Skip to content

Commit 878dc42

Browse files
ForemanZack-CableLabspre-commit-ci[bot]
ForemanZack-CableLabs
and
pre-commit-ci[bot]
authored
Add openssl 3.5 to /opt/matter/openssl Crypto build docker only (project-chip#74150)
* Docker: isolate private OpenSSL installation and expose linkage selection Install OpenSSL 3.5 under /opt/matter/openssl while preserving system library discovery for unrelated tools. Add the OPENSSL_STATIC build argument and certification-image workflow input. CHIP_OPENSSL_ROOT and CHIP_OPENSSL_STATIC require the SDK configuration changes in the follow-up commit. Older SDK revisions ignore these variables and continue to use their existing OpenSSL discovery. * Docker: verify prebuilt OpenSSL libraries for CI reuse * Docker: defer certification-image workflow changes to SDK branch * Docker: bump shared image version to 212 for private OpenSSL * Build: include private OpenSSL selection and static target option with Docker images * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Docker: move SDK build changes and documentation to dependent branch * fixed version number --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
1 parent fe4e1c8 commit 878dc42

4 files changed

Lines changed: 59 additions & 25 deletions

File tree

‎integrations/docker/images/base/chip-build-minimal/Dockerfile‎

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ RUN set -x \
2222
wget
2323

2424
# Build and install OpenSSL 3.5 LTS (post-quantum ML-DSA / ML-KEM support)
25+
# Build once per image; CI jobs reuse these static and shared libraries.
2526
ARG OPENSSL_VERSION=3.5.0
2627
ARG OPENSSL_SHA256=344d0a79f1a9b08029b0744e2cc401a43f9c90acd1044d09a530b4885a8e9fc0
2728
RUN set -x \
@@ -30,9 +31,23 @@ RUN set -x \
3031
&& echo "${OPENSSL_SHA256} openssl-${OPENSSL_VERSION}.tar.gz" | sha256sum -c - \
3132
&& tar xzf openssl-${OPENSSL_VERSION}.tar.gz \
3233
&& cd openssl-${OPENSSL_VERSION} \
33-
&& ./Configure --prefix=/usr/local --openssldir=/etc/ssl --libdir=lib \
34+
&& ./Configure --prefix=/opt/matter/openssl --openssldir=/etc/ssl --libdir=lib \
3435
&& make -j$(nproc) \
3536
&& make install_sw \
36-
&& ldconfig \
37+
&& test "$(PKG_CONFIG_PATH= PKG_CONFIG_LIBDIR=/opt/matter/openssl/lib/pkgconfig pkg-config --modversion openssl)" = "$OPENSSL_VERSION" \
38+
&& test -f /opt/matter/openssl/lib/libssl.a \
39+
&& test -f /opt/matter/openssl/lib/libcrypto.a \
40+
&& test -f /opt/matter/openssl/lib/libssl.so \
41+
&& test -f /opt/matter/openssl/lib/libcrypto.so \
3742
&& cd / && rm -rf /tmp/openssl-${OPENSSL_VERSION}* \
3843
&& : # last line
44+
45+
# Unset uses host OpenSSL. Explicit true/false selects private OpenSSL with
46+
# static/dynamic linkage. Only the SDK's OpenSSL GN configuration consumes these.
47+
ARG OPENSSL_STATIC=
48+
RUN case "$OPENSSL_STATIC" in \
49+
''|true|false) ;; \
50+
*) echo "OPENSSL_STATIC must be empty (host), true (static), or false (dynamic)" >&2; exit 1 ;; \
51+
esac
52+
ENV CHIP_OPENSSL_ROOT=${OPENSSL_STATIC:+/opt/matter/openssl}
53+
ENV CHIP_OPENSSL_STATIC=${OPENSSL_STATIC}

‎integrations/docker/images/base/chip-build/Dockerfile‎

Lines changed: 20 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -207,14 +207,10 @@ RUN set -x \
207207
&& rm -rf /var/lib/apt/lists/ \
208208
&& : # last line
209209

