Skip to content

bpo-43466: Add -Wl,--exclude-libs to ssl #24989

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
tiran wants to merge 2 commits into from
Closed

bpo-43466: Add -Wl,--exclude-libs to ssl #24989

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9aa8cce
bpo-43466: Add -Wl,--exclude-libs to ssl
tiran Mar 23, 2021
62ac4af
s/kw/openssl_extension_kwargs/
tiran Mar 23, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions Makefile.pre.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -203,6 +203,7 @@ OPENSSL_INCLUDES=@OPENSSL_INCLUDES@
OPENSSL_LIBS=@OPENSSL_LIBS@
OPENSSL_LDFLAGS=@OPENSSL_LDFLAGS@
OPENSSL_RPATH=@OPENSSL_RPATH@
PY_LINKER_EXCLUDE_LIBS=@PY_LINKER_EXCLUDE_LIBS@

# Default zoneinfo.TZPATH. Added here to expose it in sysconfig.get_config_var
TZPATH=@TZPATH@
Expand Down
54 changes: 54 additions & 0 deletions aclocal.m4
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,60 @@ AS_VAR_IF(CACHEVAR,yes,
AS_VAR_POPDEF([CACHEVAR])dnl
])dnl AX_CHECK_COMPILE_FLAGS

# ===========================================================================
# https://www.gnu.org/software/autoconf-archive/ax_check_link_flag.html
# ===========================================================================
#
# SYNOPSIS
#
# AX_CHECK_LINK_FLAG(FLAG, [ACTION-SUCCESS], [ACTION-FAILURE], [EXTRA-FLAGS], [INPUT])
#
# DESCRIPTION
#
# Check whether the given FLAG works with the linker or gives an error.
# (Warnings, however, are ignored)
#
# ACTION-SUCCESS/ACTION-FAILURE are shell commands to execute on
# success/failure.
#
# If EXTRA-FLAGS is defined, it is added to the linker's default flags
# when the check is done. The check is thus made with the flags: "LDFLAGS
# EXTRA-FLAGS FLAG". This can for example be used to force the linker to
# issue an error when a bad flag is given.
#
# INPUT gives an alternative input source to AC_LINK_IFELSE.
#
# NOTE: Implementation based on AX_CFLAGS_GCC_OPTION. Please keep this
# macro in sync with AX_CHECK_{PREPROC,COMPILE}_FLAG.
#
# LICENSE
#
# Copyright (c) 2008 Guido U. Draheim <guidod@gmx.de>
# Copyright (c) 2011 Maarten Bosmans <mkbosmans@gmail.com>
#
# Copying and distribution of this file, with or without modification, are
# permitted in any medium without royalty provided the copyright notice
# and this notice are preserved. This file is offered as-is, without any
# warranty.

#serial 6

AC_DEFUN([AX_CHECK_LINK_FLAG],
[AC_PREREQ(2.64)dnl for _AC_LANG_PREFIX and AS_VAR_IF
AS_VAR_PUSHDEF([CACHEVAR],[ax_cv_check_ldflags_$4_$1])dnl
AC_CACHE_CHECK([whether the linker accepts $1], CACHEVAR, [
ax_check_save_flags=$LDFLAGS
LDFLAGS="$LDFLAGS $4 $1"
AC_LINK_IFELSE([m4_default([$5],[AC_LANG_PROGRAM()])],
[AS_VAR_SET(CACHEVAR,[yes])],
[AS_VAR_SET(CACHEVAR,[no])])
LDFLAGS=$ax_check_save_flags])
AS_VAR_IF(CACHEVAR,yes,
[m4_default([$2], :)],
[m4_default([$3], :)])
AS_VAR_POPDEF([CACHEVAR])dnl
])dnl AX_CHECK_LINK_FLAGS

# pkg.m4 - Macros to locate and utilise pkg-config. -*- Autoconf -*-
# serial 11 (pkg-config-0.29.1)

Expand Down
40 changes: 40 additions & 0 deletions configure
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -626,6 +626,7 @@ ac_subst_vars='LTLIBOBJS
TEST_MODULES
LIBRARY_DEPS
STATIC_LIBPYTHON
PY_LINKER_EXCLUDE_LIBS
OPENSSL_RPATH
OPENSSL_LDFLAGS
OPENSSL_LIBS
Expand Down Expand Up @@ -17721,6 +17722,45 @@ esac
$as_echo "$OPENSSL_RPATH" >&6; }


