LDFLAGS passed too late making libs linked incorrectly, e.g. OpenSSL #14893
Description
I did this
Compiling latest curl on HP-UX and linking against not the system provided OpenSSL (which is on the default loader/linker path), but against a self-compiled newer version:
export PREFIX=/opt/ports
export LIBDIR=$PREFIX/lib/hpux32
export SYSCONFDIR=/etc/opt/ports
export CC=/opt/aCC/bin/aCC
export CXX=/opt/aCC/bin/aCC
export CONFIGURE="./configure --prefix=$PREFIX --libdir=$LIBDIR --sysconfdir=$SYSCONFDIR --localstatedir=/var"
export CPPFLAGS="-I$PREFIX/include"
export CFLAGS="+We901"
export CXXFLAGS="+We901"
export LDFLAGS="-L$LIBDIR"
export HELP="./configure --help"
export OPENSSLDIR=$SYSCONFDIR/ssl
call:
$CONFIGURE --with-gssapi=$PREFIX --with-zlib --with-openssl=$PREFIX \
--disable-ftp --disable-ldap --disable-rtsp --disable-dict --disable-pop3 --disable-gopher \
--disable-imap --disable-tftp --disable-telnet --disable-smb --without-libssh2 \
--with-ca-fallback --disable-threaded-resolver --disable-dependency-tracking --disable-mqtt \
--disable-alt-svc --disable-ntlm --disable-tls-srp --without-libpsl
Summary:
Host setup: ia64-hp-hpux11.31
Install prefix: /opt/ports
Compiler: /opt/aCC/bin/aCC -AC99
CFLAGS: +We901 -z +W 4227,4255 +O2
CFLAGS extras:
CPPFLAGS: -I/opt/ports/include -I/opt/ports/include -I/opt/ports/include
LDFLAGS: -L/opt/ports/lib/hpux32 -L/opt/ports/lib
LIBS: -lssl -lcrypto -L/opt/ports/lib/hpux32 -Wl,+b,/opt/ports/lib/hpux32 -lgssapi_krb5 -lkrb5 -lk5crypto -lcom_err -lz
curl version: 8.10.0
SSL: enabled (OpenSSL v3+)
SSH: no (--with-{libssh,libssh2})
zlib: enabled
brotli: no (--with-brotli)
zstd: no (--with-zstd)
GSS-API: enabled (MIT Kerberos/Heimdal)
GSASL: no (libgsasl not found)
TLS-SRP: no (--enable-tls-srp)
resolver: default (--enable-ares / --enable-threaded-resolver)
IPv6: enabled
Unix sockets: enabled
IDN: no (--with-{libidn2,winidn})
Build docs: enabled (--disable-docs)
Build libcurl: Shared=yes, Static=yes
Built-in manual: enabled
--libcurl option: enabled (--disable-libcurl-option)
Verbose errors: enabled (--disable-verbose)
Code coverage: disabled
SSPI: no (--enable-sspi)
ca cert bundle: no
ca cert path: no
ca fallback: yes
LDAP: no (--enable-ldap / --with-ldap-lib / --with-lber-lib)
LDAPS: no (--enable-ldaps)
RTSP: no (--enable-rtsp)
RTMP: no (--with-librtmp)
PSL: no (--with-libpsl)
Alt-svc: no
Headers API: enabled (--disable-headers-api)
HSTS: enabled (--disable-hsts)
HTTP1: enabled (internal)
HTTP2: no (--with-nghttp2)
HTTP3: no (--with-ngtcp2 --with-nghttp3, --with-quiche, --with-openssl-quic, --with-msh3)
