[PATCH bpf-next] bpftool: Resolve libcrypto link flags via pkg-config

[PATCH bpf-next] bpftool: Resolve libcrypto link flags via pkg-config

[hadrien Patte]

From: Hadrien Patte <hadrien.patte@protonmail.com>

When building bpftool with EXTRA_LDFLAGS=-static on Ubuntu 26.04
(OpenSSL 3.5.5), the link fails because libcrypto.a references
libjitterentropy symbols, which are not on the link line:

  LINK     bpftool
  /usr/bin/ld: libcrypto.a(libdefault-lib-seed_src_jitter.o):
    in function `ossl_prov_acquire_entropy_from_jitter':
    (.text+0x11c): undefined reference to `jent_entropy_collector_alloc'
    (.text+0x130): undefined reference to `jent_read_entropy'
    (.text+0x13c): undefined reference to `jent_entropy_collector_free'
  /usr/bin/ld: libcrypto.a(libdefault-lib-seed_src_jitter.o):
    in function `jitter_instantiate':
    (.text+0x61c): undefined reference to `jent_entropy_init_ex'
  collect2: error: ld returned 1 exit status

The set of transitive dependencies pulled in by libcrypto.a varies
across distributions and OpenSSL builds (cf. commit 08a749184322
("bpftool: Fix dependencies for static build"), which addressed a
similar libz ordering issue), so hard-coding them in the Makefile is
fragile.

Resolve libcrypto's link flags via pkg-config, which knows about
these transitive deps. Pass --static when the user requested a static
build via EXTRA_LDFLAGS=-static so pkg-config emits the static link
line (e.g. "-lcrypto -l:libjitterentropy.a -lz -lzstd -ldl -pthread"
on Ubuntu 26.04). Fall back to -lcrypto if pkg-config or
libcrypto.pc is unavailable, preserving the previous behavior on
minimal build environments.

Signed-off-by: Hadrien Patte <hadrien.patte@protonmail.com>
---
 tools/bpf/bpftool/Makefile | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/tools/bpf/bpftool/Makefile b/tools/bpf/bpftool/Makefile
index 0febf60e1b64..d9ab860a6cce 100644
--- a/tools/bpf/bpftool/Makefile
+++ b/tools/bpf/bpftool/Makefile
@@ -103,7 +103,17 @@ SKIP_LLVM ?=
 SKIP_LIBBFD ?=
 SKIP_CRYPTO ?=
 ifneq ($(SKIP_CRYPTO),1)
-  CRYPTO_LIBS := -lcrypto
+  # Resolve libcrypto link flags via pkg-config so transitive dependencies
+  # (e.g. libjitterentropy on distros where libcrypto.a references it) are
+  # included for static builds. Pass --static when the user requested a
+  # static build via EXTRA_LDFLAGS=-static. Fall back to -lcrypto if
+  # pkg-config or libcrypto.pc is unavailable.
+  ifneq ($(findstring -static,$(EXTRA_LDFLAGS)),)
+    CRYPTO_LIBS := $(shell pkg-config --libs --static libcrypto 2>/dev/null)
+  else
+    CRYPTO_LIBS := $(shell pkg-config --libs libcrypto 2>/dev/null)
+  endif
+  CRYPTO_LIBS := $(if $(CRYPTO_LIBS),$(CRYPTO_LIBS),-lcrypto)
 endif
 
 FEATURE_TESTS := clang-bpf-co-re
-- 
2.54.0

Re: [PATCH bpf-next] bpftool: Resolve libcrypto link flags via pkg-config

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 2447 bytes --]

> diff --git a/tools/bpf/bpftool/Makefile b/tools/bpf/bpftool/Makefile
> index 0febf60e1b64..d9ab860a6cce 100644
> --- a/tools/bpf/bpftool/Makefile
> +++ b/tools/bpf/bpftool/Makefile
> @@ -103,7 +103,17 @@ SKIP_LLVM ?=
>  SKIP_LIBBFD ?=
>  SKIP_CRYPTO ?=
>  ifneq ($(SKIP_CRYPTO),1)
> -  CRYPTO_LIBS := -lcrypto
> +  # Resolve libcrypto link flags via pkg-config so transitive dependencies
> +  # (e.g. libjitterentropy on distros where libcrypto.a references it) are
> +  # included for static builds. Pass --static when the user requested a
> +  # static build via EXTRA_LDFLAGS=-static. Fall back to -lcrypto if
> +  # pkg-config or libcrypto.pc is unavailable.
> +  ifneq ($(findstring -static,$(EXTRA_LDFLAGS)),)

Will this findstring check match other flags unintentionally? If a user
passes flags like -static-pie, -static-libasan, or a custom directory path
like -L/opt/static-libs/, this condition would still evaluate to true and
pass the --static flag to pkg-config for what might be a dynamically linked
build.

