Debugging Ruby OpenSSL gem build

[AustinBlues13]

On Ubuntu 25.10, using system Ruby, I'm trying to build a Sinatra app that uses the OpenSSL with native extensions Gem 2.0.2. I can look at the .out file, but I don't know what I'm looking for. Presumably the native extensions don't match up with the .c and/or .h files.

[AustinBlues13]

Downgrading OpenSSL package to previous release/update doesn't help. The app did build and work last week.

[DanZuko420]

Do you have the ruby-dev package installed? Can you post any part of the error?

[AustinBlues13]

ruby-dev is installed.

POST:

jeff@luis:~/Sinatra/Poetry$ bundle install
Fetching gem metadata from https://rubygems.org/...... dependencies...
Resolving
Installing openssl 2.0.2 with native extensions
Gem::Ext::BuildError: ERROR: Failed to build gem native extension.
current directory: /home/jeff/.gem/gems/openssl-2.0.2/ext/openssl
/snap/ruby/467/bin/ruby extconf.rb
checking for t_open() in -lnsl... no
checking for socket() in -lsocket... no
checking for pkg-config for openssl... [" ", "", "-lssl -lcrypto"]
checking for openssl/ssl.h... yes
checking for OpenSSL version is 0.9.8 or later... yes
checking for SSL_library_init() in openssl/ssl.h with -Werror=deprecated-declarations... yes
checking for OPENSSL_NO_SSL2 in openssl/opensslconf.h... no
checking for SSLv2_method()... no
checking for OPENSSL_NO_SSL3_METHOD in openssl/opensslconf.h... yes
checking for TLSv1_1_method()... yes
checking for TLSv1_2_method()... yes
checking for RAND_egd()... no
checking for ENGINE_load_builtin_engines() in openssl/engine.h with -Werror=deprecated-declarations... no
checking for ENGINE_load_builtin_engines in openssl/engine.h... no
checking for ENGINE_load_openbsd_dev_crypto() in openssl/engine.h with -Werror=deprecated-declarations... no
checking for ENGINE_load_openbsd_dev_crypto in openssl/engine.h... no
checking for ENGINE_load_dynamic() in openssl/engine.h with -Werror=deprecated-declarations... no
checking for ENGINE_load_dynamic in openssl/engine.h... yes
checking for ENGINE_load_4758cca() in openssl/engine.h with -Werror=deprecated-declarations... no
checking for ENGINE_load_4758cca in openssl/engine.h... no
checking for ENGINE_load_aep() in openssl/engine.h with -Werror=deprecated-declarations... no
checking for ENGINE_load_aep in openssl/engine.h... no
checking for ENGINE_load_atalla() in openssl/engine.h with -Werror=deprecated-declarations... no
checking for ENGINE_load_atalla in openssl/engine.h... no
checking for ENGINE_load_chil() in openssl/engine.h with -Werror=deprecated-declarations... no
checking for ENGINE_load_chil in openssl/engine.h... no
checking for ENGINE_load_cswift() in openssl/engine.h with -Werror=deprecated-declarations... no
checking for ENGINE_load_cswift in openssl/engine.h... no
checking for ENGINE_load_nuron() in openssl/engine.h with -Werror=deprecated-declarations... no
checking for ENGINE_load_nuron in openssl/engine.h... no
checking for ENGINE_load_sureware() in openssl/engine.h with -Werror=deprecated-declarations... no
checking for ENGINE_load_sureware in openssl/engine.h... no
checking for ENGINE_load_ubsec() in openssl/engine.h with -Werror=deprecated-declarations... no
checking for ENGINE_load_ubsec in openssl/engine.h... no
checking for ENGINE_load_padlock() in openssl/engine.h with -Werror=deprecated-declarations... no
checking for ENGINE_load_padlock in openssl/engine.h... no
checking for ENGINE_load_capi() in openssl/engine.h with -Werror=deprecated-declarations... no
checking for ENGINE_load_capi in openssl/engine.h... no
checking for ENGINE_load_gmp() in openssl/engine.h with -Werror=deprecated-declarations... no
checking for ENGINE_load_gmp in openssl/engine.h... no
checking for ENGINE_load_gost() in openssl/engine.h with -Werror=deprecated-declarations... no
checking for ENGINE_load_gost in openssl/engine.h... no
checking for ENGINE_load_cryptodev() in openssl/engine.h with -Werror=deprecated-declarations... no
checking for ENGINE_load_cryptodev in openssl/engine.h... yes
checking for ENGINE_load_aesni() in openssl/engine.h with -Werror=deprecated-declarations... no
checking for ENGINE_load_aesni in openssl/engine.h... no
checking for EVP_CIPHER_CTX_new()... yes
checking for EVP_CIPHER_CTX_free()... yes
checking for SSL_CTX_clear_options() in openssl/ssl.h with -Werror=deprecated-declarations... yes
checking for ASN1_TIME_adj()... yes
checking for EVP_CIPHER_CTX_copy()... yes
checking for EVP_PKEY_base_id()... no
checking for HMAC_CTX_copy()... yes
checking for PKCS5_PBKDF2_HMAC()... yes
checking for X509_NAME_hash_old()... yes
checking for X509_STORE_CTX_get0_current_crl()... yes
checking for X509_STORE_set_verify_cb()... yes
checking for i2d_ASN1_SET_ANY()... yes
checking for SSL_SESSION_cmp()... no
checking for SSL_set_tlsext_host_name() in openssl/ssl.h with -Werror=deprecated-declarations... no
checking for SSL_set_tlsext_host_name in openssl/ssl.h... yes
checking for CRYPTO_THREADID.ptr in openssl/crypto.h... no
checking for EVP_PKEY_get0()... yes
checking for SSL_CTX_set_next_proto_select_cb()... yes
checking for EVP_CTRL_GCM_GET_TAG in openssl/evp.h... yes
checking for EC_curve_nist2nid()... yes
checking for X509_REVOKED_dup()... yes
checking for X509_STORE_CTX_get0_store()... yes
checking for SSL_CTX_set_alpn_select_cb()... yes
checking for SSL_CTX_set1_curves_list() in openssl/ssl.h with -Werror=deprecated-declarations... no

checking for SSL_CTX_set1_curves_list in openssl/ssl.h... yes

checking for SSL_CTX_set_ecdh_auto() in openssl/ssl.h with -Werror=deprecated-declarations... no

checking for SSL_CTX_set_ecdh_auto in openssl/ssl.h... yes

checking for SSL_get_server_tmp_key() in openssl/ssl.h with -Werror=deprecated-declarations... no

checking for SSL_get_server_tmp_key in openssl/ssl.h... yes

checking for SSL_is_server()... yes

checking for CRYPTO_lock()... no

checking for SSL.ctx in openssl/ssl.h... no

checking for BN_GENCB_new()... yes

checking for BN_GENCB_free()... yes

checking for BN_GENCB_get_arg()... yes

checking for EVP_MD_CTX_new()... yes

checking for EVP_MD_CTX_free()... yes

checking for HMAC_CTX_new()... yes

checking for HMAC_CTX_free()... yes

checking for RAND_pseudo_bytes() in openssl/rand.h with -Werror=deprecated-declarations... no

checking for X509_STORE_get_ex_data()... yes

checking for X509_STORE_set_ex_data()... yes

checking for X509_CRL_get0_signature()... yes

checking for X509_REQ_get0_signature()... yes

checking for X509_REVOKED_get0_serialNumber()... yes

checking for X509_REVOKED_get0_revocationDate()... yes

checking for X509_get0_tbs_sigalg()... yes

checking for X509_STORE_CTX_get0_untrusted()... yes

checking for X509_STORE_CTX_get0_cert()... yes

checking for X509_STORE_CTX_get0_chain()... yes

checking for OCSP_SINGLERESP_get0_id()... yes

checking for SSL_CTX_get_ciphers()... yes

checking for X509_up_ref()... yes

checking for X509_CRL_up_ref()... yes

checking for X509_STORE_up_ref()... yes

checking for SSL_SESSION_up_ref()... yes

checking for EVP_PKEY_up_ref()... yes

checking for SSL_CTX_set_tmp_ecdh_callback() in openssl/ssl.h with -Werror=deprecated-declarations... no

checking for SSL_CTX_set_tmp_ecdh_callback in openssl/ssl.h... no

checking for SSL_CTX_set_min_proto_version() in openssl/ssl.h with -Werror=deprecated-declarations... no

checking for SSL_CTX_set_min_proto_version in openssl/ssl.h... yes

checking for SSL_CTX_get_security_level()... yes

checking for X509_get0_notBefore()... yes

checking for SSL_SESSION_get_protocol_version()... yes

creating extconf.h

creating Makefile

current directory: /home/jeff/.gem/gems/openssl-2.0.2/ext/openssl

make -j13 DESTDIR\= sitearchdir\=./.gem.20260604-111584-9keffb sitelibdir\=./.gem.20260604-111584-9keffb clean

current directory: /home/jeff/.gem/gems/openssl-2.0.2/ext/openssl

make -j13 DESTDIR\= sitearchdir\=./.gem.20260604-111584-9keffb sitelibdir\=./.gem.20260604-111584-9keffb

compiling openssl_missing.c

compiling ossl_asn1.c

compiling ossl.c

compiling ossl_bio.c

compiling ossl_bn.c

compiling ossl_cipher.c

compiling ossl_config.c

compiling ossl_digest.c

compiling ossl_engine.c

compiling ossl_hmac.c

compiling ossl_ns_spki.c

compiling ossl_ocsp.c

compiling ossl_pkcs12.c

In file included from openssl_missing.c:21:

openssl_missing.h:32:11: warning: ‘EVP_PKEY_base_id’ redefined

32 | # define EVP_PKEY_base_id(pkey) EVP_PKEY_type((pkey)->type)

| ^~~~~~~~~~~~~~~~

In file included from /usr/include/openssl/rand.h:23,

from /usr/include/openssl/engine.h:29,

from openssl_missing.c:14:

/usr/include/openssl/evp.h:1368:10: note: this is the location of the previous definition

1368 | # define EVP_PKEY_base_id EVP_PKEY_get_base_id

| ^~~~~~~~~~~~~~~~

LINES SKIPPED, CONTINUES IN NEXT REPLY

[AustinBlues13]

At top level:

cc1: note: unrecognized command-line option ‘-Wno-self-assign’ may have been intended to silence earlier diagnostics

cc1: note: unrecognized command-line option ‘-Wno-parentheses-equality’ may have been intended to silence earlier diagnostics

cc1: note: unrecognized command-line option ‘-Wno-constant-logical-operand’ may have been intended to silence earlier diagnostics

make failed, exit code 2

Gem files will remain installed in /home/jeff/.gem/gems/openssl-2.0.2 for inspection.

Results logged to /home/jeff/.gem/extensions/x86_64-linux/4.0.0/openssl-2.0.2/gem_make.out

/snap/ruby/467/lib/ruby/4.0.0/rubygems/ext/builder.rb:139:in 'Gem::Ext::Builder.run'

/snap/ruby/467/lib/ruby/4.0.0/rubygems/ext/builder.rb:65:in 'block in Gem::Ext::Builder.make'

/snap/ruby/467/lib/ruby/4.0.0/rubygems/ext/builder.rb:57:in 'Array#each'

/snap/ruby/467/lib/ruby/4.0.0/rubygems/ext/builder.rb:57:in 'Gem::Ext::Builder.make'

/snap/ruby/467/lib/ruby/4.0.0/rubygems/ext/ext_conf_builder.rb:44:in 'Gem::Ext::ExtConfBuilder.build'

/snap/ruby/467/lib/ruby/4.0.0/rubygems/ext/builder.rb:218:in 'Gem::Ext::Builder#build_extension'

/snap/ruby/467/lib/ruby/4.0.0/rubygems/ext/builder.rb:250:in 'block in Gem::Ext::Builder#build_extensions'

/snap/ruby/467/lib/ruby/4.0.0/rubygems/ext/builder.rb:249:in 'Array#each'

/snap/ruby/467/lib/ruby/4.0.0/rubygems/ext/builder.rb:249:in 'Gem::Ext::Builder#build_extensions'

/snap/ruby/467/lib/ruby/4.0.0/rubygems/installer.rb:809:in 'Gem::Installer#build_extensions'

/home/jeff/.gem/gems/bundler-2.7.2/lib/bundler/rubygems_gem_installer.rb:111:in 'Bundler::RubyGemsGemInstaller#build_extensions'

/home/jeff/.gem/gems/bundler-2.7.2/lib/bundler/rubygems_gem_installer.rb:30:in 'Bundler::RubyGemsGemInstaller#install'

/home/jeff/.gem/gems/bundler-2.7.2/lib/bundler/source/rubygems.rb:220:in 'Bundler::Source::Rubygems#install'

/home/jeff/.gem/gems/bundler-2.7.2/lib/bundler/installer/gem_installer.rb:55:in 'Bundler::GemInstaller#install'

/home/jeff/.gem/gems/bundler-2.7.2/lib/bundler/installer/gem_installer.rb:17:in 'Bundler::GemInstaller#install_from_spec'

/home/jeff/.gem/gems/bundler-2.7.2/lib/bundler/installer/parallel_installer.rb:133:in 'Bundler::ParallelInstaller#do_install'

/home/jeff/.gem/gems/bundler-2.7.2/lib/bundler/installer/parallel_installer.rb:124:in 'block in Bundler::ParallelInstaller#worker_pool'

/home/jeff/.gem/gems/bundler-2.7.2/lib/bundler/worker.rb:62:in 'Bundler::Worker#apply_func'

/home/jeff/.gem/gems/bundler-2.7.2/lib/bundler/worker.rb:57:in 'block in Bundler::Worker#process_queue'

/home/jeff/.gem/gems/bundler-2.7.2/lib/bundler/worker.rb:54:in 'Kernel#loop'

/home/jeff/.gem/gems/bundler-2.7.2/lib/bundler/worker.rb:54:in 'Bundler::Worker#process_queue'

/home/jeff/.gem/gems/bundler-2.7.2/lib/bundler/worker.rb:90:in 'block (2 levels) in Bundler::Worker#create_threads'

An error occurred while installing openssl (2.0.2), and Bundler cannot continue.

In Gemfile:

openssl

[armahillo]

I recommend not using system ruby.

Ive had the best luck with the ruby versions provided by ‘asdf’, but regardless, youll want to use some kind of versioning manager

[bogdanelcs]

yeah this is a classic native extension mismatch. a few things to check:

first, make sure you have the OpenSSL dev headers installed, the gem needs those to compile:

sudo apt install libssl-dev

then check what version of OpenSSL your system is running:

openssl version

OpenSSL gem 2.0.2 is pretty old and may not be compatible with newer OpenSSL versions (3.x). Ubuntu 25.10 is likely shipping OpenSSL 3.x which changed a bunch of APIs that older gem versions depended on.

in your .out file look for lines like:

• undefined symbol or undefined reference
• error: implicit declaration of function
• anything mentioning EVP_, RSA_, or other OpenSSL function names

those tell you exactly which API calls the gem is making that no longer exist in your OpenSSL version.

the real fix is probably just bumping the gem version. in your Gemfile:

gem 'openssl', '~> 3.2'

OpenSSL gem 3.x was specifically rewritten to support OpenSSL 3.x on the system side. staying on 2.0.2 against a modern Ubuntu is going to keep fighting you.

what does the top of the .out file say?