OpenSSL is not available, but required for build determinism

Error message

OpenSSL is not available, but required for build determinism

What it means

On non-Windows, non-Apple platforms, ilasm's deterministic-build mode (`/DETERMINISTIC` or `m_fDeterministic`) requires a stable hash for metadata; the implementation delegates to OpenSSL via IsOpenSslAvailable() (sha256.h). If the runtime cannot load the OpenSSL crypto library at startup, Assembler::Init (assem.cpp:253) refuses to proceed and returns FALSE, because deterministic output cannot be guaranteed without it.

Source

Thrown at src/coreclr/ilasm/assem.cpp:255

    if (m_pCeeFileGen != NULL) {
        if (m_pCeeFile)
            m_pCeeFileGen->DestroyCeeFile(&m_pCeeFile);

        DestroyICeeFileGen(&m_pCeeFileGen);

        m_pCeeFileGen = NULL;
    }

    if (FAILED(CreateICeeFileGen(&m_pCeeFileGen))) return FALSE;
    if (FAILED(m_pCeeFileGen->CreateCeeFileEx(&m_pCeeFile,(ULONG)m_dwCeeFileFlags))) return FALSE;
    if (FAILED(m_pCeeFileGen->GetSectionCreate(m_pCeeFile, ".il", sdReadOnly, &m_pILSection))) return FALSE;
    if (FAILED(m_pCeeFileGen->GetSectionCreate (m_pCeeFile, ".sdata", sdReadWrite, &m_pGlobalDataSection))) return FALSE;
    if (FAILED(m_pCeeFileGen->GetSectionCreate (m_pCeeFile, ".tls", sdReadWrite, &m_pTLSSection))) return FALSE;

#if !defined(_WIN32) && !defined(__APPLE__)
    if (m_fDeterministic && !IsOpenSslAvailable())
    {
        fprintf(stderr, "OpenSSL is not available, but required for build determinism\n");
        return FALSE;
    }
#endif

    m_fGeneratePDB = generatePdb;

    return TRUE;
}

void Assembler::SetDLL(BOOL IsDll)
{
    HRESULT OK;
    OK = m_pCeeFileGen->SetDllSwitch(m_pCeeFile, IsDll);
    _ASSERTE(SUCCEEDED(OK));

    m_fDLL = IsDll;
}

View on GitHub (pinned to 290d5ab72c)

Solutions

Install the OpenSSL runtime libraries for your distro (e.g. `apt-get install libssl1.1` or `apk add openssl`).
Ensure libssl/libcrypto are on LD_LIBRARY_PATH or in the default loader path.
Drop the `/DETERMINISTIC` flag if deterministic builds are not required.
Rebuild ilasm against the OpenSSL version present on the host.

Example fix

// before
ilasm /DETERMINISTIC /out:foo.dll foo.il   # fails, no libssl
// after
apt-get install -y libssl1.1 && ilasm /DETERMINISTIC /out:foo.dll foo.il

Defensive patterns

Strategy: validation

Validate before calling

# Before running deterministic ilasm on Linux, confirm OpenSSL loads.
ldconfig -p | grep -q libcrypto.so && ldconfig -p | grep -q libssl.so \
  || { echo 'OpenSSL missing; install or drop /DETERMINISTIC'; exit 1; }
# Or test-load: ldd $(command -v ilasm) | grep -E 'libssl|libcrypto'

Prevention

Base CI images on a distro that ships the expected OpenSSL (e.g. debian-slim, not alpine without openssl).
Pin ilasm and the OpenSSL soname together in Dockerfiles.
Document the OpenSSL requirement wherever /DETERMINISTIC is used.

When it happens

Trigger: Running ilasm with deterministic mode enabled on Linux where libssl/libcrypto is missing, is the wrong version, or is not on the loader search path.

Common situations: Minimal container images (e.g. alpine) without the openssl package; a distro upgrade that removed or relocated libssl; running a bundled ilasm that was built expecting a specific OpenSSL soname.

Related errors

AI-assisted analysis of dotnet/runtime@290d5ab72c (2026-08-06). Data as JSON: /api/errors/e0f61dfb36cf2e04. Report an issue: GitHub.