Leo Famulari <leo@famulari.name> writes:

> On Sat, Nov 12, 2016 at 12:21:44PM +0100, Ludovic Courtès wrote:
>> Leo Famulari <leo@famulari.name> skribis:
>> > They changed how library runpaths are recorded at build time, and so our
>> > packaging no longer works:
>> >
>> > https://github.com/openssl/openssl/pull/1699
>> 
>> I would expect ld-wrapper to do the right thing regardless of what
>> OpenSSL’s build system does, no?
>
> So far, we've had to do some extra work in the openssl-next package
> definition:
>
> (add-after 'configure 'patch-runpath
>   (lambda* (#:key outputs #:allow-other-keys)
>     (let ((lib (string-append (assoc-ref outputs "out") "/lib")))
>       (substitute* "Makefile.shared"
>         (("\\$\\$\\{SHAREDCMD\\} \\$\\$\\{SHAREDFLAGS\\}")
>          (string-append "$${SHAREDCMD} $${SHAREDFLAGS}"
>                         " -Wl,-rpath," lib)))
>       #t)))))))))
>
> This phase still works to help OpenSSL's libraries find the libssl and
> libcrypto libraries, but the OpenSSL executable itself now lacks a
> reference to those libraries:
>
> starting phase `validate-runpath'
> validating RUNPATH of 5 binaries in "/gnu/store/d4669fp9lhvi85i97kbhwk3xprgqpv6v-openssl-1.1.0c/lib"...
> validating RUNPATH of 1 binaries in "/gnu/store/d4669fp9lhvi85i97kbhwk3xprgqpv6v-openssl-1.1.0c/bin"...
> /gnu/store/d4669fp9lhvi85i97kbhwk3xprgqpv6v-openssl-1.1.0c/bin/openssl: error: depends on 'libssl.so.1.1', which cannot be found in RUNPATH ("/gnu/store/iwgi9001dmmihrjg4rqhd6pa6788prjw-glibc-2.24/lib" "/gnu/store/cdi08kw7r6r684w8mk0xq0dkgpjhfpmd-gcc-4.9.4-lib/lib" "/gnu/store/cdi08kw7r6r684w8mk0xq0dkgpjhfpmd-gcc-4.9.4-lib/lib/gcc/x86_64-unknown-linux-gnu/4.9.4/../../..")
> /gnu/store/d4669fp9lhvi85i97kbhwk3xprgqpv6v-openssl-1.1.0c/bin/openssl: error: depends on 'libcrypto.so.1.1', which cannot be found in RUNPATH ("/gnu/store/iwgi9001dmmihrjg4rqhd6pa6788prjw-glibc-2.24/lib" "/gnu/store/cdi08kw7r6r684w8mk0xq0dkgpjhfpmd-gcc-4.9.4-lib/lib" "/gnu/store/cdi08kw7r6r684w8mk0xq0dkgpjhfpmd-gcc-4.9.4-lib/lib/gcc/x86_64-unknown-linux-gnu/4.9.4/../../..")
> validating RUNPATH of 0 binaries in "/gnu/store/wdzvwl9kx3iiq4fk2qyxg7sjxqq2qx3x-openssl-1.1.0c-static/lib"...
> phase `validate-runpath' failed after 0.0 seconds
> builder for `/gnu/store/ja9xpivxkfvbm2p6zs1vicdkk4ppq1is-openssl-1.1.0c.drv' failed with exit code 1
>
> Upstream discussion:
> https://github.com/openssl/openssl/pull/1688
> https://github.com/openssl/openssl/pull/1699
>
> My understanding is that this change was made for openssl@1.0.2 as well,
> so we will need to address it for the next big OpenSSL update. We should
> try packaging a Git snapshot of 1.0.2 now, so that we are ready.

I did this change for openssl@1.1.0 (attached). The 'config(ure)' script
now takes a -rpath flag which works as advertised.

However by duplicating the 'configure' phase, I discovered that the
'version' variable actually gets the inherited value when using
'substitute-keyword-arguments', and had to duplicate the
'remove-miscellany' phase as well, since it tried deleting a directory
called '$out/share/openssl-1.0.2j'. Should I file a bug for this, or
is it something intrinsically unfixable?