Could the filter function be used instead to match the exact word, similar to
other BPF makefiles?

> +    CRYPTO_LIBS := $(shell pkg-config --libs --static libcrypto 2>/dev/null)

Will hardcoding pkg-config directly break cross-compilation environments?
When cross-compiling, invoking pkg-config directly queries the host system's
library paths and might inject host-specific linker flags into the
cross-compiler's link line, leading to architecture mismatches.

Should a target-aware variable like $(PKG_CONFIG) be used here instead?

> +  else
> +    CRYPTO_LIBS := $(shell pkg-config --libs libcrypto 2>/dev/null)
> +  endif
> +  CRYPTO_LIBS := $(if $(CRYPTO_LIBS),$(CRYPTO_LIBS),-lcrypto)
>  endif

Is it safe to share these resolved link flags between the target build and
the host-compiled bootstrap build? Because CRYPTO_LIBS is appended to both
LIBS and LIBS_BOOTSTRAP later in the Makefile, a cross-compilation setup
might fail. It passes the exact same architecture-specific pkg-config output
to both the host and target compilers.

Would it be better to resolve dependencies separately using $(HOSTPKG_CONFIG)
for the bootstrap tool and $(PKG_CONFIG) for the main tool?


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/25226582670

Re: [PATCH bpf-next] bpftool: Resolve libcrypto link flags via pkg-config

[Quentin Monnet]

2026-05-01 17:58 UTC+0000 ~ hadrien Patte <hadrien.patte@protonmail.com>
> From: Hadrien Patte <hadrien.patte@protonmail.com>
> 
> When building bpftool with EXTRA_LDFLAGS=-static on Ubuntu 26.04
> (OpenSSL 3.5.5), the link fails because libcrypto.a references
> libjitterentropy symbols, which are not on the link line:
> 
>   LINK     bpftool
>   /usr/bin/ld: libcrypto.a(libdefault-lib-seed_src_jitter.o):
>     in function `ossl_prov_acquire_entropy_from_jitter':
>     (.text+0x11c): undefined reference to `jent_entropy_collector_alloc'
>     (.text+0x130): undefined reference to `jent_read_entropy'
>     (.text+0x13c): undefined reference to `jent_entropy_collector_free'
>   /usr/bin/ld: libcrypto.a(libdefault-lib-seed_src_jitter.o):
>     in function `jitter_instantiate':
>     (.text+0x61c): undefined reference to `jent_entropy_init_ex'
>   collect2: error: ld returned 1 exit status
> 
> The set of transitive dependencies pulled in by libcrypto.a varies
> across distributions and OpenSSL builds (cf. commit 08a749184322
> ("bpftool: Fix dependencies for static build"), which addressed a
> similar libz ordering issue), so hard-coding them in the Makefile is
> fragile.
> 
> Resolve libcrypto's link flags via pkg-config, which knows about
> these transitive deps. Pass --static when the user requested a static
> build via EXTRA_LDFLAGS=-static so pkg-config emits the static link
> line (e.g. "-lcrypto -l:libjitterentropy.a -lz -lzstd -ldl -pthread"
> on Ubuntu 26.04). Fall back to -lcrypto if pkg-config or
> libcrypto.pc is unavailable, preserving the previous behavior on
> minimal build environments.
> 
> Signed-off-by: Hadrien Patte <hadrien.patte@protonmail.com>
> ---
>  tools/bpf/bpftool/Makefile | 12 +++++++++++-
>  1 file changed, 11 insertions(+), 1 deletion(-)
> 
> diff --git a/tools/bpf/bpftool/Makefile b/tools/bpf/bpftool/Makefile
> index 0febf60e1b64..d9ab860a6cce 100644
> --- a/tools/bpf/bpftool/Makefile
> +++ b/tools/bpf/bpftool/Makefile
> @@ -103,7 +103,17 @@ SKIP_LLVM ?=
>  SKIP_LIBBFD ?=
>  SKIP_CRYPTO ?=
>  ifneq ($(SKIP_CRYPTO),1)
> -  CRYPTO_LIBS := -lcrypto
> +  # Resolve libcrypto link flags via pkg-config so transitive dependencies
> +  # (e.g. libjitterentropy on distros where libcrypto.a references it) are
> +  # included for static builds. Pass --static when the user requested a
> +  # static build via EXTRA_LDFLAGS=-static. Fall back to -lcrypto if
> +  # pkg-config or libcrypto.pc is unavailable.
> +  ifneq ($(findstring -static,$(EXTRA_LDFLAGS)),)
> +    CRYPTO_LIBS := $(shell pkg-config --libs --static libcrypto 2>/dev/null)
> +  else
> +    CRYPTO_LIBS := $(shell pkg-config --libs libcrypto 2>/dev/null)
> +  endif
> +  CRYPTO_LIBS := $(if $(CRYPTO_LIBS),$(CRYPTO_LIBS),-lcrypto)
>  endif
>  
>  FEATURE_TESTS := clang-bpf-co-re


