Re: Building OpenSSL 3.3.1 links with system libcrypto and libssl

[Greg Troxel <gdt%lexort.com@localhost>]

Mads Rasmussen <madsrasmussen%aserv.dk@localhost> writes:

  [openssl building woes]

You didn't specify:

  - which OS, version, cpu, are you building on
  - how did you bootstrap pkgsrc, or are you using the native NetBSD
  - did you remove all workdirs before you started
  - which version of pkgsrc, and did you ensure that all installed
    packages are from that version
  - do you have anything in mk.conf, and if so, what happened when you
  - removed it
  - did you 'make test', or just 'make package'


> ${LDCMD:-cc} -pthread -Wa,--noexecstack -O2 -O3 -pipe -I/usr/include -I/usr/
> pkg/include  -L/usr/local/lib -L/usr/pkg/gcc7/lib/gcc/x86_64--netbsd/7.5.0 -
> Wl,-R/usr/pkg/gcc7/lib/gcc/x86_64--netbsd/7.5.0 -Wl,-zrelro -L/usr/lib -Wl,-R/
> usr/lib -L/usr/pkg/lib -Wl,-R/usr/pkg/lib \
>         -o fuzz/quic-srtm-test \
>         fuzz/quic-srtm-test-bin-fuzz_rand.o \
>         fuzz/quic-srtm-test-bin-quic-srtm.o \
>         fuzz/quic-srtm-test-bin-test-corpus.o \
>         libssl.a libcrypto.a -pthread

1) I am not familiar with the details, but it looks like a bug to have
/usr/include before /usr/pkg/include, and to have /usr/local at all.

2) When building, a package should use its own includes from the source
tree ahead of anything from the system.  Even for tests.  This may be
due to something you are doing, a bug in upstream openssl, a bug in
pkgsrc, or something else.

3) This is using gcc7, which doesn't make sense because NetBSD 9 has
gcc7, and NetBSD 8 and earlier are obsolete.

> I have no /usr/local/lib (I think this is a Linux concept?) and I am pretty 

I am 99% sure it's from BSD from before there was Linux.  It's for
things that are built for that machine only, and thus packaging systems
should not use it, and it is almost always empty in modern times.

> sure its the L/usr/lib part that makes it fail, and I may be wrong here, but 
> would the standard Makefile from pkgsrc/security/openssl not replace the 
> system supplied version of OpenSSL? There are multiple warnings about this in 
> the OpenSSL documentation, so I can't imagine I am right about this, but --
> libdir=lib would place libcrypto.so and libssl.so in /usr/lib?

pkgsrc openssl should build to /usr/pkg (or however bootstrapped).  When
building, it should use its own headers before anything.

I just did 'make package' for security/openssl on NetBSD 10 amd64 with
pkgsrc HEAD (10 has 3.0.12 in base).  It built fine, and make test
also ran for a while and got hung up on

  04-test_bio_dgram.t .....................

which may or may not be related to what you are seeing.

I then did 'make' on netbsd-9 amd64 2024Q2.  9 has 1.1.1t in base.
That succeeded also.