Repository navigation
Can't build '_ssl' extension with Python 3.11.2 and OpenSSL 3.1 #103242
Description
Bug report
I have tried to build latest tagged release of Python v3.11.2 on a CentOS7 system with locally built OpenSSL library v3.1.0. During configuration step ssl library and headers are properly found. When I build Python I encounter error:
building '_ssl' extension
gcc -pthread .... /Modules/_ssl.o
_ssl.c: In function '_ssl__SSLContext_set_ecdh_curve':
/.../Python/Modules/_ssl.c:4344:11: error: implicit declaration of function 'EC_KEY_new_by_curve_name' [-Werror=implicit-function-declaration]
4344 | key = EC_KEY_new_by_curve_name(nid);
| ^~~~~~~~~~~~~~~~~~~~~~~~
/.../Python/Modules/_ssl.c:4344:9: warning: assignment to 'EC_KEY *' {aka 'struct ec_key_st *'} from 'int' makes pointer from integer without a cast [-Wint-conversion]
4344 | key = EC_KEY_new_by_curve_name(nid);
| ^
/.../Python/Modules/_ssl.c:4350:5: error: implicit declaration of function 'EC_KEY_free'; did you mean 'EVP_KEM_free'? [-Werror=implicit-function-declaration]
4350 | EC_KEY_free(key);
| ^~~~~~~~~~~
| EVP_KEM_free
cc1: some warnings being treated as errors
Looking inside OpenSSL sources for mentioned functions EC_KEY_new_by_curve_name and EC_KEY_free I can see in the file include/openssl/ec.h that they have been deprecated. I suppose that these functions need to be removed from Python's file Python/Modules/_ssl.c but I don't know anything about the details of OpenSSL so I would appreciate any help what to do in this case.
Your environment
- virtual computer running CentOS7
- GCC 12.2
- Python 3.12.2
- OpenSSL 3.1
- configure called with:
./configure --prefix="$INSTALLROOT"
${OPENSSL_ROOT:+--with-openssl=$OPENSSL_ROOT}
${OPENSSL_ROOT:+--with-openssl-rpath=no}
--enable-shared --with-system-expat --with-ensurepip=install
Activity
corona10 commentedon Apr 8, 2023
cc @gpshead
corona10 commentedon Apr 8, 2023
Hmm, interesting, I succeeded in building CPython with OpenSSL 3.1.0 on my Ubuntu machine (without any change).
pythongh-103242: Migrate SSLContext.set_ecdh_curve not to use depreca…
gh-103242: Migrate SSLContext.set_ecdh_curve not to use deprecated AP…
pythongh-103242: Migrate SSLContext.set_ecdh_curve not to use depreca…
gpshead commentedon Apr 8, 2023
My "understanding" of the OpenSSL APIs is that the old API still exists but can require a compiler define to expose it? Regardless, moving to the modern API is preferred. Thanks for the report and the PR. the 3.11 change will automerge after CI.
gh-103242: Migrate SSLContext.set_ecdh_curve not to use deprecated AP…
pythongh-103242: Migrate SSLContext.set_ecdh_curve not to use depreca…