Percona xtrabackup libgcrypt error: integrity check failed: checksum error

1

Dear Experts

When xtradb cluster(8.4.6) instance starts up , which is part of systemd auto startup I see following errors

Jun 18 19:19:22 vm2rhel96 xtrabackup[3121]: Libgcrypt error: integrity check failed: Checksum error
Jun 18 19:19:22 vm2rhel96 xtrabackup[3121]: Libgcrypt notice: state transition Self-Test => Error
Jun 18 19:19:22 vm2rhel96 xtrabackup[3476]: Libgcrypt error: integrity check failed: Checksum error
Jun 18 19:19:22 vm2rhel96 xtrabackup[3476]: Libgcrypt notice: state transition Self-Test => Error
Jun 18 19:19:22 vm2rhel96 xtrabackup[3478]: Libgcrypt error: integrity check failed: Checksum error
Jun 18 19:19:22 vm2rhel96 xtrabackup[3478]: Libgcrypt notice: state transition Self-Test => Error
Jun 18 19:19:22 vm2rhel96 xtrabackup[3481]: Libgcrypt error: integrity check failed: Checksum error
Jun 18 19:19:22 vm2rhel96 xtrabackup[3481]: Libgcrypt notice: state transition Self-Test => Error
Jun 18 19:19:22 vm2rhel96 xbstream[3500]: Libgcrypt error: integrity check failed: Checksum error
Jun 18 19:19:22 vm2rhel96 xbstream[3500]: Libgcrypt notice: state transition Self-Test => Error

However replication is ok.

I was digging:

rpm -qa|grep -i Libgcrypt
libgcrypt-1.10.0-11.el9.x86_64

[mysqldba@vm1rhel96 ~]$ xtrabackup --version
libgcrypt selftest: binary (0): Checksum error
xtrabackup version 8.4.0-4 based on MySQL server 8.4.0 Linux (x86_64) (revision id: c584cb20)
[mysqldba@vm1rhel96 ~]$

mysql --version
mysql Ver 8.4.6-6.1 for Linux on x86_64 (Percona XtraDB Cluster binary (GPL) 8.4.6, Revision 9ca703c, WSREP version 26.1.4.3)
[mysqldba@vm1rhel96 ~]$

ldd -v /appsSW/PerconaMYSQL/percona-xtrabackup-8.4.0-4-Linux-x86_64.glibc2.34/bin/xtrabackup |grep -i libgcr
libgcrypt.so => /appsSW/PerconaMYSQL/percona-xtrabackup-8.4.0-4-Linux-x86_64.glibc2.34/bin/../lib/private/libgcrypt.so (0x00007f85056f9000)
libgcrypt.so.20 => /lib64/libgcrypt.so.20 (0x00007f8504aa9000)
libgcrypt.so (GCRYPT_1.6) => /appsSW/PerconaMYSQL/percona-xtrabackup-8.4.0-4-Linux-x86_64.glibc2.34/bin/../lib/private/libgcrypt.so
/appsSW/PerconaMYSQL/percona-xtrabackup-8.4.0-4-Linux-x86_64.glibc2.34/bin/../lib/private/libgcrypt.so:
libgcrypt.so.20 (GCRYPT_1.6) => /lib64/libgcrypt.so.20
/lib64/libgcrypt.so.20:

[mysqldba@vm2rhel96 ~]$ ls -ld /lib64/libgcrypt.so.20
lrwxrwxrwx. 1 root root 19 Aug 1 2024 /lib64/libgcrypt.so.20 → libgcrypt.so.20.4.0
[mysqldba@vm2rhel96 ~]$

[mysqldba@vm2rhel96 ~]$ ls -ld /appsSW/PerconaMYSQL/percona-xtrabackup-8.4.0-4-Linux-x86_64.glibc2.34/lib/private/libgcr*
lrwxrwxrwx. 1 mysql mysql 19 Aug 10 2025 /appsSW/PerconaMYSQL/percona-xtrabackup-8.4.0-4-Linux-x86_64.glibc2.34/lib/private/libgcrypt.so → libgcrypt.so.20.4.0
-rwxr-xr-x. 1 mysql mysql 1320312 Aug 10 2025 /appsSW/PerconaMYSQL/percona-xtrabackup-8.4.0-4-Linux-x86_64.glibc2.34/lib/private/libgcrypt.so.20.4.0
[mysqldba@vm2rhel96 ~]$

[mysqldba@vm2rhel96 ~]$ cksum /appsSW/PerconaMYSQL/percona-xtrabackup-8.4.0-4-Linux-x86_64.glibc2.34/lib/private/libgcrypt.so.20.4.0
4160936112 1320312 /appsSW/PerconaMYSQL/percona-xtrabackup-8.4.0-4-Linux-x86_64.glibc2.34/lib/private/libgcrypt.so.20.4.0
[mysqldba@vm2rhel96 ~]$
[mysqldba@vm2rhel96 ~]$ cksum /lib64/libgcrypt.so.20
2887115410 1304856 /lib64/libgcrypt.so.20
[mysqldba@vm2rhel96 ~]$

My OS version is rhel9.6 with fips enabled. However I’ve disabled it inside config file

Thanx in advance

2

It looks like you still have the FIPS enabled. Could you please provide the output below?

cat /proc/sys/crypto/fips_enabled

ls -lrth /etc/gcrypt/fips_enabled 

ls -lrth /lib64/.libgcrypt.so.20.hmac /usr/lib64/fipscheck/.libgcrypt.so.20.hmac

fips-mode-setup --check
3

You’re right, fips mode is enabled. Needed due to compliance. In mysql config file, I had disabled it

mysql> show variables like ‘%fips%’;
±-------------------±-------+
| Variable_name | Value |
±-------------------±-------+
| ssl_fips_mode | OFF |
±-------------------±-------+
1 row in set (0.02 sec)

mysql>

In mysql config file , I’ve set wsrep_sst_method=‘xtrabackup-v2’

[mysqldba@vm1rhel96 ~]$ cat /proc/sys/crypto/fips_enabled
1
[mysqldba@vm1rhel96 ~]$ ls -lrth /etc/gcrypt/fips_enabled
ls: cannot access ‘/etc/gcrypt/fips_enabled’: No such file or directory
[mysqldba@vm1rhel96 ~]$ ls -lrth /lib64/.libgcrypt.so.20.hmac /usr/lib64/fipscheck/.libgcrypt.so.20.hmac
ls: cannot access ‘/lib64/.libgcrypt.so.20.hmac’: No such file or directory
ls: cannot access ‘/usr/lib64/fipscheck/.libgcrypt.so.20.hmac’: No such file or directory
[mysqldba@vm1rhel96 ~]$
[mysqldba@vm1rhel96 ~]$ fips-mode-setup --check
FIPS mode is enabled.
[mysqldba@vm1rhel96 ~]$