fix(android): drop native-tls/openssl-sys from Android build; bump setup-android to v4 by giswqs · Pull Request #1336 · opengeos/GeoLibre

giswqs · 2026-07-19T01:50:18Z

Problem

The v2.2.0 Android release build (run 29668727337) failed while cross-compiling openssl-sys for aarch64-linux-android:

error: failed to run custom build command for `openssl-sys v0.9.117`
  Could not find directory of OpenSSL installation, and this `-sys` crate
  cannot proceed without this knowledge.

openssl-sys is pulled in only by reqwest's native-tls feature, which was added for the desktop mutual-TLS PKCS#12 client-certificate path (#1220). Android has no such path, and openssl-sys has no vendored NDK cross build — so the whole toolchain has nothing to link against.

The run also emitted a deprecation warning: android-actions/setup-android@… (v3) targets the now-removed Node.js 20.

Fix

Gate native-tls off Android. Moved the native-tls feature from the shared reqwest dependency to a cfg(not(target_os = "android")) target dependency, and cfg-gated the code that uses it (ClientIdentity::Pkcs12 + the use_native_tls() builder arm). Android now returns a clear "PKCS#12 client certificates are not supported on this platform" error instead of silently misreading the bundle as PEM. Desktop builds are unchanged — openssl-sys stays in their dependency tree.
Bump android-actions/setup-android v3 → v4.0.1, which runs on Node.js 24.

Verification

cargo tree -i openssl-sys for --target aarch64-linux-android → nothing to print (removed); host target still shows it via native-tls → reqwest.
cargo check --lib and the client_cert unit tests pass on the host.

Summary by CodeRabbit

Bug Fixes
- Improved Android build reliability by updating the Android SDK setup process.
- Prevented unsupported PKCS#12 client certificates from being used on Android and added clearer error handling.
- Preserved PKCS#12 client-certificate support on supported desktop platforms.
- Improved TLS and certificate compatibility across desktop and Android builds.

The Android release build failed to compile openssl-sys for aarch64-linux-android ("Could not find directory of OpenSSL installation"). openssl-sys is pulled in solely by reqwest's native-tls feature, which backs the desktop mTLS PKCS#12 client-certificate path (issue #1220) and has no use on Android; openssl-sys has no vendored NDK cross build. Move native-tls to a cfg(not(target_os = "android")) target dependency and cfg-gate the code that uses it (the ClientIdentity::Pkcs12 variant and the native-tls builder path). Android surfaces a clear error if a PKCS#12 cert is configured rather than misreading it as PEM. Desktop builds are unchanged (openssl-sys stays in their dependency tree). Also bump android-actions/setup-android v3 -> v4.0.1 so the step runs on Node.js 24 (v3 targeted the now-deprecated Node.js 20).

netlify · 2026-07-19T01:50:22Z

✅ Deploy Preview for geolibre-app ready!

Name	Link
🔨 Latest commit	`9f75eff`
🔍 Latest deploy log	https://app.netlify.com/projects/geolibre-app/deploys/6a5c2d5c1283210008cab0f6
😎 Deploy Preview	https://deploy-preview-1336--geolibre-app.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

coderabbitai · 2026-07-19T01:51:12Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 44567337-30dc-4556-a089-34784a5404d7

📥 Commits

Reviewing files that changed from the base of the PR and between de5df25 and 9f75eff.

📒 Files selected for processing (3)

.github/workflows/android.yml
apps/geolibre-desktop/src-tauri/Cargo.toml
apps/geolibre-desktop/src-tauri/src/lib.rs

📝 Walkthrough

Walkthrough

Android CI updates its setup action. Desktop Rust dependencies enable native-tls only outside Android, and PKCS#12 client-certificate handling is conditionally excluded from Android builds.

Changes

Android TLS compatibility

Layer / File(s)	Summary
Android toolchain and TLS dependencies `.github/workflows/android.yml`, `apps/geolibre-desktop/src-tauri/Cargo.toml`	The Android setup action pin is updated, and `reqwest` enables `native-tls` only for non-Android targets.
Platform-specific PKCS#12 handling `apps/geolibre-desktop/src-tauri/src/lib.rs`	PKCS#12 parsing and native-tls identity configuration are excluded on Android, which reports an unsupported-platform error.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

opengeos/GeoLibre#1225: Related reqwest TLS wiring and PKCS#12 client-certificate handling.

