Do not call openssl_probe::init_ssl_cert_env_vars() on FreeBSD (#1129) #1130
Conversation
…lang#1129) The heuristics in openssl-probe leave the process environment with an invalid value breaking the certificate validation on FreeBSD. FreeBSD has a system truststore managed by certctl(8). Leave it to OpenSSL to do the right thing. Upstream issue: alexcrichton/openssl-probe#37 This fixes rust-lang#1129
Cargo uses curl-rust and git2-rs (which uses curl-rest as well). Unfortunately, git2-rs calls openssl_probe::init_ssl_cert_env_vars() unconditionally which breaks the process environment by setting an invalid value for SSL_CERT_DIR and then the system default truststore is circumvented, resulting in certificate validation errors even if certlctl(8) manages everything nicely. Upstream issues: * alexcrichton/openssl-probe#37 * rust-lang/git2-rs#1130 Reviewed by: jrm (mentor), otis (mentor), ... MFH: 2025Q1
|
@emaste FYI |
Cargo uses curl-rust and git2-rs (which uses curl-rest as well). Unfortunately, git2-rs calls openssl_probe::init_ssl_cert_env_vars() unconditionally which breaks the process environment by setting an invalid value for SSL_CERT_DIR and then the system default truststore is circumvented, resulting in certificate validation errors even if certctl(8) manages everything nicely. Upstream issues: * alexcrichton/openssl-probe#37 * rust-lang/git2-rs#1130 Reviewed by: jrm (mentor), mikael (rust) MFH: 2025Q1 Differential Revision: https://reviews.freebsd.org/D49120
Cargo uses curl-rust and git2-rs (which uses curl-rest as well). Unfortunately, git2-rs calls openssl_probe::init_ssl_cert_env_vars() unconditionally which breaks the process environment by setting an invalid value for SSL_CERT_DIR and then the system default truststore is circumvented, resulting in certificate validation errors even if certctl(8) manages everything nicely. Upstream issues: * alexcrichton/openssl-probe#37 * rust-lang/git2-rs#1130 Reviewed by: jrm (mentor), mikael (rust) MFH: 2025Q1 Differential Revision: https://reviews.freebsd.org/D49120 (cherry picked from commit 0780826)
|
Sorry, I don't know much about FreeBSD in this regard. @asomers do you perhaps have any knowledge here? Can you say why this wouldn't be a fix in |
Fro two reasons:
Don't set anything explicit if it works works flawless implicit: SSL_CTX_set_default_verify_paths I have already committed the patch downstream in FreeBSD's Rust port to fix Cargo, but this doesn't fix standalone use of this library: freebsd/freebsd-ports@0780826 |
|
Sorry @ehuss ; I'm not knowledgeable about this issue. |
|
@ehuss Do you have any objections/pain to merge this? |
|
Folks, is there anything I can do to get this upstream or provide your further information how truststore works on FreeBSD? |
Is this true with OpenSSL is built from source (like when vendored-openssl is set)? |
Yes, I am building OpenSSL on HP-UX for quite some time and this is how it looks like: Works as designed. |
|
Sorry, I don't quite understand the output that you are showing (or how HP-UX is related to FreeBSD). Vendored-openssl wouldn't provide a CLI I suppose what I'm asking is, does the openssl built by |
I totally misunderstood your question since I know very little about Rust and its ecosytem around Cargo. I will re-evaluate your question and get back to you. The HP-UX was simply to show you that a trust store can be made available at any place and OpenSSL will always pick it if you have configured it properly at compile time and call the right C functions. |
I understand your question now. Processing, please hold on. |
OK, this is how it works with the vendored (integrated) version OpenSSL on any platform Rust supports, not just FreeBSD: The vendored build is configured here: https://github.com/alexcrichton/openssl-src-rs/blob/7d112379fbbc6a4c343cd2d746b8e257bc75eff5/src/lib.rs#L39. AS you can see So this is embedded in the archive: which come from https://github.com/openssl/openssl/blob/29464b4c15db4c4063633743254986a91b91dd33/include/internal/common.h#L84-L86. This compilation unit of OpenSSL will query I hope this helps to understand the complexity of the issue. FWIW, I have fixed the same issue in PHP composer some time ago: composer/ca-bundle#98 |
The heuristics in openssl-probe leave the process environment with an invalid value breaking the certificate validation on FreeBSD. FreeBSD has a system truststore managed by certctl(8). Leave it to OpenSSL to do the right thing.
Upstream issue: alexcrichton/openssl-probe#37
This fixes #1129