fix 16KB RELRO release validation

[wysaid]

Summary

• update the README dependency examples from 3.1.2 to 3.2.0 and warn that
  the 3.1.2 16KB variants are incompatible with some 4KB-page-size devices
• correct the changelog and CMake explanation: removing explicit RELRO flags
  in 3.1.2 did not disable the linker-default RELRO layout
• add an AAR validator that checks 16KB PT_LOAD alignment and verifies that
  every 4KB-rounded PT_GNU_RELRO range remains inside mapped PT_LOAD pages
• run the validator against all four AAR variants in the release workflow
  before checksums and publication

Root cause

The published 3.1.2-16k-min arm64 libCGEExt.so was linked by LLD 17. Its
writable PT_LOAD maps only through 0xa000 on a 4KB-page-size device, while
PT_GNU_RELRO is rounded through 0xc000. Android's linker therefore calls
mprotect() across unmapped pages and reports ENOMEM as
can't enable GNU RELRO protection ... Out of memory.

The 3.2.0 artifacts use NDK r27c / LLD 18 and contain .relro_padding, so the
associated writable PT_LOAD covers the full RELRO range.

Refs #562.

Validation

• all published 3.2.0 variants pass the new validator: default, min, 16k, and
  16k-min
• the published 3.1.2-16k-min artifact is rejected, including the affected
  arm64 libCGEExt.so range 0x9000-0xc000
• release.yml parses successfully as YAML
• git diff --check passes

Summary by CodeRabbit

• Bug Fixes

  • Updated 16KB Android artifacts to improve compatibility on devices using 4KB or 16KB page sizes.
  • Resolved a native library loading issue that could cause dlopen failures on some 4KB-page-size devices.

• Documentation

  • Updated Gradle dependency examples to use version 3.2.0 and its available artifact variants.
  • Added guidance recommending 3.2.0 or newer for reliable 16KB device support.
  • Clarified the release notes around previous compatibility limitations.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 35f8b53d-58f5-47d3-825a-dd39c8dcb479

📥 Commits

Reviewing files that changed from the base of the PR and between a280744 and 2b729ee.

📒 Files selected for processing (5)

• .github/workflows/release.yml
• CHANGELOG.md
• README.md
• library/src/main/jni/CMakeLists.txt
• tools/validate_aar_elf.py

---

Walkthrough

The change adds a Python validator for native ELF layouts in AAR files, runs it during releases, and updates linker comments, dependency examples, compatibility guidance, and changelog entries for version 3.2.0.

Changes

AAR ELF validation

Layer / File(s)	Summary
ELF validation implementation tools/validate_aar_elf.py	Parses readelf program headers from AAR-contained libraries and checks 16KB PT_LOAD alignment plus GNU_RELRO coverage.
Release workflow validation gate .github/workflows/release.yml	Runs ELF validation after AAR packaging and before checksums and artifact publishing.
Release compatibility and build notes library/src/main/jni/CMakeLists.txt, README.md, CHANGELOG.md	Updates RELRO comments, 3.2.0 dependency examples, compatibility warnings, and release notes.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• wysaid/android-gpuimage-plus#563: Addresses the related RELRO/16KB artifact compatibility issue.

Sequence Diagram(s)

sequenceDiagram
  participant ReleaseWorkflow
  participant Validator as validate_aar_elf.py
  participant Readelf
  ReleaseWorkflow->>Validator: Validate packaged AAR files
  Validator->>Readelf: Inspect native ELF headers
  Readelf-->>Validator: Return PT_LOAD and GNU_RELRO layouts
  Validator-->>ReleaseWorkflow: Return success or exit code 1
  ReleaseWorkflow->>ReleaseWorkflow: Continue publishing only after validation

Loading

Poem

A bunny checks each native file,
For RELRO paths aligned in style.
Sixteen-K pages hop in line,
Four-K mappings fit just fine.
The release train bounds ahead—
With greener checks before it’s fed!

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/fix-relro-release-validation

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}