From: Johnny Rodgers <johnny.rodgers@...>
Date: 2009-09-23T02:39:18+09:00
Subject: Resolving OpenSSL version mismatch in OS X 10.5.8

In a Rails app I have built, the Amazon Web Services Product Advertising
API is used to retrieve book information.  Recently, AWS changed their
API and now requires that requests be signed with a SHA256 key.  I'm in
the process of updating my code to reflect this change, but quickly ran
into a problem with mismatched versions of OpenSSL on my system.
Specifically, the AWS API requires a SHA256 key, but I believe the
version of OpenSSL I am running (0.9.7l) only provides for SHA1.

So I downloaded the latest stable release of OpenSSL (0.9.8k), compiled
it, and installed it at /usr/local/ssl.

I set my PATH to include this directory:

Macintosh-266:~ root# env
MANPATH=/usr/share/man:/usr/local/share/man:/usr/X11/man
TERM=xterm-color
SHELL=/bin/sh
USER=root
PATH=/usr/local/ssl:/usr/local/bin:/usr/local/sbin:/usr/local/mysql/bin:/bin:/usr/bin:/usr/sbin:/sbin:/usr/local/bin:/usr/X11/bin
PWD=/var/root
SHLVL=1
HOME=/var/root
_=/usr/bin/env

I'm running Mac OS X 10.5.8.  Leopard ships with OpenSSL installed at
/System/Library/OpenSSL, and this appears to be what is being included
by ruby when I "require 'openssl'":

Macintosh-266:~ Home$ openssl version -a
OpenSSL 0.9.7l 28 Sep 2006
built on: Tue Feb 10 19:04:40 PST 2009
platform: darwin-i386-cc
options:  bn(64,32) md2(int) rc4(ptr,char) des(idx,cisc,16,long)
blowfish(ptr)
compiler: cc -arch ppc -arch ppc64 -arch i386 -arch x86_64 -g -Os -pipe
-arch ppc -arch ppc64 -arch i386 -arch x86_64 -pipe -DOPENSSL_NO_IDEA
-DFAR=
OPENSSLDIR: "/System/Library/OpenSSL"

My installation of ruby (1.8.5) is running at /usr/local/lib/ruby.

Macintosh-266:~ root# irb
irb(main):001:0> require 'openssl'
=> true
irb(main):002:0> OpenSSL::OPENSSL_VERSION
=> "OpenSSL 0.9.7i 14 Oct 2005"

In /usr/local/lib/ruby/1.8/openssl/digest.rb:

module OpenSSL
  module Digest

    alg = %w(DSS DSS1 MD2 MD4 MD5 MDC2 RIPEMD160 SHA SHA1)
    if OPENSSL_VERSION_NUMBER > 0x00908000
      alg += %w(SHA224 SHA256 SHA384 SHA512)
    end
    ...
  end
end

So, as you can see, I need to be running OpenSSL > v.0.9.8 in order to
use SHA256 hashing.

I have been scouring the forums and google for about three hours and
cannot figure out how to make my ruby install use/load the newer version
of OpenSSL.  If anyone can point me in the right direction, I would
greatly appreciate it.

Thank you very much for your help.
Cheers, JR
-- 
Posted via http://www.ruby-forum.com/.