bpo-43466: Unsupported static build hack (GH-25002) · python/cpython@bacefbf
@@ -2447,24 +2447,48 @@ def split_var(name, sep):
24472447else:
24482448runtime_library_dirs = [openssl_rpath]
244924492450+openssl_extension_kwargs = dict(
2451+include_dirs=openssl_includes,
2452+library_dirs=openssl_libdirs,
2453+libraries=openssl_libs,
2454+runtime_library_dirs=runtime_library_dirs,
2455+ )
2456+2457+# This static linking is NOT OFFICIALLY SUPPORTED.
2458+# Requires static OpenSSL build with position-independent code. Some
2459+# features like DSO engines or external OSSL providers don't work.
2460+# Only tested on GCC and clang on X86_64.
2461+if os.environ.get("PY_UNSUPPORTED_OPENSSL_BUILD") == "static":
2462+extra_linker_args = []
2463+for lib in openssl_extension_kwargs["libraries"]:
2464+# link statically
2465+extra_linker_args.append(f"-l:lib{lib}.a")
2466+# don't export symbols
2467+extra_linker_args.append(f"-Wl,--exclude-libs,lib{lib}.a")
2468+openssl_extension_kwargs["extra_link_args"] = extra_linker_args
2469+# don't link OpenSSL shared libraries.
2470+openssl_extension_kwargs["libraries"] = []
2471+24502472if config_vars.get("HAVE_X509_VERIFY_PARAM_SET1_HOST"):
2451-self.add(Extension(
2452-'_ssl', ['_ssl.c'],
2453-include_dirs=openssl_includes,
2454-library_dirs=openssl_libdirs,
2455-libraries=openssl_libs,
2456-runtime_library_dirs=runtime_library_dirs,
2457-depends=['socketmodule.h', '_ssl/debughelpers.c'])
2473+self.add(
2474+Extension(
2475+ '_ssl',
2476+ ['_ssl.c'],
2477+ depends=['socketmodule.h', '_ssl/debughelpers.c'],
2478+ **openssl_extension_kwargs
2479+ )
24582480 )
24592481else:
24602482self.missing.append('_ssl')
246124832462-self.add(Extension('_hashlib', ['_hashopenssl.c'],
2463-depends=['hashlib.h'],
2464-include_dirs=openssl_includes,
2465-library_dirs=openssl_libdirs,
2466-runtime_library_dirs=runtime_library_dirs,
2467-libraries=openssl_libs))
2484+self.add(
2485+Extension(
2486+'_hashlib',
2487+ ['_hashopenssl.c'],
2488+depends=['hashlib.h'],
2489+**openssl_extension_kwargs,
2490+ )
2491+ )
2468249224692493def detect_hash_builtins(self):
24702494# By default we always compile these even when OpenSSL is available