ECH: no (--enable-ech)
WebSockets: no (--enable-websockets)
Protocols: file http https ipfs ipns smtp smtps
Features: GSS-API HSTS HTTPS-proxy IPv6 Kerberos Largefile libz SPNEGO SSL UnixSockets
Result:
# ldd /opt/ports/bin/curl
/opt/ports/bin/curl:
libcurl.so.12 => /opt/ports/lib/hpux32/libcurl.so.12
libssl.so.3 => /opt/ports/lib/hpux32/libssl.so.3
libcrypto.so.3 => /opt/ports/lib/hpux32/libcrypto.so.3
libgssapi_krb5.2 => /opt/ports/lib/hpux32/libgssapi_krb5.2
libkrb5.3 => /opt/ports/lib/hpux32/libkrb5.3
libk5crypto.3 => /opt/ports/lib/hpux32/libk5crypto.3
libcom_err.3 => /opt/ports/lib/hpux32/libcom_err.3
libz.so => /opt/ports/lib/hpux32/libz.so
libc.so.1 => /usr/lib/hpux32/libc.so.1
libssl.so.1.1 => /usr/lib/hpux32/libssl.so.1.1
libcrypto.so.1.1 => /usr/lib/hpux32/libcrypto.so.1.1
libcrypto.so.3 => /opt/ports/lib/hpux32/libcrypto.so.3
libdl.so.1 => /usr/lib/hpux32/libdl.so.1
libpthread.so.1 => /usr/lib/hpux32/libpthread.so.1
libkrb5support.0 => /opt/ports/lib/hpux32/libkrb5support.0
libintl.so.12 => /opt/ports/lib/hpux32/libintl.so.12
libc.so.1 => /usr/lib/hpux32/libc.so.1
libcrypto.so.1.1 => /usr/lib/hpux32/libcrypto.so.1.1
libdl.so.1 => /usr/lib/hpux32/libdl.so.1
libpthread.so.1 => /usr/lib/hpux32/libpthread.so.1
libiconv.so.8 => /opt/ports/lib/hpux32/libiconv.so.8
libc.so.1 => /usr/lib/hpux32/libc.so.1
libc.so.1 => /usr/lib/hpux32/libc.so.1
# ldd /opt/ports/lib/hpux32/libcurl.so
/opt/ports/lib/hpux32/libcurl.so:
libssl.so.1.1 => /usr/lib/hpux32/libssl.so.1.1
libcrypto.so.1.1 => /usr/lib/hpux32/libcrypto.so.1.1
libgssapi_krb5.2 => /opt/ports/lib/hpux32/libgssapi_krb5.2
libkrb5.3 => /opt/ports/lib/hpux32/libkrb5.3
libk5crypto.3 => /opt/ports/lib/hpux32/libk5crypto.3
libcom_err.3 => /opt/ports/lib/hpux32/libcom_err.3
libz.so => /opt/ports/lib/hpux32/libz.so
libc.so.1 => /usr/lib/hpux32/libc.so.1
libcrypto.so.1.1 => /usr/lib/hpux32/libcrypto.so.1.1
libdl.so.1 => /usr/lib/hpux32/libdl.so.1
libpthread.so.1 => /usr/lib/hpux32/libpthread.so.1
libkrb5support.0 => /opt/ports/lib/hpux32/libkrb5support.0
libintl.so.12 => /opt/ports/lib/hpux32/libintl.so.12
libc.so.1 => /usr/lib/hpux32/libc.so.1
libdl.so.1 => /usr/lib/hpux32/libdl.so.1
libiconv.so.8 => /opt/ports/lib/hpux32/libiconv.so.8
libc.so.1 => /usr/lib/hpux32/libc.so.1
libc.so.1 => /usr/lib/hpux32/libc.so.1
I have now both OpenSSL version in the runtime path because in lib/Makefile.in libcurl_la_LINK and src/Makefile.in libcurltool_la_LINK have LDFLAGS after LIBS (LIBCURL_PC_LIBS_PRIVATE) the linker finds the default path first for libssl.so.
