Install rust failed with openssl errors

[hoverwinter]

Verification

• I searched for recent similar issues at https://github.com/rust-lang/rustup/issues?q=is%3Aissue+is%3Aopen%2Cclosed and found no duplicates.
• I am on the latest version of Rustup according to https://github.com/rust-lang/rustup/tags and am still able to reproduce my issue.

Problem

curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh

info: downloading installer
Auto configuration failed
8454617792:error:02FFF001:system library:func(4095):Operation not permitted:/AppleInternal/Library/BuildRoots/ce725a5f-c761-11ee-a4ec-b6ef2fd8d87b/Library/Caches/com.apple.xbs/Sources/libressl/libressl-3.3/crypto/bio/bss_file.c:122:fopen('/private/etc/ssl/openssl.cnf', 'rb')
8454617792:error:20FFF002:BIO routines:CRYPTO_internal:system lib:/AppleInternal/Library/BuildRoots/ce725a5f-c761-11ee-a4ec-b6ef2fd8d87b/Library/Caches/com.apple.xbs/Sources/libressl/libressl-3.3/crypto/bio/bss_file.c:127:
8454617792:error:0EFFF002:configuration file routines:CRYPTO_internal:system lib:/AppleInternal/Library/BuildRoots/ce725a5f-c761-11ee-a4ec-b6ef2fd8d87b/Library/Caches/com.apple.xbs/Sources/libressl/libressl-3.3/crypto/conf/conf_def.c:202:

Steps

Just use script on mac

Possible Solution(s)

No response

Notes

No response

Rustup version

*

Installed toolchains

*

OS version

Apple M3 Pro
macOS 14.4.1 23E224

[djc]

What does which curl say, and curl -V? It looks like your curl is using libressl, which definitely seems non-standard? My curl (on macOS 14.5) is /usr/bin/curl which seems to use SecureTransport.

[5101good]

installed already, when i run rustup, same error showup:
Auto configuration failed 8573795008:error:02FFF001:system library:func(4095):Operation not permitted:/AppleInternal/Library/BuildRoots/ce725a5f-c761-11ee-a4ec-b6ef2fd8d87b/Library/Caches/com.apple.xbs/Sources/libressl/libressl-3.3/crypto/bio/bss_file.c:122:fopen('/private/etc/ssl/openssl.cnf', 'rb') 8573795008:error:20FFF002:BIO routines:CRYPTO_internal:system lib:/AppleInternal/Library/BuildRoots/ce725a5f-c761-11ee-a4ec-b6ef2fd8d87b/Library/Caches/com.apple.xbs/Sources/libressl/libressl-3.3/crypto/bio/bss_file.c:127: 8573795008:error:0EFFF002:configuration file routines:CRYPTO_internal:system lib:/AppleInternal/Library/BuildRoots/ce725a5f-c761-11ee-a4ec-b6ef2fd8d87b/Library/Caches/com.apple.xbs/Sources/libressl/libressl-3.3/crypto/conf/conf_def.c:202:

[rami3l]

installed already, when i run rustup, same error showup: Auto configuration failed 8573795008:error:02FFF001:system library:func(4095):Operation not permitted:/AppleInternal/Library/BuildRoots/ce725a5f-c761-11ee-a4ec-b6ef2fd8d87b/Library/Caches/com.apple.xbs/Sources/libressl/libressl-3.3/crypto/bio/bss_file.c:122:fopen('/private/etc/ssl/openssl.cnf', 'rb') 8573795008:error:20FFF002:BIO routines:CRYPTO_internal:system lib:/AppleInternal/Library/BuildRoots/ce725a5f-c761-11ee-a4ec-b6ef2fd8d87b/Library/Caches/com.apple.xbs/Sources/libressl/libressl-3.3/crypto/bio/bss_file.c:127: 8573795008:error:0EFFF002:configuration file routines:CRYPTO_internal:system lib:/AppleInternal/Library/BuildRoots/ce725a5f-c761-11ee-a4ec-b6ef2fd8d87b/Library/Caches/com.apple.xbs/Sources/libressl/libressl-3.3/crypto/conf/conf_def.c:202:

@5101good I believe you're not using the system-provided curl distribution. What does which curl give on your machine?

[5101good]

OS version
Apple M3 Pro
macOS 14.4.1 23E224
I am upgrading macOS to 15.0.1, I will update its effect later.

