fix(ci): vendor OpenSSL unconditionally so cross-compiled release targets link#6279
Merged
Conversation
github-actions
Bot
added
size/S
houko
enabled auto-merge (squash)
June 22, 2026 23:52
…gets link webauthn-rs (via webauthn-rs-core) pulls in openssl-sys as a non-optional transitive dependency for every target, so every release build must resolve an OpenSSL library. #6161 added `openssl = { features = ["vendored"] }` but placed it under `[target.'cfg(windows)'.dependencies]`, so the vendored feature only activated on Windows. That fixed the Windows MSVC runners but left every cross-compiled target broken: aarch64-unknown-linux-gnu, x86_64/aarch64-apple-darwin, aarch64-linux-android, and the musl static targets have no usable cross OpenSSL, so openssl-sys falls back to probing the build host and either fails to find a directory (Android: "Could not find directory of OpenSSL installation") or finds the host's 1.0.2g and aborts on the version mismatch. The Release workflow has failed on every tag since (beta.21, beta.22). Move the dependency to the unconditional `[dependencies]` section so feature-unification builds openssl-sys from source on all targets. Vendoring (openssl-src) is the standard, supported path for `cross` builds and also makes the released native binaries self-contained instead of depending on the user's system OpenSSL at runtime. ubuntu-22.04, macos-latest, and the cross images all ship the Perl + C-compiler prerequisites.
A release that loses a single CLI build job ships without that platform's asset and becomes a "stuck" release the installer fallback (#6272) cannot recover from when no release has the asset. Besides the OpenSSL failure fixed in the previous commit, the x86_64-apple-darwin job in v2026.6.22-beta.22 died after 17s on a transient `cargo fetch` error — "[16] Error in the HTTP2 framing layer" while downloading unicode-ident — leaving the Intel-macOS asset missing. Set CARGO_NET_RETRY=10 and CARGO_HTTP_MULTIPLEXING=false on the workflow so a transient crates.io hiccup retries instead of dropping an asset. Disabling HTTP/2 multiplexing is the canonical workaround for the framing-layer error; the retry bump covers other intermittent registry failures. Env-only, no effect on the produced binaries.
houko
force-pushed
the
fix/release-openssl-vendored
branch
from
June 23, 2026 00:27
c87c8f5 to
9638b86
Compare
github-actions
Bot
added
size/S
This was referenced Jun 24, 2026
houko
added a commit
that referenced
this pull request
Jun 26, 2026
…piles for Android (#6335) The Android Tauri builds (mobile-smoke `Android (debug, unsigned)` and release `Mobile / Android`) have failed on main since #6279 vendored OpenSSL: openssl-src builds it from source for `aarch64-linux-android` and runs `make install_dev`, which calls `aarch64-linux-android-ranlib` via its CROSS_COMPILE prefix. NDK r23+ (this repo pins r27) dropped the legacy `<target>-ranlib`/`-ar` wrappers for `llvm-ranlib`/`llvm-ar`, so the archive step exits 127. Symlink the legacy-named ar/ranlib/nm/strip to their llvm equivalents after NDK_HOME is exported, in both Android jobs; release.yml also builds armv7-linux-androideabi so both ABI prefixes are linked.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The Release workflow has failed on every tag since beta.21 (also beta.22, #6273). The
CLI / *build jobs for every cross-compiled target die in ~4 min during Build CLI:aarch64-unknown-linux-gnu,*-apple-darwin,aarch64-linux-android,*-musl (static)→error: failed to run custom build command for openssl-sys v0.9.117Could not find directory of OpenSSL installationThis crate is only compatible with OpenSSL (1.1.0, 1.1.1, 3.x, 4.x) … but a different version of OpenSSL was found(it picked up the build host's 1.0.2g,version_number=1000207f)The native
x86_64-unknown-linux-gnuand Windows jobs pass, which is why it looked intermittent.Root cause
webauthn-rs(viawebauthn-rs-core) pulls inopenssl-sysas a non-optional transitive dependency for every target, so every release build must resolve an OpenSSL library. #6161 addedopenssl = { version = "0.10", features = ["vendored"] }to fix the Windows MSVC runners — but placed it under[target.'cfg(windows)'.dependencies], so thevendoredfeature only unified on Windows.Every cross-compiled target therefore still built
openssl-sysin non-vendored mode and probed the build host for OpenSSL — which has no usable cross library. Native x86_64-linux happened to have system OpenSSL 3.x and Windows had vendored, so only those two passed.Fix
Move the
openssldependency from the Windows-only section to the unconditional[dependencies]section. Feature-unification now buildsopenssl-sysfrom source (openssl-src) on all targets instead of probing for a system library.This is the standard, supported approach for
crossbuilds, and as a bonus makes the released native binaries self-contained (statically linked OpenSSL) rather than depending on the user's system OpenSSL at runtime.ubuntu-22.04,macos-latest, and thecrossimages all ship the Perl + C-compiler prerequisitesopenssl-srcneeds;nasmis auto-detected with a no-asm fallback.Supersedes the Windows-only #6161.
Verification
vendoredfeature itself is already proven (it is how the Windows release jobs succeed today).