Opened 3 years ago

Closed 3 years ago

#64115 closed defect (fixed)

mysql8-8.0.27 won't build due to missing {{FIPS_}} function definitions

Reported by: posita (Matt Bogosian) Owned by: herbygillot (Herby Gillot)
Priority: Normal Milestone:
Component: ports Version: 2.7.1
Keywords: Cc: chrstphrchvz (Christopher Chavez)
Port: mysql8

Description

From main.log:

:info:build /opt/local/macports-20211130/var/macports/build/_opt_local_macports-20211130_var_macports_sources_rsync.macports.org_macports_release_tarballs_ports_databases_mysql8/mysql8/work/mysql-8.0.27/vio/viosslfactories.cc:500:19: error: use of undeclared identifier 'FIPS_mode'
:info:build   fips_mode_old = FIPS_mode();
:info:build                   ^
:info:build /opt/local/macports-20211130/var/macports/build/_opt_local_macports-20211130_var_macports_sources_rsync.macports.org_macports_release_tarballs_ports_databases_mysql8/mysql8/work/mysql-8.0.27/vio/viosslfactories.cc:505:14: error: use of undeclared identifier 'FIPS_mode_set'
:info:build   if (!(rc = FIPS_mode_set(fips_mode))) {
:info:build              ^
:info:build /opt/local/macports-20211130/var/macports/build/_opt_local_macports-20211130_var_macports_sources_rsync.macports.org_macports_release_tarballs_ports_databases_mysql8/mysql8/work/mysql-8.0.27/vio/viosslfactories.cc:513:5: error: use of undeclared identifier 'FIPS_mode_set'
:info:build     FIPS_mode_set(fips_mode_old);
:info:build     ^
:info:build /opt/local/macports-20211130/var/macports/build/_opt_local_macports-20211130_var_macports_sources_rsync.macports.org_macports_release_tarballs_ports_databases_mysql8/mysql8/work/mysql-8.0.27/vio/viosslfactories.cc:527:31: error: use of undeclared identifier 'FIPS_mode'
:info:build uint get_fips_mode() { return FIPS_mode(); }
:info:build                               ^
:info:build /opt/local/macports-20211130/var/macports/build/_opt_local_macports-20211130_var_macports_sources_rsync.macports.org_macports_release_tarballs_ports_databases_mysql8/mysql8/work/mysql-8.0.27/vio/viosslfactories.cc:535:27: error: use of un
declared identifier 'FIPS_mode'
:info:build   int ret = FIPS_mode_set(FIPS_mode() == 0 ? 1 : 0);
:info:build                           ^

I'm not sure I quite understand what's missing here:

% ag 'int +FIPS_mode' /opt/local/macports-20211130
/opt/local/macports-20211130/libexec/openssl11/include/openssl/crypto.h
331:int FIPS_mode(void);
332:int FIPS_mode_set(int r);
ERR: Skipping /opt/local/macports-20211130/libexec/dbus-daemon-launch-helper: Error opening file: Permission denied

/opt/local/macports-20211130/var/macports/sources/rsync.macports.org/macports/release/tarballs/ports/lang/pypy/files/pypy37-openssl3.diff
578:-int FIPS_mode_set(int);
579:-int FIPS_mode(void);

/opt/local/macports-20211130/lib/pypy/lib_pypy/_cffi_ssl/_cffi_src/openssl/fips.py
16:int FIPS_mode_set(int);
17:int FIPS_mode(void);

/opt/local/macports-20211130/lib/pypy3.8/_cffi_ssl/_cffi_src/openssl/fips.py
16:int FIPS_mode_set(int);
17:int FIPS_mode(void);
% find /opt/local/macports-20211130 -name crypto.h
/opt/local/macports-20211130/libexec/openssl11/include/openssl/crypto.h
/opt/local/macports-20211130/libexec/openssl3/include/openssl/crypto.h
/opt/local/macports-20211130/include/gnutls/crypto.h

Is it picking up crypto.h from openssl3, I wonder?

