Ubuntu-fr

julien.favre

[Résolu] ElectrumSV (Python 3.10.4) sur Ubuntu 22.04: Problème OpenSSL

Bonjour,

J'utilise le logiciel ElectrumSV 1.3.13, je n'avais jamais eu de problèmes avant à le faire fonctionner.
Mais depuis que je suis passé de Ubuntu 21.10 à 22.04 ça ne marche plus du tout. Apparemment c'est un problème de compatibilité avec Python et ses bibliothèques.

J'ai demandé de l'aide sur Github au développeur de l'application, voici la discussion: https://github.com/electrumsv/electrumsv/issues/895

Pour résumer:
J'avais un premier problème que j'ai résolu en installant le paquet libffi-dev.

Mais maintenant j'ai l'erreur suivante:

julien@julien-laptop:~/Applications/ElectrumSV-1.3.13$ ./electrum-sv
Traceback (most recent call last):
  File "/usr/lib/python3.10/hashlib.py", line 160, in __hash_new
    return _hashlib.new(name, data, **kwargs)
ValueError: [digital envelope routines] unsupported

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/home/julien/Applications/ElectrumSV-1.3.13/./electrum-sv", line 31, in <module>
    from electrumsv.main import main
  File "/home/julien/Applications/ElectrumSV-1.3.13/electrumsv/main.py", line 37, in <module>
    from electrumsv import daemon, web
  File "/home/julien/Applications/ElectrumSV-1.3.13/electrumsv/daemon.py", line 33, in <module>
    from .restapi import AiohttpServer
  File "/home/julien/Applications/ElectrumSV-1.3.13/electrumsv/restapi.py", line 9, in <module>
    from .app_state import app_state
  File "/home/julien/Applications/ElectrumSV-1.3.13/electrumsv/app_state.py", line 44, in <module>
    from .networks import Net
  File "/home/julien/Applications/ElectrumSV-1.3.13/electrumsv/networks.py", line 237, in <module>
    class SVRegTestnet(object):
  File "/home/julien/Applications/ElectrumSV-1.3.13/electrumsv/networks.py", line 255, in SVRegTestnet
    REGTEST_P2PKH_ADDRESS: P2PKH_Address = REGTEST_FUNDS_PUBLIC_KEY.to_address().to_string()
  File "/home/julien/.local/lib/python3.10/site-packages/bitcoinx/keys.py", line 441, in to_address
    return P2PKH_Address(self.hash160(compressed=compressed), coin)
  File "/home/julien/.local/lib/python3.10/site-packages/bitcoinx/keys.py", line 545, in hash160
    return hash160(self.to_bytes(compressed=compressed))
  File "/home/julien/.local/lib/python3.10/site-packages/bitcoinx/hashes.py", line 77, in hash160
    return ripemd160(sha256(x))
  File "/home/julien/.local/lib/python3.10/site-packages/bitcoinx/hashes.py", line 63, in ripemd160
    h = _new_hash('ripemd160')
  File "/usr/lib/python3.10/hashlib.py", line 166, in __hash_new
    return __get_builtin_constructor(name)(data)
  File "/usr/lib/python3.10/hashlib.py", line 123, in __get_builtin_constructor
    raise ValueError('unsupported hash type ' + name)
ValueError: unsupported hash type ripemd160

et le développeur m'a répondu:

OpenSSL 3.0.2 or so does not support ripemd160, this means that all the software which relies on it no longer works. Your Python likely needs to be compiled against an earlier version of OpenSSL.

En français ça donne ça:

OpenSSL 3.0.2 ou plus ne supporte pas ripemd160, ce qui signifie que tous les logiciels qui en dépendent ne fonctionnent plus. Votre Python doit probablement être compilé avec une version antérieure d'OpenSSL.

Alors là c'est un peu trop avancé pour moi, je ne suis pas sûr de ce que je dois faire...

Est-ce que revenir simplement à une version antérieure de Python réglerait le problème ?
Je crois qu'avant ce problème j'avais une version antérieure et ça marchait. Je pense que j'avais la version 3.8.x mais je ne suis pas 100% sûr.

Est-ce que vous savez ce que je dois faire ?

Merci pour votre aide

Dernière modification par julien.favre (Le 09/07/2022, à 14:13)

Vobul

Re : [Résolu] ElectrumSV (Python 3.10.4) sur Ubuntu 22.04: Problème OpenSSL

Dans le readme il t'explique comment utiliser pyenv, ça me semble une bonne approche mais si ce python utilise l'openssl du système ça va être le même souci. Une autre approche serait d'utiliser Docker ou autre technologie de containerization.

Mais le problème principal est l'utilisation d'un algo comme ripemd160. C'est pas openssl ni ubuntu le problème. Tu peux lire ce thread: https://github.com/openssl/openssl/issues/16994 où y'a un mec qui rage par rapport à Bitcoin, ce qui est également ton souci. Mais le thread montre aussi que tu peux l'activer en modifiant le fichier de conf.

---

Vobul
Utilisez le retour utilisable de commandes !!!
J'aime la langue française, mais je parle franglais, deal with it.
RTFM

julien.favre

Re : [Résolu] ElectrumSV (Python 3.10.4) sur Ubuntu 22.04: Problème OpenSSL

Dans le readme il t'explique comment utiliser pyenv, ça me semble une bonne approche mais si ce python utilise l'openssl du système ça va être le même souci. Une autre approche serait d'utiliser Docker ou autre technologie de containerization.

Mais le problème principal est l'utilisation d'un algo comme ripemd160. C'est pas openssl ni ubuntu le problème. Tu peux lire ce thread: https://github.com/openssl/openssl/issues/16994 où y'a un mec qui rage par rapport à Bitcoin, ce qui est également ton souci. Mais le thread montre aussi que tu peux l'activer en modifiant le fichier de conf.

Merci Vobul pour avoir trouvé cette information ! C'est très instructif

J'ai lu le thread en entier et ensuite je l'ai relu pour comprendre comment activer ripemd160 mais j'ai du mal...
Quel est le fichier config que je dois modifier ?
Parce que j'ai cherché openssl.cnf et j'en ai trouvé beaucoup dans différents dossiers

Vobul

Re : [Résolu] ElectrumSV (Python 3.10.4) sur Ubuntu 22.04: Problème OpenSSL

Normalement /etc/ssl/openssl.cnf.

---

Vobul
Utilisez le retour utilisable de commandes !!!
J'aime la langue française, mais je parle franglais, deal with it.
RTFM

julien.favre

Re : [Résolu] ElectrumSV (Python 3.10.4) sur Ubuntu 22.04: Problème OpenSSL

Normalement /etc/ssl/openssl.cnf.

Ok, mon fichier ressemble à ça:

#
# OpenSSL example configuration file.
# See doc/man5/config.pod for more info.
#
# This is mostly being used for generation of certificate requests,
# but may be used for auto loading of providers

# Note that you can include other files from the main configuration
# file using the .include directive.
#.include filename

# This definition stops the following lines choking if HOME isn't
# defined.
HOME			= .

 # Use this in order to automatically load providers.
openssl_conf = openssl_init

# Comment out the next line to ignore configuration errors
config_diagnostics = 1

# Extra OBJECT IDENTIFIER info:
# oid_file       = $ENV::HOME/.oid
oid_section = new_oids

# To use this configuration file with the "-extfile" option of the
# "openssl x509" utility, name here the section containing the
# X.509v3 extensions to use:
# extensions		=
# (Alternatively, use a configuration file that has only
# X.509v3 extensions in its main [= default] section.)

[ new_oids ]
# We can add new OIDs in here for use by 'ca', 'req' and 'ts'.
# Add a simple OID like this:
# testoid1=1.2.3.4
# Or use config file substitution like this:
# testoid2=${testoid1}.5.6

# Policies used by the TSA examples.
tsa_policy1 = 1.2.3.4.1
tsa_policy2 = 1.2.3.4.5.6
tsa_policy3 = 1.2.3.4.5.7

# For FIPS
# Optionally include a file that is generated by the OpenSSL fipsinstall
# application. This file contains configuration data required by the OpenSSL
# fips provider. It contains a named section e.g. [fips_sect] which is
# referenced from the [provider_sect] below.
# Refer to the OpenSSL security policy for more information.
# .include fipsmodule.cnf

[openssl_init]
providers = provider_sect

# List of providers to load
[provider_sect]
default = default_sect
# The fips section name should match the section name inside the
# included fipsmodule.cnf.
# fips = fips_sect

# If no providers are activated explicitly, the default one is activated implicitly.
# See man 7 OSSL_PROVIDER-default for more details.
#
# If you add a section explicitly activating any other provider(s), you most
# probably need to explicitly activate the default provider, otherwise it
# becomes unavailable in openssl.  As a consequence applications depending on
# OpenSSL may not work correctly which could lead to significant system
# problems including inability to remotely access the system.
[default_sect]
# activate = 1


####################################################################
[ ca ]
default_ca	= CA_default		# The default ca section

####################################################################
[ CA_default ]

dir		= ./demoCA		# Where everything is kept
certs		= $dir/certs		# Where the issued certs are kept
crl_dir		= $dir/crl		# Where the issued crl are kept
database	= $dir/index.txt	# database index file.
#unique_subject	= no			# Set to 'no' to allow creation of
					# several certs with same subject.
new_certs_dir	= $dir/newcerts		# default place for new certs.

certificate	= $dir/cacert.pem 	# The CA certificate
serial		= $dir/serial 		# The current serial number
crlnumber	= $dir/crlnumber	# the current crl number
					# must be commented out to leave a V1 CRL
crl		= $dir/crl.pem 		# The current CRL
private_key	= $dir/private/cakey.pem# The private key

x509_extensions	= usr_cert		# The extensions to add to the cert

# Comment out the following two lines for the "traditional"
# (and highly broken) format.
name_opt 	= ca_default		# Subject Name options
cert_opt 	= ca_default		# Certificate field options

# Extension copying option: use with caution.
# copy_extensions = copy

# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
# so this is commented out by default to leave a V1 CRL.
# crlnumber must also be commented out to leave a V1 CRL.
# crl_extensions	= crl_ext

default_days	= 365			# how long to certify for
default_crl_days= 30			# how long before next CRL
default_md	= default		# use public key default MD
preserve	= no			# keep passed DN ordering

# A few difference way of specifying how similar the request should look
# For type CA, the listed attributes must be the same, and the optional
# and supplied fields are just that :-)
policy		= policy_match

# For the CA policy
[ policy_match ]
countryName		= match
stateOrProvinceName	= match
organizationName	= match
organizationalUnitName	= optional
commonName		= supplied
emailAddress		= optional

# For the 'anything' policy
# At this point in time, you must list all acceptable 'object'
# types.
[ policy_anything ]
countryName		= optional
stateOrProvinceName	= optional
localityName		= optional
organizationName	= optional
organizationalUnitName	= optional
commonName		= supplied
emailAddress		= optional

####################################################################
[ req ]
default_bits		= 2048
default_keyfile 	= privkey.pem
distinguished_name	= req_distinguished_name
attributes		= req_attributes
x509_extensions	= v3_ca	# The extensions to add to the self signed cert

# Passwords for private keys if not present they will be prompted for
# input_password = secret
# output_password = secret

# This sets a mask for permitted string types. There are several options.
# default: PrintableString, T61String, BMPString.
# pkix	 : PrintableString, BMPString (PKIX recommendation before 2004)
# utf8only: only UTF8Strings (PKIX recommendation after 2004).
# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
# MASK:XXXX a literal mask value.
# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.
string_mask = utf8only

# req_extensions = v3_req # The extensions to add to a certificate request

[ req_distinguished_name ]
countryName			= Country Name (2 letter code)
countryName_default		= AU
countryName_min			= 2
countryName_max			= 2

stateOrProvinceName		= State or Province Name (full name)
stateOrProvinceName_default	= Some-State

localityName			= Locality Name (eg, city)

0.organizationName		= Organization Name (eg, company)
0.organizationName_default	= Internet Widgits Pty Ltd

# we can do this but it is not needed normally :-)
#1.organizationName		= Second Organization Name (eg, company)
#1.organizationName_default	= World Wide Web Pty Ltd

organizationalUnitName		= Organizational Unit Name (eg, section)
#organizationalUnitName_default	=

commonName			= Common Name (e.g. server FQDN or YOUR name)
commonName_max			= 64

emailAddress			= Email Address
emailAddress_max		= 64

# SET-ex3			= SET extension number 3

[ req_attributes ]
challengePassword		= A challenge password
challengePassword_min		= 4
challengePassword_max		= 20

unstructuredName		= An optional company name

[ usr_cert ]

# These extensions are added when 'ca' signs a request.

# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.

basicConstraints=CA:FALSE

# This is typical in keyUsage for a client certificate.
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment

# PKIX recommendations harmless if included in all certificates.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer

# This stuff is for subjectAltName and issuerAltname.
# Import the email address.
# subjectAltName=email:copy
# An alternative to produce certificates that aren't
# deprecated according to PKIX.
# subjectAltName=email:move

# Copy subject details
# issuerAltName=issuer:copy

# This is required for TSA certificates.
# extendedKeyUsage = critical,timeStamping

[ v3_req ]

# Extensions to add to a certificate request

basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment

[ v3_ca ]


# Extensions for a typical CA


# PKIX recommendation.

subjectKeyIdentifier=hash

authorityKeyIdentifier=keyid:always,issuer

basicConstraints = critical,CA:true

# Key usage: this is typical for a CA certificate. However since it will
# prevent it being used as an test self-signed certificate it is best
# left out by default.
# keyUsage = cRLSign, keyCertSign

# Include email address in subject alt name: another PKIX recommendation
# subjectAltName=email:copy
# Copy issuer details
# issuerAltName=issuer:copy

# DER hex encoding of an extension: beware experts only!
# obj=DER:02:03
# Where 'obj' is a standard or added object
# You can even override a supported extension:
# basicConstraints= critical, DER:30:03:01:01:FF

[ crl_ext ]

# CRL extensions.
# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.

# issuerAltName=issuer:copy
authorityKeyIdentifier=keyid:always

[ proxy_cert_ext ]
# These extensions should be added when creating a proxy certificate

# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.

basicConstraints=CA:FALSE

# This is typical in keyUsage for a client certificate.
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment

# PKIX recommendations harmless if included in all certificates.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer

# This stuff is for subjectAltName and issuerAltname.
# Import the email address.
# subjectAltName=email:copy
# An alternative to produce certificates that aren't
# deprecated according to PKIX.
# subjectAltName=email:move

# Copy subject details
# issuerAltName=issuer:copy

# This really needs to be in place for it to be a proxy certificate.
proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo

####################################################################
[ tsa ]

default_tsa = tsa_config1	# the default TSA section

[ tsa_config1 ]

# These are used by the TSA reply generation only.
dir		= ./demoCA		# TSA root directory
serial		= $dir/tsaserial	# The current serial number (mandatory)
crypto_device	= builtin		# OpenSSL engine to use for signing
signer_cert	= $dir/tsacert.pem 	# The TSA signing certificate
					# (optional)
certs		= $dir/cacert.pem	# Certificate chain to include in reply
					# (optional)
signer_key	= $dir/private/tsakey.pem # The TSA private key (optional)
signer_digest  = sha256			# Signing digest to use. (Optional)
default_policy	= tsa_policy1		# Policy if request did not specify it
					# (optional)
other_policies	= tsa_policy2, tsa_policy3	# acceptable policies (optional)
digests     = sha1, sha256, sha384, sha512  # Acceptable message digests (mandatory)
accuracy	= secs:1, millisecs:500, microsecs:100	# (optional)
clock_precision_digits  = 0	# number of digits after dot. (optional)
ordering		= yes	# Is ordering defined for timestamps?
				# (optional, default: no)
tsa_name		= yes	# Must the TSA name be included in the reply?
				# (optional, default: no)
ess_cert_id_chain	= no	# Must the ESS cert id chain be included?
				# (optional, default: no)
ess_cert_id_alg		= sha1	# algorithm to compute certificate
				# identifier (optional, default: sha1)

[insta] # CMP using Insta Demo CA
# Message transfer
server = pki.certificate.fi:8700
# proxy = # set this as far as needed, e.g., http://192.168.1.1:8080
# tls_use = 0
path = pkix/

# Server authentication
recipient = "/C=FI/O=Insta Demo/CN=Insta Demo CA" # or set srvcert or issuer
ignore_keyusage = 1 # potentially needed quirk
unprotected_errors = 1 # potentially needed quirk
extracertsout = insta.extracerts.pem

# Client authentication
ref = 3078 # user identification
secret = pass:insta # can be used for both client and server side

# Generic message options
cmd = ir # default operation, can be overridden on cmd line with, e.g., kur

# Certificate enrollment
subject = "/CN=openssl-cmp-test"
newkey = insta.priv.pem
out_trusted = insta.ca.crt
certout = insta.cert.pem

[pbm] # Password-based protection for Insta CA
# Server and client authentication
ref = $insta::ref # 3078
secret = $insta::secret # pass:insta

[signature] # Signature-based protection for Insta CA
# Server authentication
trusted = insta.ca.crt # does not include keyUsage digitalSignature

# Client authentication
secret = # disable PBM
key = $insta::newkey # insta.priv.pem
cert = $insta::certout # insta.cert.pem

[ir]
cmd = ir

[cr]
cmd = cr

[kur]
# Certificate update
cmd = kur
oldcert = $insta::certout # insta.cert.pem

[rr]
# Certificate revocation
cmd = rr
oldcert = $insta::certout # insta.cert.pem

D'après ce que je comprends, il faudrait que je rajoute

legacy = legacy_sect

juste après

[provider_sect]
default = default_sect

Ensuite j'enlève le # devant

[default_sect]
# activate = 1

et je rajoute

[legacy_sect]
activate = 1

en dessous.

Donc j'obtiendrai le fichier suivant:

#
# OpenSSL example configuration file.
# See doc/man5/config.pod for more info.
#
# This is mostly being used for generation of certificate requests,
# but may be used for auto loading of providers

# Note that you can include other files from the main configuration
# file using the .include directive.
#.include filename

# This definition stops the following lines choking if HOME isn't
# defined.
HOME			= .

 # Use this in order to automatically load providers.
openssl_conf = openssl_init

# Comment out the next line to ignore configuration errors
config_diagnostics = 1

# Extra OBJECT IDENTIFIER info:
# oid_file       = $ENV::HOME/.oid
oid_section = new_oids

# To use this configuration file with the "-extfile" option of the
# "openssl x509" utility, name here the section containing the
# X.509v3 extensions to use:
# extensions		=
# (Alternatively, use a configuration file that has only
# X.509v3 extensions in its main [= default] section.)

