Bug 2084523
| Summary: | botan2 misses Missing dependency: libcrypt.so.1.1 (OpenSSL1.1) not present on F36 | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Philipp Raich <philipp.raich> |
| Component: | botan2 | Assignee: | Ben Kircher <bkircher> |
| Status: | CLOSED WORKSFORME | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | high | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 36 | CC: | bkircher, germano.massullo, nonamedotc, thebudget72, thomas.moschny, todd_lewis, vitaly |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-05-16 08:08:54 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Philipp Raich
2022-05-12 10:52:55 UTC
> $ ldd /usr/bin/keepassxc
> [...]
> libcrypto.so.1.1 => not found
> [...]
May be better to link against libcrypto.so.3 from the f36 installed openssl-libs-3.0.2 package so that installing openssl1.1 is not necessary.
In any case, yeah, missing dependencies in keypassxc.
I cannot reproduce on F36. Have you messed up with testing updates? Neither keepassxc nor F36 were installed from testing repos on my side. Is there a way you had OpenSSL1.1 *not* removed by the upgrade to F36, either by manual install or by dependency to other packages? Is there another explanation? I don't know how libcrypt.so.1.1 would be removed by the release-upgrade on my machine if keepasscx had it declared a dependency. KeePassXC uses botan2 library for cryptographic operations. botan2-2.19.1-1.fc36 is still using legacy OpenSSL 1.1: libcrypto.so.1.1()(64bit) libcrypto.so.1.1(OPENSSL_1_1_0)(64bit) You should ask botan2 maintainer to rebuild against OpenSSL 3.0. OK... but then I don't understand dependency resolution it seems. keepassxc requires libbotan-2.so-19, which is provided by botan2 (it seems, don't know how this is derived from the dependency), which again requires libcrypt.so.1.1, which obviously is not present? I don't understand how this can be the case - aren't the dependencies declared and resolved accordingly? Does dependency resolution not work for libs/shared objects? Just updated to Fedora 36 and have the exact same problem. Had to remove KeePassXC and install it from flatpak Ehy folks, I installed a fresh Fedora 36 VM and definitely I cannot reproduce. KeepassXC installation triggers the installation of openssl1.1 and any attempt of uninstallation of openssl1.1 triggers the removal of KeepassXC. Moreover KeepassXC is perfectly working, so for my it's not a bug. [root@localhost-live a]# dnf install keepassxc Fedora 36 - x86_64 11 MB/s | 81 MB 00:07 Fedora 36 openh264 (From Cisco) - x86_64 1.8 kB/s | 2.5 kB 00:01 Fedora Modular 36 - x86_64 1.8 MB/s | 2.4 MB 00:01 Fedora 36 - x86_64 - Updates 6.8 MB/s | 13 MB 00:01 Fedora Modular 36 - x86_64 - Updates 2.2 MB/s | 1.9 MB 00:00 Ultima verifica della scadenza dei metadati: 0:00:01 fa il dom 15 mag 2022, 19:49:13. Dipendenze risolte. ============================================================================================================== Package Architecture Version Repository Size ============================================================================================================== Installing: keepassxc x86_64 2.7.1-2.fc36 updates 7.9 M Installazione dipendenze: botan2 x86_64 2.19.1-1.fc36 fedora 2.0 M minizip x86_64 3.0.2-6.fc36 fedora 70 k openssl1.1 x86_64 1:1.1.1n-1.fc36 fedora 1.5 M Riepilogo della transazione ============================================================================================================== Installati 4 pacchetti Dimensione totale dello scaricamento: 11 M Dimensione installata: 39 M Procedere [s/N]: s Scaricamento dei pacchetti: (1/4): minizip-3.0.2-6.fc36.x86_64.rpm 325 kB/s | 70 kB 00:00 (2/4): openssl1.1-1.1.1n-1.fc36.x86_64.rpm 3.9 MB/s | 1.5 MB 00:00 (3/4): botan2-2.19.1-1.fc36.x86_64.rpm 4.1 MB/s | 2.0 MB 00:00 (4/4): keepassxc-2.7.1-2.fc36.x86_64.rpm 12 MB/s | 7.9 MB 00:00 -------------------------------------------------------------------------------------------------------------- Totale 8.8 MB/s | 11 MB 00:01 Esecuzione del controllo di transazione Controllo di transazione eseguito con successo. Test di transazione in corso Test di transazione eseguito con successo