Auto-upgrade of libopenssl fails when moving from version 1.1.1 to 3.0.x

[spillner]

Description:

Older versions of libopenssl do not support the TLS validation now running on https://bin.entware.net. This causes opkg upgrade libopenssl to fail. If the user runs opkg upgrade while both libopenssl and wget are marked as superseded, wget will be replaced with a version linked against libopenssl.so.3 even though libopenssl is not upgraded. This leaves wget in an unusable state, which complicates the use of opkg for further system repair.

To reproduce:

1. On a system with libopenssl at a pre-3.0 version, run opkg update
2. Run opkg upgrade
3. Observe that most packages, including wget, update normally, but libopenssl fails with an error like:

Upgrading libopenssl on root from 1.1.1n-1 to 3.0.8-9...
Downloading https://bin.entware.net/armv7sf-k3.2/libopenssl_3.0.8-9_armv7-3.2.ipk
wget: note: TLS certificate validation not implemented
wget: TLS error from peer (alert code 80): 80
wget: error getting response: Connection reset by peer

4. After the rest of the upgrade completes, observe the error messages

Collected errors:

• opkg_download: Failed to download https://bin.entware.net/armv7sf-k3.2/libopenssl_3.0.8-9_armv7-3.2.ipk, wget returned 1.
• opkg_install_pkg: Failed to download libopenssl. Perhaps you need to run 'opkg update'?

5. Run wget, or opkg commands that would invoke wget, and observe

wget: error while loading shared libraries: libssl.so.3: cannot open shared object file: No such file or directory

Expected behavior

Any failure to upgrade libopenssl should inhibit the upgrade of wget or other key packages that depend on libopenssl.

Steps to repair

1. Download https://bin.entware.net/armv7sf-k3.2/libopenssl_3.0.8-9_armv7-3.2.ipk
2. Download https://bin.entware.net/armv7sf-k3.2/libatomic_8.4.0-11_armv7-3.2.ipk
3. Unpack both of these packages and copy the included libraries into /opt/lib
4. Run wget to verify all shared library errors have been resolved.
5. Verify you have no other key software depending on libopenssl 1.x
6. Run opkg upgrade libatomic libopenssl to fully update the package database and remove the older versions

Device information

Remarkable 2, running kernel 5.4.70-v1.1.5-rm11x, opkg version d038e5b6d155784575f62a66a8bb7e874173e92e (2022-02-24).

[Eeems]

Duplicates #674