Skip to content

Conversation

@AdityaMishra3000
Copy link

Problem

On FIPS-enabled systems, importing cv2 aborts the Python process with:-

OpenSSL FIPS SELFTEST FAILURE
Aborted (core dumped)

I reproduced this for both opencv-python and opencv-python-headless.

How I reproduced it

I reproduced this on Rocky Linux with FIPS mode enabled
(/proc/sys/crypto/fips_enabled = 1) using the published Linux wheels:

python -c "import cv2"

The process aborts immediately during module import.

Inspecting the wheel shows that cv2.abi3.so is linked against a bundled
OpenSSL (opencv_python.libs/libssl*.so), which is loaded at import time and
fails OpenSSL self-tests in FIPS mode.

Root cause

The manylinux build currently builds and bundles its own OpenSSL and links
FFmpeg against it. On FIPS-enabled systems, this non-FIPS OpenSSL triggers
a self-test failure during dlopen, aborting the process before any OpenCV
code runs.

Solution

This change removes the vendored OpenSSL from the manylinux build and relies
on the system OpenSSL instead. FFmpeg is still built with OpenSSL support, but
discovery is done via system pkg-config paths.

System OpenSSL is FIPS-compliant on FIPS-enabled systems, which prevents the
abort while preserving existing functionality.

@AdityaMishra3000 AdityaMishra3000 changed the title manylinux: avoid bundling OpenSSL to fix FIPS import crash manylinux: avoid bundling OpenSSL to fix FIPS import crash, Related issue: #28456 Jan 24, 2026
@AdityaMishra3000
Copy link
Author

Related issue: opencv/opencv#28456

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant