Skip to content

Commit b67a379

Browse files
scotthartscotthart
authored
fix(openssl): openssl v4.x X509_get_subject_name usage (#16516)
1 parent 54c5c32 commit b67a379

5 files changed

Lines changed: 324 additions & 1 deletion

File tree

‎ci/cloudbuild/builds/openssl-4.sh‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
#!/bin/bash
2+
#
3+
# Copyright 2026 Google LLC
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# https://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
set -euo pipefail
18+
19+
source "$(dirname "$0")/../../lib/init.sh"
20+
source module ci/cloudbuild/builds/lib/cmake.sh
21+
source module ci/cloudbuild/builds/lib/ctest.sh
22+
source module ci/cloudbuild/builds/lib/features.sh
23+
source module ci/lib/io.sh
24+
25+
export CC=gcc
26+
export CXX=g++
27+
28+
mapfile -t cmake_args < <(cmake::common_args)
29+
cmake_args+=(
30+
-DOPENSSL_ROOT_DIR=/usr/local/openssl-4
31+
-DGOOGLE_CLOUD_CPP_ENABLE=storage
32+
-DCMAKE_CXX_FLAGS="-Wno-error=deprecated-declarations"
33+
)
34+
35+
io::run cmake "${cmake_args[@]}"
36+
io::run cmake --build cmake-out
37+
38+
mapfile -t ctest_args < <(ctest::common_args)
39+
io::run env -C cmake-out ctest "${ctest_args[@]}" -LE "integration-test"

