[PATCH] ci: container: build openssl against musl

[PATCH] ci: container: build openssl against musl

[Thomas Bonnefille]

Since 3c739b95ee ("sandbox: enable keytoc in hosttools_defconfig") the
hosttools_defconfig also builds keytoc a tool required to inject
cryptographic keys in a device tree.
This software needs openssl to be compiled. However, as barebox-ci is
using Debian as the base of its container, the openssl package given by
apt is compiled with the glibc.

In order to compile keytoc with musl, build a version of openssl against
musl in the barebox-ci container.

Signed-off-by: Thomas Bonnefille <thomas.bonnefille@bootlin.com>
---
Hello, I added the support to build openssl against Musl, this fixes the
commit 3c739b9 in CI.
Another patch has been sent previously to fix this issue
(https://lore.kernel.org/barebox/20260805142055.3844660-1-a.fatoum@pengutronix.de/)

I didn't find it in the 'next' branch of the Github repository
(git.pengutronix.de seems down on my side) and I assumed it wasn't
applied so I didn't include a revert commit for it.
---
 test/Containerfile | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/test/Containerfile b/test/Containerfile
index 296835d080..00f24a210f 100644
--- a/test/Containerfile
+++ b/test/Containerfile
@@ -118,4 +118,17 @@ ENV LLVM_SUFFIX=-${LLVM_VERSION}
 RUN ln -Ts /usr/lib/llvm-${LLVM_VERSION}/lib/clang/${LLVM_VERSION}/lib/linux/ \
            /usr/lib/llvm-${LLVM_VERSION}/lib/clang/${LLVM_VERSION}/lib/x86_64-pc-linux-gnu
 
+ENV OPENSSL_VERSION=3.5.6
+ENV PKG_CONFIG_PATH=/opt/openssl-musl/lib64/pkgconfig
+RUN cd /tmp && \
+	wget https://github.com/openssl/openssl/releases/download/openssl-$OPENSSL_VERSION/openssl-$OPENSSL_VERSION.tar.gz && \
+	echo "deae7c80cba99c4b4f940ecadb3c3338b13cb77418409238e57d7f31f2a3b736 openssl-$OPENSSL_VERSION.tar.gz" | sha256sum --check --status && \
+	tar -xzf openssl-$OPENSSL_VERSION.tar.gz && \
+	cd openssl-$OPENSSL_VERSION && \
+	./Configure linux-x86_64 no-shared no-tests no-secure-memory no-afalgeng \
+		--prefix=/opt/openssl-musl --openssldir=/opt/openssl-musl/ssl CC=musl-gcc && \
+	make -j$(nproc) && make install_sw && \
+	ln -s /opt/openssl-musl/include/openssl /usr/include/x86_64-linux-musl && \
+	rm -rf /tmp/openssl-$OPENSSL_VERSION.tar.gz /tmp/openssl-$OPENSSL_VERSION
+
 USER barebox:barebox

---
base-commit: 4705656eeeaba0dd3617b69172328daf4dbf9060
change-id: 20260806-add-openssl-musl-to-ci-f086904d4648

Best regards,
--  
Thomas Bonnefille <thomas.bonnefille@bootlin.com>

Re: [PATCH] ci: container: build openssl against musl

[Ahmad Fatoum]

Hello Thomas,

thanks for your patch!

On 8/11/26 7:22 PM, Thomas Bonnefille wrote:
> Since 3c739b95ee ("sandbox: enable keytoc in hosttools_defconfig") the
> hosttools_defconfig also builds keytoc a tool required to inject
> cryptographic keys in a device tree.
> This software needs openssl to be compiled. However, as barebox-ci is
> using Debian as the base of its container, the openssl package given by
> apt is compiled with the glibc.
> 
> In order to compile keytoc with musl, build a version of openssl against
> musl in the barebox-ci container.
> 
> Signed-off-by: Thomas Bonnefille <thomas.bonnefille@bootlin.com>
> ---
> Hello, I added the support to build openssl against Musl, this fixes the
> commit 3c739b9 in CI.
> Another patch has been sent previously to fix this issue
> (https://lore.kernel.org/barebox/20260805142055.3844660-1-a.fatoum@pengutronix.de/)
> 
> I didn't find it in the 'next' branch of the Github repository
> (git.pengutronix.de seems down on my side) and I assumed it wasn't
> applied so I didn't include a revert commit for it.

When issues pop up while a patch is in next, fixes can be squashed into
it. After a release, next is merged onto master, which experiences no
rewriting of history.

My patch was squashed as can be seen when you look at next's
.github/workflows/musl-tools.yml

I will send a revert for my patch once this patch is applied and a new
CI container has been rebuilt.

> ---
>  test/Containerfile | 13 +++++++++++++
>  1 file changed, 13 insertions(+)
> 
> diff --git a/test/Containerfile b/test/Containerfile
> index 296835d080..00f24a210f 100644
> --- a/test/Containerfile
> +++ b/test/Containerfile
> @@ -118,4 +118,17 @@ ENV LLVM_SUFFIX=-${LLVM_VERSION}
>  RUN ln -Ts /usr/lib/llvm-${LLVM_VERSION}/lib/clang/${LLVM_VERSION}/lib/linux/ \
>             /usr/lib/llvm-${LLVM_VERSION}/lib/clang/${LLVM_VERSION}/lib/x86_64-pc-linux-gnu
>  
> +ENV OPENSSL_VERSION=3.5.6
> +ENV PKG_CONFIG_PATH=/opt/openssl-musl/lib64/pkgconfig
> +RUN cd /tmp && \
> +	wget https://github.com/openssl/openssl/releases/download/openssl-$OPENSSL_VERSION/openssl-$OPENSSL_VERSION.tar.gz && \
> +	echo "deae7c80cba99c4b4f940ecadb3c3338b13cb77418409238e57d7f31f2a3b736 openssl-$OPENSSL_VERSION.tar.gz" | sha256sum --check --status && \
> +	tar -xzf openssl-$OPENSSL_VERSION.tar.gz && \
> +	cd openssl-$OPENSSL_VERSION && \
> +	./Configure linux-x86_64 no-shared no-tests no-secure-memory no-afalgeng \
> +		--prefix=/opt/openssl-musl --openssldir=/opt/openssl-musl/ssl CC=musl-gcc && \
> +	make -j$(nproc) && make install_sw && \
> +	ln -s /opt/openssl-musl/include/openssl /usr/include/x86_64-linux-musl && \
> +	rm -rf /tmp/openssl-$OPENSSL_VERSION.tar.gz /tmp/openssl-$OPENSSL_VERSION

I assume this doesn't increase container size too much, so this looks
good to me:

Reviewed-by: Ahmad Fatoum <a.fatoum@pengutronix.de>

Cheers,
Ahmad

> +
>  USER barebox:barebox
> 
> ---
> base-commit: 4705656eeeaba0dd3617b69172328daf4dbf9060
> change-id: 20260806-add-openssl-musl-to-ci-f086904d4648
> 
> Best regards,
> --  
> Thomas Bonnefille <thomas.bonnefille@bootlin.com>
> 
> 

-- 
Pengutronix e.K.                  |                             |
Steuerwalder Str. 21              | http://www.pengutronix.de/  |
31137 Hildesheim, Germany         | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686  | Fax:   +49-5121-206917-5555 |

Re: [PATCH] ci: container: build openssl against musl

[Sascha Hauer]

On Tue, 11 Aug 2026 19:22:14 +0200, Thomas Bonnefille wrote:
> Since 3c739b95ee ("sandbox: enable keytoc in hosttools_defconfig") the
> hosttools_defconfig also builds keytoc a tool required to inject
> cryptographic keys in a device tree.
> This software needs openssl to be compiled. However, as barebox-ci is
> using Debian as the base of its container, the openssl package given by
> apt is compiled with the glibc.
> 
> [...]

Applied, thanks!

[1/1] ci: container: build openssl against musl
      https://git.pengutronix.de/cgit/barebox/commit/?id=e0e425a5c73c (link may not be stable)

Best regards,
-- 
Sascha Hauer <s.hauer@pengutronix.de>