build armv7l images (#669)

* build armv7l images

* Update build-docker-images.yml

* Don't use `enable-ec_nistp_64_gcc_128` on armv7l

* hack?

* We are an armv4 build

Author: alex

.github/workflows/build-docker-images.yml

@@ -66,6 +66,10 @@ jobs:
           - {TAG_NAME: "cryptography-runner-ubuntu-rolling:aarch64", DOCKERFILE_PATH: "runners/ubuntu", BUILD_ARGS: "RELEASE=rolling", RUNNER: "ubuntu-24.04-arm"}
           - {TAG_NAME: "cryptography-runner-alpine:aarch64", DOCKERFILE_PATH: "runners/alpine", RUNNER: "ubuntu-24.04-arm"}
 
+          - {TAG_NAME: "cryptography-runner-ubuntu-rolling:armv7l", DOCKERFILE_PATH: "runners/ubuntu", DOCKER_PLATFORM: "linux/arm/v7", BUILD_ARGS: "RELEASE=rolling", RUNNER: "ubuntu-24.04-arm"}
+
+          - {TAG_NAME: "cryptography-manylinux_2_31:armv7l", DOCKERFILE_PATH: "cryptography-linux", DOCKER_PLATFORM: "linux/arm/v7", BUILD_ARGS: "PYCA_RELEASE=manylinux_2_31_armv7l", RUNNER: "ubuntu-24.04-arm"}
+
     name: "${{ matrix.IMAGE.TAG_NAME }}"
     steps:
       - uses: actions/[email protected]
@@ -106,6 +110,7 @@ jobs:
           context: ${{ matrix.IMAGE.DOCKERFILE_PATH }}
           cache-from: ghcr.io/pyca/${{ matrix.IMAGE.TAG_NAME }}
           tags: ghcr.io/pyca/${{ matrix.IMAGE.TAG_NAME }}
+          platforms: ${{ matrix.IMAGE.DOCKER_PLATFORM }}
           pull: true
           build-args: |
             NODE_ARCH_RELEASE=${{ env.NODE_ARCH_RELEASE }}

cryptography-linux/install_openssl.sh

@@ -8,7 +8,13 @@ curl -#LO "${OPENSSL_URL}/${OPENSSL_VERSION}/${OPENSSL_VERSION}.tar.gz"
 echo "${OPENSSL_SHA256}  ${OPENSSL_VERSION}.tar.gz" | sha256sum -c -
 tar zxf ${OPENSSL_VERSION}.tar.gz
 pushd ${OPENSSL_VERSION}
-./config $OPENSSL_BUILD_FLAGS --prefix=/opt/pyca/cryptography/openssl --openssldir=/opt/pyca/cryptography/openssl
+BUILD_FLAGS="$OPENSSL_BUILD_FLAGS"
+# Can't use `$(uname -m) = "armv7l"` because that returns what kernel we're
+# using, and we build for armv7l with an ARM64 host.
+if [ "$(readelf -h /proc/self/exe | grep -o 'Machine:.* ARM')" ]; then
+    BUILD_FLAGS="$OPENSSL_BUILD_FLAGS_ARMV7L"
+fi
+./config $BUILD_FLAGS --prefix=/opt/pyca/cryptography/openssl --openssldir=/opt/pyca/cryptography/openssl
 make depend
 make -j4
 # avoid installing the docs

cryptography-linux/openssl-version.sh

@@ -3,4 +3,5 @@ export OPENSSL_SHA256="e15dda82fe2fe8139dc2ac21a36d4ca01d5313c75f99f46c4e8a27709
 # We need a base set of flags because on Windows using MSVC
 # enable-ec_nistp_64_gcc_128 doesn't work since there's no 128-bit type
 export OPENSSL_BUILD_FLAGS_WINDOWS="no-ssl3 no-ssl3-method no-zlib no-shared no-module no-comp no-dynamic-engine no-apps no-docs no-sm2-precomp no-atexit"
+export OPENSSL_BUILD_FLAGS_ARMV7L="linux-armv4 ${OPENSSL_BUILD_FLAGS_WINDOWS}"
 export OPENSSL_BUILD_FLAGS="${OPENSSL_BUILD_FLAGS_WINDOWS} enable-ec_nistp_64_gcc_128"