Everything

php

configure bug with static openssl 1.1.1?

php.internals

Helmut Tessarek

7 years ago

Please don't bite my head off for posting to the internals list, but I
think it is a bug in configure. If it is not, I'm more than happy to
post it in the users group.

I run into an error when trying to configure PHP 7.2.13 with a static
openssl 1.1.1. The strange thing however is that using a static openssl
1.0.2 works.

The error is as follows:

checking for OpenSSL version... >= 1.0.1
checking for CRYPTO_free in -lcrypto... yes
checking for SSL_CTX_set_ssl_version in -lssl... no
configure: error: libssl not found!

I've also tried to set:
export PKG_CONFIG_PATH=/usr/local/ssl-1.1.1/lib/pkgconfig/

But it did not help.

Here's my config.log: https://evermeet.cx/pub/logs/config.log

(I've compiled Apache httpd successfully against this static openssl
1.1.1 version, so I know that it works.)

Has someone seen this issue before? Any ideas why this is happening?

Cheers,
K. C.

--
regards Helmut K. C. Tessarek              KeyID 0x172380A011EF4944
Key fingerprint = 8A55 70C1 BD85 D34E ADBC 386C 1723 80A0 11EF 4944

/*
Thou shalt not follow the NULL pointer for chaos and madness
await thee at its end.
*/

Helmut Tessarek

7 years ago

On 2018-12-08 22:43, Helmut K. C. Tessarek wrote:

> Please don't bite my head off for posting to the internals list, but I
> think it is a bug in configure. If it is not, I'm more than happy to
> post it in the users group.
>
> I run into an error when trying to configure PHP 7.2.13 with a static
> openssl 1.1.1. The strange thing however is that using a static openssl
> 1.0.2 works.
>
> The error is as follows:
>
> checking for OpenSSL version... >= 1.0.1
> checking for CRYPTO_free in -lcrypto... yes
> checking for SSL_CTX_set_ssl_version in -lssl... no
> configure: error: libssl not found!
>
> I've also tried to set:
> export PKG_CONFIG_PATH=/usr/local/ssl-1.1.1/lib/pkgconfig/
>
> But it did not help.
>
> Here's my config.log: https://evermeet.cx/pub/logs/config.log
>
> (I've compiled Apache httpd successfully against this static openssl
> 1.1.1 version, so I know that it works.)
>
> Has someone seen this issue before? Any ideas why this is happening?
>
> Cheers,
>   K. C.
>

It seems that nobody thinks this belongs in this group.

Can anyone tell me where I should post this question to?
To the General user list, or the Installation issues and problems list?

Cheers,
K. C.

Jakub Zelenka

7 years ago

On Wed, Dec 12, 2018 at 2:58 PM Helmut K. C. Tessarek <tessarek@evermeet.cx>
wrote:

> On 2018-12-08 22:43, Helmut K. C. Tessarek wrote:
> > Please don't bite my head off for posting to the internals list, but I
> > think it is a bug in configure. If it is not, I'm more than happy to
> > post it in the users group.
> >
> > I run into an error when trying to configure PHP 7.2.13 with a static
> > openssl 1.1.1. The strange thing however is that using a static openssl
> > 1.0.2 works.
> >
> > The error is as follows:
> >
> > checking for OpenSSL version... >= 1.0.1
> > checking for CRYPTO_free in -lcrypto... yes
> > checking for SSL_CTX_set_ssl_version in -lssl... no
> > configure: error: libssl not found!
> >
> > I've also tried to set:
> > export PKG_CONFIG_PATH=/usr/local/ssl-1.1.1/lib/pkgconfig/
> >
> > But it did not help.
> >
> > Here's my config.log: https://evermeet.cx/pub/logs/config.log
> >
> > (I've compiled Apache httpd successfully against this static openssl
> > 1.1.1 version, so I know that it works.)
> >
> > Has someone seen this issue before? Any ideas why this is happening?
> >
> > Cheers,
> >   K. C.
> >
>
> It seems that nobody thinks this belongs in this group.
>
> Can anyone tell me where I should post this question to?
> To the General user list, or the Installation issues and problems list?
>

You should create a bug report.

