net: extend the host netdev to darwin

[yohimik]

net: extend the host netdev to darwin

Repository tinygo-org/net. Branch upstream-pr/darwin-host-netdev, base
main.

What this does

The host netdev was for linux only, so a macOS binary registered no netdev and
every Dial reported "Netdev not set". Nothing in it is specific to linux.
Darwin also keeps the standard library syscall package, where the TinyGo
compiler routes the libc_*_trampoline symbols to libSystem, so the same
raw-socket implementation works there.

• The build constraint on netdev_native.go becomes (linux || darwin).
• The one part that is different, the socket options for every socket, moves
  into per-OS setSockDefaults functions in netdev_native_linux.go and
  netdev_native_darwin.go.
• Linux keeps the same SO_REUSEADDR as before. Darwin adds SO_NOSIGPIPE,
  because a BSD socket raises SIGPIPE on a write to a closed connection and
  darwin has no MSG_NOSIGNAL to prevent it for one write. Without it a peer
  that hangs up in the middle of a response kills the process instead of a
  return of EPIPE from Send.
• Accept retries on EINTR, as Connect, Send and Recv already do. Under
  the threads scheduler a GC cycle interrupts a blocking call with a signal, and
  a server must not see that as a failed accept.
• An accepted socket gets the same defaults as a created one, which puts
  SO_NOSIGPIPE on the connections that a server writes to.

Evidence

There is no CI in this repository, so the checks were run by hand on macOS 26.6
arm64 with a TinyGo build that carries the matching toolchain change.

• A program that calls net.LookupHost and http.Get("https://example.com/")
  builds and completes with this branch and the three other branches in this
  series.

A downstream product ships binaries built with these changes in a production
release. dispat v1.4.0 is published and is not a prerelease. It carries
dispat-tiny-linux-amd64 and dispat-tiny-linux-arm64, built by the fork
release v0.42.0-net.4 from sha256-pinned tarballs and smoke-executed under
binfmt before upload, beside six binaries from the gc toolchain.
https://github.com/yohimik/dispat/releases/tag/services%2Fdispat%2Fv1.4.0

The acceptance record of that repository is committed at
packages/docs/docs/internals/tinygo.md. It reports the net.2 to net.4
acceptance history, an integration suite of 694 rows that passes with 0 failures
and 1 documented skip on darwin, and a size table of 0.58x to 0.63x against the
gc equivalents with TinyGo -opt=z -no-debug against go build -trimpath -ldflags "-s -w". Those figures come from that document. They are not a
measurement of this branch.

The rows of that suite include DNS, TCP, TLS and x509 paths. The shipped
binaries in that release are for linux. The darwin evidence is the acceptance
record and the check above.

Dependencies

• The darwin toolchain needs the BSD socket symbols in the libSystem stub. See
  the tinygo PR "builder: declare the BSD socket API in the darwin libSystem
  stub". Without it a darwin program that opens a socket does not link.

Known gaps

• Deadlines use SO_RCVTIMEO and SO_SNDTIMEO, and a call that EINTR restarts
  begins its timeout again, so a deadline can be later than it should be under a
  heavy GC load.
• Linux behaviour is unchanged.

Related

• Support for x86_64 Linux #28, "Support for x86_64 Linux".
• Netdev not set on AMD64+Linux tinygo#4981, "Netdev not set on AMD64+Linux".
• the network does not work without drivers? Lookup of host name 'www.com' failed: Netdev not set tinygo#4630, "the network does not work without drivers?".
• TinyGo, TCP/UDP, Linux tinygo#1776, "TinyGo, TCP/UDP, Linux".
• Missing stdlib symbols on Linux native: net/http.Server.ListenAndServeTLS and net.* APIs tinygo#5205, "Missing stdlib symbols on Linux native".

Related pull requests

This change is part of one body of work. Together the changes make programs that use the network and child processes work on hosted linux and macOS. A full CLI was tested end to end with all of them and ships binaries built this way, see dispat v1.4.0 in the evidence section.

In tinygo-org/tinygo

• sync: hand the RWMutex over instead of a re-test of the reader count tinygo#5630 sync, RWMutex hand-over. Bug fix, standalone.
• runtime: deliver os/signal notifications under the threads scheduler tinygo#5631 is CLOSED in favor of runtime: deliver signals under the threads scheduler when blocked on I/O tinygo#5530 for signal delivery with the threads scheduler.
• compiler: implement go:cgo_import_dynamic and lower Darwin cgo import trampolines (#5604) tinygo#5612 owns darwin fcntl. compiler,runtime: call fcntl through a C wrapper on darwin tinygo#5632 is closed in its favor. Integer and pointer tests were offered on #5612.
• runtime: implement weak.runtime_makeStrongFromWeak tinygo#5633 runtime, weak.runtime_makeStrongFromWeak. Needed by real crypto/tls.
• os: start processes with posix_spawn tinygo#5634 is limited to process support with posix_spawn.
• loader: use the real crypto/tls on hosted linux and darwin tinygo#5635 loader, real crypto/tls on hosted linux and darwin.
• builder: declare Darwin socket and process symbols tinygo#5636 adds builder socket and spawn symbols at 6fded0c9. It is independent. Its direct syscall test needs no net pin.

In this repository

• net/http: follow redirects in the client again #72 net/http, follow redirects in the client again.
• net: report a name that does not exist as a not-found lookup error #73 net, report a name that does not exist as a not-found error.
• net: extend the host netdev to darwin #74 net, extend the host netdev to darwin.
• net/http: give the HTTPS client trust roots on darwin #75 net/http, give the HTTPS client trust roots on darwin.

A merge order that works. The remaining bug fixes are independent. tinygo-org/tinygo#5633 goes before tinygo-org/tinygo#5635. HTTPS on linux needs only tinygo-org/tinygo#5633 and tinygo-org/tinygo#5635. Full darwin support also needs tinygo-org/tinygo#5636, the net changes and a new src/net submodule pin.

Related owner work

• net: non-blocking host netdev I/O with an epoll poller #77 owns Linux I/O cancellation and deadline interruption. Its epoll code needs an OS split when combined with the darwin support in net: extend the host netdev to darwin #74.
• net: report the kernel-assigned port after listening on port 0 #80 owns the kernel-assigned TCP listener port. Do not add a second port fix.
• net/http: add ListenAndServeTLS / ServeTLS (software TLS) #79 owns server TLS methods. This is separate from client redirects and client trust roots.
• http: port Go net/http timeout handling #67 owns Client.Timeout and transport selection. Its native cancellation gap is recorded in the review. net/http: follow redirects in the client again #72 must be combined with that work at http/client.go.
• net: API-compat fills for grpc and wazero (SyscallConn, Dialer.Control, IPConn.Read) #78 owns Dialer.Control API fields and other API additions. It does not implement ListenConfig.

The Crier listener and close audit is separate from these PR measurements. The historical Linux arm64 run passed 142 tests with local patches. It predates later Crier changes and is not release validation.

Current integration status

Darwin fcntl work is in tinygo-org/tinygo#5612. tinygo-org/tinygo#5632 is closed and remains a history reference only. The integer and pointer tests were offered on #5612. Builder socket and spawn symbols in tinygo-org/tinygo#5636 are an independent prerequisite at 6fded0c9. The direct syscall test needs no net update, so that PR does not wait for this net series. tinygo-org/tinygo#5634 is limited to process support.

#82 supplies the separate ListenConfig implementation. Close guard tests and a limited shutdown fix stay on the fork branch codex/close-audit for coordination with the #77 owner. They are not equivalent to the poller. No second shutdown PR was opened.

Published fork and downstream evidence

The net.2 fork release combines the coordinated changes at 95fba82a, with net 0f460803. It differs from accepted candidate e7d34c8c only in the version constant. Linux, macOS and Windows branch CI and tag CI passed on their first attempts.

