fix: prioritise llvm tools

boring-sys/Cargo.toml

@@ -86,6 +86,10 @@ pq-experimental = []
 # those for `pq-experimental` feature apply.
 underscore-wildcards = []
 
+# Add a prefix to all symbols in libcrypto and libssl to prevent conflicts
+# with other OpenSSL or BoringSSL versions that might be linked in the same process.
+prefix-symbols = []
+
 [build-dependencies]
 autocfg = { workspace = true }
 bindgen = { workspace = true }

boring-sys/build/config.rs

@@ -21,6 +21,7 @@ pub(crate) struct Features {
     pub(crate) pq_experimental: bool,
     pub(crate) rpk: bool,
     pub(crate) underscore_wildcards: bool,
+    pub(crate) prefix_symbols: bool,
 }
 
 pub(crate) struct Env {
@@ -125,6 +126,7 @@ impl Features {
         let pq_experimental = env::var_os("CARGO_FEATURE_PQ_EXPERIMENTAL").is_some();
         let rpk = env::var_os("CARGO_FEATURE_RPK").is_some();
         let underscore_wildcards = env::var_os("CARGO_FEATURE_UNDERSCORE_WILDCARDS").is_some();
+        let prefix_symbols = env::var_os("CARGO_FEATURE_PREFIX_SYMBOLS").is_some();
 
         Self {
             fips,
@@ -133,6 +135,7 @@ impl Features {
             pq_experimental,
             rpk,
             underscore_wildcards,
+            prefix_symbols,
         }
     }
 

boring-sys/build/main.rs

@@ -1,5 +1,6 @@
 use fslock::LockFile;
 use std::env;
+use std::ffi::OsStr;
 use std::ffi::OsString;
 use std::fs;
 use std::io;
@@ -9,8 +10,10 @@ use std::process::{Command, Output};
 use std::sync::OnceLock;
 
 use crate::config::Config;
+use crate::prefix::{prefix_symbols, PrefixCallback};
 
 mod config;
+mod prefix;
 
 fn should_use_cmake_cross_compilation(config: &Config) -> bool {
     if config.host == config.target {
@@ -127,11 +130,10 @@ fn get_boringssl_source_path(config: &Config) -> &PathBuf {
         if !submodule_path.join("CMakeLists.txt").exists() {
             println!("cargo:warning=fetching boringssl git submodule");
 
-            run_command(
+            run_command(&["git"], |c| {
-                Command::new("git")
+                c.args(["submodule", "update", "--init", "--recursive"])
-                    .args(["submodule", "update", "--init", "--recursive"])
+                    .arg(&submodule_path)
-                    .arg(&submodule_path),
+            })
-            )
             .unwrap();
         }
 
@@ -494,9 +496,12 @@ fn ensure_patches_applied(config: &Config) -> io::Result<()> {
 
     // NOTE: init git in the copied files, so we can apply patches
     if !has_git {
-        run_command(Command::new("git").arg("init").current_dir(src_path))?;
+        run_command(&["git"], |c| c.arg("init").current_dir(src_path))?;
     }
 
+    println!("cargo:warning=applying prefix patch to boringssl");
+    apply_patch(config, "boringssl-prefix.patch")?;
+
     println!("cargo:warning=applying 44b3df6f03d85c901767250329c571db405122d5 patch to boringssl");
     apply_patch(
         config,
@@ -533,32 +538,46 @@ fn apply_patch(config: &Config, patch_name: &str) -> io::Result<()> {
         args.push("-p2");
     }
 
-    run_command(
+    run_command(&["git"], |c| {
-        Command::new("git")
+        c.args(&args).arg(&cmd_path).current_dir(src_path)
-            .args(&args)
+    })?;
-            .arg(cmd_path)
-            .current_dir(src_path),
-    )?;
 
     Ok(())
 }
 
-fn run_command(command: &mut Command) -> io::Result<Output> {
+fn run_command(
-    let out = command.output()?;
+    names: &[impl AsRef<OsStr>],
+    f: impl Fn(&mut Command) -> &mut Command,
+) -> io::Result<Output> {
+    for name in names {
+        let mut command = Command::new(name);
+        f(&mut command);
 
