解決在centos7.2下YUM安裝nginx-1.12.2依賴的問題

因爲CENTOS7.2默認使用老版本的openssl(OpenSSL 1.0.1e) ,這個問題會致使yum nginx-1.12以上版本的時候會由於依賴libcrypto.so.10(OPENSSL_1.0.2)(64bit)的問題形成安裝失敗。

環境描述

以下：
系統版本檢測

[root@z000w00~]# cat /etc/redhat-release 
CentOS Linux release 7.2.1511 (Core)

openssl版本檢測

[root@z00w00 ~]# openssl version
OpenSSL 1.0.1e-fips 11 Feb 2013

嘗試YUM安裝nginx

[root@z00w00~]# yum install nginx
Loaded plugins: fastestmirror
aliEpel                                                                                                                            | 3.2 kB  00:00:00     
(1/3): aliEpel/7/x86_64/group_gz                                                                                |  88 kB  00:00:00     
(2/3): aliEpel/7/x86_64/updateinfo                                                                              | 928 kB  00:00:00     
(3/3): aliEpel/7/x86_64/primary                                                                                 | 3.5 MB  00:00:00     
Loading mirror speeds from cached hostfile
aliEpel                                                                                                                          12614/12614
Resolving Dependencies
--> Running transaction check
---> Package nginx.x86_64 1:1.12.2-2.el7 will be installed
--> Processing Dependency: nginx-filesystem = 1:1.12.2-2.el7 for package: 1:nginx-1.12.2-2.el7.x86_64
--> Processing Dependency: nginx-all-modules = 1:1.12.2-2.el7 for package: 1:nginx-1.12.2-2.el7.x86_64
--> Processing Dependency: nginx-filesystem for package: 1:nginx-1.12.2-2.el7.x86_64
--> Processing Dependency: libcrypto.so.10(OPENSSL_1.0.2)(64bit) for package: 1:nginx-1.12.2-2.el7.x86_64
--> Processing Dependency: libprofiler.so.0()(64bit) for package: 1:nginx-1.12.2-2.el7.x86_64
--> Running transaction check
.... 省略部份內容
Error: Package: 1:nginx-1.12.2-2.el7.x86_64 (aliEpel)
           Requires: libcrypto.so.10(OPENSSL_1.0.2)(64bit)
 You could try using --skip-broken to work around the problem
 You could try running: rpm -Va --nofiles --nodigest

注意看報錯，提示須要依賴libcrypto.so.10(OPENSSL_1.0.2)庫文件

排查策略

查看一下openssl版本

[root@z00w00 ~]# rpm -q --provides openssl
openssl = 1:1.0.1e-51.el7_2.7
openssl(x86-64) = 1:1.0.1e-51.el7_2.7

查看一下當前的庫文件，特別是libcrypto.so.10

[root@z00w00 ~]# rpm -q --provides openssl-libs | grep libcrypto.so.10
libcrypto.so.10()(64bit)
libcrypto.so.10(OPENSSL_1.0.1)(64bit)
libcrypto.so.10(OPENSSL_1.0.1_EC)(64bit)
libcrypto.so.10(libcrypto.so.10)(64bit)

既然知道問題所在，那麼解決就好辦了。就是升級openssl。centos7.2是沒有辦法經過yum update直接升級的。

解決辦法

須要從http://rpm.pbone.net 搜索相關的RPM包下載
這個就不具體演示了。搜索技能應該是必備的

須要以上兩個文件，下一步天然是下載本地，安裝了。

我再解釋一下爲啥要同時下載和安裝這兩個RPM。由於這兩個RPM彼此依賴，若是單安裝一個RPM，會提示另外一個須要依賴，有興趣的童鞋能夠試試。

[root@z00w00 tmp]# yum localinstall openssl-libs-1.0.2k-8.el7.x86_64.rpm openssl-1.0.2k-8.el7.x86_64.rpm 
Loaded plugins: fastestmirror 
Examining openssl-libs-1.0.2k-8.el7.x86_64.rpm: 1:openssl-libs-1.0.2k-8.el7.x86_64 
Marking openssl-libs-1.0.2k-8.el7.x86_64.rpm as an update to 1:openssl-libs-1.0.1e-51.el7_2.7.x86_64 
Examining openssl-1.0.2k-8.el7.x86_64.rpm: 1:openssl-1.0.2k-8.el7.x86_64 
Marking openssl-1.0.2k-8.el7.x86_64.rpm as an update to 1:openssl-1.0.1e-51.el7_2.7.x86_64 
Resolving Dependencies 
--> Running transaction check 
---> Package openssl.x86_64 1:1.0.1e-51.el7_2.7 will be updated 
---> Package openssl.x86_64 1:1.0.2k-8.el7 will be an update 
---> Package openssl-libs.x86_64 1:1.0.1e-51.el7_2.7 will be updated 
---> Package openssl-libs.x86_64 1:1.0.2k-8.el7 will be an update 
--> Finished Dependency Resolution 

Dependencies Resolved 

======================================================================================================================================= 
Package Arch Version Repository Size 
======================================================================================================================================= 
Updating: 
openssl(B x86_64 1:1.0.2k-8.el7 /openssl-1.0.2k-8.el7.x86_64 814 k 
openssl-libs(B x86_64 1:1.0.2k-8.el7 /openssl-libs-1.0.2k-8.el7.x86_64 3.1 M 

Transaction Summary 
======================================================================================================================================= 
Upgrade 2 Packages 

Total size: 3.8 M 
Is this ok [y/d/N]: y 
Downloading packages: 
Running transaction check 
Running transaction test 
Transaction test succeeded 
Running transaction 
Updating : 1:openssl-libs-1.0.2k-8.el7.x86_64 1/4 
Updating : 1:openssl-1.0.2k-8.el7.x86_64 2/4 
Cleanup : 1:openssl-1.0.1e-51.el7_2.7.x86_64 3/4 
Cleanup : 1:openssl-libs-1.0.1e-51.el7_2.7.x86_64 4/4 
Verifying : 1:openssl-1.0.2k-8.el7.x86_64 1/4 
Verifying : 1:openssl-libs-1.0.2k-8.el7.x86_64 2/4 
Verifying : 1:openssl-libs-1.0.1e-51.el7_2.7.x86_64 3/4 
Verifying : 1:openssl-1.0.1e-51.el7_2.7.x86_64 4/4 

Updated: 
openssl.x86_64 1:1.0.2k-8.el7 openssl-libs.x86_64 1:1.0.2k-8.el7 

Complete!

接着檢查一下openssl版本

[root@z00w00 tmp]# openssl version 
OpenSSL 1.0.2k-fips 26 Jan 2017 
ror.centos.org/centos/7/os/xls

查看包

[root@z00w00 ~]# rpm -q --provides openssl
openssl = 1:1.0.2k-8.el7
openssl(x86-64) = 1:1.0.2k-8.el7

看看依賴庫

[root@gbossapp-new1-2 ~]# rpm -q --provides openssl-libs | grep libcrypto.so.10
libcrypto.so.10()(64bit)
libcrypto.so.10(OPENSSL_1.0.1)(64bit)
libcrypto.so.10(OPENSSL_1.0.1_EC)(64bit)
libcrypto.so.10(OPENSSL_1.0.2)(64bit)
libcrypto.so.10(libcrypto.so.10)(64bit)

這個時候你就能夠放心的yum 新版本NGINX了。

升級openssl仍是要注意一下，由於有一些個別老應用會用到openssl1.0.1,這個時候就須要認真平衡了。