Repository: nervosnetwork/ckb (language: rust)

Issue:
Static build CKB's release with `openssl 3` 
## Feature Request

#### Is your feature request related to a problem? Please describe.

The OpenSSL 1.1.1 series has reached its [End of Life](https://www.openssl.org/blog/blog/2023/09/11/eol-111), so it's time for us to transition to OpenSSL 3 since CKB is statically built with OpenSSL 1.1.1.


https://github.com/nervosnetwork/ckb/blob/6c6ea88c7605aaed1f955485205745dd9cb0fa0c/.github/workflows/package.yaml#L113-L115

https://github.com/nervosnetwork/ckb/blob/6c6ea88c7605aaed1f955485205745dd9cb0fa0c/.github/workflows/package.yaml#L198

https://github.com/nervosnetwork/ckb/blob/6c6ea88c7605aaed1f955485205745dd9cb0fa0c/.github/workflows/package.yaml#L257

We should also consider upgrading the `ckb-docker-builder`:

https://github.com/nervosnetwork/ckb-docker-builder/blob/8ce6f4d4a073be833ef07f6a61d038eeb12b5780/centos-7/Dockerfile#L11-L12




Discussion / hints:
Related: https://github.com/nervosnetwork/ckb-cli/issues/566
We can't use `centos-7` to build `openssl 3.1.3`, since `openssl 3.1.3` need `GLIBC_2.18` at least, but `centos-7` only provide `GLIBC 2.17`:

- When I try to build openssl 3.1.3 on [nervos/ckb-docker-builder:centos-7-rust-1.71.1](https://github.com/nervosnetwork/ckb-docker-builder/blob/master/centos-7/Dockerfile), this error occured:
```bash
Caused by:
  process didn't exit successfully: `/ckb/target/prod/build/openssl-sys-9f0e66e82e308245/build-script-main` (exit status: 1)
  --- stderr
  /ckb/target/prod/build/openssl-sys-9f0e66e82e308245/build-script-main: /lib64/libc.so.6: version `GLIBC_2.25' not found (required by /ckb/target/prod/build/openssl-sys-9f0e66e82e308245/build-script-main)
  /ckb/target/prod/build/openssl-sys-9f0e66e82e308245/build-script-main: /lib64/libc.so.6: version `GLIBC_2.27' not found (required by /ckb/target/prod/build/openssl-sys-9f0e66e82e308245/build-script-main)
  /ckb/target/prod/build/openssl-sys-9f0e66e82e308245/build-script-main: /lib64/libc.so.6: version `GLIBC_2.18' not found (required by /ckb/target/prod/build/openssl-sys-9f0e66e82e308245/build-script-main)
warning: build failed, waiting for other jobs to finish...
error: /lib64/libc.so.6: version `GLIBC_2.25' not found (required by /ckb/target/prod/deps/libnumext_constructor-034cd93ffbc6e1e3.so)
```

```bash
❯ docker run --rm -it nervos/ckb-docker-builder:centos-7-rust-1.71.1 bash                                 
[root@9574b0e79d5a /]# ldd --version
ldd (GNU libc) 2.17
Copyright (C) 2012 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.
```
try newer version of devtoolset and llvm-toolset
> try newer version of devtoolset and llvm-toolset

Thank you.

Fix patch:
diff --git a/.github/workflows/package.yaml b/.github/workflows/package.yaml
index b660d0e589..bdd9896595 100644
--- a/.github/workflows/package.yaml
+++ b/.github/workflows/package.yaml
@@ -61,7 +61,7 @@ jobs:
         GPG_SIGNER: ${{ secrets.GPG_SIGNER }}
       run: |
         export GIT_TAG_NAME=` echo ${{ github.ref }} | awk -F '/' '{print $4}' `
-        docker run --rm -i -w /ckb -v $(pwd):/ckb -e OPENSSL_STATIC=1 -e OPENSSL_LIB_DIR=/usr/lib/x86_64-linux-gnu -e OPENSSL_INCLUDE_DIR=/usr/include $BUILDER_IMAGE make ${{ matrix.build_target }}
+        docker run --rm -i -w /ckb -v $(pwd):/ckb -e OPENSSL_STATIC=1 -e OPENSSL_LIB_DIR=/usr/local/lib64 -e OPENSSL_INCLUDE_DIR=/usr/local/include $BUILDER_IMAGE make ${{ matrix.build_target }}
         gpg --quiet --batch --yes --decrypt --passphrase="$LARGE_SECRET_PASSPHRASE" --output devtools/ci/signer.asc devtools/ci/signer.asc.gpg
         gpg --import devtools/ci/signer.asc
         devtools/ci/package.sh target/prod/ckb
@@ -78,7 +78,7 @@ jobs:
         name: ckb_${{env.GIT_TAG_NAME }}_${{env.REL_PKG }}.asc
         path: ckb_${{env.GIT_TAG_NAME }}_${{env.REL_PKG }}.asc
     env:
-      BUILDER_IMAGE: nervos/ckb-docker-builder:bionic-rust-1.71.1
+      BUILDER_IMAGE: nervos/ckb-docker-builder:bionic-rust-1.71.1-openssl-3.1.3
       REL_PKG: ${{ matrix.rel_pkg }}
 
   package-for-linux-aarch64:
@@ -94,6 +94,24 @@ jobs:
       run: rustup target add aarch64-unknown-linux-gnu
     - name: Install dependencies
       run: sudo apt-get update && sudo apt-get install -y gcc-multilib && sudo apt-get install -y build-essential clang gcc-aarch64-linux-gnu g++-aarch64-linux-gnu
+    - name: Install OpenSSL
+      run: |
+        mkdir target && cd target
+
+        curl -LO https://www.openssl.org/source/openssl-3.1.3.tar.gz
+        curl -LO https://www.openssl.org/source/openssl-3.1.3.tar.gz.asc
+
+        gpg --keyserver keys.openpgp.org --recv-keys EFC0A467D613CB83C7ED6D30D894E2CE8B3D79F5
+        gpg --verify openssl-3.1.3.tar.gz.asc openssl-3.1.3.tar.gz
+
+        curl -LO https://www.openssl.org/source/openssl-3.1.3.tar.gz.sha256
+        echo $(cat openssl-3.1.3.tar.gz.sha256) openssl-3.1.3.tar.gz | sha256sum --check
+
+        tar -xzf openssl-3.1.3.tar.gz
+        cd openssl-3.1.3
+        CC=aarch64-linux-gnu-gcc ./Configure --prefix=$(pwd)/openssl-3.1.3/build linux-aarch64 no-shared
+        CC=aarch64-linux-gnu-gcc make -j $(nproc)
+        CC=aarch64-linux-gnu-gcc make -j $(nproc) install_sw
     - name: Build CKB and Package CKB
       env:
         LARGE_SECRET_PASSPHRASE: ${{ secrets.LARGE_SECRET_PASSPHRASE }}
@@ -103,16 +121,13 @@ jobs:
         SKIP_CKB_CLI: true
       run: |
         export GIT_TAG_NAME=` echo ${{ github.ref }} | awk -F '/' '{print $4}' `
-        export TOP_DIR=$(pwd)
-        curl -LO https://www.openssl.org/source/openssl-1.1.1.tar.gz
-        tar -xzf openssl-1.1.1.tar.gz
-        cd openssl-1.1.1
-        CC=aarch64-linux-gnu-gcc ./Configure linux-aarch64 shared
-        CC=aarch64-linux-gnu-gcc make
-        cd ..
-        export OPENSSL_LIB_DIR=${TOP_DIR}/openssl-1.1.1
-        export OPENSSL_INCLUDE_DIR=${TOP_DIR}/openssl-1.1.1/include
+
+        export OPENSSL_DIR=$(pwd)/target/openssl-3.1.3/build
+        export OPENSSL_INCLUDE_DIR=${OPENSSL_DIR}/include
+        export OPENSSL_LIB_DIR=${OPENSSL_DIR}/lib64
+        export OPENSSL_STATIC=1
         PKG_CONFIG_ALLOW_CROSS=1 CC=gcc CC_aarch64_unknown_linux_gnu=aarch64-linux-gnu-gcc CKB_BUILD_TARGET="--target=aarch64-unknown-linux-gnu" make prod_portable
+
         gpg --quiet --batch --yes --decrypt --passphrase="$LARGE_SECRET_PASSPHRASE" --output devtools/ci/signer.asc devtools/ci/signer.asc.gpg
         gpg --import devtools/ci/signer.asc
         devtools/ci/package.sh target/aarch64-unknown-linux-gnu/prod/ckb
@@ -170,7 +185,7 @@ jobs:
         name: ckb_${{env.GIT_TAG_NAME }}_${{env.REL_PKG }}.asc
         path: ckb_${{env.GIT_TAG_NAME }}_${{env.REL_PKG }}.asc
     env:
-      BUILDER_IMAGE: nervos/ckb-docker-builder:centos-7-rust-1.71.1
+      BUILDER_IMAGE: nervos/ckb-docker-builder:centos-7-rust-1.71.1-openssl-3.1.3
       REL_PKG: ${{ matrix.rel_pkg }}
 
   package-for-mac:
@@ -189,13 +204,37 @@ jobs:
       run: |
         export GIT_TAG_NAME=` echo ${{ github.ref }} | awk -F '/' '{print $4}' `
         echo "GIT_TAG_NAME=$GIT_TAG_NAME" >> $GITHUB_ENV
+    - name: Install Dependencies
+      run: |
+        mkdir target && cd target
+
+        curl -LO https://www.openssl.org/source/openssl-3.1.3.tar.gz
+        curl -LO https://www.openssl.org/source/openssl-3.1.3.tar.gz.asc
+
+        gpg --keyserver keys.openpgp.org --recv-keys EFC0A467D613CB83C7ED6D30D894E2CE8B3D79F5
+        gpg --verify openssl-3.1.3.tar.gz.asc openssl-3.1.3.tar.gz
+
+        curl -LO https://www.openssl.org/source/openssl-3.1.3.tar.gz.sha256
+        echo $(cat openssl-3.1.3.tar.gz.sha256) openssl-3.1.3.tar.gz | sha256sum --check
+
+        tar -xzf openssl-3.1.3.tar.gz
+        cd openssl-3.1.3
+        ./Configure --prefix=$(pwd)/openssl-3.1.3/build no-shared
+        make
+        make install_sw
     - name: Build CKB and Package CKB
       env:
         LARGE_SECRET_PASSPHRASE: ${{ secrets.LARGE_SECRET_PASSPHRASE }}
         GPG_SIGNER: ${{ secrets.GPG_SIGNER }}
       run: |
         export GIT_TAG_NAME=` echo ${{ github.ref }} | awk -F '/' '{print $4}' `
-        make OPENSSL_STATIC=1 OPENSSL_LIB_DIR=/usr/local/opt/openssl@1.1/lib OPENSSL_INCLUDE_DIR=/usr/local/opt/openssl@1.1/include ${{ matrix.build_target }}
+
+        export OPENSSL_DIR=$(pwd)/target/openssl-3.1.3/build
+        export OPENSSL_LIB_DIR=${OPENSSL_DIR}/lib
+        export OPENSSL_INCLUDE_DIR=${OPENSSL_DIR}/include
+        export OPENSSL_STATIC=1
+        make ${{ matrix.build_target }}
+
         gpg --quiet --batch --yes --decrypt --passphrase="$LARGE_SECRET_PASSPHRASE" --output devtools/ci/signer.asc devtools/ci/signer.asc.gpg
         gpg --import devtools/ci/signer.asc
         devtools/ci/package.sh target/prod/ckb
@@ -230,12 +269,13 @@ jobs:
         echo /opt/homebrew/bin >> $GITHUB_PATH
         echo /opt/homebrew/sbin >> $GITHUB_PATH
         echo "$HOME/.cargo/bin" >> $GITHUB_PATH
-
+    - uses: actions/checkout@v3
+    - name: Set Env
+      run: |
+        export GIT_TAG_NAME=` echo ${{ github.ref }} | awk -F '/' '{print $4}' `
+        echo "GIT_TAG_NAME=$GIT_TAG_NAME" >> $GITHUB_ENV
     - name: Install Depedencies
       run: |
-        if ! [ -d /opt/homebrew/opt/openssl@1.1 ]; then
-          brew install "openssl@1.1"
-        fi
         if ! type -f gpg &> /dev/null; then
           brew install gnupg
         fi
@@ -243,18 +283,36 @@ jobs:
           curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
         fi
 
-    - uses: actions/checkout@v3
-    - name: Set Env
-      run: |
-        export GIT_TAG_NAME=` echo ${{ github.ref }} | awk -F '/' '{print $4}' `
-        echo "GIT_TAG_NAME=$GIT_TAG_NAME" >> $GITHUB_ENV
+        mkdir target && cd target
+
+        curl -LO https://www.openssl.org/source/openssl-3.1.3.tar.gz
+        curl -LO https://www.openssl.org/source/openssl-3.1.3.tar.gz.asc
+
+        gpg --keyserver keys.openpgp.org --recv-keys EFC0A467D613CB83C7ED6D30D894E2CE8B3D79F5
+        gpg --verify openssl-3.1.3.tar.gz.asc openssl-3.1.3.tar.gz
+
+        curl -LO https://www.openssl.org/source/openssl-3.1.3.tar.gz.sha256
+        echo $(cat openssl-3.1.3.tar.gz.sha256) openssl-3.1.3.tar.gz | sha256sum --check
+
+        tar -xzf openssl-3.1.3.tar.gz
+        cd openssl-3.1.3
+        ./Configure --prefix=$(pwd)/openssl-3.1.3/build no-shared
+        make
+        make install_sw
+
     - name: Build CKB and Package CKB
       env:
         LARGE_SECRET_PASSPHRASE: ${{ secrets.LARGE_SECRET_PASSPHRASE }}
         GPG_SIGNER: ${{ secrets.GPG_SIGNER }}
       run: |
         export GIT_TAG_NAME=` echo ${{ github.ref }} | awk -F '/' '{print $4}' `
-        make OPENSSL_STATIC=1 OPENSSL_LIB_DIR=/opt/homebrew/opt/openssl@1.1/lib OPENSSL_INCLUDE_DIR=/opt/homebrew/opt/openssl@1.1/include ${{ matrix.build_target }}
+
+        export OPENSSL_DIR=$(pwd)/target/openssl-3.1.3/build
+        export OPENSSL_LIB_DIR=${OPENSSL_DIR}/lib
+        export OPENSSL_INCLUDE_DIR=${OPENSSL_DIR}/include
+        export OPENSSL_STATIC=1
+        make ${{ matrix.build_target }}
+
         gpg --quiet --batch --yes --decrypt --passphrase="$LARGE_SECRET_PASSPHRASE" --output devtools/ci/signer.asc devtools/ci/signer.asc.gpg
         gpg --import devtools/ci/signer.asc
         devtools/ci/package.sh target/prod/ckb
diff --git a/devtools/ci/ci_main.sh b/devtools/ci/ci_main.sh
index 75d5db62e8..7f990c1e15 100755
--- a/devtools/ci/ci_main.sh
+++ b/devtools/ci/ci_main.sh
@@ -66,15 +66,15 @@ case $GITHUB_WORKFLOW in
     sudo apt-get install -y gcc-multilib
     sudo apt-get install -y gcc-aarch64-linux-gnu g++-aarch64-linux-gnu clang
     rustup target add aarch64-unknown-linux-gnu
-    curl -LO https://www.openssl.org/source/openssl-1.1.1.tar.gz
-    tar -xvzf openssl-1.1.1.tar.gz
-    cd openssl-1.1.1
+    curl -LO https://www.openssl.org/source/openssl-3.1.3.tar.gz
+    tar -xvzf openssl-3.1.3.tar.gz
+    cd openssl-3.1.3
     CC=aarch64-linux-gnu-gcc ./Configure linux-aarch64 shared
     CC=aarch64-linux-gnu-gcc make
     cd ..
     export TOP
-    export OPENSSL_LIB_DIR=$(pwd)/openssl-1.1.1
-    export OPENSSL_INCLUDE_DIR=$(pwd)/openssl-1.1.1/include
+    export OPENSSL_LIB_DIR=$(pwd)/openssl-3.1.3
+    export OPENSSL_INCLUDE_DIR=$(pwd)/openssl-3.1.3/include
     export PKG_CONFIG_ALLOW_CROSS=1
     export CC=gcc
     export CC_aarch64_unknown_linux_gnu=aarch64-linux-gnu-gcc
diff --git a/docker/hub/Dockerfile b/docker/hub/Dockerfile
index c156c4d4e4..e4cdbbbb65 100644
--- a/docker/hub/Dockerfile
+++ b/docker/hub/Dockerfile
@@ -1,9 +1,9 @@
-FROM nervos/ckb-docker-builder:bionic-rust-1.71.1 as ckb-docker-builder
+FROM nervos/ckb-docker-builder:bionic-rust-1.71.1-openssl-3.1.3 as ckb-docker-builder
 
 WORKDIR /ckb
 COPY ./ .
 
-RUN make prod-docker
+RUN make OPENSSL_STATIC=1 OPENSSL_LIB_DIR=/usr/local/lib64 OPENSSL_INCLUDE_DIR=/usr/local/include prod-docker
 
 FROM ubuntu:bionic
 LABEL description="Nervos CKB is a public permissionless blockchain, the common knowledge layer of Nervos network."
@@ -15,10 +15,6 @@ RUN groupadd -g 1000 ckb \
 
 WORKDIR /var/lib/ckb
 
-COPY --from=ckb-docker-builder \
-     /usr/lib/x86_64-linux-gnu/libssl.so.* \
-     /usr/lib/x86_64-linux-gnu/libcrypto.so.* \
-     /usr/lib/x86_64-linux-gnu/
 COPY --from=ckb-docker-builder /ckb/target/prod/ckb /ckb/docker/docker-entrypoint.sh /bin/
 RUN chown -R ckb:ckb /var/lib/ckb \
  && chmod 755 /var/lib/ckb


Test patch: