在 CentOS 上，如何在合并 openssl 模块的同时从源代码构建 Python 3.9？

Question

我正在尝试在 CentOS 7 上构建支持 SSL 的 Python 3.9.1。

[myuser@server Python-3.9.1]$ which openssl
/usr/local/bin/openssl
[myuser@server Python-3.9.1]$ openssl version
OpenSSL 1.1.1g  21 Apr 2020

运行这个命令

sudo ./configure CPPFLAGS="-I/usr/local/openssl/include" LDFLAGS="-L/usr/local/openssl/lib" --with-ssl

接下来的“make”适用于 Python 3.7，但是当我在 3.9 上运行上面的代码然后运行 ​​make 时，我得到了这个输出

...
Python build finished successfully!
The necessary bits to build these optional modules were not found:
_lzma                 _tkinter              _uuid              
To find the necessary bits, look in setup.py in detect_modules() for the module's name.


The following modules found by detect_modules() in setup.py, have been
built by the Makefile instead, as configured by the Setup files:
_abc                  atexit                pwd                
time                                                           


Following modules built successfully but were removed because they could not be imported:
_hashlib              _ssl                                     


Could not build the ssl module!
Python requires an OpenSSL 1.0.2 or 1.1 compatible libssl with X509_VERIFY_PARAM_set1_host().
LibreSSL 2.6.4 and earlier do not provide the necessary APIs, https://github.com/libressl-portable/portable/issues/381

running build_scripts
creating build/scripts-3.9
copying and adjusting /usr/src/Python-3.9.1/Tools/scripts/pydoc3 -> build/scripts-3.9
copying and adjusting /usr/src/Python-3.9.1/Tools/scripts/idle3 -> build/scripts-3.9
copying and adjusting /usr/src/Python-3.9.1/Tools/scripts/2to3 -> build/scripts-3.9
changing mode of build/scripts-3.9/pydoc3 from 644 to 755
changing mode of build/scripts-3.9/idle3 from 644 to 755
changing mode of build/scripts-3.9/2to3 from 644 to 755
renaming build/scripts-3.9/pydoc3 to build/scripts-3.9/pydoc3.9
renaming build/scripts-3.9/idle3 to build/scripts-3.9/idle3.9
renaming build/scripts-3.9/2to3 to build/scripts-3.9/2to3-3.9
/bin/install -c -m 644 ./Tools/gdb/libpython.py python-gdb.py
gcc -pthread -c -Wno-unused-result -Wsign-compare -DNDEBUG -g -fwrapv -O3 -Wall    -std=c99 -Wextra -Wno-unused-result -Wno-unused-parameter -Wno-missing-field-initializers -Werror=implicit-function-declaration -fvisibility=hidden  -I./Include/internal  -I. -I./Include -I/usr/local/openssl/include   -DPy_BUILD_CORE -o Programs/_testembed.o ./Programs/_testembed.c
gcc -pthread -L/usr/local/openssl/lib    -Xlinker -export-dynamic -o Programs/_testembed Programs/_testembed.o libpython3.9.a -lcrypt -lpthread -ldl  -lutil -lm   -lm 
sed -e "s,@EXENAME@,/usr/local/bin/python3.9," < ./Misc/python-config.in >python-config.py
LC_ALL=C sed -e 's,\$(\([A-Za-z0-9_]*\)),\$\{\1\},g' < Misc/python-config.sh >python-config

显然 Python 3.9 并不是使用 SSL 构建的。使用已安装的 openssl 模块构建 Python 3.9 还需要做什么？

Answer 1

Python3.10源码在CentOS 7.6上构建

\n

上面的帖子对指导我的解决方案非常有帮助。我想分享以防其他人可以使用这个：

\n

首先是开发库

\n

\n
1. sudo yum groupinstall "Development Tools" -y
\n
2. sudo yum install openssl11-devel libffi-devel bzip2-devel xz-devel -y\n
   \n
   • 用于静态链接使用openssl11-static
   \n
   \n
\n

\n

然后配置

\n

因此，由于某种原因，CentOS 发布了openssl1.1.1，但它的安装方式与 Python 的脚本不相符configure。

\n

# note that we #include <openssl/foo.h>, so the OpenSSL headers have to be in\n    # an 'openssl' subdirectory\n\n    if ! $found; then\n        OPENSSL_INCLUDES=\n        for ssldir in $ssldirs; do\n            { $as_echo "$as_me:${as_lineno-$LINENO}: checking for openssl/ssl.h in $ssldir" >&5\n$as_echo_n "checking for openssl/ssl.h in $ssldir... " >&6; }\n            if test -f "$ssldir/include/openssl/ssl.h"; then\n                OPENSSL_INCLUDES="-I$ssldir/include"\n                OPENSSL_LDFLAGS="-L$ssldir/lib"\n                OPENSSL_LIBS="-lssl -lcrypto"\n

\n

由于 Python 包含标头，所以需要一个子文件夹：$ssldir/include/openssl/ssl.h

\n

我刚刚创建了一个具有正确布局的新文件夹：

\n

/opt/openssl111/\n\xe2\x94\x9c\xe2\x94\x80\xe2\x94\x80 include\n\xe2\x94\x82\xc2\xa0\xc2\xa0 \xe2\x94\x94\xe2\x94\x80\xe2\x94\x80 openssl\n\xe2\x94\x82       \xe2\x94\x94\xe2\x94\x80\xe2\x94\x80 *.h\n\xe2\x94\x94\xe2\x94\x80\xe2\x94\x80 lib\n    \xe2\x94\x9c\xe2\x94\x80\xe2\x94\x80 libcrypto.so\n    \xe2\x94\x94\xe2\x94\x80\xe2\x94\x80 libssl.so\n

\n

一旦就位，三连胜：

\n

\n
1. ./configure --enable-optimizations --with-lto --with-openssl=/opt/openssl111/\n
   \n
   • lto是链接时间优化
   \n
   \n
\n
2. make -j8
\n
3. make altinstall（安装时/usr/local/不要覆盖系统python）
\n

\n

Answer 2

该问题是因为缺少应安装的开发库。要安装它们，请按照CentOS 的Python 开发人员安装文档，运行

sudo yum install yum-utils
sudo yum-builddep python3

运行以下命令来构建 Python

./configure
make
make test
sudo make install

如果您想使用自定义 SSL 库构建它，请传递参数--with-openssl以及您的库路径。该路径应包含一个lib包含所需文件的文件夹。

./configure
make
make test
sudo make install

Answer 3

编译 Python 时，您需要告诉它要使用哪些 OpenSSL 标头和库。./configure"构建 Python 时，在运行“之前尝试此操作

export CFLAGS="$CFLAGS $(pkg-config --cflags openssl11)"
export LDFLAGS="$LDFLAGS $(pkg-config --libs openssl11)"

这是将正确标志传递给编译器和链接器的最可靠方法。还值得检查是否有任何冲突的值传递到CFLAGS/LDFLAGS环境变量中，这可能会阻碍您的工作。

显然，这假设您已经openssl-devel安装了该软件包。:-)