Bug 1055482

Summary:	python-pyOpenSSL fails to build with OpenSSL 1.1
Product:	[openSUSE] openSUSE Tumbleweed	Reporter:	Vítězslav Čížek <vcizek>
Component:	Other	Assignee:	Jan Matejek <jmatejek>
Status:	RESOLVED FIXED	QA Contact:	E-mail List <qa-bugs>
Severity:	Normal
Priority:	P5 - None	CC:	vcizek
Version:	Current
Target Milestone:	---
Hardware:	Other
OS:	Other
Whiteboard:
Found By:	---	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---
Bug Depends on:	1055478
Bug Blocks:	1042629

Description Vítězslav Čížek 2017-08-24 10:51:06 UTC

The package fails to build with OpenSSL 1.1.
We need to migrate Factory to OpenSSL 1.1 as it will become the default on SLE-15. For more information see the blocker bug.

Currently testing in staging project:
https://build.opensuse.org/project/show/openSUSE:Factory:Staging:SSL11
Fails with:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:SSL11/python-pyOpenSSL/standard/x86_64

Comment 1 Vítězslav Čížek 2017-09-04 19:48:38 UTC

The build fails during %check:

==================== FAILURES =====================
___ TestFunction.test_dump_certificate_request ____

self = <tests.test_crypto.TestFunction object at 0x7fcf63212710>
[...]
        dumped_text = dump_certificate_request(FILETYPE_TEXT, req)
        good_text = _runopenssl(
            dumped_pem, b"req", b"-noout", b"-text", b"-nameopt", b"")
>       assert dumped_text == good_text
E       AssertionError: assert 'Certificate ...      b6:ac\n' == 'Certificate R...      b6:ac\n'
E         Skipping 38 identical leading characters in diff, use -v to show
E         Skipping 1385 identical trailing characters in diff, use -v to show
E         -  Version: 0 (0x0)
E         ?           ^
E         +  Version: 1 (0x0)
E         ?           ^

"good_text" is generated using the installed openssl 1.1.0.
"dumped_text" contains "Version: 0 (0x0)", which means it was generated using old openssl 1.0.0.
That's because the certificate request version number printing was fixed in openssl 1.1. (Version 1 is indeed correct, see RFC 2986, section 4.1)

/usr/bin/py.test-2.7 utilizes libopenssl1_0_0 which is pulled in by python/python-cryptography. It looks like we need to port those first.

Comment 2 Vítězslav Čížek 2017-09-14 15:19:52 UTC

python-pyOpenSSL builds successfully if it's using python-cryptography built against OpenSSL 1.1.

Comment 3 Vítězslav Čížek 2017-09-14 15:20:56 UTC

Closing.