vi/websocat

Force build with libssl3 or libssl1.1 on debian 12

Opened this issue · 5 comments

nbanb commented

Hi Vi

When building websocat on a fresh debian 12 install, there is only libssl3 installed on the system (libssl1.1 is not availiable under debian 12) so websocat build with libssl3 support.

Now if building websocat on a debian12 machine that was upgraded from debian11, both libssl1.1 and libssl3 are installed and :

cargo install --features=ssl --git https://github.com/vi/websocat

is building websocat with libssl1.1

The trouble is after when using websocat not on the build machine but on a fresh install of debian12 (without libssl1.1 : libssl1.1 is not in debian 12 repository) we get the following error :

websocat: error while loading shared libraries: libssl.so.1.1: cannot open shared object file: No such file or directory

The only way was to "purge" libssl1.1 on the build machine to force the use of libssl3 for debian12 systems.
But doing this remove the capacity of the building machine to build websocat for debian11 or debian10 LTS

I did not find a 'feature' of cargo install which let me specify which version of libssl must be used for building.
Is there a way to force the build with libssl3 without removing libssl1.1 of the building machine ?

Thanks and kind regards
nbanba

vi commented

Maybe some environment variable can affect what openssl-sys choses?

Or trying older version of that crate?

What is the version of libssl-dev package? Is it for 1 or for 3?

Why not build Websocat for Debian 10 on Debian 10 itself, keeping 11 clean of old packages?

Note that there is a vendored_openssl crate feature that allows embedding OpenSSL into Websocat executable itself. This allows creation of more universal binaries, but unfortunately also opts out of Debian security updates regarding TLS.

nbanb commented

Hi
Thanks for answer

On the building machine, this behavior happend with

libssl-dev:amd64                                      3.0.11-1~deb12u2

If both libssl 1.1 and libssl3 are installed with libssl-dev in version 3+ :

$ dpkg -l | grep libssl
ii  libssl-dev:amd64                                      3.0.11-1~deb12u2                     amd64        Secure Sockets Layer toolkit - development files
ii  libssl1.1:amd64                                       1.1.1w-0+deb11u1                     amd64        Secure Sockets Layer toolkit - shared libraries
ii  libssl3:amd64                                         3.0.11-1~deb12u2                     amd64        Secure Sockets Layer toolkit - shared libraries

Then, the build will use libssl1.1 even if libssl-dev is in version 3+

Why not build Websocat for Debian 10 on Debian 10 itself, keeping 11 clean of old packages?

Because I will have to maintien 6 building machines for my project :
ARM64 debian10 + debian11 + debian12
AMD64 debian10 + debian11 + debian12

Today, I'm having only 2 building machines, 1 ARM64 and 1 AMD64 (I can cross-compile but users of my project told me that native build works better on arm64)

Kind regards
nbanba

vi commented

I haven't tried myself, but maybe you can experiment with OPENSSL_LIBS environment variable, pointing it to specific so files? (or maybe just setting it to ssl3)

nbanb commented

Sorry, I did already try with ssl3 :

$ cargo install --features=ssl3 --git https://github.com/vi/websocat
    Updating git repository `https://github.com/vi/websocat`
  Installing websocat v1.13.0 (https://github.com/vi/websocat#258e7e89)
error: failed to compile `websocat v1.13.0 (https://github.com/vi/websocat#258e7e89)`, intermediate artifacts can be found at `/tmp/cargo-install8BWPHQ`.
To reuse those artifacts with a future compilation, set the environment variable `CARGO_TARGET_DIR` to that path.

Caused by:
  Package `websocat v1.13.0 (/home/nba/.cargo/git/checkouts/websocat-d4b86660a0a61d76/258e7e8)` does not have the feature `ssl3`

I will try with OPENSSL_LIBS environment variable
Thanks
Regards
nbanba

nbanb commented

Hi

OPENSSL_LIBS=/usr/lib/x86_64-linux-gnu/libssl.so.3 cargo install --features=ssl --git https://github.com/vi/websocat --force

is working

Thanks

Kind regards
nbanba