Error while loading shared libraries: libcrypt.so.1

[sureshjoshi]

Known issue from Python Standalone (https://github.com/indygreg/python-build-standalone/issues/113) and PyOx (https://github.com/indygreg/PyOxidizer/issues/89).

Ran into this in Fedora (environment detailed below). Will try Greg's workaround tonight when I'm home.

⬢[sj@pants pants-plugins]$ ./scie-pants-linux-x86_64 
/var/home/sj/.cache/nce/cdc3a4cfddcd63b6cebdd75b14970e02d8ef0ac5be4d350e57ab5df56c19e85e/cpython-3.9.15+20221106-x86_64-unknown-linux-gnu-install_only.tar.gz/python/bin/python3.9: error while loading shared libraries: libcrypt.so.1: cannot open shared object file: No such file or directory
Error: Isolates your Pants from the elements.

Please select from the following boot commands:

<default>: Detects the current Pants installation and launches it.
bootstrap-tools: Introspection tools for the Pants bootstrap process.
pants: Runs a hermetic Pants installation.
pants-debug: Runs a hermetic Pants installation with a debug server for debugging Pants code.
update: Update scie-pants.

You can select a boot command by passing it as the 1st argument or else by setting the SCIE_BOOT environment variable.

ERROR: Failed to establish atomic directory /var/home/sj/.cache/nce/4babf95d09aea647ecb10481b524c5c2b4881e0338b465f2f2724356698955b6/locks/configure-48820e0e26193929b465ab5ca48693a932844b8082a9b529facbb28128a8ea85. Population of work directory failed: Boot binding command failed: exit status: 127

Suggestions

Since we use Python 3.9 standalone, some number of Red Hat users will run into this bug when using Pants. I'd recommend documenting this problem and linking back to Greg's documentation (https://github.com/indygreg/python-build-standalone/blob/main/docs/quirks.rst#missing-libcryptso1).

Alternatively/In addition - would it be worth checking for that missing library, and providing a clearer and/or more actionable warning on Linux?

Environment

Fedora 37 toolbox created in Fedora SilverBlue 37 host OS.

⬢[sj@pants pants-plugins]$ neofetch 
             .',;::::;,'.                sj@pants 
         .';:cccccccccccc:;,.            -------- 
      .;cccccccccccccccccccccc;.         OS: Fedora Linux 37 (Container Image) x86_64 
    .:cccccccccccccccccccccccccc:.       Host: B550I AORUS PRO AX 
  .;ccccccccccccc;.:dddl:.;ccccccc;.     Kernel: 6.0.14-300.fc37.x86_64 
 .:ccccccccccccc;OWMKOOXMWd;ccccccc:.    Uptime: 3 days, 1 hour, 8 mins 
.:ccccccccccccc;KMMc;cc;xMMc:ccccccc:.   Packages: 475 (rpm) 
,cccccccccccccc;MMM.;cc;;WW::cccccccc,   Shell: bash 5.2.9 
:cccccccccccccc;MMM.;cccccccccccccccc:   Resolution: 2560x1080 
:ccccccc;oxOOOo;MMM0OOk.;cccccccccccc:   Terminal: conmon 
cccccc:0MMKxdd:;MMMkddc.;cccccccccccc;   CPU: AMD Ryzen 7 3800X (16) @ 3.900GHz 
ccccc:XM0';cccc;MMM.;cccccccccccccccc'   GPU: NVIDIA GeForce GTX 1660 SUPER 
ccccc;MMo;ccccc;MMW.;ccccccccccccccc;    Memory: 6503MiB / 31996MiB 
ccccc;0MNc.ccc.xMMd:ccccccccccccccc;
cccccc;dNMWXXXWM0::cccccccccccccc:,                              
cccccccc;.:odl:.;cccccccccccccc:,.                               
:cccccccccccccccccccccccccccc:'.
.:cccccccccccccccccccccc:;,..
  '::cccccccccccccc::;,.

[jsirois]

Yeah, tests are definitely in play. That's in the slow path, so we can be elaborate in code to do the test. How you do that test robustly I have ~0 clues.

[sureshjoshi]

Like, CI tests? Or install-time tests?

I can think of a few kinda gross ones:

• Create a dummy object that gets linked to libcrypt - 🤢 - requires having a linker present
• Use ldconfig, which I think uses sudo (at least, on my machine it does)
• Anything else I can think of might be distro-specific

If we think the error string is a stable one, what about letting it fail and just adding a cleaner error message to the end?

Would be nicer to have that directly in PyOx or Standalone, but 🤷🏽

The only way I could imagine the error string not being stable is if Greg decided to suppress the output of the error for some reason, which seems unlikely.

[sureshjoshi]

Note: Might also be a problem for Arch-ers? https://unix.stackexchange.com/questions/691479/how-to-deal-with-missing-libcrypt-so-1-on-arch-linux

[sureshjoshi]

And to no-one's surprise, Greg's suggested workaround works: sudo dnf install libxcrypt-compat

[jsirois]

I mean install time tests, as I think you meant. Install is the slow path and it's ok to be slow and potentially complex there.

[jsirois]

And yes, it's a problem for Arch. Despite my current Windows stint to bring Windows support to Pex, I'm a long time Arch user (2003+). It's rolling bleeding edge and tends not to have old libs installed by default. PyOx gave me issues last I tried it on arch w/o installing a back compat package.

[jsirois]

@sureshjoshi, ldd python should actually do it. I think ldd is pervasive and it does not require root.

[sureshjoshi]

Didn't even think of ldd, I always just assumed it came down with build essentials or whatever, but nope - it's there in my containers.

I think ldd comes with libc/glibc?

musl has that functionality built-in if memory serves, so I wonder how alpine would work out? Not that alpine should be a deal breaker, just typing out loud.

[sureshjoshi]

From: https://wiki.musl-libc.org/faq.html

musl’s dynamic linker comes with ldd functionality built in. Just create a symlink from ld-musl-$ARCH.so to /bin/ldd. If the dynamic linker was started as “ldd”, it will detect that and print the appropriate DSO information.

[jsirois]

There currently is no scie-pants for Alpine (scie-pants itself is musl libc static, but no musl PBS CPython is configured).

[jsirois]

Maybe you could add that support?

[jsirois]

So, this was nominally fixed by @kaos in #311: https://github.com/pantsbuild/scie-pants/blob/3497f4cac1e1b93f9122c9160a153802762255ae/package/scie-pants.toml#L17-L29

But that upgrade only worked for science - which uses 3.11 from that release - 3.8 and 3.9 are still broken: https://github.com/indygreg/python-build-standalone/issues/197. That was fixed by this release though: https://github.com/indygreg/python-build-standalone/releases/tag/20240107; so scie-pants should likely upgrade.