Commit b47b4f6e4f for openssl.org

commit b47b4f6e4f60bb75e78a6054b601ec4bdb2cb463
Author: Dmitry Misharov <dmitry@openssl.org>
Date:   Tue Oct 20 13:11:08 2026 +0200

    Configure: add no-buildinfo-cflags option

    The compiler command line stored in libcrypto for OPENSSL_CFLAGS can
    contain environment-specific flags and paths, which prevents
    reproducible builds across build environments.  With no-buildinfo-cflags,
    it is not recorded and "compiler: information not available" is reported
    instead.

    Assisted-by: Claude:claude-opus-5-5
    Reviewed-by: Neil Horman <nhorman@openssl.org>
    Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
    Merge-date: Thu Oct 29 08:53:50 2026
    Merged-from: https://github.com/openssl/openssl/pull/33280

diff --git a/CHANGES.md b/CHANGES.md
index 664f4741aa..02a221ea5d 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -44,6 +44,15 @@ OpenSSL 4.2

    *Ingo Franzki*

+ * Added the `no-buildinfo-cflags` Configure option.  It stops the compiler
+   command line and flags from being recorded in `libcrypto`, which helps
+   reproducible builds across different build environments.
+   `OpenSSL_version(OPENSSL_CFLAGS)` and `openssl version -f` then report
+   `compiler: information not available`.
+   <!-- https://github.com/openssl/openssl/pull/33280 -->
+
+   *Dmitry Misharov*
+
  * Changed TLS 1.3 clients to offer a PSK, and to attempt 0-RTT early data,
    only when it can actually be used. A resumption ticket or external PSK is
    offered only if some offered ciphersuite shares its handshake digest, and
diff --git a/Configure b/Configure
index ac24e753e8..dba37111de 100755
--- a/Configure
+++ b/Configure
@@ -518,6 +518,7 @@ my @disablables_features = (
     "autoerrinit",
     "autoload-config",
     "brotli-dynamic",
+    "buildinfo-cflags",
     "buildtest-c++",
     "bulk",
     "cached-fetch",
diff --git a/INSTALL.md b/INSTALL.md
index 6dc586d4a7..8817442998 100644
--- a/INSTALL.md
+++ b/INSTALL.md
@@ -698,6 +698,16 @@ Don't automatically load the default `openssl.cnf` file.
 Typically OpenSSL will automatically load a system config file which configures
 default SSL options.

+### no-buildinfo-cflags
+
+Don't record the compiler command line and flags in libcrypto.
+
+By default they are reported by `OpenSSL_version(OPENSSL_CFLAGS)` and
+`openssl version -f`.  As they may contain environment specific paths and
+flags, they make it harder to build bit-for-bit identical binaries in
+different build environments.  With this option they are reported as
+`compiler: information not available` instead.
+
 ### enable-buildtest-c++

 While testing, generate C++ buildtest files that simply check that the public
diff --git a/crypto/build.info b/crypto/build.info
index 87b3b5ea0a..3e6cb23b3d 100644
--- a/crypto/build.info
+++ b/crypto/build.info
@@ -114,7 +114,11 @@ DEFINE[../libcrypto]=$UPLINKDEF

 DEPEND[info.o]=buildinf.h
 DEPEND[cversion.o]=buildinf.h
-GENERATE[buildinf.h]=../util/mkbuildinf.pl "$(CC) $(LIB_CFLAGS) $(CPPFLAGS_Q)" "$(PLATFORM)"
+IF[{- !$disabled{"buildinfo-cflags"} -}]
+  GENERATE[buildinf.h]=../util/mkbuildinf.pl "$(CC) $(LIB_CFLAGS) $(CPPFLAGS_Q)" "$(PLATFORM)"
+ELSE
+  GENERATE[buildinf.h]=../util/mkbuildinf.pl "$(PLATFORM)"
+ENDIF

 GENERATE[uplink-x86.S]=../ms/uplink-x86.pl
 GENERATE[uplink-x86_64.s]=../ms/uplink-x86_64.pl
diff --git a/doc/man1/openssl-version.pod b/doc/man1/openssl-version.pod
index 5c08f22f6e..28b97fac93 100644
--- a/doc/man1/openssl-version.pod
+++ b/doc/man1/openssl-version.pod
@@ -50,7 +50,8 @@ Option information: various options set when the library was built.

 =item B<-f>

-Compilation flags.
+Compilation flags, or C<information not available> when OpenSSL was
+configured with B<no-buildinfo-cflags>.

 =item B<-p>

diff --git a/doc/man3/OpenSSL_version.pod b/doc/man3/OpenSSL_version.pod
index d978eb35ee..304d395373 100644
--- a/doc/man3/OpenSSL_version.pod
+++ b/doc/man3/OpenSSL_version.pod
@@ -124,7 +124,7 @@ The value of B<OPENSSL_FULL_VERSION_STR>

 The compiler flags set for the compilation process in the form
 C<compiler: ...>  if available, or C<compiler: information not available>
-otherwise.
+otherwise, for example when OpenSSL was configured with B<no-buildinfo-cflags>.

 =item OPENSSL_BUILT_ON

diff --git a/util/mkbuildinf.pl b/util/mkbuildinf.pl
index 799ed3cdcd..bc95f0dd3b 100755
--- a/util/mkbuildinf.pl
+++ b/util/mkbuildinf.pl
@@ -12,7 +12,8 @@ use warnings;
 my $platform = pop @ARGV;
 my $cflags = join(' ', @ARGV);
 $cflags =~ s(\\)(\\\\)g;
-$cflags = "compiler: $cflags";
+# No flags are given when configured with no-buildinfo-cflags
+$cflags = "compiler: " . ($cflags eq '' ? "information not available" : $cflags);

 # Use the value of the envvar SOURCE_DATE_EPOCH, even if it's
 # zero or the empty string.