Thanks Hadrien,

The Makefile for bpftool is also used in the version mirrored on GitHub;
and so far it hasn't relied on pkg-config. So if we introduce pkg-config
in bpftool's Makefile, could we please make it optional, like the GitHub
version for libbpf's Makefile does?

See https://github.com/libbpf/libbpf/blob/master/src/Makefile#L46

Thanks,
Quentin

[PATCH bpf-next v2] bpftool: Resolve libcrypto link flags via pkg-config

[hadrien Patte]

From: Hadrien Patte <hadrien.patte@protonmail.com>

When building bpftool with EXTRA_LDFLAGS=-static on Ubuntu 26.04
(OpenSSL 3.5.5), the link fails because libcrypto.a references
libjitterentropy symbols, which are not on the link line:

  LINK     bpftool
  /usr/bin/ld: libcrypto.a(libdefault-lib-seed_src_jitter.o):
    in function `ossl_prov_acquire_entropy_from_jitter':
    (.text+0x11c): undefined reference to `jent_entropy_collector_alloc'
    (.text+0x130): undefined reference to `jent_read_entropy'
    (.text+0x13c): undefined reference to `jent_entropy_collector_free'
  /usr/bin/ld: libcrypto.a(libdefault-lib-seed_src_jitter.o):
    in function `jitter_instantiate':
    (.text+0x61c): undefined reference to `jent_entropy_init_ex'
  collect2: error: ld returned 1 exit status

The set of transitive dependencies pulled in by libcrypto.a varies
across distributions and OpenSSL builds (cf. commit 08a749184322
("bpftool: Fix dependencies for static build"), which addressed a
similar libz ordering issue), so hard-coding them in the Makefile is
fragile.

Resolve libcrypto's link flags via pkg-config, which knows about
these transitive deps. Pass --static when the user requested a static
build via EXTRA_LDFLAGS=-static so pkg-config emits the static link
line (e.g. "-lcrypto -l:libjitterentropy.a -lz -lzstd -ldl -pthread"
on Ubuntu 26.04).

Resolve libcrypto separately for the target binary (built with
$(CC)) and the bootstrap host tool (built with $(HOSTCC)), using
$(PKG_CONFIG) and $(HOSTPKG_CONFIG) respectively, so cross-compile
setups pick up the correct architecture-specific dependencies. This
follows the pattern already established in
tools/bpf/resolve_btfids/Makefile.

pkg-config remains optional: if the tool is not available, fall back
to plain -lcrypto, mirroring the up-front probe pattern used by
libbpf's standalone Makefile. This preserves the previous build
behavior for environments where pkg-config is not installed.

