mysql8-8.0.27 won't build due to missing {{FIPS_}} function definitions

[posita (Matt Bogosian)]

From main.log:

:info:build /opt/local/macports-20211130/var/macports/build/_opt_local_macports-20211130_var_macports_sources_rsync.macports.org_macports_release_tarballs_ports_databases_mysql8/mysql8/work/mysql-8.0.27/vio/viosslfactories.cc:500:19: error: use of undeclared identifier 'FIPS_mode'
:info:build   fips_mode_old = FIPS_mode();
:info:build                   ^
:info:build /opt/local/macports-20211130/var/macports/build/_opt_local_macports-20211130_var_macports_sources_rsync.macports.org_macports_release_tarballs_ports_databases_mysql8/mysql8/work/mysql-8.0.27/vio/viosslfactories.cc:505:14: error: use of undeclared identifier 'FIPS_mode_set'
:info:build   if (!(rc = FIPS_mode_set(fips_mode))) {
:info:build              ^
:info:build /opt/local/macports-20211130/var/macports/build/_opt_local_macports-20211130_var_macports_sources_rsync.macports.org_macports_release_tarballs_ports_databases_mysql8/mysql8/work/mysql-8.0.27/vio/viosslfactories.cc:513:5: error: use of undeclared identifier 'FIPS_mode_set'
:info:build     FIPS_mode_set(fips_mode_old);
:info:build     ^
:info:build /opt/local/macports-20211130/var/macports/build/_opt_local_macports-20211130_var_macports_sources_rsync.macports.org_macports_release_tarballs_ports_databases_mysql8/mysql8/work/mysql-8.0.27/vio/viosslfactories.cc:527:31: error: use of undeclared identifier 'FIPS_mode'
:info:build uint get_fips_mode() { return FIPS_mode(); }
:info:build                               ^
:info:build /opt/local/macports-20211130/var/macports/build/_opt_local_macports-20211130_var_macports_sources_rsync.macports.org_macports_release_tarballs_ports_databases_mysql8/mysql8/work/mysql-8.0.27/vio/viosslfactories.cc:535:27: error: use of un
declared identifier 'FIPS_mode'
:info:build   int ret = FIPS_mode_set(FIPS_mode() == 0 ? 1 : 0);
:info:build                           ^

I'm not sure I quite understand what's missing here:

% ag 'int +FIPS_mode' /opt/local/macports-20211130
/opt/local/macports-20211130/libexec/openssl11/include/openssl/crypto.h
331:int FIPS_mode(void);
332:int FIPS_mode_set(int r);
ERR: Skipping /opt/local/macports-20211130/libexec/dbus-daemon-launch-helper: Error opening file: Permission denied

/opt/local/macports-20211130/var/macports/sources/rsync.macports.org/macports/release/tarballs/ports/lang/pypy/files/pypy37-openssl3.diff
578:-int FIPS_mode_set(int);
579:-int FIPS_mode(void);

/opt/local/macports-20211130/lib/pypy/lib_pypy/_cffi_ssl/_cffi_src/openssl/fips.py
16:int FIPS_mode_set(int);
17:int FIPS_mode(void);

/opt/local/macports-20211130/lib/pypy3.8/_cffi_ssl/_cffi_src/openssl/fips.py
16:int FIPS_mode_set(int);
17:int FIPS_mode(void);
% find /opt/local/macports-20211130 -name crypto.h
/opt/local/macports-20211130/libexec/openssl11/include/openssl/crypto.h
/opt/local/macports-20211130/libexec/openssl3/include/openssl/crypto.h
/opt/local/macports-20211130/include/gnutls/crypto.h

Is it picking up crypto.h from openssl3, I wonder?

[posita (Matt Bogosian)]

This is interesting. mysql8 doesn't look like it requires openssl3, but behaves like it does:

% port info mysql8
mysql8 @8.0.27_4 (databases)
…
Build Dependencies:   cmake, pkgconfig
Library Dependencies: cyrus-sasl2, icu, libedit, libevent, zlib, zstd, openssl11
Runtime Dependencies: mysql_select
…
% sudo port uninstall openssl3
Note: It is not recommended to uninstall/deactivate a port that has dependents as it breaks the dependents.
The following ports will break:
 openssl @3_1
 cargo-c @0.9.5_0
 pypy37 @7.3.7_2
 xar @1.8.0.452_2
Continue? [y/N]: y
Warning: Uninstall forced.  Proceeding despite dependencies.
--->  Deactivating openssl3 @3.0.0_6+legacy
--->  Cleaning openssl3
--->  Uninstalling openssl3 @3.0.0_6+legacy
--->  Cleaning openssl3
% sudo port build mysql8
--->  Computing dependencies for openssl3
--->  Fetching distfiles for openssl3
--->  Verifying checksums for openssl3
--->  Extracting openssl3
--->  Applying patches to openssl3
--->  Configuring openssl3
--->  Building openssl3
--->  Staging openssl3 into destroot
--->  Installing openssl3 @3.0.0_6+legacy
--->  Activating openssl3 @3.0.0_6+legacy
--->  Cleaning openssl3
--->  Computing dependencies for mysql8
--->  Building mysql8
Error: Failed to build mysql8: command execution failed
Error: See /opt/local/macports-20211130/var/macports/logs/_opt_local_macports-20211130_var_macports_sources_rsync.macports.org_macports_release_tarballs_ports_databases_mysql8/mysql8/main.log for details.
Error: Follow https://guide.macports.org/#project.tickets if you believe there is a bug.
Error: Processing of port mysql8 failed

