Bref: Version-specific image build fails on mongodb extension compile due to missing openssl

[iansltx]

 cc -DBSON_COMPILATION -DMONGOC_COMPILATION -DKMS_MSG_STATIC -std=gnu99 -DKMS_MESSAGE_ENABLE_CRYPTO=1 -DKMS_MESSAGE_ENABLE_CRYPTO_LIBCRYPTO=1 -Isrc/libmongocrypt/src/crypto/ -I/tmp/pear/temp/mongodb/src/libmongocrypt/src/crypto/ -DPHP_ATOM_INC -I/tmp/pear/temp/pear-build-defaultuseroJ2RFk/mongodb-1.7.2/include -I/tmp/pear/temp/pear-build-defaultuseroJ2RFk/mongodb-1.7.2/main -I/tmp/pear/temp/mongodb -I/opt/bref/include/php -I/opt/bref/include/php/main -I/opt/bref/include/php/TSRM -I/opt/bref/include/php/Zend -I/opt/bref/include/php/ext -I/opt/bref/include/php/ext/date/lib -I/tmp/pear/temp/mongodb/src/libmongoc/src/common/ -I/tmp/pear/temp/mongodb/src/libmongoc/src/libbson/src/ -I/tmp/pear/temp/mongodb/src/libmongoc/src/libbson/src/jsonsl/ -I/tmp/pear/temp/mongodb/src/libmongoc/src/libmongoc/src/ -I/tmp/pear/temp/mongodb/src/libmongocrypt/src/ -I/tmp/pear/temp/mongodb/src/libmongocrypt/kms-message/src/ -I/tmp/pear/temp/mongodb/src/libmongocrypt-compat/ -I/tmp/pear/temp/mongodb/src/BSON/ -I/tmp/pear/temp/mongod
b/src/MongoDB/ -I/tmp/pear/temp/mongodb/src/MongoDB/Exception/ -I/tmp/pear/temp/mongodb/src/MongoDB/Monitoring/ -I/tmp/pear/temp/mongodb/src/contrib/ -DHAVE_CONFIG_H -g -O2 -c /tmp/pear/temp/mongodb/src/libmongocrypt/src/crypto/libcrypto.c  -fPIC -DPIC -o src/libmongocrypt/src/crypto/.libs/libcrypto.o
/tmp/pear/temp/mongodb/src/libmongocrypt/src/crypto/libcrypto.c:30:10: fatal error: openssl/crypto.h: No such file or directory
 #include <openssl/crypto.h>
          ^~~~~~~~~~~~~~~~~~
compilation terminated.
make: *** [src/libmongocrypt/src/crypto/libcrypto.lo] Error 1
ERROR: `make' failed
The command '/bin/bash -c pecl install mongodb' returned a non-zero code: 1
make: *** [docker-images] Error 1

You should be able to repro by running make docker-images from master.

[iansltx]

UPDATE: This doesn't appear to be isolated to 7.2. Had the same error on 7.3.

[iansltx]

Confirmed that 7.2/7.3/7.4 all have the same issue, and that dropping that pecl install allows the build to proceed.

[mnapoli]

Thanks! It is a problem indeed :/

However we do install openssl in the Dockerfiles 🤔 (IIRC) I haven't had the time to look into this yet, do you have an idea on how we could solve this?

[iansltx]

I see openssl compiled in the base image. Was going to suggest yum installing openssl-devel or the like, but not sure that would make anything better.

I did confirm that dropping the pecl install command, as well as the extension include from the test php.ini, allows everything to build, so mongodb is the only hangup here.

[iansltx]

So, this landed Feb 4: https://pecl.php.net/package-changelog.php?package=mongodb&release=1.7.0

Something tells me that the ext didn't require OpenSSL before and now does.

[iansltx]

Hm, wonder if this is the problem: https://github.com/brefphp/bref/blob/master/runtime/base/base.Dockerfile#L134. Thinking that should be openssl, not xml2.

[iansltx]

Nope, that's not it; same error when switching from xml2 to openssl in the dir name.

[alcaeus]

@iansltx would you be able to provide a Dockerfile that reproduces the problem? The issue depends on how you install the MongoDB extension.

if installing via pecl, we will use bundled versions of libraries and auto-detect the SSL library on the system. This information is later exposed via phpinfo. So if you install a 1.6 release (which does not include the failing libmongocrypt library), you can run php --ri mongodb and see output like this (values are from a local dev build and will be different):

MongoDB support => enabled
MongoDB extension version => 1.8.0-dev
MongoDB extension stability => devel
libbson bundled version => 1.17.0-20200224+git958fb6f084
libmongoc bundled version => 1.17.0-20200224+git958fb6f084
libmongoc SSL => enabled
libmongoc SSL library => Secure Transport
libmongoc crypto => enabled
libmongoc crypto library => Common Crypto
libmongoc crypto system profile => disabled

Please post that information either in this issue or create a new issue at https://github.com/mongodb/mongo-php-driver so I can look and inspect it.

If you want to use 1.7.0, there may be several ways around the problem. If you compile the driver manually instead of installing via pecl, you can use the --with-mongodb-ssl and --with-openssl-dir to specify where openssl headers should be found. Alternatively, you should be able to compile a 1.7 release by passing --with-mongodb-client-side-encryption=no to disable support for client-side encryption. Please note that this does not reduce security, as client-side encryption is an optional feature in 1.7.

[mnapoli]

@alcaeus thanks for your help.

Do you know if it is possible to pass the --with-mongodb-client-side-encryption=no flag via pecl install? That would be slightly simpler than installing manually.

BTW here are the Dockerfiles: https://github.com/brefphp/bref/tree/master/runtime/base

To test it, you can clone this repository and run: cd runtimes && make runtimes.

[alcaeus]

Do you know if it is possible to pass the --with-mongodb-client-side-encryption=no flag via pecl install? That would be slightly simpler than installing manually.

I haven't found a way to make this work using pecl, so you'll need to build this manually if you want to disable certain features (or pass different options in general).

I've opened a tracking ticket at https://jira.mongodb.org/browse/PHPC-1560 which you can follow. I'll test this and report back once I know more. Thanks for bringing this to my attention.

[alcaeus]

I've found the cause of the issue, which will be fixed in ext-mongodb 1.7.4. We're currently planning to release this early next week.

[mnapoli]

@alcaeus that is awesome, thank you!

[alcaeus]

There was a slight delay in publishing the release, but it's available now: https://github.com/mongodb/mongo-php-driver/releases/tag/1.7.4. Please let me know if you encounter any other issues. Thank you for the patience!

[mnapoli]

Thank you so much! I'll try recompiling everything asap to test this.

[mnapoli]

All good thank you!