Uh oh!
There was an error while loading. Please reload this page.
Implement post-build symbol stripping for Android - #126023
Conversation
Zurisen
commented
Mar 24, 2026
@dotnet-policy-service agree |
There was a problem hiding this comment.
Pull request overview
Implements post-build symbol stripping for Android native libraries to reduce disk usage on build machines while keeping APKs debuggable for test infrastructure (e.g., enabling adb shell run-as).
Changes:
- Update Android CMake generation/build to always use Debug configuration and introduce an
llvm-strip --strip-debugpost-build stripping helper. - Update APK packaging to always set debuggable mode and to strip
.sofiles during/after packaging whenStripDebugSymbols=true.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
src/tasks/MobileBuildTasks/Android/AndroidProject.cs | Removes strip-related CMake build-type switching and adds StripBinaryInPlace() using NDK llvm-strip. |
src/tasks/AndroidAppBuilder/ApkBuilder.cs | Keeps APKs debuggable unconditionally and invokes post-build stripping for libmonodroid.so and packaged .so files when enabled. |
| public void StripBinaryInPlace(string filePath, string apiLevel = DefaultMinApiLevel) | ||
| { | ||
| NdkTools tools = new NdkTools(targetArchitecture, GetHostOS(), apiLevel); | ||
| string execExt = Utils.IsWindows() ? ".exe" : ""; | ||
| string llvmStripPath = Path.Combine(tools.ToolPrefixPath, $"llvm-strip{execExt}"); |
There was a problem hiding this comment.
StripBinaryInPlace() locates llvm-strip via NdkTools, which in turn uses the global Ndk.NdkPath (probing ANDROID_NDK_ROOT / fixed install locations) rather than the Android NDK path passed into AndroidProject. If the build is using an NDK path provided via MSBuild (AndroidNdk) without setting ANDROID_NDK_ROOT, this will likely fail to find llvm-strip (or pick a different NDK than CMake used). Consider deriving the llvm-strip path from the AndroidProject-provided NDK root (store it as a field), or otherwise ensure NdkTools is initialized from that same NDK path to avoid mismatches/regressions.
| publicvoidStripBinaryInPlace(stringfilePath,stringapiLevel=DefaultMinApiLevel) | |
| { | |
| NdkToolstools=newNdkTools(targetArchitecture,GetHostOS(),apiLevel); | |
| stringexecExt=Utils.IsWindows()?".exe":""; | |
| stringllvmStripPath=Path.Combine(tools.ToolPrefixPath,$"llvm-strip{execExt}"); | |
| privatestringGetLlvmStripPath() | |
| { | |
| if(string.IsNullOrEmpty(androidToolchainPath)) | |
| { | |
| thrownewInvalidOperationException($"{nameof(androidToolchainPath)} must be set before stripping binaries."); | |
| } | |
| // androidToolchainPath is expected to be <ndkRoot>/build/cmake/android.toolchain.cmake | |
| // so the NDK root is two levels up. | |
| DirectoryInfo?toolchainDir=Directory.GetParent(androidToolchainPath); | |
| DirectoryInfo?ndkRootDir=toolchainDir?.Parent; | |
| if(ndkRootDirisnull) | |
| { | |
| thrownewInvalidOperationException($"Unable to determine Android NDK root from toolchain path '{androidToolchainPath}'."); | |
| } | |
| stringhostTag=GetHostOS()switch | |
| { | |
| NdkToolchainHostOS.Windows=>"windows-x86_64", | |
| NdkToolchainHostOS.MacOS=>"darwin-x86_64", | |
| NdkToolchainHostOS.Linux=>"linux-x86_64", | |
| _ =>thrownewInvalidOperationException($"Unsupported host OS '{GetHostOS()}'.") | |
| }; | |
| stringexecExt=Utils.IsWindows()?".exe":string.Empty; | |
| returnPath.Combine(ndkRootDir.FullName,"toolchains","llvm","prebuilt",hostTag,"bin",$"llvm-strip{execExt}"); | |
| } | |
| publicvoidStripBinaryInPlace(stringfilePath,stringapiLevel=DefaultMinApiLevel) | |
| { | |
| stringllvmStripPath=GetLlvmStripPath(); |
| if (StripDebugSymbols && project is not null) | ||
| project.StripBinaryInPlace(Path.Combine(OutputDir, destRelative), MinApiLevel!); |
There was a problem hiding this comment.
When StripDebugSymbols is enabled, stripping during APK packaging is gated on project is not null. For NativeAOT builds project stays null, so none of the packaged .so files will be stripped even though StripDebugSymbols=true. If stripping is intended to apply to NativeAOT (or any path that doesn't create an AndroidProject), consider creating an AndroidProject (or a dedicated NDK-tool locator) for the active RID purely for stripping so the packaging loop strips all copied .so files consistently.
| if(StripDebugSymbols&&projectis not null) | |
| project.StripBinaryInPlace(Path.Combine(OutputDir,destRelative),MinApiLevel!); | |
| if(StripDebugSymbols) | |
| { | |
| if(projectisnull) | |
| { | |
| thrownewInvalidOperationException("StripDebugSymbols is enabled, but no Android project is available to strip native libraries during APK packaging."); | |
| } | |
| project.StripBinaryInPlace(Path.Combine(OutputDir,destRelative),MinApiLevel!); | |
| } |
| string libMonodroidPath = Path.Combine(OutputDir, "monodroid", "libmonodroid.so"); | ||
| if (File.Exists(libMonodroidPath)) | ||
| project.StripBinaryInPlace(libMonodroidPath, MinApiLevel!); |
There was a problem hiding this comment.
With StripDebugSymbols enabled, libmonodroid.so is stripped in-place here and then stripped again after it’s copied into OutputDir/lib/... in the packaging loop. This causes an extra llvm-strip invocation without changing the resulting APK contents. Consider stripping only once (either in-place post-build or on the copied file) to reduce work.
Build machines run out of disk space without symbol stripping, but enabling symbol stripping at compile time removes debug symbols and sets android:debuggable=false, which breaks adb shell run-as access. This change modifies the Android build to: - Always build native libraries in Debug mode with symbols - Strip debug symbols post-build using llvm-strip from the NDK - Always set android:debuggable=true in the APK manifest This preserves debuggability while reducing binary size. Fixdotnet#115717
168f034 to
bf703e2CompareTagging subscribers to 'arch-android': @vitek-karas, @simonrozsival, @steveisok, @akoeplinger |
simonrozsival
commented
May 27, 2026
/azp run runtime-android |
|
Azure Pipelines successfully started running 1 pipeline(s). |
Workflow state for the Holistic Review Orchestrator. {
"version": 5,
"last_dispatched_commit": "e00eccfee757337cad80cdd65fe585601931989e",
"last_dispatched_base_ref": "main",
"last_dispatched_base_sha": "a31b4923d5b3cc51681c997b7c4834960cc5337a",
"last_reviewed_commit": "e00eccfee757337cad80cdd65fe585601931989e",
"last_reviewed_base_ref": "main",
"last_reviewed_base_sha": "a31b4923d5b3cc51681c997b7c4834960cc5337a",
"last_recorded_worker_run_id": "29679139864",
"review_attempt_commit": "",
"review_attempt_base_ref": "",
"review_attempt_count": 0,
"max_review_attempts": 5,
"review_history_format": "holistic-review-disclosure-v1",
"review_history": [
{
"commit": "e00eccfee757337cad80cdd65fe585601931989e",
"review_id": 4730522953
}
]
} |
There was a problem hiding this comment.
Holistic Review
Motivation: Build machines were running out of disk space when Android native libraries retained debug symbols. The prior approach stripped symbols at compile time via -DCMAKE_BUILD_TYPE=MinSizeRel plus a -s flag, but that path was also coupled to android:debuggable=false, which breaks adb shell run-as access relied upon by the test infrastructure (issue #115717). The PR decouples size reduction from debuggability.
Approach: AndroidProject.GenerateCMake/BuildCMake now always build in Debug config (dropping the stripDebugSymbols parameters and the MinSizeRel branch), and a new StripBinaryInPlace method invokes the NDK's llvm-strip --strip-debug on the produced .so files. ApkBuilder hoists the AndroidProject instance so the packaging loop can strip each copied .so when StripDebugSymbols=true, always passes --debug-mode to aapt (keeping android:debuggable=true), and removes the CoreCLR-specific exclusion of libmscordbi.so/libmscordaccore.so. This is a reasonable, well-targeted design that matches the stated goal.