Transazione in corso Preparazione in corso : 1/1 Installing : openssl1.1-1:1.1.1n-1.fc36.x86_64 1/4 Installing : botan2-2.19.1-1.fc36.x86_64 2/4 Installing : minizip-3.0.2-6.fc36.x86_64 3/4 Installing : keepassxc-2.7.1-2.fc36.x86_64 4/4 Esecuzione scriptlet in corso: keepassxc-2.7.1-2.fc36.x86_64 4/4 Verifica in corso : botan2-2.19.1-1.fc36.x86_64 1/4 Verifica in corso : minizip-3.0.2-6.fc36.x86_64 2/4 Verifica in corso : openssl1.1-1:1.1.1n-1.fc36.x86_64 3/4 Verifica in corso : keepassxc-2.7.1-2.fc36.x86_64 4/4 Installati: botan2-2.19.1-1.fc36.x86_64 keepassxc-2.7.1-2.fc36.x86_64 minizip-3.0.2-6.fc36.x86_64 openssl1.1-1:1.1.1n-1.fc36.x86_64 Fatto! [root@localhost-live a]# dnf remove --assumeno openssl1.1 Dipendenze risolte. ============================================================================================================================ Package Architecture Version Repository Size ============================================================================================================================ Rimozione in corso: openssl1.1 x86_64 1:1.1.1n-1.fc36 @fedora 3.7 M Rimozione dei pacchetti dipendenti in corso: keepassxc x86_64 2.7.1-2.fc36 @updates 29 M Rimozione dipendenze inutilizzate: botan2 x86_64 2.19.1-1.fc36 @fedora 5.9 M minizip x86_64 3.0.2-6.fc36 @fedora 168 k Riepilogo della transazione ============================================================================================================================ Rimossi 4 pacchetti Spazio liberato: 39 M Operazione annullata. Hi all! > You should ask botan2 maintainer to rebuild against OpenSSL 3.0. botan2 in F36 builds against the compat-openssl11 package and in some future Fedora release will drop the OpenSSL provider altogether. Upstream has no incentives to support OpenSSL 3 [1]. (I built 2.18 once against OpenSSL 3. It works, but you get a lot of deprecation warnings during build.) Upstream will drop support for OpenSSL provider altogether in the future. Package in epel9 already builds without OpenSSL provider. [1]: https://github.com/randombit/botan/issues/2842 Yeah, just tried to reproduce on a fresh F36 Workstation install. All is good. Maybe the system upgrade was b0rked? [bk@localhost-live ~]$ sudo dnf install keepassxc <snip> Dependencies resolved. ============================================================================================================================== Package Architecture Version Repository Size ============================================================================================================================== Installing: keepassxc x86_64 2.7.1-2.fc36 updates 7.9 M Installing dependencies: botan2 x86_64 2.19.1-1.fc36 fedora 2.0 M minizip x86_64 3.0.2-6.fc36 fedora 70 k openssl1.1 x86_64 1:1.1.1n-1.fc36 fedora 1.5 M qt5-qtsvg x86_64 5.15.3-1.fc36 fedora 186 k Transaction Summary ============================================================================================================================== Install 5 Packages Total download size: 12 M Installed size: 39 M Is this ok [y/N]: @Philipp Raich: Just make sure you have openssl1.1 installed. There is no problem with both versions of OpenSSL to be installed. Closing as this all works as expected. Please feel free to reopen if I missed something. Yeah, you missed something. This isn't about botan2, keepassxc, or F36. It's about
keepassxc working on F35 -> Upgrade to F36 -> keepasscx not working on F36
> [...] Maybe the system upgrade was b0rked?
Bingo. Not this particular host's upgrade, but the upgrade process itself will "upgrade" away openssl1.1, leaving dependent binaries unusable.
You may be correct that this isn't a problem with botan2, or how it's packaged. Likewise keepassxc. But "worksforme" doesn't solve this problem, or prevent future occurrences of the same class of problem with system upgrades.
BTW, after my F35->F36 upgrade, I tried "dnf reinstall keepassxc" and it didn't solve the problem. I had to "ldd /usr/bin/keepassxc", see the missing library, see what provided it, and install that. What I have not done is to go through all the binaries on the system and see what else is missing. I'm starting to think I need to.
