Force linking to static archives during make?

[Maxim Dounin]

Hello!

On Wed, Dec 18, 2013 at 12:03:31PM -0500, Jeffrey Walton wrote:

> Thanks
> 
> On Wed, Dec 18, 2013 at 4:29 AM, Ruslan Ermilov <ru at nginx.com> wrote:
> > On Tue, Dec 17, 2013 at 04:16:55PM -0500, Jeffrey Walton wrote:
> >> This should be my last build question.
> >>
> >> $ ./auto/configure --with-http_ssl_module ...
> >> --with-cc-opt="-I/usr/local/ssl/include"
> >> --with-ld-opt="-L/usr/local/ssl/lib /usr/local/ssl/lib/libssl.a
> >> /usr/local/ssl/lib/libcrypto.a -ldl"
> >> ...
> >> $ make
> >> ...
> >>
> >> Results in the following. Note that OpenSSL is still dynamically linked:
> >>
> >> $ ldd objs/nginx
> >>     linux-vdso.so.1 =>  (0x00007fffd0dfe000)
> >>     libdl.so.2 => /lib64/libdl.so.2 (0x0000003ebf600000)
> >>     libpthread.so.0 => /lib64/libpthread.so.0 (0x0000003ebfa00000)
> >>     libcrypt.so.1 => /lib64/libcrypt.so.1 (0x0000003ed3e00000)
> >>     libpcre.so.1 => /lib64/libpcre.so.1 (0x0000003ec0a00000)
> >>     libssl.so.1.0.0 => not found
> >>     libcrypto.so.1.0.0 => not found
> >>     libz.so.1 => /lib64/libz.so.1 (0x0000003ebfe00000)
> >>     libc.so.6 => /lib64/libc.so.6 (0x0000003ebf200000)
> >>     /lib64/ld-linux-x86-64.so.2 (0x0000003ebea00000)
> >>     libfreebl3.so => /lib64/libfreebl3.so (0x0000003ec7a00000)
> >>
> >> *****
> >>
> >> Adding -Bstatic does not help even though its clearly on the link command line:
> >>
> >> $ ./auto/configure --with-http_ssl_module ...
> >> --with-cc-opt="-I/usr/local/ssl/include" --with-ld-opt="-Bstatic
> >> -L/usr/local/ssl/lib /usr/local/ssl/lib/libssl.a
> >> /usr/local/ssl/lib/libcrypto.a -ldl"
> >> ...
> >> $ make
> >> ...
> >> objs/src/http/modules/ngx_http_upstream_keepalive_module.o \
> >> objs/ngx_modules.o \
> >> -Bstatic -L/usr/local/ssl/lib /usr/local/ssl/lib/libssl.a
> >> /usr/local/ssl/lib/libcrypto.a -ldl -lpthread -lcrypt -lpcre -lssl
> >> -lcrypto -lz
> >> ...
> >> $ ldd objs/nginx
> >>     linux-vdso.so.1 =>  (0x00007fffd4fc6000)
> >>     libdl.so.2 => /lib64/libdl.so.2 (0x0000003ebf600000)
> >>     ...
> >>     libssl.so.1.0.0 => not found
> >>     libcrypto.so.1.0.0 => not found
> >>
> >> *****
> >>
> >> Omitting -L/usr/local/ssl/lib results in a failed configure.
> >>
> >> *****
> >>
> >> How does one force nginx to use static linking for a library?
> >>
> >> Thanks in advance.
> >
> > I can't tell for Linux, but on FreeBSD it's as simple as:
> >
> > $ auto/configure --with-ld-opt=-static
> > [...]
> > $ make -sj4
> > $ file objs/nginx
> > objs/nginx: ELF 64-bit LSB executable, x86-64, version 1 (FreeBSD), statically linked, for FreeBSD 9.2 (902503), not stripped
> > $ ldd objs/nginx
> > ldd: objs/nginx: not a dynamic ELF executable
> This is a known problem with the toolchains on Linux and Apple. Hence
> the reason we need a way to use the fully specified archive when we
> want static linking.
> 
> In my case, if I distribute on Ubuntu 12.04 LTS, folks will likely get
> Ubuntu's version of OpenSSL since the names are the same and binary
> compatible. The Ubuntu folks disable TLSv1.1 and TLSv1.2, and they
> refuse to enable them (there's a bug report covering it).
> 
> I just don't see how this can be done without enhancing/patching
> nginx's configuration subsystem.
> 
> Jeff
> 
> *****
> 
> $ cat t.c
> #include <openssl/ssl.h>
> 
> int main(int argc, char* argv[])
> {
>     return (int)SSL_library_init();
> }
> 
> $ gcc -I/usr/local/ssl/include t.c -L/usr/local/ssl/lib -Bstatic -lssl -lcrypto
> 
> $ ldd a.out
>     linux-vdso.so.1 =>  (0x00007fff68a2e000)
>     libssl.so.1.0.0 => not found
>     libcrypto.so.1.0.0 => not found
>     libc.so.6 => /lib64/libc.so.6 (0x0000003ebf200000)
>     /lib64/ld-linux-x86-64.so.2 (0x0000003ebea00000)

Just tested on Ubuntu 13.10, and it seems to work this way:

gcc t.c -I/usr/local/ssl/include -L/usr/local/ssl/lib \
    -Wl,-Bstatic -lssl -lcrypto -Wl,-Bdynamic -ldl

That is, using

./configure --with-cc-opt="-I/usr/local/ssl/include" \
    --with-ld-opt="-L/usr/local/ssl/lib -Wl,-Bstatic -lssl -lcrypto -Wl,-Bdynamic -ldl"

will force use of static versions of libssl and libcrypto, without 
any changes to nginx configure.

Alternatively, trivial workaround is to move away dynamic 
libraries (or not compile/install them).  Or you may ask nginx to 
compile OpenSSL for you.

-- 
Maxim Dounin
http://nginx.org/