Re: [PATCH bpf-next] bpftool: Resolve libcrypto link flags via pkg-config

[Quentin Monnet <qmo@kernel.org>]

2026-05-01 17:58 UTC+0000 ~ hadrien Patte <hadrien.patte@protonmail.com>
> From: Hadrien Patte <hadrien.patte@protonmail.com>
> 
> When building bpftool with EXTRA_LDFLAGS=-static on Ubuntu 26.04
> (OpenSSL 3.5.5), the link fails because libcrypto.a references
> libjitterentropy symbols, which are not on the link line:
> 
>   LINK     bpftool
>   /usr/bin/ld: libcrypto.a(libdefault-lib-seed_src_jitter.o):
>     in function `ossl_prov_acquire_entropy_from_jitter':
>     (.text+0x11c): undefined reference to `jent_entropy_collector_alloc'
>     (.text+0x130): undefined reference to `jent_read_entropy'
>     (.text+0x13c): undefined reference to `jent_entropy_collector_free'
>   /usr/bin/ld: libcrypto.a(libdefault-lib-seed_src_jitter.o):
>     in function `jitter_instantiate':
>     (.text+0x61c): undefined reference to `jent_entropy_init_ex'
>   collect2: error: ld returned 1 exit status
> 
> The set of transitive dependencies pulled in by libcrypto.a varies
> across distributions and OpenSSL builds (cf. commit 08a749184322
> ("bpftool: Fix dependencies for static build"), which addressed a
> similar libz ordering issue), so hard-coding them in the Makefile is
> fragile.
> 
> Resolve libcrypto's link flags via pkg-config, which knows about
> these transitive deps. Pass --static when the user requested a static
> build via EXTRA_LDFLAGS=-static so pkg-config emits the static link
> line (e.g. "-lcrypto -l:libjitterentropy.a -lz -lzstd -ldl -pthread"
> on Ubuntu 26.04). Fall back to -lcrypto if pkg-config or
> libcrypto.pc is unavailable, preserving the previous behavior on
> minimal build environments.
> 
> Signed-off-by: Hadrien Patte <hadrien.patte@protonmail.com>
> ---
>  tools/bpf/bpftool/Makefile | 12 +++++++++++-
>  1 file changed, 11 insertions(+), 1 deletion(-)
> 
> diff --git a/tools/bpf/bpftool/Makefile b/tools/bpf/bpftool/Makefile
> index 0febf60e1b64..d9ab860a6cce 100644
> --- a/tools/bpf/bpftool/Makefile
> +++ b/tools/bpf/bpftool/Makefile
> @@ -103,7 +103,17 @@ SKIP_LLVM ?=
>  SKIP_LIBBFD ?=
>  SKIP_CRYPTO ?=
>  ifneq ($(SKIP_CRYPTO),1)
> -  CRYPTO_LIBS := -lcrypto
> +  # Resolve libcrypto link flags via pkg-config so transitive dependencies
> +  # (e.g. libjitterentropy on distros where libcrypto.a references it) are
> +  # included for static builds. Pass --static when the user requested a
> +  # static build via EXTRA_LDFLAGS=-static. Fall back to -lcrypto if
> +  # pkg-config or libcrypto.pc is unavailable.
> +  ifneq ($(findstring -static,$(EXTRA_LDFLAGS)),)
> +    CRYPTO_LIBS := $(shell pkg-config --libs --static libcrypto 2>/dev/null)
> +  else
> +    CRYPTO_LIBS := $(shell pkg-config --libs libcrypto 2>/dev/null)
> +  endif
> +  CRYPTO_LIBS := $(if $(CRYPTO_LIBS),$(CRYPTO_LIBS),-lcrypto)
>  endif
>  
>  FEATURE_TESTS := clang-bpf-co-re


Thanks Hadrien,

The Makefile for bpftool is also used in the version mirrored on GitHub;
and so far it hasn't relied on pkg-config. So if we introduce pkg-config
in bpftool's Makefile, could we please make it optional, like the GitHub
version for libbpf's Makefile does?

See https://github.com/libbpf/libbpf/blob/master/src/Makefile#L46

Thanks,
Quentin