No rule to make target `scripts/extract-cert' when building Linux Kernel - Centos 7, devtoolset-9

Question

I'm trying to debug my build environment for compiling a linux kernel with some patch sets.

I installed devtoolset-9 in my CentOS 7 environment to satisfy the minimum gcc version requirement of the 5.15.86 linux kernel branch. When compiling the kernel with a simple make bzImage, I get the following error:

make[2]: *** No rule to make target `scripts/extract-cert', needed by `certs/x509_certificate_list'.  Stop.

I then tried to make extract-cert by cd'ing to scripts and running make extract-cert, but get the following error:

    cc     extract-cert.c   -o extract-cert
/opt/rh/devtoolset-9/root/usr/libexec/gcc/x86_64-redhat-linux/9/ld: /tmp/ccx32b6d.o: in function `display_openssl_errors':
extract-cert.c:(.text+0x3e): undefined reference to `ERR_peek_error'
/opt/rh/devtoolset-9/root/usr/libexec/gcc/x86_64-redhat-linux/9/ld: extract-cert.c:(.text+0x7f): undefined reference to `ERR_error_string'
/opt/rh/devtoolset-9/root/usr/libexec/gcc/x86_64-redhat-linux/9/ld: extract-cert.c:(.text+0xc2): undefined reference to `ERR_get_error_line'
/opt/rh/devtoolset-9/root/usr/libexec/gcc/x86_64-redhat-linux/9/ld: /tmp/ccx32b6d.o: in function `drain_openssl_errors':
extract-cert.c:(.text+0xdd): undefined reference to `ERR_peek_error'
/opt/rh/devtoolset-9/root/usr/libexec/gcc/x86_64-redhat-linux/9/ld: extract-cert.c:(.text+0xf6): undefined reference to `ERR_get_error_line'
/opt/rh/devtoolset-9/root/usr/libexec/gcc/x86_64-redhat-linux/9/ld: /tmp/ccx32b6d.o: in function `write_cert':
extract-cert.c:(.text+0x132): undefined reference to `BIO_new_file'
/opt/rh/devtoolset-9/root/usr/libexec/gcc/x86_64-redhat-linux/9/ld: extract-cert.c:(.text+0x186): undefined reference to `X509_get_subject_name'
/opt/rh/devtoolset-9/root/usr/libexec/gcc/x86_64-redhat-linux/9/ld: extract-cert.c:(.text+0x1a0): undefined reference to `X509_NAME_oneline'
/opt/rh/devtoolset-9/root/usr/libexec/gcc/x86_64-redhat-linux/9/ld: extract-cert.c:(.text+0x1b9): undefined reference to `i2d_X509_bio'
/opt/rh/devtoolset-9/root/usr/libexec/gcc/x86_64-redhat-linux/9/ld: /tmp/ccx32b6d.o: in function `main':
extract-cert.c:(.text+0x230): undefined reference to `OPENSSL_add_all_algorithms_noconf'
/opt/rh/devtoolset-9/root/usr/libexec/gcc/x86_64-redhat-linux/9/ld: extract-cert.c:(.text+0x235): undefined reference to `ERR_load_crypto_strings'
/opt/rh/devtoolset-9/root/usr/libexec/gcc/x86_64-redhat-linux/9/ld: extract-cert.c:(.text+0x23a): undefined reference to `ERR_clear_error'
/opt/rh/devtoolset-9/root/usr/libexec/gcc/x86_64-redhat-linux/9/ld: extract-cert.c:(.text+0x338): undefined reference to `ENGINE_load_builtin_engines'
/opt/rh/devtoolset-9/root/usr/libexec/gcc/x86_64-redhat-linux/9/ld: extract-cert.c:(.text+0x347): undefined reference to `ENGINE_by_id'
/opt/rh/devtoolset-9/root/usr/libexec/gcc/x86_64-redhat-linux/9/ld: extract-cert.c:(.text+0x386): undefined reference to `ENGINE_init'
/opt/rh/devtoolset-9/root/usr/libexec/gcc/x86_64-redhat-linux/9/ld: extract-cert.c:(.text+0x3e2): undefined reference to `ENGINE_ctrl_cmd_string'
/opt/rh/devtoolset-9/root/usr/libexec/gcc/x86_64-redhat-linux/9/ld: extract-cert.c:(.text+0x437): undefined reference to `ENGINE_ctrl_cmd'
/opt/rh/devtoolset-9/root/usr/libexec/gcc/x86_64-redhat-linux/9/ld: extract-cert.c:(.text+0x48a): undefined reference to `BIO_new_file'
/opt/rh/devtoolset-9/root/usr/libexec/gcc/x86_64-redhat-linux/9/ld: extract-cert.c:(.text+0x4df): undefined reference to `PEM_read_bio_X509'
/opt/rh/devtoolset-9/root/usr/libexec/gcc/x86_64-redhat-linux/9/ld: extract-cert.c:(.text+0x4fb): undefined reference to `ERR_peek_last_error'
/opt/rh/devtoolset-9/root/usr/libexec/gcc/x86_64-redhat-linux/9/ld: extract-cert.c:(.text+0x522): undefined reference to `ERR_clear_error'
/opt/rh/devtoolset-9/root/usr/libexec/gcc/x86_64-redhat-linux/9/ld: extract-cert.c:(.text+0x57a): undefined reference to `BIO_free'
collect2: error: ld returned 1 exit status
make: *** [extract-cert] Error 1

