'openssl/engine.h' not found on RHEL10

[tmds]

Our CI is failing when compiling runtime on RHEL 10 with:

 In file included from /home/tester/runtime/src/native/libs/System.Security.Cryptography.Native/apibridge.c:4:
  /home/tester/runtime/src/native/libs/System.Security.Cryptography.Native/opensslshim.h:20:10: fatal error: 'openssl/engine.h' file not found
     20 | #include <openssl/engine.h>
        |          ^~~~~~~~~~~~~~~~~~

Probably this is related to disabling OpenSSL engine support: https://discussion.fedoraproject.org/t/f41-change-proposal-disable-openssl-engine-support-system-wide/107511.

cc @bartonjs @vcsjones @omajid

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

[vcsjones]

I can take a look at what it would take to get back to a building state with engines disabled, and handling situations where we use engine APIs.

[vcsjones]

Pull request #104810 addressed this for .NET 9. If the engine.h header is not present and .NET is not being built portably, ENGINE functionality is disabled.

For previous versions of .NET (6 and 8), would it be reasonable to take a build dependency on openssl-devel-engine package so that the builds continue to work as they always have? I don't believe there are any plans to backport this change to previous versions of .NET.

[omajid]

For previous versions of .NET (6 and 8), would it be reasonable to take a build dependency on openssl-devel-engine package so that the builds continue to work as they always have?

I think we can ignore .NET 6 here. It goes EOL in ~4 months.

As far as I can tell via the CentOS Stream 10 container (quay.io/centos/centos:stream10-development ), the openssl-devel-engine package only exists in Fedora, not in CentOS Stream 10/RHEL 10. So we can't take a dependency on it for our non-portable builds.

I suppose I can just carry a local backport patch for .NET 8 for now?

[vcsjones]

Is the lack of openssl-devel-engine package just a flow issue and it will be eventually available for those distributions, or is there no plan to create a similar compatibility package for CentOS / RHEL?

[omajid]

The current plan is to never add openssl-devel-engine to RHEL 10/CentOS Stream 10. Providing engine support has issues. This issue (which should be public) describes it as:

Engines are not FIPS compatible and corresponding API is deprecated since OpenSSL 3.0. The engine functionality we are aware of (PKCS#11, TPM) is either covered by providers maintained by Crypto Team now or will be covered soon.

We kindly ask you to implement patches or apply compiling options to eliminate the code relying on ENGINE API. Even if we don’t eliminate the ENGINE API completely for backward binary compatibility, the compilation of applications using the ENGINE API will soon become impossible

This issue was opened a few months ago, so the "soon" has become more of a "now" at this point in time.