Nothing is building on Ubuntu 20.04 with OpenSSL 1.1.1f libraries

[hackdefendr]

Steps to reproduce the behavior

1. Install all required dependency packages for Ubuntu 20.04
2. Install rbenv and ruby-build plugin
3. Standard build for ruby 3.0.4 fails due to incompatibility in SSL libraries.

Expected vs. actual behavior

1. In June of this year I was able to build Ruby v3.0.3 and several rubies/gems etc.
2. In November, present day, absolutely nothing ruby will build
3. My mastodon server is currently hosed because of this issue.
4. I expect the build process to be successful

Logs

https://gist.github.com/hackdefendr/0843d822fbfbecdc777b007bbe82aea8

Notes

There seems to be a few discussions around build failures on Ubuntu, but no actual solutions are being suggested.

[hackdefendr]

Update

1. Upgraded my host to Ubuntu 22.04.1
2. Same issue, nothing is building

[phylor]

I had some issues on ArchLinux, but not the same error as @hackdefendr.

Maybe you need to use another gcc version. I'm not currently using Ubuntu though.

You could try with something like:

apt install gcc-10
CC=/usr/bin/gcc-10 rbenv install 3.0.3

Really a shot in the dark though.

[hackdefendr]

I gave it a shot, but unfortunately got the same errors. I think this is due to the latest change from patching an OpenSSL vulnerability. Something was introduced in that patch that is causing every single Ruby compile that has SSL dependencies to crash.

[mislav]

@hackdefendr Sorry that you're experiencing trouble. ruby-build does nothing to ensure OpenSSL compatibility, therefore this isn't a sign of breakage in ruby-build and this report should be moved to the Discussion area instead. You need to have a compatible OpenSSL version installed on your system in order to build Ruby. You can download and compile your own OpenSSL if all else fails and link to it using RUBY_CONFIGURE_OPTS="--with-openssl-dir=/path/to/openssl"

[hackdefendr]

Please re-open this and do a better investigation.

--with-openssl-dir is not a Ruby configure option anymore.

I do have the correct SSL libraries installed already as I did in June when this worked. Based on other discussions, you aren't addressing any of the complaints there either. This absolutely is an issue with the ruby-build process.

Please stop telling people to use discussions because nobody is discussing anything.

[eregon]

--with-openssl-dir is not a Ruby configure option anymore.

Really? https://github.com/ruby/ruby/blob/ca0b59267352dd23bc53b5cb6f09aacd0025f536/ext/openssl/extconf.rb#L16-L102 shows the opposite.

And stop being so annoying with maintainers of ruby-build which are not responsible for problems unrelated to ruby-build, otherwise I lock this conversation too.

[eregon]

To make progress, please provide a Dockerfile reproducing this problem. Probably it cannot reproduced in Docker, which shows a problem of your environment.

[hackdefendr]

First, nothing changed in my environment beyond normal OS level security patches. Second, if anyone is being annoying it is the lack of discussion (until today) on this issue that has been reported several times. Third, here is the output from Ruby 3.0.4 ./configure --help, please show me where --with-openssl-dir exists?

`configure' configures this package to adapt to many kinds of systems.

Usage: ./configure [OPTION]... [VAR=VALUE]...

To assign environment variables (e.g., CC, CFLAGS...), specify them as
VAR=VALUE.  See below for descriptions of some of the useful variables.

Defaults for the options are specified in brackets.

Configuration:
  -h, --help              display this help and exit
      --help=short        display options specific to this package
      --help=recursive    display the short help of all the included packages
  -V, --version           display version information and exit
  -q, --quiet, --silent   do not print `checking ...' messages
      --cache-file=FILE   cache test results in FILE [disabled]
  -C, --config-cache      alias for `--cache-file=config.cache'
  -n, --no-create         do not create output files
      --srcdir=DIR        find the sources in DIR [configure dir or `..']

Installation directories:
  --prefix=PREFIX         install architecture-independent files in PREFIX
                          [/usr/local]
  --exec-prefix=EPREFIX   install architecture-dependent files in EPREFIX
                          [PREFIX]

By default, `make install' will install all the files in
`/usr/local/bin', `/usr/local/lib' etc.  You can specify
an installation prefix other than `/usr/local' using `--prefix',
for instance `--prefix=$HOME'.