[ new_oids ]
# We can add new OIDs in here for use by 'ca', 'req' and 'ts'.
# Add a simple OID like this:
# testoid1=1.2.3.4
# Or use config file substitution like this:
# testoid2=${testoid1}.5.6

# Policies used by the TSA examples.
tsa_policy1 = 1.2.3.4.1
tsa_policy2 = 1.2.3.4.5.6
tsa_policy3 = 1.2.3.4.5.7

# For FIPS
# Optionally include a file that is generated by the OpenSSL fipsinstall
# application. This file contains configuration data required by the OpenSSL
# fips provider. It contains a named section e.g. [fips_sect] which is
# referenced from the [provider_sect] below.
# Refer to the OpenSSL security policy for more information.
# .include fipsmodule.cnf

[openssl_init]
providers = provider_sect

# List of providers to load
[provider_sect]
default = default_sect
legacy = legacy_sect
# The fips section name should match the section name inside the
# included fipsmodule.cnf.
# fips = fips_sect

# If no providers are activated explicitly, the default one is activated implicitly.
# See man 7 OSSL_PROVIDER-default for more details.
#
# If you add a section explicitly activating any other provider(s), you most
# probably need to explicitly activate the default provider, otherwise it
# becomes unavailable in openssl.  As a consequence applications depending on
# OpenSSL may not work correctly which could lead to significant system
# problems including inability to remotely access the system.
[default_sect]
activate = 1

[legacy_sect]
activate = 1

####################################################################
[ ca ]
default_ca	= CA_default		# The default ca section

####################################################################
[ CA_default ]

dir		= ./demoCA		# Where everything is kept
certs		= $dir/certs		# Where the issued certs are kept
crl_dir		= $dir/crl		# Where the issued crl are kept
database	= $dir/index.txt	# database index file.
#unique_subject	= no			# Set to 'no' to allow creation of
					# several certs with same subject.
new_certs_dir	= $dir/newcerts		# default place for new certs.

certificate	= $dir/cacert.pem 	# The CA certificate
serial		= $dir/serial 		# The current serial number
crlnumber	= $dir/crlnumber	# the current crl number
					# must be commented out to leave a V1 CRL
crl		= $dir/crl.pem 		# The current CRL
private_key	= $dir/private/cakey.pem# The private key

x509_extensions	= usr_cert		# The extensions to add to the cert

# Comment out the following two lines for the "traditional"
# (and highly broken) format.
name_opt 	= ca_default		# Subject Name options
cert_opt 	= ca_default		# Certificate field options

# Extension copying option: use with caution.
# copy_extensions = copy

# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
# so this is commented out by default to leave a V1 CRL.
# crlnumber must also be commented out to leave a V1 CRL.
# crl_extensions	= crl_ext

default_days	= 365			# how long to certify for
default_crl_days= 30			# how long before next CRL
default_md	= default		# use public key default MD
preserve	= no			# keep passed DN ordering

# A few difference way of specifying how similar the request should look
# For type CA, the listed attributes must be the same, and the optional
# and supplied fields are just that :-)
policy		= policy_match

# For the CA policy
[ policy_match ]
countryName		= match
stateOrProvinceName	= match
organizationName	= match
organizationalUnitName	= optional
commonName		= supplied
emailAddress		= optional

# For the 'anything' policy
# At this point in time, you must list all acceptable 'object'
# types.
[ policy_anything ]
countryName		= optional
stateOrProvinceName	= optional
localityName		= optional
organizationName	= optional
organizationalUnitName	= optional
commonName		= supplied
emailAddress		= optional

####################################################################
[ req ]
default_bits		= 2048
default_keyfile 	= privkey.pem
distinguished_name	= req_distinguished_name
attributes		= req_attributes
x509_extensions	= v3_ca	# The extensions to add to the self signed cert

# Passwords for private keys if not present they will be prompted for
# input_password = secret
# output_password = secret

# This sets a mask for permitted string types. There are several options.
# default: PrintableString, T61String, BMPString.
# pkix	 : PrintableString, BMPString (PKIX recommendation before 2004)
# utf8only: only UTF8Strings (PKIX recommendation after 2004).
# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
# MASK:XXXX a literal mask value.
# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.
string_mask = utf8only

# req_extensions = v3_req # The extensions to add to a certificate request

[ req_distinguished_name ]
countryName			= Country Name (2 letter code)
countryName_default		= AU
countryName_min			= 2
countryName_max			= 2

stateOrProvinceName		= State or Province Name (full name)
stateOrProvinceName_default	= Some-State

localityName			= Locality Name (eg, city)

0.organizationName		= Organization Name (eg, company)
0.organizationName_default	= Internet Widgits Pty Ltd

# we can do this but it is not needed normally :-)
#1.organizationName		= Second Organization Name (eg, company)
#1.organizationName_default	= World Wide Web Pty Ltd

organizationalUnitName		= Organizational Unit Name (eg, section)
#organizationalUnitName_default	=

commonName			= Common Name (e.g. server FQDN or YOUR name)
commonName_max			= 64

emailAddress			= Email Address
emailAddress_max		= 64

# SET-ex3			= SET extension number 3

[ req_attributes ]
challengePassword		= A challenge password
challengePassword_min		= 4
challengePassword_max		= 20

unstructuredName		= An optional company name

[ usr_cert ]

# These extensions are added when 'ca' signs a request.

# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.

basicConstraints=CA:FALSE

# This is typical in keyUsage for a client certificate.
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment

# PKIX recommendations harmless if included in all certificates.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer

# This stuff is for subjectAltName and issuerAltname.
# Import the email address.
# subjectAltName=email:copy
# An alternative to produce certificates that aren't
# deprecated according to PKIX.
# subjectAltName=email:move

# Copy subject details
# issuerAltName=issuer:copy

# This is required for TSA certificates.
# extendedKeyUsage = critical,timeStamping

[ v3_req ]

# Extensions to add to a certificate request

basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment

[ v3_ca ]


# Extensions for a typical CA


# PKIX recommendation.

subjectKeyIdentifier=hash

authorityKeyIdentifier=keyid:always,issuer

basicConstraints = critical,CA:true

# Key usage: this is typical for a CA certificate. However since it will
# prevent it being used as an test self-signed certificate it is best
# left out by default.
# keyUsage = cRLSign, keyCertSign

# Include email address in subject alt name: another PKIX recommendation
# subjectAltName=email:copy
# Copy issuer details
# issuerAltName=issuer:copy

# DER hex encoding of an extension: beware experts only!
# obj=DER:02:03
# Where 'obj' is a standard or added object
# You can even override a supported extension:
# basicConstraints= critical, DER:30:03:01:01:FF

[ crl_ext ]

# CRL extensions.
# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.

# issuerAltName=issuer:copy
authorityKeyIdentifier=keyid:always

[ proxy_cert_ext ]
# These extensions should be added when creating a proxy certificate

# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.

basicConstraints=CA:FALSE

# This is typical in keyUsage for a client certificate.
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment

# PKIX recommendations harmless if included in all certificates.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer

# This stuff is for subjectAltName and issuerAltname.
# Import the email address.
# subjectAltName=email:copy
# An alternative to produce certificates that aren't
# deprecated according to PKIX.
# subjectAltName=email:move

# Copy subject details
# issuerAltName=issuer:copy

# This really needs to be in place for it to be a proxy certificate.
proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo

####################################################################
[ tsa ]

default_tsa = tsa_config1	# the default TSA section

[ tsa_config1 ]

# These are used by the TSA reply generation only.
dir		= ./demoCA		# TSA root directory
serial		= $dir/tsaserial	# The current serial number (mandatory)
crypto_device	= builtin		# OpenSSL engine to use for signing
signer_cert	= $dir/tsacert.pem 	# The TSA signing certificate
					# (optional)
certs		= $dir/cacert.pem	# Certificate chain to include in reply
					# (optional)
signer_key	= $dir/private/tsakey.pem # The TSA private key (optional)
signer_digest  = sha256			# Signing digest to use. (Optional)
default_policy	= tsa_policy1		# Policy if request did not specify it
					# (optional)
other_policies	= tsa_policy2, tsa_policy3	# acceptable policies (optional)
digests     = sha1, sha256, sha384, sha512  # Acceptable message digests (mandatory)
accuracy	= secs:1, millisecs:500, microsecs:100	# (optional)
clock_precision_digits  = 0	# number of digits after dot. (optional)
ordering		= yes	# Is ordering defined for timestamps?
				# (optional, default: no)
tsa_name		= yes	# Must the TSA name be included in the reply?
				# (optional, default: no)
ess_cert_id_chain	= no	# Must the ESS cert id chain be included?
				# (optional, default: no)
ess_cert_id_alg		= sha1	# algorithm to compute certificate
				# identifier (optional, default: sha1)

[insta] # CMP using Insta Demo CA
# Message transfer
server = pki.certificate.fi:8700
# proxy = # set this as far as needed, e.g., http://192.168.1.1:8080
# tls_use = 0
path = pkix/

