fix(addon): link the vendored static libcrypto for libssh2

.github/workflows/build-linux.yml

@@ -14,6 +14,37 @@ on:
   push:
     tags:
       - "v*"
+  # Pull requests build and verify but never publish (the --publish flag below
+  # only says "always" for a tag).
+  #
+  # paths-ignore, not paths: the default is to build, and only what is provably
+  # documentation is exempt. An allow-list would silently skip CI for any new
+  # code directory nobody remembered to add.
+  #
+  # This still means some PRs get no run at all, so do NOT mark this workflow as
+  # a required status check — a required check that never runs leaves the PR
+  # stuck on "Expected — waiting for status" forever. To have both, drop the
+  # filter and gate the expensive steps with an `if:` on the changed paths
+  # instead, so the check always reports a conclusion.
+  pull_request:
+    branches:
+      - main
+    paths-ignore:
+      - "**.md"
+      - "site/**"
+      - "images/**"
+      - "LICENSE"
+
+# One build per ref: a new push to a PR supersedes the one still running.
+#
+# cancel-in-progress is deliberately limited to pull requests. A tag build ends
+# in `electron-builder --publish always`, and killing that mid-upload can leave
+# the GitHub Release with a latest-linux.yml pointing at assets that were never
+# finished uploading — which is exactly what electron-updater then hands to
+# every installed client.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 # Needed for electron-builder to upload artifacts to the GitHub Release on a
 # tag push. The default GITHUB_TOKEN is read-only, so publishing fails with
@@ -95,6 +126,22 @@ jobs:
         working-directory: ui/electron
         run: npm ci --ignore-scripts
 
+      # Compile the addon against Electron's ABI here, before packaging, purely
+      # so the audit below can gate the release: on a tag push electron-builder
+      # publishes as it packages, so a check that runs afterwards is too late.
+      # electron-builder's own @electron/rebuild step then finds it up to date.
+      - name: Build native addon for Electron
+        working-directory: ui/electron
+        run: npx electron-rebuild --only gitbox-addon --force
+
+      # Guards issue #1. The addon must carry libgit2/libssh2/mbedTLS/OpenSSL
+      # inside itself; when an archive is missing from binding.gyp nothing fails
+      # at build time — the app just dies on the user's machine with
+      # "undefined symbol: EVP_des_ede3_cbc".
+      - name: Verify the native addon is self-contained
+        working-directory: core/addon
+        run: npm test
+
       # electron-builder runs @electron/rebuild first (compiling gitbox_addon
       # and node-pty against Electron via node-gyp + the vendored libs), then
       # packages the AppImage/deb/rpm/pacman targets declared in package.json.

.github/workflows/build-windows.yml

@@ -15,6 +15,22 @@ on:
   push:
     tags:
       - "v*"
+  # Same rules as build-linux.yml: PRs build and verify, never publish, and the
+  # filter exempts documentation rather than allow-listing code.
+  pull_request:
+    branches:
+      - main
+    paths-ignore:
+      - "**.md"
+      - "site/**"
+      - "images/**"
+      - "LICENSE"
+
+# One build per ref, cancelling superseded PR runs only — never a publishing tag
+# build. See build-linux.yml for why.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 # Needed for electron-builder to upload artifacts to the GitHub Release on a
 # tag push. The default GITHUB_TOKEN is read-only, so publishing fails with
@@ -96,6 +112,19 @@ jobs:
         working-directory: ui/electron
         run: npm ci --ignore-scripts
 
+      # Built here (not left to electron-builder) so the audit below runs before
+      # a tag push publishes the installers. See build-linux.yml for the why.
+      - name: Build native addon for Electron
+        working-directory: ui/electron
+        run: npx electron-rebuild --only gitbox-addon --force
+
+      # Guards issue #1. On Windows this checks the addon imports no DLL beyond
+      # the system set (dumpbin comes from the MSVC environment above); the
+      # symbol-level audit needs nm and skips itself here.
+      - name: Verify the native addon is self-contained
+        working-directory: core/addon
+        run: npm test
+
       # electron-builder runs @electron/rebuild first (compiling gitbox_addon
       # and node-pty against Electron via node-gyp + the vendored libs), then
       # packages the NSIS and MSI targets declared in package.json.

core/addon/binding.gyp

@@ -24,23 +24,37 @@
       },
       "conditions": [
         ["OS=='linux'", {
+          # Archive order matters: libssh2 pulls symbols out of libcrypto, so
+          # libcrypto.a must come after it. Linking the vendored static
+          # libcrypto is NOT optional — libssh2's crypt-method table holds
+          # direct data relocations to EVP_* (R_X86_64_64), which the loader
+          # must resolve at dlopen time. Leave it out and the addon silently
+          # borrows the host process's OpenSSL: plain node exports its own
+          # (so it "works"), but Electron ships BoringSSL and has no
+          # EVP_des_ede3_cbc, so the app dies at startup with
+          # "undefined symbol: EVP_des_ede3_cbc" (issue #1).
           "libraries": [
             "<(module_root_dir)/vendor/libgit2/install/lib/libgit2.a",
             "<(module_root_dir)/vendor/libssh2/install/lib/libssh2.a",
+            "<(module_root_dir)/vendor/openssl/install/lib/libcrypto.a",
             "<(module_root_dir)/vendor/mbedtls/install/lib/libmbedtls.a",
             "<(module_root_dir)/vendor/mbedtls/install/lib/libmbedx509.a",
             "<(module_root_dir)/vendor/mbedtls/install/lib/libmbedcrypto.a",
-            "-lrt"
+            "-lrt",
+            "-ldl",
+            "-lpthread"
           ],
           "ldflags": [
             "-Wl,-Bsymbolic",
             "-Wl,--exclude-libs,ALL"
           ]
         }],
         ["OS=='mac'", {
+          # Same libssh2 -> libcrypto rule as Linux; see the note above.
           "libraries": [
             "<(module_root_dir)/vendor/libgit2/install/lib/libgit2.a",
             "<(module_root_dir)/vendor/libssh2/install/lib/libssh2.a",
+            "<(module_root_dir)/vendor/openssl/install/lib/libcrypto.a",
             "<(module_root_dir)/vendor/mbedtls/install/lib/libmbedtls.a",
             "<(module_root_dir)/vendor/mbedtls/install/lib/libmbedx509.a",
             "<(module_root_dir)/vendor/mbedtls/install/lib/libmbedcrypto.a"

core/addon/package.json

@@ -5,7 +5,8 @@
   "main": "index.js",
   "gypfile": true,
   "scripts": {
-    "build": "node-gyp rebuild"
+    "build": "node-gyp rebuild",
+    "test": "node --test test/self-contained.test.js"
   },
   "dependencies": {
     "bindings": "^1.5.0",