Skip to content

Commit dc2e895

Browse files
AdityaMishra3000AdityaMishra3000
committed
manylinux: avoid bundling OpenSSL to fix FIPS import crash
1 parent 9faa612 commit dc2e895

File tree

1 file changed

+82
-65
lines changed

1 file changed

+82
-65
lines changed

‎docker/manylinux2014/Dockerfile_x86_64‎

Lines changed: 82 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -9,152 +9,169 @@ ARG FREETYPE_VERSION=2.14.1
99
ARG LIBPNG_VERSION=1.6.53
1010
ARG VPX_VERSION=v1.15.2
1111
ARG NASM_VERSION=2.15.04
12-
ARG OPENSSL_VERSION=1_1_1w
1312
ARG QT_VERSION=5.15.18
1413
ARG YASM_VERSION=1.3.0
1514
ARG AOM_VERSION=v3.13.1
1615
ARG AVIF_VERSION=v1.3.0
1716

1817
ENV LD_LIBRARY_PATH /usr/local/lib:$LD_LIBRARY_PATH
1918

20-
# epel-release need for aarch64 to get openblas packages
21-
RUN yum install zlib-devel curl-devel xcb-util-renderutil-devel xcb-util-devel xcb-util-image-devel xcb-util-keysyms-devel xcb-util-wm-devel mesa-libGL-devel libxkbcommon-devel libxkbcommon-x11-devel libXi-devel lapack-devel epel-release -y && \
22-
yum install openblas-devel dejavu-sans-fonts -y && \
19+
# Base dependencies + system OpenSSL (FIPS-safe)
20+
RUN yum install -y \
21+
zlib-devel \
22+
curl-devel \
23+
xcb-util-renderutil-devel \
24+
xcb-util-devel \
25+
xcb-util-image-devel \
26+
xcb-util-keysyms-devel \
27+
xcb-util-wm-devel \
28+
mesa-libGL-devel \
29+
libxkbcommon-devel \
30+
libxkbcommon-x11-devel \
31+
libXi-devel \
32+
lapack-devel \
33+
epel-release \
34+
openssl \
35+
openssl-devel && \
36+
yum install -y openblas-devel dejavu-sans-fonts && \
2337
cp /usr/include/openblas/*.h /usr/include/ && \
2438
cp /usr/include/lapacke/lapacke*.h /usr/include/ && \
25-
# libpng will be built from source
26-
yum remove libpng -y
39+
yum remove -y libpng
2740

41+
# libpng
2842
RUN mkdir ~/libpng_sources && \
2943
cd ~/libpng_sources && \
3044
curl -O -L https://download.sourceforge.net/libpng/libpng-${LIBPNG_VERSION}.tar.gz && \
3145
tar -xf libpng-${LIBPNG_VERSION}.tar.gz && \
3246
cd libpng-${LIBPNG_VERSION} && \
3347
./configure --prefix=/usr/local && \
34-
make && \
35-
make install && \
36-
cd .. && \
37-
rm -rf ~/libpng_sources
48+
make && make install && \
49+
cd .. && rm -rf ~/libpng_sources
3850

51+
# freetype
3952
RUN mkdir ~/freetype_sources && \
4053
cd ~/freetype_sources && \
4154
curl -O -L https://download.savannah.gnu.org/releases/freetype/freetype-${FREETYPE_VERSION}.tar.gz && \
4255
tar -xf freetype-${FREETYPE_VERSION}.tar.gz && \
4356
cd freetype-${FREETYPE_VERSION} && \
4457
./configure --prefix="/ffmpeg_build" --enable-freetype-config && \
45-
make && \
46-
make install && \
47-
cd .. && \
48-
rm -rf ~/freetype_sources
58+
make && make install && \
59+
cd .. && rm -rf ~/freetype_sources
4960