‎ci/cloudbuild/dockerfiles/fedora-openssl-4.Dockerfile‎

Lines changed: 227 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,227 @@
1+
# Copyright 2026 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# https://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
FROM fedora:40
16+
ARG NCPU=4
17+
ARG ARCH=amd64
18+
19+
# Fedora includes packages for OpenSSL that are recent enough
20+
# for `google-cloud-cpp`. Install these packages and additional development
21+
# tools to compile the dependencies:
22+
RUN dnf makecache && \
23+
dnf install -y abi-compliance-checker autoconf automake \
24+
clang clang-analyzer clang-tools-extra \
25+
cmake diffutils findutils gcc-c++ git \
26+
libnghttp2-devel llvm make ninja-build \
27+
openssl-devel patch perl-core python python3 \
28+
python-pip tar unzip w3m wget which zip zlib-devel
29+
30+
# Install the Python modules needed to run the storage emulator
31+
RUN dnf makecache && dnf install -y python3-devel
32+
RUN pip3 install --upgrade pip
33+
RUN pip3 install setuptools wheel
34+
35+
# The Cloud Pub/Sub emulator needs Java :shrug:
36+
RUN dnf makecache && dnf install -y java-latest-openjdk
37+
38+
# This is used to improve the output in check-api builds
39+
RUN dnf makecache && dnf install -y "dnf-command(debuginfo-install)"
40+
RUN dnf makecache && dnf debuginfo-install -y libstdc++
41+
42+
# These are used by the docfx tool.
43+
RUN dnf makecache && dnf install -y pugixml-devel
44+
45+
RUN dnf install -y valgrind
46+
47+
# Sets root's password to the empty string to enable users to get a root shell
48+
# inside the container with `su -` and no password. Sudo would not work because
49+
# we run these containers as the invoking user's uid, which does not exist in
50+
# the container's /etc/passwd file.
51+
RUN echo "root:cloudcxx" | chpasswd
52+
53+
# Build and install OpenSSL 4.0.2 in /usr/local/openssl-4
54+
WORKDIR /var/tmp/build/openssl
55+
RUN curl -fsSL https://github.com/openssl/openssl/releases/download/openssl-4.0.2/openssl-4.0.2.tar.gz | \
56+
tar -xzf - --strip-components=1 && \
57+
./Configure --prefix=/usr/local/openssl-4 --openssldir=/usr/local/openssl-4 && \
58+
make -j ${NCPU:-4} && \
59+
make install_sw && \
60+
cd /var/tmp && rm -fr build
61+
RUN (echo /usr/local/openssl-4/lib; echo /usr/local/openssl-4/lib64; echo /usr/local/lib; echo /usr/local/lib64) | tee /etc/ld.so.conf.d/local.conf && ldconfig
62+
63+
WORKDIR /var/tmp/build/
64+
RUN curl -fsSL https://github.com/jbeder/yaml-cpp/archive/refs/tags/yaml-cpp-0.9.0.tar.gz | \
65+
tar -xzf - --strip-components=1 && \
66+
cmake \
67+
-DCMAKE_BUILD_TYPE=Release \
68+
-DCMAKE_CXX_STANDARD=17 \
69+
-DBUILD_SHARED_LIBS=ON \
70+
-DBUILD_TESTING=OFF \
71+
-S . -B cmake-out -GNinja && \
72+
cmake --build cmake-out --target install && \
73+
ldconfig && cd /var/tmp && rm -fr build
74+
75+
# Fedora's version of `pkg-config` (https://github.com/pkgconf/pkgconf) is slow
76+
# when handling `.pc` files with lots of `Requires:` deps. This problem is
77+
# triggered by the Abseil `.pc` files, which we use (indirectly) when testing
78+
# our own `.pc` files. We install the more traditional `pkg-config` binary.
79+
# For more details see
80+
# https://github.com/googleapis/google-cloud-cpp/issues/7052
81+
WORKDIR /var/tmp/build/pkgconf
82+
RUN curl -fsSL https://distfiles.ariadne.space/pkgconf/pkgconf-2.2.0.tar.gz | \
83+
tar -xzf - --strip-components=1 && \
84+
./configure --prefix=/usr --with-system-libdir=/lib64:/usr/lib64 --with-system-includedir=/usr/include && \
85+
make -j ${NCPU:-4} && \
86+
make install && \
87+
ldconfig && cd /var/tmp && rm -fr build
88+
89+
# The following steps will install libraries and tools in `/usr/local`. By
90+
# default, pkgconf does not search in these directories. We need to explicitly
91+
# set the search path.
92+
ENV PKG_CONFIG_PATH=/usr/local/openssl-4/lib64/pkgconfig:/usr/local/openssl-4/lib/pkgconfig:/usr/local/lib64/pkgconfig:/usr/local/lib/pkgconfig:/usr/lib64/pkgconfig
93+
94+
# Install curl from source to avoid a libcurl bug present in older versions.
95+
# See https://github.com/googleapis/google-cloud-cpp/issues/16343 for more
96+
# details.
97+
WORKDIR /var/tmp/build/curl
98+
RUN curl -fsSL https://github.com/curl/curl/releases/download/curl-8_22_0/curl-8.22.0.tar.gz | \
99+
tar -xzf - --strip-components=1 && \
100+
printf "CURL_OPENSSL_4\n{\n global: curl_*;\n local: *;\n};\n" > libcurl.vers && \
101+
cmake \
102+
-DCMAKE_BUILD_TYPE=Release \
103+
-DCMAKE_CXX_STANDARD=17 \
104+
-DBUILD_SHARED_LIBS=ON \
105+
-DOPENSSL_ROOT_DIR=/usr/local/openssl-4 \
106+
-DCURL_USE_OPENSSL=ON \
107+
-DCURL_USE_LIBPSL=OFF \
108+
-DBUILD_CURL_EXE=ON \
109+
