From nobody Wed Oct 25 09:12:35 2023 X-Original-To: freebsd-ports@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4SFjrD2VSHz4yFcq for ; Wed, 25 Oct 2023 09:12:44 +0000 (UTC) (envelope-from SRS0=lkkf=GH=klop.ws=ronald-lists@realworks.nl) Received: from smtp-relay-int-backup.realworks.nl (smtp-relay-int-backup.realworks.nl [87.255.56.188]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 4SFjrC5n1gz3LPJ; Wed, 25 Oct 2023 09:12:43 +0000 (UTC) (envelope-from SRS0=lkkf=GH=klop.ws=ronald-lists@realworks.nl) Authentication-Results: mx1.freebsd.org; none Received: from rwvirtual98.colo.realworks.nl (rwvirtual98.colo.realworks.nl [10.0.10.102]) by mailrelayint1.colo2.realworks.nl (Postfix) with ESMTP id 4SFjr432h7z3xFZ; Wed, 25 Oct 2023 11:12:36 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=klop.ws; s=rw2; t=1698225156; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=eeDOwdfvjZw+ijjWp2Ew5WkZiAAkmKQbUs4+5yH8rQE=; b=qg1H83Ir66BZFi+2wk4q/rD+DysMzs/M5ehWXtKzZTb9nyGcpYsfkuFL/KK2Cnv43goBOP HntA8VUc9HM8AmfIHxMFvVS7rcvYQkRs7/c00yhC2Q3bQefLDqWEnp7sPQJdyYoQojSLmp uq6bC6Pb5GsVerjEZAyszJ6eawK9n4+xhTl8CrepGUDCBoYUw0dWxzyhN90+4nyBC8m/kl qCxS0mVVsAR5N/jJfeKDtQRvEISzq2VF8kfkwudYhuHYpqg1u6cTaQRCsIjU5hpguvH208 8OeCTfQsZFiNOSSx6US4YmDG+vO540KcupPa8rMjI84grm0nkghFSBm+fFpSNQ== Received: from rwvirtual98.colo.realworks.nl (localhost [127.0.0.1]) by rwvirtual98.colo.realworks.nl (Postfix) with ESMTP id 1878EA0D00; Wed, 25 Oct 2023 11:12:35 +0200 (CEST) Date: Wed, 25 Oct 2023 11:12:35 +0200 (CEST) From: Ronald Klop To: Dutch Daemon - FreeBSD Forums Administrator Cc: freebsd-ports@freebsd.org Message-ID: <186133619.3538.1698225155900@localhost> In-Reply-To: <18b65b654d0.2818.b36d34a15fda208b80f54b6ad54d9e04@freebsd.org> References: <76713a44-1fa4-41ee-a4f9-177907e9a57f@FreeBSD.org> <18b65b654d0.2818.b36d34a15fda208b80f54b6ad54d9e04@freebsd.org> Subject: Re: FreeBSD 13 + CertBot + OpenSSL 3 - status? List-Id: Porting software to FreeBSD List-Archive: https://lists.freebsd.org/archives/freebsd-ports List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-ports@freebsd.org X-BeenThere: freebsd-ports@freebsd.org MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_Part_3537_336896926.1698225155894" X-Mailer: Realworks (676.5) X-Originating-Host: from (89-20-164-210.static.ef-service.nl [89.20.164.210]) by rwvirtual98 [10.0.10.102] with HTTP; Wed, 25 Oct 2023 11:12:35 +0200 Importance: Normal X-Priority: 3 (Normal) X-Originating-User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/118.0 X-Spamd-Bar: ---- X-Rspamd-Pre-Result: action=no action; module=replies; Message is reply to one we originated X-Spamd-Result: default: False [-4.00 / 15.00]; REPLY(-4.00)[]; ASN(0.00)[asn:38930, ipnet:87.255.32.0/19, country:NL] X-Rspamd-Queue-Id: 4SFjrC5n1gz3LPJ ------=_Part_3537_336896926.1698225155894 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Hi, I see that you are compiling certbot to openssl from ports. Apparently you are running a not often used configuration of the port. Did you try reaching out to the maintainer of the port (python@FreeBSD.org)? And there are also other implementations of the ACME protocol in the ports tree like security/acmetool. I have no experience with them but they might fit your use case. Sorry I can't help you further for now. Maybe others have more handson experience with running python with openssl111 from ports. PS: as you have the name "Dutch" in your