Re: building pkgsrc/security/p5-Net-SSLeay: perl is loading libcrypto in an unsafe way

[Sebastian Wiedenroth <wiedi%frubar.net@localhost>]

Hi,

I ran into this as well a few days ago and found [1] from macports.
I tried it like [2] for pkgsrc and it seems to work ok for me, although I did not yet look deeper into this.

Feel free to commit if that makes sense, my new system is not fully configured for pkgsrc development yet.

Best,
Sebastian


[1] https://github.com/macports/macports-ports/blob/f5c07023aec0af236d208f8610d6282fdf56bc49/perl/p5-net-ssleay/files/patch-libdir.diff
[2] https://github.com/wiedi/pkgsrc/commit/dd51c050cd91e9149b51bc414d2c15fda397b951


> Am 19.11.2021 um 17:02 schrieb Hubert Feyrer <hubertf%gmx.de@localhost>:
> 
> Hi,
> 
> building on Mac OS X 12.0.1 on Intel CPU with recent XCode and Command Line Tools and a fresh bootstrap and complete rebuild of all(!) pkgs gives me:
> 
> …
> Do you want to run external tests?
> These tests *will* *fail* if you do not have network connectivity. [n] n
> *** Found OpenSSL-1.1.1l installed in /Volumes/pkgsrc17/pkg
> *** Be sure to use the same compiler and options to compile your OpenSSL, perl,
>     and Net::SSLeay. Mixing and matching compilers is not supported.
> Checking if your kit is complete...
> Looks good
> WARNING: /Volumes/pkgsrc17/pkg/bin/perl is loading libcrypto in an unsafe way
> Abort trap: 6
> 
> 
> A mix of compilers and options for OpenSSL, Net::SSLeay and perl is not likely, as I did a complete build form scratch, including bootstrap of pkgsrc.
> After some googgling[1], it seems the following two commands help as workaround:
> 
> sudo ln -s /Volumes/pkgsrc17/pkg/lib/libssl.1.1.dylib /usr/local/lib/libssl.dylib
> sudo ln -s /Volumes/pkgsrc17/pkg/lib/libcrypto.1.1.dylib  /usr/local/lib/libcrypto.dylib
> 
> 
> Now things work:
> 
> Do you want to run external tests?
> These tests *will* *fail* if you do not have network connectivity. [n] n
> *** Found OpenSSL-1.1.1l installed in /Volumes/pkgsrc17/pkg
> *** Be sure to use the same compiler and options to compile your OpenSSL, perl,
>     and Net::SSLeay. Mixing and matching compilers is not supported.
> Checking if your kit is complete...
> Looks good
> Generating a Unix-style Makefile
> Writing Makefile for Net::SSLeay
> Writing MYMETA.yml and MYMETA.json
> 
> I have no idea where the above error comes from,
> but apparently something has a dependency outside of pkgsrc.
> Can this be fixed somehow?
> 
> I have no idea on Mac OS X’s dynlib handling.
> If more data is needed, let me know.
> 
> Please keep me in CC for answers.
> 
> 
>  - Hubert
> 
> 
> [1] https://github-wiki-see.page/m/kyzn/PRC/wiki/Development-Instructions-%28macOS-Apple-Silicon%29
>