Change History (13)

comment:1 Changed 3 years ago by jmroot (Joshua Root)

Milestone: MacPorts Future
Owner: set to herbygillot
Status: newassigned

comment:2 Changed 3 years ago by posita (Matt Bogosian)

This is interesting. mysql8 doesn't look like it requires openssl3, but behaves like it does:

% port info mysql8
mysql8 @8.0.27_4 (databases)
…
Build Dependencies:   cmake, pkgconfig
Library Dependencies: cyrus-sasl2, icu, libedit, libevent, zlib, zstd, openssl11
Runtime Dependencies: mysql_select
…
% sudo port uninstall openssl3
Note: It is not recommended to uninstall/deactivate a port that has dependents as it breaks the dependents.
The following ports will break:
 openssl @3_1
 cargo-c @0.9.5_0
 pypy37 @7.3.7_2
 xar @1.8.0.452_2
Continue? [y/N]: y
Warning: Uninstall forced.  Proceeding despite dependencies.
--->  Deactivating openssl3 @3.0.0_6+legacy
--->  Cleaning openssl3
--->  Uninstalling openssl3 @3.0.0_6+legacy
--->  Cleaning openssl3
% sudo port build mysql8
--->  Computing dependencies for openssl3
--->  Fetching distfiles for openssl3
--->  Verifying checksums for openssl3
--->  Extracting openssl3
--->  Applying patches to openssl3
--->  Configuring openssl3
--->  Building openssl3
--->  Staging openssl3 into destroot
--->  Installing openssl3 @3.0.0_6+legacy
--->  Activating openssl3 @3.0.0_6+legacy
--->  Cleaning openssl3
--->  Computing dependencies for mysql8
--->  Building mysql8
Error: Failed to build mysql8: command execution failed
Error: See /opt/local/macports-20211130/var/macports/logs/_opt_local_macports-20211130_var_macports_sources_rsync.macports.org_macports_release_tarballs_ports_databases_mysql8/mysql8/main.log for details.
Error: Follow https://guide.macports.org/#project.tickets if you believe there is a bug.
Error: Processing of port mysql8 failed

comment:3 Changed 3 years ago by posita (Matt Bogosian)

Okay, I see how openssl3 is swept in:

port rdependents openssl3 shows these dependencies of mysql8:

  • openssl
    • curl
      • cmake
    • cyrus-sasl2
    • libevent
Last edited 3 years ago by posita (Matt Bogosian) (previous) (diff)

comment:4 Changed 3 years ago by chrstphrchvz (Christopher Chavez)

Cc: chrstphrchvz added

comment:5 Changed 3 years ago by chrstphrchvz (Christopher Chavez)

MySQL 8 does not support OpenSSL 3, so the port requests OpenSSL 1.1. mysql8 correctly detects the include path for OpenSSL 1.1 during configure, but the path is not specified with higher precedence than ${prefix}/include to the compiler, causing the build to error when OpenSSL 3 headers are picked up from ${prefix}/include/openssl.

I wonder if other MySQL versions affected by this.

Last edited 3 years ago by chrstphrchvz (Christopher Chavez) (previous) (diff)

comment:6 Changed 3 years ago by chrstphrchvz (Christopher Chavez)

The C_INCLUDES and CXX_INCLUDES variables in ${workpath}/build/…/flags.make files generated by CMake are where ${prefix}/include appears before ${prefix}/libexec/openssl11/include, but I don’t know how their order is determined. (These paths are included again in C_FLAGS/CXX_FLAGS variables, but with ${prefix}/libexec/openssl11/include before ${prefix}/include.) There are other external dependencies (libevent, icu) whose includes are in ${prefix}/include; maybe this is a factor.

comment:7 Changed 3 years ago by kencu (Ken)

cmake gives you some ability to manipulate the order of includes.

