It seems like with the update to openssl 1.0.2g in: http://git.yoctoproject.org/cgit.cgi/poky/commit?id=73a43fc15e0463c39baaadecab78fb3ef51b8cd0 the version script was changed. The new script seems to be from this debian change: https://anonscm.debian.org/viewvc/pkg-openssl?view=revision&revision=747 The reason for the change is that there was an ABI incompatible change, so the soname was bumped and the version script started over. However, when yocto imported this the soname bump was not added. So, yocto ABI matches the debian 1.0.2 ABI, but has a soname of 1.0.0. Meanwhile it seems like ubuntu *didn't* bump soname, nor restart on a new version symbol script. This means binaries built on ubuntu will link against the yocto 1.0.0 soname but fail due to it having the debian 1.0.2 ABI. It may be hard to change this at this point, but maybe there could be an option to bump the soname to 1.0.2. This was noticed in the flatpak runtime: https://github.com/flatpak/freedesktop-sdk-images/issues/25 And we will add the debian patch to bump soname to get debian compat.
I agree with the conclusions here and have sent a patch: http://lists.openembedded.org/pipermail/openembedded-core/2017-April/135881.html I didn't fully realize that this happened a year ago already. We've had this situation in both morty and krogoth. Not sure what the best options is really.
commit a59bfd05d15085a3dc5669b47fd19867246c846b Author: Jussi Kukkonen <jussi.kukkonen@intel.com> Date: Thu Apr 20 16:32:19 2017 +0300 openssl: Bump SONAME to match the ABI Commit 7933fbbc637 "Security fix Drown via 1.0.2g update" included a version-script change from Debian that was an ABI change. It did not include the soname change that Debian did so we have been calling our ABI 1.0.0 but it really matches what others call 1.0.2. Bump SONAME to match the ABI. In practice this changes both libcrypto and libssl sonames from 1.0.0 to 1.0.2. For background: Upstream does not do sonames so these are set by distros. In this case the ABI changes based on a build time configuration! Debian took the ABI changing configuration and bumped soname but e.g. Ubuntu kept the deprecated API and just made it not work, keeping soname. So both have same version of openssl but support different ABI (and expose different SONAME). Fixes [YOCTO #11396]. Thanks to Alexander Larsson et al for detective work. (From OE-Core rev: 1b430eef7131876bc735c22d66358379b0516821) Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>