feat: add self-extracting stub for platforms without UPX support

Author: mhx

.docker/Dockerfile.alpine

@@ -105,6 +105,8 @@ RUN if [ "$ARCH" == "amd64" ] || [ "$ARCH" == "arm64v8" ]; then \
 
 RUN pip3 install --break-system-packages --root-user-action ignore mistletoe
 
+RUN apk add py3-xxhash py3-zstd py3-lz4
+
 # Set up git & user
 RUN git config --global --add safe.directory /workspace
 RUN adduser -G users -s bash -u 1000 -D mhx

CMakeLists.txt

@@ -911,6 +911,26 @@ if(STATIC_BUILD_DO_NOT_USE)
   foreach(tgt ${BINARY_TARGETS} ${TEST_TARGETS})
     target_link_libraries(${tgt} PRIVATE gcc_eh)
   endforeach()
+
+  if(WITH_UNIVERSAL_BINARY OR WITH_FUSE_EXTRACT_BINARY)
+    # Build stub for self-extracting universal binary.
+    add_executable(sfxstub_zstd sfx/stub.c)
+    target_compile_options(sfxstub_zstd PRIVATE -O2)
+
+    if(LIBLZ4_FOUND)
+      add_executable(sfxstub_lz4 sfx/stub.c)
+      target_compile_definitions(sfxstub_lz4 PRIVATE DWARFS_SFX_STUB_USE_LZ4=1)
+      target_link_libraries(sfxstub_lz4 PRIVATE PkgConfig::XXHASH PkgConfig::LIBLZ4)
+    endif()
+
+    foreach(tgt sfxstub_zstd sfxstub_lz4)
+      if(TARGET ${tgt})
+        target_compile_options(${tgt} PRIVATE -fno-stack-protector -fno-asynchronous-unwind-tables)
+        target_link_options(${tgt} PRIVATE -Wl,--build-id=none)
+        list(APPEND BINARY_TARGETS ${tgt})
+      endif()
+    endforeach()
+  endif()
 endif(STATIC_BUILD_DO_NOT_USE)
 
 foreach(tgt ${TEST_TARGETS})
@@ -1040,6 +1060,10 @@ if(STATIC_BUILD_DO_NOT_USE OR WIN32)
     list(APPEND UNIVERSAL_TARGETS dwarfsfuseextract)
   endif()
 
+  if(${CMAKE_SYSTEM_PROCESSOR} MATCHES "^(i386|x86_64|AMD64|aarch64|ppc64le|arm)$")
+    find_program(UPX_EXE upx upx.exe PATHS "c:/bin" DOC "ultimate packer for executables")
+  endif()
+
   foreach(tgt ${UNIVERSAL_TARGETS})
     get_target_property(TARGET_FILENAME ${tgt} OUTPUT_NAME)
     get_filename_component(TARGET_FILENAME ${TARGET_FILENAME} NAME_WLE)
@@ -1055,10 +1079,6 @@ if(STATIC_BUILD_DO_NOT_USE OR WIN32)
         WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
       )
     else()
-      if(${CMAKE_SYSTEM_PROCESSOR} MATCHES "^(i386|x86_64|AMD64|aarch64|ppc64le|arm)$")
-        find_program(UPX_EXE upx upx.exe PATHS "c:/bin" DOC "ultimate packer for executables")
-      endif()
-
       if(UPX_EXE)
         # upx -9 is a good compromise between compression ratio and speed
         # also, anything above --best increases the startup time of the compressed
@@ -1068,12 +1088,40 @@ if(STATIC_BUILD_DO_NOT_USE OR WIN32)
           COMMAND ${UPX_EXE} -9 --best -o ${UNIVERSAL_OUT} $<TARGET_FILE:${tgt}>
           WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
         )
+      elseif(TARGET sfxstub_lz4 OR TARGET sfxstub_zstd)
+        # Fallback if UPX is not found or doesn't support the target architecture.
+        # Prefer lz4 if available (as it is faster), otherwise use zstd.
+        if(TARGET sfxstub_zstd)
+          set(_sfx_stub_target sfxstub_zstd)
+          # Sweet spot between compression ratio and decompression speed.
+          set(_sfx_options "--level=16")
+        else()
+          set(_sfx_stub_target sfxstub_lz4)
+          set(_sfx_options "--lz4")
+        endif()
+        add_custom_command(
+          OUTPUT ${UNIVERSAL_OUT}
+          COMMAND ${CMAKE_SOURCE_DIR}/sfx/pack.py
+                      ${_sfx_options}
+                      --stub $<TARGET_FILE:${_sfx_stub_target}>
+                      --input $<TARGET_FILE:${tgt}>
+                      --output ${UNIVERSAL_OUT}
+          COMMAND ${CMAKE_CROSSCOMPILING_EMULATOR}
+                  ${UNIVERSAL_OUT} --extract-wrapped-binary ${UNIVERSAL_OUT}.extracted
+          COMMAND ${CMAKE_COMMAND} -E compare_files
+                  ${CMAKE_CURRENT_BINARY_DIR}/${UNIVERSAL_OUT}.extracted
+                  $<TARGET_FILE:${tgt}>
+          COMMAND ${CMAKE_COMMAND} -E remove
+                  ${CMAKE_CURRENT_BINARY_DIR}/${UNIVERSAL_OUT}.extracted
+          WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
+          COMMENT "UPX not found/supported, using ${_sfx_stub_target} for universal binary"
+        )
       else()
         add_custom_command(
           OUTPUT ${UNIVERSAL_OUT}
           COMMAND ${CMAKE_COMMAND} -E copy $<TARGET_FILE:${tgt}> ${UNIVERSAL_OUT}
           WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
-          COMMENT "UPX not found, copying binary without compression"
+          COMMENT "UPX not found/supported, copying binary without compression"
         )
       endif()
     endif()

sfx/pack.py

@@ -0,0 +1,68 @@
+#!/usr/bin/env python3
+
+"""
+Create a self-extracting, zstd-compressed binary
+"""
+
+import argparse
+import lz4.block
+import os
+import shutil
+import struct
+import subprocess
+import sys
+import tempfile
+import xxhash
+import zstd
+
+TRAILER_MAGIC = b"SQUEEZE!"
+TRAILER_SIZE = 32
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--stub", required=True)
+    ap.add_argument("--input", required=True)
+    ap.add_argument("--output", required=True)
+    ap.add_argument("--lz4", action="store_true")
+    ap.add_argument("--level", type=int)
+    args = ap.parse_args()
+
+    if args.level is None:
+        args.level = 12 if args.lz4 else 19
+
+    if not os.path.isfile(args.stub):
+        ap.error(f"--stub not found: {args.stub}")
+    if not os.path.isfile(args.input):
+        ap.error(f"--input not found: {args.input}")
+
+    with open(args.input, "rb") as f:
+        payload = f.read()
+
+    u_size = len(payload)
+    u_xxh64 = xxhash.xxh64(payload).intdigest()
+
+    if args.lz4:
+        compressed = lz4.block.compress(
+            payload, mode="high_compression", compression=args.level, store_size=False
+        )
+    else:
+        compressed = zstd.compress(payload, args.level)
+
+    c_size = len(compressed)
+
+    with open(args.stub, "rb") as fstub, open(args.output, "wb") as fout:
+        shutil.copyfileobj(fstub, fout)
+        fout.write(compressed)
+        trailer = TRAILER_MAGIC + struct.pack("<QQQ", u_size, c_size, u_xxh64)
+        assert len(trailer) == TRAILER_SIZE
+        fout.write(trailer)
+
+    os.chmod(args.output, os.stat(args.output).st_mode | 0o111)
+    print(
+        f"OK: wrote {args.output} (orig {u_size} bytes, xxh64=0x{u_xxh64:016x}, payload {c_size} bytes)"
+    )
+
+
+if __name__ == "__main__":
+    main()