TclTLS: History Of Ticket c0cd214ad4722efa

Artifacts Associated With Ticket c0cd214ad4722efa

Ticket change [f37f308176] (rid 4384) by anonymous on 2026-09-27 14:41:17:

foundin initialized to: "tcltls-20260905210751-225266f767"

icomment:

Hi,
I've run into a few problems building and testing TclTLS from source against a statically linked version of OpenSSL and a statically linked Tcl installation, these are the problems I encountered with some copy-pasted CLI output below:
1. Just running 'make' fails due to an issue building documentation, the workaround is running 'make binaries && make libraries && make install-binaries && make install-libraries'
2. The build process creates the 'pkgIndex.tcl' in the source directory but does not install it. I had to manually 'install pkgIndex.tcl /path/to/custom/tcl/lib/tcltls2.0.1'
3. Loading the example snippet from the man page fails.
4. I also noticed static library libtcl9tls2.0.1.a is surprisingly small, only 136KB.

> uname -r
6.12.108-1-MANJARO

% info tclversion
9.1

> ./openssl --version
OpenSSL 4.0.2 25 Aug 2026 (Library: OpenSSL 4.0.2 25 Aug 2026)

> cd tcltls-20260905210751-225266f767


> ./configure --disable-shared --enable-static-ssl --with-tcl=/path/to/custom/tcl/lib --with-tclsh=/path/to/custom/tcl/bin/tclsh --with-openssl-pkgconfig=/path/to/custom/openssl/lib64/pkgconfig/ --with-tclinclude=/path/to/custom/tcl/include/ --with-openssl-libdir=/path/to/custom/openssl/lib64/ --enable-64bit