61+
# Qt (explicitly without OpenSSL)
5062
RUN curl -O -L https://download.qt.io/archive/qt/5.15/${QT_VERSION}/single/qt-everywhere-opensource-src-${QT_VERSION}.tar.xz && \
5163
tar -xf qt-everywhere-opensource-src-${QT_VERSION}.tar.xz && \
5264
cd qt-everywhere-src-${QT_VERSION} && \
5365
export MAKEFLAGS=-j$(nproc) && \
54-
./configure -prefix /opt/Qt${QT_VERSION} -release -opensource -confirm-license -qtnamespace QtOpenCVPython -xcb -xcb-xlib -bundled-xcb-xinput -no-openssl -no-dbus -skip qt3d -skip qtactiveqt -skip qtcanvas3d -skip qtconnectivity -skip qtdatavis3d -skip qtdoc -skip qtgamepad -skip qtgraphicaleffects -skip qtimageformats -skip qtlocation -skip qtmultimedia -skip qtpurchasing -skip qtqa -skip qtremoteobjects -skip qtrepotools -skip qtscript -skip qtscxml -skip qtsensors -skip qtserialbus -skip qtserialport -skip qtspeech -skip qttranslations -skip qtwayland -skip qtwebchannel -skip qtwebengine -skip qtwebsockets -skip qtwebview -skip xmlpatterns -skip declarative -make libs && \
55-
make && \
56-
make install && \
57-
cd .. && \
58-
rm -rf qt-everywhere*
66+
./configure -prefix /opt/Qt${QT_VERSION} -release -opensource -confirm-license \
67+
-qtnamespace QtOpenCVPython \
68+
-xcb -xcb-xlib -bundled-xcb-xinput \
69+
-no-openssl -no-dbus \
70+
-skip qt3d -skip qtactiveqt -skip qtcanvas3d -skip qtconnectivity \
71+
-skip qtdatavis3d -skip qtdoc -skip qtgamepad -skip qtgraphicaleffects \
72+
-skip qtimageformats -skip qtlocation -skip qtmultimedia -skip qtpurchasing \
73+
-skip qtqa -skip qtremoteobjects -skip qtrepotools -skip qtscript \
74+
-skip qtscxml -skip qtsensors -skip qtserialbus -skip qtserialport \
75+
-skip qtspeech -skip qttranslations -skip qtwayland -skip qtwebchannel \
76+
-skip qtwebengine -skip qtwebsockets -skip qtwebview -skip xmlpatterns \
77+
-skip declarative -make libs && \
78+
make && make install && \
79+
cd .. && rm -rf qt-everywhere*
5980

6081
ENV QTDIR /opt/Qt${QT_VERSION}
6182
ENV PATH "$QTDIR/bin:$PATH"
6283

63-
RUN mkdir ~/openssl_sources && \
64-
cd ~/openssl_sources && \
65-
curl -O -L https://github.com/openssl/openssl/archive/OpenSSL_${OPENSSL_VERSION}.tar.gz && \
66-
tar -xf OpenSSL_${OPENSSL_VERSION}.tar.gz && \
67-
cd openssl-OpenSSL_${OPENSSL_VERSION} && \
68-
./config --prefix="/ffmpeg_build" --openssldir="/ffmpeg_build" no-pinshared shared zlib && \
69-
make -j$(getconf _NPROCESSORS_ONLN) && \
70-
# skip installing documentation
71-
make install_sw && \
72-
cd .. && \
73-
rm -rf ~/openssl_build ~/openssl_sources
74-
84+
# nasm
7585
RUN mkdir ~/nasm_sources && \
7686
cd ~/nasm_sources && \
7787
curl -O -L http://www.nasm.us/pub/nasm/releasebuilds/${NASM_VERSION}/nasm-${NASM_VERSION}.tar.gz && \
78-
tar -xf nasm-${NASM_VERSION}.tar.gz && cd nasm-${NASM_VERSION} && ./autogen.sh && \
88+
tar -xf nasm-${NASM_VERSION}.tar.gz && \
89+
cd nasm-${NASM_VERSION} && ./autogen.sh && \
7990
./configure --prefix="/ffmpeg_build" --bindir="$HOME/bin" && \
80-
make -j$(getconf _NPROCESSORS_ONLN) && \
81-
make install && \
82-
cd .. && \
83-
rm -rf ~/nasm_sources
91+
make -j$(getconf _NPROCESSORS_ONLN) && make install && \
92+
cd .. && rm -rf ~/nasm_sources
8493

94+
# yasm
8595
RUN mkdir ~/yasm_sources && \
8696
cd ~/yasm_sources && \
8797
curl -O -L http://www.tortall.net/projects/yasm/releases/yasm-${YASM_VERSION}.tar.gz && \
8898
tar -xf yasm-${YASM_VERSION}.tar.gz && \
8999
cd yasm-${YASM_VERSION} && \
90100
./configure --prefix="/ffmpeg_build" --bindir="$HOME/bin" && \
91-
make -j$(getconf _NPROCESSORS_ONLN) && \
92-
make install && \
93-
cd .. && \
94-
rm -rf ~/yasm_sources
101+
make -j$(getconf _NPROCESSORS_ONLN) && make install && \
102+
cd .. && rm -rf ~/yasm_sources
95103

104+
# libvpx
96105
RUN mkdir ~/libvpx_sources && \
97106
cd ~/libvpx_sources && \
98107
git clone --depth 1 -b ${VPX_VERSION} https://chromium.googlesource.com/webm/libvpx.git && \
99108
cd libvpx && \
100-
./configure --prefix="/ffmpeg_build" --disable-examples --disable-unit-tests --enable-vp9-highbitdepth --as=yasm --enable-pic --enable-shared && \
101-
make -j$(getconf _NPROCESSORS_ONLN) && \
102-
make install && \
103-
cd .. && \
104-
rm -rf ~/libvpx_sources
105-
109+
./configure --prefix="/ffmpeg_build" \
110+
--disable-examples --disable-unit-tests \
111+
--enable-vp9-highbitdepth --as=yasm \
112+
--enable-pic --enable-shared && \
113+
make -j$(getconf _NPROCESSORS_ONLN) && make install && \
114+
cd .. && rm -rf ~/libvpx_sources
115+
116+
# aom
106117
RUN mkdir ~/aom_sources && \
107118
cd ~/aom_sources && \
108119
git clone --depth 1 -b ${AOM_VERSION} https://aomedia.googlesource.com/aom && \
109120
mkdir build && cd build && \
110-
cmake -DCMAKE_C_COMPILER=$(dirname $(which g++))/gcc -DCMAKE_INSTALL_PREFIX=/usr -DBUILD_SHARED_LIBS=ON -DENABLE_TESTS=OFF ../aom/ && \
111-
make -j$(getconf _NPROCESSORS_ONLN) && \
112-
make install && \
121+
cmake -DCMAKE_INSTALL_PREFIX=/usr -DBUILD_SHARED_LIBS=ON -DENABLE_TESTS=OFF ../aom && \
122+
make -j$(getconf _NPROCESSORS_ONLN) && make install && \
113123
cd / && rm -rf ~/aom_sources
114124

125+
# avif
115126
RUN mkdir ~/avif_sources && \
116127
cd ~/avif_sources && \
117128
git clone -b ${AVIF_VERSION} https://github.com/AOMediaCodec/libavif.git && \
118129
mkdir build && cd build && \
119-
cmake -DCMAKE_INSTALL_PREFIX=/usr -DAVIF_CODEC_AOM=SYSTEM -DAVIF_LIBYUV=LOCAL -DAVIF_BUILD_APPS=OFF ../libavif && \
120-
make -j$(getconf _NPROCESSORS_ONLN) && \
121-
make install && \
130+
cmake -DCMAKE_INSTALL_PREFIX=/usr \
131+
-DAVIF_CODEC_AOM=SYSTEM \
132+
-DAVIF_LIBYUV=LOCAL \
133+
-DAVIF_BUILD_APPS=OFF ../libavif && \
134+
make -j$(getconf _NPROCESSORS_ONLN) && make install && \
122135
cd / && rm -rf ~/avif_sources
123136

