@cryptotaxi247 / netdata-1 / commits / 7707f9aa3

Fixed handling of OpenSSL on CentOS/RHEL by bundling a static copy and selecting a configuration directory at install time. (#9263)

* Bundle static OpenSSL in our static builds. This adds code to bundle a static locally built copy of OpenSSL into our static builds instead of using the Alpine provided copy. It fixes two cases where our usage of OpenSSL currently fails: * On CentOS, RHEL, OEL, Amazon Linux, and their derivatives, the OpenSSL configuration directory is `/etc/pki/tls` instead of the normal `/etc/ssl`. Any usage of TLS in our static builds currently fails there because it can't find that directory. * TLS usage fails similarly on systems that do not have OpenSSL at all for the same reason. To fix this, the newly bundled copy of OpenSSL is built to use `/opt/netdata/etc/ssl` as it's configuration directory. This directory is a symlink created at install time pointing to one of the following locations (in order of precedence): * `/etc/pki/tls` (for CentOS, RHEL, OEL, AL, and similar). * `/etc/ssl` (for sane distros that just use the default path). * `/opt/netdata/share/ssl` (for systems that don't have OpenSSL, this contains a copy of the config and certificates from the build environment). * Ensure other components are built with local OpenSSL. * Clone directly from the desired tag.

Austin S. Hemmelgarn committed Jun 5, 2020 at 08:12 UTC 7707f9aa3afaacfab6612a66f9e643be91f7f00f
8 files changed +46
packaging/makeself/install-or-update.sh
+18
@@ -248,6 +248,24 @@ fi
248
249 # -----------------------------------------------------------------------------
250
251 +echo "Configure TLS certificate paths"
252 +if [ ! -L /opt/netdata/etc/ssl ] && [ -d /opt/netdata/etc/ssl ] ; then
253 + echo "Preserving existing user configuration for TLS"
254 +else
255 + if [ -d /etc/pki/tls ] ; then
256 + echo "Using /etc/pki/tls for TLS configuration and certificates"
257 + ln -sf /etc/pki/tls /opt/netdata/etc/ssl
258 + elif [ -d /etc/ssl ] ; then
259 + echo "Using /etc/ssl for TLS configuration and certificates"
260 + ln -sf /etc/ssl /opt/netdata/etc/ssl
261 + else
262 + echo "Using bundled TLS configuration and certificates"
263 + ln -sf /opt/netdata/share/ssl /opt/netdata/etc/ssl
264 + fi
265 +fi
266 +
267 +# -----------------------------------------------------------------------------
268 +
269 echo "Save install options"
270 grep -qv 'IS_NETDATA_STATIC_BINARY="yes"' "${NETDATA_PREFIX}/etc/netdata/.environment" || echo IS_NETDATA_STATIC_BINARY=\"yes\" >> "${NETDATA_PREFIX}/etc/netdata/.environment"
271 sed -i "s/REINSTALL_OPTIONS=\".*\"/REINSTALL_OPTIONS=\"${REINSTALL_OPTIONS}\"/" "${NETDATA_PREFIX}/etc/netdata/.environment"
packaging/makeself/jobs/20-openssl.install.sh new
+17
@@ -0,0 +1,17 @@
1 +#!/usr/bin/env bash
2 +# SPDX-License-Identifier: GPL-3.0-or-later
3 +
4 +# shellcheck source=packaging/makeself/functions.sh
5 +. "$(dirname "${0}")/../functions.sh" "${@}" || exit 1
6 +
7 +version="$(cat "$(dirname "${0}")/../openssl.version")"
8 +
9 +export LDFLAGS='-static'
10 +export PKG_CONFIG="pkg-config --static"
11 +
12 +run git clone --branch "${version}" --single-branch git://git.openssl.org/openssl.git "${NETDATA_MAKESELF_PATH}/tmp/openssl"
13 +cd "${NETDATA_MAKESELF_PATH}/tmp/openssl" || exit 1
14 +
15 +run ./config no-shared no-tests --prefix=/openssl-static --openssldir=/opt/netdata/etc/ssl
16 +run make -j "$(nproc)"
17 +run make -j "$(nproc)" install_sw
packaging/makeself/jobs/50-bash-4.4.18.install.sh
+2
@@ -6,6 +6,8 @@
6
7 fetch "bash-4.4.18" "http://ftp.gnu.org/gnu/bash/bash-4.4.18.tar.gz"
8
9 +export PKG_CONFIG_PATH="/opnessl/lib/pkgconfig"
10 +
11 run ./configure \
12 --prefix="${NETDATA_INSTALL_PATH}" \
13 --without-bash-malloc \
packaging/makeself/jobs/50-curl-7.60.0.install.sh
+1
@@ -8,6 +8,7 @@ fetch "curl-curl-7_60_0" "https://github.com/curl/curl/archive/curl-7_60_0.tar.g
8
9 export LDFLAGS="-static"
10 export PKG_CONFIG="pkg-config --static"
11 +export PKG_CONFIG_PATH="/opnessl/lib/pkgconfig"
12
13 run ./buildconf
14
packaging/makeself/jobs/50-fping-4.2.install.sh
+1
@@ -7,6 +7,7 @@
7 fetch "fping-4.2" "https://github.com/schweikert/fping/releases/download/v4.2/fping-4.2.tar.gz"
8
9 export CFLAGS="-static"
10 +export PKG_CONFIG_PATH="/opnessl/lib/pkgconfig"
11
12 run ./configure \
13 --prefix="${NETDATA_INSTALL_PATH}" \
packaging/makeself/jobs/70-netdata-git.install.sh
+1
@@ -18,6 +18,7 @@ export IS_NETDATA_STATIC_BINARY="yes"
18
19 # Set eBPF LIBC to "static" to bundle the `-static` variant of the kernel-collector
20 export EBPF_LIBC="static"
21 +export PKG_CONFIG_PATH="/opnessl/lib/pkgconfig"
22
23 run ./netdata-installer.sh \
24 --install "${NETDATA_INSTALL_PARENT}" \
packaging/makeself/jobs/99-makeself.install.sh
+5
@@ -52,6 +52,11 @@ exec "${NETDATA_INSTALL_PATH}/bin/srv/netdata" "\${@}"
52 EOF
53 run chmod 755 "${NETDATA_INSTALL_PATH}/bin/netdata"
54
55 +# -----------------------------------------------------------------------------
56 +# copy the SSL/TLS configuration and certificates from the build system
57 +
58 +run cp -a /etc/ssl "${NETDATA_INSTALL_PATH}/share/ssl"
59 +
60 # -----------------------------------------------------------------------------
61 # remove the links to allow untaring the archive
62
packaging/makeself/openssl.version new
+1
@@ -0,0 +1 @@
1 +OpenSSL_1_1_1g