xrootd build error on Ubuntu 22.04

[Axel-Naumann]

Hi,

Building xrootd as part of ROOT we get:

/home/sftnight/build/night/LABEL/ROOT-ubuntu2204/SPEC/soversion/V/master/build/builtins/xrootd/XROOTD-prefix/src/XROOTD/src/XrdCrypto/XrdCryptosslRSA.cc:656:55: error: invalid conversion from ‘const rsa_st*’ to ‘RSA*’ {aka ‘rsa_st*’} [-fpermissive]
  656 |                                      EVP_PKEY_get0_RSA(fEVP), RSA_PKCS1_PADDING)) < 0) {
      |                                      ~~~~~~~~~~~~~~~~~^~~~~~
      |                                                       |
      |                                                       const rsa_st*
In file included from /usr/include/openssl/x509.h:36,
                 from /usr/include/openssl/pem.h:23,
                 from /home/sftnight/build/night/LABEL/ROOT-ubuntu2204/SPEC/soversion/V/master/build/builtins/xrootd/XROOTD-prefix/src/XROOTD/src/XrdCrypto/XrdCryptosslRSA.cc:44:
/usr/include/openssl/rsa.h:289:29: note:   initializing argument 4 of ‘int RSA_public_decrypt(int, const unsigned char*, unsigned char*, RSA*, int)’
  289 |                        RSA *rsa, int padding);
      |                        ~~~~~^~~

There's also a gazillion warnings; here's the log:
XROOTD-build-err.log

Is that our config issue or a lack of support of that specific openssl 3 version (OpenSSL 3.0.1) in xrootd v5.4.2?

I see in docs/ReleaseNotes.txt

Build openssl3 files only if WITH_OPENSSL3=TRUE.

but I'd hope that CMake knows that this is openssl3 and I don't need to specify things by hand?

[Axel-Naumann]

So passing -DWITH_OPENSSL3=TRUE fixes this. Isn't that something CMake should be able to figure out itself...?

[simonmichal]

@Axel-Naumann : at that point -DWITH_OPENSSL3=TRUE was considered experimental because it was not well tested, currently (in master) WITH_OPENSSL3 has been replaced with ENABLE_OPENSSL3 and is by default is set to TRUE (we are still sorting out some details (see #1662)), this is scheduled for release 5.5.0.

[Axel-Naumann]

Thanks! I.e. I reckon with our v5.4.2 we should set -DWITH_OPENSSL3=TRUE. Can we always set it, or really only when building against openssl version 3?

Do you have an ETA for 5.5.0?

[simonmichal]

You can always set, it is compatible with older versions of openssl. 5.5.0 is planned for beginning of May (we want to start the release process after Hepix).

[Axel-Naumann]

We need -DWITH_OPENSSL3=TRUE for Ubuntu 22.04, but enabling it causes

builtins/xrootd/XROOTD-prefix/src/XROOTD/src/XrdSec/openssl3/XrdSecProtect.cc:57:8: error: unknown type name 'EVP_MD_CTX'
static EVP_MD_CTX* EVP_MD_CTX_new() {
       ^
builtins/xrootd/XROOTD-prefix/src/XROOTD/src/XrdSec/openssl3/XrdSecProtect.cc:58:3: error: unknown type name 'EVP_MD_CTX'
  EVP_MD_CTX *ctx = (EVP_MD_CTX *)OPENSSL_malloc(sizeof(EVP_MD_CTX));
  ^
builtins/xrootd/XROOTD-prefix/src/XROOTD/src/XrdSec/openssl3/XrdSecProtect.cc:58:22: error: use of undeclared identifier 'EVP_MD_CTX'
  EVP_MD_CTX *ctx = (EVP_MD_CTX *)OPENSSL_malloc(sizeof(EVP_MD_CTX));
                     ^
builtins/xrootd/XROOTD-prefix/src/XROOTD/src/XrdSec/openssl3/XrdSecProtect.cc:58:34: error: expected expression
  EVP_MD_CTX *ctx = (EVP_MD_CTX *)OPENSSL_malloc(sizeof(EVP_MD_CTX));
                                 ^
builtins/xrootd/XROOTD-prefix/src/XROOTD/src/XrdSec/openssl3/XrdSecProtect.cc:63:29: error: unknown type name 'EVP_MD_CTX'
static void EVP_MD_CTX_free(EVP_MD_CTX *ctx) {
                            ^
builtins/xrootd/XROOTD-prefix/src/XROOTD/src/XrdSec/openssl3/XrdSecProtect.cc:166:4: error: unknown type name 'EVP_MD_CTX'
   EVP_MD_CTX *mdctx = EVP_MD_CTX_new();
   ^
builtins/xrootd/XROOTD-prefix/src/XROOTD/src/XrdSec/openssl3/XrdSecProtect.cc:167:10: error: unknown type name 'EVP_MD'
   const EVP_MD *md = EVP_get_digestbyname("sha256");
         ^
builtins/xrootd/XROOTD-prefix/src/XROOTD/src/XrdSec/openssl3/XrdSecProtect.cc:167:23: error: use of undeclared identifier 'EVP_get
_digestbyname'
   const EVP_MD *md = EVP_get_digestbyname("sha256");
                      ^

on macOS12. So it seems to "have an effect" also with "openssl" 2-compatible libraries. What do you recommend us to do? Pass -DWITH_OPENSSL3=TRUE only if openssl v3 is detected?

[simonmichal]

@Axel-Naumann : sorry, my bad, that's because 5.4.2 is missing this patch: 34d1a1e
34d1a1e#diff-5b3f6a82808172f6e5f51f3770d8444710164b8b17e1e5e6e50c22e9bbd02bb4R44

This will be also included in the coming 5.5.0.

[Axel-Naumann]

Is that commit 34d1a1e relevant for any platform that offers openssl version 3, or is this just a backward compatibility (-DWITH_OPENSSL3=TRUE but openssl < 3)?

[simonmichal]

@Axel-Naumann : AFAIR this patch is required on MAC OSX for openssl 3.

[Axel-Naumann]

All clarified, thank you!