feat: Add android build

.cargo/config.toml

@@ -16,5 +16,8 @@ runner = "docker/nix-cargo-runner.sh"
 [target.x86_64-unknown-linux-gnu]
 rustflags = ["-Clinker-features=-lld"] # dont use lld, it has issues with fenix rn
 
+[target.aarch64-linux-android]
+rustflags = ["-C", "debuginfo=line-tables-only", "-C", "strip=debuginfo"]
+
 [alias]
 x = "run -q --package x --"

.github/workflows/rust-ci.yaml

@@ -227,7 +227,54 @@
           if-no-files-found: error
           retention-days: 14
 
+  android-build:
+    name: Android Build
+    runs-on: public-ubuntu-24.04-8core
+    steps:
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # pin@v3
+        with:
+          token: ${{ secrets.ORB_GIT_HUB_TOKEN }}
+      - uses: cachix/install-nix-action@0b0e072294b088b73964f1d72dfdac0951439dbd # pin@v31.8.4
+        with:
+          github_access_token: ${{ secrets.ORB_GIT_HUB_TOKEN }}
+      - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # pin@v15
+        continue-on-error: true
+        with:
+          name: worldcoin
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+      - name: Authorize private git repos
+        run: git config --global url."https://${{ secrets.ORB_GIT_HUB_TOKEN }}@github.com".insteadOf https://github.com
+      - name: Cache cargo dependencies
+        uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # pin@v2.8.0
+        with:
+          key: custom-${{ hashFiles('**/*.nix', 'flake.lock') }}
+      - name: Print environment
+        run: |
+          uname -a
+          nix develop -c env
+
+      - name: Allow unprivileged user namespaces for bubblewrap
+        # apexer's bubblewrap FHS sandbox (nix/packages/android-apex.nix)
+        # always creates a user namespace for CAP_SYS_ADMIN, which Ubuntu
+        # 24.04's AppArmor blocks for unprofiled binaries like nix store
+        # paths ("bwrap: setting up uid map: Permission denied"). Safe to
+        # relax repo-wide here since this runner is ephemeral (ARC); a
+        # persistent host should ship a scoped AppArmor exception instead.
+        run: sudo sysctl --write kernel.apparmor_restrict_unprivileged_userns=0
+      - name: Build and package Android APEXes
+        run: |
+          nix develop -c \
+            cargo x android-apex
+
+      - name: Upload APEX artifacts
+        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # pin@v4.3.3
+        with:
+          name: android-apex
+          path: target/android-apex/*.apex
+          if-no-files-found: error
+          retention-days: 14
+
   cargo-deny:
     name: Cargo Deny
     runs-on: ubuntu-24.04
     if: ${{ !inputs.skip_cargo_deny }}

agentwire/Cargo.toml

@@ -53,4 +53,8 @@ tracing = "0.1"
 tokio = { version = "1", features = ["macros"] }
 
 [package.metadata.orb]
-unsupported_targets = ["aarch64-apple-darwin", "x86_64-apple-darwin"]
+unsupported_targets = [
+	"aarch64-apple-darwin",
+	"x86_64-apple-darwin",
+	"aarch64-linux-android",
+]

bidiff-cli/Cargo.toml

@@ -43,3 +43,6 @@ test-log.workspace = true
 
 [build-dependencies]
 orb-build-info = { workspace = true, features = ["build-script"] }
+
+[package.metadata.orb]
+unsupported_targets = ["aarch64-linux-android"]

bidiff-squashfs/lib/Cargo.toml

@@ -21,3 +21,6 @@ cmd_lib.workspace = true
 color-eyre.workspace = true
 orb-telemetry = { workspace = true, default-features = false }
 tempfile.workspace = true
+
+[package.metadata.orb]
+unsupported_targets = ["aarch64-linux-android"]

bidiff-squashfs/shim/Cargo.toml

@@ -13,3 +13,6 @@ cc.workspace = true
 license-stub-glib.workspace = true
 license-stub-libsquashfs1.workspace = true
 pkg-config.workspace = true
+
+[package.metadata.orb]
+unsupported_targets = ["aarch64-linux-android"]

can/Cargo.toml

@@ -25,4 +25,8 @@ thiserror = { workspace = true, features = ["std"] }
 isotp = []
 
 [package.metadata.orb]
-unsupported_targets = ["aarch64-apple-darwin", "x86_64-apple-darwin"]
+unsupported_targets = [
+	"aarch64-apple-darwin",
+	"x86_64-apple-darwin",
+	"aarch64-linux-android",
+]

efivar/Cargo.toml

@@ -14,3 +14,6 @@ rust-version.workspace = true
 [dependencies]
 color-eyre.workspace = true
 libc.workspace = true
+
+[package.metadata.orb]
+unsupported_targets = ["aarch64-linux-android"]

gst-jpeg/Cargo.toml

@@ -15,3 +15,6 @@ gstreamer-app.workspace = true
 gstreamer-video.workspace = true
 license-stub-gstreamer.workspace = true
 tracing.workspace = true
+
+[package.metadata.orb]
+unsupported_targets = ["aarch64-linux-android"]

hil/Cargo.toml

@@ -51,3 +51,6 @@ zbus.workspace = true
 
 [build-dependencies]
 orb-build-info = { path = "../build-info", features = ["build-script"] }
+
+[package.metadata.orb]
+unsupported_targets = ["aarch64-linux-android"]

jwk-util/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "orb-jwk-util"
-version = "0.0.0"
+version = "0.0.1"
 authors = ["Ryan Butler <thebutlah@users.noreply.github.com>"]
 description = "CLI utility for manipulating Json Web Keys"
 publish = false

mcu-interface/Cargo.toml

@@ -24,7 +24,11 @@ tokio.workspace = true
 tracing.workspace = true
 
 [package.metadata.orb]
-unsupported_targets = ["aarch64-apple-darwin", "x86_64-apple-darwin"]
+unsupported_targets = [
+	"aarch64-apple-darwin",
+	"x86_64-apple-darwin",
+	"aarch64-linux-android",
+]
 
 [dev-dependencies]
 futures.workspace = true

mcu-util/Cargo.toml

@@ -28,7 +28,11 @@ tracing.workspace = true
 orb-build-info = { path = "../build-info", features = ["build-script"] }
 
 [package.metadata.orb]
-unsupported_targets = ["aarch64-apple-darwin", "x86_64-apple-darwin"]
+unsupported_targets = [
+	"aarch64-apple-darwin",
+	"x86_64-apple-darwin",
+	"aarch64-linux-android",
+]
 
 [package.metadata.deb]
 assets = [