Reduce build times resulting from trivial openssl overlay

Help
1

Hi folks, I am using Nix (and not NixOS). have an overlay that looks something like this

      overlays = (self: super: {
        openssl = super.openssl.override {
          # overrides etc/ssl/openssl.cnf because SQL Server 2008 needs TLS 1.0
          conf = ./openssl.cnf;
        };
     });

Rationale: openssl has a single configuration file, which i need to change in such a way that TLS 1.0 is reenabled (the system needs to contact a MS SQL Server 2008, which only does TLS 1.0).

When I do this, half the world gets recompiled, which is understandable, because the config file override path is an argument to the stuff that builds openssl. But the change is really about the runtime environment, not the build environment, so, in reality, there is no need to actually rebuild the dependents. I realize that if I were on NixOS, I could use system.replaceRuntimeDependencies to work around this, but I’m not. I’m in bare Nix. Does anyone have any thoughts (other than just caching the resulting built stuff) that might reduce my build times?

I’m game to change the openssl derivation code if it’s required.

1 Like
2

I assume not every program provided by Nix needs to access the SQL server, so you should not override openssl in nixpkgs. Assign the modified derivation to openssl_with_tls1 and use it in the inputs of those derivations that actually need to access SQL server.

4 Likes
3

Thank you! My final solution was something like

      overlays = (self: super: {
        
        openssl_1_1_with_tls_1_0 = super.openssl_1_1.override {
          # overrides etc/ssl/openssl.cnf
          # SQL Server 2008 needs TLS 1.0
          conf = ./openssl.cnf;
        };
        
        unixODBCDrivers = super.unixODBCDrivers // {
          msodbcsql18 = super.unixODBCDrivers.msodbcsql18.overrideAttrs
            (old: {
              postFixup = ''
                patchelf --set-rpath ${super.lib.makeLibraryPath
                  [ super.unixODBC
                    self.openssl_1_1_with_tls_1_0
                    super.libkrb5
                    super.libuuid
                    super.stdenv.cc.cc ]} $out/${
                      super.unixODBCDrivers.msodbcsql18.passthru.driver}
              '';
            });
        };
      });
4

I feel like you should just be able to set the OPENSSL_CONF environment variable for the process in question to point at the altered one?

2 Likes
5

Oh man, I did not know about OPENSSL_CONF. :man_facepalming: . Thank you.

1 Like
6

I’m just sorry I didn’t see clearly what you were actually trying to do sooner

1 Like
7

The overlay would be useless in most circumstances given OPENSSL_CONF… in this one, however, I think I’m sticking with it.

Rationale: The config file formats between openssl 1.1.1 and 3.X are very different and I’m not sure 3.X would be happy with a 1.1.1 config file. The ODBC driver needs openssl 1.1.1 because I can’t figure out how to allow openssl 3.0.X to talk TLS 1.0. If I set OPENSSL_CONF globally I’m not sure what would happen. WIth the overlay, the rest of the stuff in the process can go ahead and use whatever openssl they’re compiled against.

2 Likes
8

For the sake of people reading this in the future, msodbcsql18 coredumps in that config, but after a few changes, I got msodbcsql17 working.

      overlays = (self: super: {

        openssl_1_1_with_tls_1_0 = super.openssl_1_1.override {
          # overrides etc/ssl/openssl.cnf
          # SQL Server 2008 needs TLS 1.0
          conf = ./openssl.cnf;
        };

        libkrb5_with_openssl_1_1 = super.krb5.override {
          # krb5 uses openssl too
          type = "lib";
          openssl = self.openssl_1_1_with_tls_1_0;
        };

        unixODBCDrivers = super.unixODBCDrivers // {
          msodbcsql17 = super.unixODBCDrivers.msodbcsql17.overrideAttrs
            (old: {
              postFixup = ''
                patchelf --set-rpath ${super.lib.makeLibraryPath
                  [ super.unixODBC
                    self.openssl_1_1_with_tls_1_0
                    self.libkrb5_with_openssl_1_1
                    super.libuuid
                    super.stdenv.cc.cc ]} $out/${
                      super.unixODBCDrivers.msodbcsql17.passthru.driver}
              '';
            });
        };
      });