libssl error on Rocky 9

[Carlo Giesa]

Hi there!

I'm wondering if we are doing something wrong. I'm getting an error when doing following on a Rocky 9 distribution with the latest gaffer gcc11 version (1.4.8.0) and I tried others with the same result:

gaffer env python

import ssl

The error is:

ImportError: libssl.so.1.1: cannot open shared object file: No such file or directory

In our tests with Rocky 9, we encountered this issue already a while ago outside of Gaffer and we compiled a custom Python with a more recent version of libssl (3.0.7 if I'm not mistaken) that is compatible with Alma 8 and Rocky 9, so we can have a smooth transition between the two OSes.

If I got it right, gaffer gcc11 is compiled in a Rocky 9 container, isn't it? So, how do you handle the ssl? If I remember well, libssl < 3 is not available on Rocky 9. I do not understand the error then.

Greets,
Carlo

[Murray Stevenson]

Hey Carlo!

With Gaffer 1.4+ we've moved to treating OpenSSL as a system dependency given that it is security critical and can require updating to fix vulnerabilities. Distributions also often patch their system OpenSSL libraries, which we've seen to cause problems running tools built against the system OpenSSL within a Gaffer environment providing a vanilla OpenSSL as symbols added to the system OpenSSL may not be available in vanilla OpenSSL.

> If I got it right, gaffer gcc11 is compiled in a Rocky 9 container, isn't it? So, how do you handle the ssl?

We follow the VFX platform recommendation, which is to build on Rocky 8 as glibc 2.28 is the highest version the VFX reference platform allows software to be built against and Rocky 9 is too new with glibc 2.34. Rocky 8's system OpenSSL is 1.1.

> If I remember well, libssl < 3 is not available on Rocky 9. I do not understand the error then.

RHEL/Rocky/Alma 9 provides a compat-openssl11 package with OpenSSL 1.1, installing this should get you going.

Cheers,

M

--
You received this message because you are subscribed to the Google Groups "gaffer-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to gaffer-dev+...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/gaffer-dev/0440db84-5b4e-4764-b371-236fad33156fn%40googlegroups.com.

[Carlo Giesa]

Hey Murray!

Thanks a lot for all those clarifications. That makes things much clearer to us.

We'll check out the OpenSSL 1.1 solution for Rocky 9. I'll keep you posted.

We are keen to move to Rocky 9 since several DCCs mention this distribution as the new system requirement.

Greets,

Carlo

To view this discussion on the web visit https://groups.google.com/d/msgid/gaffer-dev/CAOjnMawVkho_%2BHo3ZxcwOBghp3r%3D1ZKfSd5zDO0z2TM%3D5LY7AA%40mail.gmail.com.

[Carlo Giesa]

It works! Thanks for the hint!

Greets,
Carlo