From 9e3e3766e77243f6111bb8e5e8b18bf97137391f Mon Sep 17 00:00:00 2001
From: Shaun Arman <Shaun.Arman@motorolasolutions.com>
Date: Sat, 13 Jun 2026 23:36:54 -0500
Subject: [PATCH] fix(build): resolve Windows MinGW memset_explicit linking
 error

libsodium-sys requires memset_explicit which is not available in older
MinGW toolchains. Added a C shim that provides a fallback implementation
using volatile pointers to prevent compiler optimization.

Changes:
- Added memset_s_shim.c with fallback memset_explicit implementation
- Updated build.rs to compile shim for Windows GNU targets
- Added cc crate as build dependency
- Set CFLAGS in CI to target Windows 8+ (_WIN32_WINNT=0x0602)
- Set SODIUM_STATIC=yes to force static libsodium build

Fixes linking error: undefined reference to memset_explicit

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
---
 .gitea/workflows/release-beta.yml |  4 ++++
 src-tauri/.cargo/config.toml      |  4 ++++
 src-tauri/Cargo.lock              |  1 +
 src-tauri/Cargo.toml              |  1 +
 src-tauri/build.rs                | 10 ++++++++++
 src-tauri/memset_s_shim.c         | 28 ++++++++++++++++++++++++++++
 6 files changed, 48 insertions(+)
 create mode 100644 src-tauri/memset_s_shim.c

diff --git a/.gitea/workflows/release-beta.yml b/.gitea/workflows/release-beta.yml
index 18a56c5e..42ccfd68 100644
--- a/.gitea/workflows/release-beta.yml
+++ b/.gitea/workflows/release-beta.yml
@@ -317,6 +317,10 @@ jobs:
           CARGO_TARGET_X86_64_PC_WINDOWS_GNU_LINKER: x86_64-w64-mingw32-gcc
           OPENSSL_NO_VENDOR: "0"
           OPENSSL_STATIC: "1"
+          # Fix memset_explicit missing symbol for libsodium on MinGW
+          CFLAGS_x86_64_pc_windows_gnu: "-D_WIN32_WINNT=0x0602"
+          SODIUM_LIB_DIR: ""
+          SODIUM_STATIC: "yes"
         run: |
           npm ci --legacy-peer-deps
           CI=true npx tauri build --target x86_64-pc-windows-gnu
diff --git a/src-tauri/.cargo/config.toml b/src-tauri/.cargo/config.toml
index 28287212..37432416 100644
--- a/src-tauri/.cargo/config.toml
+++ b/src-tauri/.cargo/config.toml
@@ -9,3 +9,7 @@ rustflags = ["-C", "link-arg=-Wl,--exclude-all-symbols"]
 # Use system OpenSSL instead of vendoring from source (which requires Perl modules
 # unavailable on some environments and breaks clippy/check).
 OPENSSL_NO_VENDOR = "1"
+
+# Force libsodium to use minimal mode which avoids memset_explicit on Windows
+SODIUM_USE_PKG_CONFIG = "0"
+SODIUM_STATIC = "1"
diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock
index 27577b70..88b4a436 100644
--- a/src-tauri/Cargo.lock
+++ b/src-tauri/Cargo.lock
@@ -6535,6 +6535,7 @@ dependencies = [
  "anyhow",
  "async-trait",
  "base64 0.22.1",
+ "cc",
  "chrono",
  "dirs 5.0.1",
  "docx-rs",
diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml
index afdd9be3..350f1662 100644
--- a/src-tauri/Cargo.toml
+++ b/src-tauri/Cargo.toml
@@ -9,6 +9,7 @@ crate-type = ["staticlib", "cdylib", "rlib"]
 
 [build-dependencies]
 tauri-build = { version = "2.6", features = [] }
+cc = "1.0"
 
 [dependencies]
 tauri = { version = "2", features = [] }
diff --git a/src-tauri/build.rs b/src-tauri/build.rs
index 55db2c01..3a8a7951 100644
--- a/src-tauri/build.rs
+++ b/src-tauri/build.rs
@@ -5,6 +5,16 @@ fn main() {
     println!("cargo:rerun-if-changed=.git/refs/heads/master");
     println!("cargo:rerun-if-changed=.git/refs/tags");
 
+    // Compile memset_explicit shim for Windows MinGW
+    if std::env::var("CARGO_CFG_TARGET_OS").unwrap_or_default() == "windows"
+        && std::env::var("CARGO_CFG_TARGET_ENV").unwrap_or_default() == "gnu"
+    {
+        cc::Build::new()
+            .file("memset_s_shim.c")
+            .compile("memset_shim");
+        println!("cargo:rerun-if-changed=memset_s_shim.c");
+    }
+
     tauri_build::build()
 }
 
diff --git a/src-tauri/memset_s_shim.c b/src-tauri/memset_s_shim.c
new file mode 100644
index 00000000..68c19b91
--- /dev/null
+++ b/src-tauri/memset_s_shim.c
@@ -0,0 +1,28 @@
+// Shim for memset_explicit on MinGW which doesn't provide it
+// This is needed for libsodium's secure memory clearing
+
+#if defined(_WIN32) && defined(__MINGW32__)
+
+#include <string.h>
+
+// memset_explicit is available in Windows 8+ but MinGW headers don't always declare it
+// Provide a fallback implementation using SecureZeroMemory if available,
+// or a volatile memset to prevent compiler optimization
+void *memset_explicit(void *s, int c, size_t n) {
+    // Try to use Windows API if available
+    #ifdef _WIN32_WINNT
+        #if _WIN32_WINNT >= 0x0602  // Windows 8+
+            extern void *memset_s(void *, size_t, int, size_t);
+            return memset_s(s, n, c, n);
+        #endif
+    #endif
+
+    // Fallback: use volatile to prevent optimization
+    volatile unsigned char *p = (volatile unsigned char *)s;
+    while (n--) {
+        *p++ = (unsigned char)c;
+    }
+    return s;
+}
+
+#endif