Bug 1565047

Summary: cryptopp-devel lacks static library
Product: [Fedora] Fedora Reporter: Alexander Korsunsky <a.korsunsky>
Component: cryptoppAssignee: nucleo <alekcejk>
Status: CLOSED WONTFIX QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 27CC: alekcejk, aurelien, kwizart, mstevens
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-11-05 15:56:54 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Alexander Korsunsky 2018-04-09 08:55:57 UTC
Description of problem: Statically linking against the Crypto++ library is impossible due to a missing static library.

Hello, I wanted to link statically against the Crypto++ library that is packaged inside Fedora. To my surprise, I have found that there is no "libcryptopp.a" library inside the cryptopp-devel package.

Shared linking works fine, but I would like to statically link the library to my program in order to avoid any shenanigans with the LD_PRELOAD variable.

I checked the spec file, and it seems that the static library is built explicitly excluded from the binary package, so that looks like it
s on purpose. What's the reason for doing that?

Note that upstream even recommends static linking, due to the exact same reason:

> The makefile links to the static version of the Crypto++ library to avoid binary
planting and other LD_PRELOAD tricks. You should use the static version of the
library in your programs to help avoid unwanted redirections.

Source: Readme.txt inside the source package or: https://github.com/weidai11/cryptopp/blob/master/Readme.txt

Besides, both Ubuntu and Debian ship the static library in their libcrypto++-dev package, so I'm wondering about the reasons for excluding it.

Version-Release number of selected component (if applicable): 5.6.5-2.fc27

How reproducible: Every time

Steps to Reproduce:
1. Install cryptopp-devel

Actual results:
No libcryptopp.a library available.

Expected results:
libcryptopp.a available for static linking.

Additional info:
The same issue exists in the Fedora EPEL repo

Comment 1 Nicolas Chauvet (kwizart) 2018-11-05 15:56:54 UTC
Fedora recommends to use shared libraries when possible and because the cflags used across the whole distribution are more appropriate for shared objects I often recommend you to build your own static version instead for your own usage (outside of fedora).