View Issue Details

IDProjectCategoryView StatusLast Update
0011254Rocky-Linux-10keapublic2025-11-27 18:55
ReporterMatt Gear Assigned ToLouis Abel  
PriorityhighSeveritycrashReproducibilityalways
Status needinfoResolutionopen 
Product Version10.0 
Summary0011254: kea / kea-dhcp4 on Rocky Linux 10.0 fails to start due to an undefined OpenSSL symbol
Descriptionkea / kea-dhcp4 on Rocky Linux 10.0 fails to start due to an undefined OpenSSL symbol, caused by the package being built against a newer OpenSSL version than the system provides.
The RPM does not declare the correct dependency, so DNF installs an incompatible combination.
On a clean install
dnf install kea
 results with:
/usr/sbin/kea-dhcp4: symbol lookup error:
 /lib64/libkea-cryptolink.so.64: undefined symbol:
 EVP_MD_CTX_get_size_ex, version OPENSSL_3.4.0

However, Rocky Linux 10 ships with:
openssl-libs-3.2.2-16.el10.x86_64

The Kea RPM does not declare any minimum version requirement for OpenSSL, so DNF installs it even though the system’s OpenSSL is too old.

This is a packaging error.
Steps To Reproducednf clean all
dnf update -y

dnf install -y kea
systemctl enable --now kea-dhcp4

systemctl status kea-dhcp4

Result:
/usr/sbin/kea-dhcp4: symbol lookup error:
 /lib64/libkea-cryptolink.so.64: undefined symbol:
 EVP_MD_CTX_get_size_ex, version OPENSSL_3.4.0

journalctl -xe shows the same.

Expected Result

Kea (3.0.1-2.el10_1) should start normally.

DNF should prevent installation if OpenSSL requirements are not satisfied.

System OpenSSL before fix:
openssl-libs-3.2.2-16.el10.x86_64

System OpenSSL after manual upgrade (working):
openssl-libs-3.5.1-4.el10_1.x86_64
Additional InformationRoot Cause

The Kea RPM was built against a newer OpenSSL (likely 3.4.0+ based on the missing symbol), but does not list a dependency such as:
Requires: openssl-libs >= 3.4.0

Therefore, DNF installs Kea alongside an incompatible version of OpenSSL.

Only after manually upgrading OpenSSL (which pulls in openssl-libs-3.5.1-4.el10_1) does Kea run successfully.

In Kea’s RPM spec file, add the correct OpenSSL dependency:
Requires: openssl-libs >= 3.4.0

Or whichever version contains EVP_MD_CTX_get_size_ex.

This ensures DNF automatically installs the required OpenSSL version and prevents broken Kea installations.



Impact
    • Kea DHCP server is broken out-of-the-box on Rocky 10.
    • Users relying on DHCP (including infrastructure deployments) encounter immediate service failure.
    • Workaround requires manual OpenSSL upgrade that DNF should have handled automatically.
TagsNo tags attached.

Activities

Louis Abel

Louis Abel

2025-11-27 18:55

administrator   ~0011914

Thank you for the report. There are inconsistencies with your description which needs clarification.

>The RPM does not declare the correct dependency, so DNF installs an incompatible combination.
>This is a packaging error.

Unless there is a hard dependency, this is usually not the case for most packages. Some packages, when being built, will automatically require certain versions or symbols (llvm is an example of this where mesa is heavily reliant on specific versions and symbols). Kea does not fall into this category as there is nothing indicating to build process (by spec or by detection) of specific reliance of the libraries it built against.

In this scenario, this is akin to cherry picking updates. At the surface, your system was not fully up to date when installing kea.

>However, Rocky Linux 10 ships with:
>openssl-libs-3.2.2-16.el10.x86_64

10.0 does, but 10.1 is released. 10.0 is now end of life and you are encouraged to update all of your systems to 10.1 using dnf update.

>dnf clean all
>dnf update -y

You are stating you ran this, but if you did, you would receive the latest openssl automatically as it's part of 10.1, which was released this week. See attached screenshot. There was no reason to do any manual updates of packages.

Setting to needinfo as I am unable to reproduce this behavior with your stated steps. Please ensure that you are updating your systems, fully, before installing any other packages.
Louis Abel

Louis Abel

2025-11-27 18:55

administrator   ~0011915

SCR-20251127-kjli.png (191,828 bytes)   
SCR-20251127-kjli.png (191,828 bytes)   

Issue History

Date Modified Username Field Change
2025-11-27 18:09 Matt Gear New Issue
2025-11-27 18:55 Louis Abel Assigned To => Louis Abel
2025-11-27 18:55 Louis Abel Status new => needinfo
2025-11-27 18:55 Louis Abel Note Added: 0011914
2025-11-27 18:55 Louis Abel Note Added: 0011915
2025-11-27 18:55 Louis Abel File Added: SCR-20251127-kjli.png