From 1c469fd6d2e9bf718b2280d672ffd3adb6646dc2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavol=20=C5=BD=C3=A1=C4=8Dik?= Date: Thu, 28 Aug 2025 11:56:15 +0200 Subject: [PATCH] Build tests in %check and without LTO The patch which enables the split build is backported from https://github.com/openssl/openssl/pull/28302. Resolves: RHEL-111634 --- ...ip-build-of-non-installable-programs.patch | 153 ++++++++++++++++++ openssl.spec | 16 +- 2 files changed, 166 insertions(+), 3 deletions(-) create mode 100644 0057-Targets-to-skip-build-of-non-installable-programs.patch diff --git a/0057-Targets-to-skip-build-of-non-installable-programs.patch b/0057-Targets-to-skip-build-of-non-installable-programs.patch new file mode 100644 index 0000000..0634895 --- /dev/null +++ b/0057-Targets-to-skip-build-of-non-installable-programs.patch @@ -0,0 +1,153 @@ +From b96746b02cff910f4cd3787fddc042f7e3fb4956 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Pavol=20=C5=BD=C3=A1=C4=8Dik?= +Date: Tue, 19 Aug 2025 14:26:07 +0200 +Subject: [PATCH] Add targets to skip build of non-installable programs + +These make it possible to split the build into two +parts, e.g., when tests should be built with different +compiler flags than installed software. + +Also use these as dependecies where appropriate. +--- + Configurations/descrip.mms.tmpl | 7 +++++-- + Configurations/unix-Makefile.tmpl | 9 ++++++--- + Configurations/windows-makefile.tmpl | 8 ++++++-- + util/help.pl | 2 +- + 4 files changed, 18 insertions(+), 8 deletions(-) + +diff --git a/Configurations/descrip.mms.tmpl b/Configurations/descrip.mms.tmpl +index db6a1b1799..bc7fc36b46 100644 +--- a/Configurations/descrip.mms.tmpl ++++ b/Configurations/descrip.mms.tmpl +@@ -491,6 +491,8 @@ NODEBUG=@ + {- dependmagic('build_libs'); -} : build_libs_nodep + {- dependmagic('build_modules'); -} : build_modules_nodep + {- dependmagic('build_programs'); -} : build_programs_nodep ++{- dependmagic('build_inst_sw'); -} : build_libs_nodep, build_modules_nodep, build_inst_programs_nodep ++{- dependmagic('build_inst_programs'); -} : build_inst_programs_nodep + + build_generated_pods : $(GENERATED_PODS) + build_docs : build_html_docs +@@ -500,6 +502,7 @@ build_generated : $(GENERATED_MANDATORY) + build_libs_nodep : $(LIBS), $(SHLIBS) + build_modules_nodep : $(MODULES) + build_programs_nodep : $(PROGRAMS), $(SCRIPTS) ++build_inst_programs_nodep : $(INSTALL_PROGRAMS), $(SCRIPTS) + + # Kept around for backward compatibility + build_apps build_tests : build_programs +@@ -606,7 +609,7 @@ install_docs : install_html_docs + uninstall_docs : uninstall_html_docs + + {- output_off() if $disabled{fips}; "" -} +-install_fips : build_sw $(INSTALL_FIPSMODULECONF) ++install_fips : build_inst_sw $(INSTALL_FIPSMODULECONF) + @ WRITE SYS$OUTPUT "*** Installing FIPS module" + - CREATE/DIR ossl_installroot:[MODULES{- $target{pointer_size} -}.'arch'] + - CREATE/DIR/PROT=(S:RWED,O:RWE,G:RE,W:RE) OSSL_DATAROOT:[000000] +@@ -687,7 +690,7 @@ install_runtime_libs : check_INSTALLTOP build_libs + @install_shlibs) -} + @ {- output_on() if $disabled{shared}; "" -} ! + +-install_programs : check_INSTALLTOP install_runtime_libs build_programs ++install_programs : check_INSTALLTOP install_runtime_libs build_inst_programs + @ {- output_off() if $disabled{apps}; "" -} ! + @ ! Install the main program + - CREATE/DIR ossl_installroot:[EXE.'arch'] +diff --git