Adapt build for Mac OS and arm mode compilation (#62)

* Adapt makefile for mac OS and arm mode compilation

* Add . zizmor scanning and fixes

* Update rtems submodule

* Update rtems-source-builder

Author: ziopio

.github/workflows/ci.yml

@@ -6,8 +6,12 @@ on:
   pull_request:
     branches: [ master ]
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     timeout-minutes: 150
     strategy:
       fail-fast: false
@@ -17,7 +21,9 @@ jobs:
           - macOS-latest
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - name:  Install dependencies
         shell: bash
         run:   |
@@ -76,14 +82,16 @@ jobs:
       - name: Create package
         run: make package
       - name: Upload package artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
         with:
           name: package-${{ runner.os }}
           path: |
             package/*
             external/rtems-source-builder/rtems/rsb-report-*.txt
 
   upload:
+    permissions:
+      actions: read
     if: ${{ github.ref == 'refs/heads/master' }} # Only upload on master builds
     needs: build
     strategy:
@@ -95,7 +103,7 @@ jobs:
     steps:
 
       - name: Download a single artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
           name: package-${{ runner.os }}
           path: package

.github/workflows/zizmor.yaml

@@ -0,0 +1,24 @@
+name: GitHub Actions Security Analysis with zizmor 🌈
+
+on:
+  push:
+    branches: ["**"]
+  pull_request:
+    branches: ["**"]
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Run zizmor 🌈
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor 🌈
+        uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # v0.5.0

Makefile

@@ -71,6 +71,24 @@ OPTIMIZATION = 2
 EXTRA_BSP_OPTS =
 endif
 
+# On macOS, files downloaded via browser/AirDrop can inherit quarantine and
+# trigger Gatekeeper for freshly built cross-tools (e.g. arm-rtems5-ar).
+ifeq ($(UNAME),Darwin)
+define UNQUARANTINE_CMD
+if command -v xattr >/dev/null 2>&1; then \
+	for d in "$(PREFIX)/$(TARGET)/bin" "$(PREFIX)/bin"; do \
+		if [ -d "$$d" ]; then \
+			xattr -dr com.apple.quarantine "$$d" 2>/dev/null || true; \
+		fi; \
+	done; \
+fi
+endef
+else
+define UNQUARANTINE_CMD
+true
+endef
+endif
+
 
 export ORGPATH := $(PATH)
 export PATH := $(PREFIX)/bin:$(PATH)
@@ -101,11 +119,13 @@ bootstrap:
 toolchain:
 	mkdir -p $(BUILD_LOGS)
 	rm -rf $(RSB)/rtems/build
+	@$(UNQUARANTINE_CMD)
 	cd $(RSB)/rtems && ../source-builder/sb-set-builder \
 	    --prefix=$(PREFIX) \
 	    --log=$(BUILD_LOGS)/rsb-toolchain.log \
 		--with-fortran \
 	    $(RTEMS_VERSION)/rtems-$(ARCH)
+	@$(UNQUARANTINE_CMD)
 	rm -rf $(RSB)/rtems/build
 
 .PHONY: toolchain-revision
@@ -338,6 +358,7 @@ cryptoauthlib: cmake_toolchain_config
 			-DATCA_USE_ATCAB_FUNCTIONS=ON \
 			-DATCA_PRINTF=OFF \
 			-DUNIX=true \
+			-DCMAKE_POLICY_VERSION_MINIMUM=3.5 \
 			-DCMAKE_TOOLCHAIN_FILE=$(CMAKE_TOOLCHAIN_CONFIG) ..
 	cd $(SRC_CRYPTOAUTHLIB)/build && \
 		make DESTDIR=$(SRC_CRYPTOAUTHLIB)/install install && \
@@ -349,11 +370,20 @@ cryptoauthlib: cmake_toolchain_config
 		touch $(PREFIX)/$(TARGET)/$(BSP)/lib/include/cryptoauthlib/atca_start_iface.h
 
 
+BLAS_CPU_FLAGS = -march=armv7-a -marm -mfloat-abi=hard -mtune=cortex-a7 -mfpu=neon
+BLAS_CFLAGS = -O3 $(BLAS_CPU_FLAGS)
+BLAS_FFLAGS = -O3 $(BLAS_CPU_FLAGS)
+BLAS_FFLAGS_NOOPT = -O0 -frecursive $(BLAS_CPU_FLAGS)
+
 BLAS_TOOLS=\
 			BLLIB='$(MAKEFILE_DIR)external/BLAS/CBLAS/lib/blas_ARM.a' \
 			CBLIB='$(MAKEFILE_DIR)external/BLAS/CBLAS/lib/cblas_ARM.a' \
 			CC='$(MAKEFILE_DIR)rtems/$(RTEMS_VERSION)/bin/$(ARCH)-rtems$(RTEMS_VERSION)-gcc' \
 			FC='$(MAKEFILE_DIR)rtems/$(RTEMS_VERSION)/bin/$(ARCH)-rtems$(RTEMS_VERSION)-gfortran' \
+			CFLAGS='$(BLAS_CFLAGS)' \
+			FFLAGS='$(BLAS_FFLAGS)' \
+			FFLAGS_DRV='$(BLAS_FFLAGS)' \
+			FFLAGS_NOOPT='$(BLAS_FFLAGS_NOOPT)' \
 			RANLIB='$(MAKEFILE_DIR)rtems/$(RTEMS_VERSION)/$(ARCH)-rtems$(RTEMS_VERSION)/bin/ranlib' \
 			AR='$(MAKEFILE_DIR)rtems/$(RTEMS_VERSION)/$(ARCH)-rtems$(RTEMS_VERSION)/bin/ar' \
 			ARCH=$(AR)