aboutsummaryrefslogtreecommitdiffstats
path: root/meta/recipes-connectivity/openssl
AgeCommit message (Collapse)Author
2018-08-20openssl: fix path in nativesdk environment-setup scriptAndre McCurdy
A single version of the openssl.sh environment-setup script is currently shared by both the openssl 1.0 and 1.1 recipes. The libdir path in the script needs to be tweaked for openssl 1.1. Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-20openssl: move the libdir openssl.cnf symlink into the openssl packageAndre McCurdy
The openssl 1.0 recipe puts the libdir symlink to /etc/ssl/openssl.cnf in the base openssl package (along with the libdir symlinks to /etc/ssl/certs and /etc/ssl/private). Keep the openssl 1.1 recipe aligned with that approach until there's a clear reason to do something else. For more background, see comments in the following thread: http://lists.openembedded.org/pipermail/openembedded-core/2017-April/135176.html Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-20openssl: openssl-misc dependency on perl should be unconditionalAndre McCurdy
The openssl 1.1 recipe doesn't have a PACKAGECONFIG option for perl, so the RDEPENDS for openssl-misc shouldn't be conditional on it. Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-20openssl: minor reformatting to align the 1.0 and 1.1 recipesAndre McCurdy
Formatting and comment tweaks only, no functional changes. Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-20openssl: update 32bit x86 target from linux-elf -> linux-x86Andre McCurdy
According to comments in Configurations/10-main.conf, the linux-elf target is "... to be used on older Linux machines where gcc doesn't understand -m32 and -m64". The linux-x86 target appears to be the newer replacement (currently the only difference between the two is that linux-x86 adds -m32 to cflags). Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-20openssl: consolidate target name mapping rulesAndre McCurdy
Merge duplicates + minor reformatting (no functional changes). Note that the openssl 1.1 recipe still needs to be updated to handle MIPS Release 6 ISA targets (e.g. linux-mipsisa32r6, etc). Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-19openssl: update 1.1.0h -> 1.1.0iAndrej Valek
Please see this security advisory: https://www.openssl.org/news/secadv/20180612.txt Remove obsolete patch. Signed-off-by: Andrej Valek <andrej.valek@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-19openssl: update 1.0.2o -> 1.0.2pAndrej Valek
Please see this security advisory: https://www.openssl.org/news/secadv/20180612.txt Refresh patches Signed-off-by: Andrej Valek <andrej.valek@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-15openssl-1.1: /etc/ssl location compatibilityAndrej Valek
Some packages have hard-coded path to /etc/ssl location. Create a symlinks to correct location. Signed-off-by: Andrej Valek <andrej.valek@siemens.com> Signed-off-by: Marko Peter <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-15openssl-1.1: rework packagingAndrej Valek
The main idea is to have libssl and libcrypto in separate packages. This saves space if only single library is needed and also some recipes (in other layers) depend on these library packages. Together with this other packages like in 1.0.x were created. The only difference is that openssl 1.1 has additional package openssl-bin. Add missing dependency to perl for openssl-bin pkg, c_rehash requires it. Signed-off-by: Andrej Valek <andrej.valek@siemens.com> Signed-off-by: Marko Peter <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-15openssl-1.1: fix c_rehash perl errorsAndrej Valek
Patch original c_rehash script with Debian patch instead of overriding it with own version. Error output from c_reshah without patching: Unknown regexp modifier "/b" at ./c_rehash line 15, at end of line Unknown regexp modifier "/W" at ./c_rehash line 28, at end of line Unknown regexp modifier "/3" at ./c_rehash line 28, at end of line Unknown regexp modifier "/2" at ./c_rehash line 28, at end of line No such class installdir at ./c_rehash line 63, near "Prefix our installdir" (Might be a runaway multi-line // string starting on line 28) syntax error at ./c_rehash line 63, near "Prefix our installdir" Can't redeclare "my" in "my" at ./c_rehash line 68, near "" Execution of ./c_rehash aborted due to compilation errors. Signed-off-by: Andrej Valek <andrej.valek@siemens.com> Signed-off-by: Marko Peter <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-14openssl_1.0: drop unnecessary call to perlpath.pl from do_configure()Andre McCurdy
The perlpath.pl script is used to patch the #! lines in all perl scripts in the utils directory. However, as these scripts are run via e.g. "perl foo.pl", they don't actually rely on the #! path to be correct (which can be confirmed by the observation that the path is currently being set to ${STAGING_BINDIR_NATIVE}/perl, which doesn't exist). Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-08openssl_1.0: drop unnecessary dependency on makedepend-nativeAndre McCurdy
