Date: Wed, 25 Oct 2023 11:12:35 +0200 (CEST) From: Ronald Klop <ronald-lists@klop.ws> To: Dutch Daemon - FreeBSD Forums Administrator <dutchdaemon@freebsd.org> Cc: freebsd-ports@freebsd.org Subject: Re: FreeBSD 13 + CertBot + OpenSSL 3 - status? Message-ID: <186133619.3538.1698225155900@localhost> In-Reply-To: <18b65b654d0.2818.b36d34a15fda208b80f54b6ad54d9e04@freebsd.org> References: <76713a44-1fa4-41ee-a4f9-177907e9a57f@FreeBSD.org> <18b65b654d0.2818.b36d34a15fda208b80f54b6ad54d9e04@freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
------=_Part_3537_336896926.1698225155894 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Hi, I see that you are compiling certbot to openssl from ports. Apparently you are running a not often used configuration of the port. Did you try reaching out to the maintainer of the port (python@FreeBSD.org)? And there are also other implementations of the ACME protocol in the ports tree like security/acmetool. I have no experience with them but they might fit your use case. Sorry I can't help you further for now. Maybe others have more handson experience with running python with openssl111 from ports. PS: as you have the name "Dutch" in your email please check out the upcoming Dutch BSD event in November: https://bsdnl.nl/ Regards, Ronald. Van: Dutch Daemon - FreeBSD Forums Administrator <dutchdaemon@freebsd.org> Datum: woensdag, 25 oktober 2023 09:22 Aan: freebsd-ports@freebsd.org Onderwerp: Re: FreeBSD 13 + CertBot + OpenSSL 3 - status? > > > > On October 24, 2023 14:54:40 DutchDaemon - FreeBSD Forums Administrator <DutchDaemon@FreeBSD.org> wrote: >> >> Does anyone in 'port land' know what the current developments are wrt CertBot (or py-crypto under its hood)? >> >> CertBot is happily compiling against OpenSSL 3 from ports, but when running 'certbot', the crypto side of it talks to the base system OpenSSL 1.1.1, hence failing because the OpenSSL 1.1.1 library does not understand the OpenSSL 3 calls made to it. >> >> From what I understood, this was due to an error/regression in pkgconf(?) which causes some type of 'path reversal' that causes py-crypto to ignore the OpenSSL it was compiled against, favoring the base system library. >> >> I either have to revert a whole lot of servers back to OpenSSL 1.1.1w from ports in order to renew certificates, or wait for "any movement" in getting the path reversal addressed/fixed. >> >> So: does anyone know where we're at with this? > > Memory jog: > > > Traceback (most recent call last): > File "/usr/local/bin/certbot", line 33, in <module> > sys.exit(load_entry_point('certbot==2.6.0', 'console_scripts', 'certbot')()) > File "/usr/local/bin/certbot", line 25, in importlib_load_entry_point > return next(matches).load() > File "/usr/local/lib/python3.9/importlib/metadata.py", line 86, in load > module = import_module(match.group('module')) > File "/usr/local/lib/python3.9/importlib/__init__.py", line 127, in import_module > return _bootstrap._gcd_import(name[level:], package, level) > File "<frozen importlib._bootstrap>", line 1030, in _gcd_import > File "<frozen importlib._bootstrap>", line 1007, in _find_and_load > File "<frozen importlib._bootstrap>", line 986, in _find_and_load_unlocked > File "<frozen importlib._bootstrap>", line 680, in _load_unlocked > File "<frozen importlib._bootstrap_external>", line 850, in exec_module > File "<frozen importlib._bootstrap>", line 228, in _call_with_frames_removed > File "/usr/local/lib/python3.9/site-packages/certbot/main.py", line 6, in <module> > from certbot._internal import main as internal_main > File "/usr/local/lib/python3.9/site-packages/certbot/_internal/main.py", line 21, in <module> > import josepy as jose > File "/usr/local/lib/python3.9/site-packages/josepy/__init__.py", line 40, in <module> > from josepy.json_util import ( > File "/usr/local/lib/python3.9/site-packages/josepy/json_util.py", line 14, in <module> > from OpenSSL import crypto > File "/usr/local/lib/python3.9/site-packages/OpenSSL/__init__.py", line 8, in <module> > from OpenSSL import SSL, crypto > File "/usr/local/lib/python3.9/site-packages/OpenSSL/SSL.py", line 9, in <module> > from OpenSSL._util import ( > File "/usr/local/lib/python3.9/site-packages/OpenSSL/_util.py", line 6, in <module> > from cryptography.hazmat.bindings.openssl.binding import Binding > File "/usr/local/lib/python3.9/site-packages/cryptography/hazmat/bindings/openssl/binding.py", line 15, in <module> > from cryptography.exceptions import InternalError > File "/usr/local/lib/python3.9/site-packages/cryptography/exceptions.py", line 9, in <module> > from cryptography.hazmat.bindings._rust import exceptions as rust_exceptions > ImportError: /usr/local/lib/python3.9/site-packages/cryptography/hazmat/bindings/_rust.abi3.so: Undefined symbol "EVP_default_properties_is_fips_enabled" ------=_Part_3537_336896926.1698225155894 Content-Type: text/html; charset=us-ascii Content-Transfer-Encoding: 7bit <html><head></head><body>Hi,<br> <br> I see that you are compiling certbot to openssl from ports. Apparently you are running a not often used configuration of the port.<br> Did you try reaching out to the maintainer of the port (python@FreeBSD.org)?<br> And there are also other implementations of the ACME protocol in the ports tree like security/acmetool. I have no experience with them but they might fit your use case.<br> <br> Sorry I can't help you further for now. Maybe others have more handson experience with running python with openssl111 from ports.<br> <br> PS: as you have the name "Dutch" in your email please check out the upcoming Dutch BSD event in November: https://bsdnl.nl/<br>; <br> Regards,<br> Ronald.<br> <br> <p><strong>Van:</strong> Dutch Daemon - FreeBSD Forums Administrator <dutchdaemon@freebsd.org><br> <strong>Datum:</strong> woensdag, 25 oktober 2023 09:22<br> <strong>Aan:</strong> freebsd-ports@freebsd.org<br> <strong>Onderwerp:</strong> Re: FreeBSD 13 + CertBot + OpenSSL 3 - status?</p> <blockquote style="padding-right: 0px; padding-left: 5px; margin-left: 5px; border-left: #000000 2px solid; margin-right: 0px"> <div class="MessageRFC822Viewer" id="P"> <div class="MultipartAlternativeViewer"> <div class="TextHTMLViewer" id="P.P.P"> <div> <div> </div> <div id="aqm-original" style="color: black;"> <div class="aqm-original-body" style="color: #000000; background: #ffffff; padding-bottom: 1px;"> <div style="color: black;"> <hr style="border: none; border-top: solid #D0D0D0 1.0pt;"> <p style="color: black; font-size: 10pt; font-family: sans-serif; margin: 8pt 0;">On October 24, 2023 14:54:40 DutchDaemon - FreeBSD Forums Administrator <DutchDaemon@FreeBSD.org> wrote:</p> <blockquote class="gmail_quote" style="margin: 0 0 0 0.75ex; border-left: 1px solid #808080; padding-left: 0.75ex;"> <p>Does anyone in 'port land' know what the current developments are wrt CertBot (or py-crypto under its hood)? </p> <p>CertBot is happily compiling against OpenSSL 3 from ports, but when running 'certbot', the crypto side of it talks to the base system OpenSSL 1.1.1, hence failing because the OpenSSL 1.1.1 library does not understand the OpenSSL 3 calls made to it.</p> <p>From what I understood, this was due to an error/regression in pkgconf(?) which causes some type of 'path reversal' that causes py-crypto to ignore the OpenSSL it was compiled against, favoring the base system library.</p> <p>I either have to revert a whole lot of servers back to OpenSSL 1.1.1w from ports in order to renew certificates, or wait for "any movement" in getting the path reversal addressed/fixed.</p> <p>So: does anyone know where we're at with this?</p> </blockquote> </div> </div> </div> <div>Memory jog:</div> <div> </div> <div> </div> <div><span style="font-family: Courier New, Courier, Liberation Mono, monospace;">Traceback (most recent call last):</span></div> <div><span style="font-family: Courier New, Courier, Liberation Mono, monospace;"> File "/usr/local/bin/certbot", line 33, in <module></span></div> <div><span style="font-family: Courier New, Courier, Liberation Mono, monospace;"> sys.exit(load_entry_point('certbot==2.6.0', 'console_scripts', 'certbot')())</span></div> <div><span style="font-family: Courier New, Courier, Liberation Mono, monospace;"> File "/usr/local/bin/certbot", line 25, in importlib_load_entry_point</span></div> <div><span style="font-family: Courier New, Courier, Liberation Mono, monospace;"> return next(matches).load()</span></div> <div><span style="font-family: Courier New, Courier, Liberation Mono, monospace;"> File "/usr/local/lib/python3.9/importlib/metadata.py", line 86, in load</span></div> <div><span style="font-family: Courier New, Courier, Liberation Mono, monospace;"> module = import_module(match.group('module'))</span></div> <div><span style="font-family: Courier New, Courier, Liberation Mono, monospace;"> File "/usr/local/lib/python3.9/importlib/__init__.py", line 127, in import_module</span></div> <div><span style="font-family: Courier New, Courier, Liberation