Re: git: 3797fe720a37 - main - libcrypto: compile all PIC objects with -DOPENSSL_PIC -fPIC

On 22 Mar 2026, at 01:38, Enji Cooper <ngie@freebsd.org> wrote:
> 
> The branch main has been updated by ngie:
> 
> URL: https://cgit.FreeBSD.org/src/commit/?id=3797fe720a37ff9fb5b20546494ef1c4a6c01541
> 
> commit 3797fe720a37ff9fb5b20546494ef1c4a6c01541
> Author:     Enji Cooper <ngie@FreeBSD.org>
> AuthorDate: 2026-03-22 00:39:16 +0000
> Commit:     Enji Cooper <ngie@FreeBSD.org>
> CommitDate: 2026-03-22 01:38:49 +0000
> 
>    libcrypto: compile all PIC objects with -DOPENSSL_PIC -fPIC
> 
>    This change modifies the libcrypto PIC objects to always compile with
>    `-DOPENSSL_PIC -fPIC` to restore parity with the upstream build process.
>    This ensures that the legacy provider is built with parity to the
>    upstream legacy provider.
> 
>    MFC after:              12 days
>    Tested with:            `make check` (legacy provider), `make universe`
>    Fixes:                  14b9955e
>    Differential Revision:  https://reviews.freebsd.org/D44896
> ---
> secure/lib/libcrypto/Makefile     | 6 ------
> secure/lib/libcrypto/Makefile.inc | 3 +++
> 2 files changed, 3 insertions(+), 6 deletions(-)
> 
> diff --git a/secure/lib/libcrypto/Makefile b/secure/lib/libcrypto/Makefile
> index 738de3479987..9d484e9d480c 100644
> --- a/secure/lib/libcrypto/Makefile
> +++ b/secure/lib/libcrypto/Makefile
> @@ -687,12 +687,6 @@ SUBDIR.${MK_TESTS}= tests
> 
> .include <bsd.lib.mk>
> 
> -.if ${MACHINE} == "powerpc"
> -# Work around "relocation R_PPC_GOT16 out of range" errors
> -PICFLAG= -fPIC
> -.endif
> -PICFLAG+= -DOPENSSL_PIC
> -
> .if defined(ASM_${MACHINE_CPUARCH})
> .PATH: ${SRCTOP}/sys/crypto/openssl/${MACHINE_CPUARCH}
> .if defined(ASM_amd64)
> diff --git a/secure/lib/libcrypto/Makefile.inc b/secure/lib/libcrypto/Makefile.inc
> index 73c650d590ff..8f22d501e005 100644
> --- a/secure/lib/libcrypto/Makefile.inc
> +++ b/secure/lib/libcrypto/Makefile.inc
> @@ -12,6 +12,9 @@ CFLAGS+= -I${LCRYPTO_SRC}/providers/common/include
> CFLAGS+= -I${LCRYPTO_SRC}/providers/fips/include
> CFLAGS+= -I${LCRYPTO_SRC}/providers/implementations/include
> 
> +PICFLAG= -fPIC
> +PICFLAG+= -DOPENSSL_PIC
> +
> .SUFFIXES: .pc
> .PATH.pc: ${LCRYPTO_SRC}/exporters

This isn’t what PICFLAG is for. Is there a reason you can’t use SHARED_CFLAGS?

Jessica