Undefined reference to symbol 'SSL_CTX_get_cert_store'

[phodina]

Description

I'm attempting to use the cpr as a dependency to build depthai-core project on Nixos.

Unfortunately I do get error during linking about missing symbol in the library.

/nix/store/9g4gsby96w4cx1i338kplaap0x37apdf-binutils-2.43.1/bin/ld: /nix/store/mfmymib131v7h2r9c1y2fkvp5zibpp7b-cpr-1.11.0/lib/libcpr.a(ssl_ctx.cpp.o): undefined reference to symbol 'SSL_CTX_get_cert_store@@OPENSSL_3.0.0'
/nix/store/9g4gsby96w4cx1i338kplaap0x37apdf-binutils-2.43.1/bin/ld: /nix/store/z2g8g76mw8xkyniz5yxnrn8r0gpdckzy-openssl-3.4.1/lib/libssl.so.3: error adding symbols: DSO missing from command line
collect2: error: ld returned 1 exit status

Is there an option to turn on during the build?

What version of the OpenSSL should I use? I attempted 3.0.16 and 3.4.1

Example/How to Reproduce

Here's package definition of the cpr for later upstreaming into nixpkgs repo:

{ lib
, stdenv
, fetchFromGitHub
, cmake
, pkg-config
, openssl_3
, curl
, zlib
, gtest
, cppcheck
}:

stdenv.mkDerivation rec {
  pname = "cpr";
  version = "1.11.0";

  src = fetchFromGitHub {
    owner = "libcpr";
    repo = "cpr";
    tag = "${version}";
    sha256 = "sha256-jWyss0krj8MVFqU1LAig+4UbXO5pdcWIT+hCs9DxemM=";
  };

  patches = [ ./001-build.patch ];

  nativeBuildInputs = [
    cmake
    pkg-config
    gtest
    cppcheck
  ];

  buildInputs = [
    openssl_3
    zlib
    curl
  ];

  cmakeFlags = [
    # Does not build with CPPCHECK
    # "-DCPR_ENABLE_CPPCHECK=ON"
    "-DCPR_BUILD_TEST=ON"
    "-DCURL_ZLIB=OFF"
    "-DCPR_USE_SYSTEM_CURL=ON"
    "-DCMAKE_BUILD_TYPE=Release"
  ];

  # Install headers
  postInstall = ''
    mkdir -p $out/include
    cp -r $src/include/* $out/include/
  '';

  meta = with lib; {
    description = "C++ Requests: Curl for People, a spiritual port of Python Requests";
    homepage = "https://github.com/libcpr/cpr";
    license = licenses.mit; # MIT License
    platforms = platforms.all;
    maintainers = with maintainers; [ /* add your name here */ ];
  };
}

Also the patch (no need to download the code as it's already in Nix and the build happens in the container without network connection):

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 3f6e1d0..b0eebc5 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -295,11 +295,11 @@ else()
     if (CMAKE_VERSION VERSION_GREATER_EQUAL "3.24.0")
         cmake_policy(SET CMP0135 NEW)
     endif()
-    FetchContent_Declare(curl
-                         URL                    https://github.com/curl/curl/releases/download/curl-8_10_1/curl-8.10.1.tar.xz
-                         URL_HASH               SHA256=73a4b0e99596a09fa5924a4fb7e4b995a85fda0d18a2c02ab9cf134bebce04ee # the file hash for curl-8.10.1.tar.xz
-                         USES_TERMINAL_DOWNLOAD TRUE)   # <---- This is needed only for Ninja to show download progress
-    FetchContent_MakeAvailable(curl)
+    #    FetchContent_Declare(curl
+    #                     URL                    https://github.com/curl/curl/releases/download/curl-8_10_1/curl-8.10.1.tar.xz
+    #                     URL_HASH               SHA256=73a4b0e99596a09fa5924a4fb7e4b995a85fda0d18a2c02ab9cf134bebce04ee # the file hash for curl-8.10.1.tar.xz
+    #                     USES_TERMINAL_DOWNLOAD TRUE)   # <---- This is needed only for Ninja to show download progress
+    #FetchContent_MakeAvailable(curl)
 
     restore_variable(DESTINATION CMAKE_CXX_CLANG_TIDY BACKUP CMAKE_CXX_CLANG_TIDY_BKP)
 endif()
@@ -310,7 +310,7 @@ if(TARGET libcurl)
     set(CURL_LIB libcurl)
 else()
     # New curl CMake target name
-    set(CURL_LIB CURL::libcurl)
+    set(CURL_LIB libcurl)
 endif()
 
 # GTest configuration

Possible Fix

No response

Where did you get it from?

Other (specify in "Additional Context/Your Environment")

Additional Context/Your Environment

• OS: NixOS 24.11
• Version: Linux vision 6.13.4

[COM8]

@phodina thanks for reporting!

On Fedora I can build cpr with OpenSSL 3.2.2 4 Jun 2024 without any issues.
Se we do not include any version of OpenSSL and only use it transitively via curl. Since you are setting CPR_USE_SYSTEM_CURL to ON, are you sure your used curl version ships with a known good openssl version?
Or is it using an other SSL backend like wolfSSL, ...?