Re: Can't build TclTLS 2.0b1

On 09/07/2025 08:55, Ralf Fassel wrote:

* Brian <brian199@comcast.net>
| The last option is just delete that old version of OpenSSL.
 Which seems a reasonable solution anyway IMHO :-)
 R'

Isn't this fun?!
In a private email (apologies for the slight breach of protocol), Ralf pointed out that specifying CFLAGS was only appropriate if the makefile honours it; experience suggests that it doesn't and a check through the makefile doesn't present any obvious way to supply extra flags. Ralf also recommended defining C_INCLUDE_PATH, a gcc-specific environment variable, to be /usr/include, which does get original problem.
But...
$ (cd Downloads/tcltls-2.0b1/; C_INCLUDE_PATH=/usr/include make)
.
.
.
gcc -DPACKAGE_NAME=\"tls\" -DPACKAGE_TARNAME=\"tls\" -DPACKAGE_VERSION=\"2.0b1\" -DPACKAGE_STRING=\"tls\ 2.0b1\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE_URL=\"\" -DBUILD_tls=/\*\*/ -DHAVE_STDIO_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_STRINGS_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_UNISTD_H=1 -DSTDC_HEADERS=1 -DUSE_THREAD_ALLOC=1 -D_REENTRANT=1 -D_THREAD_SAFE=1 -DTCL_THREADS=1 -DUSE_TCL_STUBS=1 -DUSE_TCLOO_STUBS=1 -DMODULE_SCOPE=extern\ __attribute__\(\(__visibility__\(\"hidden\"\)\)\) -DHAVE_HIDDEN=1 -DHAVE_CAST_TO_UNION=1 -DHAVE_STDBOOL_H=1 -DTCL_WIDE_INT_IS_LONG=1 -DTCL_CFG_OPTIMIZED=1 -DUSE_TCL_STUBS=1 -DNO_SSL3=1 -D_FORTIFY_SOURCE=2 -fstack-protector-all -fno-strict-overflow -I/usr/include -Wno-deprecated-declarations -I/usr/include -I"/home/alan/Downloads/tcl9.0.2/generic"  -I.    -O2 -fomit-frame-pointer -DNDEBUG -Wall -fPIC -pipe -m64 -O2 -fomit-frame-pointer -DNDEBUG -Wall -fPIC  -c `echo ./generic/tls.c` -o tls.o
In file included from /usr/include/openssl/ssl.h:21,
                  from ./generic/tlsInt.h:31,
                  from ./generic/tls.c:26:
/usr/include/openssl/macros.h:155:4: error: #error "OPENSSL_API_COMPAT expresses an impossible API compatibility level"
   155 | #  error "OPENSSL_API_COMPAT expresses an impossible API compatibility level"
       |    ^~~~~
Good news - no trace of /usr/local/include
Bad news is obvious.
I've had a poke around /usr/include/openssl/macros.h, but I regret I can't properly make out how it encodes OPENSSL_API_COMPAT and friends, and since I'm not sure level of compatability is required, I'm unwilling to try specifying it. The following comment occurs at line 84 of macros.h
  * Applications should use -DOPENSSL_API_COMPAT=<version> to suppress the
  * declarations of functions deprecated in or before <version>.  If this is
  * undefined, the value of the macro OPENSSL_CONFIGURED_API (defined in
  * <openssl/opensslconf.h>) is the default.
OPENSSL_CONFIGURED_API is defined to be 30000 (in /usr/include/x86_64-linix-gnu/openssl/configuration.h).
There are three places where macros.h might produce this error message - the first (at line 139) occurs if OPENSSL_API_LEVEL > OPENSSL_VERSION_MAJOR * 10000 + OPENSSL_MINOR_VERSION * 100. Now, according to /usr/include.openssl/opensslv.h, the major and minor versions are 3 and 0 respectively. The error doesn't trigger, which is what I'd expect.
The next (at line 151) occurs if OPENSSL_API_LEVEL < 30000 && OPENSSL_API_LEVEL >= 20000. This doesn't trigger either.
The error (at line 155) that does trigger indicates that OPENSSL_API_LEVEL < 908 which I don't understand, since it seems to me after reading macros.h several times in different directions that since OPENSSL_API_COMPAT isn't defined, OPENSSL_API_LEVEL should be set to OPENSSL_CONFIGURED_API, i.e. 30000.
I am loth to follow the otherwise very reasonable suggestion that I just remove the old openssl installation, since I'm not sure how it got there or what relies upon it. Granted, I could simply rename, the offending directories to, say old_openssl, but I fear that if I did that, then by the time whatever it is blows up, I will have forgotten about the renaming exercise.