fix: we have to build our own openssl to use standard paths

flake.nix

@@ -37,6 +37,7 @@
           kernel = pkgs.callPackage ./pkgs/kernel { };
           glibc = pkgs.callPackage ./pkgs/glibc { };
           busybox = pkgs.callPackage ./pkgs/busybox { };
+          openssl = pkgs.callPackage ./pkgs/openssl { };
           kexec = pkgs.callPackage ./pkgs/kexec-tools { };
           lvm2 = pkgs.callPackage ./pkgs/lvm2 { };
           tpm2-tools = pkgs.callPackage ./pkgs/tpm2-tools { inherit patosPkgs; };

lib/make-sysext.nix

@@ -63,7 +63,7 @@ runCommand name
       cp -Pv "$srcfile" "$destfile"
 
       chmod 755 "$destfile"
-      patchelf --set-rpath /lib:/usr/lib:/ $destfile
+      patchelf --set-rpath /usr/lib $destfile
       patchelf --set-interpreter /lib/ld-linux-x86-64.so.2 $destfile || true
     }
 

pkgs/openssl/default.nix

@@ -0,0 +1,166 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  perl,
+  makeBinaryWrapper,
+  withCryptodev ? false,
+  cryptodev,
+  withZlib ? false,
+  zlib,
+  enableSSL2 ? false,
+  enableSSL3 ? false,
+  enableMD2 ? false,
+  enableKTLS ? stdenv.hostPlatform.isLinux,
+  static ? stdenv.hostPlatform.isStatic,
+  removeReferencesTo,
+}:
+
+stdenv.mkDerivation rec {
+    pname = "openssl";
+    version = "3.4.1";
+    hash = "sha256-ACotazC1i/S+pGxDvdljZar42qbEKHgqpP7uBtoZffM=";
+
+    src = fetchurl {
+      url = "https://github.com/openssl/openssl/releases/download/openssl-${version}/openssl-${version}.tar.gz";
+      hash = hash;
+    };
+
+    outputs = [ "out" ];
+
+    nativeBuildInputs =
+      lib.optional (!stdenv.hostPlatform.isWindows) makeBinaryWrapper
+      ++ [ perl ]
+      ++ lib.optionals static [ removeReferencesTo ];
+    buildInputs = lib.optional withCryptodev cryptodev ++ lib.optional withZlib zlib;
+
+    # TODO(@Ericson2314): Improve with mass rebuild
+    configurePlatforms = [ ];
+    configureScript =
+      {
+        armv5tel-linux = "./Configure linux-armv4 -march=armv5te";
+        armv6l-linux = "./Configure linux-armv4 -march=armv6";
+        armv7l-linux = "./Configure linux-armv4 -march=armv7-a";
+        x86_64-darwin = "./Configure darwin64-x86_64-cc";
+        aarch64-darwin = "./Configure darwin64-arm64-cc";
+        x86_64-linux = "./Configure linux-x86_64";
+        x86_64-solaris = "./Configure solaris64-x86_64-gcc";
+        powerpc64-linux = "./Configure linux-ppc64";
+        riscv32-linux = "./Configure ${
+          if lib.versionAtLeast version "3.2" then "linux32-riscv32" else "linux-latomic"
+        }";
+        riscv64-linux = "./Configure linux64-riscv64";
+      }
+      .${stdenv.hostPlatform.system} or (
+        if stdenv.hostPlatform == stdenv.buildPlatform then
+          "./config"
+        else if stdenv.hostPlatform.isBSD then
+          if stdenv.hostPlatform.isx86_64 then
+            "./Configure BSD-x86_64"
+          else if stdenv.hostPlatform.isx86_32 then
+            "./Configure BSD-x86" + lib.optionalString stdenv.hostPlatform.isElf "-elf"
+          else
+            "./Configure BSD-generic${toString stdenv.hostPlatform.parsed.cpu.bits}"
+        else if stdenv.hostPlatform.isMinGW then
+          "./Configure mingw${
+            lib.optionalString (stdenv.hostPlatform.parsed.cpu.bits != 32) (
+              toString stdenv.hostPlatform.parsed.cpu.bits
+            )
+          }"
+        else if stdenv.hostPlatform.isLinux then
+          if stdenv.hostPlatform.isx86_64 then
+            "./Configure linux-x86_64"
+          else if stdenv.hostPlatform.isMicroBlaze then
+            "./Configure linux-latomic"
+          else if stdenv.hostPlatform.isMips32 then
+            "./Configure linux-mips32"
+          else if stdenv.hostPlatform.isMips64n32 then
+            "./Configure linux-mips64"
+          else if stdenv.hostPlatform.isMips64n64 then
+            "./Configure linux64-mips64"
+          else
+            "./Configure linux-generic${toString stdenv.hostPlatform.parsed.cpu.bits}"
+        else if stdenv.hostPlatform.isiOS then
+          "./Configure ios${toString stdenv.hostPlatform.parsed.cpu.bits}-cross"
+        else
+          throw "Not sure what configuration to use for ${stdenv.hostPlatform.config}"
+      );
+
+    # OpenSSL doesn't like the `--enable-static` / `--disable-shared` flags.
+    dontAddStaticConfigureFlags = true;
+
+    configureFlags =
+      [
+        "shared" # "shared" builds both shared and static libraries
+        "--prefix=/usr"
+        "--libdir=lib"
+        "--openssldir=/etc/ssl"
+      ]
+      ++ lib.optionals withCryptodev [
+        "-DHAVE_CRYPTODEV"
+        "-DUSE_CRYPTODEV_DIGESTS"
+      ]
+      ++ lib.optional enableMD2 "enable-md2"
+      ++ lib.optional enableSSL2 "enable-ssl2"
+      ++ lib.optional enableSSL3 "enable-ssl3"
+      # We select KTLS here instead of the configure-time detection (which we patch out).
+      # KTLS should work on FreeBSD 13+ as well, so we could enable it if someone tests it.
+      ++ lib.optional (lib.versionAtLeast version "3.0.0" && enableKTLS) "enable-ktls"
+      ++ lib.optional (lib.versionAtLeast version "1.1.1" && stdenv.hostPlatform.isAarch64) "no-afalgeng"
+      # OpenSSL needs a specific `no-shared` configure flag.
+      # See https://wiki.openssl.org/index.php/Compilation_and_Installation#Configure_Options
+      # for a comprehensive list of configuration options.
+      ++ lib.optional (lib.versionAtLeast version "1.1.1" && static) "no-shared"
+      ++ lib.optional (lib.versionAtLeast version "3.0.0" && static) "no-module"
+      # This introduces a reference to the CTLOG_FILE which is undesired when
+      # trying to build binaries statically.
+      ++ lib.optional static "no-ct"
+      ++ lib.optional withZlib "zlib"
+      # /dev/crypto support has been dropped in OpenBSD 5.7.
+      #
+      # OpenBSD's ports does this too,
+      # https://github.com/openbsd/ports/blob/a1147500c76970fea22947648fb92a093a529d7c/security/openssl/3.3/Makefile#L25.
+      #
+      # https://github.com/openssl/openssl/pull/10565 indicated the
+      # intent was that this would be configured properly automatically,
+      # but that doesn't appear to be the case.
+      ++ lib.optional stdenv.hostPlatform.isOpenBSD "no-devcryptoeng"
+      ++ lib.optionals (stdenv.hostPlatform.isMips && stdenv.hostPlatform ? gcc.arch) [
+        # This is necessary in order to avoid openssl adding -march
+        # flags which ultimately conflict with those added by
+        # cc-wrapper.  Openssl assumes that it can scan CFLAGS to
+        # detect any -march flags, using this perl code:
+        #
+        #   && !grep { $_ =~ /-m(ips|arch=)/ } (@{$config{CFLAGS}})
+        #
+        # The following bogus CFLAGS environment variable triggers the
+        # the code above, inhibiting `./Configure` from adding the
+        # conflicting flags.
+        "CFLAGS=-march=${stdenv.hostPlatform.gcc.arch}"
+      ];
+
+    postPatch = ''
+      patchShebangs Configure
+    '';
+
+    installPhase = ''
+      make DESTDIR=$out install
+    '';
+
+    enableParallelBuilding = true;
+
+    meta = {
+      homepage = "https://www.openssl.org/";
+      changelog = "https://github.com/openssl/openssl/blob/openssl-${version}/CHANGES.md";
+      description = "Cryptographic library that implements the SSL and TLS protocols";
+      license = lib.licenses.openssl;
+      mainProgram = "openssl";
+      maintainers = with lib.maintainers; [ thillux ] ++ lib.teams.stridtech.members;
+      pkgConfigModules = [
+        "libcrypto"
+        "libssl"
+        "openssl"
+      ];
+      platforms = lib.platforms.all;
+    };
+}

pkgs/rootfs/default.nix

@@ -30,6 +30,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   tpm2Libs = patosPkgs.tpm2-tss.out;
   kexec = patosPkgs.kexec.out;
   lvm2 = patosPkgs.lvm2.out;
+  openssl = patosPkgs.openssl.out;
 
   builder = ./mkrootfs.sh;
 })

pkgs/rootfs/mkrootfs.sh

@@ -115,6 +115,10 @@ EOF
 ### install PatOS glibc
 cp -P $glibcPatos/lib/*.so* $out/usr/lib/
 
+### install openssl
+cp -P $openssl/usr/lib/*.so* $out/usr/lib/
+cp -Pr $openssl/etc/ssl $out/etc/
+
 ### install kernel modules
 cp -r $kernel/lib/modules $out/usr/lib/
 find $out/usr/lib/modules -type d -exec chmod 755 {} \;
@@ -149,7 +153,8 @@ cp -P $kmodBin/bin/* $out/usr/bin
 cp -P $libbpf/lib/libbpf* $out/usr/lib
 
 ### install ca cert bundle
-cp -Pr $cacert/etc/ssl $out/etc/
+chmod 755 $out/etc/ssl
+cp -P $cacert/etc/ssl/certs/ca-bundle.crt $out/etc/ssl/cert.pem
 
 # setup default files
 $systemd/usr/bin/systemd-hwdb --root=$out --usr update
@@ -166,7 +171,7 @@ rm -rf $out/usr/lib/pkgconfig
 
 ### Find and install all shared libs
 find $out -type f -executable -exec ldd {} \; | awk '{print $3}' | \
-  grep -v systemd | grep -v glibc | grep -v tpm2 | grep -v devmapper | \
+  grep -v systemd | grep -v glibc | grep -v openssl | grep -v tpm2 | grep -v devmapper | grep -v not | \
   sort -u | xargs -I {} cp {} $out/usr/lib/
 
 find $out -type f -executable -exec chmod 755 {} \;