Mach-O && rm /tmp/t

RUN mkdir -p /output/lib /output/include /output/include/JavaScriptCore /output/include/wtf /output/include/bmalloc

# ───────────────────────────────────────────────────────────────────────────
# mig — the Mach Interface Generator. WTF's APPLE branch runs it on
# MachExceptions.defs to generate the mach_exc RPC stubs its Mach-exception
# signal handling (Wasm OOB trapping, VM watchdog traps) compiles in.
# Apple's migcom is a plain flex/bison program; build it as a host tool
# against the minimal mach type stubs in macos-cross/. See
# macos-cross/README.md for why this is sound.
# ───────────────────────────────────────────────────────────────────────────
FROM base AS build_mig
ARG BOOTSTRAP_CMDS_TAG
COPY macos-cross/ /macos-cross/
RUN git clone --depth=1 --branch ${BOOTSTRAP_CMDS_TAG} \
      https://github.com/apple-oss-distributions/bootstrap_cmds.git /bootstrap_cmds && \
    cd /bootstrap_cmds/migcom.tproj && \
    flex -o lexxer.c lexxer.l && \
    bison -d -o parser.c parser.y && \
    cp parser.h y.tab.h && \
    $CC -O2 -w -I. -I/macos-cross "-D__private_extern__=" -Ulinux \
       "-DMIG_VERSION=\"${BOOTSTRAP_CMDS_TAG}-linux\"" \
       -o /usr/local/bin/migcom \
       error.c global.c header.c mig.c routine.c server.c statement.c \
       string.c type.c user.c utils.c lexxer.c parser.c && \
    install -m 0755 /macos-cross/mig /usr/local/bin/mig && \
    migcom -version

# ───────────────────────────────────────────────────────────────────────────
# WebKit (JSCOnly)
# ───────────────────────────────────────────────────────────────────────────
FROM base AS build_webkit

ARG MACOS_ARCH
ARG MACOS_DEPLOYMENT_TARGET
ARG WEBKIT_RELEASE_TYPE
ARG LTO_FLAG
ARG MARCH_FLAG
ARG DEFAULT_CFLAGS
ARG CPP_FLAGS
ARG ENABLE_MALLOC_HEAP_BREAKDOWN
ARG ENABLE_SANITIZERS
ARG USE_MIMALLOC
ARG USE_EXTERNAL_MIMALLOC

COPY --from=build_mig /usr/local/bin/mig /usr/local/bin/migcom /usr/local/bin/
COPY . /webkit
WORKDIR /webkit

ENV WEBKIT_OUT_DIR=/webkitbuild

# MIGCC/MIGCOM drive macos-cross/mig (the cmake rule just invokes `mig`).
# CMAKE_SYSTEM_NAME=Darwin puts cmake in cross mode and makes APPLE true, so
# WebKit takes the same branches the native macOS build does (USE_APPLE_ICU,
# U_DISABLE_RENAMING, MachExceptions, cocoa/MemoryFootprintCocoa.cpp).
# CMAKE_OSX_SYSROOT/-DEPLOYMENT_TARGET add -isysroot/-mmacosx-version-min.
RUN --mount=type=tmpfs,target=/webkitbuild \
    export CROSS="--target=${MACOS_ARCH}-apple-macosx" && \
    export MIGCC="$(which $CC) -E ${CROSS} -isysroot ${MACOS_SDK}" && \
    export MIGCOM="$(which migcom)" && \
    export ENABLE_ASSERTS="AUTO" && \
    if [ -n "${ENABLE_SANITIZERS}" ]; then export ENABLE_ASSERTS="ON"; fi && \
    export G=$(if [ -n "${LTO_FLAG:-}" ]; then echo "-g1"; fi) && \
    export CFLAGS="${CROSS} ${DEFAULT_CFLAGS} $G ${CPP_FLAGS} ${MARCH_FLAG} ${LTO_FLAG} -ffile-prefix-map=/webkit/Source=vendor/WebKit/Source -ffile-prefix-map=/webkitbuild/=." && \
    export CXXFLAGS="${CROSS} -nostdinc++ -isystem ${MACOS_SDK}/usr/include/c++/v1 ${DEFAULT_CFLAGS} $G ${CPP_FLAGS} ${MARCH_FLAG} ${LTO_FLAG} -fno-c++-static-destructors -ffile-prefix-map=/webkit/Source=vendor/WebKit/Source -ffile-prefix-map=/webkitbuild/=." && \
    cd /webkitbuild && \
    cmake \
    -DCMAKE_SYSTEM_NAME=Darwin \
    -DCMAKE_SYSTEM_PROCESSOR=${MACOS_ARCH} \
    -DCMAKE_OSX_SYSROOT=${MACOS_SDK} \
    -DCMAKE_OSX_DEPLOYMENT_TARGET=${MACOS_DEPLOYMENT_TARGET} \
    -DCMAKE_C_COMPILER=$(which $CC) \
    -DCMAKE_CXX_COMPILER=$(which $CXX) \
    -DCMAKE_AR=$(which $AR) \
    -DCMAKE_RANLIB=$(which $RANLIB) \
    -DPORT=JSCOnly \
    -DENABLE_STATIC_JSC=ON \
    -DENABLE_BUN_SKIP_FAILING_ASSERTIONS=ON \
    -DCMAKE_BUILD_TYPE=${WEBKIT_RELEASE_TYPE} \
    -DUSE_THIN_ARCHIVES=OFF \
    -DUSE_BUN_JSC_ADDITIONS=ON \
    -DUSE_BUN_EVENT_LOOP=ON \
    -DUSE_MIMALLOC="$USE_MIMALLOC" \
    -DUSE_EXTERNAL_MIMALLOC="$USE_EXTERNAL_MIMALLOC" \
    -DENABLE_FTL_JIT=ON \
    -DENABLE_API_TESTS=OFF \
    -DENABLE_MALLOC_HEAP_BREAKDOWN=${ENABLE_MALLOC_HEAP_BREAKDOWN} \
    -DENABLE_SANITIZERS="${ENABLE_SANITIZERS}" \
    -DENABLE_ASSERTS="${ENABLE_ASSERTS}" \
    -DCMAKE_EXPORT_COMPILE_COMMANDS=ON \
    -DALLOW_LINE_AND_COLUMN_NUMBER_IN_BUILTINS=ON \
    -DENABLE_REMOTE_INSPECTOR=ON \
    -DCMAKE_EXE_LINKER_FLAGS="${CROSS} --ld-path=$(which ld64.lld) -mlinker-version=705" \
    -DCMAKE_C_FLAGS="$CFLAGS" \
    -DCMAKE_CXX_FLAGS="$CXXFLAGS" \
    -G Ninja \
    /webkit && \
    cmake --build /webkitbuild --config ${WEBKIT_RELEASE_TYPE} --target jsc --target testFFI && \
    python3 /webkit/Tools/Scripts/check-classinfo-uniqueness.py $WEBKIT_OUT_DIR/bin/jsc && \
    # -L everywhere: WebKit's cmake stages the WTF/bmalloc framework headers
    # as *symlinks* into the source tree when the host filesystem supports
    # them. Copied verbatim they'd dangle outside this container (pointing at
    # /webkit/...), so dereference every copy into /output.
    cp -rL $WEBKIT_OUT_DIR/lib/*.a /output/lib && \
    cp -L $WEBKIT_OUT_DIR/cmakeconfig.h /output/include/cmakeconfig.h && \
    cp -rL $WEBKIT_OUT_DIR/WTF/Headers/wtf /output/include && \
    cp -rL $WEBKIT_OUT_DIR/ICU/Headers/* /output/include && \
    mkdir -p /output/include/wtf/include && \
    cp -rL /webkit/Source/WTF/icu/unicode /output/include/wtf/include && \
    cp -rL $WEBKIT_OUT_DIR/bmalloc/Headers/bmalloc /output/include && \
    cp -fL $WEBKIT_OUT_DIR/JavaScriptCore/Headers/JavaScriptCore/* /output/include/JavaScriptCore/ && \
    cp -fL $WEBKIT_OUT_DIR/JavaScriptCore/PrivateHeaders/JavaScriptCore/* /output/include/JavaScriptCore/ && \
    cp -fL $WEBKIT_OUT_DIR/JavaScriptCore/DerivedSources/*.h /output/include/JavaScriptCore/ && \
    cp -fL $WEBKIT_OUT_DIR/JavaScriptCore/DerivedSources/*/*.h /output/include/JavaScriptCore/ && \
    mkdir -p /output/Source/JavaScriptCore && \
    cp -rL /webkit/Source/JavaScriptCore/Scripts /output/Source/JavaScriptCore && \
    cp -L /webkit/Source/JavaScriptCore/create_hash_table /output/Source/JavaScriptCore && \
    cp -rL $WEBKIT_OUT_DIR/bin /output/bin && \
    test -z "$(find /output/include -type l -print -quit)" || { echo "ERROR: dangling symlinks in /output/include"; find /output/include -type l | head; exit 1; }

FROM scratch AS artifact
COPY --from=build_webkit /output /