For better control, use the options below.

Fine tuning of the installation directories:
  --bindir=DIR            user executables [EPREFIX/bin]
  --sbindir=DIR           system admin executables [EPREFIX/sbin]
  --libexecdir=DIR        program executables [EPREFIX/libexec]
  --sysconfdir=DIR        read-only single-machine data [PREFIX/etc]
  --sharedstatedir=DIR    modifiable architecture-independent data [PREFIX/com]
  --localstatedir=DIR     modifiable single-machine data [PREFIX/var]
  --runstatedir=DIR       modifiable per-process data [LOCALSTATEDIR/run]
  --libdir=DIR            object code libraries [EPREFIX/lib]
  --includedir=DIR        C header files [PREFIX/include]
  --oldincludedir=DIR     C header files for non-gcc [/usr/include]
  --datarootdir=DIR       read-only arch.-independent data root [PREFIX/share]
  --datadir=DIR           read-only architecture-independent data [DATAROOTDIR]
  --infodir=DIR           info documentation [DATAROOTDIR/info]
  --localedir=DIR         locale-dependent data [DATAROOTDIR/locale]
  --mandir=DIR            man documentation [DATAROOTDIR/man]
  --docdir=DIR            documentation root [DATAROOTDIR/doc/PACKAGE]
  --htmldir=DIR           html documentation [DOCDIR]
  --dvidir=DIR            dvi documentation [DOCDIR]
  --pdfdir=DIR            pdf documentation [DOCDIR]
  --psdir=DIR             ps documentation [DOCDIR]

Program names:
  --program-prefix=PREFIX            prepend PREFIX to installed program names
  --program-suffix=SUFFIX            append SUFFIX to installed program names
  --program-transform-name=PROGRAM   run sed PROGRAM on installed program names

System types:
  --build=BUILD     configure for building on BUILD [guessed]
  --host=HOST       cross-compile to build programs to run on HOST [BUILD]
  --target=TARGET   configure for building compilers for TARGET [HOST]

Optional Features:
  --disable-option-checking  ignore unrecognized --enable/--with options
  --disable-FEATURE       do not include FEATURE (same as --enable-FEATURE=no)
  --enable-FEATURE[=ARG]  include FEATURE [ARG=yes]
  --enable-load-relative  resolve load paths at run time
  --disable-werror        don't make warnings into errors even if a compiler
                          support -Werror feature [[disabled by default unless
                          development version]]
  --disable-fortify-source
                          disable -D_FORTIFY_SOURCE=2 option, which causes
                          link error on mingw
  --disable-largefile     omit support for large files
  --enable-mathn          enable canonicalization for mathn
  --enable-setreuid       use setreuid()/setregid() according to need even if
                          obsolete
  --enable-rpath          embed run path into extension libraries. enabled by
                          default on ELF platforms
  --enable-multiarch      enable multiarch compatible directories
  --enable-shared         build a shared library for Ruby
  --disable-pie           disable PIE feature
  --enable-dtrace         enable DTrace for tracing inside ruby. enabled by
                          default on systems having dtrace
  --enable-gcov           enable coverage measurement by gcov
  --disable-install-doc   do not install either rdoc indexes or C API
                          documents during install
  --disable-install-rdoc  do not install rdoc indexes during install
  --disable-install-capi  do not install C API documents during install
  --disable-jit-support   disable JIT features
  --disable-install-static-library
                          do not install static ruby library
  --disable-dln           disable dynamic link feature
  --enable-debug-env      enable RUBY_DEBUG environment variable
  --disable-rubygems      disable rubygems by default