-    println!("{}", std::str::from_utf8(&out.stdout).unwrap());
+        let out = match command.output() {
-    eprintln!("{}", std::str::from_utf8(&out.stderr).unwrap());
+            Ok(out) => out,
-
+            Err(e) if e.kind() == io::ErrorKind::NotFound => continue,
-    if !out.status.success() {
+            Err(e) => {
-        let err = match out.status.code() {
+                eprintln!("{command:?} failed to execute: {e}");
-            Some(code) => format!("{command:?} exited with status: {code}"),
+                continue;
-            None => format!("{command:?} was terminated by signal"),
+            }
         };
 
-        return Err(io::Error::other(err));
+        println!("{}", std::str::from_utf8(&out.stdout).unwrap());
+        eprintln!("{}", std::str::from_utf8(&out.stderr).unwrap());
+
+        if !out.status.success() {
+            let err = match out.status.code() {
+                Some(code) => format!("{command:?} exited with status: {code}"),
+                None => format!("{command:?} was terminated by signal"),
+            };
+
+            return Err(io::Error::other(err));
+        }
+
+        return Ok(out);
     }
 
-    Ok(out)
+    Err(io::ErrorKind::NotFound.into())
 }
 
 fn built_boring_source_path(config: &Config) -> &PathBuf {
@@ -592,8 +611,12 @@ fn built_boring_source_path(config: &Config) -> &PathBuf {
             cfg.define("FIPS", "1");
         }
 
-        cfg.build_target("ssl").build();
+        if config.features.prefix_symbols {
-        cfg.build_target("crypto").build()
+            cfg.define("CMAKE_POSITION_INDEPENDENT_CODE", "ON");
+        }
+
+        cfg.build_target("bssl2_ssl").build();
+        cfg.build_target("bssl2_crypto").build()
     })
 }
 
@@ -605,7 +628,7 @@ fn link_in_precompiled_bcm_o(config: &Config) {
         .expect("`fips-link-precompiled` requires `BORING_BSSL_FIPS_PRECOMPILED_BCM_O` env variable to be specified");
 
     let libcrypto_path = bssl_dir
-        .join("build/crypto/libcrypto.a")
+        .join("build/bssl2_crypto/libbssl2_crypto.a")
         .canonicalize()
         .unwrap();
 
@@ -614,13 +637,8 @@ fn link_in_precompiled_bcm_o(config: &Config) {
     fs::copy(bcm_o_src_path, &bcm_o_dst_path).unwrap();
 
     // check that fips module is named as expected
-    let out = run_command(
+    let ar = &["llvm-ar", "ar"];
-        Command::new("ar")
+    let out = run_command(ar, |c| c.arg("t").arg(&libcrypto_path).arg("bcm.o")).unwrap();
-            .arg("t")
-            .arg(&libcrypto_path)
-            .arg("bcm.o"),
-    )
-    .unwrap();
 
     assert_eq!(
         String::from_utf8(out.stdout).unwrap().trim(),
@@ -633,11 +651,10 @@ fn link_in_precompiled_bcm_o(config: &Config) {
     // (this causes the need for extra linker flags to deal with duplicate symbols)
     // (as long as the newer module does not define new symbols, one may also remove it,
     // but once there are new symbols it would cause missing symbols at linking stage)
-    run_command(
+    run_command(ar, |c| {
-        Command::new("ar")
+        c.args(["rb", "bcm.o"])
-            .args(["rb", "bcm.o"])
+            .args([&libcrypto_path, &bcm_o_dst_path])
-            .args([&libcrypto_path, &bcm_o_dst_path]),
+    })
-    )
     .unwrap();
 }
 
@@ -663,6 +680,9 @@ fn main() {
     if !config.env.docs_rs {
         emit_link_directives(&config);
     }
+    if config.features.prefix_symbols {
+        prefix_symbols(&config);
+    }
     generate_bindings(&config);
 }
 
@@ -679,12 +699,12 @@ fn emit_link_directives(config: &Config) {
     } else {
         // todo(rmehra): clean this up, I think these are pretty redundant
         println!(
-            "cargo:rustc-link-search=native={}/build/crypto/{}",
+            "cargo:rustc-link-search=native={}/build/bssl2_crypto/{}",
             bssl_dir.display(),
             build_path
         );
         println!(
-            "cargo:rustc-link-search=native={}/build/ssl/{}",
+            "cargo:rustc-link-search=native={}/build/bssl2_ssl/{}",
             bssl_dir.display(),
             build_path
         );
@@ -706,8 +726,8 @@ fn emit_link_directives(config: &Config) {
     if let Some(cpp_lib) = get_cpp_runtime_lib(config) {
         println!("cargo:rustc-link-lib={cpp_lib}");
     }
-    println!("cargo:rustc-link-lib=static=crypto");
+    println!("cargo:rustc-link-lib=static=bssl2_crypto");
-    println!("cargo:rustc-link-lib=static=ssl");
+    println!("cargo:rustc-link-lib=static=bssl2_ssl");
 
     if config.target_os == "windows" {
         // Rust 1.87.0 compat - https://github.com/rust-lang/rust/pull/138233
@@ -765,6 +785,10 @@ fn generate_bindings(config: &Config) {
             .clang_arg(sysroot.display().to_string());
     }
 
