mirror of
https://github.com/neondatabase/neon.git
synced 2025-12-22 21:59:59 +00:00
Link OpenSSL dynamically (#10302)
## Problem Statically linked OpenSSL is buggy in multithreaded environment: - https://github.com/neondatabase/cloud/issues/16155 - https://github.com/neondatabase/neon/issues/8275 ## Summary of changes - Link OpenSSL dynamically (revert OpenSSL part from https://github.com/neondatabase/neon/pull/8074) Before: ``` ldd /usr/local/v17/lib/libpq.so linux-vdso.so.1 (0x0000ffffb5ce4000) libm.so.6 => /lib/aarch64-linux-gnu/libm.so.6 (0x0000ffffb5c10000) libc.so.6 => /lib/aarch64-linux-gnu/libc.so.6 (0x0000ffffb5650000) /lib/ld-linux-aarch64.so.1 (0x0000ffffb5ca7000) ``` After: ``` ldd /usr/local/v17/lib/libpq.so linux-vdso.so.1 (0x0000ffffbf3e8000) libssl.so.3 => /lib/aarch64-linux-gnu/libssl.so.3 (0x0000ffffbf260000) libcrypto.so.3 => /lib/aarch64-linux-gnu/libcrypto.so.3 (0x0000ffffbec00000) libm.so.6 => /lib/aarch64-linux-gnu/libm.so.6 (0x0000ffffbf1c0000) libc.so.6 => /lib/aarch64-linux-gnu/libc.so.6 (0x0000ffffbea50000) /lib/ld-linux-aarch64.so.1 (0x0000ffffbf3ab000) ```
This commit is contained in:
committed by
GitHub
parent
d1bc36f536
commit
b2d0e1a519
@@ -71,6 +71,7 @@ RUN set -e \
|
|||||||
ca-certificates \
|
ca-certificates \
|
||||||
# System postgres for use with client libraries (e.g. in storage controller)
|
# System postgres for use with client libraries (e.g. in storage controller)
|
||||||
postgresql-15 \
|
postgresql-15 \
|
||||||
|
openssl \
|
||||||
&& rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* \
|
&& rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* \
|
||||||
&& useradd -d /data neon \
|
&& useradd -d /data neon \
|
||||||
&& chown -R neon:neon /data
|
&& chown -R neon:neon /data
|
||||||
|
|||||||
3
Makefile
3
Makefile
@@ -3,7 +3,6 @@ ROOT_PROJECT_DIR := $(dir $(abspath $(lastword $(MAKEFILE_LIST))))
|
|||||||
# Where to install Postgres, default is ./pg_install, maybe useful for package managers
|
# Where to install Postgres, default is ./pg_install, maybe useful for package managers
|
||||||
POSTGRES_INSTALL_DIR ?= $(ROOT_PROJECT_DIR)/pg_install/
|
POSTGRES_INSTALL_DIR ?= $(ROOT_PROJECT_DIR)/pg_install/
|
||||||
|
|
||||||
OPENSSL_PREFIX_DIR := /usr/local/openssl
|
|
||||||
ICU_PREFIX_DIR := /usr/local/icu
|
ICU_PREFIX_DIR := /usr/local/icu
|
||||||
|
|
||||||
#
|
#
|
||||||
@@ -26,11 +25,9 @@ endif
|
|||||||
ifeq ($(shell test -e /home/nonroot/.docker_build && echo -n yes),yes)
|
ifeq ($(shell test -e /home/nonroot/.docker_build && echo -n yes),yes)
|
||||||
# Exclude static build openssl, icu for local build (MacOS, Linux)
|
# Exclude static build openssl, icu for local build (MacOS, Linux)
|
||||||
# Only keep for build type release and debug
|
# Only keep for build type release and debug
|
||||||
PG_CFLAGS += -I$(OPENSSL_PREFIX_DIR)/include
|
|
||||||
PG_CONFIGURE_OPTS += --with-icu
|
PG_CONFIGURE_OPTS += --with-icu
|
||||||
PG_CONFIGURE_OPTS += ICU_CFLAGS='-I/$(ICU_PREFIX_DIR)/include -DU_STATIC_IMPLEMENTATION'
|
PG_CONFIGURE_OPTS += ICU_CFLAGS='-I/$(ICU_PREFIX_DIR)/include -DU_STATIC_IMPLEMENTATION'
|
||||||
PG_CONFIGURE_OPTS += ICU_LIBS='-L$(ICU_PREFIX_DIR)/lib -L$(ICU_PREFIX_DIR)/lib64 -licui18n -licuuc -licudata -lstdc++ -Wl,-Bdynamic -lm'
|
PG_CONFIGURE_OPTS += ICU_LIBS='-L$(ICU_PREFIX_DIR)/lib -L$(ICU_PREFIX_DIR)/lib64 -licui18n -licuuc -licudata -lstdc++ -Wl,-Bdynamic -lm'
|
||||||
PG_CONFIGURE_OPTS += LDFLAGS='-L$(OPENSSL_PREFIX_DIR)/lib -L$(OPENSSL_PREFIX_DIR)/lib64 -L$(ICU_PREFIX_DIR)/lib -L$(ICU_PREFIX_DIR)/lib64 -Wl,-Bstatic -lssl -lcrypto -Wl,-Bdynamic -lrt -lm -ldl -lpthread'
|
|
||||||
endif
|
endif
|
||||||
|
|
||||||
UNAME_S := $(shell uname -s)
|
UNAME_S := $(shell uname -s)
|
||||||
|
|||||||
@@ -190,21 +190,6 @@ RUN for package in Capture::Tiny DateTime Devel::Cover Digest::MD5 File::Spec JS
|
|||||||
&& make install \
|
&& make install \
|
||||||
&& rm -rf ../lcov.tar.gz
|
&& rm -rf ../lcov.tar.gz
|
||||||
|
|
||||||
# Compile and install the static OpenSSL library
|
|
||||||
ENV OPENSSL_VERSION=1.1.1w
|
|
||||||
ENV OPENSSL_PREFIX=/usr/local/openssl
|
|
||||||
RUN wget -O /tmp/openssl-${OPENSSL_VERSION}.tar.gz https://www.openssl.org/source/openssl-${OPENSSL_VERSION}.tar.gz && \
|
|
||||||
echo "cf3098950cb4d853ad95c0841f1f9c6d3dc102dccfcacd521d93925208b76ac8 /tmp/openssl-${OPENSSL_VERSION}.tar.gz" | sha256sum --check && \
|
|
||||||
cd /tmp && \
|
|
||||||
tar xzvf /tmp/openssl-${OPENSSL_VERSION}.tar.gz && \
|
|
||||||
rm /tmp/openssl-${OPENSSL_VERSION}.tar.gz && \
|
|
||||||
cd /tmp/openssl-${OPENSSL_VERSION} && \
|
|
||||||
./config --prefix=${OPENSSL_PREFIX} -static --static no-shared -fPIC && \
|
|
||||||
make -j "$(nproc)" && \
|
|
||||||
make install && \
|
|
||||||
cd /tmp && \
|
|
||||||
rm -rf /tmp/openssl-${OPENSSL_VERSION}
|
|
||||||
|
|
||||||
# Use the same version of libicu as the compute nodes so that
|
# Use the same version of libicu as the compute nodes so that
|
||||||
# clusters created using inidb on pageserver can be used by computes.
|
# clusters created using inidb on pageserver can be used by computes.
|
||||||
#
|
#
|
||||||
|
|||||||
Reference in New Issue
Block a user