openssl - why is the system not used?

[mistydemeo]

I see that the system openssl isn't being used with current ruby versions; why is that? I couldn't find any documentation about the issues it causes.

[sferik]

ruby-build only installs openssl on Mac OS X, which ships with an old version of OpenSSL that isn’t compatible with Ruby 2.0.0.

Here is an example bug report: #197.

Here is the fix: #273.

Prior to the fix, users of homebrew were able to work-around this problem by specifying:

CONFIGURE_OPTS=--with-openssl-dir=`brew --prefix openssl`

However, not all ruby-build users also use homebrew, so we felt the need to fix the problem in ruby-build.

If you believe there needs to be better documentation of this issue, feel free to edit the wiki or submit a pull request that adds a section to the README. We actually removed documentation from the README as part of the fix because it should Just Work:tm: on a Mac and not be an issue on other systems.

Please let me know if you have any more questions about this issue. Otherwise, I'll close it.

[mistydemeo]

I'm wondering since we're updating the 2.0 formula in Homebrew, and I needed to judge whether it's necessary to add a dependency on a new OpenSSL version.

I had previously built 2.0-rc2 using Homebrew against the system OpenSSL, and the OpenSSL module was built - hence my confusion. My understanding of that issue is that the OpenSSL module shouldn't have been built at all if only an incompatible version is available, is that right?

[sferik]

What if I added:

option 'with-brewed-openssl', "Use Homebrew's OpenSSL"
depends_on 'openssl' if build.include? 'with-brewed-openssl'

It looks like that's what done in the python forumla (and python3 formula). If this seems like a good idea to you, I'm happy to update my pull request.

[davidcelis]

For what it's worth, I still have to do the CONFIGURE_OPTS workaround (although now I have to use RUBY_CONFIGURE_OPTS) as the version of OpenSSL shipping with 2.0 on ruby-build fails to build on Mountain Lion. Here's the log: https://gist.github.com/davidcelis/62c8a8acb3cbaefc799b

It looks like it never even makes it past configuration.

[mistydemeo]

I don't mind duping openssl conditionally or always, I just want to make sure that it's necessary - since I can't reproduce the problem. Does this only happen on certain OS X versions?

[sferik]

@davidcelis Would you mind submitting that as a separate issue?

[sferik]

@mistydemeo I am on the latest release of OS X (10.8.2) and my system openssl is too old for Ruby 2.0.0.

/usr/bin/openssl version
OpenSSL 0.9.8r 8 Feb 2011

I hope this will be fixed in the next version of OS X but I believe it affects every version shipped to date.

[mistydemeo]

/usr/bin/openssl version
OpenSSL 0.9.8r 8 Feb 2011

I'm on 10.7.5, with an identical version of OpenSSL and it's not too old for Ruby 2.0.0. I think there's another variable here.

[mistydemeo]

e.g. this problem may be localized to Mountain Lion. I have a Mountain Lion box; I'll see what happens there.

[sferik]

Please let me know what you discover in your investigation.

[mistydemeo]

On my 10.8.2 box, ruby's configure does skip building openssl. It looks like this is specific to Mountain Lion.

The specific lines from ext/openssl/extconf.rb:

unless OpenSSL.check_func("SSL_library_init()", "openssl/ssl.h")
  raise "Ignore OpenSSL broken by Apple.\nPlease use another openssl. (e.g. using `configure --with-openssl-dir=/path/to/openssl')"
end

That said, I'm a little curious what's different here. On both my 10.7 and 10.8 machines, openssl/ssl.h has that function, and the symbol is in the output of nm /usr/lib/libssl.dylib. While it's marked by Apple as deprecated, the deprecation itself is marked: DEPRECATED_IN_MAC_OS_X_VERSION_10_7_AND_LATER

[mistydemeo]

PS:

I hope this will be fixed in the next version of OS X but I believe it effects ever version shipped to date.

Apple have officially deprecated OpenSSL. I doubt they have any plans to change it.

[codykrieger]

FWIW, I was only able to get 2.0.0-p0 successfully installed if I made ruby-build build openssl the same way as homebrew builds it.

~/.rbenv/plugins/ruby-build/bin/ruby-build:

   # Compile with zlib, no kerberos, and do a static build.
-  package_option openssl configure --openssldir="$OPENSSLDIR" zlib no-krb5 no-shared
+  package_option openssl configure --openssldir="$OPENSSLDIR" zlib-dynamic shared

Otherwise, invariably, I ended up with the "The Ruby openssl extension was not compiled. Missing the OpenSSL lib?" message at the end of the install process.

[wfarr]

@codykrieger I'm seeing similar behavior.

I only had to change the no-shared setting to shared and it appeared to finally build correctly.

[epogue]

@codykrieger Your changes worked for me!

Before, openssl itself would seem to compile, but I would always get the "The Ruby openssl extension was not compiled. Missing the OpenSSL lib?" error. Using Cody's diff, 2.0.0-p0 installed successfully and is working like a charm.

[jeremy]

Fixed @ fee1e49