<https://cmake.org/cmake/help/latest/command/include_directories.html>

finding a way to make the needed openssl includes come before the other includes is likely possible.

for example:

include_directories(BEFORE PATH_TO_NEEDED_OPENSSL11_INCLUDES)

Otherwise you have to tack the include directory onto the compiler spec, use a compiler wrapper, or some such to force it, which is messier.

comment:8 in reply to:  7 Changed 3 years ago by chrstphrchvz (Christopher Chavez)

Replying to kencu:

cmake gives you some ability to manipulate the order of includes.

<https://cmake.org/cmake/help/latest/command/include_directories.html>

finding a way to make the needed openssl includes come before the other includes is likely possible.

for example:

include_directories(BEFORE PATH_TO_NEEDED_OPENSSL11_INCLUDES)

I had tried this with the following patch:

  • cmake/ssl.cmake

    diff --git a/cmake/ssl.cmake b/cmake/ssl.cmake
    index 293281cf1..6655f5b3b 100644
    a b MACRO (MYSQL_CHECK_SSL) 
    313313        SET(SSL_LIBRARIES ${SSL_LIBRARIES} ${LIBDL})
    314314      ENDIF()
    315315      MESSAGE(STATUS "SSL_LIBRARIES = ${SSL_LIBRARIES}")
    316       INCLUDE_DIRECTORIES(SYSTEM ${OPENSSL_INCLUDE_DIR})
     316      INCLUDE_DIRECTORIES(BEFORE SYSTEM ${OPENSSL_INCLUDE_DIR})
    317317    ELSE()
    318318      RESET_SSL_VARIABLES()
    319319      FATAL_SSL_NOT_FOUND_ERROR(

This made no difference to the C_INCLUDES/CXX_INCLUDES variables in flags.make files.

comment:9 Changed 3 years ago by chrstphrchvz (Christopher Chavez)

I wonder if I should ask, why must the openssl wrapper port install headers to ${prefix}/include? Would users find it disruptive not to? Is it significantly more work to get ports needing OpenSSL 3 to use ${prefix}/libexec/openssl3/include than to get ports needing OpenSSL 1.1 to use ${prefix}/libexec/openssl11/include while also ignoring OpenSSL 3 headers in ${prefix}/include?

comment:10 Changed 3 years ago by kencu (Ken)

Instead of

INCLUDE_DIRECTORIES(BEFORE SYSTEM ${OPENSSL_INCLUDE_DIR})

did you try

INCLUDE_DIRECTORIES(BEFORE ${OPENSSL_INCLUDE_DIR})

?

As you know, SYSTEM includes always come after user includes.

Last edited 3 years ago by kencu (Ken) (previous) (diff)

comment:11 Changed 3 years ago by kencu (Ken)

For a few of these, I tagged the openssl 1.1 include directory right onto the compiler spec to make 1000% sure it came first.

comment:12 Changed 3 years ago by chrstphrchvz (Christopher Chavez)

I find that Ken’s suggestion in comment:10 puts -I${prefix}/libexec/openssl11/include at the very beginning of the C_INCLUDES and CXX_INCLUDES variables, and prevents OpenSSL 3 header usage. PR opened: https://github.com/macports/macports-ports/pull/13545

Replying to chrstphrchvz:

I wonder if other MySQL versions affected by this.

mysql56/mysql57 do not appear to be affected by this issue (-I${prefix}/libexec/openssl11/include is specified before -isystem${prefix}/include). percona is likely affected, though.

Last edited 3 years ago by chrstphrchvz (Christopher Chavez) (previous) (diff)

comment:13 Changed 3 years ago by chrstphrchvz (Christopher Chavez)

Resolution: fixed
Status: assignedclosed

In ecc4e7af78ef33f6a8e88d800b822cabc7d4d478/macports-ports (master):

mysql8: avoid using OpenSSL 3 headers

Fixes: #64115

Note: See TracTickets for help on using tickets.