provided.al2 : package conflict with openssl-snapsafe-libs

[hallm4]

Not sure where to file this. I'm using the provided.al2 image as a base, and I'm trying to add a few packages to it.

Repro Dockerfile

# syntax = docker/dockerfile:1
ARG IMGTAG=al2
FROM public.ecr.aws/lambda/provided:${IMGTAG}

RUN yum install -y perl-LWP-Protocol-https

RUN amazon-linux-extras install -y epel && \
    yum install -y perl-REST-Client \
                   perl-Net-GitHub

docker buildx build --platform linux/amd64 \
                    -f Dockerfile -t repro:latest

These packages seem to have a dependency on a newer openssl that conflicts with an existing SSL library in the provided.al2 image.

.... lots of output
#9 10.02 --> Processing Conflict: 1:openssl-snapsafe-libs-1.0.2k-24.amzn2.0.14.x86_64 conflicts openssl-libs
#9 10.09 --> Finished Dependency Resolution
#9 10.10 Error: openssl-snapsafe-libs conflicts with 1:openssl-libs-1.0.2k-24.amzn2.0.15.x86_64
#9 10.10  You could try using --skip-broken to work around the problem
#9 10.19  You could try running: rpm -Va --nofiles --nodigest

As a note, I also tried several versions of the al2 image :

#ARG IMGTAG=al2.2025.02.28.06
#ARG IMGTAG=al2.2025.02.25.16
#ARG IMGTAG=al2.2025.01.14.16

This was working a week or two ago, so I assume some new packages were published.

This seems like an issue with the newly published :

rpm -qip openssl-1.0.2k-24.amzn2.0.15.x86_64.rpm
Name        : openssl
Epoch       : 1
Version     : 1.0.2k
Release     : 24.amzn2.0.15
Architecture: x86_64
Install Date: (not installed)
Group       : System Environment/Libraries
Size        : 850020
License     : OpenSSL
Signature   : RSA/SHA512, Tue 25 Feb 2025 07:17:49 PM UTC, Key ID 11cf1f95c87f5b1a
Source RPM  : openssl-1.0.2k-24.amzn2.0.15.src.rpm
Build Date  : Tue 25 Feb 2025 07:14:44 PM UTC
Build Host  : build.amazon.com
Relocations : (not relocatable)
Packager    : Amazon Linux
Vendor      : Amazon Linux
...

As the version from last year does not have this issue.

rpm -qip openssl-1.0.2k-24.amzn2.0.14.x86_64.rpm
Name        : openssl
Epoch       : 1
Version     : 1.0.2k
Release     : 24.amzn2.0.14
...
Build Date  : Mon 21 Oct 2024 07:01:00 PM UTC

Installing "openssl-1.0.2k-24.amzn2.0.14" ahead of the packages above seem to fulfill the dependencies and do not show the error.

edit : as a note (final?) the openssl-snapsafe-libs and openssl-libs packages seems to be almost file identical. So perhaps when the new -15 release was made in regards to https://alas.aws.amazon.com/AL2/ALAS-2025-2780.html -- the openssl-snapsafe-libs not being made as part of that set was an oversight. The "provides" section of openssl-snapsafe-libs shows that :

openssl-libs = 1:1.0.2k-24.amzn2.0.14
openssl-libs(x86-64) = 1:1.0.2k-24.amzn2.0.14
openssl-snapsafe-libs = 1:1.0.2k-24.amzn2.0.14
openssl-snapsafe-libs(x86-64) = 1:1.0.2k-24.amzn2.0.14

So this package is supposed to provide openssl-libs.

[diracleo]

I'm having the same issue:

 > [4/6] RUN yum install -y xmlsec1-devel:
2.840 --> Processing Dependency: pkgconfig(libsepol) for package: libselinux-devel-2.5-12.amzn2.0.2.x86_64
2.840 ---> Package libverto-devel.x86_64 0:0.2.5-4.amzn2.0.2 will be installed
2.841 --> Running transaction check
2.841 ---> Package libsepol-devel.x86_64 0:2.5-10.amzn2.0.1 will be installed
2.842 ---> Package pcre-devel.x86_64 0:8.32-17.amzn2.0.3 will be installed
2.875 --> Processing Conflict: 1:openssl-snapsafe-libs-1.0.2k-24.amzn2.0.14.x86_64 conflicts openssl-libs
2.940 --> Finished Dependency Resolution
2.942 Error: openssl-snapsafe-libs conflicts with 1:openssl-libs-1.0.2k-24.amzn2.0.15.x86_64
2.943  You could try using --skip-broken to work around the problem
3.070  You could try running: rpm -Va --nofiles --nodigest

[TheOpenDevProject]

Yup I thought we were going crazy, they just randomly broke this for us too

[lexxschilperoord]

Same issue here: Error: openssl-snapsafe-libs conflicts with 1:openssl-libs-1.0.2k-24.amzn2.0.15.x86_64

[jiahaolo]

Currently facing this issue too. Error: openssl-snapsafe-libs conflicts with 1:openssl-libs-1.0.2k-24.amzn2.0.15.x86_64
Is there a workaround for this?

[hallm4]

Currently facing this issue too. Error: openssl-snapsafe-libs conflicts with 1:openssl-libs-1.0.2k-24.amzn2.0.15.x86_64 Is there a workaround for this?

One workaround that I mentioned above, is to explicitly install the openssl rpm package that will work / co-exist with the openssl-snapsafe-libs version.

EG:

yum install -y openssl-1.0.2k-24.amzn2.0.14

And then try installing your packages that would usually trigger the openssl rpm dependency. This will not put you on the latest openssl version as available from amazon, so please investigate for yourself that it's safe to use the slightly older version in the meantime.

