Git Help needed

Hi, I am writing below couple of questions. If it is not the right place to ask please ignore and suggest me what to do to get the help on these questions.

1) What version of SSL is supported by GIT 1.8.3 or GIT 1.9.0

2) I have installed git 1.8.3 in AIX server 6.1 TL8 SP2. It worked fine and able to extract code from git repository directly as well as from ant. Everything went well.
Recently Aix OS upgraded to 6100-09-01-1341. After OS upgrade my git commands are not working. Basic help and version works fine as expected. When I try to pull the code from git repository it give SSL library compatibility issue.

The error is  OpenSSL version mismatch. Built agains 1000105f, you have 100000bf fatal: Could not read from remote repository

In order to get rid of this, I upgraded git to 1.9.0 GIT. But still it didn't work. The issue is still coming. 

git help, version works.  When I tried directly pulling code using git pull command - didn't work. When I try to pull the code through the ant - didn't work

The ant version is 1.8.0RC1

AIX admin worked on this and provided below comments

Comments form AIX system admin  (Pasted as it is) Even after installing 1.9.0 version of GIT the library files are not compatible with the latest version of SSL (1.0.5.1). SSL works fine as a root user and other users. This compatibility issue only a raises when the LIBPATH for GIT is set and the SSL picks up its LIBPATH from the same location as GIT and this causes the incompatibility. Can you find out from the GIT/ANT support team on what version of SSL GIT supports exactly. - The is specifically with the GIT/SSL as the user "xyzabc" . The SSL otherwise works perfectly fine. You will have to re-compile the ANT libraries to use the latest library files.

Thanks in advance.

Regards, Ravi.

This looks more like a packaging/build issue than a git issue.

It looks like whomever built your version of git built it against a specific version of the OpenSSL library. You should probably contact the folks that built your binary and ask them to update and build against the version that the new version of aix ships with.

Alternatively if you build git yourself on that host you should end up with a binary that links with the version of the library that you currently have.

On Fri, Aug 1, 2014 at 12:30 PM,  <RaviKiranGoud_Palpanoori@vfc.com> wrote:

Hi Ronnie Sahlberg, Thanks for your quick reply.

I downloaded git 1.9.0 from the site https://code.google.com/p/git-core/downloads/list. Does it mean the package available at above location has issue? OR The person who built/installed git in AIX sever did something wrong by building it against a specific OpenSSL library

Could you please suggest the site from where I need to download git for AIX OS.

Regards, Ravi.

-----Original Message-----
From: Ronnie Sahlberg [mailto:sahlberg@google.com] 
Sent: Friday, August 01, 2014 3:58 PM
To: Ravi Kiran Goud Palpanoori
Cc: git@vger.kernel.org
Subject: Re: Git Help needed

This looks more like a packaging/build issue than a git issue.

It looks like whomever built your version of git built it against a specific version of the OpenSSL library. You should probably contact the folks that built your binary and ask them to update and build against the version that the new version of aix ships with.

Alternatively if you build git yourself on that host you should end up with a binary that links with the version of the library that you currently have.

On Fri, Aug 1, 2014 at 12:30 PM,  <RaviKiranGoud_Palpanoori@vfc.com> wrote:

On Fri, Aug 01, 2014 at 07:30:11PM +0000, RaviKiranGoud_Palpanoori@vfc.com wrote:

The INSTALL file doesn't mention a particular OpenSSL version that we require, but I know that it works with versions as old as 0.9.8 and as new as 1.0.1g. It may work with still older versions, but I recommend 1.0.1 or newer as it gives you proper TLS 1.2 support.

OpenSSL 1.0.0 (which you were using before) and OpenSSL 1.0.1 are binary compatible if compiled with the same flags, but they contain a hard version check that fails if they're not the same version.

This means you need to recompile git against the newer OpenSSL version, or ask your vendor to patch this check out. This is true for any program that gives you this error.

Hi brian, Thanks for your quick reply.

I downloaded git 1.9.0 from the site https://code.google.com/p/git-core/downloads/list. Does it mean the package available at above location has built with specific version of OpenSSL. How can I find out which OpenSSL version is used in the packages available at the above location.

Could you please suggest the site from where I need to download git for AIX OS. Who are the vendors of git so that I will check how to proceed on this.

Regards, Ravi.

-----Original Message-----
From: brian m. carlson [mailto:sandals@crustytoothpaste.net] 
Sent: Friday, August 01, 2014 4:05 PM
To: Ravi Kiran Goud Palpanoori
Cc: git@vger.kernel.org
Subject: Re: Git Help needed

On Fri, Aug 01, 2014 at 07:30:11PM +0000, RaviKiranGoud_Palpanoori@vfc.com wrote:

The INSTALL file doesn't mention a particular OpenSSL version that we require, but I know that it works with versions as old as 0.9.8 and as new as 1.0.1g. It may work with still older versions, but I recommend 1.0.1 or newer as it gives you proper TLS 1.2 support.

