rickub
Sign in Get started
nandi/frqpublic⑂ Fork 0
⑂ 7ef496a
Branches
claude/add-remote-repository-47d12e main View all branches → View all tags →
Commits
⬇ Clone ▾
git clone https://git.rickub.com/nandi/frq.git
git clone ssh://git@rickub.com/nandi/frq.git

Host key fingerprint (ed25519): SHA256:iycHnxEyq0Q7uyVpB7JlznP0G7JrTPXLYRcAU5CSLhc — verify it before your first connect.

Carry OpenSSL into the APK

The platform's libssl is not an app's to load: the linker namespace refuses
/system/lib64/libssl.so, whoever asks. Without one there is no TLS on the
phone at all — no sign-in, no upload, no image the client fetches itself — so
the APK brings its own, beside the libraries it already carries, which is
where an app's namespace answers for the name.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
nandi committed 2026-08-30T18:20:59-07:00 Browse files
7ef496a parent: 7b6e915
modified android/build-apk.sh +12 -2
@@ -9,6 +9,9 @@
99 # classes.dex one Java class, and only because a picture chooser answers
1010 # through onActivityResult and a NativeActivity has nowhere to
1111 # deliver that
12+# libssl.so OpenSSL, because the platform's own is not ours to load: an
13+# libcrypto.so app's linker namespace refuses /system/lib64/libssl.so, and
14+# without one there is no TLS at all on the phone
1215 #
1316 # Neither half is built here beyond that last link: the UI library comes from
1417 # vidya's `just ffi-android` and the boot image from build-jolt-boot.sh. Both
@@ -20,6 +23,7 @@ VIDYA="${VIDYA:-$(cd "$ROOT/../vidya" && pwd)}"
2023 ANDROID_HOME="${ANDROID_HOME:-$HOME/.local/share/android-sdk}"
2124 ANDROID_NDK_HOME="${ANDROID_NDK_HOME:-$HOME/.local/share/android-ndk-r29}"
2225 CHEZ_ANDROID="${CHEZ_ANDROID:-$HOME/.cache/vidya-chez-android}"
26+OPENSSL_ANDROID="${OPENSSL_ANDROID:-$HOME/.cache/frq-openssl-android/lib}"
2327 BUILD="$ROOT/android/build"
2428 JOLT_BUILD="$BUILD/jolt"
2529 STAGE="$BUILD/stage"
@@ -33,7 +37,8 @@ API=28
3337 for path in \
3438 "$NDK_BIN/aarch64-linux-android$API-clang" \
3539 "$ANDROID_HOME/platforms/android-36/android.jar" \
36- "$TOOLS/aapt2" "$TOOLS/zipalign" "$TOOLS/apksigner" "$TOOLS/d8"; do
40+ "$TOOLS/aapt2" "$TOOLS/zipalign" "$TOOLS/apksigner" "$TOOLS/d8" \
41+ "$OPENSSL_ANDROID/libssl.so" "$OPENSSL_ANDROID/libcrypto.so"; do
3742 [[ -e "$path" ]] || { echo "missing Android tool: $path" >&2; exit 1; }
3843 done
3944
@@ -76,6 +81,10 @@ rm -rf "$STAGE"
7681 mkdir -p "$STAGE/lib/arm64-v8a"
7782 cp "$JAVA_BUILD/classes.dex" "$STAGE/classes.dex"
7883 cp "$VIDYA_SO" "$STAGE/lib/arm64-v8a/libvidya.so"
84+# jolt.mvn-http dlopens these by name at first use; beside the app's own
85+# libraries is where an app's namespace will answer for that name.
86+cp "$OPENSSL_ANDROID/libssl.so" "$OPENSSL_ANDROID/libcrypto.so" \
87+ "$STAGE/lib/arm64-v8a/"
7988
8089 "$NDK_BIN/aarch64-linux-android$API-clang" \
8190 -shared -fPIC -O2 \
@@ -106,7 +115,8 @@ rm -f "$UNALIGNED" "$ALIGNED" "$APK"
106115 --version-name 0.1.0
107116 # Stored, not deflated: the loader maps these straight out of the APK.
108117 (cd "$STAGE" && zip -q -0 "$UNALIGNED" \
109- lib/arm64-v8a/libvidya.so lib/arm64-v8a/libjoltapp.so)
118+ lib/arm64-v8a/libvidya.so lib/arm64-v8a/libjoltapp.so \
119+ lib/arm64-v8a/libssl.so lib/arm64-v8a/libcrypto.so)
110120 # The dex is read by the runtime rather than mapped, so it may as well deflate.
111121 (cd "$STAGE" && zip -q "$UNALIGNED" classes.dex)
112122 "$TOOLS/zipalign" -f -p 4 "$UNALIGNED" "$ALIGNED"
@@ -9,6 +9,9 @@
9 # classes.dex one Java class, and only because a picture chooser answers9 # classes.dex one Java class, and only because a picture chooser answers
10 # through onActivityResult and a NativeActivity has nowhere to10 # through onActivityResult and a NativeActivity has nowhere to
11 # deliver that11 # deliver that
12+# libssl.so OpenSSL, because the platform's own is not ours to load: an
13+# libcrypto.so app's linker namespace refuses /system/lib64/libssl.so, and
14+# without one there is no TLS at all on the phone
12 #15 #
13 # Neither half is built here beyond that last link: the UI library comes from16 # Neither half is built here beyond that last link: the UI library comes from
14 # vidya's `just ffi-android` and the boot image from build-jolt-boot.sh. Both17 # vidya's `just ffi-android` and the boot image from build-jolt-boot.sh. Both
@@ -20,6 +23,7 @@ VIDYA="${VIDYA:-$(cd "$ROOT/../vidya" && pwd)}"
20 ANDROID_HOME="${ANDROID_HOME:-$HOME/.local/share/android-sdk}"23 ANDROID_HOME="${ANDROID_HOME:-$HOME/.local/share/android-sdk}"
21 ANDROID_NDK_HOME="${ANDROID_NDK_HOME:-$HOME/.local/share/android-ndk-r29}"24 ANDROID_NDK_HOME="${ANDROID_NDK_HOME:-$HOME/.local/share/android-ndk-r29}"
22 CHEZ_ANDROID="${CHEZ_ANDROID:-$HOME/.cache/vidya-chez-android}"25 CHEZ_ANDROID="${CHEZ_ANDROID:-$HOME/.cache/vidya-chez-android}"
26+OPENSSL_ANDROID="${OPENSSL_ANDROID:-$HOME/.cache/frq-openssl-android/lib}"
23 BUILD="$ROOT/android/build"27 BUILD="$ROOT/android/build"
24 JOLT_BUILD="$BUILD/jolt"28 JOLT_BUILD="$BUILD/jolt"
25 STAGE="$BUILD/stage"29 STAGE="$BUILD/stage"
@@ -33,7 +37,8 @@ API=28
33 for path in \37 for path in \
34 "$NDK_BIN/aarch64-linux-android$API-clang" \38 "$NDK_BIN/aarch64-linux-android$API-clang" \
35 "$ANDROID_HOME/platforms/android-36/android.jar" \39 "$ANDROID_HOME/platforms/android-36/android.jar" \
36- "$TOOLS/aapt2" "$TOOLS/zipalign" "$TOOLS/apksigner" "$TOOLS/d8"; do40+ "$TOOLS/aapt2" "$TOOLS/zipalign" "$TOOLS/apksigner" "$TOOLS/d8" \
41+ "$OPENSSL_ANDROID/libssl.so" "$OPENSSL_ANDROID/libcrypto.so"; do
37 [[ -e "$path" ]] || { echo "missing Android tool: $path" >&2; exit 1; }42 [[ -e "$path" ]] || { echo "missing Android tool: $path" >&2; exit 1; }
38 done43 done
39 44
@@ -76,6 +81,10 @@ rm -rf "$STAGE"
76 mkdir -p "$STAGE/lib/arm64-v8a"81 mkdir -p "$STAGE/lib/arm64-v8a"
77 cp "$JAVA_BUILD/classes.dex" "$STAGE/classes.dex"82 cp "$JAVA_BUILD/classes.dex" "$STAGE/classes.dex"
78 cp "$VIDYA_SO" "$STAGE/lib/arm64-v8a/libvidya.so"83 cp "$VIDYA_SO" "$STAGE/lib/arm64-v8a/libvidya.so"
84+# jolt.mvn-http dlopens these by name at first use; beside the app's own
85+# libraries is where an app's namespace will answer for that name.
86+cp "$OPENSSL_ANDROID/libssl.so" "$OPENSSL_ANDROID/libcrypto.so" \
87+ "$STAGE/lib/arm64-v8a/"
79 88
80 "$NDK_BIN/aarch64-linux-android$API-clang" \89 "$NDK_BIN/aarch64-linux-android$API-clang" \
81 -shared -fPIC -O2 \90 -shared -fPIC -O2 \
@@ -106,7 +115,8 @@ rm -f "$UNALIGNED" "$ALIGNED" "$APK"
106 --version-name 0.1.0115 --version-name 0.1.0
107 # Stored, not deflated: the loader maps these straight out of the APK.116 # Stored, not deflated: the loader maps these straight out of the APK.
108 (cd "$STAGE" && zip -q -0 "$UNALIGNED" \117 (cd "$STAGE" && zip -q -0 "$UNALIGNED" \
109- lib/arm64-v8a/libvidya.so lib/arm64-v8a/libjoltapp.so)118+ lib/arm64-v8a/libvidya.so lib/arm64-v8a/libjoltapp.so \
119+ lib/arm64-v8a/libssl.so lib/arm64-v8a/libcrypto.so)
110 # The dex is read by the runtime rather than mapped, so it may as well deflate.120 # The dex is read by the runtime rather than mapped, so it may as well deflate.
111 (cd "$STAGE" && zip -q "$UNALIGNED" classes.dex)121 (cd "$STAGE" && zip -q "$UNALIGNED" classes.dex)
112 "$TOOLS/zipalign" -f -p 4 "$UNALIGNED" "$ALIGNED"122 "$TOOLS/zipalign" -f -p 4 "$UNALIGNED" "$ALIGNED"