Optional Packages:
  --with-PACKAGE[=ARG]    use PACKAGE [ARG=yes]
  --without-PACKAGE       do not use PACKAGE (same as --with-PACKAGE=no)
  --with-baseruby=RUBY    use RUBY as baseruby; RUBY is the pathname of ruby
  --without-git           never use git
  --without-gcc           never use gcc
  --with-os-version-style=TYPE
                          OS version number for target and target_os [[full]]
                          (full|teeny|minor+0|minor|major+0|major|none)
  --with-arch=ARCHS       build an Apple/NeXT Multi Architecture Binary (MAB);
                          ARCHS is a comma-delimited list of architectures for
                          which to build; if this option is disabled or
                          omitted entirely, then the package will be built
                          only for the target platform
  --with-compress-debug-sections=type
                          enable debug section compression
  --with-opt-dir=DIR-LIST add optional headers and libraries directories
                          separated by $PATH_SEPARATOR
  --with-winnt-ver=0xXXXX target Windows NT version (default to 0x0600)
  --without-gmp           disable GNU GMP to accelerate Bignum operations
  --with-jemalloc         use jemalloc allocator
  --with-coroutine=IMPLEMENTATION
                          specify the coroutine implementation to use
  --with-dln-a-out        use dln_a_out if possible
  --without-mjit-tabs     expand tabs in mjit header
  --without-valgrind      disable valgrind memcheck support
  --with-ext=EXTS         pass to --with-ext option of extmk.rb
  --with-out-ext=EXTS     pass to --without-ext option of extmk.rb
  --with-static-linked-ext
                          link external modules statically
  --with-setup=SETUP      use extension libraries setup
  --with-rubylibprefix=DIR
                          prefix for ruby libraries [[LIBDIR/RUBY_BASE_NAME]]
  --with-soname=SONAME    base name of shared library
  --with-setjmp-type      select setjmp type
  --with-rdoc=ri,html     comma/space separated list of RDoc formats to
                          install
  --with-rubyarchprefix=DIR
                          prefix for architecture dependent ruby libraries
                          [[RUBYLIBPREFIX/ARCH]]
  --with-rubysitearchprefix=DIR
                          prefix for architecture dependent site libraries
                          [[RUBYLIBPREFIX/SITEARCH]]
  --with-ridir=DIR        ri documentation [[DATAROOTDIR/ri]]
  --with-ruby-version=STR ruby version string for version specific directories
                          [[full]] (full|minor|STR)
  --with-sitedir=DIR      site libraries in DIR [[RUBY_LIB_PREFIX/site_ruby]],
                          "no" to disable site directory
  --with-sitearchdir=DIR  architecture dependent site libraries in DIR
                          [[SITEDIR/SITEARCH]], "no" to disable site directory
  --with-vendordir=DIR    vendor libraries in DIR
                          [[RUBY_LIB_PREFIX/vendor_ruby]], "no" to disable
                          vendor directory
  --with-vendorarchdir=DIR
                          architecture dependent vendor libraries in DIR
                          [[VENDORDIR/SITEARCH]], "no" to disable vendor
                          directory
  --with-search-path=DIR  specify the additional search path
  --with-rubyhdrdir=DIR   core headers in DIR
                          [[INCLUDEDIR/RUBY_BASE_NAME-RUBY_VERSION]]
  --with-rubyarchhdrdir=DIR
                          architecture dependent core headers in DIR
                          [[$(rubyhdrdir)/$(arch)]]
  --with-sitehdrdir=DIR   core site headers in DIR [[RUBYHDRDIR/site_ruby]]
  --with-sitearchhdrdir=DIR
                          architecture dependent core site headers in DIR
                          [[RUBYHDRDIR/site_ruby]]
  --with-vendorhdrdir=DIR core vendor headers in DIR
                          [[RUBYHDRDIR/vendor_ruby]]
  --with-vendorarchhdrdir=DIR
                          architecture dependent core vendor headers in DIR
                          [[RUBYHDRDIR/vendor_ruby]]
  --with-mantype=TYPE     specify man page type; TYPE is one of man and doc
  --with-ruby-pc=FILENAME pc file basename
  --with-destdir=DESTDIR  specify default directory to install

Some influential environment variables:
  cflags      additional CFLAGS (ignored when CFLAGS is given)
  cppflags    additional CPPFLAGS (ignored when CPPFLAGS is given)
  cxxflags    additional CXXFLAGS (ignored when CXXFLAGS is given)
  AR          Archiver command
  AS          Assembler command
  CC          C compiler command
  CXX         C++ compiler command
  LD          Linker command
  NM          Symbol list command
  OBJCOPY     Objcopy command
  OBJDUMP     Objdump command
  RANLIB      Ranlib command
  STRIP       Strip command
  CFLAGS      C compiler flags
  LDFLAGS     linker flags, e.g. -L<lib dir> if you have libraries in a
              nonstandard directory <lib dir>
  LIBS        libraries to pass to the linker, e.g. -l<library>
  CPPFLAGS    (Objective) C/C++ preprocessor flags, e.g. -I<include dir> if
              you have headers in a nonstandard directory <include dir>
  CXXFLAGS    C++ compiler flags
  CPP         C preprocessor

Use these variables to override the choices made by `configure' or to help
it to find libraries and programs with nonstandard names/locations.

Report bugs to the package provider.

That configure switch does not exist. Period.

[eregon]

That configure switch does not exist. Period.

It does, it's just dynamically picked up by the file I linked and so not documented by the configure script itself.

[phylor]

On ArchLinux the following works for me to build Ruby today:

PKG_CONFIG_PATH=/usr/lib/openssl-1.1/pkgconfig rbenv install 3.1.2

Also had to install openssl-1.1, because ArchLinux uses v3 currently.

No idea if that helps you on Ubuntu though.

It would of course be great if ruby-build was smart enough to search for openssl versions or at least notify with a better error message which openssl version is required. With openssl-1.0 builds also fail.

[hackdefendr]

@mislav please re-open this as a bug. It may be a bug with openssl, but it is impacting everything Ruby with a dependency to it to fail.

[eregon]

@hackdefendr It is not a bug of ruby-build but a bug of your environment or CRuby/openssl.
Converting this to a discussion.

[mislav]

@hackdefendr ruby-build maintainers are not Ruby maintainers. If something goes wrong with Ruby compilation, we (ruby-build team) often do not know what went wrong or how to fix it. That's why we point people to the Discussions area; so that they can potentially find support from the community. Not every discussion question will have a satisfying answer.

You are welcome to download a tarball of Ruby and run ./configure && make && make install to compile Ruby yourself without assistance of ruby-build and see if that solves your problem.

[hackdefendr]

The issue was that there was almost no discussion at all before today. If ruby-build is just doing the configure, make, make install, then I fully expect if I do it outside of ruby-build that I will still see a crash. Does ruby-build do any patching before the configure process or is it doing as you suggested I do and just downloading the source and compiling it?

[eregon]

Does ruby-build do any patching before the configure process or is it doing as you suggested I do and just downloading the source and compiling it?

There is no patching, and it's basically just ./configure && make && make install + build OpenSSL in cases the system OpenSSL is of a known incompatible "major" (1.0 vs 1.1 vs 3.0) version with that Ruby version (doesn't do it in your case).
So yes please try ./configure && make && make install. And you will see you get the same error.
And then you can apologize because it will be proof it's not a ruby-build bug, even though you have been claiming that nonstop without knowing.

[hackdefendr]

Actually if you read all of the words I write I have been saying this was due to something changing in OpenSSL recently. But sure, cry about the little things because you can't take criticism of any type it seems.

You admit you were wrong about the configure option in ruby and I will apologize.

[eregon]

OK, so it's clearly not an issue of ruby-build and you have been wrong on at least 3 accounts while claiming nonstop that it's a bug of ruby-build.
That's unacceptable behavior.

--with-openssl-dir is not a Ruby configure option anymore.

Wrong, I showed you above, just read or just try it. And if you ask help stop doubting people trying to help who know better than you.

I do have the correct SSL libraries installed already as I did in June when this worked. Based on other discussions, you aren't addressing any of the complaints there either. This absolutely is an issue with the ruby-build process.

False, as it's clear now.

Please stop telling people to use discussions because nobody is discussing anything.

There are many discussions and replies at https://github.com/rbenv/ruby-build/discussions, unfounded.

I lock this now.
You can file an issue at the OpenSSL or CRuby tracker based on your findings.
I suggest you behave better in the future when asking help or reporting an issue, you'll get more help.