[jiahaolo]

Currently facing this issue too. Error: openssl-snapsafe-libs conflicts with 1:openssl-libs-1.0.2k-24.amzn2.0.15.x86_64 Is there a workaround for this?

One workaround that I mentioned above, is to explicitly install the openssl rpm package that will work / co-exist with the openssl-snapsafe-libs version.

EG:

yum install -y openssl-1.0.2k-24.amzn2.0.14

And then try installing your packages that would usually trigger the openssl rpm dependency. This will not put you on the latest openssl version as available from amazon, so please investigate for yourself that it's safe to use the slightly older version in the meantime.

Thank you, let me try it out!

[ChristophrK]

Currently also the same Issue is happening with the Python specific image public.ecr.aws/lambda/python:3.9 for me.

For me two workarrounds are working; For direct openssl installs the version pinning mentioned by @hallm4 e.g. yum install -y openssl-devel-1.0.2k-24.amzn2.0.14 instead of yum install -y openssl-devel is working. For Packages that just depend on a recent openssl lib as a dependency it helps for me installing the specific version in the same command e.g. yum install -y msodbcsql17 openssl-1.0.2k-24.amzn2.0.14.x86_64 instead of yum install -y msodbcsql17

[trivenay]

Thanks for bringing this up! We appreciate the feedback.

Background

openssl-snapsafe-libs is included in the Lambda runtimes to ensure secure cryptographic operations when using SnapStart. It is installed in the chroot of the managed runtimes, which is shared by the Lambda base images for consistency. The openssl-snapsafe-libs package is installed using a specific mirror list.

Root Cause

The issue occurs when trying to install a newer version of openssl-libs which conflicts with the pre-installed older version of openssl-snapsafe-libs. This happens when a new version of openssl-libs has been released which is not compatible with the existing version of openssl-snapsafe-libs, or when using an older image.

Workaround

Reproduce the issue:

docker run --rm -it --entrypoint /bin/bash public.ecr.aws/lambda/python:3.11.2025.01.15.13
bash-4.2# yum install -y gcc gcc-c++ openssl-devel bzip2-devel libffi-devel tar gzip wget make zlib python3-devel xz
---------------------------------FAILS---------------------------------------------------------------------
Error: openssl-snapsafe-libs conflicts with 1:openssl-libs-1.0.2k-24.amzn2.0.15.x86_64
 You could try using --skip-broken to work around the problem
 You could try running: rpm -Va --nofiles --nodigest

To workaround the issue, add the yum mirror list below to /etc/yum.repos.d/amzn2-extras.repo (replace x86_64 with arm64 as appropriate). This enables yum to fetch openssl-snapsafe-libs .

[amzn2extra-openssl-snapsafe]
enabled = 1
name = Amazon Extras repo for openssl-snapsafe
mirrorlist = https://amazonlinux-2-repos-eu-west-3.s3.eu-west-3.amazonaws.com/2/extras/openssl-snapsafe/latest/x86_64/mirror.list
gpgcheck = 1
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-amazon-linux-2
priority = 10
skip_if_unavailable = 1
report_instanceid = yes

Now upgrade openssl-snapsafe-libs

yum upgrade -y openssl-snapsafe-libs
.....
.....
Running transaction
  Updating   : 1:openssl-snapsafe-libs-1.0.2k-24.amzn2.0.15.x86_64                                                                                                                                                                                                                     1/2
  Cleanup    : 1:openssl-snapsafe-libs-1.0.2k-24.amzn2.0.14.x86_64                                                                                                                                                                                                                     2/2
  Verifying  : 1:openssl-snapsafe-libs-1.0.2k-24.amzn2.0.15.x86_64                                                                                                                                                                                                                     1/2
  Verifying  : 1:openssl-snapsafe-libs-1.0.2k-24.amzn2.0.14.x86_64                                                                                                                                                                                                                     2/2

Updated:
  openssl-snapsafe-libs.x86_64 1:1.0.2k-24.amzn2.0.15

Complete!

Now rerunning the previous yum install command works successfully.

Mitigation Plan

• Short-term: Please use the workaround provided for affected images
• Long-term: We are considering to include the mirror for openssl-snapsafe-libs (plus any other extras we bundle) in the Lambda base images to ensure dependencies can be upgraded.

Let us know if you have any questions! 🚀

[julesjans]

Thank you @trivenay, the workaround has fixed the issue for me on public.ecr.aws/lambda/ruby:3.2.

[grazzolini]

This workaround works too for python:3.9. But Is there an ETA for when the base images will have this extra repo embedded in then?

[afprjensen]

Mitigation Plan

• Short-term: Please use the workaround provided for affected images • Long-term: We are considering to include the mirror for openssl-snapsafe-libs (plus any other extras we bundle) in the Lambda base images to ensure dependencies can be upgraded.

Let us know if you have any questions! 🚀

How will we know when the Long-term solution is released and we can remove the Short-term fixes?

[afprjensen]

I used the following (HEREDOC style command) in a Dockerfile to set this up. Note that it uses variables in the mirrorlist to use region local sources like the existing yum repo config files:

RUN <<EOF
cat > /etc/yum.repos.d/amzn2-extras.repo << 'EOREPO'
[amzn2extra-openssl-snapsafe]
name=Amazon Extras repo for openssl-snapsafe
enabled=1
mirrorlist=$awsproto://$amazonlinux.$awsregion.$awsdomain/2/extras/openssl-snapsafe/latest/$basearch/mirror.list
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-amazon-linux-2
priority=10
skip_if_unavailable=1
report_instanceid=yes
EOREPO
EOF

[hunter-digital]

RUN yum install -y openssl-devel-1.0.2k-24.amzn2.0.14

Locking to 14 worked for us 👍

EDIT: This stopped working.