(In reply to todd_lewis from comment #10) > Not this particular host's upgrade, but the upgrade process itself will "upgrade" away openssl1.1, leaving dependent binaries unusable. I have upgraded 4 machines from F35 to F36 without problems, so this is very strange. Can you please show output of # dnf remove --assumeno openssl1.1 # dnf remove --assumeno keepassxc # dnf repolist > $ dnf remove --assumeno openssl1.1 > Dependencies resolved. > ==================================================================================================== > Package Architecture Version Repository Size > ==================================================================================================== > Removing: > openssl1.1 x86_64 1:1.1.1n-1.fc36 @fedora 3.7 M > > Transaction Summary > ==================================================================================================== > Remove 1 Package > > Freed space: 3.7 M > Operation aborted. AND > $ dnf remove --assumeno keepassxc > Dependencies resolved. > ==================================================================================================== > Package Architecture Version Repository Size > ==================================================================================================== > Removing: > keepassxc x86_64 2.7.1-2.fc36 @updates 29 M > Removing unused dependencies: > botan2 x86_64 2.19.1-1.fc36 @fedora 5.9 M (In reply to Germano Massullo from comment #11) > (In reply to todd_lewis from comment #10) > > Not this particular host's upgrade, but the upgrade process itself will "upgrade" away openssl1.1, leaving dependent binaries unusable. > > I have upgraded 4 machines from F35 to F36 without problems, so this is very > strange. Can you please show output of > > # dnf remove --assumeno openssl1.1 > # dnf remove --assumeno keepassxc > # dnf repolist Philipp, your output is completely different from mine [1] You forgot to run # dnf repolist [1]: # dnf remove --assumeno openssl1.1 Dipendenze risolte. ==================================================================================================================================== Package Architecture Version Repository Size ==================================================================================================================================== Rimozione in corso: openssl1.1 x86_64 1:1.1.1n-1.fc36 @fedora 3.7 M Rimozione dei pacchetti dipendenti in corso: gimp x86_64 2:2.10.30-1.fc36.1 @fedora 104 M gocryptfs x86_64 1.8.0-5.fc35 @fedora 5.2 M keepassxc x86_64 2.7.1-2.fc36 @updates 29 M libc-client x86_64 2007f-26.fc33 @fedora 1.5 M open-eid noarch 17.12-11.fc36 @fedora 0 python2-numpy x86_64 1:1.16.4-10.fc33 @fedora 19 M python2-pillow x86_64 6.2.2-5.fc33 @updates 2.4 M python2-six noarch 1.15.0-2.fc33 @fedora 109 k python2.7 x86_64 2.7.18-21.fc36 @fedora 56 M qca-ossl x86_64 2.2.1-15.fc35 @fedora 336 k Rimozione dipendenze inutilizzate: babl x86_64 0.1.92-1.fc36 @updates 2.1 M botan2 x86_64 2.19.1-1.fc36 @fedora 5.9 M firefox-pkcs11-loader x86_64 3.13.6-7.fc36 @fedora 42 k gegl04 x86_64 0.4.36-1.fc36 @updates 14 M gimp-libs x86_64 2:2.10.30-1.fc36.1 @fedora 1.8 M libdigidocpp x86_64 3.14.7-1.fc36 @fedora 2.4 M libmypaint x86_64 1.6.1-6.fc36 @fedora 911 k libwmf x86_64 0.2.12-8.fc36 @fedora 425 k mypaint-brushes noarch 1.3.1-5.fc36 @fedora 2.3 M pygobject2 x86_64 2.28.7-15.fc36 @fedora 926 k pygtk2 x86_64 2.24.0-36.fc36 @fedora 4.0 M python2-cairo x86_64 1.18.2-11.fc36 @fedora 320 k python2-olefile noarch 0.46-12.fc33 @fedora 256 k python2-setuptools noarch 41.2.0-4.fc34 @fedora 3.1 M qdigidoc x86_64 4.2.9-2.fc36 @fedora 4.9 M webextension-token-signing x86_64 1.1.5-1.fc36 @fedora 263 k xalan-c x86_64 1.12.0-17.fc36 @fedora 5.4 M xml-security-c x86_64 2.0.2-9.fc35 @fedora 1.0 M Riepilogo della transazione ==================================================================================================================================== Rimossi 29 pacchetti Spazio liberato: 271 M Operazione annullata. # dnf remove --assumeno keepassxc Dipendenze risolte. ==================================================================================================================================== Package Architecture Version Repository Size ==================================================================================================================================== Rimozione in corso: keepassxc x86_64 2.7.1-2.fc36 @updates 29 M Rimozione dipendenze inutilizzate: botan2 x86_64 2.19.1-1.fc36 @fedora 5.9 M Riepilogo della transazione ==================================================================================================================================== Rimossi 2 pacchetti Spazio liberato: 35 M Operazione annullata. (In reply to Germano Massullo from comment #13) > Philipp, your output is completely different from mine [1] That's weird - and what I was wondering about in comment #3. > You forgot to run > # dnf repolist > sorry. Don't know why my repolist looks like it does, besides the occasional COPRs (I always wondered about the modular repos, but I assumed they are the same for everyone since ~F33/F34). > $ dnf repolist > copr:copr.fedorainfracloud.org:jkonecny:kakoune Copr repo for kakoune owned by jkonecny > copr:copr.fedorainfracloud.org:luminoso:Signal-Desktop Copr repo for Signal-Desktop owned by luminoso > fedora Fedora 36 - x86_64 > fedora-cisco-openh264 Fedora 36 openh264 (From Cisco) - x86_64 > fedora-modular Fedora Modular 36 - x86_64 > flatcap-neomutt Copr repo for neomutt owned by flatcap > home_TheLocehiliosan_yadm Yet Another Dotfiles Manager (Fedora_32) > keybase keybase > rpmfusion-free RPM Fusion for Fedora 36 - Free > rpmfusion-free-updates RPM Fusion for Fedora 36 - Free - Updates > sublime-text Sublime Text - x86_64 - Stable > updates Fedora 36 - x86_64 - Updates > updates-modular Fedora Modular 36 - x86_64 - Updates > $ sudo dnf list keepassxc > Installed Packages > keepassxc.x86_64 2.7.1-2.fc36 if you run # dnf -y update # dnf distro-sync --assumeno what is the output? (In reply to Germano Massullo from comment #15) > # dnf -y update > # dnf distro-sync --assumeno dnf update installed a few unrelated updates > $ dnf distro-sync --assumeno > Last metadata expiration check: 0:00:58 ago on Mon 16 May 2022 02:28:51 PM CEST. > Dependencies resolved. > Nothing to do. > Complete! The output from the previous commands (comment #11) remain the same I very much appreciate your effort and time - should we take this discussion somewhere else? (In reply to Philipp Raich from comment #16) > I very much appreciate your effort and time - should we take this discussion somewhere else? Fedora package maintainers take quality very seriously. This committment is what makes Fedora one of the best distributions on the internet :-) I will bring this matter to the development mailing list because I ran out of ideas about this problem. Pity that thebudget72 removed himself from the ticket rather than helping debugging the problem (In reply to Germano Massullo from comment #11) > (In reply to todd_lewis from comment #10) > > Not this particular host's upgrade, but the upgrade process itself will "upgrade" away openssl1.1, leaving dependent binaries unusable. > > I have upgraded 4 machines from F35 to F36 without problems, so this is very > strange. Can you please show output of > > # dnf remove --assumeno openssl1.1 > # dnf remove --assumeno keepassxc > # dnf repolist Sure. Here you go: [root@tango ~]# dnf remove --assumeno openssl1.1 Dependencies resolved. ================================================================================================================================== Package Architecture Version Repository Size ================================================================================================================================== Removing: openssl x86_64 1:1.1.1n-1.fc35 @updates 1.1 M Removing dependent packages: NetworkManager-ovs x86_64 1:1.32.12-2.fc35 @updates 87 k Removing unused dependencies: dpdk x86_64 2:20.11-2.fc35 @fedora 20 M openvswitch x86_64 2.15.0-8.fc35 @updates 5.3 M Transaction Summary ================================================================================================================================== Remove 4 Packages Freed space: 27 M Operation aborted. [root@tango ~]# dnf remove --assumeno keepassxc Dependencies resolved. ================================================================================================================================== Package Architecture Version Repository Size ================================================================================================================================== Removing: keepassxc x86_64 2.7.1-2.fc35 @updates 29 M Removing unused dependencies: botan2 x86_64 2.18.2-1.fc35 @updates 5.8 M Transaction Summary ================================================================================================================================== Remove 2 Packages Freed space: 35 M Operation aborted. [root@tango ~]# dnf repolist repo id repo name adobe-linux-x86_64 Adobe Systems Incorporated fedora Fedora 35 - x86_64 fedora-cisco-openh264 Fedora 35 openh264 (From Cisco) - x86_64 fedora-modular Fedora Modular 35 - x86_64 google-chrome google-chrome google-earth-pro google-earth-pro phracek-PyCharm Copr repo for PyCharm owned by phracek rpmfusion-free RPM Fusion for Fedora 35 - Free rpmfusion-free-updates RPM Fusion for Fedora 35 - Free - Updates rpmfusion-nonfree RPM Fusion for Fedora 35 - Nonfree rpmfusion-nonfree-nvidia-driver RPM Fusion for Fedora 35 - Nonfree - NVIDIA Driver rpmfusion-nonfree-steam RPM Fusion for Fedora 35 - Nonfree - Steam rpmfusion-nonfree-updates RPM Fusion for Fedora 35 - Nonfree - Updates skype-stable skype (stable) slack slack teams teams trailsong trailsong Fedora-35 for x86_64 trailsong-generic trailsong Fedora-generic for x86_64 updates Fedora 35 - x86_64 - Updates updates-modular Fedora Modular 35 - x86_64 - Updates [root@tango ~]# > 2.18.2-1.fc35
Your system is still on Fedora 35, which is not affected by botan2 issue.