-DBUILD_TESTING=OFF \
110+
-DCMAKE_SHARED_LINKER_FLAGS="-Wl,--version-script=$(pwd)/libcurl.vers" \
111+
-GNinja -S . -B cmake-out && \
112+
cmake --build cmake-out --target install && \
113+
ldconfig && cd /var/tmp && rm -fr build
114+
115+
# We disable the inline namespace because otherwise Abseil LTS updates break our
116+
# `check-api` build.
117+
WORKDIR /var/tmp/build
118+
RUN curl -fsSL https://github.com/abseil/abseil-cpp/archive/20250814.2.tar.gz | \
119+
tar -xzf - --strip-components=1 && \
120+
cmake \
121+
-DCMAKE_BUILD_TYPE="Release" \
122+
-DCMAKE_CXX_STANDARD=17 \
123+
-DABSL_BUILD_TESTING=OFF \
124+
-DBUILD_SHARED_LIBS=yes \
125+
-GNinja -S . -B cmake-out && \
126+
cmake --build cmake-out --target install && \
127+
ldconfig && cd /var/tmp && rm -fr build
128+
129+
WORKDIR /var/tmp/build
130+
RUN curl -fsSL https://github.com/google/googletest/archive/v1.17.0.tar.gz | \
131+
tar -xzf - --strip-components=1 && \
132+
cmake \
133+
-DCMAKE_BUILD_TYPE="Release" \
134+
-DBUILD_SHARED_LIBS=yes \
135+
-GNinja -S . -B cmake-out && \
136+
cmake --build cmake-out --target install && \
137+
ldconfig && cd /var/tmp && rm -fr build
138+
139+
WORKDIR /var/tmp/build
140+
RUN curl -fsSL https://github.com/google/benchmark/archive/v1.9.5.tar.gz | \
141+
tar -xzf - --strip-components=1 && \
142+
cmake \
143+
-DCMAKE_BUILD_TYPE="Release" \
144+
-DBUILD_SHARED_LIBS=yes \
145+
-DBENCHMARK_ENABLE_TESTING=OFF \
146+
-GNinja -S . -B cmake-out && \
147+
cmake --build cmake-out --target install && \
148+
ldconfig && cd /var/tmp && rm -fr build
149+
150+
WORKDIR /var/tmp/build
151+
RUN curl -fsSL https://github.com/nlohmann/json/archive/v3.11.3.tar.gz | \
152+
tar -xzf - --strip-components=1 && \
153+
cmake \
154+
-DCMAKE_BUILD_TYPE=Release \
155+
-DBUILD_SHARED_LIBS=yes \
156+
-DBUILD_TESTING=OFF \
157+
-DJSON_BuildTests=OFF \
158+
-GNinja -S . -B cmake-out && \
159+
cmake --build cmake-out --target install && \
160+
ldconfig && cd /var/tmp && rm -fr build
161+
162+
WORKDIR /var/tmp/build/protobuf
163+
RUN curl -fsSL https://github.com/protocolbuffers/protobuf/archive/v36.0.tar.gz | \
164+
tar -xzf - --strip-components=1 && \
165+
cmake \
166+
-DCMAKE_BUILD_TYPE=Release \
167+
-DCMAKE_CXX_STANDARD=17 \
168+
-DBUILD_SHARED_LIBS=yes \
169+
-Dprotobuf_BUILD_TESTS=OFF \
170+
-Dprotobuf_ABSL_PROVIDER=package \
171+
-GNinja -S . -B cmake-out && \
172+
cmake --build cmake-out --target install && \
173+
ldconfig && cd /var/tmp && rm -fr build
174+
175+
WORKDIR /var/tmp/build/
176+
RUN curl -fsSL https://github.com/open-telemetry/opentelemetry-cpp/archive/v1.28.0.tar.gz | \
177+
tar -xzf - --strip-components=1 && \
178+
cmake \
179+
-DCMAKE_CXX_STANDARD=17 \
180+
-DCMAKE_BUILD_TYPE=Release \
181+
-DCMAKE_POSITION_INDEPENDENT_CODE=TRUE \
182+
-DBUILD_SHARED_LIBS=ON \
183+
-DWITH_EXAMPLES=OFF \
184+
-DWITH_STL=CXX17 \
185+
-DBUILD_TESTING=OFF \
186+
-DOPENTELEMETRY_INSTALL=ON \
187+
-DOPENTELEMETRY_ABI_VERSION_NO=2 \
188+
-S . -B cmake-out -GNinja && \
189+
cmake --build cmake-out --target install && \
190+
ldconfig && cd /var/tmp && rm -fr build
191+
192+
WORKDIR /var/tmp/build/grpc
193+
RUN dnf makecache && dnf install -y c-ares-devel re2-devel
194+
RUN curl -fsSL https://github.com/grpc/grpc/archive/v1.84.0.tar.gz | \
195+
tar -xzf - --strip-components=1 && \
196+
mkdir -p third_party/grpc-proto && \
197+
curl -fsSL https://github.com/grpc/grpc-proto/archive/ec30f589e2519d595688b9a42f88a91bdd6b733f.tar.gz | \
198+
tar -xzf - -C third_party/grpc-proto --strip-components=1 && \
199+
PKG_CONFIG_PATH=/usr/lib64/pkgconfig:/usr/share/pkgconfig cmake \
200+
-DCMAKE_BUILD_TYPE=Release \
201+
-DCMAKE_CXX_STANDARD=17 \
202+
-DBUILD_SHARED_LIBS=ON \
203+
-DgRPC_INSTALL=ON \
204+
-DgRPC_BUILD_TESTS=OFF \
205+
-DgRPC_ABSL_PROVIDER=package \
206+
-DgRPC_CARES_PROVIDER=package \
207+
-DgRPC_PROTOBUF_PROVIDER=package \
208+
-DgRPC_PROTOBUF_PACKAGE_TYPE=CONFIG \
209+
-DgRPC_RE2_PROVIDER=package \
210+
-DgRPC_SSL_PROVIDER=package \
211+
-DgRPC_ZLIB_PROVIDER=package \
212+
-DgRPC_OPENTELEMETRY_PROVIDER=package \
213+
-DgRPC_BUILD_GRPCPP_OTEL_PLUGIN=ON \
214+
-DOPENSSL_ROOT_DIR=/usr \
215+
-GNinja -S . -B cmake-out && \
216+
cmake --build cmake-out --target install && \
217+
ldconfig && cd /var/tmp && rm -fr build
218+
219+
WORKDIR /var/tmp/sccache
220+
RUN curl -fsSL https://github.com/mozilla/sccache/releases/download/v0.15.0/sccache-v0.15.0-x86_64-unknown-linux-musl.tar.gz | \
221+
tar -zxf - --strip-components=1 && \
222+
mkdir -p /usr/local/bin && \
223+
mv sccache /usr/local/bin/sccache && \
224+
chmod +x /usr/local/bin/sccache
225+
226+
# Update the dynamic linker cache for all installed libraries
227+
RUN ldconfig

‎ci/cloudbuild/triggers/openssl-4-ci.yaml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# Copyright 2026 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# https://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
filename: ci/cloudbuild/cloudbuild.yaml
16+
github:
17+
name: google-cloud-cpp
18+
owner: googleapis
19+
push:
20+
branch: ^main$
21+
includeBuildLogs: INCLUDE_BUILD_LOGS_WITH_STATUS
22+
name: openssl-4-ci
23+
substitutions:
24+
_BUILD_NAME: openssl-4
25+
_DISTRO: fedora-openssl-4
26+
_TRIGGER_TYPE: ci
27+
tags:
28+
- ci

‎ci/cloudbuild/triggers/openssl-4-pr.yaml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
# Copyright 2026 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# https://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
filename: ci/cloudbuild/cloudbuild.yaml
16+
github:
17+
name: google-cloud-cpp
18+
owner: googleapis
19+
pullRequest:
20+
branch: main
21+
commentControl: COMMENTS_ENABLED_FOR_EXTERNAL_CONTRIBUTORS_ONLY
22+
includeBuildLogs: INCLUDE_BUILD_LOGS_WITH_STATUS
23+
name: openssl-4-pr
24+
substitutions:
25+
_BUILD_NAME: openssl-4
26+
_DISTRO: fedora-openssl-4
27+
_TRIGGER_TYPE: pr
28+
tags:
29+
- pr

‎google/cloud/internal/openssl/parse_service_account_p12_file.cc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@ StatusOr<ServiceAccountCredentialsInfo> ParseServiceAccountP12File(
8585
}
8686

8787
// This is automatically deleted by `cert`.
88-
X509_NAME* name = X509_get_subject_name(cert.get());
88+
X509_NAME const* name = X509_get_subject_name(cert.get());
8989

9090
std::string service_account_id = [&name]() -> std::string {
9191
auto openssl_free = [](void* addr) { OPENSSL_free(addr); };

0 commit comments

Comments
 (0)