Enable ARM64 cryptographic extensions in iOS library builds

Go's internal/cpu never detects ARM64 features on GOOS=ios, so AES, AES-GCM
and SHA-256 use their generic implementations on iOS and tvOS. Patch the
Go source in the Apple library build to assert the ARMv8.0 cryptographic
extensions, as Go already does for macOS.

See https://github.com/SagerNet/sing-box/issues/4486

.github/go_ios_cpu_features.patch

@@ -0,0 +1,28 @@
+--- a/src/internal/cpu/cpu_arm64_ios.go
++++ b/src/internal/cpu/cpu_arm64_ios.go
+@@ -0,0 +1,14 @@
++// Copyright 2020 The Go Authors. All rights reserved.
++// Use of this source code is governed by a BSD-style
++// license that can be found in the LICENSE file.
++
++//go:build arm64 && ios
++
++package cpu
++
++func osInit() {
++	ARM64.HasAES = true
++	ARM64.HasPMULL = true
++	ARM64.HasSHA1 = true
++	ARM64.HasSHA2 = true
++}
+--- a/src/internal/cpu/cpu_arm64_other.go
++++ b/src/internal/cpu/cpu_arm64_other.go
+@@ -2,7 +2,7 @@
+ // Use of this source code is governed by a BSD-style
+ // license that can be found in the LICENSE file.
+ 
+-//go:build arm64 && !linux && !freebsd && !android && (!darwin || ios) && !openbsd
++//go:build arm64 && !linux && !freebsd && !android && !darwin && !openbsd
+ 
+ package cpu
+ 

.github/patch_go_for_ios.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+# Go's internal/cpu never detects ARM64 features on GOOS=ios, so crypto/aes,
+# AES-GCM and crypto/sha256 use their generic implementations on iOS and tvOS.
+# See https://github.com/SagerNet/sing-box/issues/4486
+#
+# Only the ARMv8.0 cryptographic extensions are asserted; ARMv8.1 atomics and
+# SHA-512 are absent on the A8/A9 devices still supported by the deployment targets.
+#
+# Remove once the Go release used by the Apple library build includes the fix.
+
+export GOTOOLCHAIN=local
+
+GOROOT="$(go env GOROOT)"
+PATCH_FILE="$(cd "$(dirname "$0")" && pwd)/go_ios_cpu_features.patch"
+
+cd "$GOROOT"
+if [[ -f src/internal/cpu/cpu_arm64_ios.go ]]; then
+  echo "already patched"
+else
+  patch --verbose -p1 < "$PATCH_FILE"
+fi
+
+CPU_FILES="$(GOOS=ios GOARCH=arm64 CGO_ENABLED=0 go list -f '{{.GoFiles}}' internal/cpu)"
+echo "internal/cpu files for ios/arm64: $CPU_FILES"
+case "$CPU_FILES" in
+*cpu_arm64_ios.go*) ;;
+*)
+  echo "patch is not effective" >&2
+  exit 1
+  ;;
+esac

.github/workflows/build.yml

@@ -1246,6 +1246,9 @@ jobs:
         with:
           go-version: 1.26.7
           cache: false
+      - name: Patch Go for iOS
+        if: matrix.build && (matrix.platform == 'ios/arm64' || matrix.platform == 'tvos/arm64')
+        run: .github/patch_go_for_ios.sh
       - name: Cache Go modules
         if: matrix.build
         uses: actions/cache@v4
@@ -1265,6 +1268,8 @@ jobs:
         run: git tag v${{ needs.calculate_version.outputs.version }} -f
       - name: Build library
         if: matrix.build
+        env:
+          GOTOOLCHAIN: local
         run: |-
           make lib_install
           export PATH="$PATH:$(go env GOPATH)/bin"