How to get homebrew to stop resetting PKG_CONFIG_LIBDIR

[heaths]

Output of brew config

HOMEBREW_VERSION: 4.4.22-90-g0e1d945
ORIGIN: https://github.com/Homebrew/brew
HEAD: 0e1d94506837ff39def056eaa365fa4d6aa07ca8
Last commit: 24 hours ago
Branch: master
Core tap HEAD: 0099f5e000ada94fb2277ed1e01e1f79d421a2fc
Core tap last commit: 57 minutes ago
Core tap JSON: 01 Mar 19:44 UTC
HOMEBREW_PREFIX: /home/linuxbrew/.linuxbrew
HOMEBREW_BROWSER: wslview
HOMEBREW_CASK_OPTS: []
HOMEBREW_DISPLAY: :0
HOMEBREW_EDITOR: hx
HOMEBREW_MAKE_JOBS: 8
HOMEBREW_SORBET_RUNTIME: set
Homebrew Ruby: 3.3.7 => /home/linuxbrew/.linuxbrew/Homebrew/Library/Homebrew/vendor/portable-ruby/3.3.7/bin/ruby
CPU: octa-core 64-bit tigerlake
Clang: 19.1.7
Git: 2.48.1 => /bin/git
Curl: 7.81.0 => /bin/curl
Kernel: Linux 5.15.167.4-microsoft-standard-WSL2 x86_64 GNU/Linux
OS: Ubuntu 22.04.5 LTS (jammy)
WSL: 2 (Microsoft Store)
Host glibc: 2.35
/usr/bin/gcc: 11.4.0
/usr/bin/ruby: N/A
glibc: N/A
gcc@11: N/A
gcc: N/A
xorg: N/A

Output of brew doctor

Please note that these warnings are just used to help the Homebrew maintainers
with debugging if you file an issue. If everything you use Homebrew for is
working fine: please don't worry or file an issue; just ignore this. Thanks!

Warning: Some installed formulae are deprecated or disabled.
You should find replacements for the following formulae:
  go@1.22
  openssl@1.1

Warning: The following formulae have the same name as core formulae:
  jandedobbeleer/oh-my-posh/oh-my-posh
Their taps are in use, so you must use these full names throughout Homebrew.

Description of issue

I started a tap at https://github.com/heaths/homebrew-tap with a single formula so far, akv. It's a run bin crate that builds and compiles fine across all my systems; however, when trying to build a bottle on ubuntu 22.04 or 20.04, building fails to find openssl via pkg-config seemingly because it unsets PKG_CONFIG_LIBDIR:

The command that runs under brew install --verbose --formula --build-bottle heaths/tap/akv:

PKG_CONFIG_LIBDIR= PKG_CONFIG_ALLOW_SYSTEM_CFLAGS=1 pkg-config --libs --cflags openssl

If I remove the PKG_CONFIG_LIBDIR reset:

PKG_CONFIG_ALLOW_SYSTEM_CFLAGS=1 pkg-config --libs --cflags openssl
# -I/home/linuxbrew/.linuxbrew/Cellar/openssl@3/3.4.1/include -L/home/linuxbrew/.linuxbrew/Cellar/openssl@3/3.4.1/lib -lssl -lcrypto

How do I get homebrew to stop resetting PKG_CONFIG_LIBDIR or, perhaps better, why is it doing so? If there's a good reason, is there a workaround? libssl-dev and friends are all installed and I can build successfully with cargo build and such.

[SMillerDev]

It's doing so to avoid accidentally including things on the system that your formula doesn't depend on. Dependencies of the formula should automatically be added to it.

[heaths]

Even with a workaround other making sure openssl@3 is installed first and setting env vars as openssl-sys (rust crate) requests, it still fails to build so something else is going on:

From the GitHub task that is building the bottle:

  env:
    HOMEBREW_NO_INSTALL_FROM_API: 
    HOMEBREW_GITHUB_API_TOKEN: ***
    OPENSSL_DIR: /home/linuxbrew/.linuxbrew/opt/openssl@3
    OPENSSL_INCLUDE_DIR: /home/linuxbrew/.linuxbrew/opt/openssl@3/include
    OPENSSL_LIB_DIR: /home/linuxbrew/.linuxbrew/opt/openssl@3/lib
    PKG_CONFIG_PATH: /home/linuxbrew/.linuxbrew/opt/openssl@3/lib/pkgconfig
...
  ==> cargo install --jobs 4 --locked --root=/home/linuxbrew/.linuxbrew/Cellar/akv/0.2.0 --path=.
...
    OPENSSL_LIB_DIR unset
    cargo:rerun-if-env-changed=X86_64_UNKNOWN_LINUX_GNU_OPENSSL_INCLUDE_DIR
    X86_64_UNKNOWN_LINUX_GNU_OPENSSL_INCLUDE_DIR unset
    cargo:rerun-if-env-changed=OPENSSL_INCLUDE_DIR
    OPENSSL_INCLUDE_DIR unset
    cargo:rerun-if-env-changed=X86_64_UNKNOWN_LINUX_GNU_OPENSSL_DIR
    X86_64_UNKNOWN_LINUX_GNU_OPENSSL_DIR unset
    cargo:rerun-if-env-changed=OPENSSL_DIR
    OPENSSL_DIR unset

I can build successfully on hosted agents in my https://github.com/heaths/akv-cli-rs repo. I may just switch over to having the various test platforms publish single-file binaries and have homebrew download those.

I'm a bit new to creating recipes, though. Can formulae still download separate binaries or do I need a cask for that?

[Bo98]

If your build needs OpenSSL 3 then you need to add depends_on "openssl@3" to the formula and the build system will pick it up automatically. It's intentional that pkg-config will fail to find things you haven't declared a dependency on.

[heaths]

I did previously and it made no difference. It's like brew is giving forked processes like cargo a new environment block that is empty or mostly empty.

[cho-m]

Homebrew aims for reproducible builds so it is expected that environment variables will be sanitized¹² as they can result in non-reproducible/broken behavior³. This is similar to build systems like Bazel. Other repositories (e.g. Debian & NixOS) should do something similar as they prioritize reproducible builds.

---

For your specific formula, depends_on "openssl@3" is required to use OpenSSL.

If you want pkg-config detection, then depends_on "pkgconf" => :build will be necessary. If you want to bypass pkg-config in openssl-sys, then ENV["OPENSSL_DIR"] = Formula["openssl@3"].opt_prefix.

These dependencies need to be explicit so they work no matter what machine is used (e.g. could be a minimal Linux container). Same idea as Debian control file Build-Depends/Depends, Fedora spec file BuildRequires/Requires, ArchLinux PKGBUILD file makedepends/depends, etc.

---

For your tap, you can use binaries if you want. This is just not allowed within main Homebrew/core. Looking at analytics, some of top installed 3rd-party formulae are:

• https://github.com/hashicorp/homebrew-tap/blob/master/Formula/terraform.rb
• https://github.com/fluxcd/homebrew-tap/blob/master/Formula/flux.rb
• https://github.com/Azure/homebrew-kubelogin/blob/master/Formula/kubelogin.rb
• https://github.com/mongodb/homebrew-brew/blob/master/Formula/mongodb-community.rb

Footnotes

1. https://docs.brew.sh/Formula-Cookbook#using-environment-variables ↩

2. https://docs.brew.sh/Formula-Cookbook#superenv-notes ↩

3. https://reproducible-builds.org/docs/env-variations/ ↩

[heaths]

Awesome! I'll try that. Yeah, I know the Azure Developer CLI (azd) also does this. I wrote their Windows Installer but someone else did the formula for Homebrew. I was considering that approach, but let me try this first.

[heaths]

FWIW, it always detected both openssl@3 and pkgconfig dependencies automatically, though:

==> Determining dependencies...
==> brew fetch --formulae --retry acl attr autoconf automake berkeley-db@5 bison brotli bzip2 ca-certificates cmake curl elfutils expat flex gdbm gettext gpatch help2man icu4c@76 krb5 libedit libffi libgit2@1.8 libidn2 libnghttp2 libnsl libssh2 libtirpc libtool libunistring libxcrypt libxml2 llvm lzip m4 mandoc mpdecimal ncurses ninja openldap openssl@3 pcre2 perl pkgconf python-setuptools python@3.12 python@3.13 readline rtmpdump rust sqlite swig unzip util-linux z3

I figure that's for rust itself, but surprised it doesn't "carry through" to building my crate.

As such, I'm trying the ENV approach first, though wondering if I need to explicitly set all the vars the build wants. I'll play around with it.

[heaths]

It almost worked. It actually built but failed to link:

==> brew linkage --test heaths/tap/akv
==> FAILED
Full linkage --test heaths/tap/akv output
  Missing libraries:
    libcrypto.so.3
    libssl.so.3

I'm wondering if I also need to update LD_LIBRARY_PATH. I'll have to try later today, but if you know for sure before I get a chance I'd love to know. Definitely got me further along, though; thanks!

[heaths]

PS: It makes sense it's trying to create reproducible builds. What was throwing me, though, was that it happily accepted that the macOS agents already had libssl.3 et. al. installed and used those, so I figured, why not linux if I preinstalled it? Then again, perhaps it is macOS (I've been primarily a Windows dev - and quite a bit of linux - for 3+ decades so still learning the macOS ecosystem) that always has openssl installed, unlike many linux flavors.