Skip to content
GitLab
Projects Groups Snippets
  • /
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in / Register
  • Mobilizon Mobilizon
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
  • Issues 503
    • Issues 503
    • List
    • Boards
    • Service Desk
    • Milestones
  • Merge requests 8
    • Merge requests 8
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Monitor
    • Monitor
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Repository
  • Wiki
    • Wiki
  • Snippets
    • Snippets
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • FramasoftFramasoft
  • MobilizonMobilizon
  • Issues
  • #991
Closed
Open
Issue created Jan 06, 2022 by Thomas Citharel@tcit🏃🏻Owner

Statically link OpenSSL in releases

In some cases, such as RedHat not including ECC curves in OpenSSL in Fedora, RHEL and CentOS (+ possibly derivatives such as Rocky Linux ?), the OpenSSL version on the host system is not compatible with the version with which Erlang is built, and on which Mobilizon releases are built.

https://github.com/kerl/kerl#compiling-crypto-on-red-hat-systems

It's possible we'll see the same kind of issue when Erlang builds by default against OpenSSL 3.0, which might be incompatible with the host system's 1.x versions.

A workaround in this situation is to install Mobilizon from source, where an appropriate local Erlang version will be used, compatible with the local OpenSSL version. People can also simply use the Docker install.

OpenSSL static linking

In the future, we should try to have a look if we can statically link OpenSSL to Erlang to avoid this kind of trouble (and possibly more). However this requires rebuilding all of OpenSSL, Erlang, Elixir and Mobilizon itself for all supported platforms, so this will take a very long time.

Building OpenSSL

./Configure --prefix=/usr/local/ssl --openssldir=/usr/local/ssl shared
make && make install

Building Erlang

KERL_CONFIGURE_OPTIONS="--with-ssl=/usr/local/ssl/ --disable-dynamic-ssl-lib"
  • https://erlang.org/pipermail/erlang-questions/2012-November/070406.html
  • https://stackoverflow.com/a/6646351

Disabling Elliptic Curves

Another solution would be to disable Elliptic Curves altogether for Mobilizon with the following Erlang compilation option, but it would be sad to disable that just because RedHat is fearful on the topic.

CFLAGS="-DOPENSSL_NO_EC=1"

Note: It seems the following might be enough (only disabling curves unavailable in RH-based distros) to keep a kinda-working modern SSL environment.

CFLAGS="-DOPENSSL_NO_EC2M=1"
  • https://github.com/kerl/kerl/issues/279#issuecomment-451663685
  • https://github.com/erlang/otp/issues/3962#issuecomment-776577256

Related links:

  • https://elixirforum.com/t/include-openssl-within-a-build/32566
  • https://hexdocs.pm/mix/Mix.Tasks.Release.html#module-requirements
  • https://github.com/kerl/kerl/issues/212
  • https://lists.fedoraproject.org/archives/list/legal@lists.fedoraproject.org/thread/WUQNAB4EPWSJMMVECL2TZGKB5KIDESII/
Edited Jan 06, 2022 by Thomas Citharel
Assignee
Assign to
Time tracking