Bug #128716 for IO-Socket-SSL: Will not build on Alpine Linux 3.9.0

Mon Mar 04 23:11:27 2019 scott [...] mailblock.net - Ticket created

Subject:

Will not build on Alpine Linux 3.9.0

Using Alpine Linux 3.9.0 in a Docker container. Steps to reproduce: apk update && apk upgrade && apk add curl tar make gcc build-base wget gnupg perl perl-dev libressl libressl-dev zlib-dev curl -L https://cpanmin.us | perl - App::cpanminus cpanm https://cpan.metacpan.org/authors/id/S/SU/SULLR/IO-Socket-SSL-2.061.tar.gz (this works fine) cpanm https://cpan.metacpan.org/authors/id/S/SU/SULLR/IO-Socket-SSL-2.062.tar.gz (this breaks, as do 2.063 and 2.064) The error is: Show quoted text

> Failed test 'Can't locate auto/Net/SSLeay/CTX_get0_pa.al in @INC (@INC contains: /root/.cpanm/work/1551758559.877/IO-Socket-SSL-2.062/blib/lib /root/.cpanm/work/1551758559.877/IO-Socket-SSL-2.062/blib/arch /usr/local/lib/perl5/site_perl /usr/local/share/perl5/site_perl /usr/lib/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib/perl5/core_perl /usr/share/perl5/core_perl .) at /root/.cpanm/work/1551758559.877/IO-Socket-SSL-2.062/blib/lib/IO/Socket/SSL.pm line 122.

Seems to be caused by this patch: + + if (my $c = eval { Net::SSLeay::X509_V_FLAG_PARTIAL_CHAIN() }) { + $check_partial_chain = sub { + my $ctx = shift; + my $param = Net::SSLeay::CTX_get0_param($ctx); + Net::SSLeay::X509_VERIFY_PARAM_set_flags($param, $c); + }; + } } The file `CTX_get0_pa.al` does not exist anywhere on the host.

Tue Mar 05 00:27:07 2019 Steffen_Ullrich [...] genua.de - Correspondence added

Am Mo 04. Mär 2019, 23:11:27, SCOTTW schrieb: Show quoted text

> Using Alpine Linux 3.9.0 in a Docker container. Steps to reproduce:

I'm not familiar what software is running in this system. Please provide the exact versions of Net::SSLeay and openssl/libressl so that I can narrow down the cause of the problem. You can do this with the following code: use strict; use warnings; use Net::SSLeay; printf("openssl version compiled=0x%0x linked=0x%0x -- %s\n", Net::SSLeay::OPENSSL_VERSION_NUMBER(), Net::SSLeay::SSLeay(), Net::SSLeay::SSLeay_version(0)); printf("Net::SSLeay version=%s\n", $Net::SSLeay::VERSION);

Tue Mar 05 00:27:07 2019 The RT System itself - Status changed from 'new' to 'open'

Tue Mar 05 12:56:50 2019 scott [...] mailblock.net - Correspondence added

On Tue Mar 05 00:27:07 2019, SULLR wrote: Show quoted text

> printf("openssl version compiled=0x%0x linked=0x%0x -- %s\n", > Net::SSLeay::OPENSSL_VERSION_NUMBER(), > Net::SSLeay::SSLeay(), > Net::SSLeay::SSLeay_version(0)); > printf("Net::SSLeay version=%s\n", $Net::SSLeay::VERSION);

openssl version compiled=0x20000000 linked=0x20000000 -- LibreSSL 2.7.4 Net::SSLeay version=1.85

Tue Mar 05 13:51:50 2019 Steffen_Ullrich [...] genua.de - Correspondence added

Am Di 05. Mär 2019, 12:56:50, SCOTTW schrieb: Show quoted text

> On Tue Mar 05 00:27:07 2019, SULLR wrote:

> > printf("openssl version compiled=0x%0x linked=0x%0x -- %s\n", > > Net::SSLeay::OPENSSL_VERSION_NUMBER(), > > Net::SSLeay::SSLeay(), > > Net::SSLeay::SSLeay_version(0)); > > printf("Net::SSLeay version=%s\n", $Net::SSLeay::VERSION);

> > openssl version compiled=0x20000000 linked=0x20000000 -- LibreSSL 2.7.4 > Net::SSLeay version=1.85

Thanks, this should be fixed in the just released version 2.065.

Tue Mar 05 13:51:51 2019 Steffen_Ullrich [...] genua.de - Status changed from 'open' to 'resolved'

Tue Mar 05 13:51:51 2019 Steffen_Ullrich [...] genua.de - Fixed in 1.29 added

Tue Mar 05 13:51:51 2019 Steffen_Ullrich [...] genua.de - Fixed in 1.30 added

Tue Mar 05 13:51:51 2019 Steffen_Ullrich [...] genua.de - Fixed in 1.30_2 added

Tue Mar 05 13:51:51 2019 Steffen_Ullrich [...] genua.de - Fixed in 1.30_3 added

Tue Mar 05 13:53:00 2019 Steffen_Ullrich [...] genua.de - Fixed in 1.29 deleted

Tue Mar 05 13:53:00 2019 Steffen_Ullrich [...] genua.de - Fixed in 1.30 deleted

Tue Mar 05 13:53:00 2019 Steffen_Ullrich [...] genua.de - Fixed in 1.30_2 deleted

Tue Mar 05 13:53:00 2019 Steffen_Ullrich [...] genua.de - Fixed in 1.30_3 deleted

Tue Mar 05 15:56:46 2019 scott [...] mailblock.net - Correspondence added

On Tue Mar 05 13:51:50 2019, SULLR wrote: Show quoted text

> Thanks, > this should be fixed in the just released version 2.065.

Looks like `t/verify_partial_chain.t` still uses the old check: ``` if (!eval { Net::SSLeay::X509_V_FLAG_PARTIAL_CHAIN() }) { print "1..0 # no support for X509_V_FLAG_PARTIAL_CHAIN\n"; exit(0); } ``` so that test fails: ``` # prove -lv t/verify_partial_chain.t t/verify_partial_chain.t .. 1..3 ok #Server Initialization not ok #client ssl connect ok #skip issuer check since no client Failed 1/3 subtests (less 1 skipped subtest: 1 okay) ```

Tue Mar 05 15:56:47 2019 scott [...] mailblock.net - Given to SULLR

Wed Mar 06 01:57:51 2019 Steffen_Ullrich [...] genua.de - Severity Critical changed to Important

Wed Mar 06 01:58:59 2019 Steffen_Ullrich [...] genua.de - Correspondence added

Show quoted text

> Looks like `t/verify_partial_chain.t` still uses the old check:

Oops. It should be properly fixed in 2.066 now.

Wed Mar 06 14:05:27 2019 scott [...] mailblock.net - Correspondence added

On Wed Mar 06 01:58:59 2019, SULLR wrote: Show quoted text

>

> > Looks like `t/verify_partial_chain.t` still uses the old check:

> > Oops. It should be properly fixed in 2.066 now.

Confirmed: fixed in 2.066. Thank you! Scott

Wed Mar 06 14:05:27 2019 scott [...] mailblock.net - Fixed in 2.066 added