Repository navigation
Provide configure option --with-ssl for compilation with custom openssl #65740
Description
| BPO | 21541 |
|---|---|
| Nosy | @gpshead, @ronaldoussoren, @tiran, @ned-deily, @bitdancer, @mmaker, @berkerpeksag |
| Superseder | |
| Files |
Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.
Show more details
GitHub fields:
assignee = 'https://github.com/tiran'
closed_at = <Date 2018-02-25.20:18:40.554>
created_at = <Date 2014-05-20.13:46:54.123>
labels = ['expert-SSL', 'type-feature', 'build']
title = 'Provide configure option --with-ssl for compilation with custom openssl'
updated_at = <Date 2018-02-25.20:18:40.552>
user = 'https://bugs.python.org/machyniak'bugs.python.org fields:
activity = <Date 2018-02-25.20:18:40.552>
actor = 'christian.heimes'
assignee = 'christian.heimes'
closed = True
closed_date = <Date 2018-02-25.20:18:40.554>
closer = 'christian.heimes'
components = ['Build', 'SSL']
creation = <Date 2014-05-20.13:46:54.123>
creator = 'machyniak'
dependencies = []
files = ['35304']
hgrepos = []
issue_num = 21541
keywords = ['patch']
message_count = 8.0
messages = ['218844', '218845', '218846', '219385', '219441', '273899', '275250', '312851']
nosy_count = 8.0
nosy_names = ['gregory.p.smith', 'ronaldoussoren', 'christian.heimes', 'ned.deily', 'r.david.murray', 'maker', 'berker.peksag', 'machyniak']
pr_nums = []
priority = 'normal'
resolution = 'duplicate'
stage = 'resolved'
status = 'closed'
superseder = '32598'
type = 'enhancement'
url = 'https://bugs.python.org/issue21541'
versions = ['Python 3.6']
Activity
machyniak commentedon May 20, 2014
There is no easy way to build python with custom openssl build. This can lead to miscellaneous problems (like segmentation faults) in various situations/configurations (see eg. http://stackoverflow.com/questions/22409092/coredump-when-compiling-python-with-a-custom-openssl-version). The problems usually arise when different version of openssl headers and libs are used, or when different versions of openssl is required within one process (eg. using python within apache httpd process (mod_wsgi or mod_python) + some other module that uses explicitly updated/newer/incompatible version of openssl).
The best way to workaround this problem would be to have the clear way how to build python with specific openssl version. The best way would by to use configure options --with-ssl=PATH optionally with --with-ssl-includes=PATH and --with-ssl-libs=PATH. In this case, setup.py shall not search for openssl but shall use the explicitly specified one.
I will shortly provide the patch for the current version of configure and setup.py.
See related issues:
bitdancer commentedon May 20, 2014
Aren't things like this normally accomplished by editing Modules/Setup? Granted, that's not the most convenient build API...
machyniak commentedon May 20, 2014
This is the proposed patch (compared 2 trees src & upd where src is latest release 3.4.1, upd is my working). Changes are in: configure, setup.py. Please review it and hopefully integrate to future releases.
ronaldoussoren commentedon May 30, 2014
Isn't Modules/Setup used for builtin modules?
The proposed configure flags are easier to find because similar flags are used by other projects using autoconf.
Note that on OSX you could use "CFLAGS=-I/path/to/ssl/include LDFLAGS=-L/path/to/ssl/lib", because setup.py contains code to add directories from those flags to its search path for headers and libraries, but only for OSX because I was overly cautious when adding that code.
ned-deily commentedon May 31, 2014
"Isn't Modules/Setup used for builtin modules?"
One of the better kept secrets of Python is that Modules/Setup can be used for building shared modules as well. I didn't know that until looking into it recently as a result of RDM's comment. See bpo-17095.
gpshead commentedon Aug 30, 2016
We use Modules/Setup.local to build the _ssl and _hashlib modules against our an SSL library of our choosing at work using a Setup entry like this:
_ssl _ssl.c $(PY_CORE_CFLAGS) -DUSE_SSL -I%{SSL_ROOT}/include \
-Wl,--version-script,_ssl.lds \
-Wl,-Bsymbolic \
%{SSL_ROOT}/libssl.a %{SSL_ROOT}/libcrypto.a
%{SSL_ROOT} is replaced prior to building using sed to drop in the path to our desired libssl build.
_ssl.lds is a linker script to hide all but the module init function as we are linking statically.
MODULE__ssl {
global: PyInit__ssl;
local: *;
};
(all that said, I still see how a configure flag would be nicer for many people even though the existing patch does not look like it would work for our own static linking needs - one reason we do that being to avoid dynamic versioning issues)
gpshead commentedon Sep 9, 2016
machyniak: Your patch appears to be missing the diff to configure.ac.
tiran commentedon Feb 25, 2018
Python 3.7+ uses https://www.gnu.org/software/autoconf-archive/ax_check_openssl.html to detect OpenSSL. It provides --with-openssl=DIR or can utilize pkg-config.
I'm closing this feature issue as duplicate of bpo-32598.