Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 443418 - media-sound/spotify-0.8.4.103-r1 should RDEPEND on dev-libs/openssl-0.9.8
Summary: media-sound/spotify-0.8.4.103-r1 should RDEPEND on dev-libs/openssl-0.9.8
Status: RESOLVED WONTFIX
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: AMD64 Linux
: Normal normal (vote)
Assignee: Matthew Thode ( prometheanfire )
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-11-15 14:57 UTC by Johannes Hirte
Modified: 2013-12-11 02:56 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Johannes Hirte 2012-11-15 14:57:57 UTC
Spotify depends on openssl-0.9.8 and doesn't start with versions above.

Reproducible: Always

Steps to Reproduce:
1. install spotify
2. try to start it in terminal
Actual Results:  
spotify
/opt/spotify/spotify: /usr/lib64/libcrypto.so.1.0.0: version `OPENSSL_0.9.8' not found (required by /opt/spotify/spotify)
/opt/spotify/spotify: /usr/lib64/libssl.so.1.0.0: version `OPENSSL_0.9.8' not found (required by /opt/spotify/spotify)

Expected Results:  
Should start without error.
Comment 1 Matthew Thode ( prometheanfire ) archtester Gentoo Infrastructure gentoo-dev Security 2012-11-15 17:35:06 UTC
this isn't actually the case for spotify.

can you do an ldd on /usr/share/spotify/spotify and grep for ssl?

It should only show this if the sed I do did not work.
ldd /usr/share/spotify/spotify | grep ssl
	libssl.so.0.9.8 => not found
	libssl.so.1.0.0 => /usr/lib64/libssl.so.1.0.0 (0x000003986388d000)


it should normally show this (not prety but it works)
ldd /usr/share/spotify/spotify | grep ssl
/usr/share/spotify/spotify: /usr/lib64/libcrypto.so.1.0.0: no version information available (required by /usr/share/spotify/spotify)
/usr/share/spotify/spotify: /usr/lib64/libssl.so.1.0.0: no version information available (required by /usr/share/spotify/spotify)
	libssl.so.1.0.0 => /usr/lib64/libssl.so.1.0.0 (0x00000309aaa67000)

these types of binaries are always a pain to deal with :|
Comment 2 Johannes Hirte 2012-11-15 18:08:01 UTC
ldd /opt/spotify/spotify |grep ssl
/opt/spotify/spotify: /usr/lib64/libcrypto.so.1.0.0: version `OPENSSL_0.9.8' not found (required by /opt/spotify/spotify)
/opt/spotify/spotify: /usr/lib64/libssl.so.1.0.0: version `OPENSSL_0.9.8' not found (required by /opt/spotify/spotify)
        libssl.so.1.0.0 => /usr/lib64/libssl.so.1.0.0 (0x00007f0cb26a0000)

and

ldd /opt/spotify/spotify |grep crypto
/opt/spotify/spotify: /usr/lib64/libcrypto.so.1.0.0: version `OPENSSL_0.9.8' not found (required by /opt/spotify/spotify)
/opt/spotify/spotify: /usr/lib64/libssl.so.1.0.0: version `OPENSSL_0.9.8' not found (required by /opt/spotify/spotify)
        libcrypto.so.1.0.0 => /usr/lib64/libcrypto.so.1.0.0 (0x00007f44bc556000)
Comment 3 Johannes Hirte 2012-11-15 18:33:59 UTC
btw. openssl-0.9.8 is installed:

