Guidance Downgrading Python2 in Zeus #python

Guidance Downgrading Python2 in Zeus #python

[MikeB]

[-- Attachment #1: Type: text/plain, Size: 601 bytes --]

I'm working on a set of platforms that have a FIPs certified OpenSSL.  We are at version 1.0.2l.

I've found that the new version of python in Zeus (2.7.17) requires a newer version of OpenSSL (1.1).

We really don't want to go through a new round of certification, so we want to keep our current OpenSSL (1.0.2l).

I think the easiest solution is to downgrade python 2 back to the version used by Sumo (2.7.15).

I know how to downgrade simple recipes, but python is far from simple.

Can someone give me some guidance on how to approach the downgrade of python2 in Zeus?

Thanks, Mike

[-- Attachment #2: Type: text/html, Size: 653 bytes --]

Re: [yocto] Guidance Downgrading Python2 in Zeus #python

[Alexander Kanavin]

[-- Attachment #1: Type: text/plain, Size: 901 bytes --]

I think python2 *recipe* requires openssl 1.1, but python2 itself will work
just fine with openssl 1.0. So you only need to adjust the dependency,
there are several ways to do that.

Alex

On Wed, 15 Apr 2020 at 18:16, MikeB <mabnhdev@gmail.com> wrote:

> I'm working on a set of platforms that have a FIPs certified OpenSSL.  We
> are at version 1.0.2l.
>
> I've found that the new version of python in Zeus (2.7.17) requires a
> newer version of OpenSSL (1.1).
>
> We really don't want to go through a new round of certification, so we
> want to keep our current OpenSSL (1.0.2l).
>
> I think the easiest solution is to downgrade python 2 back to the version
> used by Sumo (2.7.15).
>
> I know how to downgrade simple recipes, but python is far from simple.
>
> Can someone give me some guidance on how to approach the downgrade of
> python2 in Zeus?
>
> Thanks, Mike 
>

[-- Attachment #2: Type: text/html, Size: 1214 bytes --]

Re: [yocto] Guidance Downgrading Python2 in Zeus #python

[akuster]

[-- Attachment #1: Type: text/plain, Size: 803 bytes --]



On 4/15/20 9:16 AM, MikeB wrote:
> I'm working on a set of platforms that have a FIPs certified OpenSSL. 
> We are at version 1.0.2l.
>
> I've found that the new version of python in Zeus (2.7.17) requires a
> newer version of OpenSSL (1.1).
>
> We really don't want to go through a new round of certification, so we
> want to keep our current OpenSSL (1.0.2l).
>
> I think the easiest solution is to downgrade python 2 back to the
> version used by Sumo (2.7.15).
>
> I know how to downgrade simple recipes, but python is far from simple.
>
> Can someone give me some guidance on how to approach the downgrade of
> python2 in Zeus?

Have had a chance to look at this layer?
http://git.yoctoproject.org/cgit/cgit.cgi/meta-openssl102-fips/

- armin
>
> Thanks, Mike
>
> 


[-- Attachment #2: Type: text/html, Size: 1710 bytes --]

Re: [yocto] Guidance Downgrading Python2 in Zeus #python

[Sean McKay]

[-- Attachment #1: Type: text/plain, Size: 1287 bytes --]

FYI, we’re doing the same internally (vendor supplied FIPS supported openssl 1.0.2), and the layer Armin suggests worked for us on zeus with minimal additional tweaking.

Good luck!
-Sean

From: yocto@lists.yoctoproject.org <yocto@lists.yoctoproject.org> On Behalf Of akuster
Sent: Wednesday, April 15, 2020 9:23 AM
To: MikeB <mabnhdev@gmail.com>; yocto@lists.yoctoproject.org
Subject: Re: [yocto] Guidance Downgrading Python2 in Zeus #python


On 4/15/20 9:16 AM, MikeB wrote:
I'm working on a set of platforms that have a FIPs certified OpenSSL.  We are at version 1.0.2l.

I've found that the new version of python in Zeus (2.7.17) requires a newer version of OpenSSL (1.1).

We really don't want to go through a new round of certification, so we want to keep our current OpenSSL (1.0.2l).

I think the easiest solution is to downgrade python 2 back to the version used by Sumo (2.7.15).

I know how to downgrade simple recipes, but python is far from simple.

Can someone give me some guidance on how to approach the downgrade of python2 in Zeus?

Have had a chance to look at this layer?
http://git.yoctoproject.org/cgit/cgit.cgi/meta-openssl102-fips/<http://git.yoctoproject.org/cgit/cgit.cgi/meta-openssl102-fips/>

- armin


Thanks, Mike





[-- Attachment #2: Type: text/html, Size: 4027 bytes --]

Re: [yocto] Guidance Downgrading Python2 in Zeus #python

[MikeB]

[-- Attachment #1: Type: text/plain, Size: 1495 bytes --]

Thank you all.  The new layer did the trick for me also.

Regards, Mike

On Wed, Apr 15, 2020 at 12:33 PM McKay, Sean <sean.mckay@hpe.com> wrote:

> FYI, we’re doing the same internally (vendor supplied FIPS supported
> openssl 1.0.2), and the layer Armin suggests worked for us on zeus with
> minimal additional tweaking.
>
>
>
> Good luck!
>
> -Sean
>
>
>
> *From:* yocto@lists.yoctoproject.org <yocto@lists.yoctoproject.org> *On
> Behalf Of *akuster
> *Sent:* Wednesday, April 15, 2020 9:23 AM
> *To:* MikeB <mabnhdev@gmail.com>; yocto@lists.yoctoproject.org
> *Subject:* Re: [yocto] Guidance Downgrading Python2 in Zeus #python
>
>
>
>
>
> On 4/15/20 9:16 AM, MikeB wrote:
>
> I'm working on a set of platforms that have a FIPs certified OpenSSL.  We
> are at version 1.0.2l.
>
> I've found that the new version of python in Zeus (2.7.17) requires a
> newer version of OpenSSL (1.1).
>
> We really don't want to go through a new round of certification, so we
> want to keep our current OpenSSL (1.0.2l).
>
> I think the easiest solution is to downgrade python 2 back to the version
> used by Sumo (2.7.15).
>
> I know how to downgrade simple recipes, but python is far from simple.
>
> Can someone give me some guidance on how to approach the downgrade of
> python2 in Zeus?
>
>
> Have had a chance to look at this layer?
> http://git.yoctoproject.org/cgit/cgit.cgi/meta-openssl102-fips/
>
> - armin
>
>
> Thanks, Mike
>
>
>
>
>

[-- Attachment #2: Type: text/html, Size: 3393 bytes --]