Merge pull request 'fix(windows): add memset_explicit symbol export for mingw cross-compilation' (#118) from fix/cargo-config-sodium into beta

Reviewed-on: #118

.gitea/workflows/auto-tag.yml

@@ -341,13 +341,15 @@ jobs:
           key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
           restore-keys: |
             ${{ runner.os }}-npm-
+      - name: Install libsodium
+        run: |
+          apt-get update && apt-get install -y libsodium-dev pkg-config
       - name: Build
         env:
           APPIMAGE_EXTRACT_AND_RUN: "1"
-          SODIUM_LIB_DIR: /usr/lib/x86_64-linux-gnu
         run: |
           npm ci --legacy-peer-deps
-          env -u SODIUM_USE_PKG_CONFIG CI=true npx tauri build --target x86_64-unknown-linux-gnu
+          CI=true npx tauri build --target x86_64-unknown-linux-gnu
       - name: Upload artifacts
         env:
           RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
@@ -437,6 +439,9 @@ jobs:
           key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
           restore-keys: |
             ${{ runner.os }}-npm-
+      - name: Install libsodium
+        run: |
+          apt-get update && apt-get install -y libsodium-dev pkg-config
       - name: Build
         env:
           CC_x86_64_pc_windows_gnu: x86_64-w64-mingw32-gcc
@@ -445,10 +450,9 @@ jobs:
           CARGO_TARGET_X86_64_PC_WINDOWS_GNU_LINKER: x86_64-w64-mingw32-gcc
           OPENSSL_NO_VENDOR: "0"
           OPENSSL_STATIC: "1"
-          SODIUM_LIB_DIR: /usr/x86_64-w64-mingw32/lib
         run: |
           npm ci --legacy-peer-deps
-          env -u SODIUM_USE_PKG_CONFIG CI=true npx tauri build --target x86_64-pc-windows-gnu
+          CI=true npx tauri build --target x86_64-pc-windows-gnu
       - name: Upload artifacts
         env:
           RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
@@ -622,6 +626,9 @@ jobs:
           key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
           restore-keys: |
             ${{ runner.os }}-npm-
+      - name: Install libsodium
+        run: |
+          apt-get update && apt-get install -y libsodium-dev pkg-config libssl-dev
       - name: Build
         env:
           CC_aarch64_unknown_linux_gnu: aarch64-linux-gnu-gcc
@@ -634,10 +641,9 @@ jobs:
           OPENSSL_NO_VENDOR: "0"
           OPENSSL_STATIC: "1"
           APPIMAGE_EXTRACT_AND_RUN: "1"
-          SODIUM_LIB_DIR: /usr/lib/aarch64-linux-gnu
         run: |
           npm ci --legacy-peer-deps
-          env -u SODIUM_USE_PKG_CONFIG CI=true npx tauri build --target aarch64-unknown-linux-gnu --bundles deb,rpm
+          CI=true npx tauri build --target aarch64-unknown-linux-gnu --bundles deb,rpm
       - name: Upload artifacts
         env:
           RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}

.gitea/workflows/pr-review.yml

@@ -285,7 +285,7 @@ jobs:
 
           # Write body to file — passing 100KB+ JSON as a shell arg hits ARG_MAX.
           jq -cn \
-            --arg model "qwen3-coder-next" \
+            --arg model "qwen3.5-122b-think" \
             --rawfile content /tmp/prompt.txt \
             '{model: $model, messages: [{role: "user", content: $content}], stream: false}' \
             > /tmp/body.json
@@ -402,7 +402,7 @@ jobs:
           if [ -f "/tmp/pr_review.txt" ] && [ -s "/tmp/pr_review.txt" ]; then
             REVIEW_BODY=$(head -c 65536 /tmp/pr_review.txt)
             BODY=$(jq -n \
-              --arg body "Automated PR Review (qwen3-coder-next via liteLLM):\n\n${REVIEW_BODY}" \
+              --arg body "Automated PR Review (qwen3.5-122b-think via liteLLM):\n\n${REVIEW_BODY}" \
               '{body: $body, event: "COMMENT"}')
           else
             BODY=$(jq -n \

