Repository: zulip/zulip

Issue:
clean dev/vagrant setup: curl crashing (reported to curl)
Mac OSX 12.1 Monterey docker Engine 20.10.12 (desktop 4.4.2), sync'd to 4.9 (7ec2a2cde7a68de741b4bc179650e0ab0e26008e), ran `vagrant destroy` and `vagrant up --provider=docker` and got the dreaded `Error running a subcommand of ./tools/lib/provision.py` which I tracked down to curl crashing (!): `curl -fLO https://registry.npmjs.org/yarn/-/yarn-1.22.17.tgz` (install-yarn:21). I'm working around it with wget for now... I reported to the curl folks: https://github.com/curl/curl/issues/8328 (see that issue for a standalone Dockerfile to repro)

(also posted to https://chat.zulip.org/#narrow/stream/21-provision-help/topic/curl.20crashing.20.28!.29.20on.20docker.2020.2FOSX.2012.2E1/near/1315641 )

cc @alexmv 


Discussion:
I traced this to an issue in the OpenSSL ARM64 assembly for Poly1305, introduced in openssl/openssl@2cf7fd698ec1375421f91338ff8a44e7da5238b6 (`OpenSSL_1_1_1b~37`) and already fixed in openssl/openssl@5795acffd8706e1cb584284ee5bb3a30986d0e75 (`OpenSSL_1_1_1i~21`). We could ask Debian if they want to backport this fix to oldstable.

Meanwhile, here’s a workaround:

```sh
sudo perl -0777 -pe 's/(\xbf#\x03\xd5)(\xfd\x07E\xf8)/$2$1/' \
    -i /usr/lib/aarch64-linux-gnu/libcrypto.so.1.1
```
I’ve sent a debdiff with the upstream patch to https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989604 (might take a few minutes to show up in the web interface).
Hello @zulip/server-development members, this issue was labeled with the "area: provision" label, so you may want to check it out!

<!-- areaLabelAddition -->

I think we can close this as now tracked in the Debian tracker; I don't think there's much else we can do here directly.
fyi I just did a fresh checkout and the curl segfault is still happening :-( i.e. new developers on Mac M1's will need to manually apply one of the above workarounds by hand.

```
    default: + sudo -- env http_proxy= https_proxy= no_proxy= scripts/lib/install-yarn
    default:   % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
    default:                                  Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0scripts/lib/install-yarn: line 28: 10058 Segmentation fault      curl -fLO "https://registry.npmjs.org/yarn/-/$tarball"
    default:
    default: Error running a subcommand of ./lib/provision.py: sudo -- env http_proxy= https_proxy= no_proxy= scripts/lib/install-yarn
    default: Actual error output for the subcommand is just above this.
    default:
    default:
    default: Provisioning failed (exit code 1)!
    default:
    default: * Look at the traceback(s) above to find more about the errors.
    default: * Resolve the errors or get help on chat.
    default: * If you can fix this yourself, you can re-run tools/provision at any time.
    default: * Logs are here: zulip/var/log/provision.log
    default:
The SSH command responded with a non-zero exit status. Vagrant
assumes that this means the command failed. The output for this command
should be in the log above. Please read the output to determine what
went wrong.
```

I also sent a debdiff to the corresponding Ubuntu 20.04 bug: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1951279

Resolving patch:
diff --git a/tools/lib/provision.py b/tools/lib/provision.py
--- a/tools/lib/provision.py
+++ b/tools/lib/provision.py
@@ -398,6 +398,24 @@ def main(options: argparse.Namespace) -> "NoReturn":
     else:
         print("No changes to apt dependencies, so skipping apt operations.")
 
+    # Binary-patch ARM64 assembly bug in OpenSSL 1.1.1b through 1.1.1h.
+    # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989604
+    # https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1951279
+    try:
+        with open("/usr/lib/aarch64-linux-gnu/libcrypto.so.1.1", "rb") as fb:
+            if b"\xbf#\x03\xd5\xfd\x07E\xf8" in fb.read():
+                run_as_root(
+                    [
+                        "sed",
+                        "-i",
+                        r"s/\(\xbf#\x03\xd5\)\(\xfd\x07E\xf8\)/\2\1/",
+                        "/usr/lib/aarch64-linux-gnu/libcrypto.so.1.1",
+                    ],
+                    env={**os.environ, "LC_ALL": "C"},
+                )
+    except FileNotFoundError:
+        pass
+
     # Here we install node.
     proxy_env = [
         "env",


Test patch: