Fedora Account System
Red Hat Associate
Red Hat Customer
When using the openssl rand command with the openssl.exe that is provided by the mingw64-openssl package, the command blocks instead of printing random bytes. This problem first appeared in the mingw64-openssl package for Fedora 41 and is also present in subsequent releases. It is not present in the package for Fedora 40. This issue does not occur when cross-compiling the vanilla version of OpenSSL 3.2.2 on Fedora 41. I was able to trace this problem back to a single patch in the spec file: # Downstream only. Reseed DRBG using getrandom(GRND_RANDOM) # https://bugzilla.redhat.com/show_bug.cgi?id=2102541 Patch76: 0076-FIPS-140-3-DRBG.patch When building the package with this patch removed, the problem vanishes. It seems like this patch is not compatible with Windows, so I suggest removing it from the spec file for mingw-openssl. I suspect that https://bugzilla.redhat.com/show_bug.cgi?id=2333301 and https://bugzilla.redhat.com/show_bug.cgi?id=2341677 might be caused by the same patch, but I have not verified this. Reproducible: Always Steps to Reproduce: 1. Install mingw64-openssl 2. Copy /usr/x86_64-w64-mingw32/sys-root/mingw/bin/{openssl.exe,libcrypto-3-x64.dll,libssl-3-x64.dll,zlib1.dll} to a Windows system. 3. Run openssl.exe rand -base64 33 Actual Results: OpenSSL freezes and must be terminated manually. Expected Results: OpenSSL should print a random string.
Thanks, that's interesting new information for bug 2341677
Dmitry - FYI it's proposed to remove the patch 0076-FIPS-140-3-DRBG.patch from mingw builds, as apparently it causes Windows openssl rand commands to hang.
FEDORA-2025-9a6a7e04ac (mingw-openssl-3.2.4-2.fc43) has been submitted as an update to Fedora 43. https://bodhi.fedoraproject.org/updates/FEDORA-2025-9a6a7e04ac
FEDORA-2025-9a6a7e04ac (mingw-openssl-3.2.4-2.fc43) has been pushed to the Fedora 43 stable repository. If problem still persists, please make note of it in this bug report.
Thank you very much for fixing this so quickly. I tested the openssl.exe from mingw-openssl-3.2.4-2.fc43 and was able to verify that the bug is fixed in this version. Is there any chance to get this fix backported to Fedora 42?
Doing that would mean updating Fedora 42 to 3.2.4 (if we preserved git ffwd). Sandro what do you think?
No objections on my part. Thanks.
https://koji.fedoraproject.org/koji/taskinfo?taskID=130117755
FEDORA-2025-7ec6fa845b (mingw-openssl-3.2.4-2.fc42) has been submitted as an update to Fedora 42. https://bodhi.fedoraproject.org/updates/FEDORA-2025-7ec6fa845b
FEDORA-2025-7ec6fa845b has been pushed to the Fedora 42 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-7ec6fa845b` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-7ec6fa845b See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
Thank you very much for backporting the fix. I tested the package from https://bodhi.fedoraproject.org/updates/FEDORA-2025-7ec6fa845b and can confirm that it works fine and fixes the problem.
FEDORA-2025-7ec6fa845b (mingw-openssl-3.2.4-2.fc42) has been pushed to the Fedora 42 stable repository. If problem still persists, please make note of it in this bug report.