first build on Linux: OpenSSL issue

[mzimmers]

Hi all -

I just started getting my app to run on Linux (Ubuntu 22.04). It builds fine (and actually runs fine), but on startup I get an error:

qt.tlsbackend.ossl: Incompatible version of OpenSSL (built with OpenSSL >= 3.x, runtime version is < 3.x)

I found this topic, and I think I understand the problem, but I want to make sure.

1. do I correctly understand that I'm building my app with a more recent version of OpenSSL (3.x) than Qt wants me to use?
2. per the other thread, I did download an older version of OpenSSL. Per the other topic, I guess I need to add its path to the environment variable LD_LIBRARY_PATH (which currently doesn't even exist on my new system). But if I create such an entry, doesn't that imply that any of my other apps will attempt to run the old version (which is possibly undesirable)?
3. if my assumption in (2) is correct, would it be preferable to set the environment variable in my CMakeLists.txt file, using the set() command?

Thanks...

[JoeCFD]

@mzimmers said in first build on Linux: OpenSSL issue:

focal

sudo is not needed. Focal is 20.04, not 22.04. Are you sure you installed 22.04? Could be the case that libssl 1.1 points to focal.

[SGaist]

Hi,

1. language nitpick: you are likely not linking against OpenSSL. The situation is more likely to be: you are using a Qt version that was built to load OpenSSL 3. So the answer is: it will depend on the Qt version that your application will load at run time.
2. Don't do it system wide. Most of the software that need that use a bash script to set it and then launch the application itself.
3. You can set LD_LIBRARY_PATH in the run part of the Projet panel or outside of Qt Creator see point 2.

[mzimmers]

@SGaist sorry, I forgot to mention that I'm using Qt 6.5.3.

So, in the error message, where it says "built with" -- does that refer to my application, or to the version of Qt I'm running? And, I don't understand the "runtime version" being < 3.x; this is a new system with a new install of Qt, and I do have a libssl3.so in my /usr/lib/x86_64-linux-gnu folder.

I guess what I'm really asking is, which version of the library should I be trying to use - the old one, or the new one?

Thanks...

[SGaist]

The prebuilt versions of Qt do not link to OpenSSL directly but loads it at run time. So what you see there is the version of OpenSSL that was used to build the loading support. The runtime value is the version of OpenSSL that was found when your application is loaded.

It is surprising that you have such a mismatch. Can you use strace to check which version of OpenSSL is found ?

[JoeCFD]

@mzimmers run
locate libssl3.so
to see if you have more than one.

My guess is you have one with Qt installation and your app is built with it. But when you run your app, it links with the one( /usr/lib/x86_64-linux-gnu/libssl3.so ) installed with distribution. Ubuntu 22.04 has Qt 6.2.4. If you install it, you can purge it because you are not using it.

[mzimmers]

@JoeCFD

locate libssl3.so
/snap/chromium/1135/usr/lib/x86_64-linux-gnu/libssl3.so
/snap/chromium/2704/usr/lib/x86_64-linux-gnu/libssl3.so
/snap/gnome-42-2204/141/usr/lib/x86_64-linux-gnu/libssl3.so
/snap/slack/118/usr/lib/x86_64-linux-gnu/libssl3.so
/snap/snap-store/433/usr/lib/x86_64-linux-gnu/libssl3.so
/snap/snap-store/959/usr/lib/x86_64-linux-gnu/libssl3.so
/usr/lib/firefox/libssl3.so
/usr/lib/thunderbird/libssl3.so
/usr/lib/x86_64-linux-gnu/libssl3.so

This might be of more interest:

mzimmers@LinuxBoxZimmers:/usr/lib/x86_64-linux-gnu$ ls -l libssl*
-rw-r--r-- 1 root root  382024 Feb 17  2023 libssl3.so
-rw-r--r-- 1 root root 1016494 Oct 10 02:03 libssl.a
lrwxrwxrwx 1 root root      13 Oct 10 02:03 libssl.so -> libssl.so.1.1
-rw-r--r-- 1 root root  598104 Oct 10 02:03 libssl.so.1.1
mzimmers@LinuxBoxZimmers:/usr/lib/x86_64-linux-gnu$ 

If I understand this, my system is set up to use 1.1 (that's where the link is pointing)...is that how it should be?

@SGaist can you give me the proper invocation for strace? I tried it, but it just gives reams of output.

Thanks...

[JoeCFD]

@mzimmers show
ldd your app | grep libssl

[mzimmers]

@JoeCFD nothing.

[JoeCFD]

@mzimmers ldd your app

[mzimmers]

@JoeCFD I did:

mzimmers@LinuxBoxZimmers:~/QtProjects/build-NgaIcdFw-Desktop_Qt_6_5_3_GCC_64bit-Debug$ ldd appNgaIcdFw | grep libssl
mzimmers@LinuxBoxZimmers:~/QtProjects/build-NgaIcdFw-Desktop_Qt_6_5_3_GCC_64bit-Debug$ 

[JoeCFD]

@mzimmers no need. The Qt plugin has issue. Not your code.

[mzimmers]

@JoeCFD which plugin are you referring to?

[JoeCFD]

@mzimmers
Qt has a plugin libqopensslbackend.so in under gcc_64/plugins/tls. But I can see the direct link to libssl.

Anyway, libssl.so -> libssl.so.1.1 softlink always points to libssl.so.1.1.
I guess if you softlink libssl.so to libssl3.so, the problem may be gone. However, other packages in your system may be affected if they use 1.1.

[mzimmers]

@JoeCFD said in first build on Linux: OpenSSL issue:

Qt has a plugin libqopensslbackend.so in under gcc_64/plugins/tls. But I can see the direct link to libssl.

And this plugin links to version 1.1 of OpenSSL? Or is this because of the link in my /usr/lib/x86_64-linux-gnu folder?

I'd prefer to eliminate the error message, but not at the expense of breaking other applications in the system.

[JoeCFD]

@mzimmers Which Qt modules are you using? I ran a few Qt 6.6 network examples and could not see your issue.

[mzimmers]

@JoeCFD

Qt 6.5.3
Desktop gcc 64-bit
WebAssembly (single-threaded)
Android
Sources
Qt HTTP Server (TP)
Qt Virtual Keyboard
Qt WebSockets

Thanks...

[SGaist]

How come you have both OpenSSL 3 and 1.1 ?

How did you install them ?

[JoeCFD]

@mzimmers I have two in my computer as well. But my libssl points to libssl.so.3 and openssl version shows OpenSSL 3.0.2.

Maybe you can try to reinstall it.
sudo apt-get reinstall openssl
and then run
openssl version
to see if you have the right version

[mzimmers]

@JoeCFD still points to 1.1. shrug

I suppose I could manually relink it, but I'm not sure about the side effects.

[mzimmers]

@SGaist I have no idea - this is how the system came to me. The only real change my IT department made was to install some anti-virus application; maybe that used the older version of openssl?