verbose:
# ldd -s -v /opt/ports/bin/curl
/opt/ports/bin/curl:
find library=libcurl.so.12; required by /opt/ports/bin/curl
search path=/opt/ports/lib/hpux32 (RUNPATH)
trying path=/opt/ports/lib/hpux32/libcurl.so.12
libcurl.so.12 => /opt/ports/lib/hpux32/libcurl.so.12
find library=libssl.so.3; required by /opt/ports/bin/curl
search path=/opt/ports/lib/hpux32 (RUNPATH)
trying path=/opt/ports/lib/hpux32/libssl.so.3
libssl.so.3 => /opt/ports/lib/hpux32/libssl.so.3
find library=libcrypto.so.3; required by /opt/ports/bin/curl
search path=/opt/ports/lib/hpux32 (RUNPATH)
trying path=/opt/ports/lib/hpux32/libcrypto.so.3
libcrypto.so.3 => /opt/ports/lib/hpux32/libcrypto.so.3
find library=libgssapi_krb5.2; required by /opt/ports/bin/curl
search path=/opt/ports/lib/hpux32 (RUNPATH)
trying path=/opt/ports/lib/hpux32/libgssapi_krb5.2
libgssapi_krb5.2 => /opt/ports/lib/hpux32/libgssapi_krb5.2
find library=libkrb5.3; required by /opt/ports/bin/curl
search path=/opt/ports/lib/hpux32 (RUNPATH)
trying path=/opt/ports/lib/hpux32/libkrb5.3
libkrb5.3 => /opt/ports/lib/hpux32/libkrb5.3
find library=libk5crypto.3; required by /opt/ports/bin/curl
search path=/opt/ports/lib/hpux32 (RUNPATH)
trying path=/opt/ports/lib/hpux32/libk5crypto.3
libk5crypto.3 => /opt/ports/lib/hpux32/libk5crypto.3
find library=libcom_err.3; required by /opt/ports/bin/curl
search path=/opt/ports/lib/hpux32 (RUNPATH)
trying path=/opt/ports/lib/hpux32/libcom_err.3
libcom_err.3 => /opt/ports/lib/hpux32/libcom_err.3
find library=libz.so; required by /opt/ports/bin/curl
search path=/opt/ports/lib/hpux32 (RUNPATH)
trying path=/opt/ports/lib/hpux32/libz.so
libz.so => /opt/ports/lib/hpux32/libz.so
find library=libc.so.1; required by /opt/ports/bin/curl
search path=/opt/ports/lib/hpux32 (RUNPATH)
trying path=/opt/ports/lib/hpux32/libc.so.1
search path=/usr/lib/hpux32 (default)
trying path=/usr/lib/hpux32/libc.so.1
libc.so.1 => /usr/lib/hpux32/libc.so.1
find library=libssl.so.1.1; required by /opt/ports/lib/hpux32/libcurl.so.12
search path=/opt/ports/lib/hpux32 (RUNPATH)
trying path=/opt/ports/lib/hpux32/libssl.so.1.1
search path=/usr/lib/hpux32 (default)
trying path=/usr/lib/hpux32/libssl.so.1.1
libssl.so.1.1 => /usr/lib/hpux32/libssl.so.1.1
find library=libcrypto.so.1.1; required by /opt/ports/lib/hpux32/libcurl.so.12
search path=/opt/ports/lib/hpux32 (RPATH)
trying path=/opt/ports/lib/hpux32/libcrypto.so.1.1
search path=/usr/lib/hpux32 (default)
trying path=/usr/lib/hpux32/libcrypto.so.1.1
libcrypto.so.1.1 => /usr/lib/hpux32/libcrypto.so.1.1
find library=libcrypto.so.3; required by /opt/ports/lib/hpux32/libssl.so.3
search path=.:/opt/ports/lib/hpux32:/usr/lib/hpux32:/opt/langtools/lib/hpux32 (RPATH)
trying path=./libcrypto.so.3
trying path=/opt/ports/lib/hpux32/libcrypto.so.3
libcrypto.so.3 => /opt/ports/lib/hpux32/libcrypto.so.3
find library=libdl.so.1; required by /opt/ports/lib/hpux32/libssl.so.3
search path=.:/opt/ports/lib/hpux32:/usr/lib/hpux32:/opt/langtools/lib/hpux32 (RPATH)
trying path=./libdl.so.1
trying path=/opt/ports/lib/hpux32/libdl.so.1
trying path=/usr/lib/hpux32/libdl.so.1
libdl.so.1 => /usr/lib/hpux32/libdl.so.1
find library=libpthread.so.1; required by /opt/ports/lib/hpux32/libssl.so.3
search path=.:/opt/ports/lib/hpux32:/usr/lib/hpux32:/opt/langtools/lib/hpux32 (RUNPATH)
trying path=./libpthread.so.1
trying path=/opt/ports/lib/hpux32/libpthread.so.1
trying path=/usr/lib/hpux32/libpthread.so.1
libpthread.so.1 => /usr/lib/hpux32/libpthread.so.1
find library=libkrb5support.0; required by /opt/ports/lib/hpux32/libgssapi_krb5.2
search path=/opt/ports/lib/hpux32 (RPATH)
trying path=/opt/ports/lib/hpux32/libkrb5support.0
libkrb5support.0 => /opt/ports/lib/hpux32/libkrb5support.0
find library=libintl.so.12; required by /opt/ports/lib/hpux32/libgssapi_krb5.2
search path=/opt/ports/lib/hpux32 (RUNPATH)
trying path=/opt/ports/lib/hpux32/libintl.so.12
libintl.so.12 => /opt/ports/lib/hpux32/libintl.so.12
find library=libc.so.1; required by /opt/ports/lib/hpux32/libz.so
search path=/opt/ports/lib/hpux32:/usr/lib/hpux32:/opt/langtools/lib/hpux32 (RUNPATH)
trying path=/opt/ports/lib/hpux32/libc.so.1
trying path=/usr/lib/hpux32/libc.so.1
libc.so.1 => /usr/lib/hpux32/libc.so.1
find library=libcrypto.so.1.1; required by /usr/lib/hpux32/libssl.so.1.1
search path=/usr/lib/hpux32 (default)
trying path=/usr/lib/hpux32/libcrypto.so.1.1
libcrypto.so.1.1 => /usr/lib/hpux32/libcrypto.so.1.1
find library=libdl.so.1; required by /usr/lib/hpux32/libssl.so.1.1
search path=/usr/lib/hpux32 (default)
trying path=/usr/lib/hpux32/libdl.so.1
libdl.so.1 => /usr/lib/hpux32/libdl.so.1
find library=libpthread.so.1; required by /usr/lib/hpux32/libssl.so.1.1
search path=/usr/lib/hpux32 (default)
trying path=/usr/lib/hpux32/libpthread.so.1
libpthread.so.1 => /usr/lib/hpux32/libpthread.so.1
find library=libiconv.so.8; required by /opt/ports/lib/hpux32/libintl.so.12
search path=/opt/ports/lib/hpux32 (RUNPATH)
trying path=/opt/ports/lib/hpux32/libiconv.so.8
libiconv.so.8 => /opt/ports/lib/hpux32/libiconv.so.8
find library=libc.so.1; required by /opt/ports/lib/hpux32/libintl.so.12
search path=/opt/ports/lib/hpux32 (RPATH)
trying path=/opt/ports/lib/hpux32/libc.so.1
search path=/usr/lib/hpux32 (default)
trying path=/usr/lib/hpux32/libc.so.1
libc.so.1 => /usr/lib/hpux32/libc.so.1
find library=libc.so.1; required by /opt/ports/lib/hpux32/libiconv.so.8
search path=/usr/lib/hpux32 (default)
trying path=/usr/lib/hpux32/libc.so.1
libc.so.1 => /usr/lib/hpux32/libc.so.1
I cannot tell whether any of the recent changes should be reverted or not, but that comes a surprise because I explicitly pass CPPFLAGS and LDFLAGS to have autoconf to find the headers and libraries in the right place and not in default locations.
#12312 looks like a workaround to make it work again:
root@deblndw002x:/var/tmp/ports/work/curl-8.10.0
# gmake -j4 CURL_LDFLAGS_LIB=$LDFLAGS CURL_LDFLAGS_BIN=$LDFLAGS
...
# gmake install
...
