ci: fix fuzz and i686 multiarch jobs for boring 5

Two CI jobs broke after the boring 4 -> 5 upgrade because BoringSSL
is now built by `boring-sys` rather than by `quiche/src/build.rs`,
and a couple of flags we used to set in-tree need to be re-injected
from outside the build.

1. fuzz (nightly): BoringSSL 5.x consolidated the older
   `BORINGSSL_UNSAFE_{DETERMINISTIC,FUZZER}_MODE` defines into a
   single `FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION` switch.

2. quiche_multiarch (i686-unknown-linux-gnu): BoringSSL's x86
   assembly requires SSE2. `boring-sys` does set `-msse2` via
   `util/32-bit-toolchain.cmake`, but only when host != target; the
   `cross` `i686:edge` image is 32-bit-native, so that branch is
   skipped and the build fails with `x86 assembly requires SSE2`.
   Add a target-scoped `CFLAGS`/`CXXFLAGS` passthrough in
   `Cross.toml` so `-msse2 -mfpmath=sse` reaches BoringSSL's cmake
   build regardless.

Author: cjpatton

.github/workflows/nightly.yml

@@ -68,12 +68,15 @@ jobs:
     # duplicate builds for PRs created from internal branches.
     if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository
     # `quiche-fuzz` calls `RAND_reset_for_fuzzing`, which BoringSSL only
-    # exports when `BORINGSSL_UNSAFE_DETERMINISTIC_MODE` is defined.
-    # `boring-sys` doesn't expose a feature for that, but cmake-rs honors
-    # `CFLAGS`/`CXXFLAGS`, so inject the defines there.
+    # exports when built with `FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION`.
+    # BoringSSL 5.x consolidated the older
+    # `BORINGSSL_UNSAFE_{DETERMINISTIC,FUZZER}_MODE` defines into this
+    # single switch. `boring-sys` doesn't expose a feature for it, but
+    # cmake-rs (via cc-rs) honors `CFLAGS`/`CXXFLAGS`, so inject the
+    # define there.
     env:
-      CFLAGS: "-DBORINGSSL_UNSAFE_DETERMINISTIC_MODE -DBORINGSSL_UNSAFE_FUZZER_MODE"
-      CXXFLAGS: "-DBORINGSSL_UNSAFE_DETERMINISTIC_MODE -DBORINGSSL_UNSAFE_FUZZER_MODE"
+      CFLAGS: "-DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION"
+      CXXFLAGS: "-DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION"
     steps:
       - name: Checkout sources
         uses: actions/checkout@v4

Cross.toml

@@ -27,3 +27,15 @@ pre-build = [
     "ln -sf /usr/bin/gcc /usr/local/bin/i686-linux-gnu-gcc",
     "ln -sf /usr/bin/g++ /usr/local/bin/i686-linux-gnu-g++",
 ]
+
+# BoringSSL's x86 assembly requires SSE2. `boring-sys`'s cmake build
+# doesn't add `-msse2` for i686 targets (its 32-bit-toolchain.cmake
+# sets it as a CACHE STRING, but cmake-rs's `-DCMAKE_C_FLAGS=...` on
+# the command line wins), so inject it via the target-scoped
+# `CFLAGS`/`CXXFLAGS` env vars. `cc-rs` (and through it, `cmake-rs`)
+# honors these and passes them along to BoringSSL's cmake build.
+[target.i686-unknown-linux-gnu.env]
+passthrough = [
+    "CFLAGS_i686_unknown_linux_gnu=-msse2 -mfpmath=sse",
+    "CXXFLAGS_i686_unknown_linux_gnu=-msse2 -mfpmath=sse",
+]