Re: OpenSSL 1.1.0c security update required

[Leo Famulari]

On Sat, Nov 12, 2016 at 12:21:44PM +0100, Ludovic Courtès wrote:
> Leo Famulari <address@hidden> skribis:
> > They changed how library runpaths are recorded at build time, and so our
> > packaging no longer works:
> >
> > https://github.com/openssl/openssl/pull/1699
> 
> I would expect ld-wrapper to do the right thing regardless of what
> OpenSSL’s build system does, no?

So far, we've had to do some extra work in the openssl-next package
definition:

(add-after 'configure 'patch-runpath
  (lambda* (#:key outputs #:allow-other-keys)
    (let ((lib (string-append (assoc-ref outputs "out") "/lib")))
      (substitute* "Makefile.shared"
        (("\\$\\$\\{SHAREDCMD\\} \\$\\$\\{SHAREDFLAGS\\}")
         (string-append "$${SHAREDCMD} $${SHAREDFLAGS}"
                        " -Wl,-rpath," lib)))
      #t)))))))))

This phase still works to help OpenSSL's libraries find the libssl and
libcrypto libraries, but the OpenSSL executable itself now lacks a
reference to those libraries:

starting phase `validate-runpath'
validating RUNPATH of 5 binaries in 
"/gnu/store/d4669fp9lhvi85i97kbhwk3xprgqpv6v-openssl-1.1.0c/lib"...
validating RUNPATH of 1 binaries in 
"/gnu/store/d4669fp9lhvi85i97kbhwk3xprgqpv6v-openssl-1.1.0c/bin"...
/gnu/store/d4669fp9lhvi85i97kbhwk3xprgqpv6v-openssl-1.1.0c/bin/openssl: error: 
depends on 'libssl.so.1.1', which cannot be found in RUNPATH 
("/gnu/store/iwgi9001dmmihrjg4rqhd6pa6788prjw-glibc-2.24/lib" 
"/gnu/store/cdi08kw7r6r684w8mk0xq0dkgpjhfpmd-gcc-4.9.4-lib/lib" 
"/gnu/store/cdi08kw7r6r684w8mk0xq0dkgpjhfpmd-gcc-4.9.4-lib/lib/gcc/x86_64-unknown-linux-gnu/4.9.4/../../..")
/gnu/store/d4669fp9lhvi85i97kbhwk3xprgqpv6v-openssl-1.1.0c/bin/openssl: error: 
depends on 'libcrypto.so.1.1', which cannot be found in RUNPATH 
("/gnu/store/iwgi9001dmmihrjg4rqhd6pa6788prjw-glibc-2.24/lib" 
"/gnu/store/cdi08kw7r6r684w8mk0xq0dkgpjhfpmd-gcc-4.9.4-lib/lib" 
"/gnu/store/cdi08kw7r6r684w8mk0xq0dkgpjhfpmd-gcc-4.9.4-lib/lib/gcc/x86_64-unknown-linux-gnu/4.9.4/../../..")
validating RUNPATH of 0 binaries in 
"/gnu/store/wdzvwl9kx3iiq4fk2qyxg7sjxqq2qx3x-openssl-1.1.0c-static/lib"...
phase `validate-runpath' failed after 0.0 seconds
builder for `/gnu/store/ja9xpivxkfvbm2p6zs1vicdkk4ppq1is-openssl-1.1.0c.drv' 
failed with exit code 1

Upstream discussion:
https://github.com/openssl/openssl/pull/1688
https://github.com/openssl/openssl/pull/1699

My understanding is that this change was made for address@hidden as well,
so we will need to address it for the next big OpenSSL update. We should
try packaging a Git snapshot of 1.0.2 now, so that we are ready.

signature.asc
Description: PGP signature