Bug 2005832 - PKCS11 backend not available after OpenSSL 3 rebuild
Summary: PKCS11 backend not available after OpenSSL 3 rebuild
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: openssl-pkcs11
Version: rawhide
Hardware: Unspecified
OS: Unspecified
unspecified
urgent
Target Milestone: ---
Assignee: Jakub Jelen
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks: 2005795
TreeView+ depends on / blocked
 
Reported: 2021-09-20 10:01 UTC by Petr Menšík
Modified: 2021-09-21 13:55 UTC (History)
3 users (show)

Fixed In Version: openssl-pkcs11-0.4.11-6.fc36
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-09-21 13:55:42 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker FC-285 0 None None None 2021-09-20 10:02:58 UTC

Description Petr Menšík 2021-09-20 10:01:51 UTC
Description of problem:
openssl-pkcs11-0.4.11-5.fc36 failed to rebuild during side-tag 

Version-Release number of selected component (if applicable):
openssl-pkcs11-0.4.11-4.fc35.x86_64
openssl-3.0.0-1.fc36.x86_64


How reproducible:
always

Steps to Reproduce:
1. dnf install openssl-pkcs11
2. openssl engine -vv pkcs11

Actual results:
00AC0538E57F0000:error:12800067:DSO support routines:dlfcn_load:could not load the shared library:crypto/dso/dso_dlfcn.c:118:filename(/usr/lib64/engines-3/pkcs11.so): /usr/lib64/engines-3/pkcs11.so: cannot open shared object file: No such file or directory
00AC0538E57F0000:error:12800067:DSO support routines:DSO_load:could not load the shared library:crypto/dso/dso_lib.c:162:
00AC0538E57F0000:error:13000084:engine routines:dynamic_load:dso not found:crypto/engine/eng_dyn.c:422:
00AC0538E57F0000:error:13000074:engine routines:ENGINE_by_id:no such engine:crypto/engine/eng_list.c:343:id=pkcs11


Expected results:
No error

Additional info:
Because PKCS11 is used by bind, it blocks new build of bind (bug #2005795) and freeipa. It is not able to even start, because it uses PKCS11 for compatibility with opendnssec. But it cannot initialize openssl 1.1 module from openssl 3.0 build.

Comment 1 Jakub Jelen 2021-09-21 06:44:06 UTC
The openssl-pkcs11 has hardcoded path to the engines directory. Let me fix that similar way as in c9s, which has this change for some time already.

Comment 2 Jakub Jelen 2021-09-21 06:50:42 UTC
Built in koji:

https://koji.fedoraproject.org/koji/taskinfo?taskID=76046231

Let me know if it works fine for you.

Comment 3 Petr Menšík 2021-09-21 13:55:42 UTC
Sure, thank you, it is much better. Not yet in repository, but it works with downloaded packages from koji.


Note You need to log in before you can comment on or make changes to this bug.