[Buildroot] Build host-cmake with OpenSSL?

[Buildroot] Build host-cmake with OpenSSL?

[Michael Ratzel]

Hi everyone,

I recently ran into an issue where I wanted to build a 3rd party library as a target-package with buildroot 2026.08. The libraries build system uses the file(DOWNLOAD ...) CMake command with a https URL. But the host-cmake is built with OpenSSL support explicitly deactivated since 2017 (commit f87138339b17bc2b1d84c59ea176abb941413550). Therefore, the downloading fails. Fun fact: with buildroot 2025.02 and its older CMake version, the download still works.

Now I am not quite sure how to proceed.
- My first approach was to plainly revert the 2017 commit. This solves my download problem, but I do not think this is a good way, as there was a valid reason OpenSSL was deactivated in the first place.
- Patching the build system of the library. Afaik this is not a simple patch and has to be redone for every package. Simple and hacky things, like trying to tell CMake to ignore the encryption, by passing TLS_VERIFY OFF to the file() call, or by altering the download URL from https to https, did not work for me. Me next step in this direction would be to replace the file(DOWNLOAD ...) with a script, that downloads and decompresses the files with tools like wget and xz.
- Adding some sort of configuration option to let the user decide if they want to build host-cmake with or without OpenSSL. I looked for a few hours on how to do that properly. I add a patch with a suggestion to this mail, but I do not think this will be the final solution. Maybe it would be even better to add some sort of host-openssl as a dependency of host-cmake?

I personally believe it will be beneficial to allow host-cmake to download from https sources in some way. What do you think is the correct way forward? I am willing to invest time into implementing a solution for this, but I will require some guidance, or even better an example of a similar solution, to be able to help efficiently.

Best regards

Michael Ratzel

diff --git a/package/cmake/Config.in.host b/package/cmake/Config.in.host
index b8221a7d22..b2900ee6e3 100644
--- a/package/cmake/Config.in.host
+++ b/package/cmake/Config.in.host
@@ -10,6 +10,14 @@ config BR2_PACKAGE_HOST_CMAKE
 
          http://www.cmake.org/
 
+if BR2_PACKAGE_HOST_CMAKE
+config BR2_PACKAGE_HOST_CMAKE_USE_OPENSSL
+       bool "use openssl
+       help
+         Host CMake will be build with OpenSSL support active. To allow downloading from https sources.
+
+endif
+
 # The minimum system cmake version we expect if 3.18 as provided by
 # Debian bullseye, that we use in our reference build docker image.
 config BR2_HOST_CMAKE_AT_LEAST_3_19
diff --git a/package/cmake/cmake.mk b/package/cmake/cmake.mk
index 007a1efa0b..3f769782c4 100644
--- a/package/cmake/cmake.mk
+++ b/package/cmake/cmake.mk
@@ -50,6 +50,12 @@ HOST_CMAKE_CONFIGURE_OPTS = \
        GCC="$(HOSTCC_NOCCACHE)" \
        CXX="$(HOSTCXX_NOCCACHE)"
 
+ifeq ($(BR2_PACKAGE_HOST_CMAKE_USE_OPENSSL),y)
+HOST_CMAKE_USE_OPENSSL = ON
+else
+HOST_CMAKE_USE_OPENSSL = OFF
+endif
+
 define HOST_CMAKE_CONFIGURE_CMDS
        (cd $(@D); \
                $(HOST_CMAKE_CONFIGURE_OPTS) \
@@ -59,7 +65,7 @@ define HOST_CMAKE_CONFIGURE_CMDS
                        -DCMAKE_C_FLAGS="$(HOST_CMAKE_CFLAGS)" \
                        -DCMAKE_CXX_FLAGS="$(HOST_CMAKE_CXXFLAGS)" \
                        -DCMAKE_EXE_LINKER_FLAGS="$(HOST_LDFLAGS)" \
-                       -DCMAKE_USE_OPENSSL:BOOL=OFF \
+                       -DCMAKE_USE_OPENSSL:BOOL=$(HOST_CMAKE_USE_OPENSSL) \
                        -DBUILD_CursesDialog=OFF \
        )
 endef
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] Build host-cmake with OpenSSL?

[Thomas Petazzoni via buildroot]

Hello Michael,

On Mon, Oct 05, 2026 at 03:27:54PM +0000, Michael Ratzel wrote:

> I personally believe it will be beneficial to allow host-cmake to
> download from https sources in some way. What do you think is the
> correct way forward? I am willing to invest time into implementing a
> solution for this, but I will require some guidance, or even better
> an example of a similar solution, to be able to help efficiently.

Thanks for your e-mail and proposal. However it is not beneficial at
all to allow host-cmake to download from https sources, quite the
opposite.

Indeed, if you allow random stuff to be downloaded during the build,
you:

- Break the hash integrity checking that Buildroot is doing on
  downloaded artefacts.

- Break the ability to guarantee the ability to run an offline build
  after "make source"

- Break the legal-info support, as when running "make legal-info",
  you're not collecting the full source code and license terms of
  software components that go into your build.

So it is actually a great thing that our host-cmake is built without
OpenSSL support, so that we can detect packages that download stuff
during their build and fix them.

So the proper solution is one of those two options:

- Adjust your Buildroot package .mk file so that it downloads all
  files that are needed for your package to build. See for example
  package/asterisk/asterisk.mk that does this.

- Modify your upstream package build logic so that as an alternative
  to downloading/building the third-party component, it allows it to
  be provided externally, and therefore built by a separate Buildroot
  package.

Both of those solutions require a bit of effort, but they guarantee
the proper functionality of hash integrity checking, offline builds
and legal information collection.

Let us know what you think!

Best regards,

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] Build host-cmake with OpenSSL?

[Thomas Perale via buildroot]

Hi Michael,

In reply of:
> Hi everyone,
> 
> I recently ran into an issue where I wanted to build a 3rd party library as a
> target-package with buildroot 2026.08. The libraries build system uses the
> file(DOWNLOAD ...) CMake command with a https URL. But the host-cmake is
> built with OpenSSL support explicitly deactivated since 2017 (commit
> f87138339b17bc2b1d84c59ea176abb941413550). Therefore, the downloading fails.
> Fun fact: with buildroot 2025.02 and its older CMake version, the download
> still works.

If you want to download additional file that are required by your build you can
use the `<pkg>_EXTRA_DOWNLOADS` variable [1] and a pre-build hook to place them
at the correct location required in the build step.

I don't know if CMake `file(DOWNLOAD ...)` will not run if the file is already
present. If it still tries to download something unless there is an option to
pass to CMake to skip them you probably have to remove those CMake lines in a
patch for you Buildroot package.

[1] https://buildroot.org/downloads/manual/manual.html#generic-package-reference

> 
> Now I am not quite sure how to proceed.
> - My first approach was to plainly revert the 2017 commit. This solves my
> download problem, but I do not think this is a good way, as there was a valid
> reason OpenSSL was deactivated in the first place.
> - Patching the build system of the library. Afaik this is not a simple patch
> and has to be redone for every package. Simple and hacky things, like trying
> to tell CMake to ignore the encryption, by passing TLS_VERIFY OFF to the
> file() call, or by altering the download URL from https to https, did not
> work for me. Me next step in this direction would be to replace the
> file(DOWNLOAD ...) with a script, that downloads and decompresses the files
> with tools like wget and xz.

The `EXTRA_DOWNLOADS` variable kinda perform what you are describing here.
If the address of the assets you need to download is fixed then it will
probably work for your case.
It also makes sure it's ran during the "download" step which is important.

> - Adding some sort of configuration option to let the user decide if they
> want to build host-cmake with or without OpenSSL. I looked for a few hours on
> how to do that properly. I add a patch with a suggestion to this mail, but I
> do not think this will be the final solution. Maybe it would be even better
> to add some sort of host-openssl as a dependency of host-cmake?
> 
> I personally believe it will be beneficial to allow host-cmake to download
> from https sources in some way. What do you think is the correct way forward?
> I am willing to invest time into implementing a solution for this, but I will
> require some guidance, or even better an example of a similar solution, to be
> able to help efficiently.

I think it's best to avoid having anything downloaded during the 'build' step.
In air-gapped env all the sources needs to be cached to proceed to build the
packages and such a mechanisms that tries to download something during the
download would break this.

I hope this will help you with your issue,
Best regards,
PERALE Thomas
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot