Bug: SAM build fails with a broken openssl dependency after upgrading to Fedora 43

[twistypigeon]

Description:

An OpenSSL dependency is broken after upgrading to Fedora 43 when using the latest AWS SAM CLI version (1.151.0)

Steps to reproduce:

1. Upgrade from Fedora 42 to Fedora 43
2. Execute sam build in a NodeJS project

Observed result:

2026-01-02 10:12:46,957 | Building codeuri: /home/<user>/git/<project>/src runtime: nodejs24.x architecture: arm64 functions: DocumentProductionLambda          
2026-01-02 10:12:46,958 | Building to following folder /home/<user>/git/<project>/.aws-sam/build/Lambda                                       
2026-01-02 10:12:46,958 | Loading workflow module 'aws_lambda_builders.workflows'                                                                                                             
...               
2026-01-02 10:12:46,969 | npm installation actions install only production dependencies. Dev dependencies are omitted from the Lambda artifacts package                                       
2026-01-02 10:12:46,969 | Running workflow 'NodejsNpmBuilder'                                                                                                                                 
2026-01-02 10:12:46,970 |  Running NodejsNpmBuilder:NpmPack                                                                                                                                   
2026-01-02 10:12:46,970 | NODEJS packaging file:/home/<user>/git/<project>/src to /tmp/tmpff1uuq0k                                                              
2026-01-02 10:12:46,970 | executing NPM: ['npm', 'pack', '-q', 'file:/home/<user>/git/<project>/src']                                                           
2026-01-02 10:12:46,972 | NodejsNpmBuilder:NpmPack failed                                                                                                                                     
Traceback (most recent call last):                                                                                                                                                            
  File "aws_lambda_builders/workflows/nodejs_npm/actions.py", line 61, in execute                                                                                                             
  File "aws_lambda_builders/workflows/nodejs_npm/npm.py", line 72, in run                                                                                                                     
aws_lambda_builders.workflows.nodejs_npm.exceptions.NpmExecutionError: NPM Failed: /usr/bin/node-22: /usr/local/aws-sam-cli/1.151.0/dist/_internal/libcrypto.so.3: version `OPENSSL_3.4.0' not
found (required by /lib64/libnode.so.127)                                                                                                                                                     
                                                                                                                                                                                              
During handling of the above exception, another exception occurred:                                                                                                                           
                                                                                                                                                                                              
Traceback (most recent call last):                                                                                                                                                            
  File "aws_lambda_builders/workflow.py", line 374, in run                                                                                                                                    
  File "aws_lambda_builders/workflows/nodejs_npm/actions.py", line 72, in execute                                                                                                             
aws_lambda_builders.actions.ActionFailedError: NPM Failed: /usr/bin/node-22: /usr/local/aws-sam-cli/1.151.0/dist/_internal/libcrypto.so.3: version `OPENSSL_3.4.0' not found (required by     
/lib64/libnode.so.127)                                                                                                                                                                        

Build Failed

Expected result:

build should have completed normally as it did on Fedora 42

Additional environment details (Ex: Windows, Mac, Amazon Linux etc)

{
  "version": "1.151.0",
  "system": {
    "python": "3.11.10",
    "os": "Linux-6.17.12-300.fc43.x86_64-x86_64-with-glibc2.42"
  },
  "additional_dependencies": {
    "container_engine": "Docker(v29.1.3)",
    "aws_cdk": "Not available",
    "terraform": "Not available"
  },
  "available_beta_feature_env_vars": [
    "SAM_CLI_BETA_FEATURES",
    "SAM_CLI_BETA_BUILD_PERFORMANCE",
    "SAM_CLI_BETA_TERRAFORM_SUPPORT",
    "SAM_CLI_BETA_PACKAGE_PERFORMANCE",
    "SAM_CLI_BETA_RUST_CARGO_LAMBDA"
  ]
}

[twistypigeon]

Renaming the internal dependencies so that the system openssl install is used is a workaround but not ideal.

mv /usr/local/aws-sam-cli/1.151.0/dist/_internal/libssl.so.3 /usr/local/aws-sam-cli/1.151.0/dist/_internal/libssl.so.3.bak
mv /usr/local/aws-sam-cli/1.151.0/dist/_internal/libcrypto.so.3 /usr/local/aws-sam-cli/1.151.0/dist/_internal/libcrypto.so.3.bak

[bnusunny]

Thanks for reporting this issue!

The SAM CLI native installer (PyInstaller-based) bundles its own OpenSSL library. Looking at build-linux.sh, the bundled version is OpenSSL 3.3.3:

if [ "$openssl_version" = "" ]; then
    openssl_version="3.3.3";
fi

When SAM CLI spawns subprocesses like npm, the bundled libcrypto.so.3 gets picked up via the library path. However, Fedora 43 ships with OpenSSL 3.4.x, and Node.js on your system is linked against it, requiring OPENSSL_3.4.0 symbols that don't exist in the bundled 3.3.3 library.

Workaround:

Install SAM CLI via pip instead of the native installer:

pip install aws-sam-cli

This avoids the bundled OpenSSL entirely and uses your system's libraries.

Potential Fix:

Updating the bundled OpenSSL version to 3.4.x in the build script should resolve this for Fedora 43 users. However, a more robust long-term solution might be to isolate the library paths when spawning external processes so they use system libraries rather than the bundled ones.

[dcabib]

Hey team! 👋

I've been looking into this Fedora 43 OpenSSL issue and I think I can help fix it. Let me break down what I found:

The Problem

SAM CLI's native installer bundles OpenSSL 3.3.3 (hardcoded in build-linux.sh), but Fedora 43 ships with OpenSSL 3.4.x. When SAM spawns Node.js as a subprocess, Node tries to use OPENSSL_3.4.0 symbols from the bundled lib, but they don't exist → build fails.

Root Cause

File: installer/pyinstaller/build-linux.sh (lines 18-19)

if [ "$openssl_version" = "" ]; then
    openssl_version="3.3.3";  # ← This is the issue
fi

The build process downloads OpenSSL from GitHub, compiles it, and bundles it into the PyInstaller binary. The version is hardcoded here.

Proposed Solution

Update to OpenSSL 3.4.1 (or latest 3.4.x):

if [ "$openssl_version" = "" ]; then
    openssl_version="3.4.1";  # ← Simple fix
fi

Bonus: Also update macOS build which is lagging behind at 3.3.1 (build-mac.sh line 33).

Testing Strategy

Since there was a critical fix in October 2024 (commit 62ea5de) related to subprocess.check_output with OpenSSL 3.3.1, we need to validate no regressions:

1. ✅ Build completes successfully with 3.4.x
2. ✅ Test on Fedora 43 (original issue)
3. ✅ Test on Amazon Linux 2 (primary target, backward compat)
4. ✅ Test on Ubuntu 22.04 & Rocky Linux 9
5. ✅ Verify subprocess operations still work (regression test)
6. ✅ Confirm boto3 SSL/TLS connections work
7. ✅ Validate cryptography/PyOpenSSL compatibility

Why This Should Be Safe

• OpenSSL 3.4.x is a stable release line
• SAM CLI bundles OpenSSL in the binary (RPATH), so it won't break older distros
• The build script already supports version override as 6th parameter (can test before committing)
• Python 3.11.10 compiles fine with OpenSSL 3.4.x

My Offer

I'm happy to implement this fix and submit a PR with the necessary testing. The change itself is trivial (literally one line), but I'll make sure to validate it across multiple distributions to avoid any surprises.

Let me know if this approach sounds good or if you'd prefer a different strategy (e.g., platform-specific builds, library path isolation, etc.).

cc @bnusunny since you've been looking into this

[bnusunny]

@dcabib I would recommend to implement the long term solution to isolate the library paths when spawning external processes so they use system libraries rather than the bundled ones.

[dcabib]

I've submitted a PR that implements the long-term solution suggested by @bnusunny - isolating library paths when spawning subprocesses.

PR: #8628

The implementation:

• Detects PyInstaller bundle via sys._MEIPASS
• Filters LD_LIBRARY_PATH/DYLD_LIBRARY_PATH to remove bundled paths early in CLI initialization
• Ensures external processes (npm, node, pip, etc.) use system libraries

This should resolve the OpenSSL version mismatch issue on Fedora 43+ where the system ships OpenSSL 3.4.x but the bundled SAM CLI has 3.3.x.