A one-bug release, for a bug that stopped GitBox from starting at all: on Linux, v1.1.4 through v1.1.6 only ran on machines that happened to already have a compatible OpenSSL loaded. If yours did not, the app died before its first window.
Fixed
GitBox starts on Linux again — undefined symbol: EVP_des_ede3_cbc. Native SSH, added in v1.1.4, brought in libssh2 with its OpenSSL crypto backend. The vendor script builds a static OpenSSL for it, but binding.gyp only ever linked libssh2.a, so about 97 OpenSSL symbols were left undefined in the addon — and libssh2 holds them as data relocations, which the loader has to resolve the moment the addon is opened. Nothing complained: linking a shared object with undefined symbols is legal, so the build passed, and plain node exports the OpenSSL it links statically, so the addon quietly borrowed those symbols in development. Electron ships BoringSSL and exports no EVP_des_ede3_cbc, so the packaged app survived only where the system had already mapped a compatible libcrypto into the process. That is why it ran on Fedora and died on Ubuntu 24.04. The vendored static libcrypto.a is now linked into the addon, which keeps the same shared-library set and the same glibc floor as before — the binary stays as portable as it was.
Windows was never affected: SSH is still built off there. Reported by @HermesSantos in #1.
Improved
The addon is audited for self-containment before it is packaged. "Does it load?" is not a valid test for this bug — on any host with a system libcrypto, the broken binary loads fine. So the new test suite reads the built binary's imported symbols instead: it fails if anything from the vendored git, SSH or crypto libraries is imported rather than linked in, if any imported symbol resolves to something outside the C runtime and N-API, or if it needs a shared library beyond the C/C++ runtime. Run against a deliberately broken build, the three symbol tests fail while both load tests still pass.
Linux and Windows build on every pull request. Both workflows now compile the addon and run that audit before packaging, not after — on a tag push electron-builder publishes as it packages, so a check that runs afterwards cannot gate a release.
Downloads
- Linux — AppImage,
.deb,.rpm,.pacman - Windows —
.exe(NSIS installer) or.msi
Existing installs update in place through the built-in updater. Linux users on v1.1.4–v1.1.6 who cannot start GitBox at all will need to download an installer directly.