I searched in the OpenSSL source code on github and found the symbols that the linker is complaining about. So it seems that it is an OpenSSL error. I have OpenSSL installed, but I'm not sure how it works with devtoolset-9. How do I get the linker within devtoolset-9 to find the OpenSSL library? The pkgconfig files look correct to me, and the libraries exist in /usr/lib64/

$>gcc --version
gcc (GCC) 9.3.1 20200408 (Red Hat 9.3.1-2) Copyright (C) 2019 Free Software Foundation, Inc. This is free software; see the source for copying conditions.  There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
openssl version
OpenSSL 1.0.2k-fips  26 Jan 2017

$>yum list installed | grep ssl
openssl.x86_64                          1:1.0.2k-26.el7_9        @updates
openssl-devel.x86_64                    1:1.0.2k-26.el7_9        @updates
openssl-libs.x86_64                     1:1.0.2k-26.el7_9        @updates

$>find . -name 'libssl*'
./usr/lib64/pkgconfig/libssl.pc
./usr/lib64/libssl.so.1.0.2k
./usr/lib64/libssl.so.10
./usr/lib64/libssl3.so
./usr/lib64/libssl.so

$>cat ./usr/lib64/pkgconfig/libssl.pc
prefix=/usr
exec_prefix=${prefix}
libdir=${exec_prefix}/lib64
includedir=${prefix}/include

Name: OpenSSL-libssl
Description: Secure Sockets Layer and cryptography libraries
Version: 1.0.2k
Requires: libcrypto
Libs: -L${libdir} -lssl
Libs.private: -ldl -lz -lgssapi_krb5 -lkrb5 -lcom_err -lk5crypto
Cflags: -I${includedir} -I/usr/include

$>cat ./usr/lib64/pkgconfig/libcrypto.pc
prefix=/usr
exec_prefix=${prefix}
libdir=${exec_prefix}/lib64
includedir=${prefix}/include
enginesdir=/usr/lib64/openssl/engines

Name: OpenSSL-libcrypto
Description: OpenSSL cryptography library
Version: 1.0.2k
Requires:
Libs: -L${libdir} -lcrypto
Libs.private: -ldl -lz
Cflags: -I${includedir}

@Ginnungagap: The result of echo | gcc -xc -E -v - is:

