[BugFix] Update openssl in cargo.toml and Remove dll and dylibs From Repo (#7478)

* update openssl in cargo.toml, and remove dll and dylibs from repo

* cargo fmt

* cargo clippy

* cargo fmt again

* unused-mut

* adjust build.rs for test container

* windows runner setup

* fix masos linking

* same treatment for sbom files

.github/workflows/build-desktop-osx64.yml

@@ -27,6 +27,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
 
+      - name: Install OpenSSL 3
+        run: brew install openssl@3
+
       - name: Import Code Signing Certificate
         uses: apple-actions/import-codesign-certs@fe74d46e82474f87e1ba79832ad28a4013d0e33a # v6
         env:
@@ -66,6 +69,7 @@ jobs:
       - name: install Rust stable
         uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master
         with:
+          toolchain: "stable"
           targets: "x86_64-apple-darwin"
 
       - name: Install Modules

.github/workflows/build-desktop-osxARM.yml

@@ -27,6 +27,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
 
+      - name: Install OpenSSL 3
+        run: brew install openssl@3
+
       - name: Import Code Signing Certificate
         uses: apple-actions/import-codesign-certs@fe74d46e82474f87e1ba79832ad28a4013d0e33a # v6
         env:

.github/workflows/build-desktop-win64.yml

@@ -58,14 +58,22 @@ jobs:
           echo "OPENSSL_INCLUDE_DIR=${{ env.VCPKG_ROOT }}/installed/x64-windows/include" >> $GITHUB_ENV
           echo "OPENSSL_LIB_DIR=${{ env.VCPKG_ROOT }}/installed/x64-windows/lib" >> $GITHUB_ENV
 
-      - name: Copy SSL DLLs
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: lts/*
+
+      - name: Install frontend dependencies
+        run: npm install
+
+      - name: Copy OpenSSL DLLs from vcpkg
+        run: npm run openssl:copy
+
+      - name: Verify OpenSSL DLLs present
         shell: pwsh
         run: |
-          # Verify OpenSSL DLLs exist
+          $libcryptoPath = "${{ github.workspace }}/desktop/src-tauri/libcrypto-3-x64.dll"
-          $opensslBinDir = "${{ env.VCPKG_ROOT }}/installed/x64-windows/bin"
+          $libsslPath = "${{ github.workspace }}/desktop/src-tauri/libssl-3-x64.dll"
-          $libcryptoPath = Join-Path $opensslBinDir "libcrypto-3-x64.dll"
-          $libsslPath = Join-Path $opensslBinDir "libssl-3-x64.dll"
-
           if (-not (Test-Path $libcryptoPath)) {
             Write-Error "Error: libcrypto-3-x64.dll not found at $libcryptoPath"
             exit 1
@@ -74,12 +82,8 @@ jobs:
             Write-Error "Error: libssl-3-x64.dll not found at $libsslPath"
             exit 1
           }
-
+          Write-Host "OpenSSL DLLs staged in src-tauri/"
-          # Copy DLLs to src-tauri folder
+          Get-ChildItem -Path "${{ github.workspace }}/desktop/src-tauri/*.dll"
-          Copy-Item -Path $libcryptoPath -Destination "src-tauri/" -Force
-          Copy-Item -Path $libsslPath -Destination "src-tauri/" -Force
-          Write-Host "Successfully copied OpenSSL DLLs to src-tauri/"
-          Get-ChildItem -Path "src-tauri/"
 
       - name: Create temp directory for signing DLLs
         shell: pwsh
@@ -117,16 +121,14 @@ jobs:
           Write-Host "Successfully replaced unsigned DLLs with signed versions"
           Get-ChildItem -Path "${{ github.workspace }}/desktop/src-tauri/*.dll"
 
-      - name: Set up Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version: lts/*
-
       - name: Install cyclonedx-npm
         run: npm install -g @cyclonedx/cyclonedx-npm
 
       - name: Set up Rust
         uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master
+        with:
+          toolchain: stable
+
 
       - name: Cache cargo registry
         uses: actions/cache@v5
@@ -146,10 +148,8 @@ jobs:
           restore-keys: |
             windows-x64-cargo-build-
 
-      - name: Install Modules
+      - name: Generate npm SBOM
-        run: |
+        run: cyclonedx-npm --output-format XML --gather-license-texts --output-file src-tauri/open-data-platform-SBOM-npm.cdx.xml
-          npm install
-          cyclonedx-npm --output-format XML --gather-license-texts --output-file src-tauri/open-data-platform-SBOM-npm.cdx.xml
 
       - name: Install cargo-cyclonedx
         shell: pwsh
@@ -172,6 +172,7 @@ jobs:
         run: npm run tauri build -- --target x86_64-pc-windows-msvc --no-bundle
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          OPENSSL_COPY_SKIP_EXISTING: "1"
 
       - name: Create backup of unsigned executable
         shell: pwsh
@@ -205,6 +206,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+          OPENSSL_COPY_SKIP_EXISTING: "1"
 
       - name: Get Installer Path
         id: get_installer_path

.github/workflows/test-unit-desktop-osx64.yml

@@ -22,6 +22,9 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
+      - name: Install OpenSSL 3
+        run: brew install openssl@3
+
       - name: Set up Node.js
         uses: actions/setup-node@v6
         with:

.github/workflows/test-unit-desktop-osxARM.yml

@@ -22,6 +22,9 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
+      - name: Install OpenSSL 3
+        run: brew install openssl@3
+
       - name: Set up Node.js
         uses: actions/setup-node@v6
         with:

.github/workflows/test-unit-desktop-win64.yml

@@ -43,16 +43,16 @@ jobs:
 
       - name: Install OpenSSL using vcpkg
         working-directory: ${{ github.workspace }}
-        run: ${{ env.VCPKG_ROOT }}/vcpkg install openssl:x64-windows-static --vcpkg-root ${{ env.VCPKG_ROOT }}
+        run: ${{ env.VCPKG_ROOT }}/vcpkg install openssl:x64-windows --vcpkg-root ${{ env.VCPKG_ROOT }}
         env:
-          VCPKG_DEFAULT_TRIPLET: x64-windows-static
+          VCPKG_DEFAULT_TRIPLET: x64-windows
 
       - name: Set OpenSSL env
         shell: bash
         run: |
-          echo "OPENSSL_DIR=${{ env.VCPKG_ROOT }}/installed/x64-windows-static" >> $GITHUB_ENV
+          echo "OPENSSL_DIR=${{ env.VCPKG_ROOT }}/installed/x64-windows" >> $GITHUB_ENV
-          echo "OPENSSL_INCLUDE_DIR=${{ env.VCPKG_ROOT }}/installed/x64-windows-static/include" >> $GITHUB_ENV
+          echo "OPENSSL_INCLUDE_DIR=${{ env.VCPKG_ROOT }}/installed/x64-windows/include" >> $GITHUB_ENV
-          echo "OPENSSL_LIB_DIR=${{ env.VCPKG_ROOT }}/installed/x64-windows-static/lib" >> $GITHUB_ENV
+          echo "OPENSSL_LIB_DIR=${{ env.VCPKG_ROOT }}/installed/x64-windows/lib" >> $GITHUB_ENV
 
       - name: Set up Node.js
         uses: actions/setup-node@v6

.github/workflows/test-unit-desktop-winARM.yml

@@ -43,16 +43,16 @@ jobs:
 
       - name: Install OpenSSL using vcpkg
         working-directory: ${{ github.workspace }}
-        run: ${{ env.VCPKG_ROOT }}/vcpkg install openssl:arm64-windows-static --vcpkg-root ${{ env.VCPKG_ROOT }}
+        run: ${{ env.VCPKG_ROOT }}/vcpkg install openssl:arm64-windows --vcpkg-root ${{ env.VCPKG_ROOT }}
         env:
-          VCPKG_DEFAULT_TRIPLET: arm64-windows-static
+          VCPKG_DEFAULT_TRIPLET: arm64-windows
 
       - name: Set OpenSSL env
         shell: bash
         run: |
-          echo "OPENSSL_DIR=${{ env.VCPKG_ROOT }}/installed/arm64-windows-static" >> $GITHUB_ENV
+          echo "OPENSSL_DIR=${{ env.VCPKG_ROOT }}/installed/arm64-windows" >> $GITHUB_ENV
-          echo "OPENSSL_INCLUDE_DIR=${{ env.VCPKG_ROOT }}/installed/arm64-windows-static/include" >> $GITHUB_ENV
+          echo "OPENSSL_INCLUDE_DIR=${{ env.VCPKG_ROOT }}/installed/arm64-windows/include" >> $GITHUB_ENV
-          echo "OPENSSL_LIB_DIR=${{ env.VCPKG_ROOT }}/installed/arm64-windows-static/lib" >> $GITHUB_ENV
+          echo "OPENSSL_LIB_DIR=${{ env.VCPKG_ROOT }}/installed/arm64-windows/lib" >> $GITHUB_ENV
 
       - name: Set up Node.js
         uses: actions/setup-node@v6

desktop/.gitignore

@@ -35,4 +35,9 @@ yarn-error.log*
 
 src-tauri/*.dll
 
-src-tauri/frameworks/*.dylib
+src-tauri/frameworks/*
+!src-tauri/frameworks/.gitkeep
+
+# CycloneDX SBOMs are generated by CI workflows (cyclonedx-npm, cargo-cyclonedx)
+# and stubbed locally by src-tauri/build.rs.
+src-tauri/open-data-platform-SBOM-*.cdx.xml

desktop/Cargo.toml

@@ -7,4 +7,4 @@ members = [
 ]
 
 [workspace.dependencies]
-openssl = "^0.10.76"
+openssl = "^0.10.78"

desktop/dist/.gitkeep

@@ -1 +0,0 @@
-

desktop/package-lock.json

@@ -136,7 +136,6 @@
       "integrity": "sha512-CGOfOJqWjg2qW/Mb6zNsDm+u5vFQ8DxXfbM09z69p5Z6+mE1ikP2jUXw+j42Pf1XTYED2Rni5f95npYeuwMDQA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@babel/code-frame": "^7.29.0",
         "@babel/generator": "^7.29.0",
@@ -508,7 +507,6 @@
         }
       ],
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=18"
       },
@@ -532,7 +530,6 @@
         }
       ],
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=18"
       }
@@ -3838,7 +3835,6 @@
       "resolved": "https://registry.npmjs.org/@tanstack/react-router/-/react-router-1.168.13.tgz",
       "integrity": "sha512-rvrL1bK/bOjjfDyAKKFvkVXeo8IZZmwfy9DwJaMlj7lCmpWl4Qban2/d+EirlHPcwHDNq5OkS5jhcBiZ+24RJw==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@tanstack/history": "1.161.6",
         "@tanstack/react-store": "^0.9.3",
@@ -3907,7 +3903,6 @@
       "resolved": "https://registry.npmjs.org/@tanstack/router-core/-/router-core-1.168.9.tgz",
       "integrity": "sha512-18oeEwEDyXOIuO1VBP9ACaK7tYHZUjynGDCoUh/5c/BNhia9vCJCp9O0LfhZXOorDc/PmLSgvmweFhVmIxF10g==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@tanstack/history": "1.161.6",
         "cookie-es": "^2.0.0",
@@ -4560,7 +4555,8 @@
       "resolved": "https://registry.npmjs.org/@types/aria-query/-/aria-query-5.0.4.tgz",
       "integrity": "sha512-rfT93uj5s0PRL7EzccGMs3brplhcrghnDoV26NqKhCAS1hVo+WdNsPvE/yb6ilfr5hi2MEk6d5EWJTKdxg8jVw==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/@types/babel__core": {
       "version": "7.20.5",
@@ -4686,7 +4682,6 @@
       "integrity": "sha512-+qIYRKdNYJwY3vRCZMdJbPLJAtGjQBudzZzdzwQYkEPQd+PJGixUL5QfvCLDaULoLv+RhT3LDkwEfKaAkgSmNQ==",
       "devOptional": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "undici-types": "~7.19.0"
       }
@@ -4708,7 +4703,6 @@
       "resolved": "https://registry.npmjs.org/@types/react/-/react-18.3.28.tgz",
       "integrity": "sha512-z9VXpC7MWrhfWipitjNdgCauoMLRdIILQsAEV+ZesIzBq/oUlxk0m3ApZuMFCXdnS4U7KrI+l3WRUEGQ8K1QKw==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@types/prop-types": "*",
         "csstype": "^3.2.2"
@@ -4720,7 +4714,6 @@
       "integrity": "sha512-MEe3UeoENYVFXzoXEWsvcpg6ZvlrFNlOQ7EOsvhI3CfAXwzPfO8Qwuxd40nepsYKqyyVQnTdEfv68q91yLcKrQ==",
       "devOptional": true,
       "license": "MIT",
-      "peer": true,
       "peerDependencies": {
         "@types/react": "^18.0.0"
       }
@@ -4775,7 +4768,6 @@
       "integrity": "sha512-gGkiNMPqerb2cJSVcruigx9eHBlLG14fSdPdqMoOcBfh+vvn4iCq2C8MzUB89PrxOXk0y3GZ1yIWb9aOzL93bw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@typescript-eslint/scope-manager": "8.58.1",
         "@typescript-eslint/types": "8.58.1",
@@ -5145,7 +5137,6 @@
       "integrity": "sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "bin": {
         "acorn": "bin/acorn"
       },
@@ -5196,6 +5187,7 @@
       "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=8"
       }
@@ -5640,7 +5632,6 @@
         }
       ],
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "baseline-browser-mapping": "^2.10.12",
         "caniuse-lite": "^1.0.30001782",
@@ -6035,8 +6026,7 @@
       "version": "3.2.3",
       "resolved": "https://registry.npmjs.org/csstype/-/csstype-3.2.3.tgz",
       "integrity": "sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ==",
-      "license": "MIT",
+      "license": "MIT"
-      "peer": true
     },
     "node_modules/data-urls": {
       "version": "5.0.0",
@@ -6274,7 +6264,8 @@
       "resolved": "https://registry.npmjs.org/dom-accessibility-api/-/dom-accessibility-api-0.5.16.tgz",
       "integrity": "sha512-X7BJ2yElsnOJ30pZF4uIIDfBEVgF4XEBxL9Bxhy6dnrm5hkzqmsWHGTiHqRiITNhMyFLyAiWndIJP7Z1NTteDg==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/dom-helpers": {
       "version": "5.2.1",
@@ -6594,7 +6585,6 @@
       "integrity": "sha512-XoMjdBOwe/esVgEvLmNsD3IRHkm7fbKIUGvrleloJXUZgDHig2IPWNniv+GwjyJXzuNqVjlr5+4yVUZjycJwfQ==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.8.0",
