_tkinter build issue on Centos7 due changing TK/TCL detection by configure script.

[sharewax]

Bug report

I'm trying to build python 3.11rc1 and faced with issue with correct importing _tkinter module due RPM build.
Connected issues 90005 and pull request 31698.

I've installed tk-devel and tcl-devel packages on Centos7, but they are quite old (2015 year), but still usable and should be supported by python3.11. It doesn't contain needed .pc files for pkg-config, so during compilation correct flags aren't added.

During compilation and building debug environment I've got:

gcc -pthread -shared -L/opt/wargaming/wargaming-python311/root/usr/lib64-Wl,-z,relro -Wl,-rpath,/opt/wargaming/wargaming-python311/root/usr/lib64 -
Wl,--enable-new-dtags -g -L/usr/lib64/openssl11 -L/usr/lib64 -L/opt/wargaming/wargaming-python311/root/usr/lib64-Wl,-z,relro -Wl,-rpath,/opt/wargam
ing/wargaming-python311/root/usr/lib64 -Wl,--enable-new-dtags -g -L/usr/lib64/openssl11 -L/usr/lib64 -L/opt/wargaming/wargaming-python311/root/usr/
lib64-Wl,-z,relro -Wl,-rpath,/opt/wargaming/wargaming-python311/root/usr/lib64 -Wl,--enable-new-dtags -g -L/usr/lib64/openssl11 -L/usr/lib64 -flto
-fuse-linker-plugin -ffat-lto-objects -flto-partition=none -g -L/opt/wargaming/wargaming-python311/root/usr/lib64-Wl,-z,relro -Wl,-rpath,/opt/warga
ming/wargaming-python311/root/usr/lib64 -Wl,--enable-new-dtags -g -L/usr/lib64/openssl11 -L/usr/lib64 -L/opt/wargaming/wargaming-python311/root/usr
/lib64-Wl,-z,relro -Wl,-rpath,/opt/wargaming/wargaming-python311/root/usr/lib64 -Wl,--enable-new-dtags -g -L/usr/lib64/openssl11 -L/usr/lib64 -I/op
t/wargaming/wargaming-python311/root/usr/include -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffe
r-size=4 -grecord-gcc-switches -m64 -mtune=generic -D_GNU_SOURCE -fPIC -fwrapv -I/usr/include/openssl11 -I/usr/include build/temp.linux-x86_64-3.11
-pydebug/builddir/build/BUILD/Python-3.11.0rc1/Modules/_ctypes/_ctypes.o build/temp.linux-x86_64-3.11-pydebug/builddir/build/BUILD/Python-3.11.0rc1
/Modules/_ctypes/callbacks.o build/temp.linux-x86_64-3.11-pydebug/builddir/build/BUILD/Python-3.11.0rc1/Modules/_ctypes/callproc.o build/temp.linux
-x86_64-3.11-pydebug/builddir/build/BUILD/Python-3.11.0rc1/Modules/_ctypes/cfield.o build/temp.linux-x86_64-3.11-pydebug/builddir/build/BUILD/Pytho
n-3.11.0rc1/Modules/_ctypes/stgdict.o -L. -L/opt/wargaming/wargaming-python311/root/usr/lib64 -L/usr/lib64/openssl11 -L/usr/lib64 -L/usr/local/lib
-lffi -ldl -o build/lib.linux-x86_64-3.11-pydebug/_ctypes.cpython-311d-x86_64-linux-gnu.so
*** WARNING: renaming "_tkinter" since importing it failed: /builddir/build/BUILD/Python-3.11.0rc1/build/debug/build/lib.linux-x86_64-3.11-pydebug/
_tkinter.cpython-311d-x86_64-linux-gnu.so: undefined symbol: Tcl_AddErrorInfo
Following modules built successfully but were removed because they could not be imported:
_tkinter

It seems that I need correct TCLTK_CFLAGS and TCLTK_LIBS, but it's quite problematic to find it manually and it's better than on Centos7 it will be detected automatically.

Adding in SPEC file the next string:
export TCLTK_LIBS="-ltk8.5 -ltcl8.5"
solves the issue.

Your environment

docker with mock inside, devtoolset-9 is present, openssl11.

• CPython versions tested on: 3.11rc1
• Operating system and architecture: Centos7, x86_64

[tiran]

We are not going to add detection for TCL/TK to configure for several reasons:

1. It is complicated and super annoying to detect it correctly. We decided that it is both easier and more reliable to use pkg-config for the job.
2. Python 3.11 is in release candidate phase. It's too late and too risky to add complex detection logic to configure. At this point we only accept changes to documentation or fixes for critical release blockers.

I have created a PR with additional documentation and some pkg-config overrides. Some people may find it useful to build Python with RHEL 7 / CentOS 7's OpenSSL 1.1 package instead of building their own OpenSSL, too.

[sharewax]

openssl11-devel is provided pkg-config part. I have in spec the next thing:

%if 0%{?rhel} == 7
export TCLTK_LIBS="-ltk8.5 -ltkstub8.5 -ltcl8.5"
export CFLAGS="$CFLAGS $(pkg-config --cflags openssl11)"
%else
export CFLAGS="$CFLAGS $(pkg-config --cflags openssl)"
%endif

# Passing to the dynamic linker parameters -rpath and --enable-new-dtags causes
# ld to set RUNPATH instead of RPATH in the executables and libraries
# Setting RUNPATH resolves rhbz#1479406
%if 0%{?rhel} == 7
export LDFLAGS="-L%{_libdir}$RPM_LD_FLAGS -Wl,-rpath,%{_libdir} -Wl,--enable-new-dtags -g $(pkg-config --libs-only-L openssl11)"
export LDFLAGS_NODIST="-L%{_libdir}$RPM_LD_FLAGS -Wl,-rpath,%{_libdir} -Wl,--enable-new-dtags -g $(pkg-config --libs-only-L openssl11)"
%else
export LDFLAGS="-L%{_libdir}$RPM_LD_FLAGS -Wl,-rpath,%{_libdir} -Wl,--enable-new-dtags -g $(pkg-config --libs-only-L openssl)"
export LDFLAGS_NODIST="-L%{_libdir}$RPM_LD_FLAGS -Wl,-rpath,%{_libdir} -Wl,--enable-new-dtags -g $(pkg-config --libs-only-L openssl)"
%endif

But anyway in require patch for aclocal.m4: 00501-openssl11-configure.patch

diff -Nura Python-3.10.0-orig/aclocal.m4 Python-3.10.0/aclocal.m4
--- Python-3.10.0-orig/aclocal.m4	2021-10-04 17:40:46.000000000 +0000
+++ Python-3.10.0/aclocal.m4	2021-10-21 20:04:16.251057659 +0000
@@ -205,10 +205,10 @@
             # then use that information and don't search ssldirs
             AC_CHECK_TOOL([PKG_CONFIG], [pkg-config])
             if test x"$PKG_CONFIG" != x""; then
-                OPENSSL_LDFLAGS=`$PKG_CONFIG openssl --libs-only-L 2>/dev/null`
+                OPENSSL_LDFLAGS=`$PKG_CONFIG openssl11 --libs-only-L 2>/dev/null`
                 if test $? = 0; then
-                    OPENSSL_LIBS=`$PKG_CONFIG openssl --libs-only-l 2>/dev/null`
-                    OPENSSL_INCLUDES=`$PKG_CONFIG openssl --cflags-only-I 2>/dev/null`
+                    OPENSSL_LIBS=`$PKG_CONFIG openssl11 --libs-only-l 2>/dev/null`
+                    OPENSSL_INCLUDES=`$PKG_CONFIG openssl11 --cflags-only-I 2>/dev/null`
                     found=true
                 fi
             fi

(part of spec file)

%if 0%{?rhel} == 7
%patch501 -p1
%endif

I've repo with SCL for python3.10 and I suppose that I'll provide for 3.11 too, when it's going to release.

[tiran]

The openssl.pc file is for upstream users that don't want to patch CPython or don't know how to patch it. Downstream packagers can solve the problem in a different way.

By the way, you should neither set CFLAGS nor patch aclocal.m4. The file is auto-generated. sed -i 's/PKG_CONFIG openssl /PKG_CONFIG openssl11 /g' configure is enough to build Python with RHEL 7's openssl11 package.

[sharewax]

Yes, but in SPEC files I often see (like here for example)

  # Remove files that should be generated by the build
  # (This is after patching, so that we can use patches directly from upstream)
  rm configure pyconfig.h.in
...
 # Regenerate the configure script and pyconfig.h.in
  autoconf
  autoheader

thank you, updated, removed a lot of FLAGS, one patch and etc in SPEC file:

# Regenerate the configure script and pyconfig.h.in
autoconf
autoheader

# Replace openssl to openssl11 if RHEL7:
%if 0%{?rhel} == 7
sed -i 's/PKG_CONFIG openssl /PKG_CONFIG openssl11 /g' configure
%endif