# Server authentication
recipient = "/C=FI/O=Insta Demo/CN=Insta Demo CA" # or set srvcert or issuer
ignore_keyusage = 1 # potentially needed quirk
unprotected_errors = 1 # potentially needed quirk
extracertsout = insta.extracerts.pem

# Client authentication
ref = 3078 # user identification
secret = pass:insta # can be used for both client and server side

# Generic message options
cmd = ir # default operation, can be overridden on cmd line with, e.g., kur

# Certificate enrollment
subject = "/CN=openssl-cmp-test"
newkey = insta.priv.pem
out_trusted = insta.ca.crt
certout = insta.cert.pem

[pbm] # Password-based protection for Insta CA
# Server and client authentication
ref = $insta::ref # 3078
secret = $insta::secret # pass:insta

[signature] # Signature-based protection for Insta CA
# Server authentication
trusted = insta.ca.crt # does not include keyUsage digitalSignature

# Client authentication
secret = # disable PBM
key = $insta::newkey # insta.priv.pem
cert = $insta::certout # insta.cert.pem

[ir]
cmd = ir

[cr]
cmd = cr

[kur]
# Certificate update
cmd = kur
oldcert = $insta::certout # insta.cert.pem

[rr]
# Certificate revocation
cmd = rr
oldcert = $insta::certout # insta.cert.pem

Est-ce que c'est bon ?
Ensuite il y a autre chose à faire ?

Vobul

Re : [Résolu] ElectrumSV (Python 3.10.4) sur Ubuntu 22.04: Problème OpenSSL

À priori oui c'est ça. Il n'y a plus qu'à tester !

---

Vobul
Utilisez le retour utilisable de commandes !!!
J'aime la langue française, mais je parle franglais, deal with it.
RTFM

julien.favre

Re : [Résolu] ElectrumSV (Python 3.10.4) sur Ubuntu 22.04: Problème OpenSSL

À priori oui c'est ça. Il n'y a plus qu'à tester !

Merci, j'ai fait le changement et apparemment ça a résolu le problème de support ripemd160 avec OpenSSL.
Mais maintenant il me donne un message d'erreur qui semble lié à la version de Python:

julien@julien-laptop:~/Applications/ElectrumSV-1.3.13$ ./electrum-sv
Traceback (most recent call last):
  File "/home/julien/Applications/ElectrumSV-1.3.13/./electrum-sv", line 36, in <module>
    main()
  File "/home/julien/Applications/ElectrumSV-1.3.13/electrumsv/main.py", line 417, in main
    QtAppStateProxy(config, 'qt')
  File "/home/julien/Applications/ElectrumSV-1.3.13/electrumsv/gui/qt/app_state.py", line 37, in __init__
    super().__init__(*args)
  File "/home/julien/Applications/ElectrumSV-1.3.13/electrumsv/app_state.py", line 89, in __init__
    self.async_ = ASync()
  File "/home/julien/Applications/ElectrumSV-1.3.13/electrumsv/async_.py", line 47, in __init__
    self.stop_event = self.event()
  File "/home/julien/Applications/ElectrumSV-1.3.13/electrumsv/async_.py", line 52, in event
    return Event(loop=self.loop)
  File "/usr/lib/python3.10/asyncio/locks.py", line 168, in __init__
    super().__init__(loop=loop)
  File "/usr/lib/python3.10/asyncio/mixins.py", line 17, in __init__
    raise TypeError(
TypeError: As of 3.10, the *loop* parameter was removed from Event() since it is no longer necessary
julien@julien-laptop:~/Applications/ElectrumSV-1.3.13$ 

J'ai recherché sur Internet mais je ne suis pas sûr, est-ce que descendre à Python 3.9 suffirait à résoudre le problème ?
Ou faut-il modifier le code du logiciel ?

Vobul

Re : [Résolu] ElectrumSV (Python 3.10.4) sur Ubuntu 22.04: Problème OpenSSL

C'est une application graphique ton truc ou pas ? Parce que c'est exactement pour ce genre de soucis que Docker est vraiment utile...

---

Vobul
Utilisez le retour utilisable de commandes !!!
J'aime la langue française, mais je parle franglais, deal with it.
RTFM

julien.favre

Re : [Résolu] ElectrumSV (Python 3.10.4) sur Ubuntu 22.04: Problème OpenSSL

C'est une application graphique ton truc ou pas ? Parce que c'est exactement pour ce genre de soucis que Docker est vraiment utile...

Oui, ça ressemble à ça: https://electrumsv.io

Mais parfois je l'utilise avec un hardware wallet branché sur l'USB, est-ce que ça fonctionnerait avec Docker ?
Il faut aussi que le logiciel accède au fichier wallet sur le disque dur.