137+
# ffmpeg (uses system OpenSSL for FIPS compatibility)
124138
RUN mkdir ~/ffmpeg_sources && \
125139
cd ~/ffmpeg_sources && \
126140
curl -O -L https://ffmpeg.org/releases/ffmpeg-${FFMPEG_VERSION}.tar.gz && \
127141
tar -xf ffmpeg-${FFMPEG_VERSION}.tar.gz && \
128142
cd ffmpeg-${FFMPEG_VERSION} && \
129143
PATH=~/bin:$PATH && \
130-
PKG_CONFIG_PATH="/ffmpeg_build/lib/pkgconfig" ./configure --prefix="/ffmpeg_build" --extra-cflags="-I/ffmpeg_build/include" --extra-ldflags="-L/ffmpeg_build/lib" --enable-openssl --enable-libvpx --enable-shared --enable-pic --bindir="$HOME/bin" && \
131-
make -j$(getconf _NPROCESSORS_ONLN) && \
132-
make install && \
144+
PKG_CONFIG_PATH="/usr/lib64/pkgconfig:/usr/lib/pkgconfig:/ffmpeg_build/lib/pkgconfig" \
145+
./configure \
146+
--prefix="/ffmpeg_build" \
147+
--extra-cflags="-I/ffmpeg_build/include" \
148+
--extra-ldflags="-L/ffmpeg_build/lib" \
149+
--enable-openssl \
150+
--enable-libvpx \
151+
--enable-shared \
152+
--enable-pic \
153+
--bindir="$HOME/bin" && \
154+
make -j$(getconf _NPROCESSORS_ONLN) && make install && \
133155
echo "/ffmpeg_build/lib/" >> /etc/ld.so.conf && \
134156
ldconfig && \
135157
rm -rf ~/ffmpeg_sources
136158

159+
# ccache
137160
RUN curl -O -L https://github.com/ccache/ccache/releases/download/v${CCACHE_VERSION}/ccache-${CCACHE_VERSION}.tar.gz && \
138161
tar -xf ccache-${CCACHE_VERSION}.tar.gz && \
139162
cd ccache-${CCACHE_VERSION} && \
140163
./configure && \
141-
make -j$(getconf _NPROCESSORS_ONLN) && \
142-
make install && \
143-
cd .. && \
144-
rm -rf ccache-${CCACHE_VERSION}.tar.gz
164+
make -j$(getconf _NPROCESSORS_ONLN) && make install && \
165+
cd .. && rm -rf ccache-${CCACHE_VERSION}.tar.gz
145166

146-
# GitHub Actions user`s UID is 1001
167+
# CI user
147168
RUN useradd ci -m -s /bin/bash -G users --uid=1001 && \
148-
mkdir /io && \
149-
chown -R ci:ci /io && \
150-
# This needs to find ffmpeg packages from ci user
169+
mkdir /io && chown -R ci:ci /io && \
151170
chown -R ci:ci /ffmpeg_build && \
152-
# This calls in mutlibuild scripts and cannot be run without permissions
153171
chown -R ci:ci /opt/_internal/pipx/venvs/auditwheel
154172

155173
USER ci
156174

157-
# Git security vulnerability: https://github.blog/2022-04-12-git-security-vulnerability-announced
158175
RUN git config --global --add safe.directory /io
159176

160177
ENV PKG_CONFIG_PATH /usr/local/lib/pkgconfig:/ffmpeg_build/lib/pkgconfig

0 commit comments

Comments
 (0)