Attention! dev-libs/openssl-1.0.2g breaks ABI!

Polynomial-C · Unstuck 2018-09-25, --kallamej

Hi dear Gentoo people,

today I bumped openssl-1.0.2g into portage without noticing that they changed their ABI in a release that was announced as security update.

This bump breaks nearly all consumers of the libssl.so library (see bug 576128).

In case you still haven't updated to openssl-1.0.2g yet, simply prepare wget to not break:

krinn · Watchman Joined: 02 May 2003 Posts: 7470

Polynomial-C,
- wouldn't it be just easier to package current wget in order to restore it easy? <quickpkg wget>
- and the whole process could be made without need to rebuild wget twice: <emerge --update --newuse --deep --with-bdeps=y --fetchonly @world> will download everything, next to that, you don't need wget if packages sources are already present when updating for real.

Ant P. · Watchman Joined: 18 Apr 2009 Posts: 6920

Might be a good idea to add "net-misc/curl CURL_SSL: -* gnutls" to a package.use file too, otherwise it uses openssl by default.

I have a policy of disabling/replacing openssl where possible already. Unfortunately there's still a huge amount of packages that won't work at all without this radioactive waste present...

Dr.Willy · Guru Joined: 15 Jul 2007 Posts: 547 Location: NRW, Germany

What makes you think that gnutls is better in any way, shape or form?

tnt · Veteran Joined: 27 Feb 2004 Posts: 1222

worked for me.
thx!
_________________
gentoo user

Ant P. · Watchman Joined: 18 Apr 2009 Posts: 6920

tnt · Veteran Joined: 27 Feb 2004 Posts: 1222

antonlacon · Apprentice Joined: 27 Jun 2004 Posts: 257

Revdep-rebuild step for undefined symbols is using unstable gentoolkit?

depontius · Advocate Joined: 05 May 2004 Posts: 3509

Ant P. · Watchman Joined: 18 Apr 2009 Posts: 6920

Note that I very deliberately didn't say anything about gnutls up there other than mentioning it's an option. Both libs suck (unavoidably, because they're implementations of the horrifically brain-damaged X509/SSL/TLS/CA stack), but you can't deny that OpenSSL in particular is most infamous for its black-hole-like properties.

Tony0945 · Posted: Fri Mar 04, 2016 1:57 pm Post subject:

Many thanks! I took the easier step of adding >=dev-libs/openssl-1.0.2g to /usr/portage/package.mask/badapps

limn · l33t Joined: 13 May 2005 Posts: 997

Thank you ccache.

Steffen · Apprentice Joined: 14 Jul 2002 Posts: 159

On my stable amd64 system, I've unmasked openssl-1.0.2g-r2 which seems to be OpenSSL 1.0.2g with re-enabled SSLv2 and thus avoids the ABI break. However, you then have to carefully disable SSLv2 (and while you're at it: SSLv3) in all daemons.

Until the Gentoo developers decide how to handle this situation, I think this is better than continuing to use OpenSSL 1.0.2f.

Dr.Willy · Guru Joined: 15 Jul 2007 Posts: 547 Location: NRW, Germany

Ant P. · Watchman Joined: 18 Apr 2009 Posts: 6920

If it was a practical choice, I'd rather USE="-ssl"... failing that, I'm waiting for the day I can start using libressl.

And until then, I'll just settle for avoiding the lib where the hardest part of finding an exploit seems to be coming up with a catchy logo and domain name for it.

khayyam · Posted: Sat Mar 05, 2016 8:24 pm Post subject:

lutel · Posted: Thu Nov 09, 2017 10:21 pm Post subject:

This thread is more than year old, dev-libs/openssl-1.0.2m is stable in tree, we should rather move to openssl 1.1.0.

Hu · Moderator Joined: 06 Mar 2007 Posts: 21602

This thread was more than a year old, so why wake it up to make a comment that is not relevant to the original thread? Also, note that openssl-1.1.x is currently both unstable and hard-masked, both for good reason, so many people are not even offered that update.