网上有很多编译OpenSSL源码(3.x版本)为RPM包的文章，这些文章在安装RPM包时都是执行rpm -ivh openssl-xxx.rpm --nodeps --force
这个命令能在缺少依赖包的情况下能强行执行安装
其实根据Centos的文档，安装RPM包一般是执行yum install或dnf install。后者是Centos 9 stream的安装命令，是替换yum命令的。
以Centos 9上生成的OpenSSH 3.5的RPM包为例：生成了3个RPM包，分别是 :
openssl-3.5.0-2.el9.x86_64.rpmopenssl-libs-3.5.0-2.el9.x86_64.rpmopenssl-devel-3.5.0-2.el9.x86_64.rpm
执行安装的命令为 :
dnf install ./openssl-libs-3.5.0-2.el9.x86_64.rpm ./openssl-3.5.0-2.el9.x86_64.rpm
报错信息类似如下:
Problem 1: problem with installed package crypto-policies-20240828-2.git626aa59.el9.noarch
- package crypto-policies-20240828-2.git626aa59.el9.noarch from @System conflicts with openssl-libs < 1:3.0.1-10 provided by openssl-libs-1:3.5.0-2.el9.x86_64 from @commandline
- package crypto-policies-20240304-1.gitb1c706d.el9.noarch from baseos conflicts with openssl-libs < 1:3.0.1-10 provided by openssl-libs-1:3.5.0-2.el9.x86_64 from @commandline
- package crypto-policies-20240815-1.gite217f03.el9.noarch from baseos conflicts with openssl-libs < 1:3.0.1-10 provided by openssl-libs-1:3.5.0-2.el9.x86_64 from @commandline
- package crypto-policies-20240822-1.gitbaf3e06.el9.noarch from baseos conflicts with openssl-libs < 1:3.0.1-10 provided by openssl-libs-1:3.5.0-2.el9.x86_64 from @commandline
- package crypto-policies-20240828-2.git626aa59.el9.noarch from baseos conflicts with openssl-libs < 1:3.0.1-10 provided by openssl-libs-1:3.5.0-2.el9.x86_64 from @commandline
- package crypto-policies-20250128-1.git5269e22.el9.noarch from baseos conflicts with openssl-libs < 1:3.0.1-10 provided by openssl-libs-1:3.5.0-2.el9.x86_64 from @commandline
- conflicting requests
Problem 2: problem with installed package crypto-policies-scripts-20240828-2.git626aa59.el9.noarch
- package crypto-policies-scripts-20240828-2.git626aa59.el9.noarch from @System requires crypto-policies = 20240828-2.git626aa59.el9, but none of the providers can be installed
- package crypto-policies-scripts-20240828-2.git626aa59.el9.noarch from baseos requires crypto-policies = 20240828-2.git626aa59.el9, but none of the providers can be installed
- package crypto-policies-scripts-20240304-1.gitb1c706d.el9.noarch from baseos requires crypto-policies = 20240304-1.gitb1c706d.el9, but none of the providers can be installed
- package crypto-policies-scripts-20240815-1.gite217f03.el9.noarch from baseos requires crypto-policies = 20240815-1.gite217f03.el9, but none of the providers can be installed
- package crypto-policies-scripts-20240822-1.gitbaf3e06.el9.noarch from baseos requires crypto-policies = 20240822-1.gitbaf3e06.el9, but none of the providers can be installed
- package crypto-policies-scripts-20250128-1.git5269e22.el9.noarch from baseos requires crypto-policies = 20250128-1.git5269e22.el9, but none of the providers can be installed
- package crypto-policies-20240828-2.git626aa59.el9.noarch from @System conflicts with openssl-libs < 1:3.0.1-10 provided by openssl-libs-1:3.5.0-2.el9.x86_64 from @commandline
- package crypto-policies-20240304-1.gitb1c706d.el9.noarch from baseos conflicts with openssl-libs < 1:3.0.1-10 provided by openssl-libs-1:3.5.0-2.el9.x86_64 from @commandline
- package crypto-policies-20240815-1.gite217f03.el9.noarch from baseos conflicts with openssl-libs < 1:3.0.1-10 provided by openssl-libs-1:3.5.0-2.el9.x86_64 from @commandline
- package crypto-policies-20240822-1.gitbaf3e06.el9.noarch from baseos conflicts with openssl-libs < 1:3.0.1-10 provided by openssl-libs-1:3.5.0-2.el9.x86_64 from @commandline
- package crypto-policies-20240828-2.git626aa59.el9.noarch from baseos conflicts with openssl-libs < 1:3.0.1-10 provided by openssl-libs-1:3.5.0-2.el9.x86_64 from @commandline
- package crypto-policies-20250128-1.git5269e22.el9.noarch from baseos conflicts with openssl-libs < 1:3.0.1-10 provided by openssl-libs-1:3.5.0-2.el9.x86_64 from @commandline
- package openssl-1:3.5.0-2.el9.x86_64 from @commandline requires openssl-libs = 3.5.0-2.el9, but none of the providers can be installed
- package openssl-1:3.5.0-2.el9.x86_64 from @commandline requires libcrypto.so.3(OPENSSL_3.3.0)(64bit), but none of the providers can be installed
- package openssl-1:3.5.0-2.el9.x86_64 from @commandline requires libcrypto.so.3(OPENSSL_3.4.0)(64bit), but none of the providers can be installed
- package openssl-1:3.5.0-2.el9.x86_64 from @commandline requires libcrypto.so.3(OPENSSL_3.5.0)(64bit), but none of the providers can be installed
- package openssl-1:3.5.0-2.el9.x86_64 from @commandline requires libssl.so.3(OPENSSL_3.4.0)(64bit), but none of the providers can be installed
- conflicting requests
(try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages or '--nobest' to use not only best candidate packages)
上述报错的意思是crypto-policies-20240828-2.git626aa59.el9.noarch包与低于1:3.0.1-10版本的openssl-libs的包有冲突.这里的版本号1:3.0.1-10中的1:意思是EPOCH的值，3.0.1才是我们常说的版本号。
现在安装的是openssl-libs-3.5.0,即版本是3.5.0,是大于3.0.1的，按理应该不冲突才对，而实际上却发生冲突了。
我尝试重新编译和打包crypto-policies,目的就是修改对OpenSSL版本的限制。
第一次我设置为Conflicts: openssl < 1:2.9.1-10,即crypto-policies包对OpenSSL 2.9即以下版本有冲突，但测试发现限制条件没有生效
第二次我直接取消了对OpenSSL的版本限制,测试发现能成功使用dnf install命令安装OpenSSL.
下面是我分别安装crypto-policies和OpenSSL 3.5.0的输出
1.更新crypto-policies
dnf install ~/tool/crypto-policies/crypto-policies-scripts-20251215-1.git9a18988.el9.noarch.rpm \
~/tool/crypto-policies/crypto-policies-20251215-1.git9a18988.el9.noarch.rpm
输出如下 :
=============================================================================================================================================================================================
Package Architecture Version Repository Size
=============================================================================================================================================================================================
Upgrading:
crypto-policies noarch 20251215-1.git9a18988.el9 @commandline 55 k
crypto-policies-scripts noarch 20251215-1.git9a18988.el9 @commandline 84 k
Transaction Summary
=============================================================================================================================================================================================
Upgrade 2 Packages
Total size: 140 k
说明 :
- 使用的源码是
fedora-crypto-policies-rhel9.tar.gz,来自https://gitlab.com/redhat-crypto/fedora-crypto-policies/-/tree/rhel9?ref_type=heads的 rhel9 分支 - crypto-policies的版本号
20251215-1是随便设置的,目的是比原版本号高就可以了
2.安装Openssl 3.5.0
dnf install /root/tool/openssl/openssl-libs-3.5.0-2.el9.x86_64.rpm /root/tool/openssl/openssl-3.5.0-2.el9.x86_64.rpm
输出如下 :
=============================================================================================================================================================================================
Package Architecture Version Repository Size
=============================================================================================================================================================================================
Upgrading:
openssl x86_64 1:3.5.0-2.el9 @commandline 983 k
openssl-libs x86_64 1:3.5.0-2.el9 @commandline 4.2 M
Installing dependencies:
perl-AutoLoader noarch 5.74-481.el9 baseos 21 k
perl-B x86_64 1.80-481.el9 baseos 180 k
perl-Carp noarch 1.50-460.el9 baseos 30 k
perl-Class-Struct noarch 0.66-481.el9 baseos 22 k
perl-Data-Dumper x86_64 2.174-462.el9 baseos 56 k
perl-Digest noarch 1.19-4.el9 baseos 26 k
perl-Digest-MD5 x86_64 2.58-4.el9 baseos 37 k
perl-Encode x86_64 4:3.08-462.el9 baseos 1.7 M
perl-Errno x86_64 1.30-481.el9 baseos 14 k
perl-Exporter noarch 5.74-461.el9 baseos 32 k
perl-Fcntl x86_64 1.13-481.el9 baseos 20 k
perl-File-Basename noarch 2.85-481.el9 baseos 17 k
perl-File-Path noarch 2.18-4.el9 baseos 36 k
perl-File-Temp noarch 1:0.231.100-4.el9 baseos 60 k
perl-File-stat noarch 1.09-481.el9 baseos 17 k
perl-FileHandle noarch 2.03-481.el9 baseos 15 k
perl-Getopt-Long noarch 1:2.52-4.el9 baseos 61 k
perl-Getopt-Std noarch 1.12-481.el9 baseos 15 k
perl-HTTP-Tiny noarch 0.076-462.el9 baseos 54 k
perl-IO x86_64 1.43-481.el9 baseos 88 k
perl-IO-Socket-IP noarch 0.41-5.el9 baseos 43 k
perl-IO-Socket-SSL noarch 2.073-2.el9 baseos 217 k
perl-IPC-Open3 noarch 1.21-481.el9 baseos 22 k
perl-MIME-Base64 x86_64 3.16-4.el9 baseos 31 k
perl-Mozilla-CA noarch 20200520-6.el9 baseos 13 k
perl-Net-SSLeay x86_64 1.94-1.el9 baseos 414 k
perl-POSIX x86_64 1.94-481.el9 baseos 96 k
perl-PathTools x86_64 3.78-461.el9 baseos 88 k
perl-Pod-Escapes noarch 1:1.07-460.el9 baseos 21 k
perl-Pod-Perldoc noarch 3.28.01-461.el9 baseos 87 k
perl-Pod-Simple noarch 1:3.42-4.el9 baseos 225 k
perl-Pod-Usage noarch 4:2.01-4.el9 baseos 41 k
perl-Scalar-List-Utils x86_64 4:1.56-462.el9 baseos 71 k
perl-SelectSaver noarch 1.02-481.el9 baseos 11 k
perl-Socket x86_64 4:2.031-4.el9 baseos 56 k
perl-Storable x86_64 1:3.21-460.el9 baseos 96 k
perl-Symbol noarch 1.08-481.el9 baseos 14 k
perl-Term-ANSIColor noarch 5.01-461.el9 baseos 49 k
perl-Term-Cap noarch 1.17-460.el9 baseos 23 k
perl-Text-ParseWords noarch 3.30-460.el9 baseos 17 k
perl-Text-Tabs+Wrap noarch 2013.0523-460.el9 baseos 24 k
perl-Time-Local noarch 2:1.300-7.el9 baseos 34 k
perl-URI noarch 5.09-3.el9 baseos 121 k
perl-WWW-Curl x86_64 4.17-29.el9 epel 62 k
perl-base noarch 2.27-481.el9 baseos 16 k
perl-constant noarch 1.33-461.el9 baseos 24 k
perl-if noarch 0.60.800-481.el9 baseos 14 k
perl-interpreter x86_64 4:5.32.1-481.el9 baseos 71 k
perl-libnet noarch 3.13-4.el9 baseos 130 k
perl-libs x86_64 4:5.32.1-481.el9 baseos 2.2 M
perl-mro x86_64 1.23-481.el9 baseos 28 k
perl-overload noarch 1.31-481.el9 baseos 45 k
perl-overloading noarch 0.02-481.el9 baseos 12 k
perl-parent noarch 1:0.238-460.el9 baseos 15 k
perl-podlators noarch 1:4.14-460.el9 baseos 114 k
perl-subs noarch 1.03-481.el9 baseos 11 k
perl-vars noarch 1.05-481.el9 baseos 13 k
Installing weak dependencies:
perl-NDBM_File x86_64 1.15-481.el9 appstream 22 k
Transaction Summary
=============================================================================================================================================================================================
Install 58 Packages
Upgrade 2 Packages
Total size: 12 M
特别说明 :
- 考虑到
crypto-policies是整个系统的加密基础,因此不建议安装自己打包的RPM - 从安装OpenSSL的输出也可以知道在执行
rpm -ivh安装OpenSSL时，需要自行安装哪些依赖包 - 由于
OpenSSL也是系统的基础包之一，因此不建议在生产环境安装
附 : crypto-policies和OpenSSL的RPM包的下载地址 :
https://github.com/mosaicwang/myrpm/releases/tag/openssl-3.5.0
