Skip to content

systemd: add openssl as explicit buildInput#370076

Merged
ElvishJerricco merged 1 commit intoNixOS:stagingfrom
Shawn8901:fix-systemd-openssl
Jan 5, 2025
Merged

systemd: add openssl as explicit buildInput#370076
ElvishJerricco merged 1 commit intoNixOS:stagingfrom
Shawn8901:fix-systemd-openssl

Conversation

@Shawn8901
Copy link
Contributor

@Shawn8901 Shawn8901 commented Jan 2, 2025

fixes #369446

openssl is propagated by libfido2, which breaks systemd compliation in case fido support is disabled.

importd should enable openssl if gcrypt is disabled https://github.com/systemd/systemd/blob/89c4fe6c211d5e9cb380329f638609dec26bed0a/meson.build#L1637

I am still building, tho i already wanted to create the pr to gather feedback from the issue creator. Aside already that every feedback is welcome.

Things done

  • Built on platform(s)
    • x86_64-linux
    • aarch64-linux
    • x86_64-darwin
    • aarch64-darwin
  • For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
    • sandbox = relaxed
    • sandbox = true
  • Tested, as applicable:
  • Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
  • Tested basic functionality of all binary files (usually in ./result/bin/)
  • 25.05 Release Notes (or backporting 24.11 and 25.05 Release notes)
    • (Package updates) Added a release notes entry if the change is major or breaking
    • (Module updates) Added a release notes entry if the change is significant
    • (Module addition) Added a release notes entry if adding a new NixOS module
  • Fits CONTRIBUTING.md.

Add a 👍 reaction to pull requests you find important.

@github-actions github-actions bot added the 6.topic: systemd Software suite that provides an array of system components for Linux operating systems. label Jan 2, 2025
@ambroisie
Copy link
Contributor

The condition for openssl is quite complicated IMO, could it get factorized to a single place (either a local variable, or a new with* option, in the latter case with assertions for incompatible options)?

@Shawn8901
Copy link
Contributor Author

Shawn8901 commented Jan 2, 2025

or a new with* option, in the latter case with assertions for incompatible options

So that we assert, that when withHomed is true, we need to have set withOpenSSL?

@ambroisie
Copy link
Contributor

If I understand correctly, something like:

assert withHomed -> withOpenssl;
assert withFido2 -> withOpenssl;
assert withSysupdate -> withOpenssl;
assert withImportd -> (wantGcrypt || withOpenssl);
assert withOpenssl -> !wantGcrypt;

Or something like that.

@Shawn8901 Shawn8901 force-pushed the fix-systemd-openssl branch from 06e7dbd to 55d9068 Compare January 2, 2025 22:16
@github-actions github-actions bot added 10.rebuild-darwin: 1-10 This PR causes between 1 and 10 packages to rebuild on Darwin. 10.rebuild-linux: 5001+ This PR causes many rebuilds on Linux and must target the staging branches. labels Jan 2, 2025
@nix-owners nix-owners bot requested review from flokli and kloenk January 2, 2025 22:25
Copy link
Contributor

@ambroisie ambroisie left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are withGcrypt = true and withOpenssl = true compatible?

@Shawn8901
Copy link
Contributor Author

Shawn8901 commented Jan 2, 2025

Applied that refactor.

While checking the meson.build i did not find any evidence that resolved actually requires gcrypt ( https://github.com/systemd/systemd/blob/89c4fe6c211d5e9cb380329f638609dec26bed0a/meson.build#L3110 ), tho i have removed that.

(edit: The meson file also states kinda that both gcrypt and openssl are supported, tho gcrypt is preferred when available https://github.com/systemd/systemd/blob/89c4fe6c211d5e9cb380329f638609dec26bed0a/meson.build#L1537 )

Importd supports both openssl or gcrypt according the meson.build ( https://github.com/systemd/systemd/blob/89c4fe6c211d5e9cb380329f638609dec26bed0a/meson.build#L1639 )

So i switched the gcrypt to a withGcrypt to comply with the other options.

@Shawn8901 Shawn8901 marked this pull request as ready for review January 4, 2025 18:37
@Shawn8901
Copy link
Contributor Author

i has build my system with that and the over-written config from the related issue (minus coredump support, which i kept enabled). Seeing no issue with my build, so i am undrafting.

Copy link
Contributor

@ElvishJerricco ElvishJerricco left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm pretty sure systemdMinimal needs to set withOpenssl = false; and withGcrypt = false;, right?

@Shawn8901 Shawn8901 force-pushed the fix-systemd-openssl branch from 55d9068 to 52017a4 Compare January 5, 2025 02:11
@Shawn8901
Copy link
Contributor Author

I'm pretty sure systemdMinimal needs to set withOpenssl = false; and withGcrypt = false;, right?

seems absolutely reasonable. amended that into the commit.

@ElvishJerricco ElvishJerricco merged commit 130c348 into NixOS:staging Jan 5, 2025
21 of 25 checks passed
@Shawn8901 Shawn8901 deleted the fix-systemd-openssl branch January 5, 2025 09:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

6.topic: systemd Software suite that provides an array of system components for Linux operating systems. 10.rebuild-darwin: 1-10 This PR causes between 1 and 10 packages to rebuild on Darwin. 10.rebuild-linux: 5001+ This PR causes many rebuilds on Linux and must target the staging branches.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants