AppImage built against deprecated version of OpenSSL causing problems

[matterhorn103]

Originally described in the forums in thread #4995.

Avogadro version: (please complete the following information from the About box):

• Avogadrolibs: 1.98.1
• Qt: 5.15.2

Desktop version: (please complete the following information):

• OS: OpenSUSE Tumbleweed
• Version: latest snapshot (20231117)

Describe the bug
When starting the AppImage, the following lines are printed to standard output:

qt.network.ssl: QSslSocket: cannot resolve EVP_PKEY_base_id
qt.network.ssl: QSslSocket: cannot resolve SSL_get_peer_certificate

The result of this is that the plugins manager doesn't work. Possibly other things too, but I didn't find any.

Some googling revealed the problem. Many distros apparently don't ship with OpenSSL 1.1 any more but instead >=3.0, and if a Qt5 program has been built against v1.1, QSsl doesn't work. See here and here.

1.1 is still available in the OpenSUSE repos, so I installed it, and the problem was then solved, the error message was gone, and plugin installation works as expected.

From what I can find, it seems like as of 22.04 OpenSSL 1.1 is not even available in the Ubuntu repos any more, as it is deprecated. Given Ubuntu's popularity this likely means plugins are currently broken for a great number of Linux users. What the situation on other distros is I do not know.

Presumably just changing the GitHub workflow to build on Ubuntu 22.04 rather than the current 20.04 would solve the issue.

To Reproduce
Entertainingly, uninstalling the 1.1 package didn't bring back the error. Possibly a restart would have brought it back, but I didn't check.

[avo-bot]

This issue has been mentioned on Avogadro Discussion. There might be relevant details there:

https://discuss.avogadro.cc/t/challenges-with-python-extensions/4995/3

[ghutchis]

IIRC AppImage insists upon building from 20.04. "Build on old, run on newer" but that will mean bundling OpenSSL in the build.

[ghutchis]

Can you poke around in the AppImage and see if it has libssl* and libcrypto* or those need to be added to the bundle? I'm seeing lots of messages on this, but conflicting information.

(Or better yet, can I get a list of all files in the AppImage?)

[avo-bot]

This issue has been mentioned on Avogadro Discussion. There might be relevant details there:

https://discuss.avogadro.cc/t/appimage-ssl-issues/5260/2

[matterhorn103]

Can you poke around in the AppImage and see if it has libssl* and libcrypto* or those need to be added to the bundle? I'm seeing lots of messages on this, but conflicting information.

(Or better yet, can I get a list of all files in the AppImage?)

tree.txt

Sorry, I never saw this comment till now. Here is the tree of the decompressed AppImage.

Ctrl+F finds libcrypto.so.1.1 but not libssl.

[ghutchis]

I think this is now resolved in both the Flatpak and AppImage, correct?

[matterhorn103]

It was never an issue in the Flatpak I don't believe, but yes, the plugin downloader works in the nightly AppImage even without openSSL 1.1 installed. :)

[matterhorn103]

I hate to break it to you after all your work on moving to linuxdeploy, but I just tried the nightly AppImage on Fedora 41 and network stuff doesn't work after all. And on Fedora I don't even have openSSL 1.1 available from the package manager, so I can't just fix it by downloading the old version.

[ghutchis]

😢

[matterhorn103]

Was possibly fixed by #1775 but definitely will have been fixed by #1908!

[avo-bot]

This issue has been mentioned on Avogadro Discussion. There might be relevant details there:

https://discuss.avogadro.cc/t/qt6-tracking-thread/5592/23