android: vendor OpenSSL so the Rust core links (task 1864)

First Android build failed at openssl-sys: "Could not find directory of OpenSSL
installation". reqwest is pinned to native-tls, which is right for Windows — it
resolves to schannel there and keeps C and assembly out of the cross-compile —
but on Android it resolves to OpenSSL, and there is no Android OpenSSL in the
image to link against.

Vendored rather than rustls. rustls builds faster and was the obvious fix, but it
ships its own root store, so the phone would trust a different set of
certificates than the desktop: a self-hosted server behind a private or
enterprise CA would work on one surface and fail on another. Peer surfaces that
quietly disagree about who to trust is a worse outcome than a slower build, so
one TLS stack stays everywhere and OpenSSL gets compiled from source with the NDK
toolchain — which is what perl and make are in ci-tauri-android for.

Scoped to cfg(target_os = "android") so nothing changes for the Linux, Windows or
web lanes; declared as a direct dependency purely to flip the feature, since
cargo's unification then applies it to the copy native-tls pulls in.

Cargo.lock regenerated in the same commit, per the documented procedure — the
--locked gates in every lane fail otherwise. openssl-src 300.6.1+3.6.3 joins.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

ci-requirements.md

@@ -188,12 +188,20 @@ Android is a peer surface, not a desktop variant, so it gets its own workflow.
   other three ABIs, so widening is a one-word change.
 - **Green means it BUILT.** Like the Windows lane, a Linux runner cannot execute
   the artifact. Nothing here proves the app runs, renders, or is usable by finger.
-- **TLS is the likely first failure.** `reqwest` is pinned to `native-tls`, which
+- **TLS: OpenSSL is vendored on Android.** `reqwest` is pinned to `native-tls`,
-  is deliberate for the Windows lane (it resolves to `schannel`, keeping C/asm out
+  which is deliberate for the Windows lane (it resolves to `schannel`, keeping
-  of the cross-compile). On Android it resolves to **OpenSSL**, which must be
+  C/asm out of the cross-compile). On Android it resolves to **OpenSSL**, and the
-  cross-compiled per ABI — hence `perl` + `make` in the image. If that proves
+  first build duly failed with `openssl-sys`: *"Could not find directory of
-  painful, the fix is a target-specific dependency block selecting `rustls` for
+  OpenSSL installation"* — there is no Android OpenSSL to link against.
-  Android only, leaving the Windows lane's reasoning untouched.
+  `Cargo.toml` now carries a `cfg(target_os = "android")` block enabling
+  `openssl-sys`'s `vendored` feature, which compiles OpenSSL from source with the
+  NDK toolchain. That is why the image ships `perl` + `make`.
+- **Why not `rustls` on Android.** It builds faster and was the obvious fix, but
+  rustls ships its own root store — the phone would trust a DIFFERENT set of
+  certificates than the desktop. A self-hosted server behind a private or
+  enterprise CA would then work on one surface and fail on another. One TLS stack
+  across all surfaces is worth more than the build minutes. Revisit only if
+  vendored OpenSSL becomes the thing that breaks this lane repeatedly.
 
 ## Formatting the Rust lane before pushing
 

desktop/src-tauri/Cargo.lock

@@ -2382,6 +2382,15 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
 
+[[package]]
+name = "openssl-src"
+version = "300.6.1+3.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46eb8fb9fb3b61ce1c0f8a026c4c1a0714d3a9e138e7fbde78753ce2babc3846"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "openssl-sys"
 version = "0.9.117"
@@ -2390,6 +2399,7 @@ checksum = "b47e7e6bb2c38cd930d25a23b40fa52e068c10e85f3e03a7f5ba5aaca5713695"
 dependencies = [
  "cc",
  "libc",
+ "openssl-src",
  "pkg-config",
  "vcpkg",
 ]
@@ -3941,6 +3951,7 @@ version = "0.1.0"
 dependencies = [
  "chrono",
  "log",
+ "openssl-sys",
  "reqwest 0.12.28",
  "rusqlite",
  "serde",

desktop/src-tauri/Cargo.toml

@@ -63,6 +63,23 @@ reqwest = { version = "0.12", default-features = false, features = ["json", "nat
 # cross-compile lane nothing — see ci-requirements.md on why that matters here.
 sha2 = "0.10"
 
+# Android has no system OpenSSL to link against, and `native-tls` resolves to
+# OpenSSL there — unlike Windows, where it lands on schannel and costs nothing.
+# Without this the build dies at `openssl-sys`: "Could not find directory of
+# OpenSSL installation".
+#
+# `vendored` compiles OpenSSL from source with the NDK toolchain (hence perl + make
+# in ci-tauri-android). The alternative was rustls on Android only, which builds
+# faster — but rustls ships its own root store, so the phone would trust a
+# DIFFERENT set of certificates than the desktop does. A self-hosted server behind
+# a private or enterprise CA would then work on one surface and fail on another,
+# and "the surfaces behave the same" is worth more here than build minutes.
+#
+# Declared as a direct dependency purely to turn the feature on: cargo's feature
+# unification applies it to the copy `native-tls` pulls in transitively.
+[target.'cfg(target_os = "android")'.dependencies]
+openssl-sys = { version = "0.9", features = ["vendored"] }
+
 # Tauri's default release profile: smaller, faster shipped binaries.
 [profile.release]
 codegen-units = 1