find_library for libcrypto and libssl on Catalina returns the unversioned library

[worldwise001]

BPO	38873
Nosy	@ned-deily, @worldwise001

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = None
created_at = <Date 2019-11-21.02:37:22.129>
labels = ['ctypes', 'type-bug', '3.7']
title = 'find_library for libcrypto and libssl on Catalina returns the unversioned library'
updated_at = <Date 2019-11-21.08:56:36.979>
user = 'https://github.com/worldwise001'

bugs.python.org fields:

activity = <Date 2019-11-21.08:56:36.979>
actor = 'ned.deily'
assignee = 'none'
closed = False
closed_date = None
closer = None
components = ['ctypes']
creation = <Date 2019-11-21.02:37:22.129>
creator = 'worldwise001'
dependencies = []
files = []
hgrepos = []
issue_num = 38873
keywords = []
message_count = 2.0
messages = ['357125', '357144']
nosy_count = 2.0
nosy_names = ['ned.deily', 'worldwise001']
pr_nums = []
priority = 'normal'
resolution = None
stage = None
status = 'open'
superseder = None
type = 'behavior'
url = 'https://bugs.python.org/issue38873'
versions = ['Python 3.7']

[worldwise001]

I've been tracking this through a bunch of different projects now. With the release of Mac OS X Catalina, libcrypto.dylib is a dummy library that causes an automatic segfault, to prevent upstream software from relying on it.

However a large amount of software makes use of ctypes find_library() which will return the path to the unversioned library.

It would be nice if we could specify "find the latest version" or similar so that we don't have to manually munge in a version, especially for strongly cross-platform libraries such as oscrypto.

I've filed a similar bug here wbond/oscrypto#35 where it's very clear how it manifests itself.

[ned-deily]

How would having a "find the latest version" help here? The point is Apple does not want you to use *any* version of libcrypto in /usr/lib: they are there only for old versions of third-party apps that were linked to a specific then-current version of the system libcrypto with a specific ABI. For libssl and libcrypto, Apple has been saying for many releases you need to supply your own versions; they haven't been supplying the header files for them in the SDKs for several releases and now this. If an app *is* trying to use an old version (which it shouldn't!), it does need to munge a specific version.