The openssl Configure script will only select standalone makedepend (vs running "$CC -M") when building with gcc < 3.x or with an Apple Xcode version which predates the switch to clang (in approx 2010?). Neither of these cases are possible when building under OE, therefore the dependency on makedepend-native can be dropped (ie align the openssl 1.0 recipe with the 1.1 recipe, which has dropped the makedepend-native dependency already). Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-08-02openssl: fix missing dependency on hostperl-runtime-nativeAndre McCurdy
Openssl 1.1 requires perl in order to build (just as openssl 1.0 does). The missing dependency has gone unnoticed up to now since hostperl-runtime-native is included in ASSUME_PROVIDED. Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-07-30openssl_1.0: squash whitespace in CC_INFOAndre McCurdy
Squash whitespace in CC_INFO to avoid recipe whitespace changes to CFLAG affecting the final openssl binaries (the value of CC_INFO gets embedded in libcrypto, via buildinf.h). Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-07-30openssl_1.0: add PACKAGECONFIG option to control manpagesAndre McCurdy
Creating the openssl manpages, which happens as part of do_install(), can take a significant amount of time (e.g. ~50 seconds on a quad core laptop). Provide a PACKAGECONFIG option to allow creation of the manpages to be skipped completely if not required and inherit the manpages class to automatically control the PACKAGECONFIG option (based on the "api-documentation" distro feature). Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-07-30openssl_1.0: drop unmaintained darwin supportAndre McCurdy
The fact that the darwin support only appears to consider x86 (and not x86_64) suggests that it's not maintained or tested. In general oe-core doesn't support building on darwin. Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-07-30openssl_1.0: drop obsolete exporting of AS, EX_LIBS and DIRSAndre McCurdy
Previously (when EXTRA_OEMAKE contained -e) exporting these variables over-rode default values in the top-level openssl Makefile. However, since -e was removed from EXTRA_OEMAKE as part of: http://git.openembedded.org/openembedded-core/commit/?id=537a404cfbb811fcb526cdb5f2e059257de6ef13 exporting these variables does nothing. The comment from that commit that only AR is affected by removing -e wasn't correct, but the effects of letting the openssl Makefile also control AS, EX_LIBS and DIRS seem to be either benign or beneficial. Since without -e make ignores DIRS from the environment and always runs for all subdirs (including "test"), adding "test" to DIRS and calling "make depend" again from do_compile_ptest() can be dropped. Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-07-30openssl_1.0: drop obsolete ca.patchAndre McCurdy
This patch adds a second line to the -help output of the CA.pl script (which lists almost the same command line options as the line above it but in a slightly different order). Although it's tagged as a Debian backport, there's no patch like it in recent Debian patch sets for openssl 1.0.2. Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-07-26openssl: minor indent fixesAndre McCurdy
Fix inconsistent indent (and also make the openssl 1.1 recipe more consistent and consistent with the openssl 1.0 recipe). Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-07-26openssl: support musl-x32 buildAndre McCurdy
Align the openssl 1.1 recipe with changes made to openssl 1.0: http://git.openembedded.org/openembedded-core/commit/?id=a072d4620db462c5d3459441d5684cfd99938400 Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-07-26openssl: remove uclibc remnantsAndre McCurdy
Align the openssl 1.1 recipe with changes made to openssl 1.0: http://git.openembedded.org/openembedded-core/commit/?id=e01e7c543a559c8926d72159b5cd55db0c661434 Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-07-26openssl_1.0: avoid running make twice for target do_compile()Andre McCurdy
Currently target builds call make twice as part of do_compile(). It appears to be an accidental side effect of needing to only pass CC_INFO on the make command line for target builds, since CC_INFO is only referenced by the reproducible build patches. Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-07-26openssl_1.0: drop leading "-" from no-ssl3 config optionAndre McCurdy
Although passing -no-ssl3 works, comments in the openssl Configure script suggest doing so isn't really correct: s /^-no-/no-/; # some people just can't read the instructions The documented way to pass no-<cipher> config options is without a leading "-" https://github.com/openssl/openssl/blob/OpenSSL_1_0_2-stable/INSTALL Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-07-26openssl_1.0: fix cryptodev-linux PACKAGECONFIG supportAndre McCurdy
Since openssl isn't an autotools recipe, defining cryptodev-linux related config options via PACKAGECONFIG hasn't worked correctly since PACKAGECONFIG_CONFARGS stopped being automatically appended to EXTRA_OECONF in 2016: http://git.openembedded.org/openembedded-core/commit/?id=c98fb5f5129e71829ffab4449b3d28082bc95ab4 The issue appears to have been hidden as the flags are also hardcoded in CFLAG - and therefore always enabled, regardless of the state of the PACKAGECONFIG option. Fix by passing both EXTRA_OECONF and PACKAGECONFIG_CONFARGS when running the openssl Configure script. Although the openssl 1.1 recipe doesn't contain any PACKAGECONFIG options yet, pre-emptively make the same fix there too. Also only enable cryptodev-linux by default for target builds (based on the historical comments in the recipe, that seems to have been the original intention). Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-07-26openssl_1.0: drop curly brackets from shell local variablesAndre McCurdy
Make clear distinction between local variables and bitbake variables. Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-07-26openssl_1.0: minor recipe formatting tweaks etcAndre McCurdy
Drop redundant setting of S to its default value, fix inconsistent indent and re-order variables to align more closely to the OE style-guide. Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-07-26openssl_1.0: merge openssl10.inc into the openssl_1.0.2o.bb recipeAndre McCurdy
The openssl10.inc include file only has one user, so we can improve maintainability by merging the include file into the recipe which uses it. Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-07-10openssl_1.1: minor recipe formatting tweaks etcAndre McCurdy
Drop redundant setting of S to its default value and re-order variables to align more closely to the OE style-guide. Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-07-07openssl_1.1: avoid using += with an over-rideAndre McCurdy
Using += with an over-ride can be a source of confusion so try to avoid the construct in core recipes. The current usage is incorrect and prevents the aarch64 and musl specific config options from being active together. Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-07-07openssl-nativesdk: Fix "can't open config file" warningOvidiu Panait
When SDK is not installed in the default location, openssl will not be able to find the the openssl.cnf config file: "WARNING: can't open config file: XXXX/usr/lib/ssl/openssl.cnf" To fix this, we need to provide the environment variable $OPENSSL_CONF pointing to the correct config file location. Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com> Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-06-28openssl: disable ccache usageRoss Burton
ccache and openssl don't get on: | make[1]: Entering directory '/home/prj/yocto/build/tmp/work/core2-64-poky-linux/openssl/1.0.2o-r0/openssl-1.0.2o/crypto' | ccache: invalid option -- 'D' Disable the use of ccache in the openssl recipe until someone root-causes this. [ YOCTO #12810 ] Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-05-29openssl: fix upstream version check for 1.0 versionAlexander Kanavin
Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-03-30openssl: update 1.1.0g -> 1.1.0hAlexander Kanavin
Please see this security advisory: https://www.openssl.org/news/secadv/20180327.txt Remove 0001-Remove-test-that-requires-running-as-non-root.patch (issue fixed upstream) Remove 0001-aes-asm-aes-armv4-bsaes-armv7-.pl-make-it-work-with-.patch (backport) License-Update: copyright years Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-03-30openssl: update 1.0.2n -> 1.0.2oAlexander Kanavin
Please see this security advisory: https://www.openssl.org/news/secadv/20180327.txt License-Update: copyright years Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-03-15openssl: fix libdir logic to allow multiarch style pathsKoen Kooi
The recipes were using 'basename' to turn '/usr/lib' into 'lib', which breaks when libdir is '/usr/lib/tuple', leading to libraries ending up in '/usr/tuple', which isn't in FILES_*. Change the logic to use sed to strip the prefix instead. Signed-off-by: Koen Kooi <koen.kooi@linaro.org> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-03-12openssl_1.0.2n: improve reproducibilityJuro Bystricky
Improve reproducible build of: openssl-staticdev openssl-dbg libcrypto There are two main causes that prevent reproducible build, both related to the generated file "buildinf.h": 1. "buildinf.h" contains build host CFLAGS, containing various build host references. We need to pass sanitized CFLAGS to the script generating this file ("mkbuildinf.pl". ) 2. We also need to modify the script "mkbuildinf.pl" itsel in order to generate a build timestamp based on SOURCE_DATE_EPOCH, if present in the environment. Signed-off-by: Juro Bystricky <juro.bystricky@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-03-11openssl: drop openssl-1.0.2a-x32-asm.patchAlexander Kanavin
The patch was applied in a completely incorrect spot (due to fuzz), no one noticed or complained. Meanwhile upstream says the issue has been resolved differently: https://rt.openssl.org/Ticket/Display.html?id=3759&user=guest&pass=guest Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-03-11openssl: refresh patchesRoss Burton
The patch tool will apply patches by default with "fuzz", which is where if the hunk context isn't present but what is there is close enough, it will force the patch in. Whilst this is useful when there's just whitespace changes, when applied to source it is possible for a patch applied with fuzz to produce broken code which still compiles (see #10450). This is obviously bad. We'd like to eventually have do_patch() rejecting any fuzz on these grounds. For that to be realistic the existing patches with fuzz need to be rebased and reviewed. Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-02-24openssl: remove patch from 1.0.2m left behind after update to 1.0.2nDenys Dmytriyenko
Signed-off-by: Denys Dmytriyenko <denys@ti.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-02-06openssl: update to 1.0.2nAlexander Kanavin
Drop upstreamed 0001-aes-armv4-bsaes-armv7-sha256-armv4-.pl-make-it-work-.patch Rebase a couple more patches (via devtool upgrade). Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-01-29meta: don't use deprecated functions from utils.bbclassRoss Burton
These functions were moved to meta/lib/oe in 2010 and the base_* functions in utils.bbclass were intended to be a short-term compatibility layer. They're still used in a few places, so update the callers to use the new functions. Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-01-05openssl-ptest: improve reproducibilityJuro Bystricky
Remove buildhost references from Makefile and Configure. Signed-off-by: Juro Bystricky <juro.bystricky@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-12-02openssl: fix runtime errors with Thumb2 when using binutils 2.29Stefan Agner
When compiling OpenSSL with binutils 2.29 for ARM with Thumb2 enabled crashes and unexpected behavior occurs. E.g. connecting to a OpenSSH server using the affected binary fails with: ssh_dispatch_run_fatal: Connection to 192.168.10.171 port 22: incorrect signature Backport upstream bugfix: https://github.com/openssl/openssl/issues/4659 Signed-off-by: Stefan Agner <stefan.agner@toradex.com> Acked-by: Otavio Salvador <otavio@ossystems.com.br> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-12-02openssl: Upgrade 1.1.0f -> 1.1.0gStefan Agner
Deals with two CVEs: * bn_sqrx8x_internal carry bug on x86_64 (CVE-2017-3736) * Malformed X.509 IPAddressFamily could cause OOB read (CVE-2017-3735) Signed-off-by: Stefan Agner <stefan.agner@toradex.com> Acked-by: Otavio Salvador <otavio@ossystems.com.br> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-12-02openssl10: fix runtime errors with Thumb2 when using binutils 2.29Stefan Agner
When compiling OpenSSL with binutils 2.29 for ARM with Thumb2 enabled crashes and unexpected behavior occurs. E.g. connecting to a OpenSSH server using the affected binary fails with: ssh_dispatch_run_fatal: Connection to 192.168.10.171 port 22: incorrect signature Backport upstream bugfix: https://github.com/openssl/openssl/issues/4659 Signed-off-by: Stefan Agner <stefan.agner@toradex.com> Acked-by: Otavio Salvador <otavio@ossystems.com.br> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-12-02openssl10: Upgrade 1.0.2l -> 1.0.2mStefan Agner
Deals with two CVEs: * bn_sqrx8x_internal carry bug on x86_64 (CVE-2017-3736) * Malformed X.509 IPAddressFamily could cause OOB read (CVE-2017-3735) Signed-off-by: Stefan Agner <stefan.agner@toradex.com> Acked-by: Otavio Salvador <otavio@ossystems.com.br> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-11-05openssl: force soft link to avoid rare raceRandy MacLeod
This patch works around a rare parallel build race condition using the force option when soft linking. The error seen is: ln: failed to create symbolic link 'libssl.so': File exists make[4]: *** [Makefile.shared:171: link_a.gnu] Error 1 make[4]: Leaving directory '/.../build/tmp-glibc/work/x86_64-linux/openssl-native/1.0.2k-r0/openssl-1.0.2k' Just add the -f flag to the platform independent soft link code to avoid the collision. This is reasonable since this Makefile removes the link target before creating a new soft link. The Makefile was written this way to support platforms that don't allow forcing a softlink to overwrite an existing link. Only builds on Linux are supported so that's not a requirement for oe-core recipes. The openssl team is rewriting their build files so it's not appropriate for openssl upstream and fixing the root cause of the race condition was also not pursued. Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-11-05openssl: Add support for riscv32/riscv64Khem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-08-31openssl10: set right target for ilp32 buildVishal Bhoj
Signed-off-by: Vishal Bhoj <vishal.bhoj@linaro.org> Signed-off-by: Ross Burton <ross.burton@intel.com>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-05-17 15:02:20 +0000