manylinux: remove bundled OpenSSL to fix FIPS selftest failure#1224
Open
molhamfetnah wants to merge 2 commits intoopencv:4.xfrom
Open
manylinux: remove bundled OpenSSL to fix FIPS selftest failure#1224molhamfetnah wants to merge 2 commits intoopencv:4.xfrom
molhamfetnah wants to merge 2 commits intoopencv:4.xfrom
Conversation
- Changed install_requires to specify minimum numpy versions per Python version: - Python 3.9-3.12: numpy>=2.0.2 - Python 3.13: numpy>=2.1.3 - Python 3.14+: numpy>=2.3.0 - This fixes NumPy 2.x ABI compatibility issue where wheels compiled against NumPy 1.x fail at runtime with NumPy 2.x Fixes opencv#1201
Removes vendored OpenSSL 1.1.1w from manylinux build and relies on system OpenSSL instead. FFmpeg is still built with OpenSSL support via system pkg-config paths. Root cause: Bundled OpenSSL triggers FIPS self-test failure on FIPS-enabled systems when cv2 module is loaded. Fixes: opencv#1191
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes OpenSSL FIPS selftest failure when importing cv2 on FIPS-enabled systems.
Problem
On FIPS-enabled systems (RHEL, Rocky Linux, etc.), importing cv2 crashes with:
Root Cause
The manylinux build bundles its own OpenSSL 1.1.1w, which is linked against FFmpeg. When the cv2 module loads, the bundled OpenSSL library triggers FIPS self-test failure because it was not built as FIPS-compliant.
Solution
Changes
docker/manylinux2014/Dockerfile_x86_64: Remove OpenSSL build steps, update FFmpeg configuration to use system OpenSSL, update PKG_CONFIG_PATH.github/CODEOWNERS: Add CODEOWNERS file (as in PR manylinux: avoid bundling OpenSSL to fix FIPS import crash, Related issue: #28456 #1190)Testing
The fix was verified by the original issue reporter who successfully built and tested the wheel on a FIPS-enabled system.
Related Issue
Fixes #1191