Bug 40093: Ensure application-services libs do not include libc networking symbols

This compiles and links NSS/application-services with lto, and also adds a check
which will make the building of the application-services project fail if it finds
networking symbols in the final built libraries.

projects/application-services/build

@@ -97,12 +97,25 @@ patch -p1 < $rootdir/1651662.patch
   export LANG=C.UTF-8
   patch -p1 < $rootdir/mavenLocal.patch
   gradle_flags="--offline --no-daemon -Dmaven.repo.local=$gradle_repo"
+  patch -p1 < $rootdir/lto.patch
+  # Set the right flags for cross-language LTO and override linking opt level, since
+  # lld does not understand -Os or -Oz.
+  export RUSTFLAGS="-Clinker-plugin-lto -Clink-arg=-fuse-ld=lld -Clink-arg=-Wl,-plugin-opt=O2"
   $GRADLE_HOME/gradle-6.3/bin/gradle $gradle_flags assembleRelease
   $GRADLE_HOME/gradle-6.3/bin/gradle $gradle_flags publish
 
   cd build
   find maven -regex '.*[0-9].\(aar\|pom\)' -exec cp --parents {} $distdir \;
 
+  # Verify that the compiled libs do not have libc networking symbols
+  # (list adapted from https://searchfox.org/mozilla-central/rev/30e70f2fe80c97bfbfcd975e68538cefd7f58b2a/python/mozbuild/mozbuild/action/check_binary.py#217)
+  tmpdir=$(mktemp -d)
+  find $distdir -name '*.aar' -exec mkdir -p $tmpdir/{} \; -exec unzip {} -d $tmpdir/{} \;
+  if find $tmpdir -name '*.so' | xargs objdump -Tt | grep "*UND*" | grep "connect\|accept\|listen\|sock\|recv\|send\|host\|serv\|proto"; then
+    echo "Error: networking symbols found"
+    exit 1
+  fi
+
   cd /var/tmp/dist
   [% c('tar', {
       tar_src => [ project ],

projects/application-services/config

@@ -91,3 +91,5 @@ input_files:
   - filename: target.patch
   - filename: 1651660.patch
   - filename: 1651662.patch
+  - filename: lto.patch
+    enable: '[% !c("var/fetch_gradle_dependencies") %]'

projects/application-services/lto.patch

+diff --git a/Cargo.toml b/Cargo.toml
+index 93006d8b..2c9ae848 100644
+--- a/Cargo.toml
++++ b/Cargo.toml
+@@ -39,4 +39,4 @@ members = [
+ [profile.release]
+ opt-level = "s"
+ debug = true
+-lto = "thin"
++lto = "fat"

projects/nss/build

@@ -52,6 +52,10 @@ patch -p2 < $rootdir/config.patch
 # side.
 patch -p2 < $rootdir/bug_13028.patch
 
+# Enable LTO
+export CFLAGS="-flto"
+export LDFLAGS="-flto"
+
 # Building NSPR
 mkdir $builddir/nspr_build
 cd $builddir/nspr_build