OpenSSL 3.1 not supported in build of module net/http

[jan-busa]

When trying to build latest version of ROOT (6.28.02) with support of OpenSSL 3.1, OpenSSL does not get recognized and is disabled in the build process.

Since in civetweb I don't see OPENSSL_API_3_1, I solved this problem for me by changing line 82 of the file
net/http/CMakeLists.txt from

  elseif((${ssl_major} EQUAL "3") AND (${ssl_minor} EQUAL "0")))

to

  elseif((${ssl_major} EQUAL "3") AND ((${ssl_minor} EQUAL "0") OR (${ssl_minor} EQUAL "1")))

but I don't know whether it is a desired way to solve this problem.

[linev]

Can you check that it really compiles?
civetweb is designed and tested with OpenSSL 3.0 - see https://github.com/civetweb/civetweb/releases
But may be it will work with 3.1.

[jan-busa]

Actually before opening this issue, I did indeed build ROOT with it. I'm not sure, how to test if it is working but running ldd libRHTTP.so shows, that it got linked against proper library

libssl.so.3 => .../sw/slc7_x86-64/AliEn-Runtime/v2.19-le-local3/lib/libssl.so.3

I'm not sure, that this needs to be fixed ASAP, maybe after civetweb will have support for OpenSSL 3.1 but I wanted for early adopters see that such problem with build exists and how to bypass it in the time being.

[linev]

Are you sure that libRHTTP.so was linked with OpenSSL 3.1?
Please try again.

[jan-busa]

I'm working inside CentOS7 container that does not have any OpenSSL installed this prevents linking "random" OpenSSL. I did full rebuild - all dependencies including compiler, OpenSSL (downloaded and built tag openssl-3.1.0 from https://github.com/openssl/openssl.git) and ROOT 6.28.02 with aforementioned "fix". ROOT did compile and proper OpenSSL library is linked.

> ldd libRHTTP.so
...
libssl.so.3 => /sw/slc7_x86-64/AliEn-Runtime/v2.19-le-local2/lib/libssl.so.3 (0x00007f0b72d85000)
...
> openssl version
OpenSSL 3.1.0 14 Mar 2023 (Library: OpenSSL 3.1.0 14 Mar 2023)

What is interesting, the libssl.so.3 file with name libssl.so.3.1 has not been created during OpenSSL build and in OpenSSL Configure file in section apitable there is no mention of new 3.1.0 API. Either the authors have forgotten to add it there or they have decided not to increase API version. In file VERSION.dat there is proper version 3.1.

[linev]

But you modify cmake?

elseif((${ssl_major} EQUAL "3") AND ((${ssl_minor} EQUAL "0") OR (${ssl_minor} EQUAL "1")))

Can you provide PR or I can do it

[jan-busa]

Please, if you can, do the PR. I actually don't understand where it should go, v6-28-00-patches branch of ROOT?

I have one more observation. When I don't modify the cmake, then as expected I get during configuration message

Not able to recognize SSL version 3.1.0, disable SSL

and civetweb is built with -DNO_SSL but libssl.so.3 still gets linked. As I understand, this is because the libRHTTP.so is linked to libNet.so which links libssl.so.3. This is quite misleading as looking at ldd libRHTTP.so one can come to conclusion that it has been built with support of openssl even though this is not the case. I understand that this can't be avoided, it is just an observation.

[linev]

Yes, you are right.

PR #12798 also addressing library dependency.