{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the linker accepts -Wl,--exclude-libs,ALL" >&5
$as_echo_n "checking whether the linker accepts -Wl,--exclude-libs,ALL... " >&6; }
if ${ax_cv_check_ldflags___Wl___exclude_libs_ALL+:} false; then :
$as_echo_n "(cached) " >&6
else

ax_check_save_flags=$LDFLAGS
LDFLAGS="$LDFLAGS -Wl,--exclude-libs,ALL"
cat confdefs.h - <<_ACEOF >conftest.$ac_ext
/* end confdefs.h. */

int
main ()
{

;
return 0;
}
_ACEOF
if ac_fn_c_try_link "$LINENO"; then :
ax_cv_check_ldflags___Wl___exclude_libs_ALL=yes
else
ax_cv_check_ldflags___Wl___exclude_libs_ALL=no
fi
rm -f core conftest.err conftest.$ac_objext \
conftest$ac_exeext conftest.$ac_ext
LDFLAGS=$ax_check_save_flags
fi
{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ax_cv_check_ldflags___Wl___exclude_libs_ALL" >&5
$as_echo "$ax_cv_check_ldflags___Wl___exclude_libs_ALL" >&6; }
if test "x$ax_cv_check_ldflags___Wl___exclude_libs_ALL" = xyes; then :
PY_LINKER_EXCLUDE_LIBS="1"

else
:
fi



# ssl module default cipher suite string


Expand Down
6 changes: 6 additions & 0 deletions configure.ac
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5832,6 +5832,12 @@ AS_CASE($with_openssl_rpath,
AC_MSG_RESULT($OPENSSL_RPATH)
AC_SUBST([OPENSSL_RPATH])

AX_CHECK_LINK_FLAG(
[-Wl,--exclude-libs,ALL],
[PY_LINKER_EXCLUDE_LIBS="1"]
)
AC_SUBST([PY_LINKER_EXCLUDE_LIBS])

# ssl module default cipher suite string
AH_TEMPLATE(PY_SSL_DEFAULT_CIPHERS,
[Default cipher suites list for ssl module.
Expand Down
45 changes: 32 additions & 13 deletions setup.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2447,24 +2447,43 @@ def split_var(name, sep):
else:
runtime_library_dirs = [openssl_rpath]

openssl_extension_kwargs = dict(
include_dirs=openssl_includes,
library_dirs=openssl_libdirs,
libraries=openssl_libs,
runtime_library_dirs=runtime_library_dirs,
)
# Don't re-export OpenSSL symbols from statically linked libs if
# OpenSSL is built with "./config no-shared -fPIC".
# Note: gcc -shared -lcrypto -L/path/to/openssl/lib automatically
# falls back to libcrypto.a if the library search directories do not
# contain libcrypto.so.
if sysconfig.get_config_var("PY_LINKER_EXCLUDE_LIBS"):
openssl_extension_kwargs["extra_link_args"] = [
f"-Wl,--exclude-libs,lib{lib}.a"
for lib in openssl_extension_kwargs["libraries"]
]

if config_vars.get("HAVE_X509_VERIFY_PARAM_SET1_HOST"):
self.add(Extension(
'_ssl', ['_ssl.c'],
include_dirs=openssl_includes,
library_dirs=openssl_libdirs,
libraries=openssl_libs,
runtime_library_dirs=runtime_library_dirs,
depends=['socketmodule.h', '_ssl/debughelpers.c'])
self.add(
Extension(
'_ssl',
['_ssl.c'],
depends=['socketmodule.h', '_ssl/debughelpers.c'],
**openssl_extension_kwargs
)
)
else:
self.missing.append('_ssl')

self.add(Extension('_hashlib', ['_hashopenssl.c'],
depends=['hashlib.h'],
include_dirs=openssl_includes,
library_dirs=openssl_libdirs,
runtime_library_dirs=runtime_library_dirs,
libraries=openssl_libs))
self.add(
Extension(
'_hashlib',
['_hashopenssl.c'],
depends=['hashlib.h'],
**openssl_extension_kwargs,
)
)

def detect_hash_builtins(self):
# By default we always compile these even when OpenSSL is available
Expand Down