Repository navigation
fix(release): build Android libraries with 16 KB-aligned LOAD segments - #56
Merged
Merged
Conversation
Release 0.6.13's aarch64 and x86_64 libhttp_proxy.so have every LOAD segment aligned to 4 KB: the release workflow links them with NDK r26d, whose clang driver passes a 4 KB max page size. Android 15+ devices running 16 KB pages cannot load such a library, and Google Play rejects it for those targets. Local builds were already fine because build-native.ps1 uses NDK 28.2. - build-deploy.yaml: NDK r26d -> r28c (28.2.13676358), the flutter.ndkVersion of the pinned Flutter SDK and build-native.ps1's default. r28 aligns to 16 KB by default and still supports API 24. - verify-native-assets.py: read each 64-bit Android library's program headers and refuse to publish one with a LOAD segment below 16 KB, so a toolchain change cannot silently regress this. armv7 is exempt (32-bit). - docs/android-vpn.md: name the shared NDK and the new release check. Built proxy-ffi --release for both targets with NDK r28c: all LOAD segments 0x4000. The new check rejects the published 0.6.13 libraries and accepts these. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This was referenced Oct 27, 2026
acking-you
added a commit
that referenced
this pull request
Oct 28, 2026
Native 0.6.14 carries the toolchain and dependency upgrade (#55, with the review fixes in tun2proxy, ipstack, kanal-plus 0.2.2 and mimalloc), Android libraries with 16 KB-aligned LOAD segments and a release gate for them (#56), and the QUIC/TCP switching tracking from #54. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The released Android libraries are not 16 KB page-aligned. This PR builds them with an NDK that aligns to 16 KB and makes the release job refuse to publish one that isn't.
Evidence
Release 0.6.13 (
libhttp_proxy-0.6.13-{aarch64,x86_64}-linux-android.tar.gz, SHA-256 matching GitHub's digests): every LOAD segment oflibhttp_proxy.sois aligned to0x1000(4 KB).docs/android-vpn.mdrequires0x4000or more. Android 15+ devices running 16 KB pages cannot load such a library, and Google Play rejects it for those targets.Cause:
build-deploy.yamllinks with NDK r26d, whose clang driver passes a 4 KB max page size. rustc adds no page-size flag for Android. Local builds were fine, becausescripts/android/build-native.ps1defaults to NDK 28.2.Change
build-deploy.yaml: NDK r26d → r28c (28.2.13676358). That is theflutter.ndkVersionof the pinned Flutter SDK (3.47.7 and 3.47.8) andbuild-native.ps1's default, so app, local and release builds now share one NDK. r28 aligns to 16 KB by default and still supports API 24.verify-native-assets.py: parses eachaarch64-linux-android/x86_64-linux-androidlibhttp_proxy.so's ELF program headers and fails the release if any LOAD segment is below 16 KB. armv7 is 32-bit and exempt. One new test covers the rejection; the fixtures for those two targets are now minimal 16 KB-aligned ELF files.docs/android-vpn.md: names the shared NDK and the new check.Verified
cargo build -p proxy-ffi --locked --release --target {aarch64,x86_64}-linux-android. Every LOAD segment is0x4000(llvm-readelf -lW).python3 -m unittest discover -s scripts/release -p 'test_*.py': 5 tests OK.make fmtclean.make clippyshows only the existinginfallible_destructuring_matchwarning inproxy-client.Not verified
nttld/setup-ndkresolvingr28con ubuntu-latest is untested. The action documentsrNNxversions, the same form as the oldr26d.Independent of #55 (the dependency upgrade); either can land first.
🤖 Generated with Claude Code