fix: Static-link OpenSSL in secp256r1 to prevent symbol leaking

[usmansaleem]

Summary

• Static-link OpenSSL (libcrypto.a) into libbesu_native_ec.so/.dylib with symbol hiding, exporting only p256_* functions
• Remove the separate libbesu_native_ec_crypto shared library that previously leaked all OpenSSL symbols into the JVM process
• This prevents symbol conflicts with other native libraries (e.g. SoftHSM2, cloud HSM PKCS#11 clients) that depend on system OpenSSL

Changes

• secp256r1/besu-native-ec submodule updated to Consensys/besu-native-ec@062fb79 (static OpenSSL linking with version script / exported_symbols_list)
• build.sh — Build OpenSSL with no-shared -fPIC -fvisibility=hidden, target libcrypto.a
• BesuNativeEC.java — Remove besu_native_ec_crypto library loading
• secp256r1/build.gradle — Remove libbesu_native_ec_crypto from all platform copy tasks
• .github/workflows/build.yml, native-build.sh, README.md — Remove patchelf dependency

Verification

After building, confirm no OpenSSL symbols leak:

nm -D release/libbesu_native_ec.so | grep " T.*EVP_\| T.*EC_\| T.*ossl_"
# Should return nothing

nm -D release/libbesu_native_ec.so | grep " T "
# Should show only: p256_key_recovery, p256_sign, p256_verify, p256_verify_malleable_signature

Test plan

• CI native builds pass on all platforms (linux-x86-64, linux-arm64, macos-x86-64, macos-arm64)
• ./gradlew :secp256r1:test passes
• Verify no OpenSSL symbols exported from libbesu_native_ec

[Copilot]

Pull request overview

This PR updates the secp256r1 native build to static-link OpenSSL into libbesu_native_ec with symbol hiding, eliminating the separate crypto shared library to prevent OpenSSL symbol leakage into the JVM process.

Changes:

• Stop loading/copying libbesu_native_ec_crypto and rely on a single libbesu_native_ec artifact.
• Update native build scripts and CI deps to drop patchelf and build OpenSSL as a static libcrypto.a.
• Bump the secp256r1/besu-native-ec submodule to a commit that implements symbol-hiding/static OpenSSL linking.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
secp256r1/src/main/java/org/hyperledger/besu/nativelib/secp256r1/besuNativeEC/BesuNativeEC.java	Removes loading of the separate crypto JNI/JNA library.
secp256r1/build.gradle	Stops copying the libbesu_native_ec_crypto artifacts into resources.
secp256r1/besu-native-ec	Updates submodule to version that performs static OpenSSL linking/symbol hiding.
native-build.sh	Removes patchelf from native build container dependencies.
build.sh	Builds OpenSSL as static libcrypto.a and removes checks for the removed crypto dylib.
README.md	Updates Linux dependency list to remove patchelf.
CHANGELOG.md	Adds an Unreleased entry describing the OpenSSL static-linking fix.
.github/workflows/build.yml	Removes patchelf from CI deps; adds a step to unlink Homebrew LLVM.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[jframe]

LGTM