salt --versions-report broken in bionic/cosmic with openssl 1.1.1
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Salt |
Fix Released
|
Unknown
|
|||
salt (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned | ||
Bionic |
Fix Released
|
Undecided
|
Unassigned | ||
Cosmic |
Won't Fix
|
Undecided
|
Unassigned | ||
Disco |
Fix Released
|
Undecided
|
Unassigned |
Bug Description
[Impact]
* salt fails to start with OpenSSL 1.1.1 (which is in cosmic-release, bionic-proposed)
[Test Case]
* install openssl/libssl1.1 from bionic-proposed
sudo apt install salt-master
sudo salt --versions-report
[bad] Python traceback ending in:
ssl.SSLError: unknown error (_ssl.c:2788)
[good] a table of version numbers
Salt Version:
Salt: 2018.3.0
...
[Fix]
* Unused imports, and 1.1.1 incompatible libcrypto init functions in salt are causing it to fail to start with OpenSSL 1.1.1. The upstream patches that were merged into stable branch make it compatible with either 1.1.0 or 1.1.1.
* Note that for bionic above is sufficent by itself. In cosmic, python-tornado got upgraded from v4 to v5 and salt is incompatible with it. Hence salt in cosmic is currently complete busted due to this issue and lack of tornado4. I have now requested and SRU to reintroduce tornado4 into cosmic to unbreak salt in cosmic. But it may take much longer than the smaller fix for bionic.
[Regression Potential]
* The underlying behavior of crypto with or without these patches is not changed. There are no versioned breaks to prevent upgrading libssl1.1 whilst salt is installed, but this fix should make salt compatible with any openssl releases. Currently, salt is completely broken in cosmic-release (fails to start) so it's hard to regress further than that in cosmic.
[Other Info]
* Full traceback
# sudo apt install salt-master
# sudo salt --versions-report
Traceback (most recent call last):
File "/usr/bin/salt", line 10, in <module>
salt_main()
File "/usr/lib/
client.run()
File "/usr/lib/
import salt.client
File "/usr/lib/
import salt.cache
File "/usr/lib/
import salt.loader
File "/usr/lib/
import salt.utils.event
File "/usr/lib/
import tornado.iostream
File "/usr/lib/
from tornado.netutil import ssl_wrap_socket, _client_
File "/usr/lib/
ssl.
File "/usr/lib/
context = SSLContext(
File "/usr/lib/
self = _SSLContext.
ssl.SSLError: unknown error (_ssl.c:2788)
description: | updated |
Changed in salt (Ubuntu Bionic): | |
status: | New → Confirmed |
Changed in salt (Ubuntu Cosmic): | |
status: | New → Confirmed |
Changed in salt (Ubuntu Disco): | |
status: | New → Fix Released |
Changed in salt: | |
status: | Unknown → New |
description: | updated |
Changed in salt (Ubuntu Bionic): | |
status: | Confirmed → In Progress |
description: | updated |
Changed in salt: | |
status: | New → Fix Released |
Hello.
Is there any blocking thing for Bionic?