Please note that a static configuration has some issues (e.g.
https://bugs.php.net/bug.php?id=73609 and think there were more issues
maybe). Basically it's not well supported so I would recommend to do a
shared build instead otherwise you are probably on your own unless someone
finds time to look into it.

Cheers

Jakub

Helmut Tessarek

7 years ago

On 2018-12-12 16:11, Jakub Zelenka wrote:

>
> You should create a bug report.
>
> Please note that a static configuration has some issues (e.g.
> https://bugs.php.net/bug.php?id=73609 and think there were more issues
> maybe). Basically it's not well supported so I would recommend to do a
> shared build instead otherwise you are probably on your own unless
> someone finds time to look into it.

Thanks, Jakub for your reply.

Hmm, I checked the link you sent, but this ticket has nothing to do with
linking against a static openssl library.

This ticket mentions that openssl is not supported as a shared
extension. But that is not what I'm doing.

I try to link against a static openssl library. But it works when
linking against a static openssl 1.0.2 lib.
Therefore I highly suspect that there's a problem with configure. But I
will open a ticket, and I will also try to link against a dynamic
openssl 1.1.1.

So linking against a static openssl 1.0.2 works, but against a static
openssl 1.1.1 does not work.

However, linking against a static openssl library should be supported.
Years back people even suggested to always link against a static openssl
lib because of security reasons (no hijacking of dynamic libs and
whatnot). This might not be relevant anymore, but there's no logical
reason why linking against a static openssl 1.1.1 should not work.

Cheers,
K. C.

Jakub Zelenka

7 years ago

On Wed, Dec 12, 2018 at 3:32 PM Helmut K. C. Tessarek <tessarek@evermeet.cx>
wrote:

> On 2018-12-12 16:11, Jakub Zelenka wrote:
> >
> > You should create a bug report.
> >
> > Please note that a static configuration has some issues (e.g.
> > https://bugs.php.net/bug.php?id=73609 and think there were more issues
> > maybe). Basically it's not well supported so I would recommend to do a
> > shared build instead otherwise you are probably on your own unless
> > someone finds time to look into it.
>
> Thanks, Jakub for your reply.
>
> Hmm, I checked the link you sent, but this ticket has nothing to do with
> linking against a static openssl library.
>
> This ticket mentions that openssl is not supported as a shared
> extension. But that is not what I'm doing.
>
> I try to link against a static openssl library. But it works when
> linking against a static openssl 1.0.2 lib.
> Therefore I highly suspect that there's a problem with configure. But I
> will open a ticket, and I will also try to link against a dynamic
> openssl 1.1.1.
>
> So linking against a static openssl 1.0.2 works, but against a static
> openssl 1.1.1 does not work.
>
> However, linking against a static openssl library should be supported.
> Years back people even suggested to always link against a static openssl
> lib because of security reasons (no hijacking of dynamic libs and
> whatnot). This might not be relevant anymore, but there's no logical
> reason why linking against a static openssl 1.1.1 should not work.
>
>

Ah I see! Yeah I think it should work so it might be a bug if it doesn't. I
would suggest to create a bug report.

Cheers

Jakub

Helmut Tessarek

7 years ago

On 2018-12-12 16:37, Jakub Zelenka wrote:

