termux: bake Termux lib dir into DT_RUNPATH so dlopen finds openssl

Author: capocasa

.github/workflows/termux.yml

@@ -43,6 +43,16 @@ jobs:
             -o:3code-android src/threecode.nim
           file 3code-android
 
+      - name: Verify Termux RUNPATH
+        # Nim's openssl wrapper dlopens libssl.so.3/libcrypto.so.3 at
+        # module init; Android's linker only finds them via the binary's
+        # DT_RUNPATH (config.nims bakes in the Termux prefix). The android
+        # binary can't run on this x86 host, so guard the runpath here;
+        # without it the binary dies on startup with "could not import:
+        # SSL_CTX_ctrl".
+        run: |
+          readelf -d 3code-android | grep -q 'RUNPATH.*\[/data/data/com.termux/files/usr/lib\]'
+
       - name: Package
         run: |
           mkdir -p 3code-termux-arm64

config.nims

@@ -27,6 +27,16 @@ switch("path", "tests")  # test helpers (tty_expect, stub_helpers, minline_testu
 switch("d", "ssl")
 switch("d", "testPlainHttp")
 
+when defined(android):
+  # Termux: Nim's openssl wrapper dlopens libssl.so.3/libcrypto.so.3 at
+  # module init, but Android's linker only searches the system lib dirs
+  # and the binary's own DT_RUNPATH for dlopen'd libs, never Termux's
+  # $PREFIX/lib (Termux packages get a runpath from their clang; the
+  # NDK cross toolchain doesn't add one). Bake the Termux lib dir in as
+  # RUNPATH so dlopen finds the openssl package's libs. The path is a
+  # link-time constant; the linker doesn't check it exists.
+  switch("passL", "-Wl,-rpath,/data/data/com.termux/files/usr/lib")
+
 switch("d", "version=" & getVersionString())
 
 when withDir(thisDir(), system.fileExists("config.local.nims")):

src/threecode.nim

@@ -152,6 +152,9 @@ proc setupTlsEnv() =
   ## opens a TLS context calls `bundledCaFile()` (in util.nim) to feed
   ## the bundled `cacert.pem` directly to `newContext(caFile = ...)`.
   ## Linux uses the system trust store and needs nothing here.
+  ## Termux's openssl libs are found via DT_RUNPATH baked in at link
+  ## time (see config.nims); LD_LIBRARY_PATH can't help because the
+  ## openssl wrapper dlopens at module init, before main runs.
   when defined(macosx):
     let dir = parentDir(getAppFilename())
     let cur = getEnv("DYLD_LIBRARY_PATH")