From e4a19a2a7cd20aa59da93c6170cee573d008768d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E4=B8=96=E7=95=8C?= <i@sekai.icu>
Date: Thu, 3 Sep 2026 13:28:39 +0800
Subject: [PATCH] Enable ARM64 cryptographic extensions in iOS library builds

Go's internal/cpu never detects ARM64 features on GOOS=ios, so AES, AES-GCM
and SHA-256 use their generic implementations on iOS and tvOS. Patch the
Go source in the Apple library build to assert the ARMv8.0 cryptographic
extensions, as Go already does for macOS.

See https://github.com/SagerNet/sing-box/issues/4486
---
 .github/go_ios_cpu_features.patch | 28 +++++++++++++++++++++++++
 .github/patch_go_for_ios.sh       | 34 +++++++++++++++++++++++++++++++
 .github/workflows/build.yml       |  5 +++++
 3 files changed, 67 insertions(+)
 create mode 100644 .github/go_ios_cpu_features.patch
 create mode 100755 .github/patch_go_for_ios.sh

diff --git a/.github/go_ios_cpu_features.patch b/.github/go_ios_cpu_features.patch
new file mode 100644
index 00000000..704d2d76
--- /dev/null
+++ b/.github/go_ios_cpu_features.patch
@@ -0,0 +1,28 @@
+--- a/src/internal/cpu/cpu_arm64_ios.go
++++ b/src/internal/cpu/cpu_arm64_ios.go
+@@ -0,0 +1,14 @@
++// Copyright 2020 The Go Authors. All rights reserved.
++// Use of this source code is governed by a BSD-style
++// license that can be found in the LICENSE file.
++
++//go:build arm64 && ios
++
++package cpu
++
++func osInit() {
++	ARM64.HasAES = true
++	ARM64.HasPMULL = true
++	ARM64.HasSHA1 = true
++	ARM64.HasSHA2 = true
++}
+--- a/src/internal/cpu/cpu_arm64_other.go
++++ b/src/internal/cpu/cpu_arm64_other.go
+@@ -2,7 +2,7 @@
+ // Use of this source code is governed by a BSD-style
+ // license that can be found in the LICENSE file.
+ 
+-//go:build arm64 && !linux && !freebsd && !android && (!darwin || ios) && !openbsd
++//go:build arm64 && !linux && !freebsd && !android && !darwin && !openbsd
+ 
+ package cpu
+ 
diff --git a/.github/patch_go_for_ios.sh b/.github/patch_go_for_ios.sh
new file mode 100755
index 00000000..6105dd50
--- /dev/null
+++ b/.github/patch_go_for_ios.sh
@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+# Go's internal/cpu never detects ARM64 features on GOOS=ios, so crypto/aes,
+# AES-GCM and crypto/sha256 use their generic implementations on iOS and tvOS.
+# See https://github.com/SagerNet/sing-box/issues/4486
+#
+# Only the ARMv8.0 cryptographic extensions are asserted; ARMv8.1 atomics and
+# SHA-512 are absent on the A8/A9 devices still supported by the deployment targets.
+#
+# Remove once the Go release used by the Apple library build includes the fix.
+
+export GOTOOLCHAIN=local
+
+GOROOT="$(go env GOROOT)"
+PATCH_FILE="$(cd "$(dirname "$0")" && pwd)/go_ios_cpu_features.patch"
+
+cd "$GOROOT"
+if [[ -f src/internal/cpu/cpu_arm64_ios.go ]]; then
+  echo "already patched"
+else
+  patch --verbose -p1 < "$PATCH_FILE"
+fi
+
+CPU_FILES="$(GOOS=ios GOARCH=arm64 CGO_ENABLED=0 go list -f '{{.GoFiles}}' internal/cpu)"
+echo "internal/cpu files for ios/arm64: $CPU_FILES"
+case "$CPU_FILES" in
+*cpu_arm64_ios.go*) ;;
+*)
+  echo "patch is not effective" >&2
+  exit 1
+  ;;
+esac
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index b30ac60d..fe7c43a7 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1246,6 +1246,9 @@ jobs:
         with:
           go-version: 1.26.7
           cache: false
+      - name: Patch Go for iOS
+        if: matrix.build && (matrix.platform == 'ios/arm64' || matrix.platform == 'tvos/arm64')
+        run: .github/patch_go_for_ios.sh
       - name: Cache Go modules
         if: matrix.build
         uses: actions/cache@v4
@@ -1265,6 +1268,8 @@ jobs:
         run: git tag v${{ needs.calculate_version.outputs.version }} -f
       - name: Build library
         if: matrix.build
+        env:
+          GOTOOLCHAIN: local
         run: |-
           make lib_install
           export PATH="$PATH:$(go env GOPATH)/bin"