Minimal build support when using LibreSSL

[collinfunk]

Bug report

Bug description:

On systems using LibreSSL, using OpenBSD 7.6 in this example, you see the following:

$ ./configure
$ gmake
[...]
cc -pthread  -fno-strict-overflow -Wsign-compare -Wunreachable-code -DNDEBUG -g -O3 -Wall    -std=c11 -Wextra -Wno-unused-parameter -Wno-missing-field-initializers -Wstrict-prototypes -Werror=implicit-function-declaration -fvisibility=hidden  -I./Include/internal -I./Include/internal/mimalloc  -I. -I./Include    -fPIC -c ./Modules/_ssl.c -o Modules/_ssl.o
./Modules/_ssl.c:4800:18: error: call to undeclared function 'X509_OBJECT_set1_X509'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration]
            ok = X509_OBJECT_set1_X509(ret, X509_OBJECT_get0_X509(obj));
                 ^
./Modules/_ssl.c:4800:18: note: did you mean 'X509_OBJECT_get0_X509'?
/usr/include/openssl/x509_vfy.h:285:7: note: 'X509_OBJECT_get0_X509' declared here
X509 *X509_OBJECT_get0_X509(const X509_OBJECT *xo);
      ^
./Modules/_ssl.c:4804:18: error: call to undeclared function 'X509_OBJECT_set1_X509_CRL'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration]
            ok = X509_OBJECT_set1_X509_CRL(
                 ^
./Modules/_ssl.c:4804:18: note: did you mean 'X509_OBJECT_get0_X509_CRL'?
/usr/include/openssl/x509_vfy.h:286:11: note: 'X509_OBJECT_get0_X509_CRL' declared here
X509_CRL *X509_OBJECT_get0_X509_CRL(X509_OBJECT *xo);
          ^
./Modules/_ssl.c:4821:1: error: static declaration of 'X509_STORE_get1_objects' follows non-static declaration
X509_STORE_get1_objects(X509_STORE *store)
^
/usr/include/openssl/x509_vfy.h:296:24: note: previous declaration is here
STACK_OF(X509_OBJECT) *X509_STORE_get1_objects(X509_STORE *xs);
                       ^
./Modules/_ssl.c:4824:10: error: call to undeclared function 'X509_STORE_lock'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration]
    if (!X509_STORE_lock(store)) {
         ^
./Modules/_ssl.c:4827:11: error: call to undeclared function 'sk_X509_OBJECT_deep_copy'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration]
    ret = sk_X509_OBJECT_deep_copy(X509_STORE_get0_objects(store),
          ^
./Modules/_ssl.c:4827:9: warning: incompatible integer to pointer conversion assigning to 'struct stack_st_X509_OBJECT *' from 'int' [-Wint-conversion]
    ret = sk_X509_OBJECT_deep_copy(X509_STORE_get0_objects(store),
        ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
./Modules/_ssl.c:4829:5: error: call to undeclared function 'X509_STORE_unlock'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration]
    X509_STORE_unlock(store);
    ^
1 warning and 6 errors generated.
gmake: *** [Makefile:3505: Modules/_ssl.o] Error 1

CPython versions tested on:

CPython main branch

Operating systems tested on:

Other

Linked PRs

• gh-131127: Minimal build support on systems using LibreSSL #131128
• [3.13] gh-131127: Minimal build support on systems using LibreSSL (GH-131128) #132392

[skirpichev]

In build requirements we have OpenSSL 1.1.1:
https://docs.python.org/3/using/configure.html#build-requirements
See also PEP 644.

This definitely not a bug.

[picnixz]

The patch seems simple but I'm afraid that we would need to have someone that is knowledgable about this to be able to maintain the "build" support. I have no idea whether this is the only place to change, and/or if there are other discrepencies.

Also, if LibreSSL diverges from OpenSSL at some point, we may have a buildable Python but maybe not a working one. Is LibreSSL used a lot?

[collinfunk]

Also, if LibreSSL diverges from OpenSSL at some point, we may have a buildable Python but maybe not a working one. Is LibreSSL used a lot?

Good point. Maybe it is best to leave it broken and allow downstream maintainers make changes to ensure it works.

AFAIK it is default on OpenBSD and DragonflyBSD. Some other systems make it usable optionally with a package.

[picnixz]

Good point. Maybe it is best to leave it broken and allow downstream maintainers make changes to ensure it works.

In general, it's better because they know what to patch while we do not necessarily.

AFAIK it is default on OpenBSD

@vstinner as the BSD expert, does OpenBSD fall under a supported OS?

[vstinner]

I don't have OpenBSD anymore. Maybe @serhiy-storchaka has an opinion about this change.