Add aarch64-linux-android target

.buildkite/Dockerfile

@@ -124,8 +124,41 @@ ARG BUILDKITE_AGENT_TAGS
 RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y \
     && export PATH=$HOME/.cargo/bin:$PATH \
     && rustup install nightly \
-    && rustup default nightly
-
+    && rustup default nightly \
+    && rustup target add aarch64-linux-android x86_64-linux-android
+
+# Android NDK — sysroot/libc++/compiler-rt for --abi=android cross-compile.
+ARG ANDROID_NDK_VERSION="r27c"
+RUN curl -fsSL "https://dl.google.com/android/repository/android-ndk-${ANDROID_NDK_VERSION}-linux.zip" -o /tmp/ndk.zip \
+    && unzip -q /tmp/ndk.zip -d /opt \
+    && mv /opt/android-ndk-${ANDROID_NDK_VERSION} /opt/android-ndk \
+    && rm /tmp/ndk.zip \
+    # Trim ~1.1GB we don't use (NDK clang/lld, lldb, non-android runtimes) —
+    # we only need sysroot + android compiler-rt. Dramatically shrinks the
+    # docker layer / AMI size.
+    && rm -rf /opt/android-ndk/toolchains/llvm/prebuilt/linux-x86_64/bin \
+              /opt/android-ndk/toolchains/llvm/prebuilt/linux-x86_64/python3 \
+              /opt/android-ndk/toolchains/llvm/prebuilt/linux-x86_64/lib/liblldb.so \
+              /opt/android-ndk/toolchains/llvm/prebuilt/linux-x86_64/lib/*-gnu \
+              /opt/android-ndk/toolchains/llvm/prebuilt/linux-x86_64/lib/*-musl* \
+              /opt/android-ndk/simpleperf /opt/android-ndk/shader-tools /opt/android-ndk/sources \
+    # Symlink NDK compiler-rt builtins + libunwind into host clang's resource
+    # dir — clang's driver hardcodes <resource-dir>/lib/<triple>/libclang_rt.*
+    # with no -L fallback. Done at image-build time (root) since the build
+    # user can't write to /usr.
+    && RES=$(clang -print-resource-dir) \
+    && NDK_RT=/opt/android-ndk/toolchains/llvm/prebuilt/linux-x86_64/lib/clang/$(ls /opt/android-ndk/toolchains/llvm/prebuilt/linux-x86_64/lib/clang/)/lib/linux \
+    && mkdir -p $RES/lib/linux \
+    && for A in aarch64 x86_64; do \
+         ln -sf $NDK_RT/libclang_rt.builtins-${A}-android.a $RES/lib/linux/; \
+         mkdir -p $RES/lib/linux/${A}; \
+         ln -sf $NDK_RT/${A}/libunwind.a $RES/lib/linux/${A}/; \
+         DIR=$RES/lib/${A}-unknown-linux-android28; \
+         mkdir -p $DIR; \
+         ln -sf $NDK_RT/libclang_rt.builtins-${A}-android.a $DIR/libclang_rt.builtins.a; \
+         ln -sf $NDK_RT/${A}/libunwind.a $DIR/libunwind.a; \
+       done
+ENV ANDROID_NDK_ROOT=/opt/android-ndk
 
 RUN ARCH=$(if [ "$TARGETARCH" = "arm64" ]; then echo "arm64"; else echo "amd64"; fi) && \
     echo "Downloading buildkite" && \
@@ -190,7 +223,8 @@ COPY . /workspace/bun
 RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y \
     && export PATH=$HOME/.cargo/bin:$PATH \
     && rustup install nightly \
-    && rustup default nightly
+    && rustup default nightly \
+    && rustup target add aarch64-linux-android x86_64-linux-android
 
 ENV PATH=/root/.cargo/bin:$PATH
 

.buildkite/ci.mjs

@@ -33,7 +33,7 @@ import {
 /**
  * @typedef {"linux" | "darwin" | "windows"} Os
  * @typedef {"aarch64" | "x64"} Arch
- * @typedef {"musl"} Abi
+ * @typedef {"musl" | "android"} Abi
  * @typedef {"debian" | "ubuntu" | "alpine" | "amazonlinux"} Distro
  * @typedef {"latest" | "previous" | "oldest" | "eol"} Tier
  * @typedef {"release" | "assert" | "debug" | "asan"} Profile
@@ -129,6 +129,10 @@ const buildPlatforms = [
   { os: "linux", arch: "aarch64", abi: "musl", distro: "alpine", release: "3.23" },
   { os: "linux", arch: "x64", abi: "musl", distro: "alpine", release: "3.23" },
   { os: "linux", arch: "x64", abi: "musl", baseline: true, distro: "alpine", release: "3.23" },
+  // Android: cross-compiled from glibc amazonlinux via NDK sysroot. Host arch
+  // matches target arch so only --abi/--target/--sysroot are cross.
+  { os: "linux", arch: "aarch64", abi: "android", distro: "amazonlinux", release: "2023", features: ["docker"] },
+  { os: "linux", arch: "x64", abi: "android", distro: "amazonlinux", release: "2023", features: ["docker"] },
   { os: "windows", arch: "x64", release: "2019" },
   { os: "windows", arch: "x64", baseline: true, release: "2019" },
   { os: "windows", arch: "aarch64", release: "11" },
@@ -207,7 +211,9 @@ function getImageKey(platform) {
     key += `-with-${features.join("-")}`;
   }
 
-  if (abi) {
+  // Android cross-compiles from the same glibc image as gnu (just needs NDK,
+  // which bootstrap.sh installs on all Linux build images) — no separate image.
+  if (abi && abi !== "android") {
     key += `-${abi}`;
   }
 
@@ -488,6 +494,10 @@ function getBuildArgs(target, options, mode) {
     if (os === "linux") args.push(`--abi=${abi ?? "gnu"}`);
   } else if (abi === "musl") {
     args.push("--abi=musl");
+  } else if (abi === "android") {
+    // Android cross-compiles C++ from a glibc host: arch/abi must be explicit
+    // (host detection would report the build box's gnu/x64, not the target).
+    args.push(`--os=${os}`, `--arch=${arch}`, "--abi=android");
   }
   if (baseline) args.push("--baseline=on");
   if (profile === "asan") args.push("--asan=on");
@@ -598,6 +608,9 @@ function getTargetTriplet(platform) {
   if (abi === "musl") {
     triplet += "-musl";
   }
+  if (abi === "android") {
+    triplet += "-android";
+  }
   if (baseline) {
     triplet += "-baseline";
   }

build.zig

@@ -53,6 +53,7 @@ const BunBuildOptions = struct {
     no_llvm: bool,
     lto: bool,
     override_no_export_cpp_apis: bool,
+    android_ndk_sysroot: ?[]const u8 = null,
 
     cached_options_module: ?*Module = null,
     windows_shim: ?WindowsShim = null,
@@ -204,6 +205,14 @@ pub fn build(b: *Build) !void {
     const no_llvm = b.option(bool, "no_llvm", "Experiment with Zig self hosted backends. No stability guaranteed") orelse false;
     const lto = b.option(bool, "lto", "Emit LLVM bitcode for full LTO instead of a native object") orelse false;
     const override_no_export_cpp_apis = b.option(bool, "override-no-export-cpp-apis", "Override the default export_cpp_apis logic to disable exports") orelse false;
+    // Zig does not bundle bionic headers, so translate-c needs the NDK
+    // sysroot include paths explicitly. The obj's linkLibC() gets bionic
+    // via `zig build --libc <file>` (b.libc_file), which the build script
+    // also passes when targeting Android.
+    const android_ndk_sysroot = b.option([]const u8, "android_ndk_sysroot", "Android NDK sysroot for translate-c headers");
+    if (abi.isAndroid() and android_ndk_sysroot == null) {
+        std.debug.panic("-Dandroid_ndk_sysroot is required when targeting Android (zig does not bundle bionic headers)", .{});
+    }
 
     var build_options = BunBuildOptions{
         .target = target,
@@ -267,6 +276,7 @@ pub fn build(b: *Build) !void {
         .enable_tinycc = b.option(bool, "enable_tinycc", "Enable TinyCC for FFI JIT compilation") orelse true,
         .use_mimalloc = b.option(bool, "use_mimalloc", "Use mimalloc as default allocator") orelse false,
         .llvm_codegen_threads = b.option(u32, "llvm_codegen_threads", "Number of threads to use for LLVM codegen") orelse 1,
+        .android_ndk_sysroot = android_ndk_sysroot,
     };
 
     // zig build obj
@@ -443,7 +453,7 @@ pub fn build(b: *Build) !void {
         }) |t| {
             const resolved = t.resolveTarget(b);
             step.dependOn(
-                &b.addInstallFile(getTranslateC(b, resolved, .Debug), b.fmt("translated-c-headers/{s}.zig", .{
+                &b.addInstallFile(getTranslateC(b, resolved, .Debug, null), b.fmt("translated-c-headers/{s}.zig", .{
                     resolved.result.zigTriple(b.allocator) catch @panic("OOM"),
                 })).step,
             );
@@ -608,14 +618,16 @@ const TargetDescription = struct {
     os: OperatingSystem,
     arch: Arch,
     musl: bool = false,
+    android: bool = false,
 
     fn resolveTarget(desc: TargetDescription, b: *Build) std.Build.ResolvedTarget {
         return b.resolveTargetQuery(.{
             .os_tag = OperatingSystem.stdOSTag(desc.os),
             .cpu_arch = desc.arch,
             .cpu_model = getCpuModel(desc.os, desc.arch) orelse .determined_by_arch_os,
             .os_version_min = getOSVersionMin(desc.os),
-            .glibc_version = if (desc.musl) null else getOSGlibCVersion(desc.os),
+            .glibc_version = if (desc.musl or desc.android) null else getOSGlibCVersion(desc.os),
+            .abi = if (desc.android) .android else null,
         });
     }
 };
@@ -659,7 +671,7 @@ fn addMultiCheck(
     }
 }
 
-fn getTranslateC(b: *Build, initial_target: std.Build.ResolvedTarget, optimize: std.builtin.OptimizeMode) LazyPath {
+fn getTranslateC(b: *Build, initial_target: std.Build.ResolvedTarget, optimize: std.builtin.OptimizeMode, android_ndk_sysroot: ?[]const u8) LazyPath {
     const target = b.resolveTargetQuery(q: {
         var query = initial_target.query;
         if (query.os_tag == .windows)
@@ -684,6 +696,18 @@ fn getTranslateC(b: *Build, initial_target: std.Build.ResolvedTarget, optimize:
 
     translate_c.addIncludePath(b.path("vendor/zstd/lib"));
 
+    if (target.result.abi.isAndroid()) {
+        const sysroot = android_ndk_sysroot orelse
+            std.debug.panic("translate-c for Android requires -Dandroid_ndk_sysroot", .{});
+        const arch_triple = switch (target.result.cpu.arch) {
+            .aarch64 => "aarch64-linux-android",
+            .x86_64 => "x86_64-linux-android",
+            else => |a| std.debug.panic("unsupported Android arch: {s}", .{@tagName(a)}),
+        };
+        translate_c.addSystemIncludePath(.{ .cwd_relative = b.fmt("{s}/usr/include", .{sysroot}) });
+        translate_c.addSystemIncludePath(.{ .cwd_relative = b.fmt("{s}/usr/include/{s}", .{ sysroot, arch_triple }) });
+    }
+
     if (target.result.os.tag == .windows) {
         // translate-c is unable to translate the unsuffixed windows functions
         // like `SetCurrentDirectory` since they are defined with an odd macro
@@ -888,7 +912,7 @@ fn addInternalImports(b: *Build, mod: *Module, opts: *BunBuildOptions) void {
 
     mod.addImport("build_options", opts.buildOptionsModule(b));
 
-    const translate_c = getTranslateC(b, opts.target, opts.optimize);
+    const translate_c = getTranslateC(b, opts.target, opts.optimize, opts.android_ndk_sysroot);
     mod.addImport("translated-c-headers", b.createModule(.{ .root_source_file = translate_c }));
 
     const zlib_internal_path = switch (os) {

packages/bun-release/src/platform.ts

@@ -10,12 +10,12 @@ export const avx2 =
   arch === "x64" &&
   ((os === "linux" && isLinuxAVX2()) || (os === "darwin" && isDarwinAVX2()) || (os === "win32" && isWindowsAVX2()));
 
-export const abi = os === "linux" && isLinuxMusl() ? "musl" : undefined;
+export const abi = os === "android" ? "android" : os === "linux" && isLinuxMusl() ? "musl" : undefined;
 
 export type Platform = {
   os: string;
   arch: string;
-  abi?: "musl";
+  abi?: "musl" | "android";
   avx2?: boolean;
   bin: string;
   exe: string;
@@ -82,6 +82,24 @@ export const platforms: Platform[] = [
     bin: "bun-linux-x64-musl-baseline",
     exe: "bin/bun",
   },
+  {
+    // Node's process.platform is "android" on Android (Termux etc.), not "linux".
+    // The release asset is still named bun-linux-* for consistency with the
+    // build triplet, but npm's os field must be "android" for optionalDependency
+    // resolution to pick it up on-device.
+    os: "android",
+    arch: "arm64",
+    abi: "android",
+    bin: "bun-linux-aarch64-android",
+    exe: "bin/bun",
+  },
+  {
+    os: "android",
+    arch: "x64",
+    abi: "android",
+    bin: "bun-linux-x64-android",
+    exe: "bin/bun",
+  },
   {
     os: "win32",
     arch: "x64",

packages/bun-usockets/src/crypto/root_certs_linux.cpp

@@ -24,11 +24,28 @@ static void load_certs_from_directory(const char* dir_path, STACK_OF(X509)* cert
       continue;
     }
 
-    // Check if file has .crt, .pem, or .cer extension
+    // Accept .crt/.pem/.cer. On Android also accept OpenSSL c_rehash-style names
+    // (^[0-9a-f]{8}\.[0-9]+$) since /system/etc/security/cacerts/ uses ONLY that
+    // format. On Debian /etc/ssl/certs/ has both *.pem and <hash>.0 symlinks to
+    // the same files, so accepting both there would just double-load.
     const char* ext = strrchr(entry->d_name, '.');
-    if (!ext || (strcmp(ext, ".crt") != 0 && strcmp(ext, ".pem") != 0 && strcmp(ext, ".cer") != 0)) {
-      continue;
+    if (!ext) continue;
+    bool ok = strcmp(ext, ".crt") == 0 || strcmp(ext, ".pem") == 0 || strcmp(ext, ".cer") == 0;
+#ifdef __ANDROID__
+    if (!ok) {
+      size_t prefix = (size_t)(ext - entry->d_name);
+      if (prefix == 8) {
+        ok = true;
+        for (size_t i = 0; i < 8; i++) {
+          char c = entry->d_name[i];
+          if (!((c >= '0' && c <= '9') || (c >= 'a' && c <= 'f'))) { ok = false; break; }
+        }
+        for (const char* p = ext + 1; ok && *p; p++) if (*p < '0' || *p > '9') ok = false;
+        if (ext[1] == '\0') ok = false;
+      }
     }
+#endif
+    if (!ok) continue;
 
     // Build full path
     char filepath[PATH_MAX];
@@ -109,7 +126,16 @@ extern "C" void us_load_system_certificates_linux(STACK_OF(X509) **system_certs)
 
   // Otherwise, load certificates from standard Linux/Unix paths
   // These are the common locations for system certificates
-
+#ifdef __ANDROID__
+  // Android: no bundle files. System CAs are individual hashed PEM files.
+  static const char* bundle_paths[] = { NULL };
+  static const char* dir_paths[] = {
+    "/apex/com.android.conscrypt/cacerts",  // API 30+ (mainline updatable)
+    "/system/etc/security/cacerts",         // base system store
+    "/data/misc/user/0/cacerts-added",      // user-installed
+    NULL
+  };
+#else
   // Common certificate bundle locations (single file with multiple certs)
   // These paths are based on common Linux distributions and OpenSSL defaults
   static const char* bundle_paths[] = {
@@ -123,20 +149,21 @@ extern "C" void us_load_system_certificates_linux(STACK_OF(X509) **system_certs)
     "/usr/local/share/ca-certificates/ca-certificates.crt", // Custom CA installs
     NULL
   };
-  
+
   // Common certificate directory locations (multiple files)
   // Note: OpenSSL expects hashed symlinks in directories (c_rehash format)
   static const char* dir_paths[] = {
     "/etc/ssl/certs",           // Common location (Debian/Ubuntu with hashed links)
     "/etc/pki/tls/certs",       // RHEL/Fedora
     "/usr/share/ca-certificates", // Debian/Ubuntu (original certs, not hashed)
     "/usr/local/share/certs",   // FreeBSD
-    "/etc/openssl/certs",       // NetBSD  
+    "/etc/openssl/certs",       // NetBSD
     "/var/ssl/certs",           // AIX
     "/usr/local/etc/openssl/certs", // Homebrew OpenSSL on macOS
     "/System/Library/OpenSSL/certs", // macOS system OpenSSL (older versions)
     NULL
   };
+#endif
 
   // Try loading from bundle files first
   for (const char** path = bundle_paths; *path != NULL; path++) {

packages/bun-usockets/src/eventing/epoll_kqueue.c

@@ -138,7 +138,7 @@ static int bun_epoll_pwait2(int epfd, struct epoll_event *events, int maxevents,
             ret = sys_epoll_pwait2(epfd, events, maxevents, timeout, &mask);
         } while (ret == -EINTR);
 
-        if (LIKELY(ret != -ENOSYS && ret != -EPERM && ret != -EOPNOTSUPP)) {
+        if (LIKELY(ret != -ENOSYS && ret != -EPERM && ret != -EOPNOTSUPP && ret != -EACCES)) {
             return ret;
         }
 
@@ -564,7 +564,7 @@ size_t us_internal_accept_poll_event(struct us_poll_t *p) {
 struct us_timer_t *us_create_timer(struct us_loop_t *loop, int fallthrough, unsigned int ext_size) {
     struct us_poll_t *p = us_create_poll(loop, fallthrough, sizeof(struct us_internal_callback_t) + ext_size);
     memset(p, 0, sizeof(struct us_internal_callback_t) + ext_size);
-    int timerfd = timerfd_create(CLOCK_REALTIME, TFD_NONBLOCK | TFD_CLOEXEC);
+    int timerfd = timerfd_create(CLOCK_MONOTONIC, TFD_NONBLOCK | TFD_CLOEXEC);
     if (timerfd == -1) {
       return NULL;
     }
@@ -677,7 +677,14 @@ struct us_internal_async *us_internal_create_async(struct us_loop_t *loop, int f
     struct us_poll_t *p = us_create_poll(loop, fallthrough, sizeof(struct us_internal_callback_t) + ext_size);
     memset(p, 0, sizeof(struct us_internal_callback_t) + ext_size);
 
-    us_poll_init(p, eventfd(0, EFD_NONBLOCK | EFD_CLOEXEC), POLL_TYPE_CALLBACK);
+    int efd = eventfd(0, EFD_NONBLOCK | EFD_CLOEXEC);
+    if (efd == -1) {
+        // eventfd only fails on EMFILE/ENFILE — the loop is unusable without
+        // wakeup_async, and the sole caller doesn't NULL-check. Crash loudly
+        // rather than NULL-deref or store -1 as a poll fd.
+        BUN_PANIC("eventfd() failed during loop init (out of file descriptors?)");
+    }
+    us_poll_init(p, efd, POLL_TYPE_CALLBACK);
 
     struct us_internal_callback_t *cb = (struct us_internal_callback_t *) p;
     cb->loop = loop;

packages/bun-usockets/src/internal/internal.h

@@ -62,6 +62,9 @@ void us_internal_loop_update_pending_ready_polls(struct us_loop_t *loop,
 #define UNLIKELY(cond) __builtin_expect((_Bool)(cond), 0)
 #endif
 
+extern void __attribute((__noreturn__)) Bun__panic(const char *message, size_t length);
+#define BUN_PANIC(message) Bun__panic(message, sizeof(message) - 1)
+
 #ifdef _WIN32
 #define IS_EINTR(rc) (rc == SOCKET_ERROR && WSAGetLastError() == WSAEINTR)
 #define LIBUS_ERR WSAGetLastError()

packages/bun-usockets/src/loop.c

@@ -35,8 +35,6 @@
 
 #if ASSERT_ENABLED
 extern const size_t Bun__lock__size;
-extern void __attribute((__noreturn__)) Bun__panic(const char* message, size_t length);
-#define BUN_PANIC(message) Bun__panic(message, sizeof(message) - 1)
 #endif
 
 extern void Bun__internal_ensureDateHeaderTimerIsEnabled(struct us_loop_t *loop);