> On Wed, Dec 12, 2018 at 3:32 PM Helmut K. C. Tessarek
> <tessarek@evermeet.cx <mailto:tessarek@evermeet.cx>> wrote:
>
>     On 2018-12-12 16:11, Jakub Zelenka wrote:
>     >
>     > You should create a bug report.
>     >
>     > Please note that a static configuration has some issues (e.g.
>     > https://bugs.php.net/bug.php?id=73609 and think there were more issues
>     > maybe). Basically it's not well supported so I would recommend to do a
>     > shared build instead otherwise you are probably on your own unless
>     > someone finds time to look into it.
>
>     Thanks, Jakub for your reply.
>
>     Hmm, I checked the link you sent, but this ticket has nothing to do with
>     linking against a static openssl library.
>
>     This ticket mentions that openssl is not supported as a shared
>     extension. But that is not what I'm doing.
>
>     I try to link against a static openssl library. But it works when
>     linking against a static openssl 1.0.2 lib.
>     Therefore I highly suspect that there's a problem with configure. But I
>     will open a ticket, and I will also try to link against a dynamic
>     openssl 1.1.1.
>
>     So linking against a static openssl 1.0.2 works, but against a static
>     openssl 1.1.1 does not work.
>
>     However, linking against a static openssl library should be supported.
>     Years back people even suggested to always link against a static openssl
>     lib because of security reasons (no hijacking of dynamic libs and
>     whatnot). This might not be relevant anymore, but there's no logical
>     reason why linking against a static openssl 1.1.1 should not work.
>
>
> Ah I see! Yeah I think it should work so it might be a bug if it
> doesn't. I would suggest to create a bug report.

Will do.

Thanks,
K. C.

Rainer Jung

7 years ago

Am 12.12.2018 um 16:37 schrieb Jakub Zelenka:

> On Wed, Dec 12, 2018 at 3:32 PM Helmut K. C. Tessarek <tessarek@evermeet.cx>
> wrote:
>
>> On 2018-12-12 16:11, Jakub Zelenka wrote:
>>>
>>> You should create a bug report.
>>>
>>> Please note that a static configuration has some issues (e.g.
>>> https://bugs.php.net/bug.php?id=73609 and think there were more issues
>>> maybe). Basically it's not well supported so I would recommend to do a
>>> shared build instead otherwise you are probably on your own unless
>>> someone finds time to look into it.
>>
>> Thanks, Jakub for your reply.
>>
>> Hmm, I checked the link you sent, but this ticket has nothing to do with
>> linking against a static openssl library.
>>
>> This ticket mentions that openssl is not supported as a shared
>> extension. But that is not what I'm doing.
>>
>> I try to link against a static openssl library. But it works when
>> linking against a static openssl 1.0.2 lib.
>> Therefore I highly suspect that there's a problem with configure. But I
>> will open a ticket, and I will also try to link against a dynamic
>> openssl 1.1.1.
>>
>> So linking against a static openssl 1.0.2 works, but against a static
>> openssl 1.1.1 does not work.
>>
>> However, linking against a static openssl library should be supported.
>> Years back people even suggested to always link against a static openssl
>> lib because of security reasons (no hijacking of dynamic libs and
>> whatnot). This might not be relevant anymore, but there's no logical
>> reason why linking against a static openssl 1.1.1 should not work.
>>
>>
> Ah I see! Yeah I think it should work so it might be a bug if it doesn't. I
> would suggest to create a bug report.
>
> Cheers
>
> Jakub

I might be wrong, but I vaguely remember that PHp does not call
"pkg-config --static --libs openssl" with a correctly setup
PKG_CONFIG_PAATZ to get the libs needed for static compilation.
Typically OpenSSL installs correct pc files that contain pthread as such
a dependency. Without asking pkg-config some fixed decisin logic would
need to find all the needed libs.

Regards,

Rainer

Helmut Tessarek

7 years ago

On 2018-12-13 17:52, Rainer Jung wrote:

>
> I might be wrong, but I vaguely remember that PHp does not call
> "pkg-config --static --libs openssl" with a correctly setup
> PKG_CONFIG_PAATZ to get the libs needed for static compilation.
> Typically OpenSSL installs correct pc files that contain pthread as such
> a dependency. Without asking pkg-config some fixed decisin logic would
> need to find all the needed libs.

Thanks for the reply.

