[v2] package/drogon: fix build with LibreSSL
Commit Message
The trantor library bundled in drogon 1.9.14 fails to build against
LibreSSL, because it uses SSL_CTX_set_cert_cb(), which LibreSSL does
not provide.
Backport the upstream commit, which disables that call when building
against LibreSSL. The patch description explains the details.
Fixes:
- https://autobuild.buildroot.org/results/f1c7a336f3fabb2d2a2793930573b69bc47c3ee7
- https://autobuild.buildroot.org/results/795c9ab125a029f0d90a267147cb6d6d80887688
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
---
Changes v1 -> v2:
- Point the Upstream: tag to the merged commit instead of the pull
request.
- Rename the patch to 0002, since 0001 is now taken by the CVE fix.
- Update the commit message.
...0002-trantor-fix-build-with-LibreSSL.patch | 73 +++++++++++++++++++
1 file changed, 73 insertions(+)
create mode 100644 package/drogon/0002-trantor-fix-build-with-LibreSSL.patch
new file mode 100644
@@ -0,0 +1,73 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Dario Binacchi <dario.binacchi@amarulasolutions.com>
+Date: Tue, 27 Oct 2026 11:39:26 +0100
+Subject: [PATCH] Fix build with LibreSSL
+
+The Buildroot autobuilders reported that trantor, built as part of
+drogon, fails to compile against LibreSSL [1]. This patch fixes the
+two errors below.
+
+1) SSL_CTX_set_cert_cb() is not declared
+
+OpenSSLProvider.cc:1623:9: error: 'SSL_CTX_set_cert_cb' was not declared in this scope
+
+Commit 7d3aac802ff5 ("Fixes and update to TLS subsystem (#411)") calls
+SSL_CTX_set_cert_cb() to choose the server certificate during the TLS
+handshake but LibreSSL does not provide this function.
+
+The same commit also registers a servername callback, which LibreSSL
+supports and which chooses the server certificate as well, but only
+when the client sends SNI. With LibreSSL, clients that do not send SNI
+therefore get no certificate.
+
+2) lastOpenSSLError() is defined but not used
+
+OpenSSLProvider.cc:261:20: error: 'std::string internal::lastOpenSSLError()' defined but not used [-Werror=unused-function]
+
+lastOpenSSLError() is only called by code that is not built with
+LibreSSL. With LibreSSL the function is unused, and -Werror turns the
+resulting warning into an error.
+
+[1] https://autobuild.buildroot.org/results/f1c7a336f3fabb2d2a2793930573b69bc47c3ee7
+
+Upstream: https://github.com/an-tao/trantor/commit/a77cc3651d5950f2f8aeceab80f74f31870f4017
+Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
+---
+ trantor/net/inner/tlsprovider/OpenSSLProvider.cc | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/trantor/trantor/net/inner/tlsprovider/OpenSSLProvider.cc b/trantor/trantor/net/inner/tlsprovider/OpenSSLProvider.cc
+index e876ee97faf1..7b6f42d88d32 100644
+--- a/trantor/trantor/net/inner/tlsprovider/OpenSSLProvider.cc
++++ b/trantor/trantor/net/inner/tlsprovider/OpenSSLProvider.cc
+@@ -258,6 +258,7 @@ static bool isDirectory(const std::string &path)
+ #endif
+ }
+
++#ifndef LIBRESSL_VERSION_NUMBER
+ static std::string lastOpenSSLError()
+ {
+ const auto error = ERR_get_error();
+@@ -267,6 +268,7 @@ static std::string lastOpenSSLError()
+ ERR_error_string_n(error, message.data(), message.size());
+ return message.data();
+ }
++#endif
+
+ static void freeCertificateNames(STACK_OF(X509_NAME) * names)
+ {
+@@ -1620,9 +1622,14 @@ SSLContextPtr trantor::newSSLContext(const TLSPolicy &policy, bool isServer)
+ ctx->ctx(),
+ static_cast<int (*)(SSL *, int *, void *)>(
+ &OpenSSLProvider::selectServerCertificate));
++#ifndef LIBRESSL_VERSION_NUMBER
++ // LibreSSL lacks SSL_CTX_set_cert_cb(). There, the certificate is
++ // selected by the servername callback only, so clients not sending
++ // SNI won't get a certificate.
+ SSL_CTX_set_cert_cb(ctx->ctx(),
+ &OpenSSLProvider::configureServerCertificate,
+ nullptr);
++#endif
+ // A resumed handshake may not select a certificate at all. Do not
+ // resume one without consulting the current runtime provider.
+ SSL_CTX_set_session_cache_mode(ctx->ctx(), SSL_SESS_CACHE_OFF);