View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0011254 | Rocky-Linux-10 | kea | public | 2025-11-27 18:09 | 2025-11-27 18:55 |
| Reporter | Matt Gear | Assigned To | Louis Abel | ||
| Priority | high | Severity | crash | Reproducibility | always |
| Status | needinfo | Resolution | open | ||
| Product Version | 10.0 | ||||
| Summary | 0011254: kea / kea-dhcp4 on Rocky Linux 10.0 fails to start due to an undefined OpenSSL symbol | ||||
| Description | kea / kea-dhcp4 on Rocky Linux 10.0 fails to start due to an undefined OpenSSL symbol, caused by the package being built against a newer OpenSSL version than the system provides. The RPM does not declare the correct dependency, so DNF installs an incompatible combination. On a clean install dnf install kea results with: /usr/sbin/kea-dhcp4: symbol lookup error: /lib64/libkea-cryptolink.so.64: undefined symbol: EVP_MD_CTX_get_size_ex, version OPENSSL_3.4.0 However, Rocky Linux 10 ships with: openssl-libs-3.2.2-16.el10.x86_64 The Kea RPM does not declare any minimum version requirement for OpenSSL, so DNF installs it even though the system’s OpenSSL is too old. This is a packaging error. | ||||
| Steps To Reproduce | dnf clean all dnf update -y dnf install -y kea systemctl enable --now kea-dhcp4 systemctl status kea-dhcp4 Result: /usr/sbin/kea-dhcp4: symbol lookup error: /lib64/libkea-cryptolink.so.64: undefined symbol: EVP_MD_CTX_get_size_ex, version OPENSSL_3.4.0 journalctl -xe shows the same. Expected Result Kea (3.0.1-2.el10_1) should start normally. DNF should prevent installation if OpenSSL requirements are not satisfied. System OpenSSL before fix: openssl-libs-3.2.2-16.el10.x86_64 System OpenSSL after manual upgrade (working): openssl-libs-3.5.1-4.el10_1.x86_64 | ||||
| Additional Information | Root Cause The Kea RPM was built against a newer OpenSSL (likely 3.4.0+ based on the missing symbol), but does not list a dependency such as: Requires: openssl-libs >= 3.4.0 Therefore, DNF installs Kea alongside an incompatible version of OpenSSL. Only after manually upgrading OpenSSL (which pulls in openssl-libs-3.5.1-4.el10_1) does Kea run successfully. In Kea’s RPM spec file, add the correct OpenSSL dependency: Requires: openssl-libs >= 3.4.0 Or whichever version contains EVP_MD_CTX_get_size_ex. This ensures DNF automatically installs the required OpenSSL version and prevents broken Kea installations. ⸻ Impact • Kea DHCP server is broken out-of-the-box on Rocky 10. • Users relying on DHCP (including infrastructure deployments) encounter immediate service failure. • Workaround requires manual OpenSSL upgrade that DNF should have handled automatically. | ||||
| Tags | No tags attached. | ||||
|
Thank you for the report. There are inconsistencies with your description which needs clarification. >The RPM does not declare the correct dependency, so DNF installs an incompatible combination. >This is a packaging error. Unless there is a hard dependency, this is usually not the case for most packages. Some packages, when being built, will automatically require certain versions or symbols (llvm is an example of this where mesa is heavily reliant on specific versions and symbols). Kea does not fall into this category as there is nothing indicating to build process (by spec or by detection) of specific reliance of the libraries it built against. In this scenario, this is akin to cherry picking updates. At the surface, your system was not fully up to date when installing kea. >However, Rocky Linux 10 ships with: >openssl-libs-3.2.2-16.el10.x86_64 10.0 does, but 10.1 is released. 10.0 is now end of life and you are encouraged to update all of your systems to 10.1 using dnf update. >dnf clean all >dnf update -y You are stating you ran this, but if you did, you would receive the latest openssl automatically as it's part of 10.1, which was released this week. See attached screenshot. There was no reason to do any manual updates of packages. Setting to needinfo as I am unable to reproduce this behavior with your stated steps. Please ensure that you are updating your systems, fully, before installing any other packages. |
|
|
|
|
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2025-11-27 18:09 | Matt Gear | New Issue | |
| 2025-11-27 18:55 | Louis Abel | Assigned To | => Louis Abel |
| 2025-11-27 18:55 | Louis Abel | Status | new => needinfo |
| 2025-11-27 18:55 | Louis Abel | Note Added: 0011914 | |
| 2025-11-27 18:55 | Louis Abel | Note Added: 0011915 | |
| 2025-11-27 18:55 | Louis Abel | File Added: SCR-20251127-kjli.png |