OpenSSL 1.0.0 (which you were using before) and OpenSSL 1.0.1 are binary compatible if compiled with the same flags, but they contain a hard version check that fails if they're not the same version.

This means you need to recompile git against the newer OpenSSL version, or ask your vendor to patch this check out.  This is true for any program that gives you this error.

--
brian m. carlson / brian with sandals: Houston, Texas, US
+1 832 623 2791 | http://www.crustytoothpaste.net/~bmc | My opinion only
OpenPGP: RSA v4 4096b: 88AC E9B2 9196 305B A994 7552 F1BA 225C 0223 B187

On Fri, Aug 01, 2014 at 08:27:24PM +0000, RaviKiranGoud_Palpanoori@vfc.com wrote:

That URL is obsolete. Try https://www.kernel.org/pub/software/scm/git/ Google Code no longer allows anyone to upload tarballs.

If you're downloading the source tarball and building it yourself, then it's whatever version of OpenSSL is on your system. To my knowledge, nobody provides pre-built packages of git for AIX.

As I mentioned above, you'll probably need to build it yourself.

When I referred to having your vendor patch the check out, I meant your vendor of OpenSSL.

Hi Brian, Thank you. Understood OpeSSL and vendor from your original message now.

Thanks, Ravi.

-----Original Message-----
From: brian m. carlson [mailto:sandals@crustytoothpaste.net] 
Sent: Friday, August 01, 2014 5:00 PM
To: Ravi Kiran Goud Palpanoori
Cc: git@vger.kernel.org
Subject: Re: Git Help needed

On Fri, Aug 01, 2014 at 08:27:24PM +0000, RaviKiranGoud_Palpanoori@vfc.com wrote:

That URL is obsolete. Try https://www.kernel.org/pub/software/scm/git/ Google Code no longer allows anyone to upload tarballs.

If you're downloading the source tarball and building it yourself, then it's whatever version of OpenSSL is on your system.  To my knowledge, nobody provides pre-built packages of git for AIX.

As I mentioned above, you'll probably need to build it yourself.

When I referred to having your vendor patch the check out, I meant your vendor of OpenSSL.

--
brian m. carlson / brian with sandals: Houston, Texas, US
+1 832 623 2791 | http://www.crustytoothpaste.net/~bmc | My opinion only
OpenPGP: RSA v4 4096b: 88AC E9B2 9196 305B A994 7552 F1BA 225C 0223 B187

Hi Brian, My Open SSL vendor is IBM. In fact I am using AIX OS from IBM. When we (Myself and Frank. Frank is cc'ed in this email) discussed with IBM team, they asked some details on what flag settings need to be used to recompile, what parameter settings they need to do, etc. IBM team told it is easy to recompile if they have provided with the details.

Could you please help us to provide additional details for compilation. Thanks in advance.

Regards, Ravi.

-----Original Message-----
From: Ravi Kiran Goud Palpanoori 
Sent: Friday, August 01, 2014 5:03 PM
To: 'brian m. carlson'
Cc: git@vger.kernel.org
Subject: RE: Git Help needed

Hi Brian, Thank you. Understood OpeSSL and vendor from your original message now.

Thanks, Ravi.

-----Original Message-----
From: brian m. carlson [mailto:sandals@crustytoothpaste.net]
Sent: Friday, August 01, 2014 5:00 PM
To: Ravi Kiran Goud Palpanoori
Cc: git@vger.kernel.org
Subject: Re: Git Help needed

On Fri, Aug 01, 2014 at 08:27:24PM +0000, RaviKiranGoud_Palpanoori@vfc.com wrote:

That URL is obsolete. Try https://www.kernel.org/pub/software/scm/git/ Google Code no longer allows anyone to upload tarballs.

If you're downloading the source tarball and building it yourself, then it's whatever version of OpenSSL is on your system.  To my knowledge, nobody provides pre-built packages of git for AIX.

As I mentioned above, you'll probably need to build it yourself.

When I referred to having your vendor patch the check out, I meant your vendor of OpenSSL.

--
brian m. carlson / brian with sandals: Houston, Texas, US
+1 832 623 2791 | http://www.crustytoothpaste.net/~bmc | My opinion only
OpenPGP: RSA v4 4096b: 88AC E9B2 9196 305B A994 7552 F1BA 225C 0223 B187

On Tue, Oct 21, 2014 at 12:31:55PM +0000, RaviKiranGoud_Palpanoori@vfc.com wrote:

I don't have any more information than this, but I believe Debian and Red Hat have patched that check out. Any reasonable developer should be able to discover the check and remove it.

This is getting off-topic for the list, so I recommend you discuss it with IBM or simply recompile Git for the new version of OpenSSL, as this really isn't a Git issue.