Patch to statically link OpenSSL into Python3.8

README.md

Statically Linking OpenSSL Into Python3.8

EDIT/NOTE: Please see the comment below from @oferchen, this is supported properly in the build system now

Get the patch file (python3-static-link-openssl.patch) and put it in your working directory

$ wget https://www.python.org/ftp/python/3.8.12/Python-3.8.12.tar.xz
$ tar -xvf Python-3.8.12.tar.xz && cd Python-3.8.12
$ patch -p1 < ../python3-static-link-openssl.patch
$ ./configure ... --with-openssl=/opt/openssl-1.1.1k --enable-static-openssl
$ make -j && sudo make install

Verifying Success

You can verify OpenSSL was statically linked using the following

$ strace -o LOG python3 -c 'import ssl'
$ grep libssl LOG | wc -l
0
$

python3-static-link-openssl.patch

diff -Naur Python-3.8.12/configure.ac Python-3.8.12-patched/configure.ac
--- Python-3.8.12/configure.ac	2021-08-30 10:26:41.000000000 -0400
+++ Python-3.8.12-patched/configure.ac	2022-01-15 13:14:18.813720034 -0500
@@ -3058,6 +3058,15 @@
 
 AC_MSG_RESULT($enable_loadable_sqlite_extensions)
 
+# Check for static linking of OpenSSL
+AC_MSG_CHECKING(for --enable-static-openssl)
+AC_ARG_ENABLE(static_openssl,
+              AS_HELP_STRING([--enable-static-openssl], [statically link OpenSSL libraries into Python executable]),
+              [],
+              [enable_static_openssl="no"])
+
+AC_MSG_RESULT($enable_static_openssl)
+
 # Check for --with-tcltk-includes=path and --with-tcltk-libs=path
 AC_SUBST(TCLTK_INCLUDES)
 AC_SUBST(TCLTK_LIBS)
diff -Naur Python-3.8.12/setup.py Python-3.8.12-patched/setup.py
--- Python-3.8.12/setup.py	2021-08-30 10:26:41.000000000 -0400
+++ Python-3.8.12-patched/setup.py	2022-01-15 13:15:50.805002398 -0500
@@ -2178,6 +2178,7 @@
             sep = ' ' + sep
             return [v.strip() for v in value.split(sep) if v.strip()]
 
+        openssl_static = '--enable-static-openssl' in sysconfig.get_config_var("CONFIG_ARGS")
         openssl_includes = split_var('OPENSSL_INCLUDES', '-I')
         openssl_libdirs = split_var('OPENSSL_LDFLAGS', '-L')
         openssl_libs = split_var('OPENSSL_LIBS', '-l')
@@ -2202,12 +2203,28 @@
         if krb5_h:
             ssl_incs.extend(krb5_h)
 
+        if openssl_static is True:
+            extra_link_args=[
+                os.path.join(openssl_libdirs[0], 'libssl.a'),
+                os.path.join(openssl_libdirs[0], 'libcrypto.a'),
+                '-ldl']
+            library_dirs = libraries = []
+        else:
+            if not openssl_libs:
+                # libssl and libcrypto not found
+                self.missing.extend(['_ssl', '_hashlib'])
+                return None, None
+            library_dirs = openssl_libdirs
+            libraries = openssl_libs
+            extra_link_args = []
+
         if config_vars.get("HAVE_X509_VERIFY_PARAM_SET1_HOST"):
             self.add(Extension(
                 '_ssl', ['_ssl.c'],
                 include_dirs=openssl_includes,
-                library_dirs=openssl_libdirs,
-                libraries=openssl_libs,
+                library_dirs=library_dirs,
+                libraries=libraries,
+                extra_link_args=extra_link_args,
                 depends=[
                     'socketmodule.h',
                     '_ssl/debughelpers.c',
@@ -2221,8 +2238,10 @@
         self.add(Extension('_hashlib', ['_hashopenssl.c'],
                            depends=['hashlib.h'],
                            include_dirs=openssl_includes,
-                           library_dirs=openssl_libdirs,
-                           libraries=openssl_libs))
+                           library_dirs=library_dirs,
+                           libraries=libraries,
+                           extra_link_args=extra_link_args,
+                           ))
 
     def detect_hash_builtins(self):
         # We always compile these even when OpenSSL is available (issue #14693).

with recent version of python you can set the environment variable PY_UNSUPPORTED_OPENSSL_BUILD=static

with recent version of python you can set the environment variable PY_UNSUPPORTED_OPENSSL_BUILD=static

That's very convenient, thanks!

Doing this back in the Python 2.x days for the first time (before I understood how the module config/build/linking worked) was a big barrel of fun. It's nice to see this being properly supported now