.gitea/workflows/release-beta.yml

@@ -221,13 +221,15 @@ jobs:
           key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
           restore-keys: |
             ${{ runner.os }}-npm-
+      - name: Install libsodium
+        run: |
+          apt-get update && apt-get install -y libsodium-dev pkg-config
       - name: Build
         env:
           APPIMAGE_EXTRACT_AND_RUN: "1"
-          SODIUM_LIB_DIR: /usr/lib/x86_64-linux-gnu
         run: |
           npm ci --legacy-peer-deps
-          env -u SODIUM_USE_PKG_CONFIG CI=true npx tauri build --target x86_64-unknown-linux-gnu
+          CI=true npx tauri build --target x86_64-unknown-linux-gnu
       - name: Upload artifacts
         env:
           RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
@@ -310,6 +312,9 @@ jobs:
           key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
           restore-keys: |
             ${{ runner.os }}-npm-
+      - name: Install libsodium
+        run: |
+          apt-get update && apt-get install -y libsodium-dev pkg-config
       - name: Build
         env:
           CC_x86_64_pc_windows_gnu: x86_64-w64-mingw32-gcc
@@ -318,11 +323,9 @@ jobs:
           CARGO_TARGET_X86_64_PC_WINDOWS_GNU_LINKER: x86_64-w64-mingw32-gcc
           OPENSSL_NO_VENDOR: "0"
           OPENSSL_STATIC: "1"
-          SODIUM_LIB_DIR: /usr/x86_64-w64-mingw32/lib
-          SODIUM_STATIC: "1"
         run: |
           npm ci --legacy-peer-deps
-          env -u SODIUM_USE_PKG_CONFIG CI=true npx tauri build --target x86_64-pc-windows-gnu
+          CI=true npx tauri build --target x86_64-pc-windows-gnu
       - name: Upload artifacts
         env:
           RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
@@ -482,6 +485,9 @@ jobs:
           key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
           restore-keys: |
             ${{ runner.os }}-npm-
+      - name: Install libsodium
+        run: |
+          apt-get update && apt-get install -y libsodium-dev pkg-config libssl-dev
       - name: Build
         env:
           CC_aarch64_unknown_linux_gnu: aarch64-linux-gnu-gcc
@@ -494,10 +500,9 @@ jobs:
           OPENSSL_NO_VENDOR: "0"
           OPENSSL_STATIC: "1"
           APPIMAGE_EXTRACT_AND_RUN: "1"
-          SODIUM_LIB_DIR: /usr/lib/aarch64-linux-gnu
         run: |
           npm ci --legacy-peer-deps
-          env -u SODIUM_USE_PKG_CONFIG CI=true npx tauri build --target aarch64-unknown-linux-gnu --bundles deb,rpm
+          CI=true npx tauri build --target aarch64-unknown-linux-gnu --bundles deb,rpm
       - name: Upload artifacts
         env:
           RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}

src-tauri/build.rs

@@ -13,6 +13,8 @@ fn main() {
             .file("memset_s_shim.c")
             .compile("memset_shim");
         println!("cargo:rerun-if-changed=memset_s_shim.c");
+        // Explicitly link the shim library
+        println!("cargo:rustc-link-lib=static=memset_shim");
     }
 
     tauri_build::build()

src-tauri/memset_s_shim.c

@@ -1,28 +1,20 @@
-// Shim for memset_explicit on MinGW which doesn't provide it
-// This is needed for libsodium's secure memory clearing
-
-#if defined(_WIN32) && defined(__MINGW32__)
+/* memset_explicit shim for Windows MinGW
+ *
+ * libsodium-sys-stable expects memset_explicit which isn't available
+ * in the MinGW runtime. This provides a compatible implementation.
+ */
 
 #include <string.h>
 
-// memset_explicit is available in Windows 8+ but MinGW headers don't always declare it
-// Provide a fallback implementation using SecureZeroMemory if available,
-// or a volatile memset to prevent compiler optimization
-void *memset_explicit(void *s, int c, size_t n) {
-    // Try to use Windows API if available
-    #ifdef _WIN32_WINNT
-        #if _WIN32_WINNT >= 0x0602  // Windows 8+
-            extern void *memset_s(void *, size_t, int, size_t);
-            return memset_s(s, n, c, n);
-        #endif
+#ifdef _WIN32
+#define EXPORT __declspec(dllexport)
+#else
+#define EXPORT
 #endif
 
-    // Fallback: use volatile to prevent optimization
-    volatile unsigned char *p = (volatile unsigned char *)s;
+EXPORT void memset_explicit(void *dest, int val, size_t n) {
+    volatile unsigned char *p = (volatile unsigned char *)dest;
     while (n--) {
-        *p++ = (unsigned char)c;
+        *p++ = (unsigned char)val;
     }
-    return s;
 }
-
-#endif

src-tauri/src/memset_shim.rs

@@ -0,0 +1,13 @@
+/// Windows MinGW memset_explicit shim
+/// libsodium-sys-stable expects memset_explicit which isn't available in MinGW
+/// This provides a compatible implementation
+
+#[cfg(target_os = "windows")]
+#[no_mangle]
+pub extern "C" fn memset_explicit(dest: *mut u8, val: i32, n: usize) {
+    unsafe {
+        for i in 0..n {
+            *dest.add(i) = val as u8;
+        }
+    }
+}