How to avoid OpenSSL error using pyinstaller?

Question

I was able to directly execute the python script in the environment. But after I compile the package using pyinstaller: pyinstaller myscript.py --onefile When executing the execuable binary, there will be an OpenSSL error:

$ ./dist/myscript
crypto/fips/fips.c:153: OpenSSL internal error: FATAL FIPS SELFTEST FAILURE
Aborted (core dumped)

But if I directly run the script with: python myscript.py There will be no such error.

How can I avoid such error when compiling with pyinstaller? Thanks.

Answer 1

This usually happens, if you installed python with FIPS enabled/disabled or if Python is consuming a module/library or something, where python/ or that library/ python pyInstaller may be consuming artifact (that was built on some machine previously, with FIPS Disabled); using such executables on another machine(where FIPS is actually enabled) i.e. where FIPS setting doesn't match where you built the app in python or that library, then, you'll get such errors.

Ex: A package manager ex: yum / zypper installed python without openssl(pre-installed/pre-requisite for python installing it's stuff for ssl stuff) and if python is now installed without it, then later any app/running that app wants openssl processing, Python won't work even if you install openssl later on the machine and spit out bunch of gnarly openssl errors.

Similarly, if something was installed/packaged/built using FIPS disabled (on some machine) anything, either the app or any library that you are consuming... then later, if you try to run the app or app(using a library/package), and at that time, if you current machine has FIPS = 1 (enabled) then you'll see this error.

In my case, cmake was failing for running simple cmake --version and all I did was used a cmake .tar bundle which may have been compiled/set for the target machine where FIPS was enabled and thus, it worked.

You can also use strace or gdb to find more details info behind the root-cause.