fix: Statically link fuzzing builds (#2548)

* ci: Don't use `quickinstall` for `cargo-fuzz`

See rust-fuzz/cargo-fuzz#398

* Space

* Optimize

* CARGO_PROFILE_RELEASE_LTO=false

* static

* More

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Finalize

Author: larseggert

.github/workflows/check.yml

@@ -48,10 +48,17 @@ jobs:
         os: [ubuntu-24.04, ubuntu-24.04-arm, macos-14, windows-2025]
         rust-toolchain: ${{ fromJSON(needs.toolchains.outputs.toolchains) }}
         type: [debug]
+        # Include some dynamically-linked release builds, to check that that works on all platforms.
         include:
           - os: ubuntu-24.04
             rust-toolchain: stable
             type: release
+          - os: macos-14
+            rust-toolchain: stable
+            type: release
+          - os: windows-2025
+            rust-toolchain: stable
+            type: release
     env:
       BUILD_TYPE: ${{ matrix.type == 'release' && '--release' || '' }}
     runs-on: ${{ matrix.os }}

.github/workflows/fuzz-bench.yml

@@ -44,10 +44,8 @@ jobs:
         env:
           UBUNTU: ${{ startsWith(matrix.os, 'ubuntu') }}
         run: |
-          # FIXME: https://github.com/rust-fuzz/cargo-fuzz/issues/404
-          [ "$UBUNTU" = "true" ] && FUZZ_FLAGS="-s none"
-          # shellcheck disable=SC2086
-          cargo fuzz build $FUZZ_FLAGS
+          # FIXME: https://github.com/rust-fuzz/cargo-fuzz/issues/384 for why no LTO.
+          CARGO_PROFILE_RELEASE_LTO=false cargo fuzz build
 
       - if: ${{ matrix.check == 'bench' }}
         run: cargo bench --features bench --no-run

neqo-crypto/build.rs

@@ -56,13 +56,6 @@ struct Bindings {
     cplusplus: bool,
 }
 
-fn is_debug() -> bool {
-    // Check the build profile and not whether debug symbols are enabled (i.e.,
-    // `env::var("DEBUG")`), because we enable those for benchmarking/profiling and still want
-    // to build NSS in release mode.
-    env::var("PROFILE").unwrap_or_default() == "debug"
-}
-
 // bindgen needs access to libclang.
 // On windows, this doesn't just work, you have to set LIBCLANG_PATH.
 // Rather than download the 400Mb+ files, like gecko does, let's just reuse their work.
@@ -138,31 +131,34 @@ fn build_nss(dir: PathBuf, nsstarget: &str) {
 }
 
 fn dynamic_link() {
-    let libs = if env::consts::OS == "windows" {
-        &["nssutil3.dll", "nss3.dll", "ssl3.dll"]
+    let dynamic_libs = if env::consts::OS == "windows" {
+        [
+            "nssutil3.dll",
+            "nss3.dll",
+            "ssl3.dll",
+            "libplds4.dll",
+            "libplc4.dll",
+            "libnspr4.dll",
+        ]
     } else {
-        &["nssutil3", "nss3", "ssl3"]
+        ["nssutil3", "nss3", "ssl3", "plds4", "plc4", "nspr4"]
     };
-    dynamic_link_both(libs);
-}
-
-fn dynamic_link_both(extra_libs: &[&str]) {
-    let nspr_libs = if env::consts::OS == "windows" {
-        &["libplds4", "libplc4", "libnspr4"]
-    } else {
-        &["plds4", "plc4", "nspr4"]
-    };
-    for lib in nspr_libs.iter().chain(extra_libs) {
+    for lib in dynamic_libs {
         println!("cargo:rustc-link-lib=dylib={lib}");
     }
 }
 
 fn static_link() {
-    let mut static_libs = vec![
+    let static_libs = [
         "certdb",
         "certhi",
         "cryptohi",
         "freebl",
+        if env::consts::OS == "windows" {
+            "libnspr4"
+        } else {
+            "nspr4"
+        },
         "nss_static",
         "nssb",
         "nssdev",
@@ -171,30 +167,23 @@ fn static_link() {
         "pk11wrap",
         "pkcs12",
         "pkcs7",
+        if env::consts::OS == "windows" {
+            "libplc4"
+        } else {
+            "plc4"
+        },
+        if env::consts::OS == "windows" {
+            "libplds4"
+        } else {
+            "plds4"
+        },
         "smime",
         "softokn_static",
         "ssl",
     ];
-    if env::consts::OS != "macos" {
-        static_libs.push("sqlite");
-    }
     for lib in static_libs {
         println!("cargo:rustc-link-lib=static={lib}");
     }
-
-    // Dynamic libs that aren't transitively included by NSS libs.
-    let mut other_libs = Vec::new();
-    if env::consts::OS != "windows" {
-        if env::var("CARGO_CFG_TARGET_OS").unwrap_or_default() != "android" {
-            // On Android, pthread is part of libc.
-            other_libs.push("pthread");
-        }
-        other_libs.extend_from_slice(&["dl", "c", "z"]);
-    }
-    if env::consts::OS == "macos" {
-        other_libs.push("sqlite3");
-    }
-    dynamic_link_both(&other_libs);
 }
 
 fn get_includes(nsstarget: &Path, nssdist: &Path) -> Vec<PathBuf> {
@@ -342,7 +331,9 @@ fn setup_standalone(nss: &str) -> Vec<String> {
         "cargo:rustc-link-search=native={}",
         nsslibdir.to_str().unwrap()
     );
-    if is_debug() || env::consts::OS == "windows" {
+    #[expect(unexpected_cfgs, reason = "cargo-fuzz defines fuzzing")]
+    // FIXME: NSPR doesn't build proper dynamic libraries on Windows.
+    if cfg!(any(debug_assertions, fuzzing)) || env::consts::OS == "windows" {
         static_link();
     } else {
         dynamic_link();