tools: fix openssl segfault for replay and cabana

[TheSecurityDev]

Fixes the segfaults in replay and cabana caused by a linking issue with the vendored OpenSSL package from pip that conflicts with the one built in the replay or cabana binary.

Relevant Discord thread: https://discord.com/channels/469524606043160576/1476126000495726623/1476151475628412958

Claude's analysis:

The issue is clear: the vendored openssl3 package provides only static libraries, which get statically linked into the replay binary. Their symbols are exported in the binary's dynamic symbol table, and when libcurl.so.4 loads the system's libssl.so.3, calls to internal OpenSSL functions (like ossl_provider_libctx) resolve to the binary's bundled OpenSSL instead — which has an uninitialized library context, causing the crash.

The fix is to add -Wl,--exclude-libs,libssl.a,libcrypto.a to hide the static OpenSSL symbols from the binary's dynamic symbol table:

[Copilot]

Pull request overview

Updates the SCons build configuration for replay and cabana to avoid runtime OpenSSL symbol interposition that can cause segfaults when the binaries are statically linked against vendored OpenSSL while also loading system OpenSSL via other shared libraries (e.g., libcurl).

Changes:

• Add linker flags on non-macOS builds to hide symbols from libssl.a and libcrypto.a in replay.
• Add the same non-macOS linker flags to cabana.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
tools/replay/SConscript	Appends --exclude-libs linker flags (non-Darwin) to prevent exported static OpenSSL symbols in replay.
tools/cabana/SConscript	Appends --exclude-libs linker flags (non-Darwin) to prevent exported static OpenSSL symbols in cabana.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[VishBK]

Tested and working for me 👍

[adeebshihadeh]

Hmm, this might fix it, but it's clearly not a clean fix. Why is it loading the system version of these?

[TheSecurityDev]

Hmm, this might fix it, but it's clearly not a clean fix. Why is it loading the system version of these?

It seems it's due to using the system's libcurl under the hood which is built with the system's openssl. Sounds like vendoring libcurl might be more of a "proper" solution. But you have to build after building the vendored openssl, so perhaps just include it along with openssl? Even though that's confusing?