From 8019260926dcebe4f4be99cb5f92f84fbc9cd6d3 Mon Sep 17 00:00:00 2001 From: eunhhu Date: Sun, 27 Sep 2026 19:03:34 +0100 Subject: Map OpenSSL only in a server that uses it Linking OpenSSL cost every pure-serve 2.3 MiB of resident memory, 0.66 MiB of it the process's own (relocated data), though most servers never reach an https receiver or seal a send. The code that uses OpenSSL (TLS to https receivers, sealing) is now built as pure-crypto.so beside pure-serve and exports one table; pure-serve maps it the first time a wire to an https URL opens or a key is read or a seal wired (serve/crypto.c), and a missing library is reported at startup. What needs no OpenSSL, a key's hex and the suite this CPU seals with, stays in pure-serve. An idle server: RSS 4,496 -> 2,320 kB, PSS 1,639 -> 881 kB, private dirty 1,296 -> 864 kB. A static OpenSSL was measured too and is worse (RSS 3.8 MiB, but 2.3 MiB private: all of its tables relocated). The checks, https webhooks and sealed sends included, pass unchanged. --- Makefile | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) (limited to 'Makefile') diff --git a/Makefile b/Makefile index 11d14d7..ee82d93 100644 --- a/Makefile +++ b/Makefile @@ -10,7 +10,9 @@ BUILD ?= build # states as drafts; state.h and store.h are what it asks of storage. # store/ the tree store (one file; commits are one contiguous write and one # sync; formats PURETRE3 and PUREREC1). -# serve/ pure-serve: the HTTP host, outbound delivery, JSON in place. +# serve/ pure-serve: the HTTP host, outbound delivery, JSON in place; with +# pure-crypto.so beside it, OpenSSL's part (TLS to https receivers, +# sealed sends), mapped only by a server that uses one. # cli/ command-line hosts. # libpure.a is the app model with the tree store: what a host embeds (Vega's # surfaces link it). prototypes/ keeps the earlier document runtime (000-077). @@ -19,12 +21,12 @@ BUILD ?= build INCLUDES = -Icore MODEL = core/module.c core/module-list.c core/module-save.c core/module-text.c core/module-store.c core/flow.c STORE = store/store-tree.c -SERVE = serve/serve.c serve/deliver.c serve/message-json.c serve/seal.c +SERVE = serve/serve.c serve/deliver.c serve/message-json.c serve/crypto.c HEADERS = $(wildcard core/*.h) $(wildcard serve/*.h) OBJECTS = $(patsubst %.c,$(BUILD)/obj/%.o,$(MODEL) $(STORE)) .PHONY: all check -all: $(BUILD)/libpure.a $(BUILD)/pure-serve $(BUILD)/pure-run $(BUILD)/pure-edit-module +all: $(BUILD)/libpure.a $(BUILD)/pure-serve $(BUILD)/pure-crypto.so $(BUILD)/pure-run $(BUILD)/pure-edit-module $(BUILD)/obj/%.o: %.c $(HEADERS) @mkdir -p $(dir $@) @@ -38,7 +40,11 @@ $(BUILD)/libpure.a: $(OBJECTS) # It links after the library, last as it always was, so code keeps its place. $(BUILD)/pure-serve: $(SERVE) core/runtime.c $(BUILD)/libpure.a $(HEADERS) $(CC) $(CPPFLAGS) $(CFLAGS) $(INCLUDES) -Iserve -DPURE_ASYNC_EFFECTS $(SERVE) $(BUILD)/libpure.a core/runtime.c \ - $(LDFLAGS) -lssl -lcrypto -lm -pthread $(LDLIBS) -o $@ + $(LDFLAGS) -lm -pthread $(LDLIBS) -o $@ + +$(BUILD)/pure-crypto.so: serve/crypto-openssl.c $(HEADERS) + $(CC) $(CPPFLAGS) $(CFLAGS) $(INCLUDES) -Iserve -fPIC -shared serve/crypto-openssl.c $(LDFLAGS) -lssl -lcrypto \ + $(LDLIBS) -o $@ $(BUILD)/pure-run: cli/pure-run.c $(BUILD)/libpure.a $(HEADERS) $(CC) $(CPPFLAGS) $(CFLAGS) $(INCLUDES) cli/pure-run.c $(BUILD)/libpure.a $(LDFLAGS) -lm $(LDLIBS) -o $@ -- cgit v1.2.3