Date: Wed, 25 Oct 2023 09:22:11 +0200 From: "Dutch Daemon - FreeBSD Forums Administrator" <dutchdaemon@freebsd.org> To: <freebsd-ports@freebsd.org> Subject: Re: FreeBSD 13 + CertBot + OpenSSL 3 - status? Message-ID: <18b65b654d0.2818.b36d34a15fda208b80f54b6ad54d9e04@freebsd.org> In-Reply-To: <76713a44-1fa4-41ee-a4f9-177907e9a57f@FreeBSD.org> References: <76713a44-1fa4-41ee-a4f9-177907e9a57f@FreeBSD.org>
next in thread | previous in thread | raw e-mail | index | archive | help
This is a multi-part message in MIME format.
--18b65b658cf56722818a240cc2
Content-Type: text/plain; format=flowed; charset="us-ascii"
Content-Transfer-Encoding: 8bit
On October 24, 2023 14:54:40 DutchDaemon - FreeBSD Forums Administrator
<DutchDaemon@FreeBSD.org> wrote:
> Does anyone in 'port land' know what the current developments are wrt
> CertBot (or py-crypto under its hood)?
> CertBot is happily compiling against OpenSSL 3 from ports, but when running
> 'certbot', the crypto side of it talks to the base system OpenSSL 1.1.1,
> hence failing because the OpenSSL 1.1.1 library does not understand the
> OpenSSL 3 calls made to it.
> From what I understood, this was due to an error/regression in pkgconf(?)
> which causes some type of 'path reversal' that causes py-crypto to ignore
> the OpenSSL it was compiled against, favoring the base system library.
> I either have to revert a whole lot of servers back to OpenSSL 1.1.1w from
> ports in order to renew certificates, or wait for "any movement" in getting
> the path reversal addressed/fixed.
> So: does anyone know where we're at with this?
Memory jog:
Traceback (most recent call last):
File "/usr/local/bin/certbot", line 33, in <module>
sys.exit(load_entry_point('certbot==2.6.0', 'console_scripts', 'certbot')())
File "/usr/local/bin/certbot", line 25, in importlib_load_entry_point
return next(matches).load()
File "/usr/local/lib/python3.9/importlib/metadata.py", line 86, in load
module = import_module(match.group('module'))
File "/usr/local/lib/python3.9/importlib/__init__.py", line 127, in
import_module
return _bootstrap._gcd_import(name[level:], package, level)
File "<frozen importlib._bootstrap>", line 1030, in _gcd_import
File "<frozen importlib._bootstrap>", line 1007, in _find_and_load
File "<frozen importlib._bootstrap>", line 986, in _find_and_load_unlocked
File "<frozen importlib._bootstrap>", line 680, in _load_unlocked
File "<frozen importlib._bootstrap_external>", line 850, in exec_module
File "<frozen importlib._bootstrap>", line 228, in _call_with_frames_removed
File "/usr/local/lib/python3.9/site-packages/certbot/main.py", line 6, in
<module>
from certbot._internal import main as internal_main
File "/usr/local/lib/python3.9/site-packages/certbot/_internal/main.py",
line 21, in <module>
import josepy as jose
File "/usr/local/lib/python3.9/site-packages/josepy/__init__.py", line 40,
in <module>
from josepy.json_util import (
File "/usr/local/lib/python3.9/site-packages/josepy/json_util.py", line
14, in <module>
from OpenSSL import crypto
File "/usr/local/lib/python3.9/site-packages/OpenSSL/__init__.py", line 8,
in <module>
from OpenSSL import SSL, crypto
File "/usr/local/lib/python3.9/site-packages/OpenSSL/SSL.py", line 9, in
<module>
from OpenSSL._util import (
File "/usr/local/lib/python3.9/site-packages/OpenSSL/_util.py", line 6, in
<module>
from cryptography.hazmat.bindings.openssl.binding import Binding
File
"/usr/local/lib/python3.9/site-packages/cryptography/hazmat/bindings/openssl/binding.py",
line 15, in <module>
from cryptography.exceptions import InternalError
File "/usr/local/lib/python3.9/site-packages/cryptography/exceptions.py",
line 9, in <module>
from cryptography.hazmat.bindings._rust import exceptions as rust_exceptions
ImportError:
/usr/local/lib/python3.9/site-packages/cryptography/hazmat/bindings/_rust.abi3.so:
Undefined symbol "EVP_default_properties_is_fips_enabled"
--18b65b658cf56722818a240cc2
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.=
w3.org/TR/html4/loose.dtd">
<html>
<body>
<div dir=3D"auto">
<div dir=3D'auto'><br></div>
<div id=3D"aqm-original" style=3D"color: black;">
<!-- body start -->
<div style=3D"color: #000000; background: #ffffff; padding-bottom: 1px;" cl=
ass=3D"aqm-original-body">
<div style=3D"color: black;">
<hr style=3D"border: none; border-top: solid #D0D0D0 1.0pt;">
<p style=3D"color: black; font-size: 10pt; font-family: sans-serif; margin:=
8pt 0;">On October 24, 2023 14:54:40 DutchDaemon - FreeBSD Forums Administ=
rator <DutchDaemon@FreeBSD.org> wrote:</p>
<blockquote type=3D"cite" class=3D"gmail_quote" style=3D"margin: 0 0 0 0.75=
ex; border-left: 1px solid #808080; padding-left: 0.75ex;">
<p>Does anyone in 'port land' know what the current developments are
wrt CertBot (or py-crypto under its hood)? </p>
<p>CertBot is happily compiling against OpenSSL 3 from ports, but
when running 'certbot', the crypto side of it talks to the base
system OpenSSL 1.1.1, hence failing because the OpenSSL 1.1.1
library does not understand the OpenSSL 3 calls made to it.</p>
<p>From what I understood, this was due to an error/regression in
pkgconf(?) which causes some type of 'path reversal' that causes
py-crypto to ignore the OpenSSL it was compiled against, favoring
the base system library.</p>
<p>I either have to revert a whole lot of servers back to OpenSSL
1.1.1w from ports in order to renew certificates, or wait for "any
movement" in getting the path reversal addressed/fixed.</p>
<p>So: does anyone know where we're at with this?<br>
</p>
=20
<lt-container></lt-container></blockquote>
</div>
</div>
<!-- body end -->
</div><div dir=3D"auto">Memory jog:</div><div dir=3D"auto"><br></div><div d=
ir=3D"auto"><br></div><div dir=3D"auto"><span style=3D"font-family: Courier=
New, Courier, Liberation Mono, monospace;">Traceback (most recent call las=
t):</span></div><div dir=3D"auto"><span style=3D"font-family: Courier New, =
Courier, Liberation Mono, monospace;"> File "/usr/local/bin/certbot", =
line 33, in <module></span></div><div dir=3D"auto"><span style=3D"fon=
t-family: Courier New, Courier, Liberation Mono, monospace;"> s=
ys.exit(load_entry_point('certbot=3D=3D2.6.0', 'console_scripts', 'certbot'=
)())</span></div><div dir=3D"auto"><span style=3D"font-family: Courier New,=
Courier, Liberation Mono, monospace;"> File "/usr/local/bin/certbot",=
line 25, in importlib_load_entry_point</span></div><div dir=3D"auto"><span=
style=3D"font-family: Courier New, Courier, Liberation Mono, monospace;">&=
nbsp; return next(matches).load()</span></div><div dir=3D"auto"><span=
style=3D"font-family: Courier New, Courier, Liberation Mono, monospace;">&=
nbsp;File "/usr/local/lib/python3.9/importlib/metadata.py", line 86, in loa=
d</span></div><div dir=3D"auto"><span style=3D"font-family: Courier New, Co=
urier, Liberation Mono, monospace;"> module =3D import_module(m=
atch.group('module'))</span></div><div dir=3D"auto"><span style=3D"font-fam=
ily: Courier New, Courier, Liberation Mono, monospace;"> File "/usr/lo=
cal/lib/python3.9/importlib/__init__.py", line 127, in import_module</span>=
</div><div dir=3D"auto"><span style=3D"font-family: Courier New, Courier, L=
iberation Mono, monospace;"> return _bootstrap._gcd_import(name=
[level:], package, level)</span></div><div dir=3D"auto"><span style=3D"font=
-family: Courier New, Courier, Liberation Mono, monospace;"> File "<=
;frozen importlib._bootstrap>", line 1030, in _gcd_import</span></div><d=
iv dir=3D"auto"><span style=3D"font-family: Courier New, Courier, Liberatio=
n Mono, monospace;"> File "<frozen importlib._bootstrap>", line =
1007, in _find_and_load</span></div><div dir=3D"auto"><span style=3D"font-f=
amily: Courier New, Courier, Liberation Mono, monospace;"> File "<f=
rozen importlib._bootstrap>", line 986, in _find_and_load_unlocked</span=
></div><div dir=3D"auto"><span style=3D"font-family: Courier New, Courier, =
Liberation Mono, monospace;"> File "<frozen importlib._bootstrap>=
;", line 680, in _load_unlocked</span></div><div dir=3D"auto"><span style=
=3D"font-family: Courier New, Courier, Liberation Mono, monospace;"> F=
ile "<frozen importlib._bootstrap_external>", line 850, in exec_modul=
e</span></div><div dir=3D"auto"><span style=3D"font-family: Courier New, Co=
urier, Liberation Mono, monospace;"> File "<frozen importlib._boots=
trap>", line 228, in _call_with_frames_removed</span></div><div dir=3D"a=
uto"><span style=3D"font-family: Courier New, Courier, Liberation Mono, mon=
ospace;"> File "/usr/local/lib/python3.9/site-packages/certbot/main.py=
", line 6, in <module></span></div><div dir=3D"auto"><span style=3D"f=
ont-family: Courier New, Courier, Liberation Mono, monospace;">  =
;from certbot._internal import main as internal_main</span></div><div dir=
=3D"auto"><span style=3D"font-family: Courier New, Courier, Liberation Mono=
, monospace;"> File "/usr/local/lib/python3.9/site-packages/certbot/_i=
nternal/main.py", line 21, in <module></span></div><div dir=3D"auto">=
<span style=3D"font-family: Courier New, Courier, Liberation Mono, monospac=
e;"> import josepy as jose</span></div><div dir=3D"auto"><span =
style=3D"font-family: Courier New, Courier, Liberation Mono, monospace;">&n=
bsp;File "/usr/local/lib/python3.9/site-packages/josepy/__init__.py", line =
40, in <module></span></div><div dir=3D"auto"><span style=3D"font-fam=
ily: Courier New, Courier, Liberation Mono, monospace;"> from j=
osepy.json_util import (</span></div><div dir=3D"auto"><span style=3D"font-=
family: Courier New, Courier, Liberation Mono, monospace;"> File "/usr=
/local/lib/python3.9/site-packages/josepy/json_util.py", line 14, in <mo=
dule></span></div><div dir=3D"auto"><span style=3D"font-family: Courier =
New, Courier, Liberation Mono, monospace;"> from OpenSSL import=
crypto</span></div><div dir=3D"auto"><span style=3D"font-family: Courier N=
ew, Courier, Liberation Mono, monospace;"> File "/usr/local/lib/python=
3.9/site-packages/OpenSSL/__init__.py", line 8, in <module></span></d=
iv><div dir=3D"auto"><span style=3D"font-family: Courier New, Courier, Libe=
ration Mono, monospace;"> from OpenSSL import SSL, crypto</span=
></div><div dir=3D"auto"><span style=3D"font-family: Courier New, Courier, =
Liberation Mono, monospace;"> File "/usr/local/lib/python3.9/site-pack=
ages/OpenSSL/SSL.py", line 9, in <module></span></div><div dir=3D"aut=
o"><span style=3D"font-family: Courier New, Courier, Liberation Mono, monos=
pace;"> from OpenSSL._util import (</span></div><div dir=3D"aut=
o"><span style=3D"font-family: Courier New, Courier, Liberation Mono, monos=
pace;"> File "/usr/local/lib/python3.9/site-packages/OpenSSL/_util.py"=
, line 6, in <module></span></div><div dir=3D"auto"><span style=3D"fo=
nt-family: Courier New, Courier, Liberation Mono, monospace;"> =
from cryptography.hazmat.bindings.openssl.binding import Binding</span></di=
v><div dir=3D"auto"><span style=3D"font-family: Courier New, Courier, Liber=
ation Mono, monospace;"> File "/usr/local/lib/python3.9/site-packages/=
cryptography/hazmat/bindings/openssl/binding.py", line 15, in <module>=
;</span></div><div dir=3D"auto"><span style=3D"font-family: Courier New, Co=
urier, Liberation Mono, monospace;"> from cryptography.exceptio=
ns import InternalError</span></div><div dir=3D"auto"><span style=3D"font-f=
amily: Courier New, Courier, Liberation Mono, monospace;"> File "/usr/=
local/lib/python3.9/site-packages/cryptography/exceptions.py", line 9, in &=
lt;module></span></div><div dir=3D"auto"><span style=3D"font-family: Cou=
rier New, Courier, Liberation Mono, monospace;"> from cryptogra=
phy.hazmat.bindings._rust import exceptions as rust_exceptions</span></div>=
<div dir=3D"auto"><span style=3D"font-family: Courier New, Courier, Liberat=
ion Mono, monospace;">ImportError: /<b><span style=3D"color: #cc0000;">usr/=
local/lib/python3.9/site-packages/cryptography/hazmat/bindings/_rust.abi3.s=
o</span></b>: Undefined symbol "EVP_default_properties_is_fips_enabled"</sp=
an></div>
</div></body>
</html>
--18b65b658cf56722818a240cc2--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?18b65b654d0.2818.b36d34a15fda208b80f54b6ad54d9e04>