From patchwork Thu Oct 29 09:54:59 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dario Binacchi X-Patchwork-Id: 4906 Return-Path: X-Original-To: linux-amarula@patchwork.amarulasolutions.com Delivered-To: linux-amarula@patchwork.amarulasolutions.com Received: from mail-wr1-f71.google.com (mail-wr1-f71.google.com [209.85.221.71]) by ganimede.amarulasolutions.com (Postfix) with ESMTPS id A33553F1B8 for ; Thu, 29 Oct 2026 10:55:12 +0100 (CET) Received: by mail-wr1-f71.google.com with SMTP id ffacd0b85a97d-48e0ef019a4sf1529008f8f.3 for ; Thu, 29 Oct 2026 02:55:12 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1793267712; cv=pass; d=google.com; s=arc-20260327; b=Pzloy1Fw92nV9Zeej34qOUGUswTR+5Ct9GoQjV2fY/3NLDVH5qDEFDlBhWK6Sytozq 7FPdqpnnZr3L3kYN4YfRd93ip8JVXUfVrqFmFkQumqDv7hOclIirSolWVL/ixTmsxrDc WSvdHO0YatnA4pXZ907hVUs/NCDlbKoak8gZRohgfWJ9XTSbWK8XdGdGLd6iOmej6ZzE npazVT/QtZlBSo058/O6jWs5TUgdGtCJG/gS4wQ3VDZJcYKUu/Pe2ZnfUNpfhr9wd1HF RCg+Nm5Dj1BBZXkAje3VilUr3mWgLab10ZcCvsdxbIm97cglYJ2Ll3FYq0zJTGPDoV8O 0ctg== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=list-unsubscribe:list-archive:list-help:list-post:list-id :mailing-list:precedence:mime-version:message-id:date:subject:cc:to :from:dkim-signature; bh=2H5Sq+9om23GiJytoQHiJ/p8K7jRVrrItsG35JgzxDs=; fh=8Dzzgfte8KzbYFRyPFmR9QmsbaWD/ZBabqbBSfSJlms=; b=Rz/AWlmzYFXoTbPacwG2lB+fpk3I9tahxMEbbmekzm9/JeVe3aAmAzfNb/N742sv1J duiKF0HkL+bg0o13WOepd3gUuBOrqn/lb0LUnkUkJ2lK1eUur9Nffi6Wm5yybq4lq6IO Qzj9eXZbmm9fFQgqXj92Nknx2HUqmmKCczoW4ucVd773PisTaYzhYZM32S6bY9fq9eaA xyn6PFGrchv/GTH7S2hVBCMkq7P1sy7IFYzCgFfeL/uQjUogccD9VUrjgM3hQr3MGDJk z0G5Ve4pZ74+xa/vMh43rmPH8vc7+gucU67v2uHTVFXtbkewuvfXvJIZw42L6in0BYtj +x7g==; darn=patchwork.amarulasolutions.com ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@amarulasolutions.com header.s=google header.b=NvdV1FPK; spf=pass (google.com: domain of dario.binacchi@amarulasolutions.com designates 209.85.220.41 as permitted sender) smtp.mailfrom=dario.binacchi@amarulasolutions.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=amarulasolutions.com; dara=neutral header.i=@amarulasolutions.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amarulasolutions.com; s=google; t=1793267712; x=1793872512; darn=patchwork.amarulasolutions.com; h=list-unsubscribe:list-archive:list-help:list-post:list-id :mailing-list:precedence:content-type :x-original-authentication-results:x-original-sender:mime-version :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=2H5Sq+9om23GiJytoQHiJ/p8K7jRVrrItsG35JgzxDs=; b=C3VgcYACF1p66Mjj6StkRJeKWlSytw1UFtTxigz7BE9nry5CyjcKDqtnkQxROwGO8Y 3ovWYF65ZrMPPnb/4SF3BSJsSDRMXU+/uHZSo1gWPc4dhfPyb8UlBUGJ9Lcibp5hQnyP r+1c7f5dZ+McBcUyxbYKUd3JKpTkKiRIqkMTA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793267712; x=1793872512; h=list-unsubscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence :content-type:x-original-authentication-results:x-original-sender :mime-version:message-id:date:subject:cc:to:from:x-gm-gg:x-beenthere :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=2H5Sq+9om23GiJytoQHiJ/p8K7jRVrrItsG35JgzxDs=; b=MC3P74+Q40bVClCbsi0jk0NSwfjPqpP0xFfIByJy2+KBpjKbHzDEyGWOM3flMfTcch 6atoQ9eNmFAMi1FtkNnPppgKfUvJKduDjDtPcNaUG81BYWN2OL6mYVkFTOEaNxYXXcFt yT1XIQDOibJunep7h+wAvfVw+PqnmqNKANxyhldW7T7Y4Ry/V3geNnT7ljjK+crx+kXZ IkkjNEvjKgJxXTylXJos9Zgauk6akg879ha9aWaV6muS5SbYBYiVm/yogZVfHkldEUne jpFUXvT3Y0s64ARaGvruib8SBCVhJyBuyKmmDKHY/oF+ywNPLqgIM2d2d9ZAXRObjJvq uy2w== X-Forwarded-Encrypted: i=2; AKwUvBxyZtxKB531sfpdINH6qWYa3SysbiavyorT/4StefWux38XCTh/vmVNmQg27E7JEViLRjxOH+qFQfTUDH6P@patchwork.amarulasolutions.com X-Gm-Message-State: AFq9FYLeO3eRlumw8sk47UTRLc2kVN+yUOPToXiCHX0UHKMpJbwrwHUQ GIz1ZHG/5CWwKJOXGrcjxh+gGC06/GnZfziBgvY2Iqz7JZsl4SVID1C5WGqzY4GxFZADqQ== X-Received: by 2002:a05:600c:3e86:b0:4a1:83f0:7c91 with SMTP id 5b1f17b1804b1-4a96b0ab6b7mr108134475e9.18.1793267711937; Thu, 29 Oct 2026 02:55:11 -0700 (PDT) X-BeenThere: linux-amarula@amarulasolutions.com; h="ATskLdcyVSmTyPt8T39Wh1RVB1tvDReRZMlIiuwQn70SVckAVg==" Received: by 2002:a05:600c:3ba5:b0:4a1:dede:3ae2 with SMTP id 5b1f17b1804b1-4a9272538b7ls489045e9.1.-pod-prod-05-eu; Thu, 29 Oct 2026 02:55:10 -0700 (PDT) X-Forwarded-Encrypted: i=2; AKwUvBzLkpMOccSN7ppyALVmpr9ColU/ki33Ssh2Yjc4tJhP5cnTh/EXeQPohEWA8kJxdGUQchR7y95hJqBaY92b@amarulasolutions.com X-Received: by 2002:a05:600c:3b24:b0:4a1:f720:74cd with SMTP id 5b1f17b1804b1-4a9673f01abmr109027755e9.24.1793267710178; Thu, 29 Oct 2026 02:55:10 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1793267710; cv=none; d=google.com; s=arc-20260327; b=TYdmxHGRRXDkkXTQwhx1FBBu3u2FfyD9Hy3urORGTBNKWRgZX+DR2flRLpJtd9QJRF zLsjezdWGc7aceaHE5VAPpSjAF3RMo+p6lZwUVPu9iNZcTfCFj7KMDvZKeEdIGBvVbjg KBVXyjrR10qQYm6n/AxwI61J9ocZ27VT5T9ZeDxjIrIGtmTHKxgZ/bmw5z6YJtHatXc9 ddYaeuQ6ZWCdQbDjW1jsnCSPPtfaPM6oxisKnuYs/jzf5HzPnrsyOmg4e0+6dUKCNWsW ukdGJMXDA/p+KdiOskr/aI8NJqTe/t8Ebisqd+QbHwJiwPn6h86M6CS1VRghFl4+B8ZJ mwtw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:dkim-signature; bh=ilLoOVbY/JoZ0omSitaauoxMNrDozFxGRiP3rz6/S/4=; fh=4jtIdCtCxJ30uirP951cosvLj99QO/BeT5jzjNzwErc=; b=JFs0O3zV6ixxDbc2P3DI67tCevG6U3QzXtmDQvZVWLOMhY76cNCaFq/wW2uSbFmTt8 WeX3L44Sj9EYiMRWTPwNfDOaCPFyOaveQ/VRM36ctryZ4kGu89LOGWILst10igCBsUQ4 g6TdY29F8sFWdb7rTrAt/ZUcTZf/vRAnvhbjM0haHGq+tRdXg270K2UUzuoN5jQ2ZGVQ MIO2qgdqZC2PpOJsJhFaPC3mpc9Mrhc4zU08055nzoyaBeKiryCSsqK5gX/nUK29xWpe 1U9r3diKI/y1aZFj81/14Gzn2tyrRFb8TCY/k5Jb2fyWrr9f/176ihlUbE+TTAC+dOIv BxHQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@amarulasolutions.com header.s=google header.b=NvdV1FPK; spf=pass (google.com: domain of dario.binacchi@amarulasolutions.com designates 209.85.220.41 as permitted sender) smtp.mailfrom=dario.binacchi@amarulasolutions.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=amarulasolutions.com; dara=neutral header.i=@amarulasolutions.com Received: from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41]) by mx.google.com with SMTPS id ffacd0b85a97d-48e5e2ca6cesor916531f8f.4.2026.10.29.02.55.10 for (Google Transport Security); Thu, 29 Oct 2026 02:55:10 -0700 (PDT) Received-SPF: pass (google.com: domain of dario.binacchi@amarulasolutions.com designates 209.85.220.41 as permitted sender) client-ip=209.85.220.41; X-Forwarded-Encrypted: i=1; AKwUvBx6Dkktbb7G4opcobBqCZCy/iO48pJGFNNEoKoJhWU2LcU4IuSBJust6UPOxwmXL6Vd4YyASZjcGx6XEyuS@amarulasolutions.com X-Gm-Gg: AYBFou3OqEyp5ZUODx0t8rGmy387TD7p/aD5XflezkQdRgQHs/N1gcqFEtWeBEQiyLg u2q5JYYeLNCWiewFeJs5qKeyaaxiI4RIHTCSyWSrNRoKyQUwJHWAoWuw93A72IEuy9XaR0qGs5i g1AIoDwO1BExcgie1uFjbC/TYNeqG/O6Zbbx0/47lMvCQTOS8tnBVsUG3O7kAWl7uaO3yEcYaeX u+dffE3hgpb9kfH0EG8iJYw+aNhYfXOhxoKDFSLQ5pTR7HhJ7W2oElMNdOnWLJMQFZ0nABhGnGf yBj1NPMYCRTwMMFCtOQo3RfzLKELb1Y1E6XQ3VciIoQuNMz2HginK/rsw8bnlr8P3T2zyCmH99l mg1iYmQsNB3cEMbfzrJF21Foi677WE1yc9+1articQ78cD9ICtvQEjG2w0ozb1/flS2EQz8HWly aQly+OM44l1DZulodc2wvqWjBcAgMVK4AQ9XKXNda0RlHSdoSr3Lj5HlKNZWec1hrzC3I3xkYGW uoXOxv0+/q0M8TEXhWwO3PHNPQ2EgXhvLS18f2eTlk7VNpB6KUiaduE4WLI+dr4KA8iY8zjudOV bGEinXHN2ZXejDbKalGeVE6WVyfjjJxpSZdeJ9h0NfJKNLL677eCXdjHJt1eTplCh3fOQwYwMw7 /wTV+RVUnwI7Y2vF5NjJ9p3e8ySFAYDB9O9AY3BXsNpc9Y/UsVL+VUGndP2MJ76NidjPgwIGA3F mT8Nfa0qdllHWTAkwFxdBgnUA5xA== X-Received: by 2002:a05:600c:3c98:b0:4a1:f9e6:f418 with SMTP id 5b1f17b1804b1-4a967ba6b5amr110464295e9.34.1793267709708; Thu, 29 Oct 2026 02:55:09 -0700 (PDT) Received: from dario-ThinkPad-P14s-Gen-5.homenet.telecomitalia.it (host-79-14-29-58.business.telecomitalia.it. [79.14.29.58]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab69b54742sm15325595e9.15.2026.10.29.02.55.08 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 29 Oct 2026 02:55:09 -0700 (PDT) From: Dario Binacchi To: buildroot@buildroot.org Cc: Dario Binacchi , linux-amarula@amarulasolutions.com Subject: [PATCH v2] package/drogon: fix build with LibreSSL Date: Thu, 29 Oct 2026 10:54:59 +0100 Message-ID: <20261029095459.4163256-1-dario.binacchi@amarulasolutions.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 X-Original-Sender: dario.binacchi@amarulasolutions.com X-Original-Authentication-Results: mx.google.com; dkim=pass header.i=@amarulasolutions.com header.s=google header.b=NvdV1FPK; spf=pass (google.com: domain of dario.binacchi@amarulasolutions.com designates 209.85.220.41 as permitted sender) smtp.mailfrom=dario.binacchi@amarulasolutions.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=amarulasolutions.com; dara=neutral header.i=@amarulasolutions.com Precedence: list Mailing-list: list linux-amarula@amarulasolutions.com; contact linux-amarula+owners@amarulasolutions.com List-ID: X-Spam-Checked-In-Group: linux-amarula@amarulasolutions.com X-Google-Group-Id: 476853432473 List-Post: , List-Help: , List-Archive: List-Unsubscribe: , The trantor library bundled in drogon 1.9.14 fails to build against LibreSSL, because it uses SSL_CTX_set_cert_cb(), which LibreSSL does not provide. Backport the upstream commit, which disables that call when building against LibreSSL. The patch description explains the details. Fixes: - https://autobuild.buildroot.org/results/f1c7a336f3fabb2d2a2793930573b69bc47c3ee7 - https://autobuild.buildroot.org/results/795c9ab125a029f0d90a267147cb6d6d80887688 Signed-off-by: Dario Binacchi --- Changes v1 -> v2: - Point the Upstream: tag to the merged commit instead of the pull request. - Rename the patch to 0002, since 0001 is now taken by the CVE fix. - Update the commit message. ...0002-trantor-fix-build-with-LibreSSL.patch | 73 +++++++++++++++++++ 1 file changed, 73 insertions(+) create mode 100644 package/drogon/0002-trantor-fix-build-with-LibreSSL.patch diff --git a/package/drogon/0002-trantor-fix-build-with-LibreSSL.patch b/package/drogon/0002-trantor-fix-build-with-LibreSSL.patch new file mode 100644 index 000000000000..1813161fa9fc --- /dev/null +++ b/package/drogon/0002-trantor-fix-build-with-LibreSSL.patch @@ -0,0 +1,73 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Dario Binacchi +Date: Tue, 27 Oct 2026 11:39:26 +0100 +Subject: [PATCH] Fix build with LibreSSL + +The Buildroot autobuilders reported that trantor, built as part of +drogon, fails to compile against LibreSSL [1]. This patch fixes the +two errors below. + +1) SSL_CTX_set_cert_cb() is not declared + +OpenSSLProvider.cc:1623:9: error: 'SSL_CTX_set_cert_cb' was not declared in this scope + +Commit 7d3aac802ff5 ("Fixes and update to TLS subsystem (#411)") calls +SSL_CTX_set_cert_cb() to choose the server certificate during the TLS +handshake but LibreSSL does not provide this function. + +The same commit also registers a servername callback, which LibreSSL +supports and which chooses the server certificate as well, but only +when the client sends SNI. With LibreSSL, clients that do not send SNI +therefore get no certificate. + +2) lastOpenSSLError() is defined but not used + +OpenSSLProvider.cc:261:20: error: 'std::string internal::lastOpenSSLError()' defined but not used [-Werror=unused-function] + +lastOpenSSLError() is only called by code that is not built with +LibreSSL. With LibreSSL the function is unused, and -Werror turns the +resulting warning into an error. + +[1] https://autobuild.buildroot.org/results/f1c7a336f3fabb2d2a2793930573b69bc47c3ee7 + +Upstream: https://github.com/an-tao/trantor/commit/a77cc3651d5950f2f8aeceab80f74f31870f4017 +Signed-off-by: Dario Binacchi +--- + trantor/net/inner/tlsprovider/OpenSSLProvider.cc | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/trantor/trantor/net/inner/tlsprovider/OpenSSLProvider.cc b/trantor/trantor/net/inner/tlsprovider/OpenSSLProvider.cc +index e876ee97faf1..7b6f42d88d32 100644 +--- a/trantor/trantor/net/inner/tlsprovider/OpenSSLProvider.cc ++++ b/trantor/trantor/net/inner/tlsprovider/OpenSSLProvider.cc +@@ -258,6 +258,7 @@ static bool isDirectory(const std::string &path) + #endif + } + ++#ifndef LIBRESSL_VERSION_NUMBER + static std::string lastOpenSSLError() + { + const auto error = ERR_get_error(); +@@ -267,6 +268,7 @@ static std::string lastOpenSSLError() + ERR_error_string_n(error, message.data(), message.size()); + return message.data(); + } ++#endif + + static void freeCertificateNames(STACK_OF(X509_NAME) * names) + { +@@ -1620,9 +1622,14 @@ SSLContextPtr trantor::newSSLContext(const TLSPolicy &policy, bool isServer) + ctx->ctx(), + static_cast( + &OpenSSLProvider::selectServerCertificate)); ++#ifndef LIBRESSL_VERSION_NUMBER ++ // LibreSSL lacks SSL_CTX_set_cert_cb(). There, the certificate is ++ // selected by the servername callback only, so clients not sending ++ // SNI won't get a certificate. + SSL_CTX_set_cert_cb(ctx->ctx(), + &OpenSSLProvider::configureServerCertificate, + nullptr); ++#endif + // A resumed handshake may not select a certificate at all. Do not + // resume one without consulting the current runtime provider. + SSL_CTX_set_session_cache_mode(ctx->ctx(), SSL_SESS_CACHE_OFF);