Repository: spack/spack

Issue:
[BUG] Spurious Warning for System OpenSSL
With PR #120 in place, I can now configure Spack to use the system's OpenSSL instead of trying to compile its own.  I did:

packages.yaml:

``````
    openssl:
        paths:
            openssl@system: /usr
        buildable: False```
``````

So far so good.  Now when I install something that uses OpenSSL, I get a spurious warning.  The good news is, everything seems to basically work. But the warning does look ominous (and I'm 99% sure it's totally spurious).

```
[spack]$ spack install py-scipy ^python@3.5.1 ^netlib-lapack+shared ^netlib-blas+fpic
==> Warning: This installation depends on an old version of OpenSSL, which may have known security issues. 
==> Warning: Consider updating to the latest version of this package.
==> Warning: More details at http://www.openssl.org
```

[BUG] Spurious Warning for System OpenSSL
With PR #120 in place, I can now configure Spack to use the system's OpenSSL instead of trying to compile its own.  I did:

packages.yaml:

``````
    openssl:
        paths:
            openssl@system: /usr
        buildable: False```
``````

So far so good.  Now when I install something that uses OpenSSL, I get a spurious warning.  The good news is, everything seems to basically work. But the warning does look ominous (and I'm 99% sure it's totally spurious).

```
[spack]$ spack install py-scipy ^python@3.5.1 ^netlib-lapack+shared ^netlib-blas+fpic
==> Warning: This installation depends on an old version of OpenSSL, which may have known security issues. 
==> Warning: Consider updating to the latest version of this package.
==> Warning: More details at http://www.openssl.org
```



Discussion:
@alalazo Seems that `@system` should be handled specially in `url_for_version`?

@mathstuf @citibeth  If we agree on the version tag `@system` (which is fine with me), then I think we should really handle it as a special case. Should I prepare a PR?

@system seems like a fine convention to me, I will add that to the docs.
I'm generally against special cases.  But I haven't taken the time to
understand this issue, so I have no alternative suggestion.

One additional detail... builds don't usually need to be told where system
packages reside.  I put "/usr" in my packages.yaml file because (I assumed)
it wanted something there.  Now that the lib vs lib64 thing seems to be
getting straightened out, that will be a little more correct (but still
redundant).

Yes, a PR would be appreciated!

Thank you,
-- Elizabeth

On Wed, Mar 30, 2016 at 7:12 PM, Massimiliano Culpo <
notifications@github.com> wrote:

> @mathstuf https://github.com/mathstuf @citibeth
> https://github.com/citibeth If we agree on the version tag @system
> (which is fine with me), then I think we should really handle it as a
> special case. Should I prepare a PR?
> 
> —
> You are receiving this because you were mentioned.
> Reply to this email directly or view it on GitHub
> https://github.com/LLNL/spack/issues/647#issuecomment-203677379

@alalazo Seems that `@system` should be handled specially in `url_for_version`?

@mathstuf @citibeth  If we agree on the version tag `@system` (which is fine with me), then I think we should really handle it as a special case. Should I prepare a PR?

@system seems like a fine convention to me, I will add that to the docs.
I'm generally against special cases.  But I haven't taken the time to
understand this issue, so I have no alternative suggestion.

One additional detail... builds don't usually need to be told where system
packages reside.  I put "/usr" in my packages.yaml file because (I assumed)
it wanted something there.  Now that the lib vs lib64 thing seems to be
getting straightened out, that will be a little more correct (but still
redundant).

Yes, a PR would be appreciated!

