[BUG] bpftool: Build failure due to opensslv.h

[BUG] bpftool: Build failure due to opensslv.h

[Namhyung Kim]

Hello,

I'm seeing a build failure like below in Fedora 40 and others.  I'm not
sure if it's reported already but it failed to build perf tools due to
errors in the bootstrap bpftool.

    CC      /build/util/bpf_skel/.tmp/bootstrap/sign.o
  sign.c:16:10: fatal error: openssl/opensslv.h: No such file or directory
     16 | #include <openssl/opensslv.h>
        |          ^~~~~~~~~~~~~~~~~~~~
  compilation terminated.
  make[3]: *** [Makefile:256: /build/util/bpf_skel/.tmp/bootstrap/sign.o] Error 1
  make[3]: *** Waiting for unfinished jobs....
  make[2]: *** [Makefile.perf:1213: /build/util/bpf_skel/.tmp/bootstrap/bpftool] Error 2
  make[1]: *** [Makefile.perf:289: sub-make] Error 2
  make: *** [Makefile:76: all] Error 2

I think it's from the recent signing change.  I'm not familiar with
openssl but I guess there's a proper feature check for it.  Is this a
known issue?

Thanks,
Namhyung

Re: [BUG] bpftool: Build failure due to opensslv.h

[Quentin Monnet]

2025-10-26 21:01 UTC-0700 ~ Namhyung Kim <namhyung@kernel.org>
> Hello,
> 
> I'm seeing a build failure like below in Fedora 40 and others.  I'm not
> sure if it's reported already but it failed to build perf tools due to
> errors in the bootstrap bpftool.
> 
>     CC      /build/util/bpf_skel/.tmp/bootstrap/sign.o
>   sign.c:16:10: fatal error: openssl/opensslv.h: No such file or directory
>      16 | #include <openssl/opensslv.h>
>         |          ^~~~~~~~~~~~~~~~~~~~
>   compilation terminated.
>   make[3]: *** [Makefile:256: /build/util/bpf_skel/.tmp/bootstrap/sign.o] Error 1
>   make[3]: *** Waiting for unfinished jobs....
>   make[2]: *** [Makefile.perf:1213: /build/util/bpf_skel/.tmp/bootstrap/bpftool] Error 2
>   make[1]: *** [Makefile.perf:289: sub-make] Error 2
>   make: *** [Makefile:76: all] Error 2
> 
> I think it's from the recent signing change.  I'm not familiar with
> openssl but I guess there's a proper feature check for it.  Is this a
> known issue?


Hi Namhyung,

This looks related to the program signing change indeed, commit
40863f4d6ef2 ("bpftool: Add support for signing BPF programs")
introduced a dependency on OpenSSL's development headers for bpftool.
It's not gated behind a feature check. On Fedora, I think the headers
come with openssl-devel, do you have this package installed?

Best regards,
Quentin

Re: [BUG] bpftool: Build failure due to opensslv.h

[Namhyung Kim]

On Mon, Oct 27, 2025 at 11:41:01AM +0000, Quentin Monnet wrote:
> 2025-10-26 21:01 UTC-0700 ~ Namhyung Kim <namhyung@kernel.org>
> > Hello,
> > 
> > I'm seeing a build failure like below in Fedora 40 and others.  I'm not
> > sure if it's reported already but it failed to build perf tools due to
> > errors in the bootstrap bpftool.
> > 
> >     CC      /build/util/bpf_skel/.tmp/bootstrap/sign.o
> >   sign.c:16:10: fatal error: openssl/opensslv.h: No such file or directory
> >      16 | #include <openssl/opensslv.h>
> >         |          ^~~~~~~~~~~~~~~~~~~~
> >   compilation terminated.
> >   make[3]: *** [Makefile:256: /build/util/bpf_skel/.tmp/bootstrap/sign.o] Error 1
> >   make[3]: *** Waiting for unfinished jobs....
> >   make[2]: *** [Makefile.perf:1213: /build/util/bpf_skel/.tmp/bootstrap/bpftool] Error 2
> >   make[1]: *** [Makefile.perf:289: sub-make] Error 2
> >   make: *** [Makefile:76: all] Error 2
> > 
> > I think it's from the recent signing change.  I'm not familiar with
> > openssl but I guess there's a proper feature check for it.  Is this a
> > known issue?
> 
> 
> Hi Namhyung,

Hello!

> 
> This looks related to the program signing change indeed, commit
> 40863f4d6ef2 ("bpftool: Add support for signing BPF programs")
> introduced a dependency on OpenSSL's development headers for bpftool.
> It's not gated behind a feature check. On Fedora, I think the headers
> come with openssl-devel, do you have this package installed?

No I don't, but I guess it should be able to build on such systems.  Or
is it required for bpftool?  Anyway I feel like it should have a feature
check and appropriate error messages.

Thanks,
Namhyung

Re: [BUG] bpftool: Build failure due to opensslv.h

[Quentin Monnet]

2025-10-27 11:27 UTC-0700 ~ Namhyung Kim <namhyung@kernel.org>
> On Mon, Oct 27, 2025 at 11:41:01AM +0000, Quentin Monnet wrote:
>> 2025-10-26 21:01 UTC-0700 ~ Namhyung Kim <namhyung@kernel.org>
>>> Hello,
>>>
>>> I'm seeing a build failure like below in Fedora 40 and others.  I'm not
>>> sure if it's reported already but it failed to build perf tools due to
>>> errors in the bootstrap bpftool.
>>>
>>>     CC      /build/util/bpf_skel/.tmp/bootstrap/sign.o
>>>   sign.c:16:10: fatal error: openssl/opensslv.h: No such file or directory
>>>      16 | #include <openssl/opensslv.h>
>>>         |          ^~~~~~~~~~~~~~~~~~~~
>>>   compilation terminated.
>>>   make[3]: *** [Makefile:256: /build/util/bpf_skel/.tmp/bootstrap/sign.o] Error 1
>>>   make[3]: *** Waiting for unfinished jobs....
>>>   make[2]: *** [Makefile.perf:1213: /build/util/bpf_skel/.tmp/bootstrap/bpftool] Error 2
>>>   make[1]: *** [Makefile.perf:289: sub-make] Error 2
>>>   make: *** [Makefile:76: all] Error 2
>>>
>>> I think it's from the recent signing change.  I'm not familiar with
>>> openssl but I guess there's a proper feature check for it.  Is this a
>>> known issue?
>>
>>
>> Hi Namhyung,
> 
> Hello!
> 
>>
>> This looks related to the program signing change indeed, commit
>> 40863f4d6ef2 ("bpftool: Add support for signing BPF programs")
>> introduced a dependency on OpenSSL's development headers for bpftool.
>> It's not gated behind a feature check. On Fedora, I think the headers
>> come with openssl-devel, do you have this package installed?
> 
> No I don't, but I guess it should be able to build on such systems.  Or
> is it required for bpftool?  Anyway I feel like it should have a feature
> check and appropriate error messages.
> 

+Cc KP

We usually have feature checks when optional features bring in new
dependencies for bpftool, but we haven't discussed it this time. My
understanding was that program signing is important enough that it
should always be present in newer versions of bpftool, making OpenSSL
one of the required dependencies going forward.

We don't currently have feature checks to tell when required
dependencies are missing for bpftool (it's just the build failing, in
that case). I know perf does a great job at it, we could look into it
for bpftool, too.

Quentin

Re: [BUG] bpftool: Build failure due to opensslv.h

[Alan Maguire]

On 28/10/2025 09:05, Quentin Monnet wrote:
> 2025-10-27 11:27 UTC-0700 ~ Namhyung Kim <namhyung@kernel.org>
>> On Mon, Oct 27, 2025 at 11:41:01AM +0000, Quentin Monnet wrote:
>>> 2025-10-26 21:01 UTC-0700 ~ Namhyung Kim <namhyung@kernel.org>
>>>> Hello,
>>>>
>>>> I'm seeing a build failure like below in Fedora 40 and others.  I'm not
>>>> sure if it's reported already but it failed to build perf tools due to
>>>> errors in the bootstrap bpftool.
>>>>
>>>>     CC      /build/util/bpf_skel/.tmp/bootstrap/sign.o
>>>>   sign.c:16:10: fatal error: openssl/opensslv.h: No such file or directory
>>>>      16 | #include <openssl/opensslv.h>
>>>>         |          ^~~~~~~~~~~~~~~~~~~~
>>>>   compilation terminated.
>>>>   make[3]: *** [Makefile:256: /build/util/bpf_skel/.tmp/bootstrap/sign.o] Error 1
>>>>   make[3]: *** Waiting for unfinished jobs....
>>>>   make[2]: *** [Makefile.perf:1213: /build/util/bpf_skel/.tmp/bootstrap/bpftool] Error 2
>>>>   make[1]: *** [Makefile.perf:289: sub-make] Error 2
>>>>   make: *** [Makefile:76: all] Error 2
>>>>
>>>> I think it's from the recent signing change.  I'm not familiar with
>>>> openssl but I guess there's a proper feature check for it.  Is this a
>>>> known issue?
>>>
>>>
>>> Hi Namhyung,
>>
>> Hello!
>>
>>>
>>> This looks related to the program signing change indeed, commit
>>> 40863f4d6ef2 ("bpftool: Add support for signing BPF programs")
>>> introduced a dependency on OpenSSL's development headers for bpftool.
>>> It's not gated behind a feature check. On Fedora, I think the headers
>>> come with openssl-devel, do you have this package installed?
>>
>> No I don't, but I guess it should be able to build on such systems.  Or
>> is it required for bpftool?  Anyway I feel like it should have a feature
>> check and appropriate error messages.
>>
> 
> +Cc KP
> 
> We usually have feature checks when optional features bring in new
> dependencies for bpftool, but we haven't discussed it this time. My
> understanding was that program signing is important enough that it
> should always be present in newer versions of bpftool, making OpenSSL
> one of the required dependencies going forward.
> 
> We don't currently have feature checks to tell when required
> dependencies are missing for bpftool (it's just the build failing, in
> that case). I know perf does a great job at it, we could look into it
> for bpftool, too.
>

One issue here is that some distros package openssl v3 such that the
#include files are in /usr/include/openssl3 and libraries in
/usr/lib64/openssl3 so that older versions can co-exist. Maybe we could
figure out a feature test that handles that too?

Alan

Re: [BUG] bpftool: Build failure due to opensslv.h

[Namhyung Kim]

On Tue, Oct 28, 2025 at 10:05:52AM +0100, Quentin Monnet wrote:
> 2025-10-27 11:27 UTC-0700 ~ Namhyung Kim <namhyung@kernel.org>
> > On Mon, Oct 27, 2025 at 11:41:01AM +0000, Quentin Monnet wrote:
> >> 2025-10-26 21:01 UTC-0700 ~ Namhyung Kim <namhyung@kernel.org>
> >>> Hello,
> >>>
> >>> I'm seeing a build failure like below in Fedora 40 and others.  I'm not
> >>> sure if it's reported already but it failed to build perf tools due to
> >>> errors in the bootstrap bpftool.
> >>>
> >>>     CC      /build/util/bpf_skel/.tmp/bootstrap/sign.o
> >>>   sign.c:16:10: fatal error: openssl/opensslv.h: No such file or directory
> >>>      16 | #include <openssl/opensslv.h>
> >>>         |          ^~~~~~~~~~~~~~~~~~~~
> >>>   compilation terminated.
> >>>   make[3]: *** [Makefile:256: /build/util/bpf_skel/.tmp/bootstrap/sign.o] Error 1
> >>>   make[3]: *** Waiting for unfinished jobs....
> >>>   make[2]: *** [Makefile.perf:1213: /build/util/bpf_skel/.tmp/bootstrap/bpftool] Error 2
> >>>   make[1]: *** [Makefile.perf:289: sub-make] Error 2
> >>>   make: *** [Makefile:76: all] Error 2
> >>>
> >>> I think it's from the recent signing change.  I'm not familiar with
> >>> openssl but I guess there's a proper feature check for it.  Is this a
> >>> known issue?
> >>
> >>
> >> Hi Namhyung,
> > 
> > Hello!
> > 
> >>
> >> This looks related to the program signing change indeed, commit
> >> 40863f4d6ef2 ("bpftool: Add support for signing BPF programs")
> >> introduced a dependency on OpenSSL's development headers for bpftool.
> >> It's not gated behind a feature check. On Fedora, I think the headers
> >> come with openssl-devel, do you have this package installed?
> > 
> > No I don't, but I guess it should be able to build on such systems.  Or
> > is it required for bpftool?  Anyway I feel like it should have a feature
> > check and appropriate error messages.
> > 
> 
> +Cc KP
> 
> We usually have feature checks when optional features bring in new
> dependencies for bpftool, but we haven't discussed it this time. My
> understanding was that program signing is important enough that it
> should always be present in newer versions of bpftool, making OpenSSL
> one of the required dependencies going forward.

Yeah, the problem is that it also affects to perf build.

> 
> We don't currently have feature checks to tell when required
> dependencies are missing for bpftool (it's just the build failing, in
> that case). I know perf does a great job at it, we could look into it
> for bpftool, too.

It's in the tools/build directory. :)

Thanks,
Namhyung