Support cross-building aarch64 unikernels on macOS

Apple clang emits ELF with `-target aarch64-linux-gnu`, so we can
cross-compile unikernels on macOS using ld.lld and llvm-objcopy.

Author: samoht

.github/workflows/macos.yml

@@ -0,0 +1,19 @@
+name: macOS
+on: [push, pull_request]
+jobs:
+  Build:
+    name: ARM64
+    runs-on: macos-15
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Install dependencies
+        run: brew install llvm
+      - name: Build
+        run: |
+          export PATH="$(brew --prefix llvm)/bin:$PATH"
+          env TARGET_CC="clang -target aarch64-linux-gnu" \
+            TARGET_LD=ld.lld TARGET_OBJCOPY=llvm-objcopy \
+            ./configure.sh --prefix="$PWD/_install"
+          make V=1
+          make V=1 install

CHANGES.md

@@ -1,3 +1,8 @@
+## Unreleased
+
+- Support cross-building aarch64 unikernels on macOS using the LLVM cross
+  tools (#641 @samoht)
+
 ## v0.11.0 (2026-05-28)
 
 - Lint our codebase with few warnings (@dinosaure, @hannesm, @MisterDA, #632)

GNUmakefile

@@ -32,6 +32,10 @@ tests: bindings elftool
 .PHONY: build
 ifdef CONFIG_DISABLE_TOOLCHAIN
 build: elftool tenders
+else ifeq ($(CONFIG_HOST),Darwin)
+# macOS host: only the cross toolchain and target bindings are buildable here.
+# elftool needs Linux's <elf.h>, and the tenders are Linux/BSD-only.
+build: toolchain bindings
 else
 build: $(SUBDIRS)
 endif
@@ -184,6 +188,10 @@ endif
 install: MAKECMDGOALS :=
 ifdef CONFIG_DISABLE_TOOLCHAIN
 install: install-tools install-tenders
+else ifeq ($(CONFIG_HOST),Darwin)
+# macOS host: no host tools or tenders are built here, only the cross
+# toolchain and bindings (see the build target above).
+install: install-headers install-toolchain
 else
 install: install-tools install-tenders install-headers install-toolchain
 endif

configure.sh

@@ -294,6 +294,17 @@ case ${HOST_CC_MACHINE} in
             echo "#undef HAVE_VMM_H" >tenders/hvt/hvt_openbsd_config.h
         fi
         ;;
+    arm64-*darwin*|aarch64-*darwin*)
+        CONFIG_HOST_ARCH=aarch64 CONFIG_HOST=Darwin
+        # Apple clang emits Mach-O, not ELF, and macOS ships no GNU cross
+        # binutils, so building the target toolchain and bindings here needs
+        # an explicit ELF cross compiler. The tenders are Linux/BSD-only and
+        # are not built on macOS.
+        [ -z "${TARGET_CC}" ] && \
+            die "macOS host requires an ELF cross toolchain: set TARGET_CC" \
+                "(e.g. TARGET_CC='clang -target aarch64-linux-gnu')," \
+                "TARGET_LD and TARGET_OBJCOPY"
+        ;;
     *)
         die "Unsupported host toolchain: ${HOST_CC_MACHINE}"
         ;;
@@ -495,6 +506,15 @@ case ${CONFIG_HOST} in
         TARGET_LD_LDFLAGS="-nopie --no-execute-only"
         TARGET_CC_CFLAGS="${TARGET_CC_CFLAGS} -fno-emulated-tls"
         ;;
+    Darwin)
+        # Cross-building ELF unikernels from macOS: the LLVM cross tools
+        # (clang -target, ld.lld, llvm-objcopy) stand in for the GNU binutils
+        # Apple does not ship. Same ELF build-id/-no-pie handling as the Linux
+        # "cc as linker" case.
+        TARGET_LD="${TARGET_LD:-ld.lld}"
+        TARGET_OBJCOPY="${TARGET_OBJCOPY:-llvm-objcopy}"
+        TARGET_CC_LDFLAGS="-Wl,--build-id=none,-no-pie"
+        ;;
     *)
         die "Unsupported host system: ${CONFIG_HOST}"
         ;;

opam/solo5-cross-aarch64.opam

@@ -10,14 +10,18 @@ bug-reports: "https://github.com/solo5/solo5/issues"
 license: "ISC"
 dev-repo: "git+https://github.com/solo5/solo5.git"
 build: [
-  ["env" "TARGET_CC=aarch64-linux-gnu-gcc" "TARGET_LD=aarch64-linux-gnu-ld" "TARGET_OBJCOPY=aarch64-linux-gnu-objcopy" "./configure.sh" "--prefix=%{prefix}%"]
+  ["env" "TARGET_CC=aarch64-linux-gnu-gcc" "TARGET_LD=aarch64-linux-gnu-ld" "TARGET_OBJCOPY=aarch64-linux-gnu-objcopy" "./configure.sh" "--prefix=%{prefix}%"] {os != "macos"}
+  ["env" "TARGET_CC=clang -target aarch64-linux-gnu" "TARGET_LD=ld.lld" "TARGET_OBJCOPY=llvm-objcopy" "./configure.sh" "--prefix=%{prefix}%"] {os = "macos"}
   [make "V=1"]
 ]
-install: [make "V=1" "install-toolchain"]
+install: [
+  [make "V=1" "install-toolchain"]
+  [make "V=1" "install-headers"] {os = "macos"}
+]
 depends: [
   "conf-pkg-config" {build & os = "linux"}
   "conf-libseccomp" {build & os = "linux"}
-  "solo5" {= version}
+  "solo5" {= version & os != "macos"}
 ]
 depexts: [
   ["linux-headers"] {os-distribution = "alpine"}
@@ -27,8 +31,8 @@ depexts: [
   ["gcc-aarch64-linux-gnu"] {os-family = "debian"}
 ]
 available: [
-  (arch != "arm64") &
-  (os = "linux" & os-family = "debian")
+  ((arch != "arm64") & (os = "linux" & os-family = "debian"))
+  | (os = "macos" & arch = "arm64")
 ]
 synopsis: "Solo5 sandboxed execution environment"
 description: """