(In reply to Vitaly Zaitsev from comment #19) > > 2.18.2-1.fc35 > > Your system is still on Fedora 35, which is not affected by botan2 issue. :facepalm: Sorry. I'm on the wrong box. I'll get that info for you in a bit. Here's the info you requested, from the correct machine this time. I.e., this is the machine where I manually installed openssl1.1 to get keepassxc to work again. (BTW, I do have another machine that was upgraded from F35 to F36 where the openssl1.1 has not been installed.) Here goes: [root@tarna2 ~]# uname -a Linux tarna2 5.17.6-300.fc36.x86_64 #1 SMP PREEMPT Mon May 9 15:47:11 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux [root@tarna2 ~]# dnf remove --assumeno openssl1.1 Dependencies resolved. ================================================================================================== Package Architecture Version Repository Size ================================================================================================== Removing: openssl1.1 x86_64 1:1.1.1n-1.fc36 @fedora 3.7 M Transaction Summary ================================================================================================== Remove 1 Package Freed space: 3.7 M Operation aborted. [root@tarna2 ~]# dnf remove --assumeno keepassxc Dependencies resolved. ================================================================================================== Package Architecture Version Repository Size ================================================================================================== Removing: keepassxc x86_64 2.7.1-2.fc36 @updates 29 M Removing unused dependencies: botan2 x86_64 2.19.1-1.fc36 @fedora 5.9 M minizip x86_64 3.0.2-6.fc36 @fedora 168 k Transaction Summary ================================================================================================== Remove 3 Packages Freed space: 35 M Operation aborted. [root@tarna2 ~]# dnf repolist repo id repo name bluejeans Blue Jeans Network, Inc. - x86_64 software and updates fedora Fedora 36 - x86_64 fedora-cisco-openh264 Fedora 36 openh264 (From Cisco) - x86_64 fedora-modular Fedora Modular 36 - x86_64 google-chrome google-chrome google-earth google-earth google-earth-pro google-earth-pro google-talkplugin google-talkplugin rpmfusion-free RPM Fusion for Fedora 36 - Free rpmfusion-free-updates RPM Fusion for Fedora 36 - Free - Updates rpmfusion-nonfree RPM Fusion for Fedora 36 - Nonfree rpmfusion-nonfree-updates RPM Fusion for Fedora 36 - Nonfree - Updates slack slack trailsong trailsong Fedora-36 for x86_64 trailsong-generic trailsong Fedora-generic for x86_64 updates Fedora 36 - x86_64 - Updates updates-modular Fedora Modular 36 - x86_64 - Updates [root@tarna2 ~]# - How did you do the update? - On a machine where, after the update, keepassxc is installed, but openssl1.1 is not, what does `rpm -Va --nofiles` show? (In reply to Thomas Moschny from comment #22) > - How did you do the update? if [ -f /etc/os-release ] ; then . /etc/os-release version=$(($VERSION_ID + 1)) fi dnf -y upgrade --refresh --best --allowerasing dnf -y install dnf-plugin-system-upgrade dnf -y system-upgrade download --refresh --releasever=$version --allowerasing dnf -y system-upgrade reboot > - On a machine where, after the update, keepassxc is installed, but > openssl1.1 is not, what does `rpm -Va --nofiles` show? Nothing at all. Behold: [root@wfh ~]# rpm -Va --nofiles [root@wfh ~]# I also looked for other executables with ldd sadness. Output is (rpm, binary, missing library): [root@wfh ~]# (for f in $( find /usr/bin /usr/sbin /usr/libexec -type f ) ; do while read lib rest ; do printf "%-38s %-28s %s\n" $(rpm -qf $f) $f $lib ; done < <( ldd $f 2>/dev/null | grep -v -e '(0x' -e 'statically linked' ) ; done ) | sort botan2-2.19.1-1.fc36.x86_64 /usr/bin/botan libcrypto.so.1.1 keepassxc-2.7.1-2.fc36.x86_64 /usr/bin/keepassxc-cli libcrypto.so.1.1 keepassxc-2.7.1-2.fc36.x86_64 /usr/bin/keepassxc libcrypto.so.1.1 keepassxc-2.7.1-2.fc36.x86_64 /usr/bin/keepassxc-proxy libcrypto.so.1.1 transmission-common-3.00-9.fc35.x86_64 /usr/bin/transmission-create libcrypto.so.1.1 transmission-common-3.00-9.fc35.x86_64 /usr/bin/transmission-create libssl.so.1.1 transmission-common-3.00-9.fc35.x86_64 /usr/bin/transmission-edit libcrypto.so.1.1 transmission-common-3.00-9.fc35.x86_64 /usr/bin/transmission-edit libssl.so.1.1 transmission-common-3.00-9.fc35.x86_64 /usr/bin/transmission-remote libcrypto.so.1.1 transmission-common-3.00-9.fc35.x86_64 /usr/bin/transmission-remote libssl.so.1.1 transmission-common-3.00-9.fc35.x86_64 /usr/bin/transmission-show libcrypto.so.1.1 transmission-common-3.00-9.fc35.x86_64 /usr/bin/transmission-show libssl.so.1.1 transmission-gtk-3.00-9.fc35.x86_64 /usr/bin/transmission-gtk libcrypto.so.1.1 transmission-gtk-3.00-9.fc35.x86_64 /usr/bin/transmission-gtk libssl.so.1.1 (Noting that transmission-gtk and transmission-common are "fc35" rpms. No idea if that's relevant.) FWIW, maybe it's worth looking at the history entry
$ sudo dnf history list --reverse
and peek at the last `system-upgrade upgrade` entry.
