Bug 614460 – =app-arch/libarchive-3.3.1: undefined reference to `HMAC_CTX_new' (libressl)

• Product: Gentoo Linux
• Status: RESOLVED TEST-REQUEST

[Description hexum 2017-04-01 22:37:57 UTC]

Can't build libarchive.
Very similar to 594998.
I believe it's issue with libressl.

[Comment 1 hexum 2017-04-01 22:38:56 UTC]

Created attachment 468908 [details]
build.log.gz

[Comment 2 hexum 2017-04-01 22:39:26 UTC]

Created attachment 468910 [details]
emerge --info

[Comment 3 hexum 2017-04-01 22:41:25 UTC]

Created attachment 468912 [details]
build.log.gz

[Comment 4 hexum 2017-04-01 22:47:30 UTC]

Looks like we should report it to upstream and provide some patch like this one
https://github.com/libssh2/libssh2/pull/81/files

[Comment 5 hexum 2017-04-01 23:00:36 UTC]

Found appropriate patch
http://lists.infradead.org/pipermail/lede-commits/2016-December/001623.html

[Comment 6 hexum 2017-04-01 23:06:55 UTC]

After patch applying I get a similar error. But it provides an idea.

[Comment 7 hexum 2017-04-01 23:11:02 UTC]

One more patch
http://lists.infradead.org/pipermail/lede-commits/2017-January/002038.html

[Comment 8 hexum 2017-04-01 23:26:00 UTC]

Most useful link.
https://git.lede-project.org/?p=source.git;a=commitdiff;h=8160beb014baf55cd917cec50c416b69519c6a4d

[Comment 9 hexum 2017-04-01 23:30:53 UTC]

This is just exactly we need.
https://git.lede-project.org/?p=source.git;a=blob_plain;f=tools/cmake/patches/130-libarchive-fix-libressl-compat.patch;h=a56ac2ed0c96dd90707e582e83320fd408f90dab;hb=8160beb014baf55cd917cec50c416b69519c6a4d

[Comment 10 hexum 2017-04-01 23:33:25 UTC]

Created attachment 468916 [details]
libarchive-3.3.1-r1.ebuild

[Comment 11 hexum 2017-04-01 23:35:35 UTC]

Created attachment 468918 [details, diff]
130-libarchive-fix-libressl-compat.patch

[Comment 12 hexum 2017-04-01 23:35:54 UTC]

Managed to build with 130-libarchive-fix-libressl-compat.patch

[Comment 13 Toralf Förster 2017-06-07 20:31:14 UTC]

(In reply to hexum from comment #12)
Here I had to shrink the path prefix "Utilities/cmlibarchive" b/c epatch() doesn't try -p3 (any longer) - otherwise it works at a stable hardened libressl'ed server

[Comment 14 James L. Hammons 2017-06-10 13:49:46 UTC]

Can confirm that the attached ebuild and patch work as advertised (64-bit multilib).

[Comment 15 idnc_sk 2017-06-12 18:55:28 UTC]

https://www.linux-ipv6.be/130-libarchive-fix-libressl-compat.patch
works for me(libressl build > http://packages.vpslab.org/amd64.glibc/intel.nehalem/conf/)

[Comment 16 Patrick McLean 2017-06-29 23:41:30 UTC]

Fixed

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e2cfff62965a2d82ceb0e34eaf1d5cb65548af3c

[Comment 17 Michał Górny 2017-06-30 06:19:48 UTC]

Where is the upstream submission for this patch?

[Comment 18 kfm 2017-06-30 13:00:10 UTC]

(In reply to Michał Górny from comment #17)
> Where is the upstream submission for this patch?

https://github.com/libarchive/libarchive/pull/902

It's missing the alteration to archive_openssl_evp_private.h, however.

[Comment 19 Michał Górny 2017-06-30 15:32:09 UTC]

...which only proves that the patch would be merged promptly if anyone bothered submitting it rather than patching it locally throughout half a dozen random distributions and sending the patches everywhere except where they should go.

[Comment 20 hexum 2017-06-30 16:41:40 UTC]

I've got this patch on the internet. And do not sure it doesn't bring up new problems. I'm not the author of it. So, I've brought it here for staging and review.
And from my point of view, this patch is a workaround, not the right solution.
The right solution is to make libressl a drop-in replacement for libressl.
And even more better solution - to invent universal extendable crypto lib API, describe it in RFC and force applications to use dlopen instead compile time linking. It's the way PKCS11 libs work. You can change PKCS11 lib is being used be ssh by changing it's config.

[Comment 21 Michał Górny 2018-01-02 13:24:41 UTC]

Please test with 3.3.2 and reopen if there are any problems left.