+    if config.features.prefix_symbols {
+        builder = builder.parse_callbacks(Box::new(PrefixCallback));
+    }
+
     let headers = [
         "aes.h",
         "asn1_mac.h",

boring-sys/build/prefix.rs

@@ -0,0 +1,101 @@
+use crate::{
+    config::Config, get_boringssl_platform_output_path, pick_best_android_ndk_toolchain,
+    run_command,
+};
+use std::{fs, io::Write, path::PathBuf};
+
+// The prefix to add to all symbols
+// RBSSL = Rust BoringSSL, chosen arbitrarily to avoid collisions with other projects
+const PREFIX: &str = "RBSSL2";
+
+// Callback to add a `link_name` macro with the prefix to all generated bindings
+#[derive(Debug)]
+pub struct PrefixCallback;
+
+impl bindgen::callbacks::ParseCallbacks for PrefixCallback {
+    fn generated_link_name_override(
+        &self,
+        item_info: bindgen::callbacks::ItemInfo<'_>,
+    ) -> Option<String> {
+        Some(format!("{PREFIX}_{}", item_info.name))
+    }
+}
+
+fn android_toolchain(config: &Config) -> PathBuf {
+    let mut android_bin_path = config
+        .env
+        .android_ndk_home
+        .clone()
+        .expect("Please set ANDROID_NDK_HOME for Android build");
+    android_bin_path.extend(["toolchains", "llvm", "prebuilt"]);
+    android_bin_path.push(pick_best_android_ndk_toolchain(&android_bin_path).unwrap());
+    android_bin_path.push("bin");
+    android_bin_path
+}
+
+pub fn prefix_symbols(config: &Config) {
+    // List static libraries to prefix symbols in
+    let build_path = config
+        .out_dir
+        .join("build")
+        .join(get_boringssl_platform_output_path(config));
+    let static_libs: Vec<PathBuf> = [
+        build_path.clone(),
+        build_path.join("bssl2_ssl"),
+        build_path.join("bssl2_crypto"),
+    ]
+    .iter()
+    .flat_map(|dir| {
+        [
+            "libbssl2_ssl.a",
+            "libbssl2_crypto.a",
+            "bssl2_ssl.lib",
+            "bssl2_crypto.lib",
+        ]
+        .into_iter()
+        .map(move |file| PathBuf::from(dir).join(file))
+    })
+    .filter(|p| p.exists())
+    .collect();
+
+    // Use `nm` to list symbols in these static libraries
+    let nm: &[PathBuf] = match &*config.target_os {
+        "android" => &[android_toolchain(config).join("llvm-nm")],
+        _ => &[PathBuf::from("llvm-nm"), PathBuf::from("nm")],
+    };
+    let out = run_command(nm, |c| c.args(&static_libs)).unwrap();
+    let mut redefine_syms: Vec<String> = String::from_utf8_lossy(&out.stdout)
+        .lines()
+        .filter(|l| {
+            [" T ", " D ", " B ", " C ", " R ", " W "]
+                .iter()
+                .any(|s| l.contains(s))
+        })
+        .filter_map(|l| l.split_whitespace().nth(2).map(|s| s.to_string()))
+        .filter(|l| !l.starts_with("_"))
+        .filter(|l| l != "p_thread_callback_boringssl") // `/ALTERNATENAME` didn't work for this so skip it
+        .map(|l| format!("{l} {PREFIX}_{l}"))
+        .collect();
+    redefine_syms.sort();
+    redefine_syms.dedup();
+
+    let redefine_syms_path = config.out_dir.join("redefine_syms.txt");
+    let mut f = fs::File::create(&redefine_syms_path).unwrap();
+    for sym in &redefine_syms {
+        writeln!(f, "{sym}").unwrap();
+    }
+    f.flush().unwrap();
+
+    // Use `objcopy` to prefix symbols in these static libraries
+    let objcopy: &[PathBuf] = match &*config.target_os {
+        "android" => &[android_toolchain(config).join("llvm-objcopy")],
+        _ => &[PathBuf::from("llvm-objcopy"), PathBuf::from("objcopy")],
+    };
+    for static_lib in &static_libs {
+        run_command(objcopy, |c| {
+            c.arg(format!("--redefine-syms={}", redefine_syms_path.display()))
+                .arg(static_lib)
+        })
+        .unwrap();
+    }
+}