a/Configurations/unix-Makefile.tmpl b/Configurations/unix-Makefile.tmpl +index 70ac47b73c..98c11f7a0f 100644 +--- a/Configurations/unix-Makefile.tmpl ++++ b/Configurations/unix-Makefile.tmpl +@@ -531,7 +531,9 @@ LANG=C + {- dependmagic('build_sw', 'Build all the software (default target)'); -}: build_libs_nodep build_modules_nodep build_programs_nodep link-utils + {- dependmagic('build_libs', 'Build the libraries libssl and libcrypto'); -}: build_libs_nodep + {- dependmagic('build_modules', 'Build the modules (i.e. providers and engines)'); -}: build_modules_nodep +-{- dependmagic('build_programs', 'Build the openssl executables and scripts'); -}: build_programs_nodep ++{- dependmagic('build_programs', 'Build the openssl executables, scripts and all other programs as configured (e.g. tests or demos)'); -}: build_programs_nodep ++{- dependmagic('build_inst_sw', 'Build all the software to be installed'); -}: build_libs_nodep build_modules_nodep build_inst_programs_nodep link-utils ++{- dependmagic('build_inst_programs', 'Build only the installable openssl executables and scripts'); -}: build_inst_programs_nodep + + all: build_sw {- "build_docs" if !$disabled{docs}; -} ## Build software and documentation + debuginfo: $(SHLIBS) +@@ -553,6 +555,7 @@ build_generated: $(GENERATED_MANDATORY) + build_libs_nodep: $(LIBS) {- join(" ",map { platform->sharedlib_simple($_) // platform->sharedlib_import($_) // platform->sharedlib($_) // () } @{$unified_info{libraries}}) -} + build_modules_nodep: $(MODULES) + build_programs_nodep: $(PROGRAMS) $(SCRIPTS) ++build_inst_programs_nodep: $(INSTALL_PROGRAMS) $(SCRIPTS) + + # Kept around for backward compatibility + build_apps build_tests: build_programs +@@ -671,7 +674,7 @@ uninstall_docs: uninstall_man_docs uninstall_html_docs ## Uninstall manpages and + $(RM) -r "$(DESTDIR)$(DOCDIR)" + + {- output_off() if $disabled{fips}; "" -} +-install_fips: build_sw $(INSTALL_FIPSMODULECONF) ++install_fips: build_inst_sw $(INSTALL_FIPSMODULECONF) + @[ -n "$(INSTALLTOP)" ] || (echo INSTALLTOP should not be empty; exit 1) + @$(PERL) $(SRCDIR)/util/mkdir-p.pl "$(DESTDIR)$(MODULESDIR)" + @$(PERL) $(SRCDIR)/util/mkdir-p.pl "$(DESTDIR)$(OPENSSLDIR)" +@@ -956,7 +959,7 @@ install_runtime_libs: build_libs + : {- output_on() if windowsdll(); "" -}; \ + done + +-install_programs: install_runtime_libs build_programs ++install_programs: install_runtime_libs build_inst_programs + @[ -n "$(INSTALLTOP)" ] || (echo INSTALLTOP should not be empty; exit 1) + @$(PERL) $(SRCDIR)/util/mkdir-p.pl "$(DESTDIR)$(bindir)" + @$(ECHO) "*** Installing runtime programs" +diff --git a/Configurations/windows-makefile.tmpl b/Configurations/windows-makefile.tmpl +index 894834cfb7..b5872124de 100644 +--- a/Configurations/windows-makefile.tmpl ++++ b/Configurations/windows-makefile.tmpl +@@ -418,6 +418,8 @@ PROCESSOR= {- $config{processor} -} + {- dependmagic('build_libs'); -}: build_libs_nodep + {- dependmagic('build_modules'); -}: build_modules_nodep + {- dependmagic('build_programs'); -}: build_programs_nodep ++{- dependmagic('build_inst_sw'); -}: build_libs_nodep build_modules_nodep build_inst_programs_nodep copy-utils ++{- dependmagic('build_inst_programs'); -}: build_inst_programs_nodep + + build_docs: build_html_docs + build_html_docs: $(HTMLDOCS1) $(HTMLDOCS3) $(HTMLDOCS5) $(HTMLDOCS7) +@@ -430,6 +432,8 @@ build_modules_nodep: $(MODULES) + @ + build_programs_nodep: $(PROGRAMS) $(SCRIPTS) + @ ++build_inst_programs_nodep: $(INSTALL_PROGRAMS) $(SCRIPTS) ++ @ + + # Kept around for backward compatibility + build_apps build_tests: build_programs +@@ -507,7 +511,7 @@ install_docs: install_html_docs + uninstall_docs: uninstall_html_docs + + {- output_off() if $disabled{fips}; "" -} +-install_fips: build_sw $(INSTALL_FIPSMODULECONF) ++install_fips: build_inst_sw $(INSTALL_FIPSMODULECONF) + # @[ -n "$(INSTALLTOP)" ] || (echo INSTALLTOP should not be empty; exit 1) + @"$(PERL)" "$(SRCDIR)\util\mkdir-p.pl" "$(MODULESDIR)" + @"$(PERL)" "$(SRCDIR)\util\mkdir-p.pl" "$(OPENSSLDIR)" +@@ -607,7 +611,7 @@ install_runtime_libs: build_libs + "$(PERL)" "$(SRCDIR)\util\copy.pl" $(INSTALL_SHLIBPDBS) \ + "$(INSTALLTOP)\bin" + +-install_programs: install_runtime_libs build_programs ++install_programs: install_runtime_libs build_inst_programs + @if "$(INSTALLTOP)"=="" ( $(ECHO) "INSTALLTOP should not be empty" & exit 1 ) + @$(ECHO) "*** Installing runtime programs" + @if not "$(INSTALL_PROGRAMS)"=="" \ +diff --git a/util/help.pl b/util/help.pl +index a1614fe8a9..e88ff4bae1 100755 +--- a/util/help.pl ++++ b/util/help.pl +@@ -14,7 +14,7 @@ while (<>) { + chomp; # strip record separator + @Fld = split($FS, $_, -1); + if (/^[a-zA-Z0-9_\-]+:.*?##/) { +- printf " \033[36m%-15s\033[0m %s\n", $Fld[0], $Fld[1] ++ printf " \033[36m%-19s\033[0m %s\n", $Fld[0], $Fld[1] + } + if (/^##@/) { + printf "\n\033[1m%s\033[0m\n", substr($Fld[$_], (5)-1); +-- +2.50.1 + diff --git a/openssl.spec b/openssl.spec index 8213892..5024cdb 100644 --- a/openssl.spec +++ b/openssl.spec @@ -29,7 +29,7 @@ print(string.sub(hash, 0, 16)) Summary: Utilities from the general purpose cryptography library with TLS implementation Name: openssl Version: 3.5.1 -Release: 3%{?dist} +Release: 4%{?dist} Epoch: 1 Source0: openssl-%{version}.tar.gz Source1: fips-hmacify.sh @@ -98,6 +98,7 @@ Patch0053: 0053-Allow-hybrid-MLKEM-in-FIPS-mode.patch Patch0054: 0054-Temporarily-disable-SLH-DSA-FIPS-self-tests.patch Patch0055: 0055-Add-a-define-to-disable-symver-attributes.patch Patch0056: 0056-Speed-test-signatures-without-errors.patch +Patch0057: 0057-Targets-to-skip-build-of-non-installable-programs.patch License: Apache-2.0 URL: http://www.openssl.org/ @@ -265,7 +266,7 @@ export HASHBANGPERL=/usr/bin/perl # Do not run this in a production package the FIPS symbols must be patched-in #util/mkdef.pl crypto update -make -s %{?_smp_mflags} all +make -s %{?_smp_mflags} build_inst_sw # Clean up the .pc files for i in libcrypto.pc libssl.pc openssl.pc ; do @@ -289,7 +290,10 @@ export OPENSSL_ENABLE_SHA1_SIGNATURES OPENSSL_SYSTEM_CIPHERS_OVERRIDE=xyz_nonexistent_file export OPENSSL_SYSTEM_CIPHERS_OVERRIDE %{SOURCE1} providers/fips.so -#run tests itself + +# Disable LTO, build tests, and run them +%define _lto_cflags %{nil} +make -s %{?_smp_mflags} build_programs make test HARNESS_JOBS=8 # Add generation of HMAC checksum of the final stripped library @@ -454,6 +458,12 @@ touch $RPM_BUILD_ROOT/%{_prefix}/include/openssl/engine.h %ldconfig_scriptlets libs %changelog +* Thu Aug 28 2025 Pavol Žáčik - 1:3.5.1-4 +- Make openssl speed test signatures without errors + Resolves: RHEL-95182 +- Build tests in check and without LTO + Resolves: RHEL-111634 + * Thu Jul 24 2025 Simo Sorce - 1:3.5.1-3 - Add custom define to disable symbol versioning in downstream patched code Also add stricter Suggests for openssl-fips-provider