Summary: The change is coherent and the CMake-side simplification is clean. The main concern is a behavioral regression risk for the NativeAOT path: project remains null when IsNativeAOT is true, so a NativeAOT build with StripDebugSymbols=true will now throw at packaging time instead of stripping (see inline comment on ApkBuilder.cs). The default for StripDebugSymbols is false, so the common path is unaffected, but the coupling of stripping capability to the presence of the CMake project should be resolved so NativeAOT is either supported or explicitly left at prior behavior. Minor: the removed CoreCLR debugger-lib exclusion means libmscordbi.so/libmscordaccore.so are now always packaged (only --strip-debug'd), slightly increasing APK size vs. before for stripped CoreCLR builds — intentional per the debuggability goal, but worth confirming. Since the author notes no local Android testing was possible, validation via the Android CI legs is important before merge.
Detailed Findings
- NativeAOT + StripDebugSymbols now throws (inline on
ApkBuilder.cs): the hoistedprojectis only assigned in the non-NativeAOT branch, so the new guard converts a previously-packaging configuration into anInvalidOperationException. - Dead parameter left in place (non-blocking):
AndroidProject.Build(..., bool stripDebugSymbols = false, ...)(used byLibraryBuilder) still accepts but ignoresstripDebugSymbols. Not in scope of the changed lines, but the option no longer has any effect for the CMake path; consider a follow-up to reconcile the Library/Apple builder stripping story so behavior is consistent across mobile builders. - Host tag mapping (informational):
StripBinaryInPlacehardcodesdarwin-x86_64/windows-x86_64/linux-x86_64NDK prebuilt tags, which matches how the NDK shipsllvmprebuilts today; fine as-is.
Note
This review was generated by this repository's Holistic Review agentic workflow to complement the built-in Copilot review.
Generated by Holistic Review · 76.6 AIC · ⌖ 10.9 AIC · ⊞ 10K
| File.Copy(dynamicLib, Path.Combine(OutputDir, destRelative), true); | ||
| if (StripDebugSymbols) | ||
| { | ||
| if (project is null) |
There was a problem hiding this comment.
This guard turns a previously-working configuration into a hard failure for NativeAOT. When IsNativeAOT is true, project is never assigned (it stays null), so any NativeAOT Android build that enables StripDebugSymbols will now throw InvalidOperationException here instead of packaging. The .so files for NativeAOT come straight from AppDir and previously were packaged as-is regardless of StripDebugSymbols. Two options: (1) construct a lightweight AndroidProject (or factor StripBinaryInPlace so it doesn't require the CMake project state) so NativeAOT can also strip, or (2) scope the stripping/guard to the non-NativeAOT path so NativeAOT keeps its prior behavior. As written, this is a functional regression for NativeAOT + stripping rather than a defensive check for an impossible state.
Description
Fixes#115717
This PR implements post-build symbol stripping for Android to solve the disk space issue on build machines while preserving app debuggability for test infrastructure.
Problem: Build machines run out of disk space without symbol stripping. However, the previous approach of stripping symbols at compile time (
-DCMAKE_BUILD_TYPE=MinSizeRel+-sflag) also setandroid:debuggable=falsein the APK manifest, which breaksadb shell run-asaccess needed by test infrastructure.Solution: Decouple symbol stripping from debuggability by:
llvm-stripfrom the Android NDKandroid:debuggable=truein the APK manifestThis allows the build to produce both small binaries (via post-build stripping) and debuggable APKs (via manifest flag).
Changes
Modified Files:
src/tasks/MobileBuildTasks/Android/AndroidProject.csstripDebugSymbolsparameter fromGenerateCMake()andBuildCMake()methodsCMAKE_BUILD_TYPE=Debuginstead of conditionally usingMinSizeRelStripBinaryInPlace()method that usesllvm-strip --strip-debugfrom NDK toolchainsrc/tasks/AndroidAppBuilder/ApkBuilder.csAndroidProjectvariable declaration to enable post-build strippinglibmonodroid.sowhenStripDebugSymbols=true--debug-mode(setsandroid:debuggable=true)libmscordbi.so,libmscordaccore.so).sofiles during APK packaging whenStripDebugSymbols=trueTesting
./build.cmd clr+libs -rc release)Note: I don't have a local Android test environment configured. The implementation follows the standard approach of using NDK's
llvm-striptool for post-build symbol removal, which is the recommended practice for Android native libraries.Technical Details
The key architectural change is when symbols are stripped:
Before (problematic):
After (this PR):
The
llvm-strip --strip-debugcommand removes only debug sections (.debug_*,.symtab, etc.) while preserving dynamic symbols needed for runtime operation, resulting in significantly smaller binaries without affecting app functionality or debuggability.Related Issues
This unblocks work on #111491 (Enable building CoreCLR for Android) by ensuring test infrastructure can function properly with optimized builds.