email please check out the upcoming Dutch BSD event in November: https://bsdnl.nl/ Regards, Ronald. Van: Dutch Daemon - FreeBSD Forums Administrator Datum: woensdag, 25 oktober 2023 09:22 Aan: freebsd-ports@freebsd.org Onderwerp: Re: FreeBSD 13 + CertBot + OpenSSL 3 - status? > > > > On October 24, 2023 14:54:40 DutchDaemon - FreeBSD Forums Administrator wrote: >> >> Does anyone in 'port land' know what the current developments are wrt CertBot (or py-crypto under its hood)? >> >> CertBot is happily compiling against OpenSSL 3 from ports, but when running 'certbot', the crypto side of it talks to the base system OpenSSL 1.1.1, hence failing because the OpenSSL 1.1.1 library does not understand the OpenSSL 3 calls made to it. >> >> From what I understood, this was due to an error/regression in pkgconf(?) which causes some type of 'path reversal' that causes py-crypto to ignore the OpenSSL it was compiled against, favoring the base system library. >> >> I either have to revert a whole lot of servers back to OpenSSL 1.1.1w from ports in order to renew certificates, or wait for "any movement" in getting the path reversal addressed/fixed. >> >> So: does anyone know where we're at with this? > > Memory jog: > > > Traceback (most recent call last): > File "/usr/local/bin/certbot", line 33, in > sys.exit(load_entry_point('certbot==2.6.0', 'console_scripts', 'certbot')()) > File "/usr/local/bin/certbot", line 25, in importlib_load_entry_point > return next(matches).load() > File "/usr/local/lib/python3.9/importlib/metadata.py", line 86, in load > module = import_module(match.group('module')) > File "/usr/local/lib/python3.9/importlib/__init__.py", line 127, in import_module > return _bootstrap._gcd_import(name[level:], package, level) > File "", line 1030, in _gcd_import > File "", line 1007, in _find_and_load > File "", line 986, in _find_and_load_unlocked > File "", line 680, in _load_unlocked > File "", line 850, in exec_module > File "", line 228, in _call_with_frames_removed > File "/usr/local/lib/python3.9/site-packages/certbot/main.py", line 6, in > from certbot._internal import main as internal_main > File "/usr/local/lib/python3.9/site-packages/certbot/_internal/main.py", line 21, in > import josepy as jose > File "/usr/local/lib/python3.9/site-packages/josepy/__init__.py", line 40, in > from josepy.json_util import ( > File "/usr/local/lib/python3.9/site-packages/josepy/json_util.py", line 14, in > from OpenSSL import crypto > File "/usr/local/lib/python3.9/site-packages/OpenSSL/__init__.py", line 8, in > from OpenSSL import SSL, crypto > File "/usr/local/lib/python3.9/site-packages/OpenSSL/SSL.py", line 9, in > from OpenSSL._util import ( > File "/usr/local/lib/python3.9/site-packages/OpenSSL/_util.py", line 6, in > from cryptography.hazmat.bindings.openssl.binding import Binding > File "/usr/local/lib/python3.9/site-packages/cryptography/hazmat/bindings/openssl/binding.py", line 15, in > from cryptography.exceptions import InternalError > File "/usr/local/lib/python3.9/site-packages/cryptography/exceptions.py", line 9, in > from cryptography.hazmat.bindings._rust import exceptions as rust_exceptions > ImportError: /usr/local/lib/python3.9/site-packages/cryptography/hazmat/bindings/_rust.abi3.so: Undefined symbol "EVP_default_properties_is_fips_enabled" ------=_Part_3537_336896926.1698225155894 Content-Type: text/html; charset=us-ascii Content-Transfer-Encoding: 7bit Hi,

I see that you are compiling certbot to openssl from ports. Apparently you are running a not often used configuration of the port.
Did you try reaching out to the maintainer of the port (python@FreeBSD.org)?
And there are also other implementations of the ACME protocol in the ports tree like security/acmetool. I have no experience with them but they might fit your use case.

Sorry I can't help you further for now. Maybe others have more handson experience with running python with openssl111 from ports.

PS: as you have the name "Dutch" in your email please check out the upcoming Dutch BSD event in November: https://bsdnl.nl/

Regards,
Ronald.

 

Van: Dutch Daemon - FreeBSD Forums Administrator <dutchdaemon@freebsd.org>
Datum: woensdag, 25 oktober 2023 09:22
Aan: freebsd-ports@freebsd.org
Onderwerp: Re: FreeBSD 13 + CertBot + OpenSSL 3 - status?

 

On October 24, 2023 14:54:40 DutchDaemon - FreeBSD Forums Administrator <DutchDaemon@FreeBSD.org> wrote:

Does anyone in 'port land' know what the current developments are wrt CertBot (or py-crypto under its hood)? 

CertBot is happily compiling against OpenSSL 3 from ports, but when running 'certbot', the crypto side of it talks to the base system OpenSSL 1.1.1, hence failing because the OpenSSL 1.1.1 library does not understand the OpenSSL 3 calls made to it.

From what I understood, this was due to an error/regression in pkgconf(?) which causes some type of 'path reversal' that causes py-crypto to ignore the OpenSSL it was compiled against, favoring the base system library.

I either have to revert a whole lot of servers back to OpenSSL 1.1.1w from ports in order to renew certificates, or wait for "any movement" in getting the path reversal addressed/fixed.

So: does anyone know where we're at with this?

Memory jog:
 
 
Traceback (most recent call last):
 File "/usr/local/bin/certbot", line 33, in <module>
   sys.exit(load_entry_point('certbot==2.6.0', 'console_scripts', 'certbot')())
 File "/usr/local/bin/certbot", line 25, in importlib_load_entry_point
   return next(matches).load()
 File "/usr/local/lib/python3.9/importlib/metadata.py", line 86, in load
   module = import_module(match.group('module'))
 File "/usr/local/lib/python3.9/importlib/__init__.py", line 127, in import_module
   return _bootstrap._gcd_import(name[level:], package, level)
 File "<frozen importlib._bootstrap>", line 1030, in _gcd_import
 File "<frozen importlib._bootstrap>", line 1007, in _find_and_load
 File "<frozen importlib._bootstrap>", line 986, in _find_and_load_unlocked
 File "<frozen importlib._bootstrap>", line 680, in _load_unlocked
 File "<frozen importlib._bootstrap_external>", line 850, in exec_module
 File "<frozen importlib._bootstrap>", line 228, in _call_with_frames_removed
 File "/usr/local/lib/python3.9/site-packages/certbot/main.py", line 6, in <module>
   from certbot._internal import main as internal_main
 File "/usr/local/lib/python3.9/site-packages/certbot/_internal/main.py", line 21, in <module>
   import josepy as jose
 File "/usr/local/lib/python3.9/site-packages/josepy/__init__.py", line 40, in <module>
   from josepy.json_util import (
 File "/usr/local/lib/python3.9/site-packages/josepy/json_util.py", line 14, in <module>
   from OpenSSL import crypto
 File "/usr/local/lib/python3.9/site-packages/OpenSSL/__init__.py", line 8, in <module>
   from OpenSSL import SSL, crypto
 File "/usr/local/lib/python3.9/site-packages/OpenSSL/SSL.py", line 9, in <module>
   from OpenSSL._util import (
 File "/usr/local/lib/python3.9/site-packages/OpenSSL/_util.py", line 6, in <module>
   from cryptography.hazmat.bindings.openssl.binding import Binding
 File "/usr/local/lib/python3.9/site-packages/cryptography/hazmat/bindings/openssl/binding.py", line 15, in <module>
   from cryptography.exceptions import InternalError
 File "/usr/local/lib/python3.9/site-packages/cryptography/exceptions.py", line 9, in <module>
   from cryptography.hazmat.bindings._rust import exceptions as rust_exceptions
ImportError: /usr/local/lib/python3.9/site-packages/cryptography/hazmat/bindings/_rust.abi3.so: Undefined symbol "EVP_default_properties_is_fips_enabled"

  ------=_Part_3537_336896926.1698225155894--