1427266 - Statically link libdmg-hfsplus against openssl

Status: RESOLVED FIXED

(Firefox Build System :: General, enhancement)

Comment 1

[Mike Hommey [:glandium]]

Attachment: Bug 1427266 - Statically link libdmg-hfsplus against OpenSSL.

libcrypto, part of OpenSSL, and that dmg links against, has a varying
ABI, and something built against libcrypto on Centos won't run on Debian
and vice versa. It might not even work between versions of the same OS
(e.g. Debian 7 vs. Debian 9).

Because of that, it is desirable to statically link it.

This incorporates https://github.com/mozilla/libdmg-hfsplus/pull/1
and sets OPENSSL_USE_STATIC_LIBS when building libdmg-hfsplus.

Review commit: https://reviewboard.mozilla.org/r/209452/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/209452/

Comment 2

[Mike Hommey [:glandium]]

Comment on attachment 8939011 [details]
Bug 1427266 - Statically link libdmg-hfsplus against OpenSSL.

https://reviewboard.mozilla.org/r/209452/#review215160

::: taskcluster/scripts/misc/build-libdmg-hfsplus.sh:16
(Diff revision 1)
>  # There's no single well-maintained fork of libdmg-hfsplus, so we forked
>  # https://github.com/andreas56/libdmg-hfsplus/ to get a specific version and
>  # backport some patches.
>  : LIBDMG_REPOSITORY    ${LIBDMG_REPOSITORY:=https://github.com/mozilla/libdmg-hfsplus}
>  # The `mozilla` branch contains our fork.
> -: LIBDMG_REV           ${LIBDMG_REV:=ba04b00435a0853f1499d751617177828ee8ec00}
> +: LIBDMG_REV           ${LIBDMG_REV:=2ee327795680101d36f9700bd0fb618362237718}

Note this assumes https://github.com/mozilla/libdmg-hfsplus/pull/1 is merged with a fast-forward.

Comment 3

[Gregory Szorc [:gps]]

Comment on attachment 8939011 [details]
Bug 1427266 - Statically link libdmg-hfsplus against OpenSSL.

https://reviewboard.mozilla.org/r/209452/#review215212

My main concern with statically linking openssl is weakening security by making it harder to upgrade openssl. But I don't see how this change increases our security risk given how libdmg-hfsplus is currently used (as a support library in a desired-to-be-deterministic Docker image).

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/78f2064b3811
Statically link libdmg-hfsplus against OpenSSL. r=gps

Comment 5

[Pulsebot]

Backout by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/bbd42a73b04c
Backed out 1 changesets for failing linux toolchain builds r=backout on a CLOSED TREE

Comment 6

[Mike Hommey [:glandium]]

Forgot this needs the libdmg-hfsplus PR to be merged first.

Comment 7

[Andreea Pavel [:apavel]]

Backed out for failing linux toolchain builds r=backout on a CLOSED TREE

push with failure: https://treeherder.mozilla.org/#/jobs?repo=autoland&revision=78f2064b3811db58b364c32ce9b58a3f2dcaf8f8

failure log: https://public-artifacts.taskcluster.net/PNBEe-fwStCIN3kY3qiw5g/0/public/logs/live_backing.log

backout: https://hg.mozilla.org/integration/autoland/rev/bbd42a73b04c04ca7236a3a99d4340f480d9718f

Comment 8

[Mike Hommey [:glandium]]

Mike, can you merge https://github.com/mozilla/libdmg-hfsplus/pull/1 (a fast-forward would avoid having to change the patch in this bug)?

Comment 9

[Gregory Szorc [:gps]]

Merged.

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/aa3ac1aa5299
Statically link libdmg-hfsplus against OpenSSL. r=gps

Comment 11

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/aa3ac1aa5299