chore(ios): add static OpenSSL build tooling for Apple platforms - #1068
Merged
Conversation
Build tooling only — nothing consumes the output yet. Split out from the #1059 fix so the workflow lands on main, since workflow_dispatch is only available for workflows on the default branch. scripts/build-openssl-apple.sh builds static OpenSSL for the seven Apple slices QuickCrypto supports, renames every global symbol to rnqc_* and demotes the originals to non-external, then packages an xcframework. The rename happens at link level (ld -r + -alias_list + -unexported_symbols_list) rather than through a -include prefix header, so it also covers perlasm symbols that the preprocessor cannot reach. Also scopes release-it's tag lookup to v* — the openssl-apple-* release tags share history with the npm releases, and tagMatch defaults to null, so git describe would otherwise derive the next version from them.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Build tooling only. Nothing consumes the output yet — no podspec change, no dependency change, no behaviour change. Safe to merge on its own.
Split out from the #1059 fix for one reason:
workflow_dispatchis only available for workflows that exist on the default branch, so the workflow has to land onmainbefore it can be run at all.What's here
scripts/build-openssl-apple.sh— builds static OpenSSL for the seven Apple slices we support (ios, ios-sim, macos, tvos, tvos-sim, xros, xros-sim), renames every global symbol tornqc_*, demotes the originals to non-external, and packages an xcframework plus a force-include prefix header.The rename happens at link level (
ld -r+-alias_list+-unexported_symbols_list), not through a BoringSSL-style-includeprefix header. That distinction matters: a prefix header cannot rewrite.globl _sha256_block_data_order, so every perlasm symbol would stay globally visible and still collide..github/workflows/build-openssl-apple.yml—workflow_dispatchwith an OpenSSL version input; builds, creates theopenssl-apple-<version>release, and prints the checksum to paste into the podspec.package.json— scopes release-it's tag lookup tov*. This is a prerequisite, not a drive-by:tagMatchdefaults tonull, so once anopenssl-apple-3.6.2tag exists on the same history,git describe --tags --abbrev=0returns it and release-it derives the next package version from it.Verification
Ran the full script locally — all 7 slices build, and each produced archive has zero unprefixed external symbols and zero dangling aliases:
Every slice links against a test consumer, and the macOS one executes: SHA-256 and P-256 keygen both run correctly through the renamed symbols.
Two bugs were found and fixed during that verification:
ld64emits an undefined alias for common symbols (needs-fno-common), and an over-eager symbol filter silently dropped 22 legitimate_CONF_*/_armv8_*names.Not verified
The workflow itself has never run on a GitHub runner — the script is verified, the CI wrapper around it is not.
🤖 Generated with Claude Code