Re: HEADS-UP: security/openssl switching to 3.0 branch

On 17/10/2023 12:43, DutchDaemon - FreeBSD Forums Administrator wrote:
>
> I have retried all kinds of rebuilds, new build jails, CCACHE on/off, 
> and full deinstalls/reinstalls, but this remains a problem; I see that 
> there are OpenSSL/py-crypto bugs filed for this, so I will stop trying 
> to remedy this,
>
> # certbot
> Traceback (most recent call last):
>   File "/usr/local/bin/certbot", line 33, in <module>
>     sys.exit(load_entry_point('certbot==2.6.0', 'console_scripts', 
> 'certbot')())
>   File "/usr/local/bin/certbot", line 25, in importlib_load_entry_point
>     return next(matches).load()
>   File "/usr/local/lib/python3.9/importlib/metadata.py", line 86, in load
>     module = import_module(match.group('module'))
>   File "/usr/local/lib/python3.9/importlib/__init__.py", line 127, in 
> import_module
>     return _bootstrap._gcd_import(name[level:], package, level)
>   File "<frozen importlib._bootstrap>", line 1030, in _gcd_import
>   File "<frozen importlib._bootstrap>", line 1007, in _find_and_load
>   File "<frozen importlib._bootstrap>", line 986, in 
> _find_and_load_unlocked
>   File "<frozen importlib._bootstrap>", line 680, in _load_unlocked
>   File "<frozen importlib._bootstrap_external>", line 850, in exec_module
>   File "<frozen importlib._bootstrap>", line 228, in 
> _call_with_frames_removed
>   File "/usr/local/lib/python3.9/site-packages/certbot/main.py", line 
> 6, in <module>
>     from certbot._internal import main as internal_main
>   File 
> "/usr/local/lib/python3.9/site-packages/certbot/_internal/main.py", 
> line 21, in <module>
>     import josepy as jose
>   File "/usr/local/lib/python3.9/site-packages/josepy/__init__.py", 
> line 40, in <module>
>     from josepy.json_util import (
>   File "/usr/local/lib/python3.9/site-packages/josepy/json_util.py", 
> line 14, in <module>
>     from OpenSSL import crypto
>   File "/usr/local/lib/python3.9/site-packages/OpenSSL/__init__.py", 
> line 8, in <module>
>     from OpenSSL import SSL, crypto
>   File "/usr/local/lib/python3.9/site-packages/OpenSSL/SSL.py", line 
> 9, in <module>
>     from OpenSSL._util import (
>   File "/usr/local/lib/python3.9/site-packages/OpenSSL/_util.py", line 
> 6, in <module>
>     from cryptography.hazmat.bindings.openssl.binding import Binding
>   File 
> "/usr/local/lib/python3.9/site-packages/cryptography/hazmat/bindings/openssl/binding.py", 
> line 15, in <module>
>     from cryptography.exceptions import InternalError
>   File 
> "/usr/local/lib/python3.9/site-packages/cryptography/exceptions.py", 
> line 9, in <module>
>     from cryptography.hazmat.bindings._rust import exceptions as 
> rust_exceptions
> ImportError: 
> /usr/local/lib/python3.9/site-packages/cryptography/hazmat/bindings/_rust.abi3.so: 
> Undefined symbol "EVP_default_properties_is_fips_enabled"
>

And, as noted elsewhere, it's linked to the base system OpenSSL, not the 
ported OpenSSL (make.conf has ssl=openssl).

# ldd 
/usr/local/lib/python3.9/site-packages/cryptography/hazmat/bindings/_rust.abi3.so
/usr/local/lib/python3.9/site-packages/cryptography/hazmat/bindings/_rust.abi3.so:
         libssl.so.111 => /usr/lib/libssl.so.111 (0x321b4b1ac000)
         libcrypto.so.111 => /lib/libcrypto.so.111 (0x321b50234000)
         libthr.so.3 => /lib/libthr.so.3 (0x321b4facd000)
         libgcc_s.so.1 => /lib/libgcc_s.so.1 (0x321b51360000)
         libc.so.7 => /lib/libc.so.7 (0x321b4b9c2000)