2

I have an old system based on a Mandriva 2010.1 distribution that no longer receives any updates.

Up until very recently, I was able to use the builtin git binaries to communicate with GitHub just fine but as they have changed their policy regarding insecure protocols, I am now getting this error message:

fatal: unable to access 'https://github.com/user/repo.git/': error:1407742E:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert protocol version

There are lots of answers related to that message, most of them simply being "update your client" which would be fine by me if I were not stuck with that ancient system for the foreseeable future.

Luckily for me, I have all the required build tools on that machine, and so I downloaded the sources for git 2.16.2, extracted them in /usr/src/git-2.16.2 and naively ran those commands:

./configure
make
./git --exec-path=/usr/src/git-2.16.2 clone https://github.com/user/repo.git

But, as would be quite obvious to you, this did not solve the issue.

I thus looked further to how git-remote-https is built and figured out that I would also need a more recent libcurl and a more recent open-ssl library.

So, I began with OpenSSL and put it in /usr/src/openssl-1.1.0g and built it with these commands:

./config enable-shared enable-egd
make

This built just fine so I moved on to build curl trying to make sure that it would use the openssl that I just built. I installed its sources inside /usr/src/curl-7.58.0and after a bit of trial and error, looking at various resources, I came up with the following commands:

LDFLAGS="-L/usr/src/openssl-1.1.0g -Wl,-rpath,/usr/src/openssl-1.1.0g" LIBS="-ldl" ./configure --with-ssl=/usr/src/openssl-1.1.0g --with-libssl-prefix=/usr/src/openssl-1.1.0g --disable-ldap
make

This builds just fine and I can find libcurl.so.4 inside /usr/src/curl-7.58.0/lib/.libs

I thus moved to the last step, which is building git from sources located inside /usr/src/git-2.16.2 with the following commands:

LDFLAGS="-L/usr/src/openssl-1.1.0g -L/usr/src/curl-7.58.0 -Wl,-rpath,/usr/src/openssl-1.1.0g,-rpath,/usr/src/curl-7.58.0/lib/.libs" LIBS="-ldl" ./configure --with-curl=/usr/src/curl-7.58.0 --with-openssl=/usr/src/openssl-1.1.0g
make

With all this, I get a set of git binaries and if use readelf on git-remote-https, it appears correct:

Dynamic section at offset 0x125448 contains 27 entries:

  Tag        Type                         Name/Value
 0x0000000000000001 (NEEDED)             Shared library: [libcurl.so.4]
 0x0000000000000001 (NEEDED)             Shared library: [libssl.so.1.1]
 0x0000000000000001 (NEEDED)             Shared library: [libexpat.so.1]
 0x0000000000000001 (NEEDED)             Shared library: [libz.so.1]
 0x0000000000000001 (NEEDED)             Shared library: [librt.so.1]
 0x0000000000000001 (NEEDED)             Shared library: [libpthread.so.0]
 0x0000000000000001 (NEEDED)             Shared library: [libc.so.6]
 0x000000000000000f (RPATH)              Library rpath: [/usr/src/openssl-1.1.0g:/usr/src/curl-7.58.0/lib/.libs:/usr/src/curl-7.58.0/lib]
 0x000000000000000c (INIT)               0x403870
 0x000000000000000d (FINI)               0x4e7448
 0x000000006ffffef5 (GNU_HASH)           0x400240
 0x0000000000000005 (STRTAB)             0x401838
 0x0000000000000006 (SYMTAB)             0x4002a8
 0x000000000000000a (STRSZ)              2411 (bytes)
 0x000000000000000b (SYMENT)             24 (bytes)
 0x0000000000000015 (DEBUG)              0x0
 0x0000000000000003 (PLTGOT)             0x725658
 0x0000000000000002 (PLTRELSZ)           5160 (bytes)
 0x0000000000000014 (PLTREL)             RELA
 0x0000000000000017 (JMPREL)             0x402448
 0x0000000000000007 (RELA)               0x4023d0
 0x0000000000000008 (RELASZ)             120 (bytes)
 0x0000000000000009 (RELAENT)            24 (bytes)
 0x000000006ffffffe (VERNEED)            0x402370
 0x000000006fffffff (VERNEEDNUM)         2
 0x000000006ffffff0 (VERSYM)             0x4021a4
 0x0000000000000000 (NULL)               0x0

However, if I start the same command above to retrieve the same repository, I get a very different output:

Cloning into 'repo'...
warning: templates not found /usr/local/share/git-core/templates
kernel: git-remote-http[14950]: segfault at 0 ip 00007f027380ce66 sp 00007fffa34bf5f8 error 4 in libc-2.11.1.so[7f0273793000+163000]

So, clearly, there is something wrong in the way I built my git binaries but I can't really figure out what.

Inspecting the log from make when building Git, I noticed the following warning message:

/usr/bin/ld: warning: libssl.so.1.0.0, needed by /usr/lib/gcc/x86_64-manbo-linux-gnu/4.4.3/../../../../lib64/libcurl.so, may conflict with libssl.so.1.1

It gets repeated for a number of git-remote executables and I find it a bit strange. I mean, readelf tells me libcurl.so.4 is the one that is used, and yet it appears as if the linker is still importing an old version from my outdated system libraries.

This may well explain the segfaults I'm observing, but then, how should I have built this whole chain?

Any help would be greatly appreciated.

2

To further explore the origin of the crash, I used ldd -a on git-remote-https and it showed that it was using libcurl.so.4 from system folders, not from my libcurl folder. As a result, the loader was allowing two versions of libcrypto being used, leading quite surely to the segfault I was observing.

However, after making sure make clean was called in each directory, I am now in a working situation, with the following set of commands:

For OpenSSL

./config enable-shared enable-egd
make

Then for CURL

LDFLAGS="-L/usr/src/openssl-1.1.0g -Wl,-rpath,/usr/src/openssl-1.1.0g" LIBS="-ldl" ./configure --with-ssl=/usr/src/openssl-1.1.0g --with-libssl-prefix=/usr/src/openssl-1.1.0g --disable-ldap --enable-libcurl-option
make

At that point, make sure that libcurl.so.4 is present in /usr/src/curl-7.58.0/lib/.libs. It seems that the --enable-libcurl-option ensures that this is the case while the command line used above does not always do.

Then finally, for git itself:

LDFLAGS="-L/usr/src/openssl-1.1.0g -L/usr/src/curl-7.58.0 -Wl,-rpath,/usr/src/openssl-1.1.0g,-rpath,/usr/src/curl-7.58.0/lib/.libs" LIBS="-ldl" ./configure --with-curl=/usr/src/curl-7.58.0 --with-openssl=/usr/src/openssl-1.1.0g
make

Now, using ldd you will see that /usr/src/curl-7.58.0/lib/.libs/libcurl.so.4 is used and not the one from system directories. This means that the following git command works properly:

./git --exec-path=/usr/src/git-2.16.2 clone https://github.com/user/repo.git

it is a bit cumbersome to require the use of --exec-path for every git command, but the alias command is quite convenient in this case.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.