OPENSSL_STATIC from openssl-sys is not respected

[rajivshah3]

Thanks for including openssl-sys! It makes our lives easier as we're building an app for macOS, Windows, and Linux and setting the environment variables can get annoying 😄 . However, we also need to be able to link statically, but paho-mqtt seems to keep linking OpenSSL dynamically. openssl-sys allows us to use static linking by setting OPENSSL_STATIC=1 which works fine for rust-openssl's systest, for example:

However, when building the example project with OPENSSL_STATIC=1, OpenSSL is still dynamically linked:

If I had to take a guess, it seems like OpenSSL is getting linked twice (dynamically and statically), but I haven't looked into the issue fully yet. Is this code necessary now that the linking is handled by openssl-sys?

https://github.com/eclipse/paho.mqtt.rust/blob/798b151fa6c1ff1df0f18f90c8f98633ee29825f/paho-mqtt-sys/build.rs#L269-L292

[svanharmelen]

Hi @rajivshah3, you need to use/enable the vendored-ssl feature to make sure OpenSSL is statically linked: https://github.com/eclipse/paho.mqtt.rust#linking-openssl-statically

[rajivshah3]

Thanks, I saw that but I think it may complicate things for us. The docs for openssl-sys mention this:

The vendored copy will not be configured to automatically find the system's root certificates, but the openssl-probe crate can be used to do that instead.

openssl-sys seems to distinguish between static linking and the vendored version, so it seems like you can statically link with an existing OpenSSL library. Is this not possible when used by paho-mqtt?

[svanharmelen]

Ah, I see... Must admit that I'm not sure about that one without have a closer look first...

[fpagliughi]

Yes, I noticed that, too, the other day. The behavior should be consistent, and we should not have to build the vendored SSL to get static linking,

[fpagliughi]

It looks like this is an issue with the openssl-sys build. There are a few mentions on the Internet:

sfackler/rust-openssl#183

https://users.rust-lang.org/t/how-to-link-openssl-statically/14912/17

https://stackoverflow.com/questions/49263452/how-do-i-statically-link-the-openssl-sys-crate-into-a-shared-library

It seems that if openssl-sys finds the library via the package manager, then the build script drops out before checking OPENSSL_STATIC. But a workaround may be possible, as from the docs:

If OPENSSL_DIR or OPENSSL_LIB_DIR and OPENSSL_INCLUDE_DIR is specified, then the build script will skip the pkg-config step.

Although it's not clear if that will fix things or create other problems.

[fpagliughi]

Oops. Looks like there's more I need to do as well. From the current build, even when OPENSSL_STATIC=1:

[paho-mqtt-sys 0.6.0] cargo:rustc-link-lib=ssl
[paho-mqtt-sys 0.6.0] cargo:rustc-link-lib=crypto
[paho-mqtt-sys 0.6.0] cargo:rustc-link-lib=static=paho-mqtt3as

Despite the openssl-sys doing it correctly, if the

[openssl-sys 0.9.72] X86_64_UNKNOWN_LINUX_GNU_OPENSSL_STATIC unset
[openssl-sys 0.9.72] cargo:rerun-if-env-changed=OPENSSL_STATIC
[openssl-sys 0.9.72] OPENSSL_STATIC = 1
[openssl-sys 0.9.72] cargo:rustc-link-lib=static=ssl
[openssl-sys 0.9.72] cargo:rustc-link-lib=static=crypto

Seems that the build for the paho library needs to check the flag as well and add the static linkage.