210-
# Build and install OpenSSL 3.5 LTS from source.
211-
# Ubuntu 24.04 ships OpenSSL 3.0.x via libssl-dev (kept for apt dependency
212-
# resolution). Installing 3.5 into /usr/local makes it the default for
213-
# pkg-config based builds (e.g. chip-cert, CHIPCryptoPALOpenSSL) while the
214-
# system libssl-3 continues to satisfy runtime dependencies of other
215-
# apt-installed packages.
216-
# OpenSSL 3.5 is required for native ML-DSA / ML-KEM (post-quantum) support
217-
# in the default provider (FIPS 204 / FIPS 203).
210+
# Install OpenSSL 3.5 privately for SDK targets (including ML-DSA / ML-KEM).
211+
# Keep system headers, pkg-config metadata, CLI and loader defaults unchanged
212+
# for tools built in this image or later stages such as chip-build-cirque.
213+
# Build once per image; CI jobs reuse these static and shared libraries.
218214
ARG OPENSSL_VERSION=3.5.0
219215
ARG OPENSSL_SHA256=344d0a79f1a9b08029b0744e2cc401a43f9c90acd1044d09a530b4885a8e9fc0
220216
RUN set -x \
@@ -223,9 +219,23 @@ RUN set -x \
223219
&& echo "${OPENSSL_SHA256} openssl-${OPENSSL_VERSION}.tar.gz" | sha256sum -c - \
224220
&& tar xzf openssl-${OPENSSL_VERSION}.tar.gz \
225221
&& cd openssl-${OPENSSL_VERSION} \
226-
&& ./Configure --prefix=/usr/local --openssldir=/etc/ssl --libdir=lib \
222+
&& ./Configure --prefix=/opt/matter/openssl --openssldir=/etc/ssl --libdir=lib \
227223
&& make -j$(nproc) \
228224
&& make install_sw \
229-
&& ldconfig \
225+
&& test "$(PKG_CONFIG_PATH= PKG_CONFIG_LIBDIR=/opt/matter/openssl/lib/pkgconfig pkg-config --modversion openssl)" = "$OPENSSL_VERSION" \
226+
&& test -f /opt/matter/openssl/lib/libssl.a \
227+
&& test -f /opt/matter/openssl/lib/libcrypto.a \
228+
&& test -f /opt/matter/openssl/lib/libssl.so \
229+
&& test -f /opt/matter/openssl/lib/libcrypto.so \
230230
&& cd / && rm -rf /tmp/openssl-${OPENSSL_VERSION}* \
231231
&& : # last line
232+
233+
# Unset uses host OpenSSL. Explicit true/false selects private OpenSSL with
234+
# static/dynamic linkage. Only the SDK's OpenSSL GN configuration consumes these.
235+
ARG OPENSSL_STATIC=
236+
RUN case "$OPENSSL_STATIC" in \
237+
''|true|false) ;; \
238+
*) echo "OPENSSL_STATIC must be empty (host), true (static), or false (dynamic)" >&2; exit 1 ;; \
239+
esac
240+
ENV CHIP_OPENSSL_ROOT=${OPENSSL_STATIC:+/opt/matter/openssl}
241+
ENV CHIP_OPENSSL_STATIC=${OPENSSL_STATIC}

‎integrations/docker/images/base/chip-build/version‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
212 : [Silabs] Add MG26 LLVM Bluetooth library in EFR32
1+
213 : [OpenSSL] Prebuild private OpenSSL for SDK static and dynamic linkage

‎integrations/docker/images/chip-cert-bins/Dockerfile‎

Lines changed: 21 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,7 @@ RUN set -x \
124124
&& : # last line
125125