Signed-off-by: Hadrien Patte <hadrien.patte@protonmail.com>
---

Notes:
    Changes since v1:
     - Probe for pkg-config availability up front and fall back to plain -lcrypto
       when it isn't installed, mirroring the optional pkg-config pattern in
       libbpf/src/Makefile. This preserves the previous build behavior for
       environments without pkg-config.
     - Use $(PKG_CONFIG) and $(HOSTPKG_CONFIG) (with $(CROSS_COMPILE)pkg-config
       defaults) instead of invoking pkg-config directly, so cross-compile builds
       query the correct sysroot.
     - Resolve libcrypto separately for the target (CRYPTO_LIBS, used by LIBS) and
       the bootstrap host tool (CRYPTO_LIBS_BOOTSTRAP, used by LIBS_BOOTSTRAP);
       the bootstrap binary is built with $(HOSTCC) and may need different deps
       than the target binary in cross-compile setups.
     - Use $(filter -static,...) instead of $(findstring -static,...) so flags
       like -static-libasan or library paths containing 'static' don't cause
       false positives.
     - Link to v1: https://lore.kernel.org/bpf/20260501175829.9833-1-hadrien.patte@protonmail.com/

 tools/bpf/bpftool/Makefile | 32 ++++++++++++++++++++++++++++++--
 1 file changed, 30 insertions(+), 2 deletions(-)

diff --git a/tools/bpf/bpftool/Makefile b/tools/bpf/bpftool/Makefile
index 0febf60e1b64..455508d4f654 100644
--- a/tools/bpf/bpftool/Makefile
+++ b/tools/bpf/bpftool/Makefile
@@ -103,7 +103,35 @@ SKIP_LLVM ?=
 SKIP_LIBBFD ?=
 SKIP_CRYPTO ?=
 ifneq ($(SKIP_CRYPTO),1)
-  CRYPTO_LIBS := -lcrypto
+  PKG_CONFIG ?= $(CROSS_COMPILE)pkg-config
+  HOSTPKG_CONFIG ?= pkg-config
+
+  ifeq ($(shell command -v $(PKG_CONFIG) 2>/dev/null),)
+    NO_PKG_CONFIG := 1
+  endif
+  ifeq ($(shell command -v $(HOSTPKG_CONFIG) 2>/dev/null),)
+    NO_HOSTPKG_CONFIG := 1
+  endif
+
+  # Resolve libcrypto link flags via pkg-config when available, so transitive
+  # dependencies (e.g. libjitterentropy on distros where libcrypto.a
+  # references it) are included for static builds. Pass --static when the
+  # user requested a static build via EXTRA_LDFLAGS=-static.
+  ifneq ($(filter -static,$(EXTRA_LDFLAGS)),)
+    PKG_CONFIG_LIBCRYPTO := --libs --static libcrypto
+  else
+    PKG_CONFIG_LIBCRYPTO := --libs libcrypto
+  endif
+
+  ifndef NO_PKG_CONFIG
+    CRYPTO_LIBS := $(shell $(PKG_CONFIG) $(PKG_CONFIG_LIBCRYPTO) 2>/dev/null)
+  endif
+  CRYPTO_LIBS := $(if $(CRYPTO_LIBS),$(CRYPTO_LIBS),-lcrypto)
+
+  ifndef NO_HOSTPKG_CONFIG
+    CRYPTO_LIBS_BOOTSTRAP := $(shell $(HOSTPKG_CONFIG) $(PKG_CONFIG_LIBCRYPTO) 2>/dev/null)
+  endif
+  CRYPTO_LIBS_BOOTSTRAP := $(if $(CRYPTO_LIBS_BOOTSTRAP),$(CRYPTO_LIBS_BOOTSTRAP),-lcrypto)
 endif
 
 FEATURE_TESTS := clang-bpf-co-re
@@ -140,7 +168,7 @@ endif
 endif
 
 LIBS = $(LIBBPF) -lelf $(CRYPTO_LIBS) -lz
-LIBS_BOOTSTRAP = $(LIBBPF_BOOTSTRAP) -lelf $(CRYPTO_LIBS) -lz
+LIBS_BOOTSTRAP = $(LIBBPF_BOOTSTRAP) -lelf $(CRYPTO_LIBS_BOOTSTRAP) -lz
 
 ifeq ($(feature-libelf-zstd),1)
 LIBS += -lzstd
-- 
2.54.0