Dispat source 909dc401, with harness 0990c6db, passed 796 test events with no failures or skips on each native Darwin ARM64 and Linux ARM64 candidate run. Crier source 7d687fc8 passed raw and stripped E2E on native Linux ARM64 and emulated Linux AMD64, each with 144 top-level tests and 156 passing events, no failures or skips. Both applications use TinyGo-built update fixtures and test trusted TLS, certificate refusal, original backup hashes and byte-identical offline rollback. Their workflows also exercise files, environment variables, concurrency and child processes. Crier includes real FFmpeg and webrender/canvas rendering.

Crier's unchanged 13-image pixel gate passed. It uses an approved two-line explicit-rounding webrender build patch for both compilers. The earlier gradient mismatch was permitted fused arithmetic, not a TinyGo compiler error. Candidate stripped sizes are 13,835,824 versus 30,277,794 Go bytes on ARM64 (54.30% smaller), and 16,446,968 versus 32,518,306 on AMD64 (49.42% smaller).

These are combined-candidate application results, not proof that this PR alone supplies the features. They supersede the earlier Crier comparison. Published-toolchain probes and application acceptance have since completed. The final Crier v1.1.1 release evidence is below. Dispat controls its own publication. WaitDelay, in-flight deadlines and full descriptor lifetime remain open. This enables tested CLI client workflows, not general Go or server compatibility.

Owner sync, 6 September

The owner of #77 adopted our repeated-Close guard as 9dc11e1, with tests adapted to its nonblocking sockets. The owner of #80 adopted the Zone correction as 7b7aacb and removed the test dependency on #82. These are PR branches, not upstream merges.

New #83 restores RoundTripper dispatch. A Git merge check against #72 reports a conflict in http/client.go; both behaviors need combined tests before integration. New #84 uses the existing integer-conversion shim in tlssock.go. Neither new PR is included in the tested candidate e7d34c8c. No duplicate PR is needed.

Published Crier v1.1.1 evidence

Crier v1.1.1 is public at source acac2f0e and uses published TinyGo 0.43.0-net.2. Its final acceptance report and SHA-256 manifest identify the exact release bytes. The public tag, asset sizes and report digest were checked. These final sizes supersede the candidate sizes above.

Linux target	Standard Go bytes	Stripped TinyGo bytes	Reduction
ARM64	30,277,794	13,835,840	54.30%
AMD64	32,518,306	16,447,000	49.42%

The report records 144 top-level tests and 156 passing events for each raw and stripped run on native ARM64 and emulated AMD64, with no failures or skips. It covers real CLI files, environment and concurrent work, child processes, TLS, update/rollback fixtures, uploads, real FFmpeg, and webrender/canvas rendering. The unchanged 13-image gate passes on both targets. AMD64 is exact; ARM64 has 12 exact images and four event-card pixels with channel difference 1. Both compilers use the same explicit-rounding webrender build patch. Standard Go tests, 90.6% coverage, lint and docs also pass.

This is combined-fork application evidence, not isolated proof for this PR or general server support. The generic emulated AMD64 os closure assertions still fail and also fail with ordinary Go under that emulation; they are not counted as passing. Native AMD64 CI and the final published AMD64 net package pass. The report retains other platform and deadline/descriptor limits. Tiny binaries are opt-in; normal install/self-update selects standard Go assets.

Published Dispat v1.8.1 CLI evidence

Dispat v1.8.1 CLI is public. Its size and SHA-256 manifest records build source 40c58236, Go 1.26.8 and TinyGo 0.43.0-net.2. The public asset metadata and manifest digest were checked.

Linux target	Standard Go bytes	TinyGo bytes	Reduction
ARM64	9,896,098	6,299,032	36.35%
AMD64	10,895,522	6,697,528	38.53%

These are final published CLI asset sizes, not the earlier candidate measurements. They do not replace the separately identified test evidence or remove known runtime limits. CLI publication does not establish completion of the separate image, docs and installer checks in the larger release workflow.

[yohimik]

tinygo-org/net main has not moved since this branch was opened. It is still
70037cf, so the branch needs no rebase and it is current. v0.42.0 of the
toolchain pins src/net at that same commit, so the change applies to the
released toolchain.