Corporate endpoint security?

Help
21

You could try openssl_1_1.

1 Like
22

Ok thanks I will try that.

23

Did you get libssl.so.1.0.0 dependency to work?

Iā€™m hitting the same wall with another package

1 Like
24

If it actually wants that version, and you canā€™t substitute with the newer libssl, you should check with your vendor, since that version is known to be vulnerable.

They may distribute a proprietary implementation, at which point youā€™d need to get your hands on that, or theyā€™re just selling you an inherently insecure tool. Or both while also violating a FOSS license, of course.

25

I donā€™t know for the original topic, but in my case we are talking about azure function core tools.

Iā€™ve provided some more details in this post: Azure Functions Core Tools missing a binary

Could it be possible to provide a newer version, when libssl.so.1.0.0 is the one that its asking for?

26

So currently Iā€™m using 1_1 and ignoring the dependency errors. So far this approach is working, but I havenā€™t got it working, since it seems like Iā€™ll need to create a NixOS module as well to get this to work (it involves systemd services etc).

27

I added this below buildInputs in the package:

  autoPatchelfIgnoreMissingDeps = [
    "libssl.so.1.0.0"
    "libcrypto.so.1.0.0"
    "libssl.so.10"
    "libcrypto.so.10"
    "libcrypt.so.1"
    "libxml2.so.2"
    "libssl.so.1.1"
    "libcrypto.so.1.1"
  ];
28

Itā€™s quite possible it will only ā€œworkā€ until you do some actual SSL, since those versions arenā€™t ABI compatible. Itā€™d be wise to find some kind of smoketest before committing too much :wink: