[boring] Move package:boring to dart-lang/tools (3/4): prebuilt binaries and tree shaking - #2616

…libraries

tool/precompile_binaries.dart didn't set CMAKE_OSX_DEPLOYMENT_TARGET, so the
released macOS libraries only loaded on the macOS version of the build
machine or newer (the 0.4.1 dylibs have `minos 14.0`), while Dart supports
macOS 12 and Flutter's deployment target defaults to 10.15. Set it to 10.15
for x64 and 11.0 for arm64.

Link the C runtime statically on Windows (CMAKE_MSVC_RUNTIME_LIBRARY), like
the Dart SDK does, so the DLL doesn't require the Visual C++ Redistributable.
The static library's objects carry the choice, so the DLL that hook/link.dart
links inherits it.

boring_binaries.yaml checks these ABI floors (newest glibc symbol version,
macOS minos, no C runtime imports) after building, so they can't regress
unnoticed. It now also runs the `precompile` job on pull requests that change
the pipeline or the native build, which until now only ran on tag pushes, and
attests the provenance of the release libraries, which `gh attestation verify`
checks.

… assets

An unknown `buildMode` user-define, such as a typo of `checkout`, silently
selected `fetch`, so a user who wanted to build from source got downloaded
binaries instead. BuildOptions.fromDefines now throws a BuildError that lists
the valid values. The undocumented `build` alias is gone.

tool/regenerate_hashes.dart probed all 18 supported targets, 13 of which have
no prebuilt libraries, and skipped missing assets and errors, so a failed
build or a flaky download silently dropped a hash, after which `fetch`
silently compiled from source for that target. It now hashes exactly the
targets of the binaries workflow (`prebuiltTargets`) and fails without
writing anything if one is missing. The `generated` job runs it, so CI
checks that hashes.dart matches the pinned release. The release location is
one constant (`releaseAssetUrl`), version.dart is folded into hashes.dart,
and a unit test checks that hashes.dart pins exactly the assets of the
prebuilt targets.

Downloads honor the HTTPS_PROXY family of environment variables, which the
hooks runner passes through, and time out instead of hanging the build on a
stalled connection.

…s BoringSSL

doc/reusing_dart_sdk_boringssl.md was a design exploration of reusing the
BoringSSL in the Dart SDK, unrelated to the package, referring to a build
mode that doesn't exist, and shipped in the pub package. It belongs in an
issue.

The README says which targets have prebuilt libraries, that a hash mismatch
is an error rather than a fallback, and that other build modes are rejected.
pubspec.yaml explains why the package sets `buildMode: checkout` for itself,
and boring.yaml why the macOS cross toolchain isn't pinned.

hashes.dart is no longer marked linguist-generated: it pins what `fetch`
trusts, so its changes should be visible in reviews by default.

Releasing the prebuilt libraries took a hand-pushed boring-binaries-v<version>
tag, a local run of tool/regenerate_hashes.dart, and a pull request, and tied
the libraries to package versions although they only depend on the native
sources. Nothing checked that the pinned libraries were built from the
BoringSSL the package vendors, so the weekly BoringSSL update landing between
the tag and the pull request would have given `fetch` users older code than
`checkout` users.

boring_binaries.yaml now runs when a change to the native sources (src/, the
vendored BoringSSL, or the pipeline itself) lands on main, or on
workflow_dispatch on main:

- The `release` job attaches the libraries to a pre-release named after the
  build, boring-binaries-<date>-<commit>, created from the commit.
- The `pin` job writes the repository, the tag, the commit and the hashes of
  the libraries it just built to hashes.dart and opens a pull request with
  the Ecosystem Bot token, like the refresh job of boring.yaml, so that CI
  runs: the `generated` job re-hashes the release assets, and the tree-shaking
  tests download them in the `fetch` build mode.
- The `analyze` job of boring.yaml fails a release (a non -wip version) whose
  pinned libraries weren't built from the current src/, third_party/boringssl/
  and tool/REVISION, and warns otherwise.

hashes.dart therefore pins `releaseRepository`, `releaseTag` and
`sourceCommit` instead of a version, and tool/regenerate_hashes.dart takes the
tag, `--repository`, `--source-commit` (looked up with `git ls-remote` if
omitted) and `--assets`. Until the first release from this repository, which
merging this change triggers, the hashes still point at mosuem/boring v0.4.1;
the first pin pull request switches them.

Flutter apps compiled BoringSSL from source for every Android ABI and iOS
build, which takes minutes and needs CMake and Ninja. tool/precompile_binaries.dart
now cross-compiles for Android with the NDK (arm, arm64 and x64, API 21 and
later, 16 KB page alignment, stripped of the NDK's debug info) and for iOS
with Xcode (arm64, and the arm64 and x64 simulators, iOS 12 and later), and
boring_binaries.yaml builds and checks them like the desktop targets.

With exceptions disabled, libc++'s throw helpers call
std::__libcpp_verbose_abort, a function in libc++'s library, which the
libraries don't link; Android's linker rejects the undefined reference, where
the desktop toolchains let it slide. Define _LIBCPP_VERBOSE_ABORT, libc++'s
customization point, to abort directly.

tool/regenerate_hashes.dart and the unit test still require every asset of a
release built by the workflow, but accept missing ones from a release built
elsewhere, which predates these targets: the pinned mosuem/boring v0.4.1 has
no Android or iOS libraries, so those compile from source until the first
release from this repository, which merging this change triggers.

The arm64 iOS simulator only exists since iOS 14, so clang raises the
deployment target of that slice to 14.0 anyway. Set it explicitly, like
11.0 for macOS arm64, so the ABI check of the binaries workflow is exact.

…ok dependencies

tool/regenerate_hashes.dart wrote a hard-coded 2026 copyright line. It now
keeps the license header of the existing hashes.dart, whose year is the
year the file was created, like every other file's.

hook/build.dart listed itself and hashes.dart as dependencies. The hooks
runner compiles the hook with a depfile and reruns it when any of its Dart
sources change, so only pubspec.yaml remains.

…ch mode, move release docs to CONTRIBUTING.md, extract check script