Content-Type: text/plain;
	charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3731.200.110.1.12\))
Subject: Re: Libpq linked statically linked to OpenSSL/LibreSSL
From: Marco Bambini <marco@creolabs.com>
In-Reply-To: <20221206180100.yoluppdnsaivckwi@awork3.anarazel.de>
Date: Thu, 8 Dec 2022 07:07:17 +0100
Cc: =?utf-8?Q?ALBERTO_CABELLO_S=C3=81NCHEZ?= <alberto@unex.es>,
 "pgsql-interfaces@lists.postgresql.org"
 <pgsql-interfaces@lists.postgresql.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <098794B3-0300-4374-BCF1-5D2134CD3F6A@creolabs.com>
References: <CD503DB4-0B66-42FB-9E57-1DF6CEDA4D67@creolabs.com>
 <PA4PR05MB8969E8C20AC8EC343149E0F8A7189@PA4PR05MB8969.eurprd05.prod.outlook.com>
 <PA4PR05MB896952E77CAFA3AD5CB188EBA7189@PA4PR05MB8969.eurprd05.prod.outlook.com>
 <7B10A8B6-04E3-49F3-AB0D-413E8B0AC365@creolabs.com>
 <10650109-6ECE-4F7D-9014-2785AA2D413B@creolabs.com>
 <20221206180100.yoluppdnsaivckwi@awork3.anarazel.de>
To: Andres Freund <andres@anarazel.de>
Archived-At: 
 <https://www.postgresql.org/message-id/098794B3-0300-4374-BCF1-5D2134CD3F6A%40creolabs.com>
Precedence: bulk

Hi all,

I tried to follow the advices from Andreas but without any luck.
I added the  --with-includes=3D, --with-libraries=3D arguments to the =
configure command (with path to my static LibreSSL libraries) and I also =
modified the Makefile.global with:
-Wl,-Bstatic -lssl -lcrypto -Wl,-Bdynamic

The resulting libpq.so is bigger (in size) than the previous one but it =
continues to try to dynamically load the SSL functions.
# nm -D libpq.so

the output looks like:

000000000001f110 T appendBinaryPQExpBuffer
000000000001f000 T appendPQExpBuffer
000000000001f0d0 T appendPQExpBufferChar
000000000001f150 T appendPQExpBufferStr
                U ASN1_STRING_data
                U ASN1_STRING_length
                U BIO_clear_flags
                U BIO_int_ctrl
                U BIO_new
                U BIO_set_flags
                U BIO_s_socket
                U calloc
                U close
                U connect
000000000001ecd0 T createPQExpBuffer
                U CRYPTO_get_id_callback
                U CRYPTO_get_locking_callback
                U CRYPTO_num_locks
                U CRYPTO_set_id_callback
                U CRYPTO_set_locking_callback
                U __ctype_b_loc
                U __ctype_tolower_loc
                U __ctype_toupper_loc
                w __cxa_finalize
000000000001ed30 T destroyPQExpBuffer
                U ENGINE_by_id
                U ENGINE_finish
                U ENGINE_free
                U ENGINE_init
                U ENGINE_load_private_key
000000000001ed90 T enlargePQExpBuffer
                U ERR_clear_error
                U ERR_get_error
                U __errno_location
                U ERR_put_error
                U ERR_reason_error_string
                U EVP_DigestFinal_ex
                U EVP_DigestInit_ex


I really don't know why it is so difficult to have the SSL libraries =
statically linked to libpq.
Any help would be greatly appreciated.

Thanks,
Marco


> On 6 Dec 2022, at 19:01, Andres Freund <andres@anarazel.de> wrote:
>=20
> Hi,
>=20
> On 2022-12-06 11:05:49 +0100, Marco Bambini wrote:
>> I made some progresses, especially in understanding where the issue =
can be.
>>=20
>> I started with a fresh postgresql-15.1 source code installation:
>> # ./configure --with-openssl --without-readline
>>=20
>> I then modified the Makefile.global in the src directory by replacing =
the occurrences of -lssl and -lcrypto with:
>> /root/rothsoft/libressl-3.6.1/ssl/.libs/libssl.a =
/root/rothsoft/libressl-3.6.1/crypto/.libs/libcrypto.a
>> in the LIBS entry.
>=20
> I think this is completely the wrong path. You should add libressl's =
include
> and library directories to --with-includes=3D, --with-libraries=3D.
>=20
>=20
>> Please notice all the U entries in the crypto/ssl functions, so it =
looks like that they are NOT statically linked inside the libpq.so =
shared library, even if I replaced the LIBS in the Makefile.
>=20
> If there's also a shared version of libressl, you possibly would need =
to
> specify that you'd want to link statically. Something like
> -Wl,-Bstatic -lssl -lcrypto -Wl,-Bdynamic
>=20
> But I suspect that you're better of linking dynamically, specifying
> --with-includes=3D --with-libraries=3D should provide a path towards =
that. It's
> possible that you should add -Wl,-rpath,/path/to/libressl/lib to the =
LDFLAGS,
> so that the dynamic version can be found at runtime.
>=20
> Greetings,
>=20
> Andres Freund