Thank you,
-- Elizabeth

On Wed, Mar 30, 2016 at 7:12 PM, Massimiliano Culpo <
notifications@github.com> wrote:

> @mathstuf https://github.com/mathstuf @citibeth
> https://github.com/citibeth If we agree on the version tag @system
> (which is fine with me), then I think we should really handle it as a
> special case. Should I prepare a PR?
> 
> —
> You are receiving this because you were mentioned.
> Reply to this email directly or view it on GitHub
> https://github.com/LLNL/spack/issues/647#issuecomment-203677379


Resolving patch:
diff --git a/var/spack/repos/builtin/packages/openssl/package.py b/var/spack/repos/builtin/packages/openssl/package.py
--- a/var/spack/repos/builtin/packages/openssl/package.py
+++ b/var/spack/repos/builtin/packages/openssl/package.py
@@ -3,6 +3,7 @@
 
 from spack import *
 
+
 class Openssl(Package):
     """The OpenSSL Project is a collaborative effort to develop a
        robust, commercial-grade, full-featured, and Open Source
@@ -30,26 +31,14 @@ def url_for_version(self, version):
         # Same idea, but just to avoid issuing the same message multiple times
         warnings_given_to_user = getattr(Openssl, '_warnings_given', {})
         if openssl_url is None:
-            latest = 'http://www.openssl.org/source/openssl-{version}.tar.gz'
-            older = 'http://www.openssl.org/source/old/{version_number}/openssl-{version_full}.tar.gz'
-            # Try to use the url where the latest tarballs are stored. If the url does not exist (404), then
-            # return the url for older format
-            version_number = '.'.join([str(x) for x in version[:-1]])
-            older_url = older.format(version_number=version_number, version_full=version)
-            latest_url = latest.format(version=version)
-            response = urllib.urlopen(latest.format(version=version))
-            if response.getcode() == 404:
-                openssl_url = older_url
-                # Checks if we already warned the user for this particular version of OpenSSL.
-                # If not we display a warning message and mark this version
+            if self.spec.satisfies('@external'):
+                # The version @external is reserved to system openssl. In that case return a fake url and exit
+                openssl_url = '@external (reserved version for system openssl)'
                 if not warnings_given_to_user.get(version, False):
-                    tty.warn('This installation depends on an old version of OpenSSL, which may have known security issues. ')
-                    tty.warn('Consider updating to the latest version of this package.')
-                    tty.warn('More details at {homepage}'.format(homepage=Openssl.homepage))
+                    tty.msg('Using openssl@external : the version @external is reserved for system openssl')
                     warnings_given_to_user[version] = True
             else:
-                openssl_url = latest_url
-            # Store the computed URL
+                openssl_url = self.check_for_outdated_release(version, warnings_given_to_user)  # Store the computed URL
             openssl_urls[version] = openssl_url
             # Store the updated dictionary of URLS
             Openssl._openssl_url = openssl_urls
@@ -58,6 +47,28 @@ def url_for_version(self, version):
 
         return openssl_url
 
+    def check_for_outdated_release(self, version, warnings_given_to_user):
+        latest = 'ftp://ftp.openssl.org/source/openssl-{version}.tar.gz'
+        older = 'http://www.openssl.org/source/old/{version_number}/openssl-{version_full}.tar.gz'
+        # Try to use the url where the latest tarballs are stored. If the url does not exist (404), then
+        # return the url for older format
+        version_number = '.'.join([str(x) for x in version[:-1]])
+        try:
+            openssl_url = latest.format(version=version)
+            urllib.urlopen(openssl_url)
+        except IOError:
+            openssl_url = older.format(version_number=version_number, version_full=version)
+            # Checks if we already warned the user for this particular version of OpenSSL.
+            # If not we display a warning message and mark this version
+            if not warnings_given_to_user.get(version, False):
+                tty.warn(
+                    'This installation depends on an old version of OpenSSL, which may have known security issues. ')
+                tty.warn('Consider updating to the latest version of this package.')
+                tty.warn('More details at {homepage}'.format(homepage=Openssl.homepage))
+                warnings_given_to_user[version] = True
+
+        return openssl_url
+
     def install(self, spec, prefix):
         # OpenSSL uses a variable APPS in its Makefile. If it happens to be set
         # in the environment, then this will override what is set in the


Test patch: