fix: pin MACOSX_DEPLOYMENT_TARGET for cargo build (CRAN M1mac WARNING)

DESCRIPTION

@@ -1,7 +1,7 @@
 Package: pdfsigner
 Title: Digitally Sign and Verify PDF Documents
 Type: Package
-Version: 0.2.3
+Version: 0.2.4
 Authors@R: c(
               person("Andre", "Leite",
                 email = "leite@castlab.org",

cran-comments.md

@@ -1,11 +1,24 @@
 ## Submission notes
 
-This is the first CRAN submission of `pdfsigner`.
+This is a resubmission of `pdfsigner` (0.2.4) addressing the issue reported by
+Prof. Brian Ripley on the M1mac additional check for 0.2.2.
 
 `pdfsigner` digitally signs and verifies PDF documents. All cryptography and PDF
 manipulation are performed by a bundled, pure-Rust backend (the `pdf_signer`
 crate); there is no Java runtime, OpenSSL, or external command-line dependency.
 
+### Fix for the M1mac linker WARNING (0.2.2)
+
+The M1mac check of 0.2.2 reported "object file ... was built for newer 'macOS'
+version (26.5) than being linked (26.0)" for the C/assembly object files of the
+bundled `ring` crate. The cause is that, when `MACOSX_DEPLOYMENT_TARGET` is
+unset, the macOS deployment target chosen by the `cc` crate (the host SDK
+version) differs from the one used by `rustc` and by R's link step. We now
+export an explicit `MACOSX_DEPLOYMENT_TARGET` for the `cargo build` step on
+macOS (in `tools/config.R` / `src/Makevars.in`), using R's own value when set
+and otherwise the per-architecture rustc default minimum, so all objects share
+a single deployment target <= R's link target and the warning no longer occurs.
+
 ### Rust / SystemRequirements
 
 The package needs the Rust toolchain (`cargo`, `rustc`) at build time, declared
@@ -34,13 +47,14 @@ copyright holders in `Authors@R` and enumerated in `inst/AUTHORS`.
 
 ## R CMD check results
 
-On CRAN's build machines we expect 0 errors | 0 warnings | NOTEs for:
+We expect 0 errors | 0 warnings, including on the M1mac additional check that
+previously warned (the deployment-target fix above eliminates that WARNING).
+
+A remaining NOTE is expected on some platforms:
 
-* New submission.
 * Installed size (~12 MB) and source tarball size (~18 MB), both driven by the
   vendored Rust sources and the compiled static library, as explained above.
 
-Locally we additionally see two environment-specific messages that will not
-appear on CRAN's infrastructure: a linker warning about an SDK version mismatch
-(our toolchain's macOS SDK is newer than the one R was built against) and a
-"HTML Tidy not recent enough" NOTE (our local `tidy` is outdated).
+Locally we additionally see a "HTML Tidy not recent enough" NOTE that is
+environment-specific (our local `tidy` is outdated) and will not appear on
+CRAN's infrastructure.

src/Makevars.in

@@ -36,7 +36,7 @@ $(STATLIB):
 
 	export CARGO_HOME=$(CARGOTMP) && \
 	export PATH="$(PATH):$(HOME)/.cargo/bin" && \
-	@PANIC_EXPORTS@RUSTFLAGS="$(RUSTFLAGS) --print=native-static-libs" cargo build @CRAN_FLAGS@ --lib @PROFILE@ --manifest-path=./rust/Cargo.toml --target-dir $(TARGET_DIR) @TARGET@
+	@MACOS_DEPLOYMENT_TARGET@@PANIC_EXPORTS@RUSTFLAGS="$(RUSTFLAGS) --print=native-static-libs" cargo build @CRAN_FLAGS@ --lib @PROFILE@ --manifest-path=./rust/Cargo.toml --target-dir $(TARGET_DIR) @TARGET@
 
 	# Note: the extendr R wrappers (R/extendr-wrappers.R) are generated at
 	# development time with rextendr::document() and committed to the package,

tools/config.R

@@ -70,6 +70,25 @@ cfg <- if (is_debug) "debug" else "release"
   ""
 )
 
+# On macOS, pin the deployment target for the cargo build so that the C/asm
+# objects compiled by the `cc` crate (in the bundled `ring`) use the same
+# minimum-macOS version as `rustc` and as R's final link step. Without this,
+# `cc` defaults to the host SDK version (e.g. 26.5) while R links at a lower
+# target (e.g. 26.0), producing "object file was built for newer 'macOS'
+# version than being linked" linker warnings (CRAN M1mac check). The warning is
+# one-directional, so a value <= R's link target is always safe; we prefer R's
+# own MACOSX_DEPLOYMENT_TARGET when set, else fall back to rustc's per-arch
+# default minimum.
+.macos_deployment_target <- ""
+if (identical(Sys.info()[["sysname"]], "Darwin")) {
+  dt <- Sys.getenv("MACOSX_DEPLOYMENT_TARGET")
+  if (!nzchar(dt)) {
+    arch <- R.version$arch
+    dt <- if (grepl("aarch64|arm64", arch)) "11.0" else "10.13"
+  }
+  .macos_deployment_target <- paste0("MACOSX_DEPLOYMENT_TARGET=", dt, " ")
+}
+
 # read in the Makevars.in file checking
 is_windows <- .Platform[["OS.type"]] == "windows"
 
@@ -102,7 +121,8 @@ new_txt <- gsub("@CRAN_FLAGS@", .cran_flags, mv_txt) |>
   gsub("@CLEAN_TARGET@", .clean_targets, x = _) |>
   gsub("@LIBDIR@", .libdir, x = _) |>
   gsub("@TARGET@", .target, x = _) |>
-  gsub("@PANIC_EXPORTS@", .panic_exports, x = _)
+  gsub("@PANIC_EXPORTS@", .panic_exports, x = _) |>
+  gsub("@MACOS_DEPLOYMENT_TARGET@", .macos_deployment_target, x = _)
 
 message("Writing `", mv_ofp, "`.")
 con <- file(mv_ofp, open = "wb")