Add build.ps1 support for external system OpenSSL 3.5+ - #6257
Open
Tomas Weinfurt (wfurt) wants to merge 3 commits into
Open
Add build.ps1 support for external system OpenSSL 3.5+#6257Tomas Weinfurt (wfurt) wants to merge 3 commits into
Tomas Weinfurt (wfurt) wants to merge 3 commits into
Conversation
Expose the existing CMake external-OpenSSL selection through the build.ps1 helper so libmsquic can be built against a system OpenSSL 3.5.0+ without building the openssl/quictls submodules. Both libssl and libcrypto are then dynamically linked from the system. - build.ps1: add -UseExternalOpenSSL and -OpenSSLRootDir, mapping to QUIC_USE_EXTERNAL_OPENSSL / QUIC_OPENSSL_ROOT_DIR. Validate that they require -Tls openssl and are incompatible with -UseSystemOpenSSLCrypto. Finer-grained include/lib selection remains available via CMake. - CMakeLists.txt: make QUIC_USE_SYSTEM_LIBCRYPTO and QUIC_USE_EXTERNAL_OPENSSL mutually exclusive with a clear FATAL_ERROR, since the former is silently ignored by the external path. - docs/BUILD.md: document the new options and point power users to the CMake QUIC_OPENSSL_INCLUDE_DIR/QUIC_OPENSSL_LIB_DIR knobs. This is the fully-dynamic system-crypto build direction discussed in microsoft#5210, and avoids the ossl_time_now undefined-symbol crash from the static-libssl + system-libcrypto submodule path. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #6257 +/- ##
==========================================
+ Coverage 85.28% 85.38% +0.09%
==========================================
Files 60 60
Lines 18973 18977 +4
==========================================
+ Hits 16181 16203 +22
+ Misses 2792 2774 -18 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Guillaume Hetier (guhetier)
requested a review
from SanthoshShetty (Santhosha-bk)
August 24, 2026 19:23
Collaborator
Tomas Weinfurt (@wfurt) We are planning to start shipping with OpenSSL instead of QuicTLS by default starting MsQuic v2.7 |
Address review feedback on microsoft#6257: the -UseExternalOpenSSL note claimed libssl/libcrypto are always dynamically linked, but with -Static the external OpenSSL is linked statically (OPENSSL_USE_STATIC_LIBS). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Guillaume Hetier (guhetier)
approved these changes
Aug 27, 2026
SanthoshShetty (Santhosha-bk)
approved these changes
Sep 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Expose the existing CMake external-OpenSSL selection through the build.ps1 helper so libmsquic can be built against a system OpenSSL 3.5.0+ without building the openssl/quictls submodules. Both libssl and libcrypto are then dynamically linked from the system.
build.ps1: add -UseExternalOpenSSL and -OpenSSLRootDir, mapping to QUIC_USE_EXTERNAL_OPENSSL / QUIC_OPENSSL_ROOT_DIR. Validate that they require -Tls openssl and are incompatible with -UseSystemOpenSSLCrypto. Finer-grained include/lib selection remains available via CMake.
CMakeLists.txt: make QUIC_USE_SYSTEM_LIBCRYPTO and QUIC_USE_EXTERNAL_OPENSSL mutually exclusive with a clear FATAL_ERROR, since the former is silently ignored by the external path.
docs/BUILD.md: document the new options and point power users to the CMake QUIC_OPENSSL_INCLUDE_DIR/QUIC_OPENSSL_LIB_DIR knobs.
fixes #5210
when build agains external openssl the library becomes much smaller:
~11× smaller (0.45 MB vs 5.03 MB stripped).
note that we seems to build & ship binaries for Ubuntu 26 using quictls e.g. the old way even if new openssl is available.
Testing
-UseExternalOpenSSLbuildslibmsquic.so, dynamically linkslibssl.so.3+libcrypto.so.3, and has noossl_time_now/ no undefinedossl_*symbols.openssl/quictlssubmodules masked empty: build still succeeds — proves no submodule dependency.tls_openssl.ccompiles with only-I.../src/inc; no submodule OpenSSL headers leak onto the include path.Could NOT find OpenSSL ... Found unsuitable version "3.0.13" ... minimum required is "3.5.0".QUIC_USE_EXTERNAL_OPENSSL+QUIC_USE_SYSTEM_LIBCRYPTOnow fails immediately with the newFATAL_ERROR.~0.45 MBvs quictls~5.03 MB— external is ~11x smaller because OpenSSL is no longer statically embedded.Documentation
docs/BUILD.mdupdated with the new-UseExternalOpenSSL/-OpenSSLRootDiroptions and a note pointing power users to CMake for include/lib-dir control.cc: Marie Píchová (@ManickaP)