Default to dynamically linking OpenSSL on Linux

ianhattendorf · ianhattendorf · commit 38d64f2567b8 · 2022-04-25T17:24:30.000-07:00
Statically link if NODEGIT_OPENSSL_STATIC_LINK=1
diff --git a/generate/templates/templates/binding.gyp b/generate/templates/templates/binding.gyp
@@ -3,6 +3,7 @@
     "is_electron%": "<!(node ./utils/isBuildingForElectron.js <(node_root_dir))",
     "is_IBMi%": "<!(node -p \"os.platform() == 'aix' && os.type() == 'OS400' ? 1 : 0\")",
     "electron_openssl_root%": "<!(node ./utils/getElectronOpenSSLRoot.js <(module_root_dir))",
+    "electron_openssl_static%": "<!(node -p \"process.platform !== 'linux' || process.env.NODEGIT_OPENSSL_STATIC_LINK === '1' ? 1 : 0\")",
     "macOS_deployment_target": "10.11"
   },
 
@@ -175,15 +176,21 @@
             "-std=c++14"
           ],
           "conditions": [
-            ["<(is_electron) == 1", {
+            ["<(is_electron) == 1 and <(electron_openssl_static) == 1", {
               "include_dirs": [
                 "<(electron_openssl_root)/include"
               ],
               "libraries": [
-                # this order is signifcant on centos7 apparently...
+                # this order is significant on centos7 apparently...
                 "<(electron_openssl_root)/lib/libssl.a",
                 "<(electron_openssl_root)/lib/libcrypto.a"
               ]
+            }],
+            ["<(is_electron) == 1 and <(electron_openssl_static) != 1", {
+              "libraries": [
+                "-lcrypto",
+                "-lssl"
+              ]
             }]
           ],
         }],
diff --git a/guides/install/from-source/README.md b/guides/install/from-source/README.md
@@ -65,7 +65,7 @@ npm install nodegit --msvs_version=2013
 ```
 
 ### Electron and OpenSSL ###
-A local version of OpenSSL is required when building for Electron on Windows and macOS. This is due to Electron using BoringSSL, as we are not able to link to it like we are OpenSSL in Node.
+A local version of OpenSSL is required when building for Electron on Windows and macOS. This is due to Electron using BoringSSL, as we are not able to link to it like we are OpenSSL in Node. Additionally, OpenSSL can be statically linked on Linux by setting the `NODEGIT_OPENSSL_STATIC_LINK` environment variable to `1`.
 
 `acquireOpenSSL.js` will attempt to download and build OpenSSL locally. On macOS, this should Just Work(tm). On Windows, things are a little trickier.
 
diff --git a/utils/acquireOpenSSL.js b/utils/acquireOpenSSL.js
@@ -196,6 +196,16 @@ const makeOnStreamDownloadProgress = () => {
 };
 
 const buildOpenSSLIfNecessary = async (openSSLVersion, macOsDeploymentTarget) => {
+  if (process.platform !== "darwin" && process.platform !== "win32" && process.platform !== 'linux') {
+    console.log(`Skipping OpenSSL build, not required on ${process.platform}`);
+    return;
+  }
+
+  if (process.platform === 'linux' && process.env.NODEGIT_OPENSSL_STATIC_LINK !== '1') {
+    console.log(`Skipping OpenSSL build, NODEGIT_OPENSSL_STATIC_LINK !== 1`);
+    return;
+  }
+
   await removeOpenSSLIfOudated(openSSLVersion);
 
   try {
@@ -225,7 +235,7 @@ const buildOpenSSLIfNecessary = async (openSSLVersion, macOsDeploymentTarget) =>
 
   if (process.platform === "darwin") {
     await buildDarwin(buildCwd, macOsDeploymentTarget);
-  } else if (process.platform === "linux") {
+  } else if (process.platform === "linux" && process.env.NODEGIT_OPENSSL_STATIC_LINK === '1') {
     await buildLinux(buildCwd);
   } else if (process.platform === "win32") {
     await buildWin32(buildCwd);
@@ -237,6 +247,16 @@ const buildOpenSSLIfNecessary = async (openSSLVersion, macOsDeploymentTarget) =>
 }
 
 const downloadOpenSSLIfNecessary = async (downloadBinUrl, maybeDownloadSha256) => {
+  if (process.platform !== "darwin" && process.platform !== "win32" && process.platform !== 'linux') {
+    console.log(`Skipping OpenSSL download, not required on ${process.platform}`);
+    return;
+  }
+
+  if (process.platform === 'linux' && process.env.NODEGIT_OPENSSL_STATIC_LINK !== '1') {
+    console.log(`Skipping OpenSSL download, NODEGIT_OPENSSL_STATIC_LINK !== 1`);
+    return;
+  }
+
   try {
     await fs.stat(extractPath);
     console.log("Skipping OpenSSL download, dir exists");
diff --git a/utils/configureLibssh2.js b/utils/configureLibssh2.js
@@ -25,9 +25,11 @@ module.exports = function retrieveExternalDependencies() {
       newEnv[key] = process.env[key];
     });
 
-    let cpArgs = `--with-libssl-prefix=${opensslVendorDirectory}`;
+    let cpArgs = process.env.NODEGIT_OPENSSL_STATIC_LINK === '1'
+      ? ` --with-libssl-prefix=${opensslVendorDirectory}`
+      : '';
     cp.exec(
-      `${libssh2ConfigureScript} ${cpArgs}`,
+      `${libssh2ConfigureScript}${cpArgs}`,
       {
         cwd: libssh2VendorDirectory,
         env: newEnv
diff --git a/vendor/libgit2.gyp b/vendor/libgit2.gyp
@@ -11,6 +11,7 @@
     "is_clang%": 0,
     "is_IBMi%": "<!(node -p \"os.platform() == 'aix' && os.type() == 'OS400' ? 1 : 0\")",
     "electron_openssl_root%": "<!(node ../utils/getElectronOpenSSLRoot.js <(module_root_dir))",
+    "electron_openssl_static%": "<!(node -p \"process.platform !== 'linux' || process.env.NODEGIT_OPENSSL_STATIC_LINK === '1' ? 1 : 0\")",
   },
   "targets": [
     {
@@ -362,7 +363,7 @@
         }],
         ["OS=='mac' or OS=='linux' or OS.endswith('bsd') or <(is_IBMi) == 1", {
           "conditions": [
-            ["<(is_electron) == 1", {
+            ["<(is_electron) == 1 and <(electron_openssl_static) == 1", {
               "include_dirs": [
                 "<(electron_openssl_root)/include"
               ]
@@ -622,7 +623,7 @@
       "conditions": [
         ["OS=='mac' or OS=='linux' or OS.endswith('bsd') or <(is_IBMi) == 1", {
           "conditions": [
-            ["<(is_electron) == 1", {
+            ["<(is_electron) == 1 and <(electron_openssl_static) == 1", {
               "include_dirs": [
                 "<(electron_openssl_root)/include"
               ]
@@ -702,7 +703,7 @@
         }],
         ["OS=='linux'", {
           "conditions": [
-            ["<(is_electron) == 1", {
+            ["<(is_electron) == 1 and <(electron_openssl_static) == 1", {
               "include_dirs": ["<(electron_openssl_root)/include"]
             }]
           ],
