* [PATCH 0/4] Add openssl 1.1
@ 2017-08-08 15:30 Alexander Kanavin
2017-08-08 15:30 ` [PATCH 1/4] openssl: add a 1.1 version Alexander Kanavin
` (3 more replies)
0 siblings, 4 replies; 12+ messages in thread
From: Alexander Kanavin @ 2017-08-08 15:30 UTC (permalink / raw)
To: openembedded-core
This patch series introduces the recipe for openssl 1.1 (openssl 1.0 is preserved
but renamed to openssl10), and does a few necessary adjustmenets and updates to other
recipes.
Openssl 1.1 is an opt-out; it has the same recipe name as openssl 1.0 had, and so
all dependencies are compiled with it by default. If there's an API issue, please
fix it, or adjust the recipe to depend on 'openssl10' (which is a lesser solution,
and subject to openssl 1.0 eventually being removed from oe-core).
This iteration of the patchset fixes an issue with installing certificates
when building images; specifically a special version of c_rehash utility needs
to be used on build host.
The following changes since commit 621ca8b66c8f927713d98bc4d3cccc7a0f151e4b:
ca-certificates: update to 20170717 (2017-08-08 18:24:06 +0300)
are available in the git repository at:
git://git.yoctoproject.org/poky-contrib akanavin/openssl-1.1
http://git.yoctoproject.org/cgit.cgi/poky-contrib/log/?h=akanavin/openssl-1.1
Alexander Kanavin (4):
openssl: add a 1.1 version
openssh: depend on openssl 1.0
cryptodev-tests: depend on openssl 1.0
gstreamer-plugins-bad: replace openssl dependency with nettle for hls
plugin
meta/conf/distro/include/no-static-libs.inc | 3 +
meta/recipes-connectivity/openssh/openssh_7.5p1.bb | 3 +-
...ve-test-that-requires-running-as-non-root.patch | 49 +++++
...1-Take-linking-flags-from-LDFLAGS-env-var.patch | 43 ++++
.../recipes-connectivity/openssl/openssl/run-ptest | 4 +-
.../openssl/{openssl.inc => openssl10.inc} | 14 +-
...build-with-clang-using-external-assembler.patch | 0
.../{openssl => openssl10}/Makefiles-ptest.patch | 0
.../Use-SHA256-not-MD5-as-default-digest.patch | 0
.../configure-musl-target.patch | 0
.../{openssl => openssl10}/configure-targets.patch | 0
.../debian/c_rehash-compat.patch | 0
.../openssl/{openssl => openssl10}/debian/ca.patch | 0
.../debian/debian-targets.patch | 0
.../{openssl => openssl10}/debian/man-dir.patch | 0
.../debian/man-section.patch | 0
.../{openssl => openssl10}/debian/no-rpath.patch | 0
.../debian/no-symbolic.patch | 0
.../{openssl => openssl10}/debian/pic.patch | 0
.../debian/version-script.patch | 0
.../debian1.0.2/block_digicert_malaysia.patch | 0
.../debian1.0.2/block_diginotar.patch | 0
.../debian1.0.2/soname.patch | 0
.../debian1.0.2/version-script.patch | 0
.../engines-install-in-libdir-ssl.patch | 0
.../openssl/{openssl => openssl10}/find.pl | 0
.../{openssl => openssl10}/oe-ldflags.patch | 0
.../openssl-1.0.2a-x32-asm.patch | 0
.../openssl/openssl10/openssl-c_rehash.sh | 222 +++++++++++++++++++++
.../openssl-fix-des.pod-error.patch | 0
.../openssl-util-perlpath.pl-cwd.patch | 0
.../openssl_fix_for_x32.patch | 0
.../openssl/{openssl => openssl10}/parallel.patch | 0
.../{openssl => openssl10}/ptest-deps.patch | 0
.../ptest_makefile_deps.patch | 0
.../openssl/openssl10/run-ptest | 2 +
.../{openssl => openssl10}/shared-libs.patch | 0
.../{openssl_1.0.2l.bb => openssl10_1.0.2l.bb} | 4 +-
.../recipes-connectivity/openssl/openssl_1.1.0f.bb | 155 ++++++++++++++
.../cryptodev/cryptodev-tests_1.9.bb | 2 +-
.../gstreamer/gstreamer1.0-plugins-bad.inc | 4 +-
41 files changed, 495 insertions(+), 10 deletions(-)
create mode 100644 meta/recipes-connectivity/openssl/openssl/0001-Remove-test-that-requires-running-as-non-root.patch
create mode 100644 meta/recipes-connectivity/openssl/openssl/0001-Take-linking-flags-from-LDFLAGS-env-var.patch
mode change 100755 => 100644 meta/recipes-connectivity/openssl/openssl/run-ptest
rename meta/recipes-connectivity/openssl/{openssl.inc => openssl10.inc} (95%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/0001-Fix-build-with-clang-using-external-assembler.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/Makefiles-ptest.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/Use-SHA256-not-MD5-as-default-digest.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/configure-musl-target.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/configure-targets.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian/c_rehash-compat.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian/ca.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian/debian-targets.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian/man-dir.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian/man-section.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian/no-rpath.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian/no-symbolic.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian/pic.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian/version-script.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian1.0.2/block_digicert_malaysia.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian1.0.2/block_diginotar.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian1.0.2/soname.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian1.0.2/version-script.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/engines-install-in-libdir-ssl.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/find.pl (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/oe-ldflags.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/openssl-1.0.2a-x32-asm.patch (100%)
create mode 100644 meta/recipes-connectivity/openssl/openssl10/openssl-c_rehash.sh
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/openssl-fix-des.pod-error.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/openssl-util-perlpath.pl-cwd.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/openssl_fix_for_x32.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/parallel.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/ptest-deps.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/ptest_makefile_deps.patch (100%)
create mode 100755 meta/recipes-connectivity/openssl/openssl10/run-ptest
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/shared-libs.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl_1.0.2l.bb => openssl10_1.0.2l.bb} (96%)
create mode 100644 meta/recipes-connectivity/openssl/openssl_1.1.0f.bb
--
2.13.2
^ permalink raw reply [flat|nested] 12+ messages in thread
* [PATCH 1/4] openssl: add a 1.1 version
2017-08-08 15:30 [PATCH 0/4] Add openssl 1.1 Alexander Kanavin
@ 2017-08-08 15:30 ` Alexander Kanavin
2017-08-08 15:30 ` [PATCH 2/4] openssh: depend on openssl 1.0 Alexander Kanavin
` (2 subsequent siblings)
3 siblings, 0 replies; 12+ messages in thread
From: Alexander Kanavin @ 2017-08-08 15:30 UTC (permalink / raw)
To: openembedded-core
Existing openssl 1.0 recipe is renamed to openssl10; it will
continue to be provided for as long as upstream supports it
(and there are still several recipes which do not work with openssl
1.1 due to API differences).
A few files (such as openssl binary) are no longer installed by openssl 1.0,
because they clash with openssl 1.1.
Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
---
meta/conf/distro/include/no-static-libs.inc | 3 +
...ve-test-that-requires-running-as-non-root.patch | 49 +++++
...1-Take-linking-flags-from-LDFLAGS-env-var.patch | 43 ++++
.../recipes-connectivity/openssl/openssl/run-ptest | 4 +-
.../openssl/{openssl.inc => openssl10.inc} | 14 +-
...build-with-clang-using-external-assembler.patch | 0
.../{openssl => openssl10}/Makefiles-ptest.patch | 0
.../Use-SHA256-not-MD5-as-default-digest.patch | 0
.../configure-musl-target.patch | 0
.../{openssl => openssl10}/configure-targets.patch | 0
.../debian/c_rehash-compat.patch | 0
.../openssl/{openssl => openssl10}/debian/ca.patch | 0
.../debian/debian-targets.patch | 0
.../{openssl => openssl10}/debian/man-dir.patch | 0
.../debian/man-section.patch | 0
.../{openssl => openssl10}/debian/no-rpath.patch | 0
.../debian/no-symbolic.patch | 0
.../{openssl => openssl10}/debian/pic.patch | 0
.../debian/version-script.patch | 0
.../debian1.0.2/block_digicert_malaysia.patch | 0
.../debian1.0.2/block_diginotar.patch | 0
.../debian1.0.2/soname.patch | 0
.../debian1.0.2/version-script.patch | 0
.../engines-install-in-libdir-ssl.patch | 0
.../openssl/{openssl => openssl10}/find.pl | 0
.../{openssl => openssl10}/oe-ldflags.patch | 0
.../openssl-1.0.2a-x32-asm.patch | 0
.../openssl/openssl10/openssl-c_rehash.sh | 222 +++++++++++++++++++++
.../openssl-fix-des.pod-error.patch | 0
.../openssl-util-perlpath.pl-cwd.patch | 0
.../openssl_fix_for_x32.patch | 0
.../openssl/{openssl => openssl10}/parallel.patch | 0
.../{openssl => openssl10}/ptest-deps.patch | 0
.../ptest_makefile_deps.patch | 0
.../openssl/openssl10/run-ptest | 2 +
.../{openssl => openssl10}/shared-libs.patch | 0
.../{openssl_1.0.2l.bb => openssl10_1.0.2l.bb} | 4 +-
.../recipes-connectivity/openssl/openssl_1.1.0f.bb | 155 ++++++++++++++
38 files changed, 491 insertions(+), 5 deletions(-)
create mode 100644 meta/recipes-connectivity/openssl/openssl/0001-Remove-test-that-requires-running-as-non-root.patch
create mode 100644 meta/recipes-connectivity/openssl/openssl/0001-Take-linking-flags-from-LDFLAGS-env-var.patch
mode change 100755 => 100644 meta/recipes-connectivity/openssl/openssl/run-ptest
rename meta/recipes-connectivity/openssl/{openssl.inc => openssl10.inc} (95%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/0001-Fix-build-with-clang-using-external-assembler.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/Makefiles-ptest.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/Use-SHA256-not-MD5-as-default-digest.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/configure-musl-target.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/configure-targets.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian/c_rehash-compat.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian/ca.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian/debian-targets.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian/man-dir.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian/man-section.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian/no-rpath.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian/no-symbolic.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian/pic.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian/version-script.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian1.0.2/block_digicert_malaysia.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian1.0.2/block_diginotar.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian1.0.2/soname.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian1.0.2/version-script.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/engines-install-in-libdir-ssl.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/find.pl (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/oe-ldflags.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/openssl-1.0.2a-x32-asm.patch (100%)
create mode 100644 meta/recipes-connectivity/openssl/openssl10/openssl-c_rehash.sh
