Origin: Command Line Tools not working on Ubuntu 18

[alexandrevicenzi]

Command Line Tools available on https://mirror.openshift.com/pub/openshift-v3/clients/3.11.0-0.21.0/linux/oc.tar.gz does not working on Ubuntu 18.

Version

3.11?

Steps To Reproduce

1. Download https://mirror.openshift.com/pub/openshift-v3/clients/3.11.0-0.21.0/linux/oc.tar.gz
2. Extract
3. Try to run oc <command>

Current Result

libcrypto.so.10: cannot open shared object file: No such file or directory

Expected Result

It should work.

Additional Information

The version from https://github.com/openshift/origin/releases/download/v3.10.0/openshift-origin-client-tools-v3.10.0-dd10d17-linux-64bit.tar.gz works on Ubuntu 18.

Current versions of libssl for Ubuntu 18

libssl1.0.0/bionic-updates,bionic-security,now 1.0.2n-1ubuntu5.1
libssl1.1/bionic-updates,bionic-security,now 1.1.0g-2ubuntu4.1

These versions are not compatible as far as I tested.

[jwforres]

@openshift/sig-master

[soltysh]

@alexandrevicenzi looks like you're hitting a problem mentioned in https://askubuntu.com/a/339371 mind giving it a try?

[alexandrevicenzi]

@soltysh already tried and didn't work.

[soltysh]

Which exact version of libcrypto you have installed?

[alexandrevicenzi]

libcrypto++6/bionic,now 5.6.4-8 amd64
libssl1.0.0/bionic-updates,bionic-security,now 1.0.2n-1ubuntu5.1 amd64
libssl1.1/bionic-updates,bionic-security,now 1.1.0g-2ubuntu4.1 amd64

[juanvallejo]

Maybe the binary is expecting to find libcrypto.so.10 in /usr/lib instead of /usr/lib/x86_64-linux-gnu. Try symlinking to /usr/lib

[alexandrevicenzi]

If I create a symlink to use these versions it fails because the headers aren't compatible. My guess Ubuntu has a newer version and oc uses an older one.

[soltysh]

It might be that the golang package that's building these binaries relies on older libraries than ubuntu provides. In which case the only thing I can recommend is try rebuilding it locally and see if that works for you.

[alexandrevicenzi]

@soltysh rebuilding it works.

$ _output/local/bin/linux/amd64/oc version
oc v4.0.0-alpha.0+9b0a97c-250
kubernetes v1.11.0+d4cacc0
features: Basic-Auth GSSAPI Kerberos SPNEGO

The problem that I see it that the binary is available to download as the Linux version and it's quite hard to get it working on all distros.

[soltysh]

It looks like our @openshift/sig-security team is responsible for these problems, reassigning to them.

[archit2306]

Hi I am also getting the same issue while trying to install oc on ubuntu 18.04 LTS

[skonto]

I am hitting the same issue on both 16.04 and 18.04. This is a blocker. Symlink does not work as mentioned above:

./oc
./oc: /lib/x86_64-linux-gnu/libcrypto.so.10: version `OPENSSL_1.0.1_EC' not found (required by ./oc)
./oc: /lib/x86_64-linux-gnu/libcrypto.so.10: version `libcrypto.so.10' not found (required by ./oc)

[davivcgarcia]

I'm hitting the same problem on Debian 9. The workaround suggested at Stackoverflow does not work for me either. I tried to force the static compilation of the client, but it doesn't work (not sure why yet):

$ git clone [email protected]:davivcgarcia/openshift-origin.git --branch=master --depth=1
$ cd openshift-origin/
$ export CGO_LDFLAGS="-g -O2 -s"
$ export CGO_ENABLED=0
$ make build WHAT=cmd/oc
hack/build-go.sh cmd/oc 
++ Building go targets for linux/amd64: cmd/oc
# github.com/openshift/origin/pkg/oc/lib/tokencmd
pkg/oc/lib/tokencmd/negotiator_gssapi.go:23:7: undefined: gssapi.Lib
pkg/oc/lib/tokencmd/negotiator_gssapi.go:30:8: undefined: gssapi.Name
pkg/oc/lib/tokencmd/negotiator_gssapi.go:32:7: undefined: gssapi.CtxId
pkg/oc/lib/tokencmd/negotiator_gssapi.go:41:8: undefined: gssapi.CredId
[ERROR] hack/lib/build/binaries.sh:236: `GOOS=${platform%/*} GOARCH=${platform##*/} go install -pkgdir "${pkgdir}/${platform}" -tags "${OS_GOFLAGS_TAGS-} ${!platform_gotags_envvar:-}" -ldflags="${local_ldflags}" "${goflags[@]:+${goflags[@]}}" -gcflags "${gogcflags}" "${nonstatics[@]}"` exited with status 2.
[ERROR] hack/lib/build/binaries.sh:150: `( os::build::internal::build_binaries "${binaries[@]+"${binaries[@]}"}" )` exited with status 2.
[ERROR] hack/build-go.sh exited with code 2 after 00h 00m 04s
Makefile:43: recipe for target 'build' failed
make: *** [build] Error 2

If I unset the environment variables, the compilation works fine:

$ export CGO_ENABLED=1
$ export CGO_LDFLAGS="-g -O2"
$ make build WHAT=cmd/oc
hack/build-go.sh cmd/oc 
++ Building go targets for linux/amd64: cmd/oc
[INFO] hack/build-go.sh exited with code 0 after 00h 00m 16s

[davivcgarcia]

I checked the last binaries from 3.9 and 3.10 releases and the they were dynamically linked too, but the shared libraries used were more commonly available in other distros. The problems seems to be the dependency with the libcrypto.so.10 of the release-3.11:

$ ldd oc-3.10.45
    linux-vdso.so.1 (0x00007ffdee366000)
    libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f5231ec6000)
    libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f5231cc2000)
    libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f5231923000)
    /lib64/ld-linux-x86-64.so.2 (0x00007f52320e3000)

$ ldd oc-3.9.43
    linux-vdso.so.1 (0x00007fff5b586000)
    libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f04a3ff0000)
    libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f04a3dec000)
    libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f04a3a4d000)
    /lib64/ld-linux-x86-64.so.2 (0x00007f04a420d000)

[iamanam]

any solution yet? is it possible to downgrade oc to make it work with anyhow?

[ericavonb]

The community releases (https://github.com/openshift/origin/releases) should work without issue. In general, the OpenShift Container Platform builds are only guaranteed to work with RHEL. We're working with the RHEL golang team and release teams to see if we can make the published builds work; in the mean time please download the client tool from the github origin releases.

[alexandrevicenzi]

@ericavonb There's the option to release it as a Flatpak, AppImage or Snap, or even RPM and DEB packages for each distribution. In this case for distributions, someone else should take care of it and be responsible for maintaining the package.

[gabrielgrant]

Is the OS Origin client compatible with the enterprise edition of OS Container Platform?

[enj]

Is the OS Origin client compatible with the enterprise edition of OS Container Platform?

Yes, within the standard +/-1 version drift between client and server.

[rosscdh]

+1 still problematic in ubuntu + other builds

[wking]

Cross-reference rhbz#166493.

[wking]

For folks using OpenShift 4 during the preview/beta phase, @smarterclayton has also suggested
https://artifacts-openshift-master.svc.ci.openshift.org/zips/ as a source of Ubuntu-compatible clients. Checking:

$ wget https://artifacts-openshift-master.svc.ci.openshift.org/zips/openshift-origin-client-tools-v4.0.0-alpha.0-3bc8da4-1481-linux-64bit.tar.gz
$ tar -xvf openshift-origin-client-tools-v4.0.0-alpha.0-3bc8da4-1481-linux-64bit.tar.gz --strip-components 1
$ lddtree oc
oc => ./oc (interpreter => /lib64/ld-linux-x86-64.so.2)
    libpthread.so.0 => /lib64/libpthread.so.0
        ld-linux-x86-64.so.2 => /lib64/ld-linux-x86-64.so.2
    libdl.so.2 => /lib64/libdl.so.2
    libc.so.6 => /lib64/libc.so.6

So that looks good compared to the most recent v4 build from the release page:

$ wget https://mirror.openshift.com/pub/openshift-v3/clients/4.0.17/linux/oc.tar.gz
$ tar -xf oc.tar.gz
$ lddtree oc
oc => ./oc (interpreter => /lib64/ld-linux-x86-64.so.2)
    libpthread.so.0 => /lib64/libpthread.so.0
        ld-linux-x86-64.so.2 => /lib64/ld-linux-x86-64.so.2
    libcrypto.so.10 => /lib64/libcrypto.so.10
        libz.so.1 => /lib64/libz.so.1
    libdl.so.2 => /lib64/libdl.so.2
    libc.so.6 => /lib64/libc.so.6

I'm not sure what the difference is in building that's pulling in libcrypto or not.

[josequaresma]

Thanks @wking , I was facing the same issue in on Ubuntu WSL on Windows 10 and I can confirm that the binaries suggested by @smarterclayton work!

[smarterclayton]

It has to do with the FIPS mode crypto behavior in fedora/rhel golang.
Still being worked on - it should have been using dlopen instead of a
shared library. We will either disable it or fix it before the next drop.

On Fri, Mar 8, 2019 at 3:29 PM Jose Quaresma [e-mail]
wrote:

Thanks @wking https://github.com/wking , I was facing the same issue in
on Ubuntu WSL on Windows 10 and I can confirm that the binaries suggested
by @smarterclayton https://github.com/smarterclayton work!

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/openshift/origin/issues/21061#issuecomment-471066235,
or mute the thread
https://github.com/notifications/unsubscribe-auth/ABG_p_wpVGtihGCWmt-UpW_NvPlp0_QGks5vUsg8gaJpZM4WyoYx
.

[booxter]

I am on Fedora 29 (using official vagrant image), and I have exactly the same issue. It's not just Ubuntu.

[orekav]

Same issue here, I have installed Minishift a few hours ago (Ubuntu 18.04.2 installed yesterday - everything up to date)

$ eval $(minishift oc-env)
$ oc
oc: error while loading shared libraries: libcrypto.so.10: cannot open shared object file: No such file or directory

[jupierce]

@smarterclayton this is now impacting RHEL7. oc direct from latest CI, executed on RHEL 7.6 bastion.

oc: error while loading shared libraries: libcrypto.so.1.1: cannot open shared object file: No such file or directory

[wangjun1974]

rhel8 beta see similar issue.

# oc
oc: error while loading shared libraries: libcrypto.so.10: cannot open shared object file: No such file or directory

# ldd /usr/local/bin/oc
        linux-vdso.so.1 (0x00007ffe843d9000)
        libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f3bb2ecd000)
        libcrypto.so.10 => not found
        libdl.so.2 => /lib64/libdl.so.2 (0x00007f3bb2cc9000)
        libc.so.6 => /lib64/libc.so.6 (0x00007f3bb2905000)
        /lib64/ld-linux-x86-64.so.2 (0x00007f3bb30ed000)

[wking]

22595 is the short-term fix for this, so folks with subsequent builds should be fine. The next step is to do something smart with dlopen so folks can opt-in to a system libcrypto without requiring everyone to have the same system libcrypto, but users that don't care one way or the other can probably stop worrying about this issue now. Not sure if that means "close this bug" or not ;).

[openshift-bot]

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

[arlindo-agencia-tmd]

I am hitting the same issue on both 16.04 and 18.04. This is a blocker. Symlink does not work as mentioned above:

./oc
./oc: /lib/x86_64-linux-gnu/libcrypto.so.10: version `OPENSSL_1.0.1_EC' not found (required by ./oc)
./oc: /lib/x86_64-linux-gnu/libcrypto.so.10: version `libcrypto.so.10' not found (required by ./oc)

I'm having the same problem using Ubuntu 18.04

[ecwpz91]

@wangjun1974 I searched for package that provides libcrypto.so.10 and installed it.

yum provides "*libcrypto.so.10"

AND

yum install compat-openssl10

[smarterclayton]

This should have been marked fixed, if it's not then please report exact versions.

[TomC4D]

The solution above
yum provides "*libcrypto.so.10"

AND

yum install compat-openssl10

works on RHEL8