Skip to content

Restore system OpenSSL linkage for Linux releases and generate .deb deps#10

Open
NateIsern wants to merge 1 commit into
mainfrom
codex/investigate-vulnerability-related-to-openssl-1.0.1k
Open

Restore system OpenSSL linkage for Linux releases and generate .deb deps#10
NateIsern wants to merge 1 commit into
mainfrom
codex/investigate-vulnerability-related-to-openssl-1.0.1k

Conversation

@NateIsern

Copy link
Copy Markdown
Member

Motivation

  • Prevent release artifacts from statically embedding the repository depends OpenSSL 1.0.1k so shipped binaries keep distro-managed libssl updates and security fixes.
  • Ensure Debian packages declare correct shared-lib runtime dependencies instead of hardcoding libc6 only.

Description

  • Reverted Linux and Debian release jobs to use Ubuntu system development packages by installing libssl-dev, libboost-all-dev, libdb5.3-dev, libminiupnpc-dev, libzmq3-dev, and libevent-dev in the workflow Install dependencies steps in .github/workflows/release.yml.
  • Removed the make -C depends HOST=... / CONFIG_SITE=$PWD/depends/.../config.site based configure step and restored ./configure against the system libraries for the Linux tarball and Debian build jobs.
  • Replaced the hardcoded Debian control Depends: libc6 with an invocation of dpkg-shlibdeps to compute DEPENDS dynamically and write Depends: ${DEPENDS} in the generated control file so libssl and other shared libs are visible to the package manager.

Testing

  • Ran git diff --check to validate no whitespace/patch errors, which succeeded.
  • Ran a Python static regression check that asserts the workflow no longer calls make -C depends and does not set CONFIG_SITE=$PWD/depends/.../config.site, which passed.
  • Ran a Python static regression check that asserts the Debian control no longer contains the literal Depends: libc6, which passed.

Codex Task

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant