From 4c536d256b6eb7ac861ed44d379fe84a4922f7a5 Mon Sep 17 00:00:00 2001
From: Siavash Sameni <manwe@MacBook-Air.local>
Date: Thu, 9 Apr 2026 09:07:40 +0400
Subject: [PATCH] fix: install rustls crypto provider once in nativeInit, not
 per-thread (libcrypto TLS conflict)

---
 crates/wzp-android/src/engine.rs     | 3 ---
 crates/wzp-android/src/jni_bridge.rs | 3 +++
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/crates/wzp-android/src/engine.rs b/crates/wzp-android/src/engine.rs
index 53db861..c88bafb 100644
--- a/crates/wzp-android/src/engine.rs
+++ b/crates/wzp-android/src/engine.rs
@@ -207,7 +207,6 @@ impl WzpEngine {
     /// Returns JSON `{"rtt_ms":N,"server_fingerprint":"hex"}` or error.
     pub fn ping_relay(&self, address: &str) -> Result<String, anyhow::Error> {
         let addr: SocketAddr = address.parse()?;
-        let _ = rustls::crypto::ring::default_provider().install_default();
 
         let rt = tokio::runtime::Builder::new_current_thread()
             .enable_all()
@@ -264,7 +263,6 @@ impl WzpEngine {
     ) -> Result<(), anyhow::Error> {
         use wzp_proto::{MediaTransport, SignalMessage};
 
-        let _ = rustls::crypto::ring::default_provider().install_default();
 
         let addr: SocketAddr = relay_addr.parse()?;
         let seed = if seed_hex.is_empty() {
@@ -512,7 +510,6 @@ async fn run_call(
     alias: Option<&str>,
     state: Arc<EngineState>,
 ) -> Result<(), anyhow::Error> {
-    let _ = rustls::crypto::ring::default_provider().install_default();
 
     let bind_addr: SocketAddr = "0.0.0.0:0".parse().unwrap();
     let endpoint = wzp_transport::create_endpoint(bind_addr, None)?;
diff --git a/crates/wzp-android/src/jni_bridge.rs b/crates/wzp-android/src/jni_bridge.rs
index 5f0928e..76cae17 100644
--- a/crates/wzp-android/src/jni_bridge.rs
+++ b/crates/wzp-android/src/jni_bridge.rs
@@ -77,6 +77,9 @@ pub unsafe extern "system" fn Java_com_wzp_engine_WzpEngine_nativeInit(
 ) -> jlong {
     let result = panic::catch_unwind(|| {
         init_logging();
+        // Install rustls crypto provider ONCE on the main thread.
+        // Must not be called per-thread — conflicts with Android's system libcrypto.so TLS keys.
+        let _ = rustls::crypto::ring::default_provider().install_default();
         let handle = Box::new(EngineHandle {
             engine: WzpEngine::new(),
         });