$ sudo dnf history info <ID> | less
Maybe we can see then if openssl1.1 got installed properly (it should be). There should be a line
Install openssl1.1-… @fedora
or something.
Also, maybe it is not a very good idea to pass -y and --allowerasing blindly in a system upgrade without reviewing the changes?
(In reply to todd_lewis from comment #23) > (In reply to Thomas Moschny from comment #22) > > - On a machine where, after the update, keepassxc is installed, but > > openssl1.1 is not, what does `rpm -Va --nofiles` show? > > Nothing at all. Behold: > > [root@wfh ~]# rpm -Va --nofiles > [root@wfh ~]# This is really strange. Could it be that another package (incorrectly) claims to provide this library? What does `rpm -q --requires botan2 | grep libcrypto | xargs rpm -q --whatprovides` show? I on my side did the upgrade over "Gnome Software" (Application Manager for Gnome). this is what dnf history shows for that transaction > $ sudo dnf history info 978 | grep openssl > Upgrade openssl-1:3.0.2-5.fc36.x86_64 @updates > Upgrade openssl-devel-1:3.0.2-5.fc36.x86_64 @updates > Upgrade openssl-libs-1:3.0.2-5.fc36.i686 @updates > Upgrade openssl-libs-1:3.0.2-5.fc36.x86_64 @updates > Upgrade apr-util-openssl-1.6.1-20.fc36.x86_64 @fedora > Upgrade openssl-pkcs11-0.4.11-8.fc36.i686 @fedora > Upgrade openssl-pkcs11-0.4.11-8.fc36.x86_64 @fedora > Upgrade xmlsec1-openssl-1.2.33-2.fc36.x86_64 @fedora > Upgraded openssl-1:1.1.1n-1.fc35.x86_64 @@System > Upgraded openssl-devel-1:1.1.1n-1.fc35.x86_64 @@System > Upgraded openssl-libs-1:1.1.1n-1.fc35.i686 @@System > Upgraded openssl-libs-1:1.1.1n-1.fc35.x86_64 @@System > Upgraded apr-util-openssl-1.6.1-17.fc35.x86_64 @@System > Upgraded openssl-pkcs11-0.4.11-4.fc35.i686 @@System > Upgraded openssl-pkcs11-0.4.11-4.fc35.x86_64 @@System > Upgraded xmlsec1-openssl-1.2.29-4.fc35.x86_64 @@System > $ rpm -Va --nofiles shows > Unsatisfied dependencies for dnf-plugin-nvidia-2.0-1.el8.noarch: > python(abi) = 3.6 is needed by (installed) dnf-plugin-nvidia-2.0-1.el8.noarch > Unsatisfied dependencies for llvm-amdgpu-13.0.0.21295.40300-52.el7.x86_64: > libtinfo.so.5()(64bit) is needed by (installed) llvm-amdgpu-13.0.0.21295.40300-52.el7.x86_64 > perl(Hash::Util) is needed by (installed) llvm-amdgpu-13.0.0.21295.40300-52.el7.x86_64 seems unrelated... hmmm... but this might be something > $ rpm -q --requires botan2 | grep libcrypto | xargs rpm -q --whatprovides > nsight-compute-2020.1.2-2020.1.2.4-1.x86_64 > nsight-compute-2020.2.0-2020.2.0.18-1.x86_64 > nsight-compute-2020.2.1-2020.2.1.8-1.x86_64 > nsight-compute-2020.3.0-2020.3.0.18-1.x86_64 > nsight-compute-2020.3.1-2020.3.1.4-1.x86_64 > openssl1.1-1.1.1n-1.fc36.x86_64 > nsight-compute-2020.1.2-2020.1.2.4-1.x86_64 > nsight-compute-2020.2.0-2020.2.0.18-1.x86_64 > nsight-compute-2020.2.1-2020.2.1.8-1.x86_64 > nsight-compute-2020.3.0-2020.3.0.18-1.x86_64 > nsight-compute-2020.3.1-2020.3.1.4-1.x86_64 > openssl1.1-1.1.1n-1.fc36.x86_64 I actually thought I had all nVidia/CUDA stuff removed at some point... I checked yesterday, on another box everything went with the upgrade, keepass works and `dnf remove --assumeno openssl1.1` and `dnf remove --assuemno keepassx` show the expected/correct results. (In reply to Thomas Moschny from comment #25) > This is really strange. Could it be that another package (incorrectly) > claims to provide this library? > > What does `rpm -q --requires botan2 | grep libcrypto | xargs rpm -q > --whatprovides` show? I doff my red fedora to you, sir! Sometimes figuring out the right question is much trickier that getting the right answer. Behold: ---------------- start ------------------- [root@tarna2 ~]# rpm -q --requires botan2 | grep libcrypto | xargs rpm -q --whatprovides xagt-34.28.6-1.el7.x86_64 openssl1.1-1.1.1n-1.fc36.x86_64 xagt-34.28.6-1.el7.x86_64 openssl1.1-1.1.1n-1.fc36.x86_64 [root@tarna2 ~]# [root@tarna2 ~]# ls -l $(rpm -ql xagt | grep /libcrypto) lrwxrwxrwx. 1 root root 16 Feb 24 11:02 /opt/fireeye/lib/libcrypto.so -> libcrypto.so.1.1 -rwx------. 1 root root 3485640 Feb 24 10:46 /opt/fireeye/lib/libcrypto.so.1.1 [root@tarna2 ~]# [root@tarna2 ~]# rpm -qi xagt Name : xagt Version : 34.28.6 Release : 1.el7 Architecture: x86_64 Install Date: Fri 13 May 2022 05:19:30 AM EDT Group : Applications/System Size : 118451798 License : FireEye Signature : (none) Source RPM : xagt-34.28.6-1.el7.src.rpm Build Date : Thu 24 Feb 2022 11:02:28 AM EST Build Host : epsign002.eng.fireeye.com Summary : FireEye Endpoint (HX) agent Description : FireEye Endpoint xAgent protects your networks by monitoring each endpoint device or host, collecting data of events occurring on the endpoint, and identifying threat activity and evidence on the host. ---------------- end ------------------- My workplace security requires we run this security agent on anything that will run it. I'm a little surprised to see that it's been updating itself. `dnf history info xagt` shows only one transaction: the initial install of ./xagt-31.28.4-1.el7.x86_64.rpm on Mon 27 Apr 2020. It's been through a few Fedora versions w/o issue before. OK, I think I finally understand - completely my fault.
nsight-compute was never cleanly removed from my system (my fault), and the switch from OpenSSL1.1 to 3.x together with the libcrypto.so.1.1 apparently provided by nsight-compute (which of course was missing) borked my dependecies.
Removed the (incomplete) nsight-compute packages, now this looks right again:
> dnf remove --assumeno openssl1.1
> Dependencies resolved.
> =========================================================================================================
> Package Architecture Version Repository Size
> =========================================================================================================
> Removing:
> openssl1.1 x86_64 1:1.1.1n-1.fc36 @fedora 3.7 M
> Removing dependent packages:
> boinc-client x86_64 7.16.11-6.fc35 @fedora 1.4 M
> boinc-manager x86_64 7.16.11-6.fc35 @fedora 5.6 M
> gimp x86_64 2:2.10.30-1.fc36.1 @fedora 104 M
> keepassxc x86_64 2.7.1-2.fc36 @updates 29 M
> python2-numpy x86_64 1:1.16.4-10.fc33 @fedora 19 M
> python2-numpy-f2py x86_64 1:1.16.4-10.fc33 @fedora 1.3 M
> python2-six noarch 1.15.0-2.fc33 @fedora 109 k
> python2.7 x86_64 2.7.18-21.fc36 @fedora 56 M
> python3.6 x86_64 3.6.15-8.fc36 @fedora 79 M
> transmission x86_64 3.00-9.fc35 @fedora 0
> Removing unused dependencies:
> botan2 x86_64 2.19.1-1.fc36 @fedora 5.9 M
> lcms2 i686 2.13.1-1.fc36 @fedora 458 k
> libappindicator-gtk3 x86_64 12.10.0-32.fc36 @fedora 101 k
> libdbusmenu x86_64 16.04.0-19.fc36 @fedora 545 k
> libdbusmenu-gtk3 x86_64 16.04.0-19.fc36 @fedora 97 k
> libindicator-gtk3 x86_64 12.10.1-22.fc36 @fedora 212 k
> libnatpmp x86_64 20150609-15.fc36 @fedora 33 k
> pygobject2 x86_64 2.28.7-15.fc36 @fedora 926 k
> pygtk2 x86_64 2.24.0-36.fc36 @fedora 4.0 M
> python2-cairo x86_64 1.18.2-11.fc36 @fedora 320 k
> python2-setuptools noarch 41.2.0-4.fc34 @fedora 3.1 M
> tix x86_64 1:8.4.3-33.fc36 @fedora 1.0 M
> transmission-common x86_64 3.00-9.fc35 @fedora 1.2 M
> transmission-gtk x86_64 3.00-9.fc35 @fedora 3.5 M
> wxGTK3-webview x86_64 3.0.5.1-7.fc36 @fedora 164 k
>
> Transaction Summary
> =========================================================================================================
> Remove 26 Packages
>
> Freed space: 321 M
> Operation aborted.
Thank you all!
Nice find! I confirm that openssl1.1 needs to be manually installed for it to work: ``` [XXX@XXX ~]$ keepassxc bash: keepassxc: command not found [XXX@XXX ~]$ sudo dnf install -y keepassxc Last metadata expiration check: XXX on XXX. Dependencies resolved. ================================================================================================================================ Package Architecture Version Repository Size ================================================================================================================================ Installing: keepassxc x86_64 2.7.1-2.fc36 updates 7.9 M Installing dependencies: botan2 x86_64 2.19.1-1.fc36 fedora 2.0 M Transaction Summary ================================================================================================================================ Install 2 Packages Total download size: 9.9 M Installed size: 35 M Downloading Packages: (1/2): botan2-2.19.1-1.fc36.x86_64.rpm 1.8 MB/s | 2.0 MB 00:01 (2/2): keepassxc-2.7.1-2.fc36.x86_64.rpm 5.8 MB/s | 7.9 MB 00:01 -------------------------------------------------------------------------------------------------------------------------------- Total 3.0 MB/s | 9.9 MB 00:03 Running transaction check Transaction check succeeded. Running transaction test Transaction test succeeded. Running transaction Preparing : 1/1 Installing : botan2-2.19.1-1.fc36.x86_64 1/2 Installing : keepassxc-2.7.1-2.fc36.x86_64 2/2 Running scriptlet: keepassxc-2.7.1-2.fc36.x86_64 2/2 Verifying : botan2-2.19.1-1.fc36.x86_64 1/2 Verifying : keepassxc-2.7.1-2.fc36.x86_64 2/2 Installed: botan2-2.19.1-1.fc36.x86_64 keepassxc-2.7.1-2.fc36.x86_64 Complete! [XXXX@XXX ~]$ keepassxc keepassxc: error while loading shared libraries: libcrypto.so.1.1: cannot open shared object file: No such file or directory [XXX@XXX ~]$ sudo dnf install -y openssl1.1 Last metadata expiration check: XXX ago on XXX. Dependencies resolved. ================================================================================================================================ Package Architecture Version Repository Size ================================================================================================================================ Installing: openssl1.1 x86_64 1:1.1.1n-1.fc36 fedora 1.5 M Transaction Summary ================================================================================================================================ Install 1 Package Total download size: 1.5 M Installed size: 3.7 M Downloading Packages: openssl1.1-1.1.1n-1.fc36.x86_64.rpm 4.4 MB/s | 1.5 MB 00:00 -------------------------------------------------------------------------------------------------------------------------------- Total 2.9 MB/s | 1.5 MB 00:00 Running transaction check Transaction check succeeded. Running transaction test Transaction test succeeded. Running transaction Preparing : 1/1 Installing : openssl1.1-1:1.1.1n-1.fc36.x86_64 1/1 Running scriptlet: openssl1.1-1:1.1.1n-1.fc36.x86_64 1/1 Verifying : openssl1.1-1:1.1.1n-1.fc36.x86_64 1/1 Installed: openssl1.1-1:1.1.1n-1.fc36.x86_64 Complete! [XXX@XXX ~]$ keepassxc qt.qpa.wayland: Wayland does not support QWindow::requestActivate() qt.qpa.wayland: Wayland does not support QWindow::requestActivate() ``` See above. Most likely you have some 3rd-party package installed that wrongly declares to provide libcrypto. `rpm -q --requires botan2 | grep libcrypto | xargs rpm -q --whatprovides` should give you a hint which package it is. oh, worked after `sudo dnf remove nsight-compute*` now openssl1.1 is indeed installed together with keepassxc Thanks! (In reply to Thomas Moschny from comment #31) > See above. Most likely you have some 3rd-party package installed that > wrongly declares to provide libcrypto. > > `rpm -q --requires botan2 | grep libcrypto | xargs rpm -q --whatprovides` > should give you a hint which package it is. Hello Thomas, can you explain what that command will return? Since I don't have such packages installed I cannot reproduce in order to understand it. Thank you (In reply to Germano Massullo from comment #33) > (In reply to Thomas Moschny from comment #31) > > See above. Most likely you have some 3rd-party package installed that > > wrongly declares to provide libcrypto. > > > > `rpm -q --requires botan2 | grep libcrypto | xargs rpm -q --whatprovides` > > should give you a hint which package it is. > > Hello Thomas, can you explain what that command will return? Since I don't > have such packages installed I cannot reproduce in order to understand it. > Thank you In that case, pick some other rpm that you do have, like "vim-common" instead of botan2. `rpm -q --requires vim-common` will produce a list of things vim-common requires. "libc.so.6(GLIBC_2.3)(64bit)" is one of those. The last command then becomes `rpm -q --whatprovides 'libc.so.6(GLIBC_2.3)(64bit)'` which produces for me: "glibc-2.35-6.fc36.x86_64". If some other package also claimed to provide "libc.so.6(GLIBC_2.3)(64bit)", it would show up in that output as well. |