gpstart fails with error, unable to import module: /usr/local/greenplum-db/lib/libpq.so.5: symbol X509_get_signature_nid

Products

• VMware Tanzu Greenplum

Issue/Introduction

The "unable to import module" error occurs when running gpstart after upgrading GPDB 6.18 to 6.21.0 in CentOS 7.2

stderr='Error: unable to import module: /usr/local/greenplum-db-6.21.0/lib/libpq.so.5: symbol X509_get_signature_nid, version libcrypto.so.10 not defined in file libcrypto.so.10 with link time reference

Checking which rpm package include libpq.so.5, greenplum-db package has it.

$ rpm -qf /usr/local/greenplum-db/lib/libpq.so.5
greenplum-db-6-6.21.0-1.el7.x86_64

Checking which rpm package include libcrypto.so.10, openssl-lib package has it.

$ rpm -qf /lib64/libcrypto.so.10
openssl-libs-1.0.1e-60.el7.x86_64

However, X509_get_signatur_nid symbol is included in libcrypto.so.10 of current openssl pakcage there are nothing returned when checking with nm command.

$ nm -D /lib64/libcrypto.so.10 | grep X509_get_signature_nid

Checking the version of openssl on all hosts. If version 1.0.1 or lower is installed, it will need to be upgraded

$ gpssh -f hostfile
=> rpm -qa | grep openssl
[mdw] openssl-1.0.1e-60.el7.x86_64
[mdw] openssl-libs-1.0.1e-60.el7.x86_64
[smdw] openssl-1.0.1e-60.el7.x86_64
[smdw] openssl-libs-1.0.1e-60.el7.x86_64
[sdw1] openssl-1.0.1e-60.el7.x86_64
[sdw1] openssl-libs-1.0.1e-60.el7.x86_64
[sdw2] openssl-1.0.1e-60.el7.x86_64
[sdw2] openssl-libs-1.0.1e-60.el7.x86_64
[sdw3] openssl-1.0.1e-60.el7.x86_64
[sdw3] openssl-libs-1.0.1e-60.el7.x86_64
[sdw4] openssl-1.0.1e-60.el7.x86_64
[sdw4] openssl-libs-1.0.1e-60.el7.x86_64

Environment

Product Version: 6.20
OS: CentOS or RHEL 7.x

Resolution

[ Resolution ]
Upgrade the openssl package to version 1.0.2 or later. This can normally be done with "yum" command:

$ yum upgrade openssl openssl-lib

[ Cause ]
The symbol, X509_get_signature_nid is not exist in library file libcrypt.so.X of openssl-libs package in version 1.0.1 or lower. It is introduced in openssl 1.0.2.

Additionally, the rpm package dependency of greenplum-db-6  shows openssl without a version. Therefor it is possible to install the greenplum-db-6 package with an openssl-libs package that is too old.

$ rpm -qR greenplum-db-6
~~ snap
openssl
~~ snip
openssl-libs
~~ snip