I have an old system based on a Mandriva 2010.1 distribution that no longer receives any updates.
Up until very recently, I was able to use the builtin git binaries to communicate with GitHub just fine but as they have changed their policy regarding insecure protocols, I am now getting this error message:
fatal: unable to access 'https://github.com/user/repo.git/': error:1407742E:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert protocol version
There are lots of answers related to that message, most of them simply being "update your client" which would be fine by me if I were not stuck with that ancient system for the foreseeable future.
Luckily for me, I have all the required build tools on that machine, and so I downloaded the sources for git
2.16.2, extracted them in
/usr/src/git-2.16.2 and naively ran those commands:
./configure make ./git --exec-path=/usr/src/git-2.16.2 clone https://github.com/user/repo.git
But, as would be quite obvious to you, this did not solve the issue.
I thus looked further to how
git-remote-https is built and figured out that I would also need a more recent
libcurl and a more recent
So, I began with OpenSSL and put it in
/usr/src/openssl-1.1.0g and built it with these commands:
./config enable-shared enable-egd make
This built just fine so I moved on to build
curl trying to make sure that it would use the
openssl that I just built. I installed its sources inside
/usr/src/curl-7.58.0and after a bit of trial and error, looking at various resources, I came up with the following commands:
LDFLAGS="-L/usr/src/openssl-1.1.0g -Wl,-rpath,/usr/src/openssl-1.1.0g" LIBS="-ldl" ./configure --with-ssl=/usr/src/openssl-1.1.0g --with-libssl-prefix=/usr/src/openssl-1.1.0g --disable-ldap make
This builds just fine and I can find
I thus moved to the last step, which is building git from sources located inside
/usr/src/git-2.16.2 with the following commands:
LDFLAGS="-L/usr/src/openssl-1.1.0g -L/usr/src/curl-7.58.0 -Wl,-rpath,/usr/src/openssl-1.1.0g,-rpath,/usr/src/curl-7.58.0/lib/.libs" LIBS="-ldl" ./configure --with-curl=/usr/src/curl-7.58.0 --with-openssl=/usr/src/openssl-1.1.0g make
With all this, I get a set of git binaries and if use
git-remote-https, it appears correct:
Dynamic section at offset 0x125448 contains 27 entries: Tag Type Name/Value 0x0000000000000001 (NEEDED) Shared library: [libcurl.so.4] 0x0000000000000001 (NEEDED) Shared library: [libssl.so.1.1] 0x0000000000000001 (NEEDED) Shared library: [libexpat.so.1] 0x0000000000000001 (NEEDED) Shared library: [libz.so.1] 0x0000000000000001 (NEEDED) Shared library: [librt.so.1] 0x0000000000000001 (NEEDED) Shared library: [libpthread.so.0] 0x0000000000000001 (NEEDED) Shared library: [libc.so.6] 0x000000000000000f (RPATH) Library rpath: [/usr/src/openssl-1.1.0g:/usr/src/curl-7.58.0/lib/.libs:/usr/src/curl-7.58.0/lib] 0x000000000000000c (INIT) 0x403870 0x000000000000000d (FINI) 0x4e7448 0x000000006ffffef5 (GNU_HASH) 0x400240 0x0000000000000005 (STRTAB) 0x401838 0x0000000000000006 (SYMTAB) 0x4002a8 0x000000000000000a (STRSZ) 2411 (bytes) 0x000000000000000b (SYMENT) 24 (bytes) 0x0000000000000015 (DEBUG) 0x0 0x0000000000000003 (PLTGOT) 0x725658 0x0000000000000002 (PLTRELSZ) 5160 (bytes) 0x0000000000000014 (PLTREL) RELA 0x0000000000000017 (JMPREL) 0x402448 0x0000000000000007 (RELA) 0x4023d0 0x0000000000000008 (RELASZ) 120 (bytes) 0x0000000000000009 (RELAENT) 24 (bytes) 0x000000006ffffffe (VERNEED) 0x402370 0x000000006fffffff (VERNEEDNUM) 2 0x000000006ffffff0 (VERSYM) 0x4021a4 0x0000000000000000 (NULL) 0x0
However, if I start the same command above to retrieve the same repository, I get a very different output:
Cloning into 'repo'... warning: templates not found /usr/local/share/git-core/templates kernel: git-remote-http: segfault at 0 ip 00007f027380ce66 sp 00007fffa34bf5f8 error 4 in libc-2.11.1.so[7f0273793000+163000]
So, clearly, there is something wrong in the way I built my git binaries but I can't really figure out what.
Inspecting the log from
make when building Git, I noticed the following warning message:
/usr/bin/ld: warning: libssl.so.1.0.0, needed by /usr/lib/gcc/x86_64-manbo-linux-gnu/4.4.3/../../../../lib64/libcurl.so, may conflict with libssl.so.1.1
It gets repeated for a number of
git-remote executables and I find it a bit strange. I mean,
readelf tells me
libcurl.so.4 is the one that is used, and yet it appears as if the linker is still importing an old version from my outdated system libraries.
This may well explain the segfaults I'm observing, but then, how should I have built this whole chain?
Any help would be greatly appreciated.