$> echo | gcc -xc -E -v -
Using built-in specs.
COLLECT_GCC=gcc
Target: x86_64-redhat-linux
Configured with: ../configure --enable-bootstrap --enable-languages=c,c++,fortran,lto --prefix=/opt/rh/devtoolset-9/root/usr --mandir=/opt/rh/devtoolset-9/root/usr/share/man --infodir=/opt/rh/devtoolset-9/root/usr/share/info --with-bugurl=http://bugzilla.redhat.com/bugzilla --enable-shared --enable-threads=posix --enable-checking=release --enable-multilib --with-system-zlib --enable-__cxa_atexit --disable-libunwind-exceptions --enable-gnu-unique-object --enable-linker-build-id --with-gcc-major-version-only --with-linker-hash-style=gnu --with-default-libstdcxx-abi=gcc4-compatible --enable-plugin --enable-initfini-array --with-isl=/builddir/build/BUILD/gcc-9.3.1-20200408/obj-x86_64-redhat-linux/isl-install --disable-libmpx --enable-gnu-indirect-function --with-tune=generic --with-arch_32=x86-64 --build=x86_64-redhat-linux
Thread model: posix
gcc version 9.3.1 20200408 (Red Hat 9.3.1-2) (GCC)
COLLECT_GCC_OPTIONS='-E' '-v' '-mtune=generic' '-march=x86-64'
 /opt/rh/devtoolset-9/root/usr/libexec/gcc/x86_64-redhat-linux/9/cc1 -E -quiet -v - -mtune=generic -march=x86-64
ignoring nonexistent directory "/opt/rh/devtoolset-9/root/usr/lib/gcc/x86_64-redhat-linux/9/include-fixed"
ignoring nonexistent directory "/opt/rh/devtoolset-9/root/usr/lib/gcc/x86_64-redhat-linux/9/../../../../x86_64-redhat-linux/include"
#include "..." search starts here:
#include <...> search starts here:
 /opt/rh/devtoolset-9/root/usr/lib/gcc/x86_64-redhat-linux/9/include
 /usr/local/include
 /opt/rh/devtoolset-9/root/usr/include
 /usr/include
End of search list.
# 1 "<stdin>"
# 1 "<built-in>"
# 1 "<command-line>"
# 31 "<command-line>"
# 1 "/usr/include/stdc-predef.h" 1 3 4
# 32 "<command-line>" 2
# 1 "<stdin>"
COMPILER_PATH=/opt/rh/devtoolset-9/root/usr/libexec/gcc/x86_64-redhat-linux/9/:/opt/rh/devtoolset-9/root/usr/libexec/gcc/x86_64-redhat-linux/9/:/opt/rh/devtoolset-9/root/usr/libexec/gcc/x86_64-redhat-linux/:/opt/rh/devtoolset-9/root/usr/lib/gcc/x86_64-redhat-linux/9/:/opt/rh/devtoolset-9/root/usr/lib/gcc/x86_64-redhat-linux/
LIBRARY_PATH=/opt/rh/devtoolset-9/root/usr/lib/gcc/x86_64-redhat-linux/9/:/opt/rh/devtoolset-9/root/usr/lib/gcc/x86_64-redhat-linux/9/../../../../lib64/:/lib/../lib64/:/usr/lib/../lib64/:/opt/rh/devtoolset-9/root/usr/lib/gcc/x86_64-redhat-linux/9/../../../:/lib/:/usr/lib/
COLLECT_GCC_OPTIONS='-E' '-v' '-mtune=generic' '-march=x86-64'

Answer 1

This issue was due to a broken Makefile at scripts/Makefile. I was cherry-picking a custom patch from an older kernel version, and at some point the new kbuild shorthand hostprogs-always-y was introduced. When I cherry-picked the old patch, this was changed back to just hostprogs-y. This caused the helper programs in scripts/* not to get built by kbuild.

Example Makefile entry for extract-cert:

hostprogs-always-$(CONFIG_SYSTEM_TRUSTED_KEYRING)   += extract-cert

Information from patchwork is here.

Quoting the patch from Masahiro Yamada:

To build host programs, you need to add the program names to 'hostprogs' to use the necessary build rule, but it is not enough to build them because there is no dependency.

There are two types of host programs: built as the prerequisite of another (e.g. gen_crc32table in lib/Makefile), or always built when Kbuild visits the Makefile (e.g. genksyms in scripts/genksyms/Makefile).

The latter is typical in Makefiles under scripts/, which contains host programs globally used during the kernel build. To build them, you need to add them to both 'hostprogs' and 'always-y'.

This commit adds hostprogs-always-y as a shorthand.

Answer 2

extract-certs was moved from scripts/ to certs/ from kernel 5.17 commit

i suppose the make target must be updated