rpm: add almalinux:10 #834

kenhys · 2025-05-14T06:05:31Z

NOTE: RHEL10 reached general availability (GA)

kenhys · 2025-05-14T06:06:16Z

known issue: rdkafka can't built yet.

                                                                                           
gcc -MD -MP -g -O2 -fPIC -Wall -Wsign-compare -Wfloat-equal -Wpointer-arith -Wcast-align -O2 -flto=auto -ffat-lto-objects -fexceptions -g -g
record-gcc-switches -pipe -Wall -Werror=format-security -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/
rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=x86-64-v3 -mtune=generic 
-fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -mtls-dialect=gnu2 -fno-omit-frame-pointer -mno-omit-leaf-frame-pointe
r  -O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-U_FORTIFY_SOURCE,-D_FORTI
FY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/red
hat-annobin-cc1  -m64 -march=x86-64-v3 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -mtls-dialect=gn
u2 -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer  -DWITH_GZFILEOP    -O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-sw
itches -pipe -Wall -Werror=format-security -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/re
dhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=x86-64-v3 -mtune=generic -fasynchronou
s-unwind-tables -fstack-clash-protection -fcf-protection -mtls-dialect=gnu2 -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer  -DWITH_GZF
ILEOP    -c rdkafka_admin.c -o rdkafka_admin.o                                                                                              
rdkafka_admin.c: In function ‘rd_kafka_UserScramCredentialUpsertion_new’:
rdkafka_admin.c:5909:21: error: implicit declaration of function ‘RAND_priv_bytes’ [-Wimplicit-function-declaration]                        
 5909 |                 if (RAND_priv_bytes(random_salt, sizeof(random_salt)) == 1) {
      |                     ^~~~~~~~~~~~~~~                                                                                                 
make[1]: *** [../mklove/Makefile.base:97: rdkafka_admin.o] Error 1
make[1]: Leaving directory '/root/rpmbuild/BUILDROOT/fluent-package-5.2.0-1.el10.x86_64/opt/fluent/lib/ruby/gems/3.2.0/gems/rdkafka-0.16.1/e
xt/tmp/x86_64-redhat-linux/ports/librdkafka/2.3.0/librdkafka-2.3.0/src'

kenhys · 2025-06-02T09:28:27Z

This could be problematic with 0.20.0.


  rdkafka_admin.c: In function ‘rd_kafka_UserScramCredentialUpsertion_new’:
  rdkafka_admin.c:5986:21: error: implicit declaration of function ‘RAND_priv_bytes’ [-Wimplicit-function-declaration]
   5986 |                 if (RAND_priv_bytes(random_salt, sizeof(random_salt)) == 1) {
        |                     ^~~~~~~~~~~~~~~
  make[1]: *** [../mklove/Makefile.base:97: rdkafka_admin.o] Error 1
  make[1]: Leaving directory '/root/rpmbuild/BUILDROOT/fluent-package-5.2.0-1.el10.x86_64/opt/fluent/lib/ruby/gems/3.2.0/gems/rdkafka-0.20.0/ext/tmp/x86_64-redhat-linux/ports/librdkafka/2.6.1/librdkafka-2.6.1/src'
  make: *** [Makefile:27: libs] Error 2
  ----- end of file -----
  rake aborted!

kenhys · 2025-06-03T02:29:48Z

NOTE:

almalinux:9

openssl-devel 1:3.2.2-6.el9_5.1
gcc: 11.5.0-5.el9_5.alma.1

almalinux:10

openssl-devel: 1:3.2.2-16.el10.alma.1
gcc: 14.2.1-7.el10.alma.1

kenhys · 2025-06-03T02:45:53Z

https://gcc.gnu.org/gcc-14/porting_to.html#implicit-function-declaration

gcc -MD -MP -g -O2 -fPIC -Wall -Wsign-compare -Wfloat-equal -Wpointer-arith -Wcast-align -I. -DWITH_GZFILEOP      -c rdkafka_admin.c -o rdkafka_admin.o
rdkafka_admin.c: In function 'rd_kafka_UserScramCredentialUpsertion_new':
rdkafka_admin.c:5986:21: error: implicit declaration of function 'RAND_priv_bytes' [-Wimplicit-function-declaration]
 5986 |                 if (RAND_priv_bytes(random_salt, sizeof(random_salt)) == 1) {
      |                     ^~~~~~~~~~~~~~~

kenhys · 2025-06-03T02:59:16Z

It was caused by:

Include openssl/rand.h to fix build error
confluentinc/librdkafka#4379

kenhys · 2025-06-03T03:14:29Z

Even though PR4379 was applied, extra error was reported:

gcc -MD -MP -g -O2 -fPIC -Wall -Wsign-compare -Wfloat-equal -Wpointer-arith -Wcast-align -I. -DWITH_GZFILEOP      -c rdkafka_ssl.c -o rdkafka_ssl.o
rdkafka_ssl.c: In function 'rd_kafka_ssl_set_certs':
rdkafka_ssl.c:1385:24: error: implicit declaration of function 'ENGINE_load_ssl_client_cert' [-Wimplicit-function-declaration]
 1385 |                 r    = ENGINE_load_ssl_client_cert(
      |                        ^~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from rdkafka_int.h:47,
                 from rdkafka_ssl.c:36:
rdkafka_ssl.c: In function 'rd_kafka_ssl_ctx_term':
rdkafka_ssl.c:1455:44: error: implicit declaration of function 'ENGINE_free' [-Wimplicit-function-declaration]
 1455 |         RD_IF_FREE(rk->rk_conf.ssl.engine, ENGINE_free);
      |                                            ^~~~~~~~~~~
rd.h:424:25: note: in definition of macro 'RD_IF_FREE'
  424 |                         FUNC(PTR);                                             \
      |                         ^~~~
rdkafka_ssl.c: In function 'rd_kafka_ssl_ctx_init_engine':
rdkafka_ssl.c:1475:18: error: implicit declaration of function 'ENGINE_by_id' [-Wimplicit-function-declaration]
 1475 |         engine = ENGINE_by_id(rk->rk_conf.ssl.engine_id);
      |                  ^~~~~~~~~~~~
rdkafka_ssl.c:1475:16: error: assignment to 'ENGINE *' {aka 'struct engine_st *'} from 'int' makes pointer from integer without a cast [-Wint-conversion]
 1475 |         engine = ENGINE_by_id(rk->rk_conf.ssl.engine_id);
      |                ^
rdkafka_ssl.c:1477:24: error: assignment to 'ENGINE *' {aka 'struct engine_st *'} from 'int' makes pointer from integer without a cast [-Wint-conversion]
 1477 |                 engine = ENGINE_by_id("dynamic");
      |                        ^
rdkafka_ssl.c:1486:14: error: implicit declaration of function 'ENGINE_ctrl_cmd_string' [-Wimplicit-function-declaration]
 1486 |         if (!ENGINE_ctrl_cmd_string(engine, "SO_PATH",
      |              ^~~~~~~~~~~~~~~~~~~~~~
rdkafka_ssl.c:1511:14: error: implicit declaration of function 'ENGINE_init' [-Wimplicit-function-declaration]
 1511 |         if (!ENGINE_init(engine)) {
      |              ^~~~~~~~~~~
make[1]: *** [../mklove/Makefile.base:97: rdkafka_ssl.o] Error 1
make[1]: Leaving directory '/build/rdkafka-ruby.work/ext/tmp/x86_64-redhat-linux/ports/librdkafka/2.6.1/librdkafka-2.6.1/src'
make: *** [Makefile:27: libs] Error 2
----- end of file -----
rake aborted!
Failed to complete compile task

kenhys · 2025-06-03T03:15:59Z

It was enable with WITH_SSL_ENGINE, checked it.
See src/rdkafka_conf.h:

#if WITH_SSL && OPENSSL_VERSION_NUMBER >= 0x10100000 &&                        \
    !defined(OPENSSL_IS_BORINGSSL)
#define WITH_SSL_ENGINE 1
/* Deprecated in OpenSSL 3 */
#include <openssl/engine.h>
#endif /* WITH_SSL && OPENSSL_VERSION_NUMBER >= 0x10100000 */

But, engine.h is empty. Oh...

alma10$ ls -la /usr/include/openssl/engine.h 
-rw-r--r-- 1 root root 0 Feb 18 00:00 /usr/include/openssl/engine.h

kenhys · 2025-06-03T03:22:14Z

It is strange that upstream releases non empty engine.h. 🤔

-rw-rw-r-- 1 kenhys kenhys   675 11月 23  2023 ./openssl-3.2.0/include/crypto/engine.h
-rw-rw-r-- 1 kenhys kenhys 38823 11月 23  2023 ./openssl-3.2.0/include/openssl/engine.h
-rw-rw-r-- 1 kenhys kenhys   675  1月 30  2024 ./openssl-3.2.1/include/crypto/engine.h
-rw-rw-r-- 1 kenhys kenhys 38823  1月 30  2024 ./openssl-3.2.1/include/openssl/engine.h
-rw-rw-r-- 1 kenhys kenhys   675  6月  4  2024 ./openssl-3.2.2/include/crypto/engine.h
-rw-rw-r-- 1 kenhys kenhys 38823  6月  4  2024 ./openssl-3.2.2/include/openssl/engine.h
-rw-rw-r-- 1 kenhys kenhys   675  6月  3 12:18 ./openssl/include/crypto/engine.h
-rw-rw-r-- 1 kenhys kenhys 38823  6月  3 12:18 ./openssl/include/openssl/engine.h

kenhys · 2025-06-03T03:31:18Z

checking https://git.almalinux.org/rpms/openssl/releases/tag/changed/a10/openssl-3.2.2-16.el10_0.alma.1

