feat: support openssl from bcr

[zaucy]

No description provided.

[andrewkatson]

Did you want any assistance? I get a new computer tomorrow! So I can finally work on Mac, Linux, and Windows.

[zaucy]

Yeah feel free! I'm not sure when I'll get around to finishing it, but I'll be keeping tabs if you do!

[andrewkatson]

Okay! I get the last part today so hopefully Ill have a setup by tomorrow. Do you know what the main blockers right now are?

[zaucy]

what I noticed immediately is boost asio uses some openssl headers that seem to not be available on the openssl bcr module. I wasn't sure if I just misconfigured openssl though.

[andrewkatson]

oh intriguing. because openssl is the super set of boringssl. Ill reach out to the maintainer and see what they say.

[andrewkatson]

Ok I reached out and he told me to post raccoons-build/bazel-openssl-cc#1 which is their very first issue! @zaucy can you re-run the linux and windows checks.

[zaucy]

turned off fail fast so they'll all run - also made you a maintainer so feel free to adjust this PR or run the gh action as much as you need

[andrewkatson]

Nice thank you! Looks like the windows error is on their side too: https://github.com/bazelboost/asio/actions/runs/12381745142/job/34560955188?pr=5

[zaucy]

didn't realise they did a release recently - looks like its just Windows thats an issue

[andrewkatson]

Well I volunteered to add Windows support since I got openssl working on Windows previously. So we shall see. I am still building my computer but it will be done soon.

[andrewkatson]

@zaucy I have been working on the Windows support the past couple of days! But I ran into an issue where bazel isnt specifying the includes. bazelbuild/bazel#25171 Have you seen this before?

[zaucy]

From the looks of it it seems you're passing /I some\path when it should be /Isome\path.

Also you should prefer the includes and hdrs attribute over using /I in copts!

[andrewkatson]

OH the space. I wonder where we are doing that?

Edit: Oh it was implicitly adding a space in our copts between arguments which works on linux and mac but now Windows. Thank you!

[andrewkatson]

@zaucy Do you happen to understand perl scripts? Openssl uses them to generate .s files and for some reason on Windows a couple of maybe 30 fail to generate or are not valid. But bazel isnt really giving me more debugging info other than the genrule fails. Im not sure how to debug it.

[zaucy]

I'm not really familiar with perl. I do know however that genrules are a big pain on Windows. I tend to avoid them completely for that reason. Maybe using rules_perl for the scripts could help? Then instead of a genrule creating a proper rule that uses the perl binary and has well defined output paths with ctx.actions.*. That's just a blind guess though. I have no experience with rules_perl.

Openssl uses them to generate .s files and for some reason on Windows a couple of maybe 30 fail to generate or are not valid.

For the not generated part - if I were to guess it would be because the output paths are different on Windows in some subtle way.

[andrewkatson]

Thank you for the advice! I agree rules_perl would be much better. In the end I stumbled on the solution which was nasm wasnt setup properly on the container and it was silently failing.

Oh nevermind its still a problem lol fun

[andrewkatson]

@zaucy I created a perl_genrule that generates the assembly files from perl scripts. It really cleaned things up and seems to be working. But I get the oddest error whenever I try to build the libcrypto target. It thinks the .s files are inputs and cannot seem to find them. Ive added my genrule as a dep, a data, and an additional_compiler_input and it still says it cannot find the file. Could you take a look at my rule and see if there is anything obvious?

[andrewkatson]

My current guess is that because the genfiles are being generated in the bazel-out dir I must not be properly referring to them.

Generation:

# Configuration: 0de042f7f216bd39770efda4fe9ac141f679167720307fb3637d83903e80fc71
# Execution platform: @@platforms//host:host
SUBCOMMAND: # @@openssl+//:perlasm_genfiles [action 'Generating file bazel-out/darwin_arm64-fastbuild/bin/external/openssl+/crypto/sm4/sm4-armv8.S from script external/openssl+/crypto/aes/asm/vpaes-armv8.pl', configuration: 0de042f7f216bd39770efda4fe9ac141f679167720307fb36[37](https://github.com/raccoons-build/bazel-openssl-cc/actions/runs/13291627372/job/37113681694?pr=5#step:5:38)d83903e80fc71, execution platform: @@platforms//host:host, mnemonic: GenerateAssemblyFromPerlScripts]
(cd /private/var/tmp/_bazel_runner/c973e65f821f1a9c531cafa0f1d745d7/execroot/_main && \
  exec env - \
  /bin/bash -c 'perl external/openssl+/crypto/aes/asm/vpaes-armv8.pl nasm bazel-out/darwin_arm64-fastbuild/bin/external/openssl+/crypto/sm4/sm4-armv8.S')

Error:

ERROR: /private/var/tmp/_bazel_runner/c973e65f821f1a9c531cafa0f1d745d7/external/openssl+/BUILD.bazel:388:11: Compiling crypto/sm4/sm4-armv8.S failed: missing input file '@@openssl+//:crypto/sm4/sm4-armv8.S'
ERROR: /private/var/tmp/_bazel_runner/c973e65f821f1a9c531cafa0f1d745d7/external/openssl+/BUILD.bazel:388:11: Compiling crypto/sm4/sm4-armv8.S failed: 1 input file(s) do not exist

[andrewkatson]

Okay so its marking the generating action as successful but outputting no files (known to bazel). Thats the issue.
Query:

bazel query --registry="file:///tmp/bazel-central-registry" 'kind("generated file", @openssl//:perlasm_genfiles)'

Output:

Starting local Bazel server and connecting to it...
 no actions running
Loading: 0 packages loaded
Loading: 0 packages loaded
WARNING: Couldn't auto load rules or symbols, because no dependency on module/repository 'rules_android' found. This will result in a failure if there's a reference to those rules or symbols.
Loading: 0 packages loaded
Loading: 0 packages loaded
INFO: Empty results

[zaucy]

Are you using some absolute paths or internal bazel path assumptions? Could be part of the problem.

Want to link me the script? I can try to run it and try a few things maybe.

[andrewkatson]

It is kind of odd. The script only exists on my branch and the way I have been testing is running the github actions since there are quite a few steps.

raccoons-build/bazel-openssl-cc#5

The script being run looks like this though.

#!/bin/bash

set -euo pipefail

if [[ "$#" -ne 4 ]]; then
  echo "Need four params"
  exit 1
fi

binary_invocation="$1"
src_file="$2"
out_file="$3"
assembly_generator_invocation="$4"

${binary_invocation} ${src_file} ${assembly_generator_invocation} ${out_file}
if test -f ${out_file}; then
  echo "${out_file} exists"
else
  echo "${out_file} does not exist failing"
  exit 1
fi

exit 0

So it takes four params. An example would be

perl external/openssl+/crypto/aes/asm/aes-x86_64.pl elf bazel-out/k8-fastbuild/bin/external/openssl+/crypto/aes/aes-x86_64.s

Or if you ran from a fork of openssl directly it would be

perl crypto/aes/asm/aes-x86_64.pl elf crypto/aes/aes-x86_64.s

[andrewkatson]

I reproduced the error in https://github.com/andrewkatson/perl_genrule_problem.git if you wanted an easier playground for this

[andrewkatson]

Ok just to close the loop I was accidentally overwriting the files generated with each new generation...

[andrewkatson]

Update: This may not even be possible.... rules_perl isnt ready for Windows x86_64 and has no plans for arm64 as of now. So the most crucial part of the whole process -- generating the assembly with perl scripts -- cannot even be run.

[andrewkatson]

What is the plan if this is truly not possible? Because my other project is blocked on boost asio working for Bazel and I gave up on Windows on my personal project... So perhaps we should just say using boost asio with Bazel and openssl doesnt work on Windows until rules_perl works and/or Bazel stops overriding PATH with custom rules to not include Strawberry perl. I also asked a question on Bazel's github about why they exclude Strawberry perl from PATH on Windows in custom rules.

[andrewkatson]

Ok another reason this cannot be done. Openssl only generates assembly for Windows using nasm not masm. And the only nasm toolchain I can find for bazel only supports Linux and Mac. So like I am not sure what action I can even do here.

[andrewkatson]

@zaucy what can we do here?

[zaucy]

As I'm not very familiar with how openssl compiles on Windows at all I'm not sure. For my projects I've been pretty content using boringssl on Windows so it hasn't been much of an issue for me. As for support in boost.asio as long as boost asio compiles with openssl as a dep (even on windows if it's not used) then that seems fine at least for me and hopefully anyone else targetting Windows until openssl is actually supported in the BCR.

[andrewkatson]

WDYM? Without explicit Windows support will it ever compile with openssl as a dep? Or do you mean it needs to compile when boringssl is specified via flag -- which even with no Windows support it shouldn't be an issue iiuc? I will keep trying to get openssl working with Windows but I do feel concerned with the next steps. For instance, the only ways I see forward are either 1. Making my own custom toolchain and maintaining it or 2. Using msys-gcc or mingw-gcc as the host and local compiler which I am unsure of how supported those are so I reached out internally about that so Ill know more soon.

As far as boringssl in my project I cannot because we somehow use features in openssl that are not in boringssl -- I have tried compiling with boringssl and I get compilation errors around missing definitions. Also my project is millions of lines of legacy code that I inherited so I am unsure of the feasibility of fixing that. Especially since I am no cryptography expert and the cryptography used is complex, archaic, and widespread.

[zaucy]

WDYM? Without explicit Windows support will it ever compile with openssl as a dep? Or do you mean it needs to compile when boringssl is specified via flag -- which even with no Windows support it shouldn't be an issue iiuc?

I just mean that OpenSSL already has to be enabled via flag in this repo and the boost.asio in the BCR and as long as having openssl as a bazel dep in either one doesn't cause Windows to not build when using boringssl then it seems to be a non-issue for myself and I'm certain others.

However I understand that might not be feasible for you and your project you're inheriting. Sounds like a lot to manage. Does openssl compiles for Windows with MSVC + CMake upstream? I haven't looked at the official build instructions. If that's the case and the generated files from perl script is the limiting factor then could we not patch in those generated files just for Windows? Then running the perl script as a build step might not be necessary.

I did try your https://github.com/andrewkatson/perl_genrule_problem.git repo, but I didn't get anywhere with the time I was able to spend looking.

[andrewkatson]

WDYM? Without explicit Windows support will it ever compile with openssl as a dep? Or do you mean it needs to compile when boringssl is specified via flag -- which even with no Windows support it shouldn't be an issue iiuc?

I just mean that OpenSSL already has to be enabled via flag in this repo and the boost.asio in the BCR and as long as having openssl as a bazel dep in either one doesn't cause Windows to not build when using boringssl then it seems to be a non-issue for myself and I'm certain others.

However I understand that might not be feasible for you and your project you're inheriting. Sounds like a lot to manage. Does openssl compiles for Windows with MSVC + CMake upstream? I haven't looked at the official build instructions. If that's the case and the generated files from perl script is the limiting factor then could we not patch in those generated files just for Windows? Then running the perl script as a build step might not be necessary.

I did try your https://github.com/andrewkatson/perl_genrule_problem.git repo, but I didn't get anywhere with the time I was able to spend looking.

Okay that makes sense.

Its funny Openssl has this file which says it supports MSVC (which is what I am trying to do now) but only nasm not masm for the assembly. So I am wondering if there is a way to tell it to use nasm instead of masm.

[andrewkatson]

Oh intriguing it also supports masm but the comment in the file says it shouldn't be used in prod. So maybe Ill do that and just add that note for people using OpenSSL On Windows with Bazel.

[andrewkatson]

I found this from boringssl... https://github.com/rustls/boringssl/blob/018edfaaaeea43bf35a16e9f7ba24510c0c003bb/util/util.bzl#L149. So we could just get around this entire headache by disabling all the assembly... WDYT? between that and using OpenSSLs limited support for masm. @zaucy

[andrewkatson]

@zaucy I finished adding OpenSSL support for Windows with Bazel and am getting my pr reviewed now

[zaucy]

Congrats! That is great news

[andrewkatson]

Just an update. v1 of the review is done and now we are hashing out (hopefully) final details!