Re: [Buildroot] Build host-cmake with OpenSSL?

[Thomas Perale via buildroot <buildroot@buildroot.org>]

Hi Michael,

In reply of:
> Hi everyone,
> 
> I recently ran into an issue where I wanted to build a 3rd party library as a
> target-package with buildroot 2026.08. The libraries build system uses the
> file(DOWNLOAD ...) CMake command with a https URL. But the host-cmake is
> built with OpenSSL support explicitly deactivated since 2017 (commit
> f87138339b17bc2b1d84c59ea176abb941413550). Therefore, the downloading fails.
> Fun fact: with buildroot 2025.02 and its older CMake version, the download
> still works.

If you want to download additional file that are required by your build you can
use the `<pkg>_EXTRA_DOWNLOADS` variable [1] and a pre-build hook to place them
at the correct location required in the build step.

I don't know if CMake `file(DOWNLOAD ...)` will not run if the file is already
present. If it still tries to download something unless there is an option to
pass to CMake to skip them you probably have to remove those CMake lines in a
patch for you Buildroot package.

[1] https://buildroot.org/downloads/manual/manual.html#generic-package-reference

> 
> Now I am not quite sure how to proceed.
> - My first approach was to plainly revert the 2017 commit. This solves my
> download problem, but I do not think this is a good way, as there was a valid
> reason OpenSSL was deactivated in the first place.
> - Patching the build system of the library. Afaik this is not a simple patch
> and has to be redone for every package. Simple and hacky things, like trying
> to tell CMake to ignore the encryption, by passing TLS_VERIFY OFF to the
> file() call, or by altering the download URL from https to https, did not
> work for me. Me next step in this direction would be to replace the
> file(DOWNLOAD ...) with a script, that downloads and decompresses the files
> with tools like wget and xz.

The `EXTRA_DOWNLOADS` variable kinda perform what you are describing here.
If the address of the assets you need to download is fixed then it will
probably work for your case.
It also makes sure it's ran during the "download" step which is important.

> - Adding some sort of configuration option to let the user decide if they
> want to build host-cmake with or without OpenSSL. I looked for a few hours on
> how to do that properly. I add a patch with a suggestion to this mail, but I
> do not think this will be the final solution. Maybe it would be even better
> to add some sort of host-openssl as a dependency of host-cmake?
> 
> I personally believe it will be beneficial to allow host-cmake to download
> from https sources in some way. What do you think is the correct way forward?
> I am willing to invest time into implementing a solution for this, but I will
> require some guidance, or even better an example of a similar solution, to be
> able to help efficiently.

I think it's best to avoid having anything downloaded during the 'build' step.
In air-gapped env all the sources needs to be cached to proceed to build the
packages and such a mechanisms that tries to download something during the
download would break this.

I hope this will help you with your issue,
Best regards,
PERALE Thomas
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot