Skip to content

Minimal build support when using LibreSSL #131127

Closed

Description

@collinfunk

Bug report

Bug description:

On systems using LibreSSL, using OpenBSD 7.6 in this example, you see the following:

$ ./configure
$ gmake
[...]
cc -pthread  -fno-strict-overflow -Wsign-compare -Wunreachable-code -DNDEBUG -g -O3 -Wall    -std=c11 -Wextra -Wno-unused-parameter -Wno-missing-field-initializers -Wstrict-prototypes -Werror=implicit-function-declaration -fvisibility=hidden  -I./Include/internal -I./Include/internal/mimalloc  -I. -I./Include    -fPIC -c ./Modules/_ssl.c -o Modules/_ssl.o
./Modules/_ssl.c:4800:18: error: call to undeclared function 'X509_OBJECT_set1_X509'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration]
            ok = X509_OBJECT_set1_X509(ret, X509_OBJECT_get0_X509(obj));
                 ^
./Modules/_ssl.c:4800:18: note: did you mean 'X509_OBJECT_get0_X509'?
/usr/include/openssl/x509_vfy.h:285:7: note: 'X509_OBJECT_get0_X509' declared here
X509 *X509_OBJECT_get0_X509(const X509_OBJECT *xo);
      ^
./Modules/_ssl.c:4804:18: error: call to undeclared function 'X509_OBJECT_set1_X509_CRL'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration]
            ok = X509_OBJECT_set1_X509_CRL(
                 ^
./Modules/_ssl.c:4804:18: note: did you mean 'X509_OBJECT_get0_X509_CRL'?
/usr/include/openssl/x509_vfy.h:286:11: note: 'X509_OBJECT_get0_X509_CRL' declared here
X509_CRL *X509_OBJECT_get0_X509_CRL(X509_OBJECT *xo);
          ^
./Modules/_ssl.c:4821:1: error: static declaration of 'X509_STORE_get1_objects' follows non-static declaration
X509_STORE_get1_objects(X509_STORE *store)
^
/usr/include/openssl/x509_vfy.h:296:24: note: previous declaration is here
STACK_OF(X509_OBJECT) *X509_STORE_get1_objects(X509_STORE *xs);
                       ^
./Modules/_ssl.c:4824:10: error: call to undeclared function 'X509_STORE_lock'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration]
    if (!X509_STORE_lock(store)) {
         ^
./Modules/_ssl.c:4827:11: error: call to undeclared function 'sk_X509_OBJECT_deep_copy'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration]
    ret = sk_X509_OBJECT_deep_copy(X509_STORE_get0_objects(store),
          ^
./Modules/_ssl.c:4827:9: warning: incompatible integer to pointer conversion assigning to 'struct stack_st_X509_OBJECT *' from 'int' [-Wint-conversion]
    ret = sk_X509_OBJECT_deep_copy(X509_STORE_get0_objects(store),
        ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
./Modules/_ssl.c:4829:5: error: call to undeclared function 'X509_STORE_unlock'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration]
    X509_STORE_unlock(store);
    ^
1 warning and 6 errors generated.
gmake: *** [Makefile:3505: Modules/_ssl.o] Error 1

CPython versions tested on:

CPython main branch

Operating systems tested on:

Other

Linked PRs

Activity

  1. skirpichev commented on Mar 12, 2025

    @skirpichev
    Member

    In build requirements we have OpenSSL 1.1.1:
    https://docs.python.org/3/using/configure.html#build-requirements
    See also PEP 644.

    This definitely not a bug.

  2. added
    type-featureA feature request or enhancement
    and removed
    type-bugAn unexpected behavior, bug, or error
    on Mar 12, 2025
  3. changed the title [-]Python fails to build on systems using LibreSSL[/-] [+]Minimal build support when using LibreSSL[/+] on Mar 12, 2025
  4. picnixz commented on Mar 12, 2025

    @picnixz
    Member

    The patch seems simple but I'm afraid that we would need to have someone that is knowledgable about this to be able to maintain the "build" support. I have no idea whether this is the only place to change, and/or if there are other discrepencies.

    Also, if LibreSSL diverges from OpenSSL at some point, we may have a buildable Python but maybe not a working one. Is LibreSSL used a lot?

  5. collinfunk commented on Mar 12, 2025

    @collinfunk
    ContributorAuthor

    Also, if LibreSSL diverges from OpenSSL at some point, we may have a buildable Python but maybe not a working one. Is LibreSSL used a lot?

    Good point. Maybe it is best to leave it broken and allow downstream maintainers make changes to ensure it works.

    AFAIK it is default on OpenBSD and DragonflyBSD. Some other systems make it usable optionally with a package.

  6. picnixz commented on Mar 12, 2025

    @picnixz
    Member

    Good point. Maybe it is best to leave it broken and allow downstream maintainers make changes to ensure it works.

    In general, it's better because they know what to patch while we do not necessarily.

    AFAIK it is default on OpenBSD

    @vstinner as the BSD expert, does OpenBSD fall under a supported OS?

  7. vstinner commented on Mar 13, 2025

    @vstinner
    Member

    I don't have OpenBSD anymore. Maybe @serhiy-storchaka has an opinion about this change.

  8. added a commit that references this issue on Apr 11, 2025
  9. added a commit that references this issue on Apr 11, 2025
  10. serhiy-storchaka commented on Apr 11, 2025

    @serhiy-storchaka
    Member

    I just tested building Python on OpenBSD. Without fixing this issue we cannot start fixing other issues on OpenBSD. Thank you for your contribution @collinfunk.

  11. added a commit that references this issue on Apr 11, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions