Repository: pyca/cryptography

Issue:
41.0.6 build fail with LibreSSL 3.8.2 @ FreeBSD 13/stable
```
...
     Running `rustc --crate-name pyo3_ffi --edition=2018 /tmp/ports/usr/ports/security/py-cryptography/work-py39/cryptography-41.0.6/cargo-crates/pyo3-ffi-0.18.3/src/lib.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --diagnostic-width=250 --crate-type lib --emit=dep-info,metadata,link -C opt-level=3 -C embed-bitcode=no -C overflow-checks=on --cfg 'feature="abi3"' --cfg 'feature="abi3-py310"' --cfg 'feature="abi3-py311"' --cfg 'feature="abi3-py37"' --cfg 'feature="abi3-py38"' --cfg 'feature="abi3-py39"' --cfg 'feature="default"' --cfg 'feature="extension-module"' -C metadata=18d4cf00beda892c -C extra-filename=-18d4cf00beda892c --out-dir /tmp/ports/usr/ports/security/py-cryptography/work-py39/cryptography-41.0.6/src/rust/target/release/deps -L dependency=/tmp/ports/usr/ports/security/py-cryptography/work-py39/cryptography-41.0.6/src/rust/target/release/deps --extern libc=/tmp/ports/usr/ports/security/py-cryptography/work-py39/cryptography-41.0.6/src/rust/target/release/deps/liblibc-b2f74b9c3895de20.rmeta --cap-lints allow --cfg Py_3_6 --cfg Py_3_7 --cfg Py_LIMITED_API --cfg min_const_generics --cfg addr_of --cfg option_insert`
The following warnings were emitted during compilation:

warning: ../target/release/build/cryptography-cffi-21c04919c9e7f070/out/_openssl.c:855:7: error: redefinition of 'ENGINE_free' as different kind of symbol
warning: int (*ENGINE_free)(ENGINE *) = NULL;
warning:       ^
warning: /usr/local/include/openssl/engine.h:251:5: note: previous definition is here
warning: int ENGINE_free(ENGINE *engine);
warning:     ^
warning: ../target/release/build/cryptography-cffi-21c04919c9e7f070/out/_openssl.c:856:8: error: redefinition of 'ENGINE_load_builtin_engines' as different kind of symbol
warning: void (*ENGINE_load_builtin_engines)(void) = NULL;
warning:        ^
warning: /usr/local/include/openssl/engine.h:243:6: note: previous definition is here
warning: void ENGINE_load_builtin_engines(void);
warning:      ^
warning: ../target/release/build/cryptography-cffi-21c04919c9e7f070/out/_openssl.c:859:11: error: redefinition of 'ENGINE_by_id' as different kind of symbol
warning: ENGINE *(*ENGINE_by_id)(const char *) = NULL;
warning:           ^
warning: /usr/local/include/openssl/engine.h:255:9: note: previous definition is here
warning: ENGINE *ENGINE_by_id(const char *id);
warning:         ^
warning: ../target/release/build/cryptography-cffi-21c04919c9e7f070/out/_openssl.c:860:7: error: redefinition of 'ENGINE_init' as different kind of symbol
warning: int (*ENGINE_init)(ENGINE *) = NULL;
warning:       ^
warning: /usr/local/include/openssl/engine.h:252:5: note: previous definition is here
warning: int ENGINE_init(ENGINE *engine);
warning:     ^
warning: ../target/release/build/cryptography-cffi-21c04919c9e7f070/out/_openssl.c:861:7: error: redefinition of 'ENGINE_finish' as different kind of symbol
warning: int (*ENGINE_finish)(ENGINE *) = NULL;
warning:       ^
warning: /usr/local/include/openssl/engine.h:253:5: note: previous definition is here
warning: int ENGINE_finish(ENGINE *engine);
warning:     ^
warning: ../target/release/build/cryptography-cffi-21c04919c9e7f070/out/_openssl.c:865:7: error: redefinition of 'ENGINE_ctrl_cmd' as different kind of symbol
warning: int (*ENGINE_ctrl_cmd)(ENGINE *, const char *, long, void *,
warning:       ^
warning: /usr/local/include/openssl/engine.h:264:5: note: previous definition is here
warning: int ENGINE_ctrl_cmd(ENGINE *e, const char *cmd_name, long i, void *p,
warning:     ^
warning: ../target/release/build/cryptography-cffi-21c04919c9e7f070/out/_openssl.c:868:15: error: redefinition of 'ENGINE_get_id' as different kind of symbol
warning: const char *(*ENGINE_get_id)(const ENGINE *) = NULL;
warning:               ^
warning: /usr/local/include/openssl/engine.h:256:13: note: previous definition is here
warning: const char *ENGINE_get_id(const ENGINE *engine);
warning:             ^
warning: ../target/release/build/cryptography-cffi-21c04919c9e7f070/out/_openssl.c:869:15: error: redefinition of 'ENGINE_get_name' as different kind of symbol
warning: const char *(*ENGINE_get_name)(const ENGINE *) = NULL;
warning:               ^
warning: /usr/local/include/openssl/engine.h:257:13: note: previous definition is here
warning: const char *ENGINE_get_name(const ENGINE *engine);
warning:             ^
warning: ../target/release/build/cryptography-cffi-21c04919c9e7f070/out/_openssl.c:871:7: error: redefinition of 'ENGINE_ctrl_cmd_string' as different kind of symbol
warning: int (*ENGINE_ctrl_cmd_string)(ENGINE *, const char *, const char *,
warning:       ^
warning: /usr/local/include/openssl/engine.h:266:5: note: previous definition is here
warning: int ENGINE_ctrl_cmd_string(ENGINE *engine, const char *cmd, const char *arg,
warning:     ^
warning: ../target/release/build/cryptography-cffi-21c04919c9e7f070/out/_openssl.c:873:13: error: redefinition of 'ENGINE_load_private_key' as different kind of symbol
warning: EVP_PKEY *(*ENGINE_load_private_key)(ENGINE *, const char *, UI_METHOD *,
warning:             ^
warning: /usr/local/include/openssl/engine.h:269:11: note: previous definition is here
warning: EVP_PKEY *ENGINE_load_private_key(ENGINE *engine, const char *key_id,
warning:           ^
warning: ../target/release/build/cryptography-cffi-21c04919c9e7f070/out/_openssl.c:875:13: error: redefinition of 'ENGINE_load_public_key' as different kind of symbol
warning: EVP_PKEY *(*ENGINE_load_public_key)(ENGINE *, const char *,
warning:             ^
warning: /usr/local/include/openssl/engine.h:271:11: note: previous definition is here
warning: EVP_PKEY *ENGINE_load_public_key(ENGINE *engine, const char *key_id,
warning:           ^
warning: ../target/release/build/cryptography-cffi-21c04919c9e7f070/out/_openssl.c:9824:10: warning: implicit conversion loses integer precision: 'long' to 'int' [-Wshorten-64-to-32]
warning:   return DTLSv1_listen(x0, x1);
warning:   ~~~~~~ ^~~~~~~~~~~~~~~~~~~~~
warning: /usr/local/include/openssl/ssl.h:969:2: note: expanded from macro 'DTLSv1_listen'
warning:         SSL_ctrl(ssl,DTLS_CTRL_LISTEN,0, (void *)peer)
warning:         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
warning: ../target/release/build/cryptography-cffi-21c04919c9e7f070/out/_openssl.c:9862:14: warning: implicit conversion loses integer precision: 'long' to 'int' [-Wshorten-64-to-32]
warning:   { result = DTLSv1_listen(x0, x1); }
warning:            ~ ^~~~~~~~~~~~~~~~~~~~~
warning: /usr/local/include/openssl/ssl.h:969:2: note: expanded from macro 'DTLSv1_listen'
warning:         SSL_ctrl(ssl,DTLS_CTRL_LISTEN,0, (void *)peer)
warning:         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
warning: ../target/release/build/cryptography-cffi-21c04919c9e7f070/out/_openssl.c:20595:10: warning: implicit conversion changes signedness: 'long' to 'uint64_t' (aka 'unsigned long') [-Wsign-conversion]
warning:   return SSL_CTX_get_options(x0);
warning:   ~~~~~~ ^~~~~~~~~~~~~~~~~~~~~~~
warning: /usr/local/include/openssl/ssl.h:479:2: note: expanded from macro 'SSL_CTX_get_options'
warning:         SSL_CTX_ctrl((ctx),SSL_CTRL_OPTIONS,0,NULL)
warning:         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
warning: ../target/release/build/cryptography-cffi-21c04919c9e7f070/out/_openssl.c:20618:14: warning: implicit conversion changes signedness: 'long' to 'uint64_t' (aka 'unsigned long') [-Wsign-conversion]
warning:   { result = SSL_CTX_get_options(x0); }
warning:            ~ ^~~~~~~~~~~~~~~~~~~~~~~
warning: /usr/local/include/openssl/ssl.h:479:2: note: expanded from macro 'SSL_CTX_get_options'
warning:         SSL_CTX_ctrl((ctx),SSL_CTRL_OPTIONS,0,NULL)
warning:         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
warning: ../target/release/build/cryptography-cffi-21c04919c9e7f070/out/_openssl.c:21690:44: warning: implicit conversion loses integer precision: 'int' to 'uint16_t' (aka 'unsigned short') [-Wimplicit-int-conversion]
warning:   return SSL_CTX_set_max_proto_version(x0, x1);
warning:          ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~     ^~
warning: ../target/release/build/cryptography-cffi-21c04919c9e7f070/out/_openssl.c:21723:48: warning: implicit conversion loses integer precision: 'int' to 'uint16_t' (aka 'unsigned short') [-Wimplicit-int-conversion]
warning:   { result = SSL_CTX_set_max_proto_version(x0, x1); }
warning:              ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~     ^~
warning: ../target/release/build/cryptography-cffi-21c04919c9e7f070/out/_openssl.c:21738:44: warning: implicit conversion loses integer precision: 'int' to 'uint16_t' (aka 'unsigned short') [-Wimplicit-int-conversion]
warning:   return SSL_CTX_set_min_proto_version(x0, x1);
warning:          ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~     ^~
warning: ../target/release/build/cryptography-cffi-21c04919c9e7f070/out/_openssl.c:21771:48: warning: implicit conversion loses integer precision: 'int' to 'uint16_t' (aka 'unsigned short') [-Wimplicit-int-conversion]
warning:   { result = SSL_CTX_set_min_proto_version(x0, x1); }
warning:              ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~     ^~
warning: ../target/release/build/cryptography-cffi-21c04919c9e7f070/out/_openssl.c:21931:10: warning: implicit conversion changes signedness: 'long' to 'uint64_t' (aka 'unsigned long') [-Wsign-conversion]
warning:   return SSL_CTX_set_options(x0, x1);
warning:   ~~~~~~ ^~~~~~~~~~~~~~~~~~~~~~~~~~~
warning: /usr/local/include/openssl/ssl.h:475:2: note: expanded from macro 'SSL_CTX_set_options'
warning:         SSL_CTX_ctrl((ctx),SSL_CTRL_OPTIONS,(op),NULL)
warning:         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
warning: ../target/release/build/cryptography-cffi-21c04919c9e7f070/out/_openssl.c:21931:34: warning: implicit conversion changes signedness: 'uint64_t' (aka 'unsigned long') to 'long' [-Wsign-conversion]
warning:   return SSL_CTX_set_options(x0, x1);
warning:          ~~~~~~~~~~~~~~~~~~~~~~~~^~~
warning: /usr/local/include/openssl/ssl.h:475:39: note: expanded from macro 'SSL_CTX_set_options'
warning:         SSL_CTX_ctrl((ctx),SSL_CTRL_OPTIONS,(op),NULL)
warning:         ~~~~~~~~~~~~                         ^~
warning: ../target/release/build/cryptography-cffi-21c04919c9e7f070/out/_openssl.c:21964:14: warning: implicit conversion changes signedness: 'long' to 'uint64_t' (aka 'unsigned long') [-Wsign-conversion]
warning:   { result = SSL_CTX_set_options(x0, x1); }
warning:            ~ ^~~~~~~~~~~~~~~~~~~~~~~~~~~
warning: /usr/local/include/openssl/ssl.h:475:2: note: expanded from macro 'SSL_CTX_set_options'
warning:         SSL_CTX_ctrl((ctx),SSL_CTRL_OPTIONS,(op),NULL)
warning:         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
warning: ../target/release/build/cryptography-cffi-21c04919c9e7f070/out/_openssl.c:21964:38: warning: implicit conversion changes signedness: 'uint64_t' (aka 'unsigned long') to 'long' [-Wsign-conversion]
warning:   { result = SSL_CTX_set_options(x0, x1); }
warning:              ~~~~~~~~~~~~~~~~~~~~~~~~^~~
warning: /usr/local/include/openssl/ssl.h:475:39: note: expanded from macro 'SSL_CTX_set_options'
warning:         SSL_CTX_ctrl((ctx),SSL_CTRL_OPTIONS,(op),NULL)
warning:         ~~~~~~~~~~~~                         ^~
warning: ../target/release/build/cryptography-cffi-21c04919c9e7f070/out/_openssl.c:24210:10: warning: implicit conversion changes signedness: 'long' to 'uint64_t' (aka 'unsigned long') [-Wsign-conversion]
warning:   return SSL_get_options(x0);
warning:   ~~~~~~ ^~~~~~~~~~~~~~~~~~~
warning: /usr/local/include/openssl/ssl.h:485:9: note: expanded from macro 'SSL_get_options'
warning:         SSL_ctrl((ssl),SSL_CTRL_OPTIONS,0,NULL)
warning:         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
warning: ../target/release/build/cryptography-cffi-21c04919c9e7f070/out/_openssl.c:24233:14: warning: implicit conversion changes signedness: 'long' to 'uint64_t' (aka 'unsigned long') [-Wsign-conversion]
warning:   { result = SSL_get_options(x0); }
warning:            ~ ^~~~~~~~~~~~~~~~~~~
warning: /usr/local/include/openssl/ssl.h:485:9: note: expanded from macro 'SSL_get_options'
warning:         SSL_ctrl((ssl),SSL_CTRL_OPTIONS,0,NULL)
warning:         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
warning: ../target/release/build/cryptography-cffi-21c04919c9e7f070/out/_openssl.c:25596:10: warning: implicit conversion changes signedness: 'long' to 'uint64_t' (aka 'unsigned long') [-Wsign-conversion]
warning:   return SSL_set_options(x0, x1);
warning:   ~~~~~~ ^~~~~~~~~~~~~~~~~~~~~~~
warning: /usr/local/include/openssl/ssl.h:481:2: note: expanded from macro 'SSL_set_options'
warning:         SSL_ctrl((ssl),SSL_CTRL_OPTIONS,(op),NULL)
warning:         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
warning: ../target/release/build/cryptography-cffi-21c04919c9e7f070/out/_openssl.c:25596:30: warning: implicit conversion changes signedness: 'uint64_t' (aka 'unsigned long') to 'long' [-Wsign-conversion]
warning:   return SSL_set_options(x0, x1);
warning:          ~~~~~~~~~~~~~~~~~~~~^~~
warning: /usr/local/include/openssl/ssl.h:481:35: note: expanded from macro 'SSL_set_options'
warning:         SSL_ctrl((ssl),SSL_CTRL_OPTIONS,(op),NULL)
warning:         ~~~~~~~~                         ^~
warning: ../target/release/build/cryptography-cffi-21c04919c9e7f070/out/_openssl.c:25629:14: warning: implicit conversion changes signedness: 'long' to 'uint64_t' (aka 'unsigned long') [-Wsign-conversion]
warning:   { result = SSL_set_options(x0, x1); }
warning:            ~ ^~~~~~~~~~~~~~~~~~~~~~~
warning: /usr/local/include/openssl/ssl.h:481:2: note: expanded from macro 'SSL_set_options'
warning:         SSL_ctrl((ssl),SSL_CTRL_OPTIONS,(op),NULL)
warning:         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
warning: ../target/release/build/cryptography-cffi-21c04919c9e7f070/out/_openssl.c:25629:34: warning: implicit conversion changes signedness: 'uint64_t' (aka 'unsigned long') to 'long' [-Wsign-conversion]
warning:   { result = SSL_set_options(x0, x1); }
warning:              ~~~~~~~~~~~~~~~~~~~~^~~
warning: /usr/local/include/openssl/ssl.h:481:35: note: expanded from macro 'SSL_set_options'
warning:         SSL_ctrl((ssl),SSL_CTRL_OPTIONS,(op),NULL)
warning:         ~~~~~~~~                         ^~
warning: 18 warnings and 11 errors generated.

error: failed to run custom build command for `cryptography-cffi v0.1.0 (/tmp/ports/usr/ports/security/py-cryptography/work-py39/cryptography-41.0.6/src/rust/cryptography-cffi)`
...
```


Discussion:
@alex can you fix it?
Did this work with previous cryptography releases?
No, I had wait for 41.0.6 with hope that it update rust crap and fix this.
Ok. The fix for LibreSSL is on main. @reaperhulk and I will discuss if we should backport.

Resolving patch:
diff --git a/src/_cffi_src/openssl/engine.py b/src/_cffi_src/openssl/engine.py
--- a/src/_cffi_src/openssl/engine.py
+++ b/src/_cffi_src/openssl/engine.py
@@ -42,18 +42,20 @@
 typedef void UI_METHOD;
 #endif
 
-/* Despite being OPENSSL_NO_ENGINE, BoringSSL defines these symbols. */
-#if !CRYPTOGRAPHY_IS_BORINGSSL
+/* Despite being OPENSSL_NO_ENGINE, BoringSSL/LibreSSL define these symbols. */
+#if !CRYPTOGRAPHY_IS_BORINGSSL && !CRYPTOGRAPHY_IS_LIBRESSL
 int (*ENGINE_free)(ENGINE *) = NULL;
 void (*ENGINE_load_builtin_engines)(void) = NULL;
 #endif
 
-ENGINE *(*ENGINE_by_id)(const char *) = NULL;
-int (*ENGINE_init)(ENGINE *) = NULL;
-int (*ENGINE_finish)(ENGINE *) = NULL;
 ENGINE *(*ENGINE_get_default_RAND)(void) = NULL;
 int (*ENGINE_set_default_RAND)(ENGINE *) = NULL;
 void (*ENGINE_unregister_RAND)(ENGINE *) = NULL;
+
+#if !CRYPTOGRAPHY_IS_LIBRESSL
+ENGINE *(*ENGINE_by_id)(const char *) = NULL;
+int (*ENGINE_init)(ENGINE *) = NULL;
+int (*ENGINE_finish)(ENGINE *) = NULL;
 int (*ENGINE_ctrl_cmd)(ENGINE *, const char *, long, void *,
                        void (*)(void), int) = NULL;
 
@@ -66,6 +68,7 @@
                                      void *) = NULL;
 EVP_PKEY *(*ENGINE_load_public_key)(ENGINE *, const char *,
                                     UI_METHOD *, void *) = NULL;
+#endif
 
 #else
 static const long Cryptography_HAS_ENGINE = 1;
diff --git a/src/cryptography/__about__.py b/src/cryptography/__about__.py
--- a/src/cryptography/__about__.py
+++ b/src/cryptography/__about__.py
@@ -10,7 +10,7 @@
     "__copyright__",
 ]
 
-__version__ = "41.0.6"
+__version__ = "41.0.7"
 
 
 __author__ = "The Python Cryptographic Authority and individual contributors"
diff --git a/vectors/cryptography_vectors/__about__.py b/vectors/cryptography_vectors/__about__.py
--- a/vectors/cryptography_vectors/__about__.py
+++ b/vectors/cryptography_vectors/__about__.py
@@ -6,4 +6,4 @@
     "__version__",
 ]
 
-__version__ = "41.0.6"
+__version__ = "41.0.7"


Test patch: