"openssl" should not be optional

From: Christoph Berg <myon(at)debian(dot)org>
To: PostgreSQL Hackers <pgsql-hackers(at)lists(dot)postgresql(dot)org>
Subject: "openssl" should not be optional
Date: 2025-09-24 11:14:47
Message-ID: aNPSp1-RIAs3skZm@msg.df7cb.de
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

Debian's reproducible-builds machinery has discovered a problem in the
SSL tests: When building with SSL support, but /usr/bin/openssl
missing (i.e "libssl-dev" installed, but "openssl" missing), the tests
fail in subtle ways:

checking for openssl... no
configure: using openssl: openssl not found
checking for openssl/ssl.h... yes
checking for openssl/err.h... yes

build/src/test/ssl/tmp_check/log/regress_log_001_ssltests:
Can't exec "x509": No such file or directory at t/001_ssltests.pl line 751.
couldn't run " x509" to get client cert serialno at t/001_ssltests.pl line 775.

build/src/test/ssl/tmp_check/log/regress_log_003_sslinfo:
[08:42:02.209](0.029s) ok 11 - ssl_client_serial() compared with pg_stat_ssl
psql:<stdin>:1: ERROR: invalid X.509 field name: "invalid"
[08:42:02.238](0.029s) ok 12 - ssl_client_dn_field() for an invalid field

Full build log: https://reproduce.debian.net/amd64-pull184/api/v1/builds/66623/log

The problem does not show up on the normal Debian build daemons. While
the build environment there is fairly minimal, it does have "openssl"
preinstalled. So I cannot yet say if this problem is new in PG18, or
just never got detected in older branches.

While it is probably possible to skip the tests when the configure
probe did not find the openssl binary, IMHO the configure check should
already fail. That's more robust and easier.

Attached is a WIP patch that implements that for autoconf.

Christoph

Attachment Content-Type Size
v1-0001-openssl-should-not-be-optional.patch text/x-diff 1.2 KB

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Amit Kapila 2025-09-24 11:20:55 Re: Newly created replication slot may be invalidated by checkpoint
Previous Message Andrew Dunstan 2025-09-24 11:12:44 Re: REPACK and naming