[5101good]

installed already, when i run rustup, same error showup: Auto configuration failed 8573795008:error:02FFF001:system library:func(4095):Operation not permitted:/AppleInternal/Library/BuildRoots/ce725a5f-c761-11ee-a4ec-b6ef2fd8d87b/Library/Caches/com.apple.xbs/Sources/libressl/libressl-3.3/crypto/bio/bss_file.c:122:fopen('/private/etc/ssl/openssl.cnf', 'rb') 8573795008:error:20FFF002:BIO routines:CRYPTO_internal:system lib:/AppleInternal/Library/BuildRoots/ce725a5f-c761-11ee-a4ec-b6ef2fd8d87b/Library/Caches/com.apple.xbs/Sources/libressl/libressl-3.3/crypto/bio/bss_file.c:127: 8573795008:error:0EFFF002:configuration file routines:CRYPTO_internal:system lib:/AppleInternal/Library/BuildRoots/ce725a5f-c761-11ee-a4ec-b6ef2fd8d87b/Library/Caches/com.apple.xbs/Sources/libressl/libressl-3.3/crypto/conf/conf_def.c:202:

@5101good I believe you're not using the system-provided curl distribution. What does which curl give on your machine?

I consulted chatGPT, and on macOS, curl is configured to use ressl by default under Apple's settings. But this is not the issue; I don't know why those configuration files cannot be read.

[rami3l]

But this is not the issue; I don't know why those configuration files cannot be read.

@5101good I hear you. Indeed, /usr/bin/curl is the official distribution, but I still believe there's more to this issue.

How about setting OPENSSL_CONF=/etc/ssl when running the script? Since your cURL distribution's LibreSSL is (regardless of it being bundled or not) configured to read from /private/etc/ssl/ and failed, I doubt it's not in its default state.

Here's my wild guess: a certain .pkg you've installed has modified this state without you even knowing it...

Possibly related:

• Auto configuration failed ariya/phantomjs#15449

[rami3l]

To clarify, /private/etc/ssl is the default config path for the bundled LibreSSL on macOS:

> /usr/bin/openssl version -d
OPENSSLDIR: "/private/etc/ssl"

... but open() with "rb" shouldn't fail since it's on .rw-r--r--@ by default:

> eza -lah /private/etc/ssl
Permissions Size User Date Modified Name
.rw-r--r--@ 333k root  1 Oct 12:10  cert.pem
drwxr-xr-x     - root  1 Oct 12:10  certs
.rw-r--r--@  745 root  1 Oct 12:10  openssl.cnf
.rw-r--r--@ 1.0k root  1 Oct 12:10  x509v3.cnf

[5101good]

thanks for your help. My config options are same with you, but still has this issue.

[5101good]

good news, when i upgrade macOS to V15, still fail. Then a popup window remind me update cmd line tools, when update complete, rustup can start normal now. I cannot make sure its apple's compatibility or some mistake i did before. Hope this information is useful to others who come across

[5101good]

I am finally stepping into the world of Rust now😂

[rami3l]

good news, when i upgrade macOS to V15, still fail. Then a popup window remind me update cmd line tools, when update complete, rustup can start normal now. I cannot make sure its apple's compatibility or some mistake i did before. Hope this information is useful to others who come across

Nice to hear! So it sounds like the solution is to install Xcode Command Line Tools?

Anyway, it looks like I can safely close this issue now, as I'm certain it has something to do with macOS' state rather than our codebase. Thanks a lot for sharing @5101good!

[sukhmel]

I'm experiencing the same issue when installing it with Nix and there is no xcode update pending, but I will try to reinstall it then

Update 1: looks like this was because I had xcode that was too fresh, I followed the instructions to get all available versions:

    xclt_tmp="/tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress"
    /usr/bin/touch "${xclt_tmp}"
    softwareupdate --list --all
    softwareupdate -i "Command Line Tools for Xcode-15.3" # from the output of the previous line

I only checked clang version but it changed down, so I assume, everything else was downgraded, too. My machine is managed by centralised policy, and this seems to confuse Xcode, as this is not the first time something breaks because the installed SDK or something else related to cmd line tools is for the next OS version

Update 2: still same error, just after longer, that's why I thought it was fixed.

Update 3: looks like it's same as nix-community/fenix#178, which is likely same as oxalica/rust-overlay#149 but the latter should've been fixed at the start of the year

Update 4: in case anyone will stumble upon it, I was unable to solve it, and worked around by disabling sandboxing --option sandbox false

Update 5: after I successfully switched generation, I tried to turn sandbox back on and it works. Maybe it is because of how sandboxing is implemented, or maybe it was because of some garbage uncollected.