1

I am trying to install FreeRadius 3.0.16 in Debian 9 from my local repository.

However when trying to install it I got this error:

The following packages have unmet dependencies:
 freeradius : Depends: libssl1.0.0 (>= 1.0.1e-2+deb7u5) but it is not installable

The culprit is in the original source code at freeradius-server/debian/rules:

# Add dependency on distribution specific version of openssl that fixes Heartbleed (CVE-2014-0160).
ifeq ($(shell dpkg-vendor --derives-from Ubuntu && echo yes),yes)
       SUBSTVARS = -Vdist:Depends="libssl1.0.0 (>= 1.0.1f-1ubuntu2)"
else
       SUBSTVARS = -Vdist:Depends="libssl1.0.0 (>= 1.0.1e-2+deb7u5)"
endif

Putting it checking for Debian 9 is not the ideal situation, as it can be compiled for several Debian flavours...

So, short of checking for the Debian version, is there any alternative of defining the Depends for Debian both and as an alternative depending on libssl1.1 (>= 1.1)?

  • 1
    Is that piece of code something you added? If so, why do you want to enforce the Heartbleed fix in your FreeRADIUS package? (I can understand why you’d want to do this, but typically you’d enforce “being up-to-date” through other means; this is not something you’d expect in a package, which is why the packaging tools don’t provide for it very well.) – Stephen Kitt Aug 16 '17 at 14:00
  • @StephenKitt The code is verbatim as in the official git repo. – Rui F Ribeiro Aug 16 '17 at 14:02
2

I would just remove those lines of code; it’s not up to individual packages to force security upgrades in other packages.

If you look at the Debian package’s rules, you’ll see it doesn’t have anything like this. In any case, as you point out the dependencies can’t work on Debian 9 since that uses a different package name for OpenSSL.

(It should be possible to work out a disjunction which would enforce the right package upgrades, but I don’t think it’s worth the effort.)

  • It makes sense, going to propose a patch without those lines. Thanks. – Rui F Ribeiro Aug 16 '17 at 14:15
  • (Although those rules will prevent running FR in the recent Debian and derivates, the changes were not approved. I still understand their point of view, the bigger problem is Debian not having a maintainer for FR ) – Rui F Ribeiro Aug 21 '17 at 10:56
  • You could join the maintenance team ;-). – Stephen Kitt Aug 21 '17 at 11:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.