gRPC doesn't build with OpenSSL anymore - under Debian only.

[nicolasnoble]

Reproduction steps:

$ docker run -t -i debian:9 bash -l
# apt-get update
# apt-get -y dist-upgrade
# apt-get install -y git build-essential libssl-dev
# git clone --recursive https://github.com/grpc/grpc.git
# cd grpc
# EMBED_OPENSSL=false make static_c

Output:

src/core/lib/security/credentials/jwt/jwt_verifier.c: In function 'pkey_from_jwk':
src/core/lib/security/credentials/jwt/jwt_verifier.c:498:10: error: dereferencing pointer to incomplete type 'RSA {aka struct rsa_st}'
       rsa->n =
          ^~
Makefile:2446: recipe for target '/grpc/objs/opt/src/core/lib/security/credentials/jwt/jwt_verifier.o' failed
make: *** [/grpc/objs/opt/src/core/lib/security/credentials/jwt/jwt_verifier.o] Error 1

[jboeuf]

The problem is that this version of debian ships with OpenSSL 1.1 which has breaking changes in the API. See https://wiki.openssl.org/index.php/OpenSSL_1.1.0_Changes#Downloads

If we want to support both 1.0.2 and 1.1, we need to link with an API compatibility layer that can be downloaded here: https://wiki.openssl.org/images/e/ed/Openssl-compat.tar.gz

@nicolasnoble, do you have a strong opinion on what to do here? 1.1 has also deprecated other functions that we are using and causing some errors:

src/core/tsi/ssl_transport_security.c:1298:3: error: 'TLSv1_2_method' is deprecated [-Werror=deprecated-declarations]
   ssl_context = SSL_CTX_new(TLSv1_2_method());
   ^~~~~~~~~~~
In file included from /usr/include/openssl/ct.h:13:0,
                 from /usr/include/openssl/ssl.h:61,
                 from src/core/tsi/ssl_transport_security.c:59:
/usr/include/openssl/ssl.h:1608:1: note: declared here
 DEPRECATEDIN_1_1_0(__owur const SSL_METHOD *TLSv1_2_method(void)) /* TLSv1.2 */
 ^
src/core/tsi/ssl_transport_security.c: In function 'tsi_create_ssl_server_handshaker_factory_ex':
src/core/tsi/ssl_transport_security.c:1418:7: error: 'TLSv1_2_method' is deprecated [-Werror=deprecated-declarations]
       impl->ssl_contexts[i] = SSL_CTX_new(TLSv1_2_method());
       ^~~~
In file included from /usr/include/openssl/ct.h:13:0,
                 from /usr/include/openssl/ssl.h:61,
                 from src/core/tsi/ssl_transport_security.c:59:
/usr/include/openssl/ssl.h:1608:1: note: declared here
 DEPRECATEDIN_1_1_0(__owur const SSL_METHOD *TLSv1_2_method(void)) /* TLSv1.2 */

[nicolasnoble]

Hm, well, yes, we'd need to make it work for both OpenSSL 1.0.x and 1.1.x. I'm glad we've caught that early, because this will become a broader issue later on, especially with other build systems such as node.js.

Did they really break the API in a minor release ? That's... unfortunate. Isn't there any way to do anything that would work for both ? In worst case scenario, the compatibility layer may be a bit bloated, but fortunately, is easy to implement ourselves. The #if OPENSSL_VERSION_NUMBER < 0x10100000L is the way to go, with then code that differs between the two implementations.

[JelteF]

This is also an issue when compiling on Arch linux now.

[ndandanov]

Does any workaround exist? Perhaps using OpenSSL 1.0 would be sufficient.

@JelteF, I am also on Arch Linux. Did you manage to solve the issue and if yes, how?

Thank you!

[borgoat]

I was following this but forgot to mention how I solved.
I tried configuring CMake to use OpenSSL 1.0 but got issues with other libraries, eventually I settled with the standard Makefile procedure, installing openssl-1.0 package, and exporting PKG_CONFIG_PATH to point to OpenSSL 1.0

See this for reference.

Basically the build becomes:

PKG_CONFIG_PATH=/usr/lib/openssl-1.0/pkgconfig make

Hope this'll help!

[ndandanov]

Thank you a lot, @giorgioazzinnaro!
The build went successfully with this export and also with export CFLAGS="-Wno-error" in order to omit the warnings for missing breaks.

[nwoeanhinnogaehr]

For anyone else who is confused as to why @giorgioazzinnaro's answer is not working, make sure you have pkg-config installed!

[jtattermusch]

once this is fixed, we'll need a distrib test for this -> anything "supported" that doesn't have a test will be broken in the future.