[BACKPORT 2.14] Update OpenSSL to 3.0.8 (#244)

Also bumps krb5 to 1.20.1 (what master is on) to resolve compilation issues. Context: yugabyte/yugabyte-db#16407 Original PR: #239, #248
yugabyte · Nov 14, 2023 · b41c487 · b41c487
1 parent cc4d2af
commit b41c487
Show file tree

Hide file tree

Showing 10 changed files with 89 additions and 52 deletions.
diff --git a/.circleci/config.yml b/.circleci/config.yml
@@ -50,15 +50,15 @@ workflows:
 
       - build:
           archive_name_suffix: almalinux8-aarch64-clang12
-          docker_image: yugabyteci/yb_build_infra_almalinux8_aarch64:v2022-10-13T18_13_02
+          docker_image: yugabyteci/yb_build_infra_almalinux8_aarch64:v2023-10-25T03_32_54
           build_thirdparty_args: >-
             --toolchain=llvm12
             --expected-major-compiler-version=12
             --skip-sanitizers
 
       - build:
           archive_name_suffix: almalinux8-aarch64-clang12-thin-lto
-          docker_image: yugabyteci/yb_build_infra_almalinux8_aarch64:v2022-10-13T18_13_02
+          docker_image: yugabyteci/yb_build_infra_almalinux8_aarch64:v2023-10-25T03_32_54
           build_thirdparty_args: >-
             --toolchain=llvm12
             --expected-major-compiler-version=12
@@ -67,7 +67,7 @@ workflows:
 
       - build:
           archive_name_suffix: almalinux8-aarch64-clang12-full-lto
-          docker_image: yugabyteci/yb_build_infra_almalinux8_aarch64:v2022-10-13T18_13_02
+          docker_image: yugabyteci/yb_build_infra_almalinux8_aarch64:v2023-10-25T03_32_54
           build_thirdparty_args: >-
             --toolchain=llvm12
             --expected-major-compiler-version=12
@@ -80,15 +80,15 @@ workflows:
 
       - build:
           archive_name_suffix: almalinux8-aarch64-clang13
-          docker_image: yugabyteci/yb_build_infra_almalinux8_aarch64:v2022-10-13T18_13_02
+          docker_image: yugabyteci/yb_build_infra_almalinux8_aarch64:v2023-10-25T03_32_54
           build_thirdparty_args: >-
             --toolchain=llvm13
             --expected-major-compiler-version=13
             --skip-sanitizers
 
       - build:
           archive_name_suffix: almalinux8-aarch64-clang13-thin-lto
-          docker_image: yugabyteci/yb_build_infra_almalinux8_aarch64:v2022-10-13T18_13_02
+          docker_image: yugabyteci/yb_build_infra_almalinux8_aarch64:v2023-10-25T03_32_54
           build_thirdparty_args: >-
             --toolchain=llvm13
             --expected-major-compiler-version=13
@@ -97,7 +97,7 @@ workflows:
 
       - build:
           archive_name_suffix: almalinux8-aarch64-clang13-full-lto
-          docker_image: yugabyteci/yb_build_infra_almalinux8_aarch64:v2022-10-13T18_13_02
+          docker_image: yugabyteci/yb_build_infra_almalinux8_aarch64:v2023-10-25T03_32_54
           build_thirdparty_args: >-
             --toolchain=llvm13
             --expected-major-compiler-version=13
@@ -110,15 +110,15 @@ workflows:
 
       - build:
           archive_name_suffix: almalinux8-aarch64-clang14
-          docker_image: yugabyteci/yb_build_infra_almalinux8_aarch64:v2022-10-13T18_13_02
+          docker_image: yugabyteci/yb_build_infra_almalinux8_aarch64:v2023-10-25T03_32_54
           build_thirdparty_args: >-
             --toolchain=llvm14
             --expected-major-compiler-version=14
             --skip-sanitizers
 
       - build:
           archive_name_suffix: almalinux8-aarch64-clang14-thin-lto
-          docker_image: yugabyteci/yb_build_infra_almalinux8_aarch64:v2022-10-13T18_13_02
+          docker_image: yugabyteci/yb_build_infra_almalinux8_aarch64:v2023-10-25T03_32_54
           build_thirdparty_args: >-
             --toolchain=llvm14
             --expected-major-compiler-version=14
@@ -127,7 +127,7 @@ workflows:
 
