Re: [BUG] bpftool: Build failure due to opensslv.h

[Namhyung Kim <namhyung@kernel.org>]

On Thu, Nov 27, 2025 at 05:44:47PM +0000, Quentin Monnet wrote:
> 2025-11-26 10:33 UTC-0800 ~ Namhyung Kim <namhyung@kernel.org>
> > Hello,
> > 
> > On Tue, Nov 25, 2025 at 09:03:38AM +0000, Alan Maguire wrote:
> >> On 24/11/2025 20:42, Namhyung Kim wrote:
> >>> On Thu, Nov 20, 2025 at 09:24:49AM +0000, Quentin Monnet wrote:
> >>>> 2025-11-19 17:56 UTC-0800 ~ Namhyung Kim <namhyung@kernel.org>
> >>>>> Hello,
> >>>>>
> >>>>> On Tue, Oct 28, 2025 at 10:20:22AM +0000, Alan Maguire wrote:
> >>>>>> On 28/10/2025 09:05, Quentin Monnet wrote:
> >>>>>>> 2025-10-27 11:27 UTC-0700 ~ Namhyung Kim <namhyung@kernel.org>
> >>>>>>>> On Mon, Oct 27, 2025 at 11:41:01AM +0000, Quentin Monnet wrote:
> >>>>>>>>> 2025-10-26 21:01 UTC-0700 ~ Namhyung Kim <namhyung@kernel.org>
> >>>>>>>>>> Hello,
> >>>>>>>>>>
> >>>>>>>>>> I'm seeing a build failure like below in Fedora 40 and others.  I'm not
> >>>>>>>>>> sure if it's reported already but it failed to build perf tools due to
> >>>>>>>>>> errors in the bootstrap bpftool.
> >>>>>>>>>>
> >>>>>>>>>>     CC      /build/util/bpf_skel/.tmp/bootstrap/sign.o
> >>>>>>>>>>   sign.c:16:10: fatal error: openssl/opensslv.h: No such file or directory
> >>>>>>>>>>      16 | #include <openssl/opensslv.h>
> >>>>>>>>>>         |          ^~~~~~~~~~~~~~~~~~~~
> >>>>>>>>>>   compilation terminated.
> >>>>>>>>>>   make[3]: *** [Makefile:256: /build/util/bpf_skel/.tmp/bootstrap/sign.o] Error 1
> >>>>>>>>>>   make[3]: *** Waiting for unfinished jobs....
> >>>>>>>>>>   make[2]: *** [Makefile.perf:1213: /build/util/bpf_skel/.tmp/bootstrap/bpftool] Error 2
> >>>>>>>>>>   make[1]: *** [Makefile.perf:289: sub-make] Error 2
> >>>>>>>>>>   make: *** [Makefile:76: all] Error 2
> >>>>>>>>>>
> >>>>>>>>>> I think it's from the recent signing change.  I'm not familiar with
> >>>>>>>>>> openssl but I guess there's a proper feature check for it.  Is this a
> >>>>>>>>>> known issue?
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>> Hi Namhyung,
> >>>>>>>>
> >>>>>>>> Hello!
> >>>>>>>>
> >>>>>>>>>
> >>>>>>>>> This looks related to the program signing change indeed, commit
> >>>>>>>>> 40863f4d6ef2 ("bpftool: Add support for signing BPF programs")
> >>>>>>>>> introduced a dependency on OpenSSL's development headers for bpftool.
> >>>>>>>>> It's not gated behind a feature check. On Fedora, I think the headers
> >>>>>>>>> come with openssl-devel, do you have this package installed?
> >>>>>>>>
> >>>>>>>> No I don't, but I guess it should be able to build on such systems.  Or
> >>>>>>>> is it required for bpftool?  Anyway I feel like it should have a feature
> >>>>>>>> check and appropriate error messages.
> >>>>>>>>
> >>>>>>>
> >>>>>>> +Cc KP
> >>>>>>>
> >>>>>>> We usually have feature checks when optional features bring in new
> >>>>>>> dependencies for bpftool, but we haven't discussed it this time. My
> >>>>>>> understanding was that program signing is important enough that it
> >>>>>>> should always be present in newer versions of bpftool, making OpenSSL
> >>>>>>> one of the required dependencies going forward.
> >>>>>>>
> >>>>>>> We don't currently have feature checks to tell when required
> >>>>>>> dependencies are missing for bpftool (it's just the build failing, in
> >>>>>>> that case). I know perf does a great job at it, we could look into it
> >>>>>>> for bpftool, too.
> >>>>>>>
> >>>>>>
> >>>>>> One issue here is that some distros package openssl v3 such that the
> >>>>>> #include files are in /usr/include/openssl3 and libraries in
> >>>>>> /usr/lib64/openssl3 so that older versions can co-exist. Maybe we could
> >>>>>> figure out a feature test that handles that too?
> >>>>>
> >>>>> What's the state of this?  Is the fix in the bpf tree now?
> >>>>
> >>>>
> >>>> Hi Namhyung, Alan just submitted a v2 of his patch (targetting
> >>>> bpf-next), see:
> >>>>
> >>>> https://lore.kernel.org/all/20251120084754.640405-2-alan.maguire@oracle.com/
> >>>  
> >>> Hello Quentin,
> >>>
> >>> I'm afraid it doesn't fix my issue.  It seems to fix another problem
> >>> about the error API.  But I still see the build failure.
> >>>
> >>
> >> This header file is delivered by openssl-devel (could be openssl-dev on
> >> some distros). Looking at [1], it seems like that package has been a
> >> requirement to build kernels from 4.3 on. Is it missing on your system,
> >> installed to an unusual path like /usr/include/opensslv3, or is the
> >> package perhaps missing some header files?
> > 
> > I think some of my test environments don't have openssl dev packages.
> > I didn't know it was required for kernel builds but it wasn't for perf.
> > If you guys require it for bpftool, maybe I can make perf disable BPF
> > support in case openssl is missing.
> 
> 
> Hi, yes OpenSSL is a required dependency for bpftool going forward,
> sorry to hear it doesn't work well with your environment. I think
> there's already an option to turn off BPF skeletons in perf, I'd try
> running the Makefile with BUILD_BPF_SKEL=0 maybe.

Yes, we have it.  Thanks for confirming.

Namhyung