From 01ca0aba41c7531c90d2d2cc6227ca17ab4aa3e7 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 20 Oct 2026 14:47:38 +0000
Subject: [PATCH] Fix #2171: build OpenSSL from source on Windows

Praxis 0.7.3 made OpenSSL a hard dependency on every target. Windows
runners have no OpenSSL dev install, so the early-access Windows job
fails, the multi-arch manifest job is skipped, and the early-access
image stays on the 2026-10-01 build.

Enable the openssl crate's vendored feature on Windows only.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0189XaWeWPUxirC7mGwNFAGp
---
 Cargo.lock        | 11 +++++++++++
 server/Cargo.toml |  4 ++++
 2 files changed, 15 insertions(+)

diff --git a/Cargo.lock b/Cargo.lock
index 303c291ad..6cabd1bd3 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3154,6 +3154,15 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
 
+[[package]]
+name = "openssl-src"
+version = "300.6.1+3.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46eb8fb9fb3b61ce1c0f8a026c4c1a0714d3a9e138e7fbde78753ce2babc3846"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "openssl-sys"
 version = "0.9.117"
@@ -3162,6 +3171,7 @@ checksum = "b47e7e6bb2c38cd930d25a23b40fa52e068c10e85f3e03a7f5ba5aaca5713695"
 dependencies = [
  "cc",
  "libc",
+ "openssl-src",
  "pkg-config",
  "vcpkg",
 ]
@@ -6193,6 +6203,7 @@ dependencies = [
  "clap",
  "http",
  "nix",
+ "openssl",
  "praxis-ai-filters",
  "praxis-proxy-core",
  "praxis-proxy-filter",
diff --git a/server/Cargo.toml b/server/Cargo.toml
index ab95ec4dd..2c2c97f5f 100644
--- a/server/Cargo.toml
+++ b/server/Cargo.toml
@@ -58,5 +58,9 @@ wanaku-feature-simulation = { workspace = true, features = ["openapi"] }
 nix = { version = "0.31.3", default-features = false, features = ["process", "signal", "user"] }
 tikv-jemallocator = "0.7.0"
 
+# Praxis needs OpenSSL. Windows runners and hosts have no OpenSSL dev install, so build it from source.
+[target.'cfg(windows)'.dependencies]
+openssl = { version = "0.10.81", features = ["vendored"] }
+
 [dev-dependencies]
 tempfile = "3"