From bbb7f535764360d3072cbfeee6fa65705b0973fa Mon Sep 17 00:00:00 2001
From: Samuel Gbafa <skgbafa@gmail.com>
Date: Mon, 8 Jun 2026 19:15:12 -0400
Subject: [PATCH] fix: vendor openssl for aarch64 release builds

---
 .github/workflows/release.yml    | 2 ++
 Cargo.lock                       | 1 +
 tinycloud-node-server/Cargo.toml | 5 +++++
 3 files changed, 8 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f9407b7..56c6d7c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -65,6 +65,8 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y gcc-aarch64-linux-gnu g++-aarch64-linux-gnu
           echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc" >> "$GITHUB_ENV"
+          echo "CC_aarch64_unknown_linux_gnu=aarch64-linux-gnu-gcc" >> "$GITHUB_ENV"
+          echo "AR_aarch64_unknown_linux_gnu=aarch64-linux-gnu-ar" >> "$GITHUB_ENV"
 
       - name: Build release binary
         run: cargo build --release --target ${{ matrix.target }} -p tinycloud-node
diff --git a/Cargo.lock b/Cargo.lock
index 7225bc3..8d9aad9 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -9250,6 +9250,7 @@ dependencies = [
  "hmac",
  "hyper 0.14.32",
  "lazy_static",
+ "native-tls",
  "opentelemetry",
  "opentelemetry-otlp",
  "opentelemetry_sdk",
diff --git a/tinycloud-node-server/Cargo.toml b/tinycloud-node-server/Cargo.toml
index d101eaa..db09365 100644
--- a/tinycloud-node-server/Cargo.toml
+++ b/tinycloud-node-server/Cargo.toml
@@ -52,6 +52,11 @@ tracing-log = "0.2"
 tracing-opentelemetry = "0.30"
 tracing-subscriber = { version = "0.3.20", features = ["env-filter", "json"] }
 
+[target.'cfg(all(target_os = "linux", target_arch = "aarch64"))'.dependencies]
+# Release builds cross-compile aarch64 Linux from x86_64 Linux. Vendoring
+# OpenSSL avoids needing target OpenSSL headers/libs in the runner image.
+native-tls = { version = "0.2.14", features = ["vendored"] }
+
 [dependencies.tinycloud-core]
 path = "../tinycloud-core/"
 default-features = false