> make
sed -e '/^\\s*\#/d' -e '/^\\s*$/d' -e 's/\\/\\\\/g' -e 's/\"/\\"/g' -e 's/^/"/' \
    -e 's/$/\\n\"/' 'library/tls.tcl' > 'tls.tcl.h' || { rm -f tls.tcl.h; exit 1; }
gcc -DPACKAGE_NAME=\"tls\" -DPACKAGE_TARNAME=\"tls\" -DPACKAGE_VERSION=\"2.0.1\" -DPACKAGE_STRING=\"tls\ 2.0.1\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE_URL=\"\" -DBUILD_tls=/\*\*/ -DHAVE_STDIO_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_STRINGS_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_UNISTD_H=1 -DSTDC_HEADERS=1 -DUSE_THREAD_ALLOC=1 -D_REENTRANT=1 -D_THREAD_SAFE=1 -DTCL_THREADS=1 -DSTATIC_BUILD=1 -DUSE_TCL_STUBS=1 -DUSE_TCLOO_STUBS=1 -DMODULE_SCOPE=extern\ __attribute__\(\(__visibility__\(\"hidden\"\)\)\) -DHAVE_HIDDEN=1 -DHAVE_CAST_TO_UNION=1 -DHAVE_STDBOOL_H=1 -DTCL_WIDE_INT_IS_LONG=1 -DTCL_CFG_OPTIMIZED=1 -DUSE_TCL_STUBS=1 -DNO_SSL3=1 -D_FORTIFY_SOURCE=2 -fstack-protector-all -fno-strict-overflow  -Wno-deprecated-declarations -I/usr/include -I"/path/to/custom/tcl/include/"  -I.    -O2 -fomit-frame-pointer -DNDEBUG -Wall -fPIC -pipe -m64 -O2 -fomit-frame-pointer -DNDEBUG -Wall  -c `echo ./generic/tls.c` -o tls.o
gcc -DPACKAGE_NAME=\"tls\" -DPACKAGE_TARNAME=\"tls\" -DPACKAGE_VERSION=\"2.0.1\" -DPACKAGE_STRING=\"tls\ 2.0.1\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE_URL=\"\" -DBUILD_tls=/\*\*/ -DHAVE_STDIO_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_STRINGS_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_UNISTD_H=1 -DSTDC_HEADERS=1 -DUSE_THREAD_ALLOC=1 -D_REENTRANT=1 -D_THREAD_SAFE=1 -DTCL_THREADS=1 -DSTATIC_BUILD=1 -DUSE_TCL_STUBS=1 -DUSE_TCLOO_STUBS=1 -DMODULE_SCOPE=extern\ __attribute__\(\(__visibility__\(\"hidden\"\)\)\) -DHAVE_HIDDEN=1 -DHAVE_CAST_TO_UNION=1 -DHAVE_STDBOOL_H=1 -DTCL_WIDE_INT_IS_LONG=1 -DTCL_CFG_OPTIMIZED=1 -DUSE_TCL_STUBS=1 -DNO_SSL3=1 -D_FORTIFY_SOURCE=2 -fstack-protector-all -fno-strict-overflow  -Wno-deprecated-declarations -I/usr/include -I"/path/to/custom/tcl/include/"  -I.    -O2 -fomit-frame-pointer -DNDEBUG -Wall -fPIC -pipe -m64 -O2 -fomit-frame-pointer -DNDEBUG -Wall  -c `echo ./generic/tlsBIO.c` -o tlsBIO.o
gcc -DPACKAGE_NAME=\"tls\" -DPACKAGE_TARNAME=\"tls\" -DPACKAGE_VERSION=\"2.0.1\" -DPACKAGE_STRING=\"tls\ 2.0.1\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE_URL=\"\" -DBUILD_tls=/\*\*/ -DHAVE_STDIO_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_STRINGS_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_UNISTD_H=1 -DSTDC_HEADERS=1 -DUSE_THREAD_ALLOC=1 -D_REENTRANT=1 -D_THREAD_SAFE=1 -DTCL_THREADS=1 -DSTATIC_BUILD=1 -DUSE_TCL_STUBS=1 -DUSE_TCLOO_STUBS=1 -DMODULE_SCOPE=extern\ __attribute__\(\(__visibility__\(\"hidden\"\)\)\) -DHAVE_HIDDEN=1 -DHAVE_CAST_TO_UNION=1 -DHAVE_STDBOOL_H=1 -DTCL_WIDE_INT_IS_LONG=1 -DTCL_CFG_OPTIMIZED=1 -DUSE_TCL_STUBS=1 -DNO_SSL3=1 -D_FORTIFY_SOURCE=2 -fstack-protector-all -fno-strict-overflow  -Wno-deprecated-declarations -I/usr/include -I"/path/to/custom/tcl/include/"  -I.    -O2 -fomit-frame-pointer -DNDEBUG -Wall -fPIC -pipe -m64 -O2 -fomit-frame-pointer -DNDEBUG -Wall  -c `echo ./generic/tlsIO.c` -o tlsIO.o
gcc -DPACKAGE_NAME=\"tls\" -DPACKAGE_TARNAME=\"tls\" -DPACKAGE_VERSION=\"2.0.1\" -DPACKAGE_STRING=\"tls\ 2.0.1\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE_URL=\"\" -DBUILD_tls=/\*\*/ -DHAVE_STDIO_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_STRINGS_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_UNISTD_H=1 -DSTDC_HEADERS=1 -DUSE_THREAD_ALLOC=1 -D_REENTRANT=1 -D_THREAD_SAFE=1 -DTCL_THREADS=1 -DSTATIC_BUILD=1 -DUSE_TCL_STUBS=1 -DUSE_TCLOO_STUBS=1 -DMODULE_SCOPE=extern\ __attribute__\(\(__visibility__\(\"hidden\"\)\)\) -DHAVE_HIDDEN=1 -DHAVE_CAST_TO_UNION=1 -DHAVE_STDBOOL_H=1 -DTCL_WIDE_INT_IS_LONG=1 -DTCL_CFG_OPTIMIZED=1 -DUSE_TCL_STUBS=1 -DNO_SSL3=1 -D_FORTIFY_SOURCE=2 -fstack-protector-all -fno-strict-overflow  -Wno-deprecated-declarations -I/usr/include -I"/path/to/custom/tcl/include/"  -I.    -O2 -fomit-frame-pointer -DNDEBUG -Wall -fPIC -pipe -m64 -O2 -fomit-frame-pointer -DNDEBUG -Wall  -c `echo ./generic/tlsX509.c` -o tlsX509.o
rm -f libtcl9tls2.0.1.a
ar cr libtcl9tls2.0.1.a tls.o tlsBIO.o tlsIO.o tlsX509.o 
ranlib libtcl9tls2.0.1.a
make nroff documentation
Called UpdateStringOfFsPath with invalid object
make: *** [Makefile:219: make-docs-n] Error 132

> make binaries && make libraries && make install-binaries && make install-libraries

> install pkgIndex.tcl /path/to/custom/tcl/lib/tcltls2.0.1

> cat /tmp/test.tcl
package require http
package require tls

set url "https://www.tcl.tk/"
http::register https 443 [list ::tls::socket -autoservername 1 -require 1]

# Get URL
set token [http::geturl $url]

> /path/to/custom/tcl/bin/tclsh
% source "/tmp/test.tcl"
couldn't load file "/path/to/custom/tcl/lib/tcltls2.0.1/libtcl9tls2.0.1.a": /path/to/custom/tcl/lib/tcltls2.0.1/libtcl9tls2.0.1.a: invalid ELF header

> cat /path/to/custom/tcl/lib/tcltls2.0.1/pkgIndex.tcl
# -*- tcl -*-
# Tcl package index file, version 1.1
#
if {[package vsatisfies [package provide Tcl] 9.0-]} {
    package ifneeded tls 2.0.1 [list apply {{dir} {
        # Load library
        load [file join $dir libtcl9tls2.0.1.a] [string totitle tls]

        # Source init file
        set initScript [file join $dir tls.tcl]
        if {[file exists $initScript]} {
            source -encoding utf-8 $initScript
        }
    }} $dir]
} else {
    if {![package vsatisfies [package provide Tcl] 8.5]} {return}
    package ifneeded tls 2.0.1 [list apply {{dir} {
        # Load library
        if {[string tolower [file extension libtls2.0.1.a]] in [list .dll .dylib .so]} {
            # Load dynamic library
            load [file join $dir libtls2.0.1.a] [string totitle tls]
        } else {
            # Static library
            load {} [string totitle tls]
        }

        # Source init file
        set initScript [file join $dir tls.tcl]
        if {[file exists $initScript]} {
            source -encoding utf-8 $initScript
        }
    }} $dir]
}

login: "anonymous"
mimetype: "text/plain"
severity initialized to: "Important"
status initialized to: "Open"

title initialized to:

Building And Testing Against A Static OpenSSL Fails

type initialized to: "Build Problem"

Ticket change [bfdb8b15c9] (rid 4385) by bohagan on 2026-10-12 17:11:44:

icomment:

Just to be clear, you are trying to create a static TclTLS library using a static OpenSSL library, then load that into TCL? If so, you have the right compile options to create the library, assuming the OpenSSL libcrypto.a and libssl.a files are available in the paths you specified. Most Linux distributions don't include them anymore.

The failed make-docs-n is likely due to you having a ~name or HOME env var in your path. TCL 9.0 doesn't support tilde paths anymore. Please check that and let me know. The right workaround is to do a 'make binaries'.

The pkgIndex.tcl file is only installed for shared libraries. This is inherited from the sample extension makefile. Likely this is because we don't know where to put it for static builds. I can fix this, but...

However, the load will fail since you can't load static libraries, you need to link them to tcl when you compile tcl. The package require then needs to load an empty library like on TCL 8.6. So, I can fix that. However the real issue is you need to call the library from your app. You need something like https://core.tcl-lang.org/tcl/file?name=unix/tclAppInit.c to make it work.

There are a few TCL distributions that statically compile extensions. They may be a good source of information on how to make it work.

login: "bohagan"
mimetype: "text/plain"
priority changed to: "Immediate"
resolution changed to: "Open"