# ldd /opt/ports/lib/hpux32/libcurl.so
/opt/ports/lib/hpux32/libcurl.so:
libssl.so.3 => /opt/ports/lib/hpux32/libssl.so.3
libcrypto.so.3 => /opt/ports/lib/hpux32/libcrypto.so.3
libgssapi_krb5.2 => /opt/ports/lib/hpux32/libgssapi_krb5.2
libkrb5.3 => /opt/ports/lib/hpux32/libkrb5.3
libk5crypto.3 => /opt/ports/lib/hpux32/libk5crypto.3
libcom_err.3 => /opt/ports/lib/hpux32/libcom_err.3
libz.so => /opt/ports/lib/hpux32/libz.so
libc.so.1 => /usr/lib/hpux32/libc.so.1
libcrypto.so.3 => /opt/ports/lib/hpux32/libcrypto.so.3
libdl.so.1 => /usr/lib/hpux32/libdl.so.1
libpthread.so.1 => /usr/lib/hpux32/libpthread.so.1
libkrb5support.0 => /opt/ports/lib/hpux32/libkrb5support.0
libintl.so.12 => /opt/ports/lib/hpux32/libintl.so.12
libc.so.1 => /usr/lib/hpux32/libc.so.1
libiconv.so.8 => /opt/ports/lib/hpux32/libiconv.so.8
libc.so.1 => /usr/lib/hpux32/libc.so.1
libc.so.1 => /usr/lib/hpux32/libc.so.1
# ldd /opt/ports/bin/curl
/opt/ports/bin/curl:
libcurl.so.12 => /opt/ports/lib/hpux32/libcurl.so.12
libssl.so.3 => /opt/ports/lib/hpux32/libssl.so.3
libcrypto.so.3 => /opt/ports/lib/hpux32/libcrypto.so.3
libgssapi_krb5.2 => /opt/ports/lib/hpux32/libgssapi_krb5.2
libkrb5.3 => /opt/ports/lib/hpux32/libkrb5.3
libk5crypto.3 => /opt/ports/lib/hpux32/libk5crypto.3
libcom_err.3 => /opt/ports/lib/hpux32/libcom_err.3
libz.so => /opt/ports/lib/hpux32/libz.so
libc.so.1 => /usr/lib/hpux32/libc.so.1
libcrypto.so.3 => /opt/ports/lib/hpux32/libcrypto.so.3
libdl.so.1 => /usr/lib/hpux32/libdl.so.1
libpthread.so.1 => /usr/lib/hpux32/libpthread.so.1
libkrb5support.0 => /opt/ports/lib/hpux32/libkrb5support.0
libintl.so.12 => /opt/ports/lib/hpux32/libintl.so.12
libc.so.1 => /usr/lib/hpux32/libc.so.1
libiconv.so.8 => /opt/ports/lib/hpux32/libiconv.so.8
libc.so.1 => /usr/lib/hpux32/libc.so.1
libc.so.1 => /usr/lib/hpux32/libc.so.1
Well, using CURL_LDFLAGS_{LIB,BIN} is not straight forward at all because it is not documented, nor does one know that it has to be passed to make instead of to ./configure
I expected the following
LDFAGS passed before LIBS so the linker can pick up the right library to build up RPATH.
There has been some changes in terms of linking in the past few months looking at the closed issues and PRs.
curl/libcurl version
curl --version
curl 8.10.0 (ia64-hp-hpux11.31) libcurl/8.10.0 OpenSSL/3.0.15 zlib/1.3.1
Release-Date: 2024-09-11
Protocols: file http https ipfs ipns smtp smtps
Features: GSS-API HSTS HTTPS-proxy IPv6 Kerberos Largefile libz SPNEGO SSL UnixSockets
operating system
HP-UX deblndw0 B.11.31 U ia64 HP-UX
aCC: HP C/aC++ B3910B A.06.29 [Oct 18 2016]
/opt/ports/bin/openssl version
OpenSSL 3.0.15 3 Sep 2024 (Library: OpenSSL 3.0.15 3 Sep 2024)
/usr/bin/openssl version
OpenSSL 1.1.1w 11 Sep 2023