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/openssl-fix-des.pod-error.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/openssl-util-perlpath.pl-cwd.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/openssl_fix_for_x32.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/parallel.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/ptest-deps.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/ptest_makefile_deps.patch (100%)
create mode 100755 meta/recipes-connectivity/openssl/openssl10/run-ptest
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/shared-libs.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl_1.0.2l.bb => openssl10_1.0.2l.bb} (96%)
create mode 100644 meta/recipes-connectivity/openssl/openssl_1.1.0f.bb
diff --git a/meta/conf/distro/include/no-static-libs.inc b/meta/conf/distro/include/no-static-libs.inc
index f8d8c09cf0f..7c165c717fc 100644
--- a/meta/conf/distro/include/no-static-libs.inc
+++ b/meta/conf/distro/include/no-static-libs.inc
@@ -25,6 +25,9 @@ DISABLE_STATIC_pn-openjade-native = ""
DISABLE_STATIC_pn-openssl = ""
DISABLE_STATIC_pn-openssl-native = ""
DISABLE_STATIC_pn-nativesdk-openssl = ""
+DISABLE_STATIC_pn-openssl10 = ""
+DISABLE_STATIC_pn-openssl10-native = ""
+DISABLE_STATIC_pn-nativesdk-openssl10 = ""
# libssp-static-dev included in build-appliance
DISABLE_STATIC_pn-gcc-runtime = ""
# libusb1-native is used to build static dfu-util-native
diff --git a/meta/recipes-connectivity/openssl/openssl/0001-Remove-test-that-requires-running-as-non-root.patch b/meta/recipes-connectivity/openssl/openssl/0001-Remove-test-that-requires-running-as-non-root.patch
new file mode 100644
index 00000000000..736bb39acd1
--- /dev/null
+++ b/meta/recipes-connectivity/openssl/openssl/0001-Remove-test-that-requires-running-as-non-root.patch
@@ -0,0 +1,49 @@
+From 3fdb1e2a16ea405c6731447a8994f222808ef7e6 Mon Sep 17 00:00:00 2001
+From: Alexander Kanavin <alex.kanavin@gmail.com>
+Date: Fri, 7 Apr 2017 18:01:52 +0300
+Subject: [PATCH] Remove test that requires running as non-root
+
+Upstream-Status: Inappropriate [oe-core specific]
+Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
+---
+ test/recipes/40-test_rehash.t | 17 +----------------
+ 1 file changed, 1 insertion(+), 16 deletions(-)
+
+diff --git a/test/recipes/40-test_rehash.t b/test/recipes/40-test_rehash.t
+index f902c23..c7567c1 100644
+--- a/test/recipes/40-test_rehash.t
++++ b/test/recipes/40-test_rehash.t
+@@ -23,7 +23,7 @@ setup("test_rehash");
+ plan skip_all => "test_rehash is not available on this platform"
+ unless run(app(["openssl", "rehash", "-help"]));
+
+-plan tests => 5;
++plan tests => 3;
+
+ indir "rehash.$$" => sub {
+ prepare();
+@@ -42,21 +42,6 @@ indir "rehash.$$" => sub {
+ 'Testing rehash operations on empty directory');
+ }, create => 1, cleanup => 1;
+
+-indir "rehash.$$" => sub {
+- prepare();
+- chmod 0500, curdir();
+- SKIP: {
+- if (!ok(!open(FOO, ">unwritable.txt"),
+- "Testing that we aren't running as a privileged user, such as root")) {
+- close FOO;
+- skip "It's pointless to run the next test as root", 1;
+- }
+- isnt(run(app(["openssl", "rehash", curdir()])), 1,
+- 'Testing rehash operations on readonly directory');
+- }
+- chmod 0700, curdir(); # make it writable again, so cleanup works
+-}, create => 1, cleanup => 1;
+-
+ sub prepare {
+ my @pemsourcefiles = sort glob(srctop_file('test', "*.pem"));
+ my @destfiles = ();
+--
+2.11.0
+
diff --git a/meta/recipes-connectivity/openssl/openssl/0001-Take-linking-flags-from-LDFLAGS-env-var.patch b/meta/recipes-connectivity/openssl/openssl/0001-Take-linking-flags-from-LDFLAGS-env-var.patch
new file mode 100644
index 00000000000..6ce4e47d712
--- /dev/null
+++ b/meta/recipes-connectivity/openssl/openssl/0001-Take-linking-flags-from-LDFLAGS-env-var.patch
@@ -0,0 +1,43 @@
+From 08face4353d80111973aba9c1304c92158cfad0e Mon Sep 17 00:00:00 2001
+From: Alexander Kanavin <alex.kanavin@gmail.com>
+Date: Tue, 28 Mar 2017 16:40:12 +0300
+Subject: [PATCH] Take linking flags from LDFLAGS env var
+
+This fixes "No GNU_HASH in the elf binary" issues.
