Jens Geyer created THRIFT-6185:
----------------------------------
Summary: lib/d does not build against OpenSSL 3.x
Key: THRIFT-6185
URL: https://issues.apache.org/jira/browse/THRIFT-6185
Project: Thrift
Issue Type: Bug
Components: D - Library, Build Process
Reporter: Jens Geyer
The OpenSSL-dependent modules in lib/d do not link against OpenSSL 3.x. On
Ubuntu 24.04 (OpenSSL 3.0.13) the first SSL unittest binary fails at link:
{code}
dmd -g -ofunittest/debug/thrift/async/ssl -unittest -w -wi -I../../lib/d/src \
-version=use_openssl_1_0_x -L-fuse-ld=gold -L-levent -L-lssl -L-lcrypto \
src/thrift/async/ssl.d libthriftd-event.a libthriftd-ssl.a libthriftd.a
unittest/emptymain.d
libthriftd-ssl.a(ssl_347_3db.o):src/thrift/internal/ssl.d:
error: undefined reference to 'SSL_get_peer_certificate'
libthriftd-ssl.a(ssl_bio_34b_356.o):src/thrift/internal/ssl_bio.d:
error: undefined reference to 'ERR_put_error'
Error: linker exited with status 1
{code}
Two separate OpenSSL 3.0 changes:
* {{ERR_put_error}} was removed in 3.0. The replacement is {{ERR_new}} plus
{{ERR_set_debug}} and {{ERR_set_error}}, or {{ERR_raise}}.
* {{SSL_get_peer_certificate}} was renamed to {{SSL_get1_peer_certificate}}.
The old name survives only as a compatibility macro in the C header, so it is
not an exported symbol a D binding can reach.
Three things line up behind this:
# lib/d/Makefile.am compiles with {{-version=use_openssl_1_0_x}}
unconditionally, in both {{d_lib_flags}} and {{d_test_flags}}. There is no 1.1
or 3.x variant of that version identifier anywhere in the tree.
# build/docker/ubuntu-*/Dockerfile pin the deimos OpenSSL bindings at
{{v2.0.0+1.1.0h}}, which describe the 1.1.0 API.
# Of the three images, only ubuntu-focal ships an OpenSSL these two symbols
still exist in (1.1.1f). jammy has 3.0.2 and noble has 3.0.13, so {{make -C
lib/d check}} cannot pass in the project's own current images.
Affects five modules: thrift/async/ssl, thrift/internal/ssl,
thrift/internal/ssl_bio, thrift/transport/ssl and thrift/server/transport/ssl.
It is a link-time failure, so it is equally a problem for anyone using the D
binding with TLS on a current distribution, not only for the build.
The CI job added in THRIFT-6170 works around it by not installing the deimos
OpenSSL headers at all: configure then reports "Building D SSL tests ...... :
no" and drops those five modules from both the library and the test set. The
workflow step carries a comment pointing here. Once this is fixed, the headers
should be installed in that job so the SSL modules are covered too.
Compare THRIFT-6168, which was the last lib/d change that had to be verified by
hand.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
