Foreman » Smart Proxy

Error¶

smart-proxy-develop-source-release Jenkins job, ruby=3.0.4 test matrix leg, fails with:

Invalid tls_ciphers value 'PROFILE=SYSTEM': SSL_CTX_set_cipher_list: no cipher match (RuntimeError)

Origin¶

Introduced by #39405, commit 67f34e21eae6e17e92de1beb97a6b076d21c3775 (PR https://github.com/theforeman/smart-proxy/pull/947). lib/launcher.rb defaults tls_ciphers to 'PROFILE=SYSTEM' when /etc/crypto-policies/back-ends/openssl.config exists. PROFILE=SYSTEM is a Red Hat/Fedora OpenSSL patch (not in upstream OpenSSL) that reads that config file.

CI node facts¶

• Jenkins nodes for this job: RHEL/CentOS Stream 9 (theforeman/foreman-infra, puppet/data/osfamily/RedHat-9.yaml, crb/epel in jenkins_node::unittests). /etc/crypto-policies/* is present by default on these nodes.
• Ruby versions tested: 3.0.4, 3.1.0 (theforeman/foreman-jenkins-jobs, pipelines/test/smart-proxy.groovy, pipelines/release/source/smart-proxy.groovy), each compiled from source via rbenv/ruby-build (jenkins_node::rbenv in foreman-infra).
• System OpenSSL on CentOS Stream 9: 3.5.x only.
• rbenv/ruby-build definitions (upstream, github.com/rbenv/ruby-build):
  • share/ruby-build/3.0.4: builds openssl-1.1.1w from openssl.org source, gated by --if needs_openssl:1.0.1-1.x.x
  • share/ruby-build/3.1.0: builds openssl-3.0.18 from github.com/openssl/openssl source, gated by --if needs_openssl:1.0.2-3.x.x
• needs_openssl() (bin/ruby-build) compares only the system OpenSSL version against the given range; it does not check for openssl-devel.
• 3.5.x is outside 1.0.1-1.x.x -> ruby-build builds openssl-1.1.1w from source for the 3.0.4 leg, unconditionally, on this OS.
• 3.5.x is inside 1.0.2-3.x.x -> ruby-build does not vendor for the 3.1.0 leg; that Ruby links the system's OpenSSL 3.x directly.
• openssl-1.1.1w built from openssl.org source does not include Red Hat's crypto-policies patch, so it does not recognize PROFILE=SYSTEM as a cipher-list value.
• Reproduced locally: openssl ciphers "PROFILE=SYSTEM" on stock Debian bookworm / Ubuntu 24.04 OpenSSL 3.0.x returns the same error text (SSL_CTX_set_cipher_list:no cipher match).

Scope¶

Fails only on the ruby=3.0.4 leg. The ruby=3.1.0 leg uses the system's RHEL-patched OpenSSL and is unaffected. Installing/ensuring openssl-devel on the Jenkins nodes does not change this outcome, since needs_openssl() gates on version range regardless of devel-package presence.

Fix options¶

1. smart-proxy: in lib/launcher.rb, do not infer OpenSSL PROFILE=SYSTEM support from the presence of /etc/crypto-policies/* alone. Rescue/validate the SSL_CTX_set_cipher_list call and fall back to an explicit cipher list on failure.
2. CI-side workaround only (does not fix the underlying assumption): drop the ruby 3.0.4 leg from the test matrix.

References¶

• theforeman/smart-proxy: lib/launcher.rb, commit 67f34e21eae6e17e92de1beb97a6b076d21c3775
• theforeman/foreman-jenkins-jobs: theforeman.org/yaml/jobs/release/source/smart-proxy-develop-source-release.yaml, theforeman.org/pipelines/release/source/smart-proxy.groovy, theforeman.org/pipelines/lib/rbenv.groovy
• theforeman/foreman-infra: puppet/modules/jenkins_node/manifests/rbenv.pp, puppet/modules/rbenv/manifests/init.pp, puppet/data/osfamily/RedHat-9.yaml
• rbenv/ruby-build: share/ruby-build/3.0.4, share/ruby-build/3.1.0, bin/ruby-build (needs_openssl)