Re: [BUG] bpftool: Build failure due to opensslv.h

[Quentin Monnet <qmo@kernel.org>]

2025-11-19 17:56 UTC-0800 ~ Namhyung Kim <namhyung@kernel.org>
> Hello,
> 
> On Tue, Oct 28, 2025 at 10:20:22AM +0000, Alan Maguire wrote:
>> On 28/10/2025 09:05, Quentin Monnet wrote:
>>> 2025-10-27 11:27 UTC-0700 ~ Namhyung Kim <namhyung@kernel.org>
>>>> On Mon, Oct 27, 2025 at 11:41:01AM +0000, Quentin Monnet wrote:
>>>>> 2025-10-26 21:01 UTC-0700 ~ Namhyung Kim <namhyung@kernel.org>
>>>>>> Hello,
>>>>>>
>>>>>> I'm seeing a build failure like below in Fedora 40 and others.  I'm not
>>>>>> sure if it's reported already but it failed to build perf tools due to
>>>>>> errors in the bootstrap bpftool.
>>>>>>
>>>>>>     CC      /build/util/bpf_skel/.tmp/bootstrap/sign.o
>>>>>>   sign.c:16:10: fatal error: openssl/opensslv.h: No such file or directory
>>>>>>      16 | #include <openssl/opensslv.h>
>>>>>>         |          ^~~~~~~~~~~~~~~~~~~~
>>>>>>   compilation terminated.
>>>>>>   make[3]: *** [Makefile:256: /build/util/bpf_skel/.tmp/bootstrap/sign.o] Error 1
>>>>>>   make[3]: *** Waiting for unfinished jobs....
>>>>>>   make[2]: *** [Makefile.perf:1213: /build/util/bpf_skel/.tmp/bootstrap/bpftool] Error 2
>>>>>>   make[1]: *** [Makefile.perf:289: sub-make] Error 2
>>>>>>   make: *** [Makefile:76: all] Error 2
>>>>>>
>>>>>> I think it's from the recent signing change.  I'm not familiar with
>>>>>> openssl but I guess there's a proper feature check for it.  Is this a
>>>>>> known issue?
>>>>>
>>>>>
>>>>> Hi Namhyung,
>>>>
>>>> Hello!
>>>>
>>>>>
>>>>> This looks related to the program signing change indeed, commit
>>>>> 40863f4d6ef2 ("bpftool: Add support for signing BPF programs")
>>>>> introduced a dependency on OpenSSL's development headers for bpftool.
>>>>> It's not gated behind a feature check. On Fedora, I think the headers
>>>>> come with openssl-devel, do you have this package installed?
>>>>
>>>> No I don't, but I guess it should be able to build on such systems.  Or
>>>> is it required for bpftool?  Anyway I feel like it should have a feature
>>>> check and appropriate error messages.
>>>>
>>>
>>> +Cc KP
>>>
>>> We usually have feature checks when optional features bring in new
>>> dependencies for bpftool, but we haven't discussed it this time. My
>>> understanding was that program signing is important enough that it
>>> should always be present in newer versions of bpftool, making OpenSSL
>>> one of the required dependencies going forward.
>>>
>>> We don't currently have feature checks to tell when required
>>> dependencies are missing for bpftool (it's just the build failing, in
>>> that case). I know perf does a great job at it, we could look into it
>>> for bpftool, too.
>>>
>>
>> One issue here is that some distros package openssl v3 such that the
>> #include files are in /usr/include/openssl3 and libraries in
>> /usr/lib64/openssl3 so that older versions can co-exist. Maybe we could
>> figure out a feature test that handles that too?
> 
> What's the state of this?  Is the fix in the bpf tree now?


Hi Namhyung, Alan just submitted a v2 of his patch (targetting
bpf-next), see:

https://lore.kernel.org/all/20251120084754.640405-2-alan.maguire@oracle.com/

Quentin