@@ -59,7 +59,23 @@ package = {
5959
6060 xpm = {
6161 linux = {
62- deps = { " xim:make@latest" " xim:perl@latest"
62+ -- glibc + linux-headers are here for the same reason make and perl
63+ -- are: this package builds through its own Makefile with a bare
64+ -- `cc`, so every tool it uses has to be something this descriptor
65+ -- resolved, not something it hopes to find. See cc_override().
66+ --
67+ -- The specs are xim:gcc's own, character for character, and NOT
68+ -- `@latest`. openssl's objects are linked into projects built by
69+ -- that gcc, so the C library it compiles against has to be the one
70+ -- the toolchain uses; `@latest` would be free to resolve a NEWER
71+ -- glibc than the toolchain's and introduce symbols the final link
72+ -- cannot satisfy. Matching the ranges means both resolve the same
73+ -- node -- already on disk wherever gcc is, so this costs a
74+ -- resolution rather than a download.
75+ deps = {
76+ " xim:make@latest" " xim:perl@latest"
77+ " xim:glibc@>=2.39" " xim:linux-headers@5.11.1"
78+ },
6379 [" 3.5.1" = {
6480 url = {
6581 GLOBAL = " https://github.com/openssl/openssl/releases/download/openssl-3.5.1/openssl-3.5.1.tar.gz"
@@ -161,13 +177,80 @@ end
161177-- inherit the resolved toolchain's sysroot flags — it just runs `cc`. On macOS
162178-- the toolchain in PATH is xim's llvm, which has no macOS SDK wired up, so
163179-- every compile would fail on <stdio.h>. Pin Apple's own driver, which finds
164- -- the SDK by itself. Left alone elsewhere: on linux the xim gcc carries its
165- -- own payload and is the right compiler to use.
180+ -- the SDK by itself.
181+ --
182+ -- On linux the compiler used to be left to PATH, on the strength of "the xim
183+ -- gcc carries its own payload and is the right compiler to use". The binary is
184+ -- right; the assumption that it is SELF-SUFFICIENT is not. PATH reaches it
185+ -- through its xvm shim, and the shim injects `--sysroot=<subos>` resolved
186+ -- against **the subos the calling process resolved to** (xim-pkgindex
187+ -- pkgs/g/gcc.lua) -- whose own comment states the other half of the contract:
188+ --
189+ -- Consumers that bypass the shim supply their own header flags.
190+ --
191+ -- OpenSSL's Makefile is exactly such a consumer: it calls a bare `cc`. So the
192+ -- flags are this hook's business, the same way `make` and `perl` already are.
193+ --
194+ -- Leaving it ambient breaks whenever the resolved subos is not the one holding
195+ -- the toolchain. This hook runs with its cwd inside the CONSUMING PROJECT's
196+ -- xlings home (<proj>/.mcpp/.xlings/data/runtimedir/openssl-<v>), so the subos
197+ -- resolves to the PROJECT one, which holds only what that project installed --
198+ -- no usr/include, usually no usr/ at all. A `--sysroot` at an empty tree does
199+ -- not fall back to the default search, it SUPPRESSES it, and every compile
200+ -- dies a long way from the cause:
201+ --
202+ -- include/internal/common.h:14:11: fatal error: stdlib.h: No such file
203+ -- .../xim-x-gcc/16.1.0/lib/gcc/.../limits.h:210:15: fatal error: limits.h
204+ --
205+ -- (the second is gcc's own `#include_next`, which reads like a broken compiler
206+ -- and is not).
207+ --
208+ -- So resolve the C library the way make and perl are resolved -- from declared
209+ -- build deps -- and hand openssl the three things the payload gcc needs:
210+ -- headers (-isystem), crt objects (-B) and -lc (-L). `--sysroot` is re-pointed
211+ -- at the glibc payload root, which is NOT FHS-shaped and therefore contributes
212+ -- no search path of its own: it neutralises whatever the shim injected without
213+ -- opening a door to the host's /usr/include. A later --sysroot wins, so this
214+ -- needs no cooperation from the shim.
215+ --
216+ -- This is a local restatement of what mcpp's own link model does
217+ -- (src/build/flags.cppm, "payload-first, --sysroot fallback"). Duplicating a
218+ -- decision is a real cost; the alternative is worse, because openssl builds
219+ -- outside mcpp's compile rules by construction and has no other way to be told.
220+ -- If xim ever hands install() hooks a ready CC/CFLAGS, this should become that.
221+ local function libc_payloads ()
222+ local glibc = pkginfo .build_dep (" xim:glibc" or pkginfo .build_dep (" glibc"
223+ local kern = pkginfo .build_dep (" xim:linux-headers"
224+ or pkginfo .build_dep (" linux-headers"
225+ local groot = glibc and glibc .path
226+ local kroot = kern and kern .path
227+ if not (groot and os .isfile (path .join (groot , " include" " stdlib.h" then
228+ return nil
229+ end
230+ return groot , kroot
231+ end
232+
166233local function cc_override ()
167234 if os .host () == " macosx" and os .isfile (" /usr/bin/cc" then
168235 return " CC=/usr/bin/cc "
169236 end
170- return " "
237+ if os .host () ~= " linux" then return " " end
238+
239+ local groot , kroot = libc_payloads ()
240+ if not groot then
241+ log .warn (" openssl: no xim:glibc payload resolved; leaving CC to PATH"
242+ .. " (fails if the active subos carries no libc headers)"
243+ return " "
244+ end
245+ local libdir = os .isdir (path .join (groot , " lib64"
246+ and path .join (groot , " lib64" or path .join (groot , " lib"
247+ local cc = " gcc --sysroot=" .. groot
248+ .. " -isystem " .. path .join (groot , " include"
249+ if kroot and os .isdir (path .join (kroot , " include" then
250+ cc = cc .. " -isystem " .. path .join (kroot , " include"
251+ end
252+ cc = cc .. " -B " .. libdir .. " -L " .. libdir
253+ return " CC=" .. sh_quote (cc ) .. " "
171254end
172255
173256-- Does this perl actually RUN, with the core modules Configure opens with?
0 commit comments