GitBox fails to start on Ubuntu 24.04 due to OpenSSL 3 incompatibility (undefined symbol: EVP_des_ede3_cbc)

[HermesSantos]

Environment

• OS: Ubuntu 24.04.4 LTS
• OpenSSL: OpenSSL 3.0.13
• GitBox version: <coloque a versão>
• Architecture: x86_64

Problem

After updating to Ubuntu 24.04, GitBox fails to start.

Error:
A JavaScript error occurred in the main process

Error: .../gitbox_addon.node: undefined symbol: EVP_des_ede3_cbc

The native addon appears to require the OpenSSL 1.1 symbol EVP_des_ede3_cbc, which is no longer available by default in OpenSSL 3.

Investigation

The symbol is required by the native addon:

nm -D gitbox_addon.node | grep EVP_des_ede3_cbc

U EVP_des_ede3_cbc

The binary does not declare a dependency on libcrypto:
readelf -d gitbox_addon.node | grep NEEDED
Output only contains:
libstdc++.so.6
libgcc_s.so.1
libc.so.6

Workaround

The application starts when forcing OpenSSL 1.1:

LD_PRELOAD=/usr/lib/x86_64-linux-gnu/libcrypto.so.1.1 gitbox

Expected behavior

GitBox should run on modern Linux distributions without requiring OpenSSL 1.1 compatibility libraries.

Possible fix

Rebuild gitbox-addon against OpenSSL 3 / update native dependencies.

[gitgusilva]

Diagnosed — thanks, your nm/readelf output pointed straight at it.

binding.gyp linked libssh2 (added in v1.1.4 for SSH remotes) but not the static libcrypto.a that the build script produces for it, so ~97 OpenSSL symbols were left for the host process to provide. Plain node exports the OpenSSL it links statically, so it worked in development; Electron ships BoringSSL and has no EVP_des_ede3_cbc, so the packaged app only survived on machines that already had a compatible libcrypto mapped into the process. Your LD_PRELOAD was doing exactly that.

Fix in #2, plus a CI check that audits the addon's imported symbols so this can't ship again. I'll ping you when v1.1.7 is out — a confirmation on 24.04 would be very welcome.

[gitgusilva]

v1.1.7 is out: https://github.com/gitgusilva/gitbox/releases/tag/v1.1.7

The vendored static libcrypto.a is now linked into the addon, so it no longer reaches into the host process for EVP_*. The shared-library set and the glibc floor are unchanged, so it should stay as portable as before. CI also builds the addon and audits its imported symbols before packaging now — reading what the binary imports rather than just loading it, since on a host with a system libcrypto the broken build loads fine.

Linux downloads are on the release page: AppImage, .deb, .rpm and .pacman. Since v1.1.6 will not start for you at all, the in-app updater is not an option — grab the installer directly.

If you get a chance to try it on 24.04, a confirmation would be very welcome. And thanks again for the nm/readelf output and the LD_PRELOAD note — that is what made it a short hunt.