Build JITaaS with the same OpenSSL as the rest of OpenJ9

[ymanton]

OpenJ9 can now be built with OpenSSL support. When running configure you can specify --with-openssl=... to choose which set of OpenSSL headers and libraries to build against. The options are system, fetched, and a path to an OpenSSL source tree. See here for details: https://github.com/ibmruntimes/openj9-openjdk-jdk8/blob/6186c40a2eb7bf12dc0139e349229f703e5f4194/jdk/make/closed/autoconf/custom-hook.m4#L507

When building the JIT with JITaaS support we are unaware of that option and look for OpenSSL headers and libs in the default places, which is equivalent to --with-openssl=system. The JIT should instead become aware of that option and build against the same OpenSSL that the rest of the VM is building against.

[a7ehuo]

I will look at this one.

[a7ehuo]

We can add OPENSSL_CFLAGS, OPENSSL_LIBS, and OPENSSL_BUNDLE_LIB_PATH to CUSTOM_COMPILER_ENV_VARS which can be picked up when building JIT. However. --with-openssl=fetched will not set OPENSSL_LIBS. OPENSSL_LIBS will only be set if --with-openssl=system is specified. More details as below:

# --with-openssl=fetched <= Jenkins PR and nightly builds use this option
OPENSSL_DIR is /root/home/ahuo/src/openj9-openjdk-jdk8/openssl
OPENSSL_CFLAGS is -I/root/home/ahuo/src/openj9-openjdk-jdk8/openssl/include
OPENSSL_BUNDLE_LIB_PATH is 
OPENSSL_LIBS is 

# --with-openssl=fetched + --enable-openssl-bundling
OPENSSL_DIR is /root/home/ahuo/src/openj9-openjdk-jdk8/openssl
OPENSSL_CFLAGS is -I/root/home/ahuo/src/openj9-openjdk-jdk8/openssl/include
OPENSSL_BUNDLE_LIB_PATH is /root/home/ahuo/src/openj9-openjdk-jdk8/openssl
OPENSSL_LIBS is 

# --with-openssl=system
# The option --enable_openssl_bundling is not available with --with-openssl=system. Use option fetched or openssl path to bundle crypto library

OPENSSL_DIR is 
OPENSSL_CFLAGS is -I/usr/local/include
OPENSSL_BUNDLE_LIB_PATH is 
OPENSSL_LIBS is -L/usr/local/lib -lssl -lcrypto

[ymanton]

OK, it seems that in the fetched mode we (we = the OpenJ9 crypto lib) dynamically load libcrypt rather than linking to it. That explains why OPENSSL_LIBS is undefined.

For our purposes for building the JIT I guess we can check if OPENSSL_LIBS is defined and use it. If not defined, we can check that OPENSSL_DIR is defined and assume that it will contain the built libraries, so we can just add -L$(OPENSSL_DIR) to our link step so the linker will find the libs.

The only problem then is what to do at runtime, since the libraries will not be in the default search path. We don't have to care about the fetched case, since the user is taking on the responsibility of making sure that the required libraries will be found.

For fetched+bundled it seems we only bundle libcrypto.so not libssl.so. I think we will have to change that first. It also seems like (for JDK8 anyway) libcrypto.so ends up being placed in jre/lib/amd64 so perhaps when linking the JIT we can use something like -rpath $ORIGIN/.. to make sure that the library search path for the JIT includes the directory where libssl.so will end up being placed.