Repository navigation
Build the Go bindings with the go.mod toolchain - #292
nakulmanimala wants to merge 1 commit into
Conversation
gomobile bind compiles in a temporary module that keeps the netbird submodule's go directive (1.26.0) but drops its toolchain directive (go1.26.7), and actions/setup-go also installs the go-directive release. Releases since v0.6.0 were therefore built with Go 1.26.0, whose 32-bit runtime probes futex_time64. The Android 8-10 seccomp filter kills the app with SIGSYS instead of returning ENOSYS, so armeabi-v7a devices on those releases crash at launch (golang/go#77621, fixed in Go 1.26.3). Export GOTOOLCHAIN from the submodule's toolchain directive so every go invocation, including the one inside gomobile bind, uses the pinned release, in CI and in local builds alike. Fixes netbirdio#272
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Toolchain pin and build integration build-android-lib.sh |
Adds pin_go_toolchain to export the toolchain directive from go.mod as GOTOOLCHAIN when present. Calls the function after ensure_ndk and before gomobile tooling and binding. |
Priority:
Estimated code review effort: 2 (Simple) | ~10 minutes
Change: Bug fix · Severity of issue fixed: Medium
Suggested reviewers: pappz
Merge Risk: 
3b879
-
The toolchain pin is applied correctly before the Android bindings are built, with no identified merge-blocking risk.
Security architecture risk: 3b879
-
The change makes Android binding builds use the repository-pinned Go release without adding permissions, changing application trust boundaries, or weakening Android protections. No material security risk introduced or worsened by this change was identified.
Retained concerns
No architecture-level concerns identified.Security review details
-
Security Blast Radius
- inferred — The changed authority is compiler selection within the Android build process, with downstream influence on the generated AAR and packaged applications. The inspected change adds no credential access, IAM permissions, network exposure, or application authorization path.
Trust Boundaries and Controls
- inferred — Toolchain authority is derived from the checked-out submodule, not a new remote request or user-input channel. The value is exported without shell evaluation. Control of that build input already lies within the repository-controlled source boundary; the inspected change does not establish a new lower-trust path to runner execution.
-
Pre-merge checks: 
-
Check name Status Explanation Resolution Docstring Coverage Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 1 files. Write docstrings for the functions missing them to satisfy the coverage threshold. -
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title clearly and concisely describes the main change: building Go bindings with the toolchain specified in go.mod. Linked Issues check The directly linked open issue is #272. The change reads the NetBird submodule'stoolchaindirective and exportsGOTOOLCHAINbeforegomobile bind. This prevents the affected Go 1.26.0–1.26.2 bin…Out of Scope Changes check The reviewed change adds pin_go_toolchainand calls it before the Go mobile binding build. The function supports the stated Android crash fix because it applies the submodule's pinned Go toolchain t…Full details: Linked Issues check
-
Explanation
The directly linked open issue is
#272. The change reads the NetBird submodule'stoolchaindirective and exportsGOTOOLCHAINbeforegomobile bind. This prevents the affected Go 1.26.0–1.26.2 binding build on 32-bit Android. The PR reports that an Android 10 armeabi-v7a build starts, permits login, and connects. This implements the issue's launch and VPN connection objective. The reported device is a Xiaomi Mi TV, not the Redmi 9C named in#272.
Full details: Out of Scope Changes check
-
Explanation
The reviewed change adds
pin_go_toolchainand calls it before the Go mobile binding build. The function supports the stated Android crash fix because it applies the submodule's pinned Go toolchain to CI and local builds. No unrelated product behavior or unrelated files are included in the supplied change summary.
-
-
Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
A rabbit checks the toolchain trail,
Then pins the Go version without fail.
Before gomobile starts its flight,
The build steps line up just right.
Soft paws cheer the script tonight.
Comment @coderabbitai help to get the list of available commands.
Fixes #272
Related: netbirdio/netbird#8009
Releases since v0.6.0 crash at launch on 32-bit Android 8–10 (SIGSYS, seccomp blocks
futex_time64). The Go bindings are built with Go 1.26.0 instead of the go.mod toolchain go1.26.7:actions/setup-goreads only thegodirective, andgomobile bindbuilds in a temporary module that drops thetoolchaindirective. Go 1.26.0–1.26.2 have the bug (golang/go#77621).This exports
GOTOOLCHAINfrom the submodule'stoolchainline inbuild-android-lib.sh, so CI and local builds both use the pinned release.Tested:
libgojni.soin the v0.6.2 release APK reportsgo1.26.0. With this change it reportsgo1.26.7, built with go1.26.0 (as CI installs it) and with go1.25.6 on PATH.Summary by CodeRabbit