ruby - RHEL 6.3 和所有 Ruby 安装程序上的 OpenSSL 问题

Question

在我们的 RHEL 6.3 系统上安装任何版本的 Ruby 时，OpenSSL 似乎没有正确编译。我一直在尝试将 RVM 的用户安装留在后面，并通过 ruby​​-install 和 chruby 将它们替换为 root 安装。 OpenSSL 在我们的 RVM 用户安装(使用规定的 RVM 修复)以及 /usr/bin 中的 Ruby 1.8.7 内置系统安装中工作正常。

OpenSSL 在我尝试使用 ruby​​-install、ruby-build 甚至 RVM 的每个 Ruby 版本中都被破坏，当使用他们最新的建议修复时。 1.9.3-p392(我们的生产版本)，最新的 1.9 和当前的 2.1.0。我已经尝试了我能找到的所有 openssl 修复/解决方法，例如指向各种 openssl 文件夹的 --with-openssl-dir=/some/dir 配置，但对我没有任何作用。

以下是我多次尝试中的一些相关信息:

[root@dbatcit ~]# ruby-install ruby
>>> Installing ruby 2.1.0 into /opt/rubies/ruby-2.1.0 ...
>>> Installing dependencies for ruby 2.1.0 ...
Loaded plugins: product-id, rhnplugin, security, subscription-manager
Updating certificate-based repositories.
Unable to read consumer identity
Setting up Install Process
Package gcc-4.4.7-4.el6.x86_64 already installed and latest version
Package automake-1.11.1-4.el6.noarch already installed and latest version
Package zlib-devel-1.2.3-29.el6.x86_64 already installed and latest version
Package libyaml-devel-0.1.3-1.el6.x86_64 already installed and latest version
Package openssl-devel-1.0.1e-16.el6_5.4.x86_64 already installed and latest version
Package gdbm-devel-1.8.0-36.el6.x86_64 already installed and latest version
Package readline-devel-6.0-4.el6.x86_64 already installed and latest version
Package ncurses-devel-5.7-3.20090208.el6.x86_64 already installed and latest version
Package libffi-devel-3.0.5-3.2.el6.x86_64 already installed and latest version
Nothing to do
.
.
make[2]: Entering directory `/usr/local/src/ruby-2.1.0/ext/openssl'
compiling ossl_pkey.c
compiling ossl_ssl.c
ossl_ssl.c:121: error: âTLSv1_2_methodâ undeclared here (not in a function)
ossl_ssl.c:122: error: âTLSv1_2_server_methodâ undeclared here (not in a function)
ossl_ssl.c:123: error: âTLSv1_2_client_methodâ undeclared here (not in a function)
ossl_ssl.c:127: error: âTLSv1_1_methodâ undeclared here (not in a function)
ossl_ssl.c:128: error: âTLSv1_1_server_methodâ undeclared here (not in a function)
ossl_ssl.c:129: error: âTLSv1_1_client_methodâ undeclared here (not in a function)
make[2]: *** [ossl_ssl.o] Error 1
make[2]: Leaving directory `/usr/local/src/ruby-2.1.0/ext/openssl'
make[1]: *** [ext/openssl/all] Error 2
make[1]: Leaving directory `/usr/local/src/ruby-2.1.0'
make: *** [build-ext] Error 2
!!! Compiling ruby 2.1.0 failed!



[root@dbatcit ~]# ruby-install ruby 1.9
>>> Installing ruby 1.9.3-p484 into /opt/rubies/ruby-1.9.3-p484 ...
>>> Installing dependencies for ruby 1.9.3-p484 ...
Loaded plugins: product-id, rhnplugin, security, subscription-manager
Updating certificate-based repositories.
Unable to read consumer identity
Setting up Install Process
Package gcc-4.4.7-4.el6.x86_64 already installed and latest version
Package automake-1.11.1-4.el6.noarch already installed and latest version
Package zlib-devel-1.2.3-29.el6.x86_64 already installed and latest version
Package libyaml-devel-0.1.3-1.el6.x86_64 already installed and latest version
Package openssl-devel-1.0.1e-16.el6_5.4.x86_64 already installed and latest version
Package gdbm-devel-1.8.0-36.el6.x86_64 already installed and latest version
Package readline-devel-6.0-4.el6.x86_64 already installed and latest version
Package ncurses-devel-5.7-3.20090208.el6.x86_64 already installed and latest version
Package libffi-devel-3.0.5-3.2.el6.x86_64 already installed and latest version
Nothing to do
.
.
make[2]: Entering directory `/usr/local/src/ruby-1.9.3-p484/ext/openssl'
compiling ossl_pkey.c
compiling ossl_ssl.c
compiling ossl_pkcs12.c
compiling ossl_bn.c
compiling ossl_hmac.c
ossl_hmac.c: In function âossl_hmac_copyâ:
ossl_hmac.c:90: warning: implicit declaration of function âHMAC_CTX_copyâ
compiling ossl_asn1.c
compiling ossl.c
compiling ossl_bio.c
compiling ossl_pkey_rsa.c
compiling ossl_ocsp.c
ossl_ocsp.c: In function âossl_ocspreq_add_certidâ:
ossl_ocsp.c:180: warning: function called through a non-compatible type
ossl_ocsp.c:180: note: if this code is reached, the program will abort
ossl_ocsp.c: In function âossl_ocspreq_get_certidâ:
ossl_ocsp.c:200: warning: function called through a non-compatible type
ossl_ocsp.c:200: note: if this code is reached, the program will abort
ossl_ocsp.c: In function âossl_ocspbres_get_statusâ:
ossl_ocsp.c:541: warning: function called through a non-compatible type
ossl_ocsp.c:541: note: if this code is reached, the program will abort
compiling ossl_pkey_dh.c
ossl_pkey_dh.c: In function âossl_dh_initializeâ:
ossl_pkey_dh.c:184: warning: function called through a non-compatible type
ossl_pkey_dh.c:184: note: if this code is reached, the program will abort
ossl_pkey_dh.c: In function âossl_dh_to_public_keyâ:
ossl_pkey_dh.c:372: warning: function called through a non-compatible type
ossl_pkey_dh.c:372: note: if this code is reached, the program will abort
compiling ossl_ns_spki.c
compiling ossl_x509attr.c
compiling ossl_x509name.c
ossl_x509name.c: In function âossl_x509name_hash_oldâ:
ossl_x509name.c:342: warning: implicit declaration of function âX509_NAME_hash_oldâ
compiling ossl_pkcs7.c
compiling ossl_pkey_ec.c
ossl_pkey_ec.c: In function âossl_ec_group_initializeâ:
ossl_pkey_ec.c:784: warning: function called through a non-compatible type
ossl_pkey_ec.c:784: note: if this code is reached, the program will abort
ossl_pkey_ec.c: In function âossl_ec_group_to_stringâ:
ossl_pkey_ec.c:1154: warning: function called through a non-compatible type
ossl_pkey_ec.c:1154: note: if this code is reached, the program will abort
compiling ossl_ssl_session.c
ossl_ssl_session.c: In function âossl_ssl_session_initializeâ:
ossl_ssl_session.c:53: warning: function called through a non-compatible type
ossl_ssl_session.c:53: note: if this code is reached, the program will abort
ossl_ssl_session.c:57: warning: function called through a non-compatible type
ossl_ssl_session.c:57: note: if this code is reached, the program will abort
ossl_ssl_session.c: In function âossl_ssl_session_to_pemâ:
ossl_ssl_session.c:251: warning: function called through a non-compatible type
ossl_ssl_session.c:251: note: if this code is reached, the program will abort
compiling openssl_missing.c
compiling ossl_x509.c
compiling ossl_x509cert.c
compiling ossl_digest.c
compiling ossl_pkcs5.c
ossl_pkcs5.c: In function âossl_pkcs5_pbkdf2_hmacâ:
ossl_pkcs5.c:39: warning: implicit declaration of function âPKCS5_PBKDF2_HMACâ
compiling ossl_rand.c
compiling ossl_engine.c
compiling ossl_x509crl.c
compiling ossl_cipher.c
ossl_cipher.c: In function âossl_cipher_copyâ:
ossl_cipher.c:143: warning: implicit declaration of function âEVP_CIPHER_CTX_copyâ
compiling ossl_x509ext.c
compiling ossl_config.c
compiling ossl_x509store.c
compiling ossl_x509revoked.c
compiling ossl_pkey_dsa.c
compiling ossl_x509req.c
linking shared-object openssl.so
installing default openssl libraries
make[2]: Leaving directory `/usr/local/src/ruby-1.9.3-p484/ext/openssl'
.
.
>>> Successfully installed ruby 1.9.3-p484 into /opt/rubies/ruby-1.9.3-p484

注意上面所有的 ossl 警告。

重新启动 session 。测试系统 Ruby 1.8.7 openssl:有效。测试 ruby​​-install Ruby 1.9.3 openssl: 失败。

[root@dbatcit ~]# chruby
   ruby-1.9.3-p484
[root@dbatcit ~]# which ruby
/usr/bin/ruby
[root@dbatcit ~]# ruby -v
ruby 1.8.7 (2011-06-30 patchlevel 352) [x86_64-linux]
[root@dbatcit ~]# ruby -ropenssl -e "puts OpenSSL::VERSION"
1.0.0
[root@dbatcit ~]# chruby 1.9
[root@dbatcit ~]# chruby
 * ruby-1.9.3-p484
[root@dbatcit ~]# which ruby
/opt/rubies/ruby-1.9.3-p484/bin/ruby
[root@dbatcit ~]# ruby -v
ruby 1.9.3p484 (2013-11-22 revision 43786) [x86_64-linux]
[root@dbatcit ~]# ruby -ropenssl -e "puts OpenSSL::VERSION"
/opt/rubies/ruby-1.9.3-p484/lib/ruby/1.9.1/rubygems/custom_require.rb:36:in `require': /opt/rubies/ruby-1.9.3-p484/lib/ruby/1.9.1/x86_64-linux/openssl.so: undefined symbol: EC_GROUP_new_curve_GF2m - /opt/rubies/ruby-1.9.3-p484/lib/ruby/1.9.1/x86_64-linux/openssl.so (LoadError)
        from /opt/rubies/ruby-1.9.3-p484/lib/ruby/1.9.1/rubygems/custom_require.rb:36:in `require'
        from /opt/rubies/ruby-1.9.3-p484/lib/ruby/1.9.1/openssl.rb:17:in `<top (required)>'
        from /opt/rubies/ruby-1.9.3-p484/lib/ruby/1.9.1/rubygems/custom_require.rb:36:in `require'
        from /opt/rubies/ruby-1.9.3-p484/lib/ruby/1.9.1/rubygems/custom_require.rb:36:in `require'
[root@dbatcit ~]#


[root@dbatcit ~]# which -a openssl
/usr/bin/openssl
/usr/local/bin/openssl
[root@dbatcit ~]# openssl version
OpenSSL 1.0.1e-fips 11 Feb 2013
[root@dbatcit ~]# /usr/local/bin/openssl version
OpenSSL 0.9.8d 28 Sep 2006

在用户主目录中测试 RVM Ruby 1.9.3 openssl:有效。

[userbob@dbatcit ~]$ ruby -v
ruby 1.9.3p392 (2013-02-22 revision 39386) [x86_64-linux]
[userbob@dbatcit ~]$ ruby -ropenssl -e "puts OpenSSL::VERSION"
1.1.0
[userbob@dbatcit ~]$ which openssl
/usr/local/bin/openssl
[userbob@dbatcit ~]$ openssl version
OpenSSL 0.9.8d 28 Sep 2006
[userbob@dbatcit ~]$ .rvm/usr/bin/openssl version
OpenSSL 1.0.1c 10 May 2012

Answer 1

经过长时间的研究，并且对 Linux 的了解比我以前关心的要多得多，我将问题缩小到 RHEL 和 OpenSSL 的基本特性以及 Ruby (extconf.rb) 在安装过程中做出的错误假设。以下站点为我提供了一些很好的线索，让我知道要看什么，但我没有找到任何东西可以像我需要的那样将它们组合在一起。

• http://www.openssl.org/support/faq.html#BUILD8
• http://wiki.openssl.org/index.php/Compilation_and_Installation#Fedora_and_Red_Hat
• http://sachachua.com/blog/2011/04/setting-up-ruby-on-rails-on-a-redhat-enterprise-linux-rackspace-cloud-server/
• https://web.archive.org/web/20130430124941/https://rvm.io/packages/openssl/

...并不太感谢涉及 Ruby 补丁和 EC2M 的一大堆转移注意力的问题。此外，RVM 需要纠正他们的乐观态度，即他们已经用 autolibs 解决了这个问题，应该恢复他们以前的 openssl 页面。

基本解法规则

规则 1

由 yum 在 /usr/bin 中创建和维护的 OpenSSL (1.0.1e) 安装不能用于正确编译 Ruby 的 OpenSSL 扩展 -- 至少，目前不能在我的机器上使用使用最新版本的 Ruby(1.9.3-p484、2.0.0、2.1.0)。瑞尔 6.3。我只能推测这是由于 RedHat 的 OpenSSL 编译的特殊性，正如 OpenSSL 常见问题解答中所暗示的那样。

规则 2

我在/usr/local(bin + openssl，和ssl/bin) 和更新/替换这些让我更接近解决方案。无论出于何种原因，每次在 /usr/local 中手动安装 OpenSSL 1.0.1f(无论 bin、openssl、ssl 目录排列如何)都坚持将库放在 /usr/local/lib64 而不是 /usr/local/lib(当然，除非我破解了 Makefile)。然而，Ruby 的 expconf.rb 脚本假定 OpenSSL 库将始终位于 lib 目录中。解决这个单一的烦恼(以及与 OpenSSL 的冲突)是所有这一切中最困难的部分。因此，要在 /usr/local 中使用 OpenSSL 安装，您必须执行两个操作事情:(1) 使用 --with-openssl-dir 开关安装 Ruby，以及 (2) 重新编译 Ruby 的 OpenSSL 扩展，同时修改 Makefile 以指向 lib64 而不是 lib。因此，以 root 身份运行类似于以下命令字符串的内容:

ruby-install ruby 1.9.3-p545 -- --with-openssl-dir=/usr/local
cd /usr/local/src/ruby-1.9.3-p545/ext/openssl
ruby extconf.rb

编辑 openssl 的 Makefile 以替换如下内容:

  libpath = . $(libdir) /usr/local/lib
  LIBPATH =  -L. -L$(libdir) -Wl,-R$(libdir) -L/usr/local/lib -Wl,-R/usr/local/lib

像这样:

  libpath = . $(libdir) /usr/local/lib64
  LIBPATH =  -L. -L$(libdir) -Wl,-R$(libdir) -L/usr/local/lib64 -Wl,-R/usr/local/lib64

保存，返回命令行:

make
make install

新的 Ruby 安装现在应该可以正确地与 OpenSSL 一起使用。作为快速检查，我重新启动我的 sudo session ，然后(假设使用 chruby):

chruby 1.9
ruby -ropenssl -e "puts OpenSSL::VERSION"

规则 3

在 /usr 之外的任何地方安装 OpenSSL 会将库放在预期的 lib 而不是 lib64 中。 (不要问我为什么……不知道。)这可能是更易于维护的解决方案，因为它可以让您避免破坏 Makefile。这也是 RVM 在运行 rvm pkg install openssl 时使用的解决方案。因此，要同时安装 OpenSSL 和 Ruby(在 /opt 中)，您可以运行如下命令(我以 sudo bash 运行):

安装 OpenSSL:

cd /opt/local
wget http://www.openssl.org/source/openssl-1.0.1f.tar.gz
tar -xzf openssl-1.0.1f.tar.gz
cd openssl-1.0.1f
./config --prefix=/opt/local shared no-asm zlib > openssl_config.log
make > openssl_make.log
make install > openssl_install.log

(shared 开关是 Ruby 正确安装所必需的，no-asm 开关有助于消除 Make 警告，但似乎不是必需的，和 zlib 和其他开关是可选的。)

可选，更新 openssl 证书:

cd /opt/local/ssl
wget http://curl.haxx.se/ca/cacert.pem
mv cacert.pem cert.pem
cd /opt

回到 ruby :

ruby-install ruby 1.9.3-p545 -- --with-openssl-dir=/opt/local

新的 Ruby 安装现在应该可以正确地与 OpenSSL 一起使用。作为快速检查，我重新启动我的 sudo session ，然后(假设使用 chruby):

chruby 1.9
ruby -ropenssl -e "puts OpenSSL::VERSION"