Re: [Buildroot] Build host-cmake with OpenSSL?

From: Thomas Petazzoni via buildroot <buildroot@buildroot.org>
To: Michael Ratzel <michael.ratzel@phoenixwings.com>
Cc: "buildroot@buildroot.org" <buildroot@buildroot.org>
Subject: Re: [Buildroot] Build host-cmake with OpenSSL?
Date: Tue, 6 Oct 2026 16:34:43 +0200	[thread overview]
Message-ID: <asUF2a3y-jrYlRd4@windsurf> (raw)
In-Reply-To: <VI1P193MB07827A8170CCBBF9ACFD6BE6E1962@VI1P193MB0782.EURP193.PROD.OUTLOOK.COM>

Hello Michael,

On Mon, Oct 05, 2026 at 03:27:54PM +0000, Michael Ratzel wrote:

> I personally believe it will be beneficial to allow host-cmake to
> download from https sources in some way. What do you think is the
> correct way forward? I am willing to invest time into implementing a
> solution for this, but I will require some guidance, or even better
> an example of a similar solution, to be able to help efficiently.

Thanks for your e-mail and proposal. However it is not beneficial at
all to allow host-cmake to download from https sources, quite the
opposite.

Indeed, if you allow random stuff to be downloaded during the build,
you:

- Break the hash integrity checking that Buildroot is doing on
  downloaded artefacts.

- Break the ability to guarantee the ability to run an offline build
  after "make source"

- Break the legal-info support, as when running "make legal-info",
  you're not collecting the full source code and license terms of
  software components that go into your build.

So it is actually a great thing that our host-cmake is built without
OpenSSL support, so that we can detect packages that download stuff
during their build and fix them.

So the proper solution is one of those two options:

- Adjust your Buildroot package .mk file so that it downloads all
  files that are needed for your package to build. See for example
  package/asterisk/asterisk.mk that does this.

- Modify your upstream package build logic so that as an alternative
  to downloading/building the third-party component, it allows it to
  be provided externally, and therefore built by a separate Buildroot
  package.

Both of those solutions require a bit of effort, but they guarantee
the proper functionality of hash integrity checking, offline builds
and legal information collection.

Let us know what you think!

Best regards,

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot