v5.0.0.beta2 - libssl w/o openssl CLI raises exception on boot

[pbstriker38]

Describe the bug
When using an Alpine image the following error happens when starting the server:

/usr/local/bundle/gems/puma-5.0.0.beta2/lib/puma/minissl.rb:17:in `<module:MiniSSL>': uninitialized constant Puma::MiniSSL::OPENSSL_VERSION (NameError)

This was introduced in OpenSSL check that was added to v5.0.0.beta2
v5.0.0.beta1...v5.0.0.beta2#diff-d8a3dc2e04ffb9e96d5ec39008498878R17

The ruby:2.7.1-alpine image has libssl v1.1.1g-r0, it does not have the OpenSSL command-line program though.

To Reproduce

$ docker run --rm -dit --name ruby2.7 ruby:2.7.1-alpine
$ docker exec -it ruby2.7 sh

> apk add build-base
> gem install puma -v 5.0.0.beta2
> puma
Traceback (most recent call last):
	25: from /usr/local/bundle/bin/puma:23:in `<main>'
	24: from /usr/local/bundle/bin/puma:23:in `load'
	23: from /usr/local/bundle/gems/puma-5.0.0.beta2/bin/puma:6:in `<top (required)>'
	22: from /usr/local/lib/ruby/2.7.0/rubygems/core_ext/kernel_require.rb:72:in `require'
	21: from /usr/local/lib/ruby/2.7.0/rubygems/core_ext/kernel_require.rb:72:in `require'
	20: from /usr/local/bundle/gems/puma-5.0.0.beta2/lib/puma/cli.rb:8:in `<top (required)>'
	19: from /usr/local/lib/ruby/2.7.0/rubygems/core_ext/kernel_require.rb:72:in `require'
	18: from /usr/local/lib/ruby/2.7.0/rubygems/core_ext/kernel_require.rb:72:in `require'
	17: from /usr/local/bundle/gems/puma-5.0.0.beta2/lib/puma/launcher.rb:5:in `<top (required)>'
	16: from /usr/local/lib/ruby/2.7.0/rubygems/core_ext/kernel_require.rb:72:in `require'
	15: from /usr/local/lib/ruby/2.7.0/rubygems/core_ext/kernel_require.rb:72:in `require'
	14: from /usr/local/bundle/gems/puma-5.0.0.beta2/lib/puma/cluster.rb:3:in `<top (required)>'
	13: from /usr/local/lib/ruby/2.7.0/rubygems/core_ext/kernel_require.rb:72:in `require'
	12: from /usr/local/lib/ruby/2.7.0/rubygems/core_ext/kernel_require.rb:72:in `require'
	11: from /usr/local/bundle/gems/puma-5.0.0.beta2/lib/puma/runner.rb:3:in `<top (required)>'
	10: from /usr/local/lib/ruby/2.7.0/rubygems/core_ext/kernel_require.rb:72:in `require'
	 9: from /usr/local/lib/ruby/2.7.0/rubygems/core_ext/kernel_require.rb:72:in `require'
	 8: from /usr/local/bundle/gems/puma-5.0.0.beta2/lib/puma/server.rb:9:in `<top (required)>'
	 7: from /usr/local/lib/ruby/2.7.0/rubygems/core_ext/kernel_require.rb:72:in `require'
	 6: from /usr/local/lib/ruby/2.7.0/rubygems/core_ext/kernel_require.rb:72:in `require'
	 5: from /usr/local/bundle/gems/puma-5.0.0.beta2/lib/puma/reactor.rb:4:in `<top (required)>'
	 4: from /usr/local/lib/ruby/2.7.0/rubygems/core_ext/kernel_require.rb:72:in `require'
	 3: from /usr/local/lib/ruby/2.7.0/rubygems/core_ext/kernel_require.rb:72:in `require'
	 2: from /usr/local/bundle/gems/puma-5.0.0.beta2/lib/puma/minissl.rb:11:in `<top (required)>'
	 1: from /usr/local/bundle/gems/puma-5.0.0.beta2/lib/puma/minissl.rb:12:in `<module:Puma>'
/usr/local/bundle/gems/puma-5.0.0.beta2/lib/puma/minissl.rb:17:in `<module:MiniSSL>': uninitialized constant Puma::MiniSSL::OPENSSL_VERSION (NameError)

To fix the issue, install openssl-dev before installing puma.
apk add openssl-dev

Expected behavior
The openSSL command-line utility should not be required to run Puma.

Desktop (please complete the following information):

• OS: [Alpine Linux]
• Puma Version [v5.0.0.beta2]

[MSP-Greg]

@pbstriker38

The openSSL command-line utility should not be required to run Puma.

It's not required. With a lot of systems, 'openSSL command-line utility' is included.

`openssl-dev' installs the files needed to compile Puma with OpenSSL, which aren't needed by the 'openSSL command-line utility'.

If you didn't have 'openssl-dev' installed, the Puma gem shouldn't have installed, unless you added the equivalent of ENV["DISABLE_SSL"] to your environment. Can you clarify that please?

Regardless, we are working on allowing Puma to be compiled without SSL support. The work is mostly done for MRI, working more on JRuby this weekend. Prefer to commit the feature with all supported platforms...

Thanks for testing/using 5.0.0.beta2.

[pbstriker38]

I have not set any environment variables. Only packages that have been added to ruby:2.7.1-alpine are
apk add --update --no-cache build-base libsodium

Our docker image built just fine and I didn't notice the issue until our k8 pods were in a crash loop.

/ # printenv | grep DISABLE_SSL
/ # 

[nateberkopec]

We could just change the TLS 1.3 check into a class method to avoid this issue.

[MSP-Greg]

What I'm doing for #2305 fixes this, but one question arises.

With #2305, and setting ENV['DISABLE_SSL'], all will work. But if one does not set that variable, and one doesn't have openssl-dev installed, what should happen? I thought compiling stopped, but I need to uninstall opensssl-dev and check that (later).

Should Puma build w/o SSL support, or should the build stop and tell the user that openssl-dev needs to be installed or they need to set ENV['DISABLE_SSL']?

[MSP-Greg]

Re the above comment, never mind. Puma will compile if 'openssl dev' is not installed.

#2305 will remove the error, as it no longer loads minissl.rb if Puma is compiled without ssl support, either by using ENV['DISABLE_SSL'] or because 'openssl dev' is not installed.

[nateberkopec]

Fixed by #2305 - can you confirm @pbstriker38?

[pbstriker38]

@nateberkopec
I have confirmed that master works. I do get some warnings while bundling though.

Using puma 5.0.0.beta2 from https://github.com/puma/puma.git (at master@18f1810)
/usr/local/lib/ruby/2.7.0/rubygems/ext/builder.rb:165: warning: conflicting chdir during another chdir block
/usr/local/lib/ruby/2.7.0/rubygems/ext/builder.rb:173: warning: conflicting chdir during another chdir block

[nateberkopec]

Cheers! thanks for the test and the report

[nateberkopec]

I've seen the chdir thing before but I think it's Rubygems, not us.