Mono, monospace;"> return _bootstrap._gcd_import(name[level:], package, level)</span></div> <div><span style="font-family: Courier New, Courier, Liberation Mono, monospace;"> File "<frozen importlib._bootstrap>", line 1030, in _gcd_import</span></div> <div><span style="font-family: Courier New, Courier, Liberation Mono, monospace;"> File "<frozen importlib._bootstrap>", line 1007, in _find_and_load</span></div> <div><span style="font-family: Courier New, Courier, Liberation Mono, monospace;"> File "<frozen importlib._bootstrap>", line 986, in _find_and_load_unlocked</span></div> <div><span style="font-family: Courier New, Courier, Liberation Mono, monospace;"> File "<frozen importlib._bootstrap>", line 680, in _load_unlocked</span></div> <div><span style="font-family: Courier New, Courier, Liberation Mono, monospace;"> File "<frozen importlib._bootstrap_external>", line 850, in exec_module</span></div> <div><span style="font-family: Courier New, Courier, Liberation Mono, monospace;"> File "<frozen importlib._bootstrap>", line 228, in _call_with_frames_removed</span></div> <div><span style="font-family: Courier New, Courier, Liberation Mono, monospace;"> File "/usr/local/lib/python3.9/site-packages/certbot/main.py", line 6, in <module></span></div> <div><span style="font-family: Courier New, Courier, Liberation Mono, monospace;"> from certbot._internal import main as internal_main</span></div> <div><span style="font-family: Courier New, Courier, Liberation Mono, monospace;"> File "/usr/local/lib/python3.9/site-packages/certbot/_internal/main.py", line 21, in <module></span></div> <div><span style="font-family: Courier New, Courier, Liberation Mono, monospace;"> import josepy as jose</span></div> <div><span style="font-family: Courier New, Courier, Liberation Mono, monospace;"> File "/usr/local/lib/python3.9/site-packages/josepy/__init__.py", line 40, in <module></span></div> <div><span style="font-family: Courier New, Courier, Liberation Mono, monospace;"> from josepy.json_util import (</span></div> <div><span style="font-family: Courier New, Courier, Liberation Mono, monospace;"> File "/usr/local/lib/python3.9/site-packages/josepy/json_util.py", line 14, in <module></span></div> <div><span style="font-family: Courier New, Courier, Liberation Mono, monospace;"> from OpenSSL import crypto</span></div> <div><span style="font-family: Courier New, Courier, Liberation Mono, monospace;"> File "/usr/local/lib/python3.9/site-packages/OpenSSL/__init__.py", line 8, in <module></span></div> <div><span style="font-family: Courier New, Courier, Liberation Mono, monospace;"> from OpenSSL import SSL, crypto</span></div> <div><span style="font-family: Courier New, Courier, Liberation Mono, monospace;"> File "/usr/local/lib/python3.9/site-packages/OpenSSL/SSL.py", line 9, in <module></span></div> <div><span style="font-family: Courier New, Courier, Liberation Mono, monospace;"> from OpenSSL._util import (</span></div> <div><span style="font-family: Courier New, Courier, Liberation Mono, monospace;"> File "/usr/local/lib/python3.9/site-packages/OpenSSL/_util.py", line 6, in <module></span></div> <div><span style="font-family: Courier New, Courier, Liberation Mono, monospace;"> from cryptography.hazmat.bindings.openssl.binding import Binding</span></div> <div><span style="font-family: Courier New, Courier, Liberation Mono, monospace;"> File "/usr/local/lib/python3.9/site-packages/cryptography/hazmat/bindings/openssl/binding.py", line 15, in <module></span></div> <div><span style="font-family: Courier New, Courier, Liberation Mono, monospace;"> from cryptography.exceptions import InternalError</span></div> <div><span style="font-family: Courier New, Courier, Liberation Mono, monospace;"> File "/usr/local/lib/python3.9/site-packages/cryptography/exceptions.py", line 9, in <module></span></div> <div><span style="font-family: Courier New, Courier, Liberation Mono, monospace;"> from cryptography.hazmat.bindings._rust import exceptions as rust_exceptions</span></div> <div><span style="font-family: Courier New, Courier, Liberation Mono, monospace;">ImportError: /<b><span style="color: #cc0000;">usr/local/lib/python3.9/site-packages/cryptography/hazmat/bindings/_rust.abi3.so</span></b>: Undefined symbol "EVP_default_properties_is_fips_enabled"</span></div> </div> </div> </div> </div> </blockquote> <br> </body></html> ------=_Part_3537_336896926.1698225155894--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?186133619.3538.1698225155900>