Re: Fwd: sign-file.c:149:17: warning: implicit declaration of function ‘ENGINE_load_builtin_engines’

[James Bottomley <James.Bottomley@HansenPartnership.com>]

On Thu, 2023-11-23 at 18:42 -0500, Dennis Clarke wrote:
> On 11/23/23 09:53, James Bottomley wrote:
> > On Fri, 2023-11-17 at 00:34 -0500, Dennis Clarke wrote:
> > > On 11/16/23 18:41, Bagas Sanjaya wrote:
> > > > Hi,
> > > > 
> > > > I notice a bug report on Bugzilla [1]. Quoting from it:
> > > > 
> > > <snip>
> > > > > Not related to
> > > > > https://bugzilla.kernel.org/show_bug.cgi?id=215750 but I
> > > > > *feel* that this code needs a hug.
> > > > 
> > > > See Bugzilla for the full thread.
> > > > 
> > > > AFAIK, this looks like a bug when the kernel is compiled
> > > > against custom (non-system) version of OpenSSL library.
> > > > 
> > > 
> > > I do not know what you could possibly mean. There is nothing
> > > "custom" about OpenSSL. For that matter the gcc compiler I am
> > > using was also built by me. Works fine. The sign-file.c source
> > > compiles fine.
> > 
> > This has all the hallmarks of an openssl compiled without engine
> > support; is the symbol OPENSSL_NO_ENGINE set?  And which distro did
> > you get this library from?
> > 
> > James
> > 
> 
> I am looking into this. The code will likely age into some deprecated
> calls and I think that I may be way out on the edge here.

So you did build without engine support ...
 
>  However the code will need a pile of ifndef stuff and then call the
> correct future looking calls for OpenSSL 3.x etc etc etc ... the
> usual stuff

Well, not really: openssl is highly configurable and if it gets
configured wrongly, stuff like this happens.  That's why distros have a
fairly inclusive configuration and they stick to it.  No-one can cope
with the combinatoric explosion of openssl configuration possibilities
(even though they have ifdefs for most of them) so the only way is
really to fix a standard configuration and assume you're building for
it.

Openssl has been talking for ages about removing engine support, but
they've been unable to do so due to the rather slow pace of conversion
of their own engines.  I anticipate this code can be removed in favour
of the pkcs11 provider long before openssl actually manages to remove
engines.

James