ci-requirements.md

@@ -188,12 +188,20 @@ Android is a peer surface, not a desktop variant, so it gets its own workflow.
   other three ABIs, so widening is a one-word change.
 - **Green means it BUILT.** Like the Windows lane, a Linux runner cannot execute
   the artifact. Nothing here proves the app runs, renders, or is usable by finger.
-- **TLS is the likely first failure.** `reqwest` is pinned to `native-tls`, which
-  is deliberate for the Windows lane (it resolves to `schannel`, keeping C/asm out
-  of the cross-compile). On Android it resolves to **OpenSSL**, which must be
-  cross-compiled per ABI — hence `perl` + `make` in the image. If that proves
-  painful, the fix is a target-specific dependency block selecting `rustls` for
-  Android only, leaving the Windows lane's reasoning untouched.
+- **TLS: OpenSSL is vendored on Android.** `reqwest` is pinned to `native-tls`,
+  which is deliberate for the Windows lane (it resolves to `schannel`, keeping
+  C/asm out of the cross-compile). On Android it resolves to **OpenSSL**, and the
+  first build duly failed with `openssl-sys`: *"Could not find directory of
+  OpenSSL installation"* — there is no Android OpenSSL to link against.
+  `Cargo.toml` now carries a `cfg(target_os = "android")` block enabling
+  `openssl-sys`'s `vendored` feature, which compiles OpenSSL from source with the
+  NDK toolchain. That is why the image ships `perl` + `make`.
+- **Why not `rustls` on Android.** It builds faster and was the obvious fix, but
+  rustls ships its own root store — the phone would trust a DIFFERENT set of
+  certificates than the desktop. A self-hosted server behind a private or
+  enterprise CA would then work on one surface and fail on another. One TLS stack
+  across all surfaces is worth more than the build minutes. Revisit only if
+  vendored OpenSSL becomes the thing that breaks this lane repeatedly.
 
 ## Formatting the Rust lane before pushing
 

desktop/src-tauri/Cargo.lock

@@ -2382,6 +2382,15 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
 
+[[package]]
+name = "openssl-src"
+version = "300.6.1+3.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46eb8fb9fb3b61ce1c0f8a026c4c1a0714d3a9e138e7fbde78753ce2babc3846"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "openssl-sys"
 version = "0.9.117"
@@ -2390,6 +2399,7 @@ checksum = "b47e7e6bb2c38cd930d25a23b40fa52e068c10e85f3e03a7f5ba5aaca5713695"
 dependencies = [
  "cc",
  "libc",
+ "openssl-src",
  "pkg-config",
  "vcpkg",
 ]
@@ -3941,6 +3951,7 @@ version = "0.1.0"
 dependencies = [
  "chrono",
  "log",
+ "openssl-sys",
  "reqwest 0.12.28",
  "rusqlite",
  "serde",

desktop/src-tauri/Cargo.toml

@@ -63,6 +63,23 @@ reqwest = { version = "0.12", default-features = false, features = ["json", "nat
 # cross-compile lane nothing — see ci-requirements.md on why that matters here.
 sha2 = "0.10"
 
+# Android has no system OpenSSL to link against, and `native-tls` resolves to
+# OpenSSL there — unlike Windows, where it lands on schannel and costs nothing.
+# Without this the build dies at `openssl-sys`: "Could not find directory of
+# OpenSSL installation".
+#
+# `vendored` compiles OpenSSL from source with the NDK toolchain (hence perl + make
+# in ci-tauri-android). The alternative was rustls on Android only, which builds
+# faster — but rustls ships its own root store, so the phone would trust a
+# DIFFERENT set of certificates than the desktop does. A self-hosted server behind
+# a private or enterprise CA would then work on one surface and fail on another,
+# and "the surfaces behave the same" is worth more here than build minutes.
+#
+# Declared as a direct dependency purely to turn the feature on: cargo's feature
+# unification applies it to the copy `native-tls` pulls in transitively.
+[target.'cfg(target_os = "android")'.dependencies]
+openssl-sys = { version = "0.9", features = ["vendored"] }
+
 # Tauri's default release profile: smaller, faster shipped binaries.
 [profile.release]
 codegen-units = 1