fix(android): fix segfault from bionic cleanup by forcing RTLD_NODELETE

and use dynamic openssl

Author: bycruz

.github/workflows/test.yml

@@ -38,23 +38,6 @@ jobs:
         if: matrix.os == 'windows-11-arm'
         uses: jwlawson/actions-setup-cmake@v2
 
-      - name: Cache Android NDK
-        if: matrix.android
-        id: cache-android-ndk
-        uses: actions/cache@v5
-        with:
-          path: android-ndk-r29
-          key: android-ndk-r29-aarch64
-
-      - name: Setup Android NDK
-        if: matrix.android
-        run: |
-          if [[ "${{ steps.cache-android-ndk.outputs.cache-hit }}" != "true" ]]; then
-            wget -q https://github.com/lzhiyong/termux-ndk/releases/download/android-ndk/android-ndk-r29-aarch64.7z
-            7z x android-ndk-r29-aarch64.7z -o. > /dev/null
-          fi
-          echo "ANDROID_NDK_ROOT=$PWD/android-ndk-r29" >> $GITHUB_ENV
-
       - name: Setup lde
         if: "!matrix.android"
         uses: lde-org/setup-lde@master
@@ -87,7 +70,7 @@ jobs:
             docker run --privileged --platform linux/arm64 --name termux-build \
               -e DEBIAN_FRONTEND=noninteractive \
               termux/termux-docker:aarch64 \
-              bash -c "apt update && apt upgrade -y -o Dpkg::Options::=--force-confdef -o Dpkg::Options::=--force-confold && apt install -y git clang curl zip make cmake && curl -fsSL https://lde.sh/install | sh -s -- --nightly"
+              bash -c "apt update && apt upgrade -y -o Dpkg::Options::=--force-confdef -o Dpkg::Options::=--force-confold && apt install -y git clang curl zip make cmake openssl-dev && curl -fsSL https://lde.sh/install | sh -s -- --nightly"
             docker commit termux-build termux-android:latest
             docker rm termux-build
             docker save termux-android:latest -o /tmp/termux-android.tar
@@ -100,6 +83,5 @@ jobs:
             --platform linux/arm64 \
             -v ${{ github.workspace }}:/workspace \
             -w /workspace \
-            -e ANDROID_NDK_ROOT=/workspace/android-ndk-r29 \
             termux-android:latest \
             bash -c "/data/data/com.termux/files/home/.lde/lde test"

.gitmodules

@@ -1,6 +1,3 @@
 [submodule "vendor/libgit2"]
 	path = vendor/libgit2
 	url = https://github.com/libgit2/libgit2
-[submodule "vendor/mbedtls"]
-	path = vendor/mbedtls
-	url = https://github.com/Mbed-TLS/mbedtls

build.lua

@@ -16,7 +16,6 @@ local function exec(cmd)
 end
 
 local build = src .. sep .. "build"
-local ndkRoot = os.getenv("ANDROID_NDK_ROOT")
 
 ---@format disable-next
 local gitMin = "-DBUILD_TESTS=OFF -DBUILD_CLI=OFF -DUSE_SSH=OFF -DUSE_GSSAPI=OFF -DUSE_NTLMCLIENT=OFF -DREGEX_BACKEND=builtin -DUSE_HTTP_PARSER=builtin -DCMAKE_C_FLAGS=-g0"
@@ -28,17 +27,6 @@ if isWindows then
 elseif isMac then
 	https = "SecureTransport"
 	cmakeExtra = ""
-elseif isAndroid and ndkRoot then
-	https = "mbedTLS"
-	local mbedSrc = scriptDir .. "vendor" .. sep .. "mbedtls"
-	local mbedBuild = mbedSrc .. sep .. "build"
-	local mbedOut = mbedSrc .. sep .. "install"
-	local toolchain = ndkRoot .. "/build/cmake/android.toolchain.cmake"
-	local androidFlags = '-DCMAKE_TOOLCHAIN_FILE="' .. toolchain .. '" -DANDROID_ABI=arm64-v8a -DANDROID_PLATFORM=android-24'
-	exec('cmake -S "' .. mbedSrc .. '" -B "' .. mbedBuild .. '" ' .. androidFlags .. ' -DCMAKE_INSTALL_PREFIX="' .. mbedOut .. '" -DENABLE_TESTING=OFF -DENABLE_PROGRAMS=OFF -DUSE_SHARED_MBEDTLS_LIBRARY=OFF')
-	exec('cmake --build "' .. mbedBuild .. '" -j$(nproc)')
-	exec('cmake --install "' .. mbedBuild .. '"')
-	cmakeExtra = androidFlags .. ' -DMBEDTLS_ROOT_DIR="' .. mbedOut .. '"'
 else
 	https = "OpenSSL"
 	cmakeExtra = ""
@@ -54,6 +42,5 @@ elseif isMac then
 	exec('strip -x "' .. outLib .. '"')
 else
 	exec('cp "' .. build .. '/libgit2.so" "' .. outLib .. '"')
-	local strip = (isAndroid and ndkRoot) and (ndkRoot .. "/toolchains/llvm/prebuilt/linux-aarch64/bin/llvm-strip") or "strip"
-	exec(strip .. ' --strip-unneeded --remove-section=.eh_frame --remove-section=.eh_frame_hdr "' .. outLib .. '"')
+	exec('strip --strip-unneeded --remove-section=.eh_frame --remove-section=.eh_frame_hdr "' .. outLib .. '"')
 end

src/init.lua

@@ -29,7 +29,7 @@ ffi.cdef [[
 
   const git_error *git_error_last(void);
   int  git_libgit2_init(void);
-  void git_libgit2_shutdown(void);
+  int  git_libgit2_shutdown(void);
 
   int  git_clone_options_init(git_clone_options *opts, unsigned int version);
   int  git_clone(git_repository **out, const char *url, const char *local_path, const git_clone_options *options);
@@ -83,6 +83,15 @@ ffi.cdef [[
 
 local here = debug.getinfo(1, "S").source:sub(2):match("(.*[/\\])") or ""
 local libName = jit.os == "Windows" and "git2.dll" or (jit.os == "OSX" and "libgit2.dylib" or "libgit2.so")
+
+-- On Android/Bionic, OpenSSL's atexit cleanup crashes if libgit2.so has been
+-- dlclose'd (it holds callbacks into it). Pre-open with RTLD_NODELETE so the
+-- library stays mapped through process teardown even after ffi's dlclose.
+if os.getenv("ANDROID_ROOT") then
+	ffi.cdef [[ void *dlopen(const char *filename, int flags); ]]
+	ffi.C.dlopen(here .. libName, 0x2 + 0x1000) -- RTLD_NOW | RTLD_NODELETE
+end
+
 local lib = ffi.load(here .. libName)
 
 lib.git_libgit2_init()