vendor openssl for musl

Author: benbaarber

.github/workflows/release.yml

@@ -24,7 +24,7 @@ jobs:
           - target: x86_64-unknown-linux-musl
             os: ubuntu-latest
           - target: aarch64-unknown-linux-gnu
-            os: ubuntu-latest
+            os: ubuntu-24.04-arm
 
     steps:
       - uses: actions/checkout@v4
@@ -33,19 +33,22 @@ jobs:
         if: matrix.target == 'x86_64-unknown-linux-musl'
         run: sudo apt-get update && sudo apt-get install -y musl-tools
 
-      - name: Install cross-compilation tools
+      - name: Install libssl-dev
         if: matrix.target == 'aarch64-unknown-linux-gnu'
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y gcc-aarch64-linux-gnu
+        run: sudo apt-get update && sudo apt-get install -y libssl-dev pkg-config
 
       - name: Add Rust target
         run: rustup target add ${{ matrix.target }}
 
       - name: Build
-        env:
-          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
-        run: cargo build --release --target ${{ matrix.target }} -p path-cli --bin path
+        run: |
+          # musl can't use system libssl (glibc-linked), so it vendors openssl.
+          # aarch64-gnu now builds natively on an arm runner — system libssl works.
+          extra=()
+          if [ "${{ matrix.target }}" = "x86_64-unknown-linux-musl" ]; then
+            extra=(--features vendored-openssl)
+          fi
+          cargo build --release --target ${{ matrix.target }} -p path-cli --bin path "${extra[@]}"
 
       - name: Package
         shell: bash

Cargo.lock

@@ -36,7 +36,7 @@ toolpath-pi = { version = "0.3.0", path = "crates/toolpath-pi" }
 path-cli = { version = "0.8.0", path = "crates/path-cli" }
 pathbase-client = { version = "0.1.0", path = "crates/pathbase-client" }
 
-reqwest = { version = "0.13", features = ["blocking", "json"] }
+reqwest = { version = "0.13", default-features = false, features = ["blocking", "json", "rustls"] }
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 clap = { version = "4.5", features = ["derive"] }

Cargo.toml

@@ -57,6 +57,9 @@ toolpath-gemini = { workspace = true }
 toolpath-codex = { workspace = true }
 toolpath-pi = { workspace = true }
 
+[features]
+vendored-openssl = ["git2/vendored-openssl"]
+
 [dev-dependencies]
 assert_cmd = "2"
 predicates = "3"