         "@eslint-community/regexpp": "^4.12.1",
@@ -8062,7 +8052,6 @@
       "resolved": "https://registry.npmjs.org/jiti/-/jiti-1.21.7.tgz",
       "integrity": "sha512-/imKNG4EbWNrVjoNC/1H5/9GFy+tqjGBHCaSsN+P2RnPqjsLmv6UD3Ej+Kj8nBWaRAwyk7kK5ZUc+OEatnTR3A==",
       "license": "MIT",
-      "peer": true,
       "bin": {
         "jiti": "bin/jiti.js"
       }
@@ -8092,7 +8081,6 @@
       "integrity": "sha512-Cvc9WUhxSMEo4McES3P7oK3QaXldCfNWp7pl2NNeiIFlCoLr3kfq9kb1fxftiwk1FLV7CvpvDfonxtzUDeSOPg==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "cssstyle": "^4.2.1",
         "data-urls": "^5.0.0",
@@ -8315,6 +8303,7 @@
       "integrity": "sha512-h5bgJWpxJNswbU7qCrV0tIKQCaS3blPDrqKWx+QxzuzL1zGUzij9XCWLrSLsJPu5t+eWA/ycetzYAO5IOMcWAQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "bin": {
         "lz-string": "bin/bin.js"
       }
@@ -9497,7 +9486,6 @@
         }
       ],
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "nanoid": "^3.3.11",
         "picocolors": "^1.1.1",
@@ -9645,6 +9633,7 @@
       "integrity": "sha512-Qb1gy5OrP5+zDf2Bvnzdl3jsTf1qXVMazbvCoKhtKqVs4/YK4ozX4gKQJJVyNe+cajNPn0KoC0MC3FUmaHWEmQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "ansi-regex": "^5.0.1",
         "ansi-styles": "^5.0.0",
@@ -9660,6 +9649,7 @@
       "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=10"
       },
@@ -9729,7 +9719,6 @@
       "resolved": "https://registry.npmjs.org/react/-/react-18.3.1.tgz",
       "integrity": "sha512-wS+hAgJShR0KhEvPJArfuPVN1+Hz1t0Y6n5jLrGQbkb4urgPE/0Rve+1kMB1v/oWgHgm4WIcV+i7F2pTVj+2iQ==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "loose-envify": "^1.1.0"
       },
@@ -9742,7 +9731,6 @@
       "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-18.3.1.tgz",
       "integrity": "sha512-5m4nQKp+rZRb09LNH59GM4BxTh9251/ylbKIbpe7TpGxfJ+9kv6BLkLBXIjjspbgbnIBNqlI23tRnTWT0snUIw==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "loose-envify": "^1.1.0",
         "scheduler": "^0.23.2"
@@ -9756,7 +9744,6 @@
       "resolved": "https://registry.npmjs.org/react-hook-form/-/react-hook-form-7.72.1.tgz",
       "integrity": "sha512-RhwBoy2ygeVZje+C+bwJ8g0NjTdBmDlJvAUHTxRjTmSUKPYsKfMphkS2sgEMotsY03bP358yEYlnUeZy//D9Ig==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=18.0.0"
       },
@@ -9773,7 +9760,8 @@
       "resolved": "https://registry.npmjs.org/react-is/-/react-is-17.0.2.tgz",
       "integrity": "sha512-w2GsyukL62IJnlaff/nRegPQR94C/XXamvMWmSHRJ4y7Ts/4ocGRmTHvOs8PSE6pB3dWOrD/nueuU5sduBsQ4w==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/react-markdown": {
       "version": "9.1.0",
@@ -10115,7 +10103,6 @@
       "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.60.1.tgz",
       "integrity": "sha512-VmtB2rFU/GroZ4oL8+ZqXgSA38O6GR8KSIvWmEFv63pQ0G6KaBH9s07PO8XTXP4vI+3UJUEypOfjkGfmSBBR0w==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@types/estree": "1.0.8"
       },
@@ -10284,7 +10271,6 @@
       "resolved": "https://registry.npmjs.org/seroval/-/seroval-1.5.2.tgz",
       "integrity": "sha512-xcRN39BdsnO9Tf+VzsE7b3JyTJASItIV1FVFewJKCFcW4s4haIKS3e6vj8PGB9qBwC7tnuOywQMdv5N4qkzi7Q==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=10"
       }
@@ -11093,7 +11079,6 @@
       "integrity": "sha512-5C1sg4USs1lfG0GFb2RLXsdpXqBSEhAaA/0kPL01wxzpMqLILNxIxIOKiILz+cdg/pLnOUxFYOR5yhHU666wbw==",
       "devOptional": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "esbuild": "~0.27.0",
         "get-tsconfig": "^4.7.5"
@@ -11205,7 +11190,6 @@
       "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
       "dev": true,
       "license": "Apache-2.0",
-      "peer": true,
       "bin": {
         "tsc": "bin/tsc",
         "tsserver": "bin/tsserver"
@@ -11513,7 +11497,6 @@
       "resolved": "https://registry.npmjs.org/vite/-/vite-7.3.2.tgz",
       "integrity": "sha512-Bby3NOsna2jsjfLVOHKes8sGwgl4TT0E6vvpYgnAYDIF/tie7MRaFthmKuHx1NSXjiTueXH3do80FMQgvEktRg==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "esbuild": "^0.27.0",
         "fdir": "^6.5.0",

desktop/package.json

@@ -9,6 +9,7 @@
     "build": "tsc && vite build",
     "preview": "vite preview",
     "tauri": "tauri",
+    "openssl:copy": "node src-tauri/scripts/copy_openssl.cjs",
     "test": "vitest",
     "test:watch": "vitest --watch",
     "lint": "eslint src --ext .ts,.tsx,.js,.jsx"

desktop/src-tauri/Cargo.toml

@@ -14,7 +14,7 @@ rust-version = "1.90.0"
 tauri-build = { version = "2.5.6", features = [] }
 
 [dependencies]
-tokio = { version = "^1.51.1", features = ["full", "test-util"] }
+tokio = { version = "^1.52.1", features = ["full", "test-util"] }
 serde_json = { version = "^1.0.149", features = ["preserve_order"] }
 serde_yaml = "^0.9"
 chrono = "^0.4"
@@ -32,7 +32,7 @@ futures = "^0.3.32"
 tauri-plugin-shell = "2"
 url = "^2.5.8"
 urlencoding = "^2.1.3"
-uuid = { version = "^1.23.0", features = ["v4"] }
+uuid = { version = "^1.23.1", features = ["v4"] }
 toml = "^1.1.2"
 futures-util = "0.3"
 futures-channel = "0.3"
@@ -64,9 +64,6 @@ tauri-plugin-updater = "2"
 [target.'cfg(linux)'.dependencies]
 glib = "^0.21.5"
 
-[patch.crates-io]
-rustls-webpki = { version = "0.103.11" }
-
 [features]
 # This feature depends on the Tauri CLI & CLI plugin for updater
 # By default Tauri runs in production mode

desktop/src-tauri/build.rs

@@ -1,3 +1,260 @@
+use std::env;
+use std::fs;
+use std::path::{Path, PathBuf};
+use std::process::Command;
+
 fn main() {
+    if let Err(err) = stage_openssl() {
+        panic!("[build.rs] failed to stage OpenSSL runtime libraries: {err}");
+    }
+    if let Err(err) = stage_sbom_placeholders() {
+        panic!("[build.rs] failed to stage SBOM placeholders: {err}");
+    }
     tauri_build::build()
 }
+
+fn stage_sbom_placeholders() -> Result<(), String> {
+    let manifest_dir = PathBuf::from(env::var("CARGO_MANIFEST_DIR").map_err(|e| e.to_string())?);
+    for name in [
+        "open-data-platform-SBOM-cargo.cdx.xml",
+        "open-data-platform-SBOM-npm.cdx.xml",
+    ] {
+        let path = manifest_dir.join(name);
+        if path.exists() {
+            continue;
+        }
+        let stub = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<bom xmlns=\"http://cyclonedx.org/schema/bom/1.6\" version=\"1\"><components/></bom>\n";
+        fs::write(&path, stub).map_err(|e| format!("write {}: {e}", path.display()))?;
+        println!(
+            "cargo:warning=wrote SBOM placeholder at {}; CI regenerates real SBOMs before bundling",
+            path.display()
+        );
+    }
+    Ok(())
+}
+
+fn stage_openssl() -> Result<(), String> {
+    println!("cargo:rerun-if-env-changed=OPENSSL_COPY_SKIP_EXISTING");
+    println!("cargo:rerun-if-env-changed=VCPKG_ROOT");
+
+    let manifest_dir = PathBuf::from(env::var("CARGO_MANIFEST_DIR").map_err(|e| e.to_string())?);
+    let target_os = env::var("CARGO_CFG_TARGET_OS").unwrap_or_default();
+    let skip_existing = env::var("OPENSSL_COPY_SKIP_EXISTING").ok().as_deref() == Some("1");
+
+    match target_os.as_str() {
+        "macos" => stage_macos(&manifest_dir, skip_existing),
+        "windows" => stage_windows(&manifest_dir, skip_existing),
+        _ => Ok(()),
+    }
+}
+
+fn copy_if_needed(src: &Path, dest: &Path, skip_existing: bool) -> Result<(), String> {
+    if skip_existing && dest.exists() {
+        println!(
+            "cargo:warning=OPENSSL_COPY_SKIP_EXISTING=1; keeping existing {}",
+            dest.display()
+        );
+        return Ok(());
+    }
+    if let Some(parent) = dest.parent() {
+        fs::create_dir_all(parent).map_err(|e| format!("mkdir {}: {e}", parent.display()))?;
+    }
+    fs::copy(src, dest)
+        .map_err(|e| format!("copy {} -> {}: {e}", src.display(), dest.display()))?;
+    println!("cargo:rerun-if-changed={}", src.display());
+    Ok(())
+}
+
+fn stage_macos(manifest_dir: &Path, skip_existing: bool) -> Result<(), String> {
+    let names = ["libcrypto.3.dylib", "libssl.3.dylib"];
+    let frameworks = manifest_dir.join("frameworks");
+
+    if names.iter().all(|n| frameworks.join(n).exists()) {
+        if skip_existing {
+            println!("cargo:warning=OPENSSL_COPY_SKIP_EXISTING=1; OpenSSL dylibs already staged");
+        }
+        return Ok(());
+    }
+
+    let prefix = match brew_openssl_prefix() {
+        Ok(p) => p,
+        Err(err) => {
+            println!(
+                "cargo:warning={err}; skipping OpenSSL dylib staging (required only for bundling)"
+            );
+            return Ok(());
+        }
+    };
+    for name in names {
+        let src = prefix.join("lib").join(name);
+        if !src.exists() {
+            println!(
+                "cargo:warning=expected {} to exist; skipping (required only for bundling)",
+                src.display()
+            );
+            return Ok(());
+        }
+        let dest = frameworks.join(name);
+        copy_if_needed(&src, &dest, skip_existing)?;
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            let mut perms = fs::metadata(&dest)
+                .map_err(|e| format!("stat {}: {e}", dest.display()))?
+                .permissions();
+            perms.set_mode(perms.mode() | 0o200);
+            let _ = fs::set_permissions(&dest, perms);
+        }
+    }
+
+    rewrite_macos_install_names(&frameworks, &names, &prefix)?;
+    Ok(())
+}
+
+fn rewrite_macos_install_names(
+    frameworks: &Path,
+    names: &[&str],
+    brew_prefix: &Path,
+) -> Result<(), String> {
+    for name in names {
+        let dest = frameworks.join(name);
+        let new_id = format!("@executable_path/../Frameworks/{name}");
+        run_install_name_tool(&["-id", &new_id, dest.to_str().unwrap()])?;
+
+        let output = Command::new("otool")
+            .args(["-L", dest.to_str().unwrap()])
+            .output()
+            .map_err(|e| format!("otool -L {}: {e}", dest.display()))?;
+        if !output.status.success() {
+            return Err(format!(
+                "otool -L {} failed: {}",
+                dest.display(),
+                String::from_utf8_lossy(&output.stderr)
+            ));
+        }
+        let listing = String::from_utf8_lossy(&output.stdout).into_owned();
+        for dep in names {
+            if dep == name {
+                continue;
+            }
+            for line in listing.lines() {
+                let trimmed = line.trim();
+                let path = trimmed.split_whitespace().next().unwrap_or("");
+                if path.is_empty() || path == dest.to_str().unwrap() {
+                    continue;
+                }
+                if path.ends_with(&format!("/{dep}"))
+                    && (path.starts_with(brew_prefix.to_str().unwrap_or(""))
+                        || path.starts_with("/usr/local/")
+                        || path.starts_with("/opt/homebrew/")
+                        || path.starts_with("@loader_path")
+                        || path.starts_with("@rpath"))
+                {
+                    let new_dep = format!("@executable_path/../Frameworks/{dep}");
+                    run_install_name_tool(&["-change", path, &new_dep, dest.to_str().unwrap()])?;
+                }
+            }
+        }
+
+        let _ = Command::new("codesign")
+            .args(["--force", "--sign", "-", dest.to_str().unwrap()])
+            .status();
+    }
+    Ok(())
+}
+
+fn run_install_name_tool(args: &[&str]) -> Result<(), String> {
+    let output = Command::new("install_name_tool")
+        .args(args)
+        .output()
+        .map_err(|e| format!("install_name_tool {:?}: {e}", args))?;
+    if !output.status.success() {
+        return Err(format!(
+            "install_name_tool {:?} failed: {}",
+            args,
+            String::from_utf8_lossy(&output.stderr)
+        ));
+    }
+    Ok(())
+}
+
+fn brew_openssl_prefix() -> Result<PathBuf, String> {
+    if let Ok(output) = Command::new("brew")
+        .args(["--prefix", "openssl@3"])
+        .output()
+        && output.status.success()
+    {
+        let path = String::from_utf8_lossy(&output.stdout).trim().to_string();
+        if !path.is_empty() {
+            return Ok(PathBuf::from(path));
+        }
+    }
+    for fallback in ["/opt/homebrew/opt/openssl@3", "/usr/local/opt/openssl@3"] {
+        let p = PathBuf::from(fallback);
+        if p.exists() {
+            return Ok(p);
+        }
+    }
+    Err("could not resolve Homebrew openssl@3 prefix".into())
+}
+
+fn stage_windows(manifest_dir: &Path, skip_existing: bool) -> Result<(), String> {
+    let dest_names = ["libcrypto-3-x64.dll", "libssl-3-x64.dll"];
+
+    if dest_names.iter().all(|n| manifest_dir.join(n).exists()) {
+        if skip_existing {
+            println!("cargo:warning=OPENSSL_COPY_SKIP_EXISTING=1; OpenSSL DLLs already staged");
+        }
+        return Ok(());
+    }
+
+    let Ok(vcpkg_root) = env::var("VCPKG_ROOT") else {
+        return Err(
+            "VCPKG_ROOT is not set; install OpenSSL via vcpkg (openssl:x64-windows or openssl:arm64-windows) before building"
+                .into(),
+        );
+    };
+
+    let target_arch = env::var("CARGO_CFG_TARGET_ARCH").unwrap_or_default();
+    let triplets: &[&str] = match target_arch.as_str() {
+        "aarch64" => &["arm64-windows", "x64-windows"],
+        _ => &["x64-windows", "arm64-windows"],
+    };
+
+    let bin_dir = triplets
+        .iter()
+        .map(|t| PathBuf::from(&vcpkg_root).join(format!("installed/{t}/bin")))
+        .find(|p| p.exists())
+        .ok_or_else(|| {
+            format!(
+                "no vcpkg dynamic OpenSSL install found under {}/installed/{{x64,arm64}}-windows/bin; run `vcpkg install openssl:x64-windows` (or openssl:arm64-windows)",
+                vcpkg_root
+            )
+        })?;
+
+    for (pattern_prefix, dest_name) in [
+        ("libcrypto-3-", "libcrypto-3-x64.dll"),
+        ("libssl-3-", "libssl-3-x64.dll"),
+    ] {
+        let src = fs::read_dir(&bin_dir)
+            .map_err(|e| format!("read_dir {}: {e}", bin_dir.display()))?
+            .filter_map(|e| e.ok())
+            .map(|e| e.path())
+            .find(|p| {
+                p.file_name()
+                    .and_then(|n| n.to_str())
+                    .map(|n| n.starts_with(pattern_prefix) && n.ends_with(".dll"))
+                    .unwrap_or(false)
+            })
+            .ok_or_else(|| {
+                format!(
+                    "no DLL matching '{}*.dll' in {}",
+                    pattern_prefix,
+                    bin_dir.display()
+                )
+            })?;
+        let dest = manifest_dir.join(dest_name);
+        copy_if_needed(&src, &dest, skip_existing)?;
+    }
+    Ok(())
+}

desktop/src-tauri/scripts/copy_openssl.cjs

@@ -0,0 +1,42 @@
+#!/usr/bin/env node
+// Cross-platform dispatcher that copies OpenSSL runtime binaries from the
+// build container (vcpkg on Windows, Homebrew on macOS) into the locations
+// the Tauri bundler expects. Linux uses system libssl3 at runtime and is a
+// no-op here. Invoked via the `openssl:copy` npm script and the Tauri
+// beforeDevCommand / beforeBuildCommand hooks.
+
+const { spawnSync } = require("node:child_process");
+const path = require("node:path");
+const process = require("node:process");
+
+const scriptsDir = __dirname;
+const platform = process.platform;
+
+function run(cmd, args) {
+  const result = spawnSync(cmd, args, { stdio: "inherit" });
+  if (result.error) {
+    console.error(`[copy_openssl] failed to launch ${cmd}: ${result.error.message}`);
+    process.exit(1);
+  }
+  if (typeof result.status === "number" && result.status !== 0) {
+    process.exit(result.status);
+  }
+}
+
+if (platform === "win32") {
+  const script = path.join(scriptsDir, "copy_openssl_win.ps1");
+  run("powershell", [
+    "-NoProfile",
+    "-ExecutionPolicy",
+    "Bypass",
+    "-File",
+    script,
+  ]);
+} else if (platform === "darwin") {
+  const script = path.join(scriptsDir, "copy_openssl_macos.sh");
+  run("sh", [script]);
+} else {
+  console.log(
+    `[copy_openssl] platform '${platform}' does not require bundled OpenSSL; skipping.`,
+  );
+}

desktop/src-tauri/scripts/copy_openssl_win.ps1

@@ -0,0 +1,55 @@
+# Copies OpenSSL runtime DLLs from the vcpkg install tree into desktop/src-tauri/
+# so the Tauri bundler can pick them up via the `resources` entries in
+# tauri.windows.conf.json. Invoked by the `openssl:copy` npm script and
+# Tauri's beforeBuildCommand / beforeDevCommand hooks.
+#
+# Env vars:
+#   VCPKG_ROOT                  - required; path to the vcpkg checkout.
+#   OPENSSL_COPY_SKIP_EXISTING  - when set to "1", skip copy if target DLLs
+#                                 already exist. The release workflow sets
+#                                 this before invoking `tauri build` so the
+#                                 hook does not clobber workflow-signed DLLs.
+
+$ErrorActionPreference = "Stop"
+
+$scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
+$srcTauriDir = Resolve-Path (Join-Path $scriptDir "..")
+
+$vcpkgRoot = $env:VCPKG_ROOT
+if ([string]::IsNullOrWhiteSpace($vcpkgRoot)) {
+    Write-Error "[copy_openssl_win] VCPKG_ROOT is not set. Install OpenSSL via vcpkg and export VCPKG_ROOT before running."
+    exit 1
+}
+
+$triplet = "x64-windows"
+
+$binDir = Join-Path $vcpkgRoot "installed/$triplet/bin"
+if (-not (Test-Path $binDir)) {
+    Write-Error "[copy_openssl_win] vcpkg OpenSSL bin dir not found: $binDir. Did you run 'vcpkg install openssl:$triplet'?"
+    exit 1
+}
+
+$targets = @(
+    @{ Pattern = "libcrypto-3-*.dll"; Dest = "libcrypto-3-x64.dll" },
+    @{ Pattern = "libssl-3-*.dll";    Dest = "libssl-3-x64.dll" }
+)
+
+$skipExisting = $env:OPENSSL_COPY_SKIP_EXISTING -eq "1"
+
+foreach ($t in $targets) {
+    $destPath = Join-Path $srcTauriDir $t.Dest
+
+    if ($skipExisting -and (Test-Path $destPath)) {
+        Write-Host "[copy_openssl_win] OPENSSL_COPY_SKIP_EXISTING=1 and $($t.Dest) already present; skipping."
+        continue
+    }
+
+    $source = Get-ChildItem -Path $binDir -Filter $t.Pattern -File | Select-Object -First 1
+    if ($null -eq $source) {
+        Write-Error "[copy_openssl_win] No DLL matching '$($t.Pattern)' in $binDir."
+        exit 1
+    }
+
+    Copy-Item -Path $source.FullName -Destination $destPath -Force
+    Write-Host "[copy_openssl_win] Copied $($source.Name) -> $destPath"
+}

desktop/src-tauri/tauri.conf.json

@@ -63,4 +63,4 @@
       "pubkey": "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IDEzNEQ2NzFCNjVENDhEMgpSV1RTU0YyMmNkWTBBY0IrOHRRWlVYVkZ3S1p4cmpER2RSYXZldjVEOWxFTnVueExBTXZTeUl3Ywo="
     }
   }
-}
+}

desktop/src-tauri/tauri.macos.conf.json

@@ -1,6 +1,6 @@
 {
   "build": {
-    "beforeBundleCommand": "sh /Users/runner/work/OpenBB/OpenBB/desktop/src-tauri/scripts/fix_dylibs.sh"
+    "beforeBundleCommand": "sh src-tauri/scripts/fix_dylibs.sh"
   },
   "bundle": {
     "targets": "all",
@@ -31,4 +31,4 @@
       "entitlements": "./entitlements.plist"
     }
   }
-}
+}

desktop/src-tauri/tauri.windows.conf.json

@@ -10,7 +10,9 @@
     }
   },
   "bundle": {
-    "targets": ["nsis"],
+    "targets": [
+      "nsis"
+    ],
     "resources": [
       "./libcrypto-3-x64.dll",
       "./libssl-3-x64.dll",
@@ -30,4 +32,4 @@
       }
     }
   }
-}
+}