Add OpenSSL from-source build instructions alongside mbedTLS - #1400
Add OpenSSL from-source build instructions alongside mbedTLS#1400DL6ER wants to merge 3 commits into
Conversation
✅ Deploy Preview for pihole-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
7eddb99 to
797b5b5
Compare
DL6ER
changed the title
FTL's `development` branch links against OpenSSL 3.5 while `master` still uses mbedTLS. Document the OpenSSL 3.5.7 build (mirroring the `ftl-build` container, using `./config` for native host target auto-detection) next to the existing mbedTLS instructions, and note which branch needs which library. The mbedTLS section can be dropped once the next FTL release ships OpenSSL. Signed-off-by: DL6ER <dl6er@dl6er.de>
DL6ER
changed the title
DL6ER
changed the title
|
Should be merged after pi-hole/FTL#2941 has been merged as the text says that |
DL6ER
changed the title
|
Keeping both the mbedTLS and OpenSSL instructions on purpose for now (a bit of Zweigleisigkeit): FTL on Once the next FTL release (the one including the OpenSSL migration) is out, the mbedTLS section can be removed. Until then, having both does not hurt, which is why this PR no longer depends on pi-hole/FTL#2941 and can be merged at any time. |
FTL targets OpenSSL 4.0 (it ships SSL_get_peer_addr, which the later DoQ work needs). Bump the from-source instructions to 4.0.0 and drop no-ssl3 / no-engine from the config line: SSLv3 and the ENGINE API are already removed in 4.0, so both are only accepted there as deprecated Configure options. Signed-off-by: DL6ER <dl6er@dl6er.de>
The from-source guide now follows the `development` branch explicitly, with a note that it may not match `master` or older releases. Since `development` moved its webserver TLS stack to OpenSSL, remove the `libmbedtls` section and the master-vs-development hedge and keep OpenSSL as the single path. Also make the build feature-complete: call out OpenSSL 4.0 (with a note that an older 3.5.x works but disables the HTTP/3 and QUIC features), and add `nghttp2`/`nghttp3` from-source steps so a locally built binary serves HTTP/2 and HTTP/3 like the official release. Signed-off-by: DL6ER <dl6er@dl6er.de>
| We pre-compile FTL for you to save you the trouble of compiling anything yourself. However, sometimes you may want to make your own modifications. To test them, you have to compile FTL from source. Luckily, you don't have to be a programmer to build FTL from source and install it on your system; you only have to know the basics we provide in here. With just a few commands, you can build FTL from source like a pro. | ||
|
|
||
| !!! note | ||
| These instructions follow FTL's `development` branch - the code the next release is built from. They are not guaranteed to match the current `master` branch or older releases, whose build dependencies can differ (for example, `master` still links mbedTLS while `development` has moved to OpenSSL). If you are building a different branch and something does not line up, just ask us - we are happy to help with the specifics. |
There was a problem hiding this comment.
(for example, `master` still links mbedTLS while `development` has moved to OpenSSL)
This is true only until the next release, correct?
After that mbedTLS will be removed from master too.
We probably need to add a reminder somewhere to remove this comment after the release.
There was a problem hiding this comment.
We could remove the part
(for example,
masterstill links mbedTLS whiledevelopmenthas moved to OpenSSL)
and it will be always true
yubiuser
left a comment
yubiuser
left a comment
There was a problem hiding this comment.
The whole ToC for this page is distorted. Install native build environment and Use containerized build environment are not part of the ToC. I suspect, it's because both use a level one heading. I think it would work, if all headings are moved one level down (# -> ##, ## -> ###,..)
| sudo service pihole-FTL restart | ||
| ``` | ||
|
|
||
| ## Caution |
| ``` | ||
|
|
||
| ## Caution | ||
|
|
|
|
||
| ## Caution | ||
|
|
||
| Once your homebrew `pihole-FTL` binary is built and installed, do not run `pihole -up` or `pihole checkout`. These commands might overwrite your local `pihole-FTL` binary with Pi-hole's pre-compiled binaries. |
There was a problem hiding this comment.
| Once your homebrew `pihole-FTL` binary is built and installed, do not run `pihole -up` or `pihole checkout`. These commands might overwrite your local `pihole-FTL` binary with Pi-hole's pre-compiled binaries. |
Note
Accompanies the FTL OpenSSL migration PR (pi-hole/FTL#2941), but no longer depends on it: since both the mbedTLS and OpenSSL instructions are kept, this can be merged at any time.
What
Adds an OpenSSL from-source build section to the FTL compile-from-source guide, next to the existing mbedTLS one. Both are kept for now:
masterstill links against mbedTLS, whiledevelopment(and the upcoming release) uses OpenSSL. A short note tells readers which library goes with which branch.Details
ftl-buildcontainer.no-*configure flags (static-onlylibssl/libcrypto, drops legacy provider, unused protocols/ciphers, engines, DSO)../config(auto target detection) instead of the container's per-archcase/./Configure, since a native host build does not cross-compile.sedpatch for the OpenSSL path - OpenSSL enables threading by default.make install_devto install only headers + static libs.The mbedTLS section can be removed once the next FTL release (the one including the OpenSSL migration) is out. See the comment below for the reasoning.