I've opened a bug: https://bugs.php.net/bug.php?id=77288

Yep, the following entry is in the .pc file for libcrypto:
Libs.private: -ldl -pthread

Cheers,
K. C.

Helmut Tessarek

7 years ago

Hello,

On 2018-12-13 17:52, Rainer Jung wrote:

> I might be wrong, but I vaguely remember that PHp does not call
> "pkg-config --static --libs openssl" with a correctly setup
> PKG_CONFIG_PAATZ to get the libs needed for static compilation.
> Typically OpenSSL installs correct pc files that contain pthread as such
> a dependency. Without asking pkg-config some fixed decisin logic would
> need to find all the needed libs.

I'd like to follow up on bug https://bugs.php.net/bug.php?id=77288

It's not stated in the documentation anywhere that a static openssl is
not supported.
It's ok, if devs don't have the time to look into it right away, but
I've opened this bug 2 months ago, and it would be nice, if someone
could at least acknowledge the bug and/or give some sort of a feedback.

If PHP does not support static openssl, please change the documentation
accordingly.

However, it's wotking with openssl 1.0.2, so I must assume that there's
a bug somewhere otherwise it would work with openssl 1.1.1 as well.

Cheers,
K. C.

--
regards Helmut K. C. Tessarek              KeyID 0x172380A011EF4944
Key fingerprint = 8A55 70C1 BD85 D34E ADBC 386C 1723 80A0 11EF 4944

/*
Thou shalt not follow the NULL pointer for chaos and madness
await thee at its end.
*/

Jakub Zelenka

7 years ago

On Thu, Feb 7, 2019 at 12:39 PM Helmut K. C. Tessarek <tessarek@evermeet.cx>
wrote:

> Hello,
>
> On 2018-12-13 17:52, Rainer Jung wrote:
> > I might be wrong, but I vaguely remember that PHp does not call
> > "pkg-config --static --libs openssl" with a correctly setup
> > PKG_CONFIG_PAATZ to get the libs needed for static compilation.
> > Typically OpenSSL installs correct pc files that contain pthread as such
> > a dependency. Without asking pkg-config some fixed decisin logic would
> > need to find all the needed libs.
>
> I'd like to follow up on bug https://bugs.php.net/bug.php?id=77288
>
> It's not stated in the documentation anywhere that a static openssl is
> not supported.
> It's ok, if devs don't have the time to look into it right away, but
> I've opened this bug 2 months ago, and it would be nice, if someone
> could at least acknowledge the bug and/or give some sort of a feedback.
>
> If PHP does not support static openssl, please change the documentation
> accordingly.
>
> However, it's wotking with openssl 1.0.2, so I must assume that there's
> a bug somewhere otherwise it would work with openssl 1.1.1 as well.
>
>

Looks like a bug. Just not the highest priority for me atm.

Helmut Tessarek

7 years ago

Thanks for the reply.

On 2019-02-24 10:19, Jakub Zelenka wrote:

> Looks like a bug. Just not the highest priority for me atm.

It would be great, if you could add that info to the bug. e.g. change the
status to verified, change priority to low, severity to high (since you can't
use PHP with a static openssl 1.1.1).

Cheers,
K. C.

--
regards Helmut K. C. Tessarek              KeyID 0x172380A011EF4944
Key fingerprint = 8A55 70C1 BD85 D34E ADBC 386C 1723 80A0 11EF 4944

/*
Thou shalt not follow the NULL pointer for chaos and madness
await thee at its end.
*/

Jan Ehrhardt

6 years ago

"Helmut K. C. Tessarek" in php.internals (Thu, 7 Feb 2019 13:39:11
+0100):

>On 2018-12-13 17:52, Rainer Jung wrote:
>> I might be wrong, but I vaguely remember that PHp does not call
>> "pkg-config --static --libs openssl" with a correctly setup
>> PKG_CONFIG_PAATZ to get the libs needed for static compilation.
>> Typically OpenSSL installs correct pc files that contain pthread as such
>> a dependency. Without asking pkg-config some fixed decisin logic would
>> need to find all the needed libs.
>
>I'd like to follow up on bug https://bugs.php.net/bug.php?id=77288
>
>It's not stated in the documentation anywhere that a static openssl is
>not supported.
>It's ok, if devs don't have the time to look into it right away, but
>I've opened this bug 2 months ago, and it would be nice, if someone
>could at least acknowledge the bug and/or give some sort of a feedback.
>
>If PHP does not support static openssl, please change the documentation
>accordingly.
>
>However, it's wotking with openssl 1.0.2, so I must assume that there's
>a bug somewhere otherwise it would work with openssl 1.1.1 as well.

Did you ever find a solution to compile PHP with a static OpenSSL 1.1.1?

--
Jan

Helmut Tessarek

6 years ago

On 2019-10-13 16:50, Jan Ehrhardt wrote:

> Did you ever find a solution to compile PHP with a static OpenSSL 1.1.1?

Unfortunately not. I really hoped that someone would look into it, but I guess
security is not that important.

--
regards Helmut K. C. Tessarek              KeyID 0x172380A011EF4944
Key fingerprint = 8A55 70C1 BD85 D34E ADBC 386C 1723 80A0 11EF 4944

/*
Thou shalt not follow the NULL pointer for chaos and madness
await thee at its end.
*/

Nikita Popov

6 years ago

On Sun, Oct 13, 2019 at 10:51 PM Jan Ehrhardt <phpdev@ehrhardt.nl> wrote:

> "Helmut K. C. Tessarek" in php.internals (Thu, 7 Feb 2019 13:39:11
> +0100):
> >On 2018-12-13 17:52, Rainer Jung wrote:
> >> I might be wrong, but I vaguely remember that PHp does not call
> >> "pkg-config --static --libs openssl" with a correctly setup
> >> PKG_CONFIG_PAATZ to get the libs needed for static compilation.
> >> Typically OpenSSL installs correct pc files that contain pthread as such
> >> a dependency. Without asking pkg-config some fixed decisin logic would
> >> need to find all the needed libs.
> >
> >I'd like to follow up on bug https://bugs.php.net/bug.php?id=77288
> >
> >It's not stated in the documentation anywhere that a static openssl is
> >not supported.
> >It's ok, if devs don't have the time to look into it right away, but
> >I've opened this bug 2 months ago, and it would be nice, if someone
> >could at least acknowledge the bug and/or give some sort of a feedback.
> >
> >If PHP does not support static openssl, please change the documentation
> >accordingly.
> >
> >However, it's wotking with openssl 1.0.2, so I must assume that there's
> >a bug somewhere otherwise it would work with openssl 1.1.1 as well.
>
> Did you ever find a solution to compile PHP with a static OpenSSL 1.1.1?
> --
> Jan
>

Don't know about previous versions, but at least on 7.4 setting
OPENSSL_CFLAGS and OPENSSL_LIBS appropriately (e.g. using pkg-config
--static --cflags/--libs return values) should work. These environment
variables allow you to bypass normal pkg-config checks, which are generally
going to be non-static.

Nikita

Helmut Tessarek

6 years ago

On 2019-10-13 17:00, Nikita Popov wrote:

> Don't know about previous versions, but at least on 7.4 setting
> OPENSSL_CFLAGS and OPENSSL_LIBS appropriately (e.g. using pkg-config
> --static --cflags/--libs return values) should work. These environment
> variables allow you to bypass normal pkg-config checks, which are generally
> going to be non-static.

I've tried pretty much anything, so if you have flags and env vars that work,
please post them here.

--
regards Helmut K. C. Tessarek              KeyID 0x172380A011EF4944
Key fingerprint = 8A55 70C1 BD85 D34E ADBC 386C 1723 80A0 11EF 4944

/*
Thou shalt not follow the NULL pointer for chaos and madness
await thee at its end.
*/