Suggested reviewers: copilot

Poem

I’m a rabbit guarding TLS,
With Android-safe hops and bliss.
Native roots stay in their lane,
PKCS#12 waits off the train.
Setup pins shine bright and new—
A carrot-crafted build comes through!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main Android build fix and the setup-android version bump.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/android-openssl-build

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-07-19T01:52:00Z

⚡ Cloudflare Pages preview

Item	Value
Preview	https://70b5d13a.geolibre-preview.pages.dev
Demo app	https://70b5d13a.geolibre-preview.pages.dev/demo/
Commit	`c0f5e7e`

github-actions · 2026-07-19T01:54:33Z

+            Err(format!(
+                "PKCS#12 client certificates are not supported on this platform: {}",
+                path.display()
+            ))


Nice, clear failure mode instead of silently misreading the bundle. One follow-up: this is a genuinely new platform limitation (PKCS#12 client certs work on desktop, not on Android), but neither docs/android.md's "Known limitations / follow-ups" section nor the mTLS env-var table in docs/architecture.md (lines 120-129) mentions it. Worth a one-line addition to docs/android.md so this doesn't surprise someone configuring GEOLIBRE_HTTP_CLIENT_CERT on an Android build later.

Confidence: medium.

github-actions · 2026-07-19T01:54:47Z

Code review

I reviewed the diff (.github/workflows/android.yml, apps/geolibre-desktop/src-tauri/Cargo.toml, apps/geolibre-desktop/src-tauri/src/lib.rs) against the surrounding source for context. This is a small, carefully-scoped fix; I did not find correctness, security, or performance defects in the changed lines.

Bugs

None found. The cfg-gating is internally consistent: ClientIdentity::Pkcs12 and its two use sites (client_identity(), build_guarded_http_client()) are all gated with matching #[cfg(not(target_os = "android"))], so the match in build_guarded_http_client stays exhaustive on every target, and no Android build can reference a native-tls API that no longer exists in its feature set. Verified there are no other references to Pkcs12/ClientIdentity left ungated. Confidence: high.
The [dependencies] / [target.'cfg(not(target_os = "android"))'.dependencies] split of reqwest's features is a standard, valid Cargo pattern — Cargo unifies features across normal and target-specific tables for the same package+version, so non-Android builds still get native-tls unioned in. Confidence: high.

Security

None found. No new input handling, secrets, or trust-boundary changes; the SSRF guard and cert-loading error handling are untouched apart from the platform gate.

Performance

None found beyond a pre-existing, trivial pattern: on Android, client_identity() still reads the cert file bytes from disk before checking whether it's a (now-unsupported) PKCS#12 bundle, so a misconfigured Android build pays one wasted small file read before erroring. Not introduced by this PR's logic and not worth restructuring for a rarely-hit error path. Confidence: low.

Quality

Docs gap: this PR introduces a genuine new platform limitation (PKCS#12 client certs are unsupported on Android) but doesn't mention it in docs/android.md's "Known limitations / follow-ups" section or the mTLS env-var table in docs/architecture.md (~lines 120-129), both of which document this exact feature. Left as an inline comment. Confidence: medium.
Comments are thorough and accurately explain the why (matches CLAUDE.md's guidance to explain non-obvious constraints), and the Android error message ("PKCS#12 client certificates are not supported on this platform") is a clear improvement over the alternative of silently misreading the bundle as PEM.

CLAUDE.md

No violations found. The workflow SHA-pin convention ("pinned to a full commit SHA … per the repo's policy for non-official actions") is preserved for the setup-android bump; I could not independently verify the new SHA against the v4.0.1 tag from this sandbox (outbound network calls were blocked), so that trust is placed in the PR author/CI rather than verified here.

Copilot AI review requested due to automatic review settings July 19, 2026 01:50

Copilot AI reviewed Jul 19, 2026

coderabbitai Bot approved these changes Jul 19, 2026

View reviewed changes

github-actions Bot reviewed Jul 19, 2026

View reviewed changes

giswqs merged commit da119e5 into main Jul 19, 2026
18 checks passed

giswqs deleted the fix/android-openssl-build branch July 19, 2026 02:22

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(android): drop native-tls/openssl-sys from Android build; bump setup-android to v4#1336

fix(android): drop native-tls/openssl-sys from Android build; bump setup-android to v4#1336
giswqs merged 1 commit into
mainfrom
fix/android-openssl-build

giswqs commented Jul 19, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

netlify Bot commented Jul 19, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

coderabbitai Bot commented Jul 19, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

github-actions Bot commented Jul 19, 2026

Uh oh!

github-actions Bot Jul 19, 2026

Uh oh!

github-actions Bot commented Jul 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

giswqs commented Jul 19, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Fix

Verification

Summary by CodeRabbit

Uh oh!

netlify Bot commented Jul 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for geolibre-app ready!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot commented Jul 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

github-actions Bot commented Jul 19, 2026

⚡ Cloudflare Pages preview

Uh oh!

github-actions Bot Jul 19, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Jul 19, 2026

Code review

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

giswqs commented Jul 19, 2026 •

edited by coderabbitai Bot

Loading

netlify Bot commented Jul 19, 2026 •

edited

Loading

coderabbitai Bot commented Jul 19, 2026 •

edited

Loading