OpenSSL crate fails compilation on Mac OS X 10.11

Question

I tried to install the Iron framework for Rust on Mac OS X 10.11.2, but it failed when I run cargo build or cargo run on compiling openssl's stuff:

failed to run custom build command for `openssl-sys-extras v0.7.4`
Process didn't exit successfully: `/xxx/rust/hello/target/debug/build/openssl-sys-extras-413d6c73b37a590d/build-script-build` (exit code: 101)
--- stdout
TARGET = Some("x86_64-apple-darwin")
OPT_LEVEL = Some("0")
PROFILE = Some("debug")
TARGET = Some("x86_64-apple-darwin")
debug=true opt-level=0
HOST = Some("x86_64-apple-darwin")
TARGET = Some("x86_64-apple-darwin")
TARGET = Some("x86_64-apple-darwin")
HOST = Some("x86_64-apple-darwin")
CC_x86_64-apple-darwin = None
CC_x86_64_apple_darwin = None
HOST_CC = None
CC = None
HOST = Some("x86_64-apple-darwin")
TARGET = Some("x86_64-apple-darwin")
HOST = Some("x86_64-apple-darwin")
CFLAGS_x86_64-apple-darwin = None
CFLAGS_x86_64_apple_darwin = None
HOST_CFLAGS = None
CFLAGS = None
running: "cc" "-O0" "-ffunction-sections" "-fdata-sections" "-g" "-m64" "-fPIC" "-o" "/xxx/rust/hello/target/debug/build/openssl-sys-extras-413d6c73b37a590d/out/src/openssl_shim.o" "-c" "src/openssl_shim.c"
ExitStatus(Code(1))


command did not execute successfully, got: exit code: 1



--- stderr
src/openssl_shim.c:1:10: fatal error: 'openssl/hmac.h' file not found
#include <openssl/hmac.h>
     ^
1 error generated.
thread '<main>' panicked at 'explicit panic', /xxx/.cargo/registry/src/github.com-0a35038f75765ae4/gcc-0.3.21/src/lib.rs:772

openssl version seems OK:

$ openssl version
OpenSSL 0.9.8zg 14 July 2015

I don't know what I have to do in order to make this installation work and give Iron a try.

Earthshine

Answer 1

As of rust-openssl version 0.8, Homebrew-installed OpenSSL libraries will be automatically detected by the crate, there is no need to set extra environment variables.

If you need to support a version prior to that or choose to not use Homebrew, read on.

---

This is a known issue (also this and this), but not one that the crate can fix.

The quick solution is to install OpenSSL with Homebrew and then explicitly point to the directories where OpenSSL is found by setting the OPENSSL_INCLUDE_DIR and OPENSSL_LIB_DIR environment variables:

OPENSSL_INCLUDE_DIR=/usr/local/Cellar/openssl/1.0.2e/include \
OPENSSL_LIB_DIR=/usr/local/Cellar/openssl/1.0.2e/lib \
cargo build

If you've already done one cargo build, you will need to run cargo clean first to clear our some stale cached information.

If you don't want to set this for every shell you open, add it to your shell initialization files (like ~/.bash_profile). You can make it a bit less brittle by not hard-coding the version number:

export OPENSSL_INCLUDE_DIR=$(brew --prefix openssl)/include
export OPENSSL_LIB_DIR=$(brew --prefix openssl)/lib

If you don't want to use Homebrew, follow the same process but using the appropriate path to your copy of OpenSSL.

---

The longer reason is well described by andrewtj:

OpenSSL doesn't have a stable ABI so for compatibility purposes Apple have maintained a fork that's compatible with one of the earlier ABIs. They deprecated OpenSSL in 10.7 and finally dropped the headers in 10.11 to push OS X app developers toward bundling their own OpenSSL or using their frameworks. The dylibs have been left around so apps that haven't been updated don't break. You can still link against them but you're opening yourself up to odd compatibility issues by doing so (unless you grab the headers from an earlier OS X release).

Secunda

I'm pretty sure that running brew link --force openssl together with installed pkg-config will resolve this problem automatically. That said, it may be not a good idea to make openssl libraries available by default, I'm not sure. – Wasserman

@VladimirMatveev yeah, that's mentioned in a few of the issues, but I am likewise wary of something like --force until I understand it thoroughly. I'm hoping that the Homebrew devs do all the hard work and make a solid recommendation that I can just follow. :-) – Secunda

Well, AFAIK in this case --force only overrides the setting in the formula not to create symlinks by default. So this should not do anything dangerous and can even be reverted by brew unlink. But yes, I don't know about consequences of making openssl libraries available in /usr/local/lib. – Wasserman

I had a similar issue with hyper and this also helped me fix it. – Koziol

I think it's sufficient to just have the one variable export OPENSSL_DIR="$(brew --prefix openssl)" – Bonni

Answer 2

With Brew use like this:

brew install openssl
export OPENSSL_INCLUDE_DIR=`brew --prefix openssl`/include
export OPENSSL_LIB_DIR=`brew --prefix openssl`/lib
cargo clean
cargo build

Fixture

this worked for me as of April 2017 on El Capitan OSX. Thanks – Ampulla

Worked for me on Catalina 10.15.7 on Oct 2020 – Aitch

Answer 3

If you have homebrew's openssl installed just add the following to your Cargo.toml:

[target.x86_64-apple-darwin.openssl-sys]
rustc-link-search = [ "/usr/local/opt/openssl/lib" ]
rustc-link-lib = [ "ssl", "crypto" ]
include = [ "/usr/local/opt/openssl/include" ]

and then cargo clean && cargo build. No breaking OS X by introducing an incompatible openssl into the library load paths, and no forgetting to set/unset environment variables when you want to build (or polluting your shell env when not working on Rust stuff). All in all a much happier and less infuriating approach.

I can't add this answer to my own question where it belongs (because it depends on homebrew), because Shepmaster decided it should be closed but I'll answer here and link to that question.

Referendum

Note that this solution (which seems reasonable) doesn't seem to depend on homebrew; regardless of how or where you've installed openssl, you should be able to add those configuration variables. The big downside is that you are tying your code to only run on your machine (or machines with similar layouts). Not all x86_64-apple-darwin targets will have the same installation paths. – Secunda

True, it's not a hard homebrew dependency, but you do need to have installed openssl yourself as of El Cap, because the headers are gone for the system openssl (plus it's just too old to be of much use). – Referendum

Yep; that seems to fit with the quote at the bottom of the other answer. Are things like Fink or MacPorts still a thing? I guess people could always have compiled their own OpenSSL version... – Secunda

They are, but in my not so humble opinion hombrew is a significantly better option, for much the same reason I don't like the idea of using the brew link --force openssl approach, they pollute the system and are hard to clean up. – Referendum

Answer 4

https://mcmap.net/q/616171/-openssl-crate-fails-compilation-on-mac-os-x-10-11's answer for MacPorts:

sudo port install openssl
export OPENSSL_INCLUDE_DIR=/opt/local/include
export OPENSSL_LIB_DIR=/opt/local/lib
cargo clean
cargo build

Berceuse

Interesting that the real answer is way back here. – Deafen