       - build:
           archive_name_suffix: almalinux8-aarch64-clang14-full-lto
-          docker_image: yugabyteci/yb_build_infra_almalinux8_aarch64:v2022-10-13T18_13_02
+          docker_image: yugabyteci/yb_build_infra_almalinux8_aarch64:v2023-10-25T03_32_54
           build_thirdparty_args: >-
             --toolchain=llvm14
             --expected-major-compiler-version=14

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
diff --git a/.github/workflows/linux_build.sh b/.github/workflows/linux_build.sh
@@ -7,6 +7,7 @@ checkout_dir=$PWD
 echo "Building in directory: $checkout_dir"
 docker run -t \
   --cap-add=SYS_PTRACE \
+  -u root \
   -e GITHUB_TOKEN \
   -e YB_BUILD_THIRDPARTY_ARGS \
   -e YB_THIRDPARTY_ARCHIVE_NAME_SUFFIX \

diff --git a/.github/workflows/macos_build.sh b/.github/workflows/macos_build.sh
@@ -2,7 +2,7 @@
 
 set -euo pipefail
 
-brew install autoconf automake pkg-config shellcheck
+brew install autoconf automake pkg-config shellcheck hub
 dirs=( /opt/yb-build/{thirdparty,brew,tmp} )
 sudo mkdir -p "${dirs[@]}"
 sudo chmod 777 "${dirs[@]}"

diff --git a/patches/openssl-fix-afalg-link-on-centos7.patch b/patches/openssl-fix-afalg-link-on-centos7.patch
@@ -0,0 +1,27 @@
+diff --git a/engines/e_afalg.c b/engines/e_afalg.c
+index 2c08cbb..f362d94 100644
+--- a/engines/e_afalg.c
++++ b/engines/e_afalg.c
+@@ -34,10 +34,22 @@
+ #  warning "AFALG ENGINE requires Kernel Headers >= 4.1.0"
+ #  warning "Skipping Compilation of AFALG engine"
+ # endif
++# ifndef OPENSSL_NO_DYNAMIC_ENGINE
++OPENSSL_EXPORT
++    int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns);
++OPENSSL_EXPORT
++    int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns)
++{
++    return 0;
++}
++
++IMPLEMENT_DYNAMIC_CHECK_FN()
++# else
+ void engine_load_afalg_int(void);
+ void engine_load_afalg_int(void)
+ {
+ }
++# endif
+ #else
+
+ # include <linux/if_alg.h>
diff --git a/python/build_definitions/cassandra_cpp_driver.py b/python/build_definitions/cassandra_cpp_driver.py
@@ -22,7 +22,7 @@
 class CassandraCppDriverDependency(Dependency):
     def __init__(self) -> None:
         super(CassandraCppDriverDependency, self).__init__(
-                'cassandra-cpp-driver', '2.9.0-yb-13',
+                'cassandra-cpp-driver', '2.9.0-yb-14',
                 'https://github.com/yugabyte/cassandra-cpp-driver/archive/{0}.tar.gz',
                 BUILD_GROUP_INSTRUMENTED)
         self.copy_sources = False

diff --git a/python/build_definitions/krb5.py b/python/build_definitions/krb5.py
@@ -22,8 +22,8 @@ class Krb5Dependency(Dependency):
     def __init__(self) -> None:
         super(Krb5Dependency, self).__init__(
             'krb5',
-            '1.19.3',
-            'https://kerberos.org/dist/krb5/1.19/krb5-{0}.tar.gz',
+            '1.20.1',
+            'https://kerberos.org/dist/krb5/1.20/krb5-{0}.tar.gz',
             BUILD_GROUP_INSTRUMENTED)
         self.copy_sources = True
         self.patches = ['krb5-1.19.3-use-ldflags-for-test.patch']

diff --git a/python/build_definitions/openssl.py b/python/build_definitions/openssl.py
@@ -34,10 +34,16 @@ class OpenSSLDependency(Dependency):
     def __init__(self) -> None:
         super(OpenSSLDependency, self).__init__(
             name='openssl',
-            version='1.1.1o',
+            version='3.0.8',
             url_pattern='https://www.openssl.org/source/openssl-{0}.tar.gz',
             build_group=BUILD_GROUP_COMMON)
         self.copy_sources = True
+        # Patch fixes the following error on kernel versions < 4.1.0:
+        # ld.lld: error: version script assignment of 'global' to symbol 'bind_engine' failed:
+        # symbol not defined
+        # ld.lld: error: version script assignment of 'global' to symbol 'v_check' failed:
+        # symbol not defined
+        self.patches = ['openssl-fix-afalg-link-on-centos7.patch']
 
     def build(self, builder: BuilderInterface) -> None:
         common_configure_options = ['shared', 'no-tests']

diff --git a/requirements_frozen.txt b/requirements_frozen.txt
@@ -13,9 +13,9 @@ packaging==23.1
 pycodestyle==2.11.0
 requests==2.31.0
 ruamel.yaml==0.17.32
-ruamel.yaml.clib==0.2.7
+ruamel.yaml.clib==0.2.8
 sys-detection==1.3.0
-typing_extensions==4.7.1
+typing_extensions==4.8.0
 urllib3==2.0.4
 websocket-client==1.6.1
 yugabyte-pycommon==1.9.15
diff --git a/thirdparty_src_checksums.txt b/thirdparty_src_checksums.txt
@@ -7,6 +7,7 @@ fc9f85fc030e233142908241af7a846e60630aa7388de9a5fafb1f3a26840854  boost-1.77.0.t
 8681f175d4bdb26c52222665793eef08490d7758529330f98d3b29dd0735bccc  boost-1.78.0.tar.bz2
 7bc4b0257d4c15676a158dd30b665d85c1c6a590548e9f6288e2f1542ca6e05a  cassandra-cpp-driver-2.9.0-yb-12.tar.gz
 48dbb1e29028c2caeed6e6c6ec45a5deb0c18955f0292899e1994dd89defc3db  cassandra-cpp-driver-2.9.0-yb-13.tar.gz
+1e42551a7bf986be92d937a18be7208d38c5420550813b170969b08f1cb79058  cassandra-cpp-driver-2.9.0-yb-14.tar.gz
 e97dc472aae52197a4d5e0185eb8f9e04d7575d2dc2b12194ddc768e0f8a846d  cfe-7.1.0.tar.xz
 1ce0042c48ecea839ce67b87e9739cf18e7a5c2b3b9a36d177d00979609b6451  clang-tools-extra-7.1.0.tar.xz
 057bdac0581215b5ceb39edfd5bbef9eb79578f16a8908349f3066251fba88d8  compiler-rt-7.1.0.tar.xz
@@ -37,6 +38,7 @@ ea566e528605befb830671e359118c2da718f721c27225cbbc93858c7520fee3  gperftools-2.9
 d7cb878f268b171e7a33ddd052f7810e4af609f092a6c67c13264d7ffb17e7aa  include-what-you-use-0.11.tar.gz
 10453fee4e3a8f8ce6129059e5c050b8a65dab1c257df68b99b3112eaa0cdf6a  krb5-1.19.2.tar.gz
 56d04863cfddc9d9eb7af17556e043e3537d41c6e545610778676cf551b9dcd0  krb5-1.19.3.tar.gz
+704aed49b19eb5a7178b34b2873620ec299db08752d6a8574f95d41879ab8851  krb5-1.20.1.tar.gz
 800fdbba1fb0eb3e3b159214e1c1123365cc734877e4e79f5251bb9170569a0d  libbacktrace-ba79a27ee9a62b1be86d0ddae7614c316b7f6fbb.zip
 f090380ecd6b63a3c2b2f0bdb27260de2ccb22486ef7f47cc1175b70c6e4e388  libcds-2.3.3.tar.gz
 4442b408eaea3c1e4aa2cf21da38aba9f0856b4b522b1c3d555c3251af62b04e  libcxx-7.1.0.tar.xz
@@ -73,6 +75,7 @@ c48450d27524c2e5856997133e059e3cf9909241110a6e21ad278890ac425afc  lz4-r130.tar.g
 0b7a3e5e59c34827fe0c3a74b7ec8baef302b98fa80088d7f9153aa16fa76bd1  openssl-1.1.1l.tar.gz
 40dceb51a4f6a5275bde0e6bf20ef4b91bfc32ed57c0552e2e8e15463372b17a  openssl-1.1.1n.tar.gz
 9384a2b0570dd80358841464677115df785edb941c71211f75076d72fe6b438f  openssl-1.1.1o.tar.gz
+6c13d2bf38fdf31eac3ce2a347073673f5d63263398f1f69d0df4a41253e4b3e  openssl-3.0.8.tar.gz
 c28dba8782da2cfea1e11c61d335958c31a9c1bc553063546af9cbe98f204092  protobuf-3.5.1.tar.gz
 05e28e5141c1962b1c9d8793cc9cfee8cd11bc24cea13fb9689ac3fc0a379bd3  protobuf-3.5.1-yb-1.tar.gz
 ecff26c4f01c7904abff431b07b09f7c3837d3c2861cdc95ba6f0272d84a8e17  rapidjson-1.1.0-yb-1.zip