Upgrading 12SP5 with openssl1.1.1

Ramakrishna · January 12, 2021, 8:02pm

Hi, I have below requirement. I have 12SP5 that is having default Openssl1.0.2-fips. Now due to some CVS, we need to upgrade to Openssl1.1.1. In suse manager i can see the version 1.1.1d and in our config file, we mentioned only openssl1.1.1d versions. But after we get the image, I see both rpms of 1.0.2 and 1.1.1d are available and two packages with openssl and openssl-1_1 are avail under /usr/bin folder. To make it 1.1.1d version i have renamed openssl1.1.1d as openssl so thats taken care now. But I see both openssl versions are available. I want to know even if I forced to pull only 1.1.1d version, why is it pulling both the versions? I am quite new here. Could someone give an idea as what could be done to get only 1.1.1d rpms.?

Thanks,

malcolmlewis · January 12, 2021, 9:03pm

@Ramakrishna Hi and welcome to the Forum
Can you show the output from zypper se -si ssl AFAIK you should be able to remove the old version?

Ramakrishna · January 12, 2021, 9:20pm

Thanks Lewis. But am not able to delete still.

zypper se -si ssl
Download (curl) error for ‘https://localhost/srsupdates/repodata/repomd.xml?ssl_verify=no’:
Error code: Connection failed
Error message: Failed to connect to localhost port 443: Connection refused

Abort, retry, ignore? [a/r/i/…? shows all options] (a): a
Error building the cache:
[srs_ve_x86_64-Updates|https://localhost/srsupdates/?ssl_verify=no] Valid metadata not found at specified URL
Warning: Skipping repository ‘srs_ve_x86_64-Updates’ because of the above error.
Some of the repositories have not been refreshed because of an error.
Loading repository data…
Reading installed packages…

Ramakrishna · January 12, 2021, 9:46pm

malcolmlewis · January 12, 2021, 11:42pm

@Ramakrishna Hi, so if you try to remove the old libraries what happens?
zypper rm libopenssl-1_0_0-devel libopenssl-devel libopenssl1_0_0 libopenssl1_0_0-32bit openssl openssl-1_0_0

Ramakrishna · January 13, 2021, 7:15am

@malcolmlewis If I am removing them manually, its removing all the other rpms in my image. There are about 260rpms that are dependent and are getting removed.
zypper rm libopenssl-1_0_0-devel libopenssl-devel libopenssl1_0_0 libopenssl1_0_0-32bit openssl openssl-1_0_0
Loading repository data…
Warning: No repositories defined. Operating only with the installed resolvables. Nothing can be installed.
Reading installed packages…
Resolving package dependencies…

The following 262 packages are going to be REMOVED:

malcolmlewis · January 13, 2021, 2:33pm

@Ramakrishna Hi and ouch! I suspect since you have no online repositories enabled, the packages that would have rebuilt with the later version of openssl and installed at the same time are causing the issues.

Ramakrishna · January 13, 2021, 3:00pm

@malcolmlewis Not really Lewis. Actually we have a config xml file that pulls the rpms from suse manager, during our image creation. and this will be done by our devops team. It does have a repo. But the my precise question is as following:
I have specifically mentioned in my config file to pull rpm related to 1.1.1 only …
But this in turn is pulling 1.0.2 as well. and then after deployment of my image i see the default version as 1.0.2. As mentioned earlier to make it 1.1.1 I need rename the package of openssl-1_1 to default.
I was going through forum posts , i see similar issue but that was also not fully solved.
https://forums.suse.com/discussion/comment/61207#Comment_61207

Ramakrishna · January 13, 2021, 3:01pm

malcolmlewis · January 13, 2021, 4:09pm

@Ramakrishna Hi, Ahh, ok, then you should be able to set a version string, or (I’m assuming an update repo?), then set the priority of the repo, org just get rid of the old version of the SuMA instance…

Ramakrishna · January 22, 2021, 1:54pm

@malcolmlewis Not sure i understood what this mean from the above chat. (you should be able to set a version string,). Can you please elaborate on this.

malcolmlewis · January 22, 2021, 2:46pm

@Ramakrishna Hi, this is a autoyast config file? Normally should be able to add a <version>x.x.x</version> with the package.

Ramakrishna · January 22, 2021, 4:10pm

malcolmlewis I dont know on that. Coz sometime back suse engineer gave this xml file to us and we are working on top of it. Please check the attachement.

Ramakrishna · January 22, 2021, 4:15pm

Please check the attachment.

Ramakrishna · January 22, 2021, 4:51pm

@malcolmlewis Please check the xml file that was shared to us by SUSE engr sometime back and we use this for rpm generation. If you see this, under package type image and bootstrap we are giving openssl1-1_1 packages. So its pulling them, now in addition to that its pulling Openssl1_0_0 packages as well and making 1.0.0 as default openssl. I was trying to understand if by any chance we can get only openssl1.1.1 version and not 1.0.2. So that Openssl1.1.1 would be default in that case. Thats a big challenge am seeing, if you can help on it that would be a real time saver for me.

malcolmlewis · January 22, 2021, 5:04pm

@Ramakrishna Hi add a remove packages section…

<remove-packages config:type=ÂlistÂ>
        <package>libopenssl1_0_0</package>
      </remove-packages>

Or add in the delete section…

Ramakrishna · January 22, 2021, 5:14pm

@malcolmlewis Exactly this kind of stuff i was looking for. Where can i place this section is it under or its a independent section that I can place at the end of the file. Secondly whats the xml file called, is this autoyast file?

Ramakrishna · January 22, 2021, 5:15pm

@malcolmlewis is it under packages type=“image” …under that or at the end of the file as independent section?

malcolmlewis · January 22, 2021, 6:35pm

@Ramakrishna Hi, at the very end of the xml file;

</packages>    <packages type="delete">
               <package name="libopenssl1_0_0"/>

Or add after the section… Yes it’s an ‘autoyast’ file.

Ramakrishna · January 22, 2021, 7:52pm

@malcolmlewis No luck here as well. Looks like while image was created, it pulled openssl 1.0.0 version and then deleted that version. But somehow all our custom rpms are getting dependent on the openssl1.0.0 due to which after delete instructions were run, the image got corrupted.

Topic		Replies	Views
Modify the default version of openssl ? SLES Configure-Administer	11	1467	February 16, 2021
SLES 12 SP 1 - openssl version (upgrade) SLES Updates	4	327	February 11, 2016
Openssl 1.1 for SUSE 11 SP3 ? SLES Updates	4	223	January 12, 2015
Update SLES 12 to SLES 12 sp1 SLES Updates	4	241	January 9, 2016
Upgrading SLES and OpenSSL to support TLS 1.2 SLES Updates	2	819	February 9, 2016

Upgrading 12SP5 with openssl1.1.1

Related topics