Repository navigation
Minimal build support when using LibreSSL #131127
Copy link
Copy link
Closed
Labels
OS-unsupportedextension-modulesC modules in the Modules dirC modules in the Modules dirtopic-SSLtype-featureA feature request or enhancementA feature request or enhancement
Description
Bug report
Bug description:
On systems using LibreSSL, using OpenBSD 7.6 in this example, you see the following:
$ ./configure
$ gmake
[...]
cc -pthread -fno-strict-overflow -Wsign-compare -Wunreachable-code -DNDEBUG -g -O3 -Wall -std=c11 -Wextra -Wno-unused-parameter -Wno-missing-field-initializers -Wstrict-prototypes -Werror=implicit-function-declaration -fvisibility=hidden -I./Include/internal -I./Include/internal/mimalloc -I. -I./Include -fPIC -c ./Modules/_ssl.c -o Modules/_ssl.o
./Modules/_ssl.c:4800:18: error: call to undeclared function 'X509_OBJECT_set1_X509'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration]
ok = X509_OBJECT_set1_X509(ret, X509_OBJECT_get0_X509(obj));
^
./Modules/_ssl.c:4800:18: note: did you mean 'X509_OBJECT_get0_X509'?
/usr/include/openssl/x509_vfy.h:285:7: note: 'X509_OBJECT_get0_X509' declared here
X509 *X509_OBJECT_get0_X509(const X509_OBJECT *xo);
^
./Modules/_ssl.c:4804:18: error: call to undeclared function 'X509_OBJECT_set1_X509_CRL'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration]
ok = X509_OBJECT_set1_X509_CRL(
^
./Modules/_ssl.c:4804:18: note: did you mean 'X509_OBJECT_get0_X509_CRL'?
/usr/include/openssl/x509_vfy.h:286:11: note: 'X509_OBJECT_get0_X509_CRL' declared here
X509_CRL *X509_OBJECT_get0_X509_CRL(X509_OBJECT *xo);
^
./Modules/_ssl.c:4821:1: error: static declaration of 'X509_STORE_get1_objects' follows non-static declaration
X509_STORE_get1_objects(X509_STORE *store)
^
/usr/include/openssl/x509_vfy.h:296:24: note: previous declaration is here
STACK_OF(X509_OBJECT) *X509_STORE_get1_objects(X509_STORE *xs);
^
./Modules/_ssl.c:4824:10: error: call to undeclared function 'X509_STORE_lock'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration]
if (!X509_STORE_lock(store)) {
^
./Modules/_ssl.c:4827:11: error: call to undeclared function 'sk_X509_OBJECT_deep_copy'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration]
ret = sk_X509_OBJECT_deep_copy(X509_STORE_get0_objects(store),
^
./Modules/_ssl.c:4827:9: warning: incompatible integer to pointer conversion assigning to 'struct stack_st_X509_OBJECT *' from 'int' [-Wint-conversion]
ret = sk_X509_OBJECT_deep_copy(X509_STORE_get0_objects(store),
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
./Modules/_ssl.c:4829:5: error: call to undeclared function 'X509_STORE_unlock'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration]
X509_STORE_unlock(store);
^
1 warning and 6 errors generated.
gmake: *** [Makefile:3505: Modules/_ssl.o] Error 1CPython versions tested on:
CPython main branch
Operating systems tested on:
Other
Linked PRs
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
OS-unsupportedextension-modulesC modules in the Modules dirC modules in the Modules dirtopic-SSLtype-featureA feature request or enhancementA feature request or enhancement
Projects
- StatusShow more project fieldsDone
Activity
skirpichev commentedon Mar 12, 2025
In build requirements we have OpenSSL 1.1.1:
https://docs.python.org/3/using/configure.html#build-requirements
See also PEP 644.
This definitely not a bug.
[-]Python fails to build on systems using LibreSSL[/-][+]Minimal build support when using LibreSSL[/+]picnixz commentedon Mar 12, 2025
The patch seems simple but I'm afraid that we would need to have someone that is knowledgable about this to be able to maintain the "build" support. I have no idea whether this is the only place to change, and/or if there are other discrepencies.
Also, if LibreSSL diverges from OpenSSL at some point, we may have a buildable Python but maybe not a working one. Is LibreSSL used a lot?
collinfunk commentedon Mar 12, 2025
Good point. Maybe it is best to leave it broken and allow downstream maintainers make changes to ensure it works.
AFAIK it is default on OpenBSD and DragonflyBSD. Some other systems make it usable optionally with a package.
picnixz commentedon Mar 12, 2025
In general, it's better because they know what to patch while we do not necessarily.
@vstinner as the BSD expert, does OpenBSD fall under a supported OS?
vstinner commentedon Mar 13, 2025
I don't have OpenBSD anymore. Maybe @serhiy-storchaka has an opinion about this change.
gh-131127: Minimal build support on systems using LibreSSL (GH-131128)
pythongh-131127: Minimal build support on systems using LibreSSL (pyt…
serhiy-storchaka commentedon Apr 11, 2025
I just tested building Python on OpenBSD. Without fixing this issue we cannot start fixing other issues on OpenBSD. Thank you for your contribution @collinfunk.
[3.13] gh-131127: Minimal build support on systems using LibreSSL (GH…