libevent changes ABI on >=glibc-2.36 upgrade, breaking e.g. Tor

Sam James <[email protected]> Wed, 15 Mar 2023 04:20:29 +0000

Newsgroups	dev.linux.lists.distributions
Message-ID	<[email protected]>

libevent hasn't made a release in a while, so this is probably worth
getting out there.

If libevent is built against a libc without arc4random, like
<=glibc-2.36, it'll provide evutil_secure_rng_add_bytes. If
it's built against a libc providing arc4random, it'll stop
providing evutil_secure_rng_add_bytes without changing SONAME.

This breaks consumers like Tor which uses it if it exists in
libevent, leading to runtime issues:
```
Feb 15 04:57:23 systemd[1]: Starting tor.service...
Feb 15 04:57:23 tor[1321]: /usr/bin/tor: symbol lookup error:
/usr/bin/tor: undefined symbol: evutil_secure_rng_add_bytes
```

This originally bit us in Gentoo [0] and there's an upstream
bug report [1] and patch available now (but no new release)
to always provide evutil_secure_rng_add_bytes, but stubbed
out if libc provides arc4random.

[0] https://bugs.gentoo.org/894536
[1] https://github.com/libevent/libevent/issues/1393
[2] https://github.com/libevent/libevent/pull/1427

best,
sam

signature.asc (application/pgp-signature, 377 B)