Bug 282232 - security/sudo with libressl 4.0
Summary: security/sudo with libressl 4.0
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Only Me
Assignee: Renato Botelho
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-10-20 18:12 UTC by jakub_lach
Modified: 2024-10-22 08:15 UTC (History)
3 users (show)

See Also:
bugzilla: maintainer-feedback? (garga)


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description jakub_lach 2024-10-20 18:12:54 UTC
security/sudo looks for ibcrypto.so.53 and if there is no ln -s libcrypto.so.53 to libcrypto.so.55, security/sudo tries to install libressl once again and fails because it is already installed.
Comment 1 Herbert J. Skuhra 2024-10-20 19:15:04 UTC
(In reply to jakub_lach from comment #0)
I guess this not a sudo but libressl issue:

diff --git a/security/libressl/version.mk b/security/libressl/version.mk
index d967dc772682..c2a37fc2b0bb 100644
--- a/security/libressl/version.mk
+++ b/security/libressl/version.mk
@@ -1 +1 @@
-OPENSSL_SHLIBVER?=     53
+OPENSSL_SHLIBVER?=     55
Comment 2 Bernard Spil freebsd_committer freebsd_triage 2024-10-20 19:55:07 UTC
(In reply to jakub_lach from comment #0)
Outdated dependencies? Check UPDATING, you must rebuild everything that links to LibreSSL's libcrypto/libssl/libtls
Comment 3 jakub_lach 2024-10-20 20:02:11 UTC
(In reply to Bernard Spil from comment #2)

All linked to libcrypto.so.53 was rebuild. Afterwards, sudo links to libcrypto.so.55 (which is evident if I remove libressl then). Still, if there is no soft link to 53, sudo tries to install libressl once again even if there is libressl 4.0 in place. 

I think Herbert solution is correct.
Comment 4 jakub_lach 2024-10-20 20:12:44 UTC
I think it still needlessly rebuilds and installs libressl twice, but it is a behaviour which I've noticed earlier.

===>>> Re-installation of sudo-1.9.16 succeeded

rm: libressl-4.0.0.pkg: Nie ma takiego pliku/katalogu
rm: libressl-4.0.0.pkg: Nie ma takiego pliku/katalogu
===>>> Waiting for background 'make clean' processes to finish

===>>> The following actions were performed:
        Re-installation of libressl-4.0.0
        Re-installation of libressl-4.0.0
        Re-installation of libressl-4.0.0
        Re-installation of sudo-1.9.16
Comment 5 Bernard Spil freebsd_committer freebsd_triage 2024-10-20 20:49:26 UTC
Unclear how this leads to an error outside of poudriere builds.

Sorry Jakub, can't help this way. If you're not using poudriere builds, pls check old UPDATING entries that had instructions for portmaster etc. Basically: Rebuild everything that depends on libcrypto.so.*
Comment 6 jakub_lach 2024-10-20 20:56:41 UTC
(In reply to Bernard Spil from comment #5)

Thanks, what I'm trying to say - changing OPENSSL_SHLIBVER?= 53 to OPENSSL_SHLIBVER?=      55 in /usr/ports/security/libressl/version.mk fixed the problem reported. Maybe it's worth looking into that. I can rebuild sudo now without additional ln -s.

The thing with portmaster and rebuilding libressl twice is just a side note and behaviour observed with 53 before too.
Comment 7 Herbert J. Skuhra 2024-10-20 21:46:36 UTC
(In reply to Bernard Spil from comment #5)

Sorry, why did you ignore my diff in comment #1?

You obviously forgot to bump OPENSSL_SHLIBVER (53 -> 55) in version.mk
again. This happened before (02a45093a3e8ed10e7a0af0c70ced7af9b36d6fe).
You did this in 1c60c1a4cc45f408a186d7717374dc45f6e86eb9 for
libressl-devel.
Comment 8 Mark Millard 2024-10-21 20:27:41 UTC
(In reply to Bernard Spil from comment #2)
(In reply to Bernard Spil from comment #5)

Perhaps this will make things clearer for the status of:

https://cgit.freebsd.org/ports/tree/security/libressl/Makefile
vs.:
https://cgit.freebsd.org/ports/tree/security/libressl/version.mk

as of:

https://cgit.freebsd.org/ports/commit/security/libressl?id=928370d52b789a79f802201a477d54f22492e57f

Makefile has:
. . .
PLIST_SUB+=	LIBCRYPTO_SHLIBMAJ=55 \
		LIBCRYPTO_SHLIBFULL=55.0.0 \
. . .

But version.mk has:

OPENSSL_SHLIBVER?=	53

That last is from the most recent version.mk :

* 	security/libressl: Chase missing SHLIBVER bump	Bernard Spil	2024-05-13	1	-1/+1
Comment 9 commit-hook freebsd_committer freebsd_triage 2024-10-22 08:15:20 UTC
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=ce4aba13958d4816b28d4bb74dd6859f484578a0

commit ce4aba13958d4816b28d4bb74dd6859f484578a0
Author:     Bernard Spil <brnrd@FreeBSD.org>
AuthorDate: 2024-10-22 08:13:36 +0000
Commit:     Bernard Spil <brnrd@FreeBSD.org>
CommitDate: 2024-10-22 08:13:36 +0000

    security/libressl: Chase SHLIBVER bump

    PR:             282232
    Reported by:    Jakub Lach <jakub_lach mailplus pl>

 security/libressl/Makefile   | 1 +
 security/libressl/version.mk | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)