126126
# Build and install OpenSSL 3.5 LTS (post-quantum ML-DSA / ML-KEM support)
127+
# Build once per image; CI jobs reuse these static and shared libraries.
127128
ARG OPENSSL_VERSION=3.5.0
128129
ARG OPENSSL_SHA256=344d0a79f1a9b08029b0744e2cc401a43f9c90acd1044d09a530b4885a8e9fc0
129130
RUN set -x \
@@ -132,13 +133,27 @@ RUN set -x \
132133
&& echo "${OPENSSL_SHA256} openssl-${OPENSSL_VERSION}.tar.gz" | sha256sum -c - \
133134
&& tar xzf openssl-${OPENSSL_VERSION}.tar.gz \
134135
&& cd openssl-${OPENSSL_VERSION} \
135-
&& ./Configure --prefix=/usr/local --openssldir=/etc/ssl --libdir=lib \
136+
&& ./Configure --prefix=/opt/matter/openssl --openssldir=/etc/ssl --libdir=lib \
136137
&& make -j$(nproc) \
137138
&& make install_sw \
138-
&& ldconfig \
139+
&& test "$(PKG_CONFIG_PATH= PKG_CONFIG_LIBDIR=/opt/matter/openssl/lib/pkgconfig pkg-config --modversion openssl)" = "$OPENSSL_VERSION" \
140+
&& test -f /opt/matter/openssl/lib/libssl.a \
141+
&& test -f /opt/matter/openssl/lib/libcrypto.a \
142+
&& test -f /opt/matter/openssl/lib/libssl.so \
143+
&& test -f /opt/matter/openssl/lib/libcrypto.so \
139144
&& cd / && rm -rf /tmp/openssl-${OPENSSL_VERSION}* \
140145
&& : # last line
141146

147+
# Unset uses host OpenSSL. Explicit true/false selects private OpenSSL with
148+
# static/dynamic linkage. Only the SDK's OpenSSL GN configuration consumes these.
149+
ARG OPENSSL_STATIC=
150+
RUN case "$OPENSSL_STATIC" in \
151+
''|true|false) ;; \
152+
*) echo "OPENSSL_STATIC must be empty (host), true (static), or false (dynamic)" >&2; exit 1 ;; \
153+
esac
154+
ENV CHIP_OPENSSL_ROOT=${OPENSSL_STATIC:+/opt/matter/openssl}
155+
ENV CHIP_OPENSSL_STATIC=${OPENSSL_STATIC}
156+
142157
# Stage 1.5: Bootstrap Matter.
143158
RUN echo "Cloning at commit: ${COMMITHASH}" \
144159
&& git clone https://github.com/project-chip/connectedhomeip.git /root/connectedhomeip \
@@ -271,16 +286,10 @@ RUN apt-get update -y \
271286
&& rm -rf /var/lib/apt/lists/* \
272287
&& : # last line
273288

274-
# The apps below are linked against the OpenSSL 3.5 built from source in
275-
# Stage 1 (for ML-DSA / ML-KEM support), not the system 3.0.x that libcurl4
276-
# etc. pull in above. /usr/local/lib is scanned by ldconfig ahead of the
277-
# multiarch system library dirs (see /etc/ld.so.conf.d/libc.conf), so
278-
# dropping the 3.5 build there and refreshing the cache makes the dynamic
279-
# linker prefer it for libssl.so.3/libcrypto.so.3 without needing to remove
280-
# the apt-installed libssl3.
281-
COPY --from=chip-build-cert-bins /usr/local/lib/libssl.so* /usr/local/lib/
282-
COPY --from=chip-build-cert-bins /usr/local/lib/libcrypto.so* /usr/local/lib/
283-
RUN ldconfig
289+
# Dynamic SDK binaries have a RUNPATH to this private installation. System
290+
# tools continue to load Ubuntu's OpenSSL; do not register these with ldconfig.
291+
COPY --from=chip-build-cert-bins /opt/matter/openssl/lib/libssl.so* /opt/matter/openssl/lib/
292+
COPY --from=chip-build-cert-bins /opt/matter/openssl/lib/libcrypto.so* /opt/matter/openssl/lib/
284293

285294
WORKDIR /root/
286295
COPY --from=chip-build-cert-bins /root/.sdk-sha-version .sdk-sha-version

0 commit comments

Comments
 (0)