[posita (Matt Bogosian)]

Okay, I see how openssl3 is swept in:

port rdependents openssl3 shows these dependencies of mysql8:

• openssl
  • curl
    • cmake
  • cyrus-sasl2
  • libevent

[chrstphrchvz (Christopher Chavez)]

MySQL 8 does not support OpenSSL 3, so the port requests OpenSSL 1.1. mysql8 correctly detects the include path for OpenSSL 1.1 during configure, but the path is not specified with higher precedence than ${prefix}/include to the compiler, causing the build to error when OpenSSL 3 headers are picked up from ${prefix}/include/openssl.

I wonder if other MySQL versions affected by this.

[chrstphrchvz (Christopher Chavez)]

The C_INCLUDES and CXX_INCLUDES variables in ${workpath}/build/…/flags.make files generated by CMake are where ${prefix}/include appears before ${prefix}/libexec/openssl11/include, but I don’t know how their order is determined. (These paths are included again in C_FLAGS/CXX_FLAGS variables, but with ${prefix}/libexec/openssl11/include before ${prefix}/include.) There are other external dependencies (libevent, icu) whose includes are in ${prefix}/include; maybe this is a factor.

[kencu (Ken)]

cmake gives you some ability to manipulate the order of includes.

<​https://cmake.org/cmake/help/latest/command/include_directories.html>

finding a way to make the needed openssl includes come before the other includes is likely possible.

for example:

include_directories(BEFORE PATH_TO_NEEDED_OPENSSL11_INCLUDES)

Otherwise you have to tack the include directory onto the compiler spec, use a compiler wrapper, or some such to force it, which is messier.

[chrstphrchvz (Christopher Chavez)]

Replying to kencu:

cmake gives you some ability to manipulate the order of includes.

<​https://cmake.org/cmake/help/latest/command/include_directories.html>

finding a way to make the needed openssl includes come before the other includes is likely possible.

for example:

include_directories(BEFORE PATH_TO_NEEDED_OPENSSL11_INCLUDES)

I had tried this with the following patch:

cmake/ssl.cmake

@@ -313 +313 @@
         SET(SSL_LIBRARIES ${SSL_LIBRARIES} ${LIBDL})
       ENDIF()
       MESSAGE(STATUS "SSL_LIBRARIES = ${SSL_LIBRARIES}")
-      INCLUDE_DIRECTORIES(SYSTEM ${OPENSSL_INCLUDE_DIR})
+      INCLUDE_DIRECTORIES(BEFORE SYSTEM ${OPENSSL_INCLUDE_DIR})
     ELSE()
       RESET_SSL_VARIABLES()
       FATAL_SSL_NOT_FOUND_ERROR(

This made no difference to the C_INCLUDES/CXX_INCLUDES variables in flags.make files.

[chrstphrchvz (Christopher Chavez)]

I wonder if I should ask, why must the openssl wrapper port install headers to ${prefix}/include? Would users find it disruptive not to? Is it significantly more work to get ports needing OpenSSL 3 to use ${prefix}/libexec/openssl3/include than to get ports needing OpenSSL 1.1 to use ${prefix}/libexec/openssl11/include while also ignoring OpenSSL 3 headers in ${prefix}/include?

[kencu (Ken)]

Instead of

INCLUDE_DIRECTORIES(BEFORE SYSTEM ${OPENSSL_INCLUDE_DIR})

did you try

INCLUDE_DIRECTORIES(BEFORE ${OPENSSL_INCLUDE_DIR})

?

As you know, SYSTEM includes always come after user includes.

[kencu (Ken)]

For a few of these, I tagged the openssl 1.1 include directory right onto the compiler spec to make 1000% sure it came first.

[chrstphrchvz (Christopher Chavez)]

I find that Ken’s suggestion in comment:10 puts -I${prefix}/libexec/openssl11/include at the very beginning of the C_INCLUDES and CXX_INCLUDES variables, and prevents OpenSSL 3 header usage. PR opened: ​https://github.com/macports/macports-ports/pull/13545

Replying to chrstphrchvz:

I wonder if other MySQL versions affected by this.

mysql56/mysql57 do not appear to be affected by this issue (-I${prefix}/libexec/openssl11/include is specified before -isystem${prefix}/include). percona is likely affected, though.

[chrstphrchvz (Christopher Chavez)]

In ecc4e7af78ef33f6a8e88d800b822cabc7d4d478/macports-ports (master):

mysql8: avoid using OpenSSL 3 headers

Fixes: #64115