Vobul

Re : [Résolu] ElectrumSV (Python 3.10.4) sur Ubuntu 22.04: Problème OpenSSL

Utilise pyenv pour gérer plusieurs versions. Et utilise les environnements virtuels pour installer les dépendences. Poetry ou Pipenv sont tes amis.

Oublie Docker pour une application graphique, c'est pas trop fait pour (même si c'est possible, c'est galère). Ça pourrait être un snap ou un flatpak ou appimage, mais ce serait plutôt au dev de fournir ça. Après tu peux en faire un et faire une PR

---

Vobul
Utilisez le retour utilisable de commandes !!!
J'aime la langue française, mais je parle franglais, deal with it.
RTFM

julien.favre

Re : [Résolu] ElectrumSV (Python 3.10.4) sur Ubuntu 22.04: Problème OpenSSL

Utilise pyenv pour gérer plusieurs versions. Et utilise les environnements virtuels pour installer les dépendences. Poetry ou Pipenv sont tes amis.

Oublie Docker pour une application graphique, c'est pas trop fait pour (même si c'est possible, c'est galère). Ça pourrait être un snap ou un flatpak ou appimage, mais ce serait plutôt au dev de fournir ça. Après tu peux en faire un et faire une PR

J'ai demandé au développeur et il m'a conseillé d’utiliser Python 3.8 pour être sûr que ça marche: https://github.com/electrumsv/electrums … 1140509626

J'ai trouvé ce tutoriel en anglais: https://realpython.com/intro-to-pyenv
Il a l'air très bien, je ne sais pas s'il contient tout ce que tu m'as conseillé. Mais je vais le suivre et voir si j'arrive à faire fonctionner tout ça.
À moins que tu en connaisses un meilleur ?

Je reviendrai ici, j'aurai peut-être des questions pour arriver à faire ça.

Merci

julien.favre

Re : [Résolu] ElectrumSV (Python 3.10.4) sur Ubuntu 22.04: Problème OpenSSL

J'ai commencé le tutoriel mais je n'arrive pas à installer le paquet python-openssl:

julien@julien-laptop:~$ sudo apt-get install -y make build-essential libssl-dev zlib1g-dev \
libbz2-dev libreadline-dev libsqlite3-dev wget curl llvm libncurses5-dev \
libncursesw5-dev xz-utils tk-dev libffi-dev liblzma-dev python-openssl
[sudo] Mot de passe de julien : 
Lecture des listes de paquets... Fait
Construction de l'arbre des dépendances... Fait
Lecture des informations d'état... Fait      
E: Impossible de trouver le paquet python-openssl
julien@julien-laptop:~$ 

J'ai fait une recherche mais je n'arrive pas à trouver comment l'installer...
Par contre je suis arrivé à installer tous les autres paquets.

Savez-vous comment l'installer ?

Dernière modification par julien.favre (Le 07/07/2022, à 18:41)

Vobul

Re : [Résolu] ElectrumSV (Python 3.10.4) sur Ubuntu 22.04: Problème OpenSSL

python3-openssl

---

Vobul
Utilisez le retour utilisable de commandes !!!
J'aime la langue française, mais je parle franglais, deal with it.
RTFM

julien.favre

Re : [Résolu] ElectrumSV (Python 3.10.4) sur Ubuntu 22.04: Problème OpenSSL

python3-openssl

Merci, apparemment ce paquet était déjà installé sur mon ordinateur.

J'ai suivi le tutoriel et c'était beaucoup plus simple que je ne le pensais.
Je suis arrivé à faire fonctionner ElectrumSV en utilisant Python 3.8.0 avec pyenv.

Merci pour tous vos conseils, ce forum est vraiment excellent, j'ai toujours trouvé des solutions avec votre aide
Bon week-end !

julien.favre

Re : [Résolu] ElectrumSV (Python 3.10.4) sur Ubuntu 22.04: Problème OpenSSL

Bonjour, une petite mise à jour concernant cette discussion.

Avec la nouvelle version d'ElectrumSV  1.3.16 (2023/05/23), le problème avec OpenSSL 3 a été résolu.
C’est décrit là avec les autres changements: https://electrumsv.io/articles/2023/ele … _3_16.html

Donc il n'y a plus besoin de modifier le fichier openssl.cnf comme décrit plus haut.
Par contre il faut toujours utiliser pyenv avec la version de Python 3.9.16 mais c'est parfaitement décrit dans les instructions d'installation ici: https://github.com/electrumsv/electrums … linuxmacos
Il est important de suivre ces instructions et non pas le README.rst dans le fichier source qui lui est incomplet.

Personnellement, j'ai maintenant Ubuntu 23.04, j'ai restauré le fichier backup de openssl.cnf ensuite j'ai suivi les instructions à la lettre et pas de problèmes

Salut et merci !