threads / rfc / 40851

[RFC] OS X El Capitan + Xcode ships without SSL header?!

Subject: [RFC] OS X El Capitan + Xcode ships without SSL header?!

## tl;dr

4 messages between Nov 21, 2015 and Dec 1, 2015.

replies: 3people: 3as markdown or json

Lars Schneider· Nov 21, 2015, 18:58 UTC · lore
Hi,
I cannot build Git on a clean machine with OS X El Capitan 10.11, Xcode 7.1.1 and Xcode command line tools because of missing OpenSSL headers.

It looks like as there are no OpenSSL headers at all. I only found this weird non working version: /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/swift-migrator/sdk/MacOSX.sdk/usr/include/openssl/ssl.h

I installed OpenSSL with brew, added the include path and it works.
Can anyone confirm?

Thanks, Lars

Dair Grant· Nov 22, 2015, 13:12 UTC · re: Lars Schneider · lore

Re: [RFC] OS X El Capitan + Xcode ships without SSL header?!

Show 5 quoted lines
> On 21 Nov 2015, at 18:58, Lars Schneider <larsxschneider@gmail.com> wrote:
> 
> I installed OpenSSL with brew, added the include path and it works.
> 
> Can anyone confirm?
That is correct. Xcode’s copy of OpenSSL has been deprecated since 10.7 and was removed for 10.11 in Xcode 7:
   https://lists.apple.com/archives/macnetworkprog/2015/Jun/msg00025.html
-dair
Torsten Bögershausen· Nov 29, 2015, 17:04 UTC · re: Lars Schneider · lore

Re: [RFC] OS X El Capitan + Xcode ships without SSL header?!

On 21/11/15 19:58, Lars Schneider wrote:
Show 14 quoted lines
> Hi,
> 
> I cannot build Git on a clean machine with OS X El Capitan 10.11, Xcode 7.1.1 and Xcode command line tools because of missing OpenSSL headers.
> 
> It looks like as there are no OpenSSL headers at all. I only found this weird non working version:
> /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/swift-migrator/sdk/MacOSX.sdk/usr/include/openssl/ssl.h
> 
> I installed OpenSSL with brew, added the include path and it works.
> 
> Can anyone confirm?
> 
> Thanks,
> Lars
> 
(Does it make sense that you send a patch which auto-detects brew similar to fink or mac ports?)

After some proper updating of one test machine I ran into the same problem. A possible patch may look like this:

commit 5e7c16f3350e8e62bfdb181b0b5da7352945d046
Author: Torsten Bögershausen <tboegi@web.de>
Date:   Sun Nov 29 17:29:22 2015 +0100
    Mac OS X 10.11: set NO_OPENSSL
    
    There is no openssl/ directory any more in Mac OS X 10.11,
    openssl is depracated since Mac OS X 10.7
    
    Set NO_OPENSSL to YesPlease as default under Mac OS X, and make it
    possible to override this and use openssl by defining DARWIN_OPENSSL
diff --git a/config.mak.uname b/config.mak.uname
index f34dcaa..a8a8b07 100644
--- a/config.mak.uname
+++ b/config.mak.uname
@@ -105,6 +105,12 @@ ifeq ($(uname_S),Darwin)
        ifeq ($(shell test "`expr "$(uname_R)" : '\([0-9][0-9]*\)\.'`" -ge 11 && echo 1),1)
                HAVE_GETDELIM = YesPlease
        endif
+       # MacOS 10.11  and higher
+       ifeq ($(shell test "`expr "$(uname_R)" : '\([0-9][0-9]*\)\.'`" -ge 15 && echo 1),1)
+               ifndef DARWIN_OPENSSL
+                       NO_OPENSSL = YesPlease
+               endif
+       endif
        NO_MEMMEM = YesPlease
        USE_ST_TIMESPEC = YesPlease
        HAVE_DEV_TTY = YesPlease
Lars Schneider· Dec 1, 2015, 09:04 UTC · re: Torsten Bögershausen · lore

Re: [RFC] OS X El Capitan + Xcode ships without SSL header?!

On 29 Nov 2015, at 18:04, Torsten Bögershausen <tboegi@web.de> wrote:
Show 16 quoted lines
> On 21/11/15 19:58, Lars Schneider wrote:
>> Hi,
>> 
>> I cannot build Git on a clean machine with OS X El Capitan 10.11, Xcode 7.1.1 and Xcode command line tools because of missing OpenSSL headers.
>> 
>> It looks like as there are no OpenSSL headers at all. I only found this weird non working version:
>> /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/swift-migrator/sdk/MacOSX.sdk/usr/include/openssl/ssl.h
>> 
>> I installed OpenSSL with brew, added the include path and it works.
>> 
>> Can anyone confirm?
>> 
>> Thanks,
>> Lars
>> 
> (Does it make sense that you send a patch which auto-detects brew similar to fink or mac ports?)
I think that would make sense. I'll look into it if I find some free cycles...
Show 31 quoted lines
> 
> After some proper updating of one test machine I ran into the same problem.
> A possible patch may look like this:
> 
> 
> commit 5e7c16f3350e8e62bfdb181b0b5da7352945d046
> Author: Torsten Bögershausen <tboegi@web.de>
> Date:   Sun Nov 29 17:29:22 2015 +0100
> 
>    Mac OS X 10.11: set NO_OPENSSL
> 
>    There is no openssl/ directory any more in Mac OS X 10.11,
>    openssl is depracated since Mac OS X 10.7
> 
>    Set NO_OPENSSL to YesPlease as default under Mac OS X, and make it
>    possible to override this and use openssl by defining DARWIN_OPENSSL
> 
> diff --git a/config.mak.uname b/config.mak.uname
> index f34dcaa..a8a8b07 100644
> --- a/config.mak.uname
> +++ b/config.mak.uname
> @@ -105,6 +105,12 @@ ifeq ($(uname_S),Darwin)
>        ifeq ($(shell test "`expr "$(uname_R)" : '\([0-9][0-9]*\)\.'`" -ge 11 && echo 1),1)
>                HAVE_GETDELIM = YesPlease
>        endif
> +       # MacOS 10.11  and higher
> +       ifeq ($(shell test "`expr "$(uname_R)" : '\([0-9][0-9]*\)\.'`" -ge 15 && echo 1),1)
> +               ifndef DARWIN_OPENSSL
> +                       NO_OPENSSL = YesPlease
> +               endif
> +       endif
That would propably do it. However, what are the ramifications here? Does this affect `git clone` over HTTPS or even SSH? Sorry if this question sounds stupid but I am not too familiar with these systems. If there are indeed these severe ramifications then I would probably print a little tutorial how to install OpenSSL via brew.
Maybe one could use Apple's TLS implementation [1] on OS X alternatively. However, I don't know how different the APIs are and the resulting "ifdefs" are probably undesired.

Cheers, Lars

[1] https://developer.apple.com/library/mac/documentation/Security/Reference/secureTransportRef/

← back to recent threads