[I] dev-libs/openssl
     Available versions:  
        (0.9.8) 0.9.8u 0.9.8v 0.9.8w 0.9.8x
        (0)     1.0.0h 1.0.0i 1.0.0j (~)1.0.1a (~)1.0.1b (~)1.0.1c
        {{bindist gmp kerberos rfc3779 sse2 static-libs test vanilla zlib}}
     Installed versions:  0.9.8x(0.9.8)(18:54:36 14.10.2012)(gmp sse2 zlib -bindist -kerberos -test) 1.0.1c(18:51:41 19.07.2012)(gmp sse2 zlib -bindist -kerberos -rfc3779 -static-libs -test -vanilla)
Comment 4 Matthew Thode ( prometheanfire ) archtester Gentoo Infrastructure gentoo-dev Security 2012-11-16 05:06:49 UTC
That eix didn't tell me if 0.9.8 was installed, do an 'ls -l /usr/lib64/libssl*' to check what's there.  'qlist -IS | grep openssl' will show it as well (the slot at least).
Comment 5 Johannes Hirte 2012-11-16 07:35:26 UTC
ls -l /usr/lib64/libssl*
lrwxrwxrwx 1 root root     13 28. Okt 22:34 /usr/lib64/libssl3.so -> libssl3.so.12
-rwxr-xr-x 1 root root 283376 28. Okt 22:34 /usr/lib64/libssl3.so.12
lrwxrwxrwx 1 root root     15 19. Jul 18:51 /usr/lib64/libssl.so -> libssl.so.1.0.0
-rwxr-xr-x 1 root root 344296 14. Okt 18:54 /usr/lib64/libssl.so.0.9.8
-r-xr-xr-x 1 root root 424920 19. Jul 18:51 /usr/lib64/libssl.so.1.0.0
Comment 6 Matthew Thode ( prometheanfire ) archtester Gentoo Infrastructure gentoo-dev Security 2012-11-16 07:38:07 UTC
looks like you have both installed, I'll test with both slots installed tomorrow.  I'm guessing that if you get rid of  0.9.8 it will work (though that may be pulled in by something else).  try an emerge --depclean
Comment 7 Johannes Hirte 2012-11-16 12:47:52 UTC
I've installed 0.9.8 when spotify didn't work with 1.0.1. But even with the sed-workaround removed in the ebuild, I get the error

/opt/spotify/spotify: /usr/lib64/libcrypto.so.1.0.0: version `OPENSSL_0.9.8' not found (required by /opt/spotify/spotify)
/opt/spotify/spotify: /usr/lib64/libssl.so.1.0.0: version `OPENSSL_0.9.8' not found (required by /opt/spotify/spotify)

ldd shows me then this:

ldd /opt/spotify/spotify |grep ssl
/opt/spotify/spotify: /usr/lib64/libcrypto.so.0.9.8: version `OPENSSL_0.9.8' not found (required by /opt/spotify/spotify)
/opt/spotify/spotify: /usr/lib64/libssl.so.0.9.8: version `OPENSSL_0.9.8' not found (required by /opt/spotify/spotify)
        libssl.so.0.9.8 => /usr/lib64/libssl.so.0.9.8 (0x00007f3474d69000)
        libssl.so.1.0.0 => /usr/lib64/libssl.so.1.0.0 (0x00007f3472bef000)
Comment 8 Matthew Thode ( prometheanfire ) archtester Gentoo Infrastructure gentoo-dev Security 2012-11-16 15:01:24 UTC
So, it sounds to me like spotify is not starting with either version of openssl installed.  Is that correct (have you tried, each alone and both installed together to show that all options do not work)?
Comment 9 David Leverton 2012-11-17 00:59:23 UTC
(In reply to comment #0)
> Spotify depends on openssl-0.9.8 and doesn't start with versions above.

This is a mess - the binary is linked to 0.9.8, but unfortunately if you let it use 0.9.8 when Qt is compiled against OpenSSL 1, you get nasty crashes due to having both versions loaded into the same process, hence the sed workaround (which is incredibly evil, but it /seems/ to work in practice - presumably Spotify only calls OpenSSL functions that didn't change ABI).

> /opt/spotify/spotify: /usr/lib64/libcrypto.so.1.0.0: version `OPENSSL_0.9.8' not found (required by /opt/spotify/spotify)
> /opt/spotify/spotify: /usr/lib64/libssl.so.1.0.0: version `OPENSSL_0.9.8' not found (required by /opt/spotify/spotify)

These aren't fatal errors as far as I know, unless maybe you have some option set to make the linker stricter than usual?

> I've installed 0.9.8 when spotify didn't work with 1.0.1. But even with the sed-workaround removed in the ebuild, I get the error

The Spotify binary is apparently built on a system (I suspect Ubuntu?) that patches OpenSSL to use symbol versioning, which is where the OPENSSL_0.9.8 comes from.  This isn't included in standard OpenSSL[1] or Gentoo, but Debian[2] and derivatives, and possibly others, include it as a patch.  Since the symbol versions aren't present in Gentoo's library, the linker complains.

If OpenSSL /did/ have symbol versions, that would also allow both versions to be safely loaded together, as Qt and Spotify itself would each be bound to the specific version they were built with, and so would allow the Spotify ebuild to depend on the real openssl:0.9.8 and do away with the sed hack.  That would be the best way to go if base-system is happy with it.

[1] http://rt.openssl.org/Ticket/Display.html?user=guest&pass=guest&id=1222
[2] http://patch-tracker.debian.org/patch/series/view/openssl/0.9.8o-4squeeze13/version-script.patch
Comment 10 Johannes Hirte 2012-11-18 11:01:25 UTC
Ok, on a second system spotify works and I get this message:

/opt/spotify/spotify: /usr/lib64/libcrypto.so.1.0.0: no version information available (required by /opt/spotify/spotify)
/opt/spotify/spotify: /usr/lib64/libssl.so.1.0.0: no version information available (required by /opt/spotify/spotify)

Both systems are ~amd64, so I don't know what's different.
Comment 11 Johannes Hirte 2012-11-18 13:08:46 UTC
Ok, just recompiled openssl on the first system. Now it works there too with the

/opt/spotify/spotify: /usr/lib64/libcrypto.so.1.0.0: no version information available (required by /opt/spotify/spotify)
/opt/spotify/spotify: /usr/lib64/libssl.so.1.0.0: no version information available (required by /opt/spotify/spotify)
Comment 12 Matthew Thode ( prometheanfire ) archtester Gentoo Infrastructure gentoo-dev Security 2012-11-19 00:56:13 UTC
I think the best thing to do in these cases are to have the end user run revdep-rebuild to check for broken linking.  It's hard to justify the dep on 0.9.8 when it will not load with it (because qt stuff is built with 1.x for instance).  So for now I think it will remain as is.  I've notified upstream and will talk with them more tomorrow.  I'm hoping they start building with 1.x soon.
Comment 13 Johannes Hirte 2012-11-19 06:13:04 UTC
(In reply to comment #12)
> I think the best thing to do in these cases are to have the end user run
> revdep-rebuild to check for broken linking. 

revdep-rebuild didn't helped here. It wasn't broken linking but wrong version information in the shared lib. If it was broken linking, rebuilding openssl should not help.
Comment 14 Andreas Fink 2013-11-25 12:29:55 UTC
Sorry to comment on a closed issue...
I needed to recompile openssl with the default GNU linker ld.bfd (binutils-config --linker ld.bfd). The gold linker gives exactly the error mentioned in this bugreport.
Comment 15 Johannes Hirte 2013-12-04 22:15:34 UTC
(In reply to Andreas Fink from comment #14)
> Sorry to comment on a closed issue...
> I needed to recompile openssl with the default GNU linker ld.bfd
> (binutils-config --linker ld.bfd). The gold linker gives exactly the error
> mentioned in this bugreport.

Thanks for this. I can confirm, that compiling openssl with ld.bfd makes spotify work. Is there an option to make spotify depends on openssl compiled with ld.bfd?
Comment 16 Matthew Thode ( prometheanfire ) archtester Gentoo Infrastructure gentoo-dev Security 2013-12-11 02:56:57 UTC
There's not a way to get it to not link with that, so ewarn :(