Add support for publishing aarch64-unknown-linux-musl binaries (#659)

This adds publishing of (cross-compiled) aarch64-unknown-linux-musl
binaries for cargo-deny releases.

---------

Signed-off-by: Mark S <the@wondersmith.dev>
Co-authored-by: Jake Shadle <jake.shadle@embark-studios.com>

.github/musl-cross.sh

@@ -0,0 +1,21 @@
+#!/bin/env bash
+set -e
+
+root="$RUNNER_TEMP/musl"
+bin="$root/bin"
+target="aarch64-linux-musl"
+mkdir -p "$root"
+curl -fsSL "https://musl.cc/$target-cross.tgz" | tar --strip-components=1 -C "$root" -xzf -
+
+MUSL_INCLUDE="$(find "$root/lib/gcc/$target/" -maxdepth 2 -type d -name 'include' | head -n 1)"
+
+echo "$bin" >> "$GITHUB_PATH"
+
+{
+    echo "AR_aarch64_unknown_linux_musl=$bin/$target-ar";
+    echo "CC_aarch64_unknown_linux_musl=$bin/$target-gcc";
+    echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER=$bin/$target-ld";
+    echo "CFLAGS_aarch64_unknown_linux_musl=-nostdinc -nostdlib -isystem$root/$target/include -I ${MUSL_INCLUDE}";
+} >> "$GITHUB_ENV"
+
+unset CFLAGS MUSL_INCLUDE

.github/workflows/ci.yaml

@@ -128,19 +128,23 @@ jobs:
       matrix:
         include:
           - os: ubuntu-22.04
-            rust: stable
+            toolchain: stable
             target: x86_64-unknown-linux-musl
             bin: cargo-deny
+          - os: ubuntu-22.04
+            toolchain: stable
+            target: aarch64-unknown-linux-musl
+            bin: cargo-deny
           - os: windows-2022
-            rust: stable
+            toolchain: stable
             target: x86_64-pc-windows-msvc
             bin: cargo-deny.exe
           - os: macos-14
-            rust: stable
+            toolchain: stable
             target: x86_64-apple-darwin
             bin: cargo-deny
           - os: macos-14
-            rust: stable
+            toolchain: stable
             target: aarch64-apple-darwin
             bin: cargo-deny
     runs-on: ${{ matrix.os }}
@@ -149,12 +153,14 @@ jobs:
       - name: Install stable toolchain
         uses: dtolnay/rust-toolchain@master
         with:
-          toolchain: ${{ matrix.rust }}
           target: ${{ matrix.target }}
+          toolchain: ${{ matrix.toolchain }}
       - name: Install musl tools
-        if: matrix.target == 'x86_64-unknown-linux-musl'
-        run: |
-          sudo apt-get install -y musl-tools
+        if: ${{ endsWith( matrix.target, '-unknown-linux-musl' ) }}
+        run: sudo apt-get update -y && sudo apt-get install -y musl-tools
+      - name: Install arm64 extras
+        if: ${{ matrix.target == 'aarch64-unknown-linux-musl' }}
+        run: .github/musl-cross.sh
       - uses: Swatinem/rust-cache@v2
       - name: cargo fetch
         run: cargo fetch --target ${{ matrix.target }}
@@ -168,12 +174,17 @@ jobs:
           release_name="$name-$tag-${{ matrix.target }}"
           release_tar="${release_name}.tar.gz"
           mkdir "$release_name"
+          binary="target/${{ matrix.target }}/release/${{ matrix.bin }}"
 
           if [ "${{ matrix.target }}" != "x86_64-pc-windows-msvc" ]; then
-              strip "target/${{ matrix.target }}/release/${{ matrix.bin }}"
+              if [ "${{ matrix.target }}" == "aarch64-unknown-linux-musl" ]; then
+                $RUNNER_TEMP/musl/bin/aarch64-linux-musl-strip "$binary"
+              else
+                strip "$binary"
+              fi
           fi
 
-          cp "target/${{ matrix.target }}/release/${{ matrix.bin }}" "$release_name/"
+          cp "$binary" "$release_name/"
           cp README.md LICENSE-APACHE LICENSE-MIT "$release_name/"
           tar czvf "$release_tar" "$release_name"
 
@@ -223,6 +234,6 @@ jobs:
 
   test_success:
     runs-on: ubuntu-22.04
-    needs: [typos,lint,test,self,publish-check,doc-book]
+    needs: [typos, lint, test, self, publish-check, doc-book]
     steps:
-    - run: echo "All test jobs passed"
+      - run: echo "All test jobs passed"

src/cargo-deny/check.rs

@@ -77,11 +77,11 @@ pub struct Args {
     /// Defaults to <cwd>/deny.toml if not specified
     #[arg(short, long)]
     pub config: Option<PathBuf>,
-    /// Path to graph_output root directory
+    /// Path to graph output root directory
     ///
     /// If set, a dotviz graph will be created for whenever multiple versions of the same crate are detected.
     ///
-    /// Each file will be created at <dir>/graph_output/<crate_name>.dot. <dir>/graph_output/* is deleted and recreated each run.
+    /// Each file will be created at `<dir>/graph_output/<crate_name>.dot`. `<dir>/graph_output/*` is deleted and recreated each run.
     #[arg(short, long)]
     pub graph: Option<PathBuf>,
     /// Hides the inclusion graph when printing out info for a crate

tests/snapshots/cargo_deny__test__cargo_deny-check.snap

@@ -19,11 +19,11 @@ Options:
           Defaults to <cwd>/deny.toml if not specified
 
   -g, --graph <GRAPH>
-          Path to graph_output root directory
+          Path to graph output root directory
 
           If set, a dotviz graph will be created for whenever multiple versions of the same crate are detected.
 
-          Each file will be created at <dir>/graph_output/<crate_name>.dot. <dir>/graph_output/* is deleted and recreated each run.
+          Each file will be created at `<dir>/graph_output/<crate_name>.dot`. `<dir>/graph_output/*` is deleted and recreated each run.
 
       --hide-inclusion-graph
           Hides the inclusion graph when printing out info for a crate
@@ -61,4 +61,3 @@ Options:
 
   -V, --version
           Print version
-