It seems that engine.h was explicitly removed.

https://git.almalinux.org/rpms/openssl/src/tag/changed/a10/openssl-3.2.2-16.el10_0.alma.1/openssl.spec#L492

kenhys · 2025-06-03T03:34:08Z

For almalinux9, openssl/engine.h was not removed yet.
https://git.almalinux.org/rpms/openssl/src/tag/imports/c9/openssl-3.2.2-6.el9_5.1/SPECS/openssl.spec

kenhys · 2025-06-03T03:44:48Z

NOTE: for librdkafka 2.6.1 (rdkafka-ruby 0.20.0),

Need to fix implicit function error:
- Solution: Apply patch Include openssl/rand.h to fix build error confluentinc/librdkafka#4379
Need to disable WITH_SSL_ENGINE
- Patch src/rdkafka_conf.h to disable it on AlmaLinux 10.

kenhys · 2025-06-03T06:01:12Z

I overlooked https://github.com/confluentinc/librdkafka/releases/tag/v2.8.0

Support versions of OpenSSL without the ENGINE component

It will be installed for almalinux:8 (previously, I thought that it must be rdkafka 0.20.0 (librdkafka 2.6.1) because of OpenSSL 1.x on almalinux:8, but it seems okay)

kenhys · 2025-06-03T06:21:36Z

Side effect of upgrading to rdkafka 0.21.0 is ftbfs on AmazonLinux 2 (OpenSSL 1.0.2k), but it will be dropped as supported platform later.

kenhys · 2025-06-03T07:09:22Z

NOTE: AL2 will be dropped in another PR.

kenhys · 2025-06-03T07:30:09Z

NOTE: AL2 will be dropped in another PR.

Should be dropped by #850

Signed-off-by: Kentaro Hayashi <[email protected]>

Use newer bundled rdkafka with librdkafka 2.8.0 to support AlmaLinux 10 (librdkafka 2.8.0 supports "OpenSSL without the ENGINE component") If we stick to 0.20.0, must fix the following issues: * Need to fix implicit function error: Include openssl/rand.h to fix build error confluentinc/librdkafka#4379 * Need to disable WITH_SSL_ENGINE Patch src/rdkafka_conf.h to disable it on AlmaLinux 10. Signed-off-by: Kentaro Hayashi <[email protected]>