boring-sys/patches/boringssl-prefix.patch

@@ -0,0 +1,280 @@
+diff --git a/BUILD b/BUILD
+index 206786442..4188c0859 100644
+--- a/BUILD
++++ b/BUILD
+@@ -131,7 +131,7 @@ boringssl_copts_cxx = boringssl_copts + select({
+ })
+ 
+ cc_library(
+-    name = "crypto",
++    name = "bssl2_crypto",
+     srcs = crypto_sources + crypto_internal_headers + asm_sources,
+     hdrs = crypto_headers + fips_fragments,
+     copts = boringssl_copts_c11,
+@@ -144,14 +144,14 @@ cc_library(
+ )
+ 
+ cc_library(
+-    name = "ssl",
++    name = "bssl2_ssl",
+     srcs = ssl_sources + ssl_internal_headers,
+     hdrs = ssl_headers,
+     copts = boringssl_copts_cxx,
+     includes = ["src/include"],
+     visibility = ["//visibility:public"],
+     deps = [
+-        ":crypto",
++        ":bssl2_crypto",
+     ],
+ )
+ 
+@@ -160,5 +160,5 @@ cc_binary(
+     srcs = tool_sources + tool_headers,
+     copts = boringssl_copts_cxx,
+     visibility = ["//visibility:public"],
+-    deps = [":ssl"],
++    deps = [":bssl2_ssl"],
+ )
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index faed2befa..fc7b38d5b 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -264,7 +264,7 @@ if(OPENSSL_NASM)
+ endif()
+ 
+ add_library(
+-  crypto
++  bssl2_crypto
+ 
+   ${CRYPTO_SOURCES_ASM_USED}
+   err_data.c
+@@ -493,10 +493,10 @@ add_library(
+   src/crypto/x509v3/v3_utl.c
+ )
+ 
+-target_include_directories(crypto PUBLIC $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/src/include>)
++target_include_directories(bssl2_crypto PUBLIC $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/src/include>)
+ 
+ add_library(
+-  ssl
++  bssl2_ssl
+ 
+   src/ssl/bio_ssl.cc
+   src/ssl/d1_both.cc
+@@ -537,10 +537,10 @@ add_library(
+   src/ssl/tls_record.cc
+ )
+ 
+-target_link_libraries(ssl crypto)
++target_link_libraries(bssl2_ssl bssl2_crypto)
+ 
+ add_executable(
+-  bssl
++  bssl2_bssl
+ 
+   src/tool/args.cc
+   src/tool/ciphers.cc
+@@ -561,14 +561,13 @@ add_executable(
+   src/tool/transport_common.cc
+ )
+ 
+-target_link_libraries(bssl ssl crypto)
++target_link_libraries(bssl2_bssl bssl2_ssl bssl2_crypto)
+ 
+ if(NOT ANDROID)
+   find_package(Threads REQUIRED)
+-  target_link_libraries(crypto Threads::Threads)
++  target_link_libraries(bssl2_crypto Threads::Threads)
+ endif()
+ 
+ if(WIN32)
+-  target_link_libraries(crypto ws2_32)
++  target_link_libraries(bssl2_crypto ws2_32)
+ endif()
+-
+diff --git a/src/crypto/CMakeLists.txt b/src/crypto/CMakeLists.txt
+index cdb5ddca1..e9ef24a24 100644
+--- a/src/crypto/CMakeLists.txt
++++ b/src/crypto/CMakeLists.txt
+@@ -62,7 +62,7 @@ add_custom_command(
+ )
+ 
+ add_library(
+-  crypto
++  bssl2_crypto
+ 
+   asn1/a_bitstr.c
+   asn1/a_bool.c
+@@ -291,26 +291,26 @@ add_library(
+   ${CRYPTO_FIPS_OBJECTS}
+ )
+ if(OPENSSL_ASM)
+-  target_sources(crypto PRIVATE ${CRYPTO_SOURCES_ASM})
++  target_sources(bssl2_crypto PRIVATE ${CRYPTO_SOURCES_ASM})
+ endif()
+ if(OPENSSL_NASM)
+-  target_sources(crypto PRIVATE ${CRYPTO_SOURCES_NASM})
++  target_sources(bssl2_crypto PRIVATE ${CRYPTO_SOURCES_NASM})
+ endif()
+-target_include_directories(crypto PUBLIC
++target_include_directories(bssl2_crypto PUBLIC
+   $<BUILD_INTERFACE:${PROJECT_SOURCE_DIR}/include>
+   $<INSTALL_INTERFACE:include>
+ )
+-install_if_enabled(TARGETS crypto EXPORT OpenSSLTargets ${INSTALL_DESTINATION_DEFAULT})
+-set_property(TARGET crypto PROPERTY EXPORT_NAME Crypto)
++install_if_enabled(TARGETS bssl2_crypto EXPORT OpenSSLTargets ${INSTALL_DESTINATION_DEFAULT})
++set_property(TARGET bssl2_crypto PROPERTY EXPORT_NAME Crypto)
+ 
+ if(FIPS_SHARED)
+   # Rewrite libcrypto.so to inject the correct module hash value. This assumes
+   # UNIX-style library naming, but we only support FIPS mode on Linux anyway.
+   add_custom_command(
+-    TARGET crypto POST_BUILD
++    TARGET bssl2_crypto POST_BUILD
+     COMMAND ${GO_EXECUTABLE} run
+     ${CMAKE_CURRENT_SOURCE_DIR}/../util/fipstools/inject_hash/inject_hash.go
+-    -o libcrypto.so -in-object libcrypto.so
++    -o libbssl2_crypto.so -in-object libbssl2_crypto.so
+     # The DEPENDS argument to a POST_BUILD rule appears to be ignored. Thus
+     # go_executable isn't used (as it doesn't get built), but we list this
+     # dependency anyway in case it starts working in some CMake version.
+@@ -319,27 +319,27 @@ if(FIPS_SHARED)
+   )
+ endif()
+ 
+-add_dependencies(crypto boringssl_prefix_symbols)
++add_dependencies(bssl2_crypto boringssl_prefix_symbols)
+ 
+ if(FIPS_DELOCATE OR FIPS_SHARED)
+-  add_dependencies(crypto bcm_o_target)
++  add_dependencies(bssl2_crypto bcm_o_target)
+ endif()
+ 
+-set_target_properties(crypto PROPERTIES LINKER_LANGUAGE C)
++set_target_properties(bssl2_crypto PROPERTIES LINKER_LANGUAGE C)
+ 
+ if(WIN32)
+-  target_link_libraries(crypto ws2_32)
++  target_link_libraries(bssl2_crypto ws2_32)
+ endif()
+ 
+ if(NOT ANDROID)
+   find_package(Threads REQUIRED)
+-  target_link_libraries(crypto Threads::Threads)
++  target_link_libraries(bssl2_crypto Threads::Threads)
+ endif()
+ 
+ # Every target depends on crypto, so we add libcxx as a dependency here to
+ # simplify injecting it everywhere.
+ if(USE_CUSTOM_LIBCXX)
+-  target_link_libraries(crypto libcxx)
++  target_link_libraries(bssl2_crypto libcxx)
+ endif()
+ 
+ # urandom_test is a separate binary because it needs to be able to observe the
+@@ -350,7 +350,7 @@ add_executable(
+ 
+   fipsmodule/rand/urandom_test.cc
+ )
+-target_link_libraries(urandom_test test_support_lib boringssl_gtest crypto)
++target_link_libraries(urandom_test test_support_lib boringssl_gtest bssl2_crypto)
+ add_dependencies(all_tests urandom_test)
+ 
+ add_executable(
+@@ -424,5 +424,5 @@ add_executable(
+ 
+   $<TARGET_OBJECTS:crypto_test_data>
+ )
+-target_link_libraries(crypto_test test_support_lib boringssl_gtest_main crypto)
++target_link_libraries(crypto_test test_support_lib boringssl_gtest_main bssl2_crypto)
+ add_dependencies(all_tests crypto_test)
+diff --git a/src/ssl/CMakeLists.txt b/src/ssl/CMakeLists.txt
+index d8d997e34..f0471b379 100644
+--- a/src/ssl/CMakeLists.txt
++++ b/src/ssl/CMakeLists.txt
+@@ -1,5 +1,5 @@
+ add_library(
+-  ssl
++  bssl2_ssl
+ 
+   bio_ssl.cc
+   d1_both.cc
+@@ -42,9 +42,9 @@ add_library(
+ # Although libssl also provides headers that require an include directory, the
+ # flag is already specified by libcrypto, so we omit target_include_directories
+ # here.
+-install_if_enabled(TARGETS ssl EXPORT OpenSSLTargets ${INSTALL_DESTINATION_DEFAULT})
+-set_property(TARGET ssl PROPERTY EXPORT_NAME SSL)
+-target_link_libraries(ssl crypto)
++install_if_enabled(TARGETS bssl2_ssl EXPORT OpenSSLTargets ${INSTALL_DESTINATION_DEFAULT})
++set_property(TARGET bssl2_ssl PROPERTY EXPORT_NAME SSL)
++target_link_libraries(bssl2_ssl crypto)
+ 
+ add_executable(
+   ssl_test
+@@ -53,5 +53,5 @@ add_executable(
+   ssl_test.cc
+   ssl_c_test.c
+ )
+-target_link_libraries(ssl_test test_support_lib boringssl_gtest_main ssl crypto)
++target_link_libraries(ssl_test test_support_lib boringssl_gtest_main bssl2_ssl bssl2_crypto)
+ add_dependencies(all_tests ssl_test)
+diff --git a/src/tool/CMakeLists.txt b/src/tool/CMakeLists.txt
+index 504710889..d5674fa9e 100644
+--- a/src/tool/CMakeLists.txt
++++ b/src/tool/CMakeLists.txt
+@@ -1,5 +1,5 @@
+ add_executable(
+-  bssl
++  bssl2_bssl
+ 
+   args.cc
+   ciphers.cc
+@@ -19,5 +19,5 @@ add_executable(
+   tool.cc
+   transport_common.cc
+ )
+-install_if_enabled(TARGETS bssl DESTINATION ${INSTALL_DESTINATION_DEFAULT})
+-target_link_libraries(bssl ssl crypto)
++install_if_enabled(TARGETS bssl2_bssl DESTINATION ${INSTALL_DESTINATION_DEFAULT})
++target_link_libraries(bssl2_bssl bssl2_ssl bssl2_crypto)
+diff --git a/src/util/BUILD.toplevel b/src/util/BUILD.toplevel
+index 206786442..81f55c1af 100644
+--- a/src/util/BUILD.toplevel
++++ b/src/util/BUILD.toplevel
+@@ -131,7 +131,7 @@ boringssl_copts_cxx = boringssl_copts + select({
+ })
+ 
+ cc_library(
+-    name = "crypto",
++    name = "bssl2_crypto",
+     srcs = crypto_sources + crypto_internal_headers + asm_sources,
+     hdrs = crypto_headers + fips_fragments,
+     copts = boringssl_copts_c11,
+@@ -144,21 +144,21 @@ cc_library(
+ )
+ 
+ cc_library(
+-    name = "ssl",
++    name = "bssl2_ssl",
+     srcs = ssl_sources + ssl_internal_headers,
+     hdrs = ssl_headers,
+     copts = boringssl_copts_cxx,
+     includes = ["src/include"],
+     visibility = ["//visibility:public"],
+     deps = [
+-        ":crypto",
++        ":bssl2_crypto",
+     ],
+ )
+ 
+ cc_binary(
+-    name = "bssl",
++    name = "bssl2_bssl",
+     srcs = tool_sources + tool_headers,
+     copts = boringssl_copts_cxx,
+     visibility = ["//visibility:public"],
+-    deps = [":ssl"],
++    deps = [":bssl2_ssl"],
+ )

boring/Cargo.toml

@@ -17,6 +17,8 @@ features = ["pq-experimental", "underscore-wildcards"]
 rustdoc-args = ["--cfg", "docsrs"]
 
 [features]
+default = ["prefix-symbols"]
+
 # Controlling the build
 
 # NOTE: This feature is deprecated. It is needed for the submoduled
@@ -55,6 +57,10 @@ pq-experimental = ["boring-sys/pq-experimental"]
 # those for `pq-experimental` feature apply.
 underscore-wildcards = ["boring-sys/underscore-wildcards"]
 
+# Add a prefix to all symbols in libcrypto and libssl to prevent conflicts
+# with other OpenSSL or BoringSSL versions that might be linked in the same process.
+prefix-symbols = ["boring-sys/prefix-symbols"]
+
 # Controlling key exchange preferences at compile time
 
 # Choose key exchange preferences at compile time. This prevents the user from