[package] openssl/1.0.2u: linking against libcrypto.a causes linker to set the EXEC_STACK bit in the executable

When building and linking 64 bit ELF binaries, the linker follows rather arcane rules for determining whether the resulting executable needs an executable stack (good summary of rules is at http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.faqs/ka14320.html). As it turns out, libcrypto.a as built by this recipe contains several .o files which include .note.GNU-stack as well as a handful of .o files that do not have that section, and the linker marks the resulting executable as needing an executable stack.

This is a direct consequence of the recipe using ./Configure rather than ./config. The ./config script contains specific checks that ensure that the assembler gets invoked with --noexecstack if the assembler supports that option, whereas Configure contains no such logic, and from what I can tell offers no option to enable such a thing.

It’s not clear why the recipe chose “Configure” rather than “config” for unix targets. I also haven’t been able to test against a packaged 1.1.1.

Package and Environment Details (include every applicable attribute)

• Package Name/Version: openssl/1.0.2u
• Operating System+version: Linux Centos 7.6
• Compiler+version: devtoolset-7 (gcc-7)
• Conan version: conan 1.21.0

Conan profile (output of conan profile show default or conan profile show <profile> if custom profile is in use)

Put your profile output here

Steps to reproduce (Include if Applicable)

Logs (Include/Attach if Applicable)

Click to expand log

Put your log output here

[Croydon]

They are still releasing lettered 1.0.2 (most recent was 1.0.2u in late december 2019)

1.0.2u is the last patch in the 1.0.2 series. As @SSE4 said, it is EOL

[cleeland]

Yes, this still needs to be fixed.

They are still releasing lettered 1.0.2 (most recent was 1.0.2u in late december 2019), and moving from 1.0.x to 1.1.x is a breaking change.

Basically, we moved from a system-distributed openssl to the conan-based variant of the same release line, and things broke in very subtle but significant ways that cost probably 100+ engineering hours to hunt down. Plus it’s a viral security risk.