Re: git: 3797fe720a37 - main - libcrypto: compile all PIC objects with -DOPENSSL_PIC -fPIC

On Mon, 23 Mar 2026 18:02:38 +0100, Jessica Clarke wrote:
> 
> On 22 Mar 2026, at 01:38, Enji Cooper <ngie@freebsd.org> wrote:
> > 
> > The branch main has been updated by ngie:
> > 
> > URL: https://cgit.FreeBSD.org/src/commit/?id=3797fe720a37ff9fb5b20546494ef1c4a6c01541
> > 
> > commit 3797fe720a37ff9fb5b20546494ef1c4a6c01541
> > Author:     Enji Cooper <ngie@FreeBSD.org>
> > AuthorDate: 2026-03-22 00:39:16 +0000
> > Commit:     Enji Cooper <ngie@FreeBSD.org>
> > CommitDate: 2026-03-22 01:38:49 +0000
> > 
> >    libcrypto: compile all PIC objects with -DOPENSSL_PIC -fPIC
> > 
> >    This change modifies the libcrypto PIC objects to always compile with
> >    `-DOPENSSL_PIC -fPIC` to restore parity with the upstream build process.
> >    This ensures that the legacy provider is built with parity to the
> >    upstream legacy provider.
> > 
> >    MFC after:              12 days
> >    Tested with:            `make check` (legacy provider), `make universe`
> >    Fixes:                  14b9955e
> >    Differential Revision:  https://reviews.freebsd.org/D44896
> > ---
> > secure/lib/libcrypto/Makefile     | 6 ------
> > secure/lib/libcrypto/Makefile.inc | 3 +++
> > 2 files changed, 3 insertions(+), 6 deletions(-)
> > 
> > diff --git a/secure/lib/libcrypto/Makefile b/secure/lib/libcrypto/Makefile
> > index 738de3479987..9d484e9d480c 100644
> > --- a/secure/lib/libcrypto/Makefile
> > +++ b/secure/lib/libcrypto/Makefile
> > @@ -687,12 +687,6 @@ SUBDIR.${MK_TESTS}= tests
> > 
> > .include <bsd.lib.mk>
> > 
> > -.if ${MACHINE} == "powerpc"
> > -# Work around "relocation R_PPC_GOT16 out of range" errors
> > -PICFLAG= -fPIC
> > -.endif
> > -PICFLAG+= -DOPENSSL_PIC
> > -
> > .if defined(ASM_${MACHINE_CPUARCH})
> > .PATH: ${SRCTOP}/sys/crypto/openssl/${MACHINE_CPUARCH}
> > .if defined(ASM_amd64)
> > diff --git a/secure/lib/libcrypto/Makefile.inc b/secure/lib/libcrypto/Makefile.inc
> > index 73c650d590ff..8f22d501e005 100644
> > --- a/secure/lib/libcrypto/Makefile.inc
> > +++ b/secure/lib/libcrypto/Makefile.inc
> > @@ -12,6 +12,9 @@ CFLAGS+= -I${LCRYPTO_SRC}/providers/common/include
> > CFLAGS+= -I${LCRYPTO_SRC}/providers/fips/include
> > CFLAGS+= -I${LCRYPTO_SRC}/providers/implementations/include
> > 
> > +PICFLAG= -fPIC
> > +PICFLAG+= -DOPENSSL_PIC
> > +
> > .SUFFIXES: .pc
> > .PATH.pc: ${LCRYPTO_SRC}/exporters
> 
> This isn’t what PICFLAG is for. Is there a reason you can’t use SHARED_CFLAGS?

Is this the final fix and will it be merged to stable/15?

Thanks.