OpenSSL bundling is interfering with native libraries to use the OS installed version

[pshipton]

Renaming the bundled OpenSSL 3.5 to crypto-semeru (libcrypto-semeru.so) does not stop it from interfering with native libraries that use libssl / libcrypto, causing UnsatisfiedLinkErrors when trying to load the native libraries.

Possible error messages include:

/libcrypto-semeru.so: version 'OPENSSL_3.0.1' not found (required by /lib64/libssl.so.3)

cannot open shared object file: No such file or directory

There is a workaround, run with -Djdk.native.openssl.skipBundled=true to avoid loading the bundled OpenSSL 3.5 library and use a OS installed OpenSSL instead.

Ref https://github.ibm.com/runtimes/jit-crypto/issues/906

[pshipton]

Tentatively set it as a blocker, although perhaps there isn't time to fix it for 0.56 and it will need to move out.

[pshipton]

A solution couldn't be found for 0.56, moving it out.

[ricellis]

This can also break jarsigner commands that use e.g. a specific PKCS11 module needing the system openssl. Even with -verbose the error message can be a much less informative jarsigner error: java.security.ProviderException: Initialization failed.
Adding -J-Djdk.native.openssl.skipBundled=true to the jarsigner command gets things working again.

[jasonkatonica]

Updates to further isolate bundled openssl symbols in the bundled openssl library can be found at :

Java next => ibmruntimes/openj9-openjdk-jdk#1110 => merged
Java 25 => ibmruntimes/openj9-openjdk-jdk25#73 => merged
Java 21 => ibmruntimes/openj9-openjdk-jdk21#376 => merged
Java 17 => ibmruntimes/openj9-openjdk-jdk17#558 => merged
Java 11 => ibmruntimes/openj9-openjdk-jdk11#988 => merged
Java 8 => ibmruntimes/openj9-openjdk-jdk8#858 => merged

[jasonkatonica]

Associated changes have all been merged. This is now targted for the 1Q release of Semeru.

[jasonkatonica]

The above updates are complete for linux systems where interference is likely to occur given that linux typically includes openssl libraries making a conflict likely in versions in use. These updates were addressed with code updates linked to above. These updates are expected to become available in the 0.57 release.

Further work is ongoing with a similar update for other platforms. Other platforms are less likely to encounter this issue given they do not include openssl in the OS however we would still like to make similar changes there. These changes are targeted for a future release.