Signed-off-by: Kentaro Hayashi <[email protected]>

It will fix the following ERROR: ERROR 0002: file '/opt/fluent/lib/ruby/gems/3.2.0/extensions/aarch64-linux/3.2.0/json-2.9.0/json/ext/parser.so' contains an invalid rpath '/opt/fluent/lib' in [/opt/fluent/lib] ******************************************************************************* * * WARNING: 'check-rpaths' detected a broken RPATH OR RUNPATH and will cause * 'rpmbuild' to fail. To ignore these errors, you can set the * '$QA_RPATHS' environment variable which is a bitmask allowing the * values below. The current value of QA_RPATHS is 0x0000. * * 0x0001 ... standard RPATHs (e.g. /usr/lib); such RPATHs are a minor * issue but are introducing redundant searchpaths without * providing a benefit. They can also cause errors in multilib * environments. * 0x0002 ... invalid RPATHs; these are RPATHs which are neither absolute * nor relative filenames and can therefore be a SECURITY risk * 0x0004 ... insecure RPATHs; these are relative RPATHs which are a * SECURITY risk * 0x0008 ... the special '$ORIGIN' RPATHs are appearing after other * RPATHs; this is just a minor issue but usually unwanted * 0x0010 ... the RPATH is empty; there is no reason for such RPATHs * and they cause unneeded work while loading libraries * 0x0020 ... an RPATH references '..' of an absolute path; this will break * the functionality when the path before '..' is a symlink * * * Examples: * - to ignore standard and empty RPATHs, execute 'rpmbuild' like * $ QA_RPATHS=$(( 0x0001|0x0010 )) rpmbuild my-package.src.rpm * - to check existing files, set $RPM_BUILD_ROOT and execute check-rpaths like * $ RPM_BUILD_ROOT=<top-dir> /usr/lib/rpm/check-rpaths * ******************************************************************************* ERROR 0002: file '/opt/fluent/lib/ruby/gems/3.2.0/extensions/aarch64-linux/3.2.0/cmetrics-0.3.3/cmetrics/cmetrics.so' contains an invalid rpath '/opt/fluent/lib' in [/opt/fluent/lib] ERROR 0002: file '/opt/fluent/lib/ruby/gems/3.2.0/extensions/aarch64-linux/3.2.0/systemd-journal-2.0.0/systemd/journal/shim.so' contains an invalid rpath '/opt/fluent/lib' in [/opt/fluent/lib] ERROR 0002: file '/opt/fluent/lib/ruby/gems/3.2.0/extensions/aarch64-linux/3.2.0/rbs-2.8.2/rbs_extension.so' contains an invalid rpath '/opt/fluent/lib' in [/opt/fluent/lib] ERROR 0002: file '/opt/fluent/lib/ruby/gems/3.2.0/extensions/aarch64-linux/3.2.0/strptime-0.2.5/strptime/strptime.so' contains an invalid rpath '/opt/fluent/lib' in [/opt/fluent/lib] ERROR 0002: file '/opt/fluent/lib/ruby/gems/3.2.0/extensions/aarch64-linux/3.2.0/capng_c-0.2.3/capng/capng.so' contains an invalid rpath '/opt/fluent/lib' in [/opt/fluent/lib] ERROR 0002: file '/opt/fluent/lib/ruby/gems/3.2.0/extensions/aarch64-linux/3.2.0/cool.io-1.8.1/cool.io_ext.so' contains an invalid rpath '/opt/fluent/lib' in [/opt/fluent/lib] ERROR 0002: file '/opt/fluent/lib/ruby/gems/3.2.0/extensions/aarch64-linux/3.2.0/yajl-ruby-1.4.3/yajl/yajl.so' contains an invalid rpath '/opt/fluent/lib' in [/opt/fluent/lib] ERROR 0002: file '/opt/fluent/lib/ruby/gems/3.2.0/extensions/aarch64-linux/3.2.0/cool.io-1.8.1/iobuffer_ext.so' contains an invalid rpath '/opt/fluent/lib' in [/opt/fluent/lib] ERROR 0002: file '/opt/fluent/lib/ruby/gems/3.2.0/extensions/aarch64-linux/3.2.0/nio4r-2.7.4/nio4r_ext.so' contains an invalid rpath '/opt/fluent/lib' in [/opt/fluent/lib] ERROR 0002: file '/opt/fluent/lib/ruby/gems/3.2.0/extensions/aarch64-linux/3.2.0/msgpack-1.7.3/msgpack/msgpack.so' contains an invalid rpath '/opt/fluent/lib' in [/opt/fluent/lib] Signed-off-by: Kentaro Hayashi <[email protected]>

Watson1978

👍🏻

kenhys force-pushed the poc-almalinux-10 branch 3 times, most recently from 4815966 to a46233f Compare May 29, 2025 06:43

kenhys force-pushed the poc-almalinux-10 branch 2 times, most recently from 3bd2fa4 to ef39b90 Compare June 3, 2025 05:56

kenhys changed the title ~~rpm: add upcoming almalinux:10~~ rpm: add almalinux:10 Jun 3, 2025

kenhys force-pushed the poc-almalinux-10 branch from 7fbbd48 to ed262de Compare June 3, 2025 06:36

kenhys marked this pull request as ready for review June 3, 2025 07:06

kenhys added 4 commits June 3, 2025 17:36

rpm: add almalinux:10

ca04235

Signed-off-by: Kentaro Hayashi <[email protected]>

Update bundled lockfile for rdkafka

395a54b

Signed-off-by: Kentaro Hayashi <[email protected]>

kenhys force-pushed the poc-almalinux-10 branch from ed262de to 3528ca6 Compare June 3, 2025 08:37

kenhys requested review from Watson1978 and daipom June 3, 2025 09:52

Watson1978 approved these changes Jun 3, 2025

View reviewed changes

kenhys merged commit 411950e into fluent:master Jun 3, 2025
265 of 267 checks passed

kenhys deleted the poc-almalinux-10 branch June 3, 2025 10:29

rpm: add almalinux:10 #834

rpm: add almalinux:10 #834

Uh oh!

Conversation

kenhys commented May 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kenhys commented May 14, 2025

Uh oh!

kenhys commented Jun 2, 2025

Uh oh!

kenhys commented Jun 3, 2025

Uh oh!

kenhys commented Jun 3, 2025

Uh oh!

kenhys commented Jun 3, 2025

Uh oh!

kenhys commented Jun 3, 2025

Uh oh!

kenhys commented Jun 3, 2025

Uh oh!

kenhys commented Jun 3, 2025

Uh oh!

kenhys commented Jun 3, 2025

Uh oh!

kenhys commented Jun 3, 2025

Uh oh!

kenhys commented Jun 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kenhys commented Jun 3, 2025

Uh oh!

kenhys commented Jun 3, 2025

Uh oh!

kenhys commented Jun 3, 2025

Uh oh!

kenhys commented Jun 3, 2025

Uh oh!

Watson1978 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

kenhys commented May 14, 2025 •

edited

Loading

kenhys commented Jun 3, 2025 •

edited

Loading