encapsulate-sqlcipher.diff

diff --git i/hak/matrix-seshat/build.ts w/hak/matrix-seshat/build.ts
index 8d50bb1..33ad8d5 100644
--- i/hak/matrix-seshat/build.ts
+++ w/hak/matrix-seshat/build.ts
@@ -26,7 +26,7 @@ export default async function(hakEnv: HakEnv, moduleInfo: DependencyInfo): Promi
     if (hakEnv.isWin()) {
         await buildOpenSslWin(hakEnv, moduleInfo);
         await buildSqlCipherWin(hakEnv, moduleInfo);
-    } else if (hakEnv.isMac()) {
+    } else {
         await buildSqlCipherUnix(hakEnv, moduleInfo);
     }
     await buildMatrixSeshat(hakEnv, moduleInfo);
@@ -179,12 +179,17 @@ async function buildSqlCipherUnix(hakEnv, moduleInfo) {
         '--prefix=' + moduleInfo.depPrefix + '',
         '--enable-tempstore=yes',
         '--enable-shared=no',
+        '--enable-tcl=no',
     ];
 
     if (hakEnv.isMac()) {
         args.push('--with-crypto-lib=commoncrypto');
     }
 
+    if (hakEnv.isLinux()) {
+        args.push('--with-pic=yes');
+    }
+
     if (!hakEnv.isHost()) {
         // In the nonsense world of `configure`, it is assumed you are building
         // a compiler like `gcc`, so the `host` option actually means the target
@@ -265,12 +270,14 @@ async function buildMatrixSeshat(hakEnv, moduleInfo) {
     // it for now: we should confirm how much of this it still actually needs.
     const env = hakEnv.makeGypEnv();
 
-    if (!hakEnv.isLinux()) {
-        Object.assign(env, {
-            SQLCIPHER_STATIC: 1,
-            SQLCIPHER_LIB_DIR: path.join(moduleInfo.depPrefix, 'lib'),
-            SQLCIPHER_INCLUDE_DIR: path.join(moduleInfo.depPrefix, 'include'),
-        });
+    Object.assign(env, {
+        SQLCIPHER_STATIC: 1,
+        SQLCIPHER_LIB_DIR: path.join(moduleInfo.depPrefix, 'lib'),
+        SQLCIPHER_INCLUDE_DIR: path.join(moduleInfo.depPrefix, 'include'),
+    });
+
+    if (hakEnv.isLinux()) {
+        env.RUSTFLAGS = '-Clink-arg=-Wl,-Bsymbolic -Clink-arg=-Wl,--exclude-libs,ALL'
     }
 
     if (hakEnv.isWin()) {
diff --git i/hak/matrix-seshat/check.ts w/hak/matrix-seshat/check.ts
index d34247f..ad6533a 100644
--- i/hak/matrix-seshat/check.ts
+++ w/hak/matrix-seshat/check.ts
@@ -22,21 +22,19 @@ import { DependencyInfo } from '../../scripts/hak/dep';
 
 export default async function(hakEnv: HakEnv, moduleInfo: DependencyInfo): Promise<void> {
     // of course tcl doesn't have a --version
-    if (!hakEnv.isLinux()) {
-        await new Promise<void>((resolve, reject) => {
-            const proc = childProcess.spawn('tclsh', [], {
-                stdio: ['pipe', 'ignore', 'ignore'],
-            });
-            proc.on('exit', (code) => {
-                if (code !== 0) {
-                    reject("Can't find tclsh - have you installed TCL?");
-                } else {
-                    resolve();
-                }
-            });
-            proc.stdin.end();
+    await new Promise<void>((resolve, reject) => {
+        const proc = childProcess.spawn('tclsh', [], {
+            stdio: ['pipe', 'ignore', 'ignore'],
         });
-    }
+        proc.on('exit', (code) => {
+            if (code !== 0) {
+                reject("Can't find tclsh - have you installed TCL?");
+            } else {
+                resolve();
+            }
+        });
+        proc.stdin.end();
+    });
 
     const tools = [
         ['rustc', '--version'],
diff --git i/hak/matrix-seshat/fetchDeps.ts w/hak/matrix-seshat/fetchDeps.ts
index a2fcf34..1ae1286 100644
--- i/hak/matrix-seshat/fetchDeps.ts
+++ w/hak/matrix-seshat/fetchDeps.ts
@@ -25,9 +25,7 @@ import HakEnv from '../../scripts/hak/hakEnv';
 import { DependencyInfo } from '../../scripts/hak/dep';
 
 export default async function(hakEnv: HakEnv, moduleInfo: DependencyInfo): Promise<void> {
-    if (!hakEnv.isLinux()) {
-        await getSqlCipher(hakEnv, moduleInfo);
-    }
+    await getSqlCipher(hakEnv, moduleInfo);
 
     if (hakEnv.isWin()) {
         await getOpenSsl(hakEnv, moduleInfo);