From 230417e7b6ff3ad96723cd60a4c176e3993eeed7 Mon Sep 17 00:00:00 2001
From: Fabiana Cecin <fabiana@waku.org>
Date: Fri, 31 Jul 2026 08:27:29 -0300
Subject: [PATCH] fix: stop host OpenSSL from hijacking bundled BoringSSL in
 liblogosdelivery (#4085) (#4086)

This commit is a workaround to a nim-boringssl issue; see: https://github.com/logos-messaging/logos-delivery/pull/4086#issuecomment-5140765772
---
 logos_delivery.nimble | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/logos_delivery.nimble b/logos_delivery.nimble
index 01ca35c94..bf0be7134 100644
--- a/logos_delivery.nimble
+++ b/logos_delivery.nimble
@@ -115,9 +115,15 @@ proc buildLibrary(lib_name: string, srcDir = "./", params = "", `type` = "static
       " --threads:on --app:staticlib --opt:speed --noMain --mm:refc --header -d:metrics --nimMainPrefix:" & mainPrefix & " --skipParentCfg:on -d:discv5_protocol_id=d5waku " &
       getMyCPU() & getNimParams() & srcDir & "/" & srcFile
   else:
+    # -Bsymbolic binds the library's references to its own symbols at link
+    # time. Without it, a host process that already loads OpenSSL (e.g.
+    # Node.js) interposes our statically linked BoringSSL functions and data
+    # (ASN1_ITEM tables), and QUIC startup crashes in lsquic setupSSLContext
+    # (issue #4085).
+    let elfFlags = when defined(linux): "--passL:-Wl,-Bsymbolic " else: ""
     exec "nim c" & " --out:build/" & lib_name &
       " --threads:on --app:lib --opt:speed --noMain --mm:refc --header -d:metrics --nimMainPrefix:" & mainPrefix & " --skipParentCfg:off -d:discv5_protocol_id=d5waku " &
-      getMyCPU() & getNimParams() & " " & srcDir & "/" & srcFile
+      elfFlags & getMyCPU() & getNimParams() & " " & srcDir & "/" & srcFile
 
 proc buildLibDynamicWindows(libName: string, folderName: string) =
   buildLibrary libName & ".dll", folderName,
@@ -173,8 +179,9 @@ proc buildMobileAndroid(srcDir = ".", params = "") =
   if not dirExists outDir:
     mkDir outDir
 
+  # -Bsymbolic: see buildLibrary's dynamic branch (issue #4085).
   exec "nim c" & " --out:" & outDir &
-    "/liblogosdelivery.so --threads:on --app:lib --opt:speed --noMain --mm:refc -d:chronicles_sinks=textlines[dynamic] --header -d:chronosEventEngine=epoll --passL:-L" &
+    "/liblogosdelivery.so --threads:on --app:lib --opt:speed --noMain --mm:refc -d:chronicles_sinks=textlines[dynamic] --header -d:chronosEventEngine=epoll --passL:-Wl,-Bsymbolic --passL:-L" &
     outdir & " --passL:-lrln --passL:-llog --cpu:" & cpu & " --nimMainPrefix:liblogosdelivery --os:android -d:androidNDK " & params &
     getNimParams() & " " & srcDir & "/liblogosdelivery.nim"