Build: prevent OpenSSL using /etc/ssl on macOS & Linux #114569

Campbell Barton · 2023-11-07T10:53:53+01:00

Campbell Barton commented

2023-11-07 10:53:53 +01:00

Using /etc/ssl only makes sense when the versions of SSL on the system
is compatible with the version Blender uses.

Failure to load the configuration for e.g. causes SSL to fail entirely
(causing downloading over HTTPS to fail).

A recent change 0 used the de facto standard directory /etc/ssl,
however this can back-fire, see: #114452 for details.

Instead of reverting the define, point to a location known not to exist.

Having to roll back use of the correct directory isn't so nice, since the change caused a regression it seems the least risky - so close to 4.0 release.

Note that I looked into an alternative fix #114565, setting OPENSSL_CONF=/dev/null however this means sub-processes launched by Blender will fail to use the proper configuration & there is the potential that other files used by OpenSSL aren't compatible.

Using /etc/ssl only makes sense when the versions of SSL on the system is compatible with the version Blender uses. Failure to load the configuration for e.g. causes SSL to fail entirely (causing downloading over HTTPS to fail). A recent change [0] used the de facto standard directory `/etc/ssl`, however this can back-fire, see: #114452 for details. Instead of reverting the define, point to a location known not to exist. [0]: 60a8ae7830acd09c3d8e9ab52630d48ecd4d281b ---- Having to roll back use of the _correct_ directory isn't so nice, since the change caused a regression it seems the least risky - so close to 4.0 release. Note that I looked into an alternative fix #114565, setting `OPENSSL_CONF=/dev/null` however this means sub-processes launched by Blender will fail to use the proper configuration & there is the potential that other files used by OpenSSL aren't compatible.

Campbell Barton added 1 commit 2023-11-07 10:54:07 +01:00

e96df5fee1 Build: prevent OpenSSL using /etc/ssl on macOS & Linux

Using /etc/ssl only makes sense when the versions of SSL on the system
is compatible with the version Blender uses.

Failure to load the configuration for e.g. causes SSL to fail entirely
(causing downloading over HTTPS to fail).

Recently [0] de facto standard directory `/etc/ssl` was used however
this can back-fire, see: #114452 for details.

Instead of reverting the define, point to a location known not to exist.

[0]: 60a8ae7830

Campbell Barton requested review from Brecht Van Lommel 2023-11-07 10:55:18 +01:00

Campbell Barton referenced this pull request

2023-11-07 11:00:54 +01:00

SSL module initialization error on Fedora Linux #114452

Brecht Van Lommel approved these changes 2023-11-07 11:53:39 +01:00

Campbell Barton referenced this issue from a commit

2023-11-07 13:23:43 +01:00

Build: prevent OpenSSL using /etc/ssl on macOS & Linux

Campbell Barton manually merged commit 5c6c71e6e8 into blender-v4.0-release

2023-11-07 13:33:48 +01:00

Brecht Van Lommel referenced this issue from a commit

2023-11-07 20:13:32 +01:00