+
+Upstream-Status: Inappropriate [oe-core specific]
+Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
+---
+ Configurations/unix-Makefile.tmpl | 2 +-
+ Configure | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/Configurations/unix-Makefile.tmpl b/Configurations/unix-Makefile.tmpl
+index c029817..43b769b 100644
+--- a/Configurations/unix-Makefile.tmpl
++++ b/Configurations/unix-Makefile.tmpl
+@@ -173,7 +173,7 @@ CROSS_COMPILE= {- $config{cross_compile_prefix} -}
+ CC= $(CROSS_COMPILE){- $target{cc} -}
+ CFLAGS={- our $cflags2 = join(" ",(map { "-D".$_} @{$target{defines}}, @{$config{defines}}),"-DOPENSSLDIR=\"\\\"\$(OPENSSLDIR)\\\"\"","-DENGINESDIR=\"\\\"\$(ENGINESDIR)\\\"\"") -} {- $target{cflags} -} {- $config{cflags} -}
+ CFLAGS_Q={- $cflags2 =~ s|([\\"])|\\$1|g; $cflags2 -} {- $config{cflags} -}
+-LDFLAGS= {- $target{lflags} -}
++LDFLAGS= {- $target{lflags}." ".$ENV{'LDFLAGS'} -}
+ PLIB_LDFLAGS= {- $target{plib_lflags} -}
+ EX_LIBS= {- $target{ex_libs} -} {- $config{ex_libs} -}
+ LIB_CFLAGS={- $target{shared_cflag} || "" -}
+diff --git a/Configure b/Configure
+index aee7cc3..274d236 100755
+--- a/Configure
++++ b/Configure
+@@ -979,7 +979,7 @@ $config{build_file} = $target{build_file};
+ $config{defines} = [];
+ $config{cflags} = "";
+ $config{ex_libs} = "";
+-$config{shared_ldflag} = "";
++$config{shared_ldflag} = $ENV{'LDFLAGS'};
+
+ # Make sure build_scheme is consistent.
+ $target{build_scheme} = [ $target{build_scheme} ]
+--
+2.11.0
+
diff --git a/meta/recipes-connectivity/openssl/openssl/run-ptest b/meta/recipes-connectivity/openssl/openssl/run-ptest
old mode 100755
new mode 100644
index 3b20fce1ee9..65c6cc7b862
--- a/meta/recipes-connectivity/openssl/openssl/run-ptest
+++ b/meta/recipes-connectivity/openssl/openssl/run-ptest
@@ -1,2 +1,4 @@
#!/bin/sh
-make -k runtest
+cd test
+OPENSSL_ENGINES=../engines BLDTOP=.. SRCTOP=.. perl run_tests.pl
+cd ..
diff --git a/meta/recipes-connectivity/openssl/openssl.inc b/meta/recipes-connectivity/openssl/openssl10.inc
similarity index 95%
rename from meta/recipes-connectivity/openssl/openssl.inc
rename to meta/recipes-connectivity/openssl/openssl10.inc
index ce295e8f37a..30aaeae1d43 100644
--- a/meta/recipes-connectivity/openssl/openssl.inc
+++ b/meta/recipes-connectivity/openssl/openssl10.inc
@@ -37,8 +37,6 @@ FILES_${PN} =+ " ${libdir}/ssl/*"
FILES_${PN}-misc = "${libdir}/ssl/misc"
RDEPENDS_${PN}-misc = "${@bb.utils.filter('PACKAGECONFIG', 'perl', d)}"
-PROVIDES += "openssl10"
-
# Add the openssl.cnf file to the openssl-conf package. Make the libcrypto
# package RRECOMMENDS on this package. This will enable the configuration
# file to be installed for both the base openssl package and the libcrypto
@@ -252,3 +250,15 @@ do_install_append_class-native() {
}
BBCLASSEXTEND = "native nativesdk"
+
+PACKAGE_PREPROCESS_FUNCS += "openssl_package_preprocess"
+
+openssl_package_preprocess () {
+ for file in `find ${PKGD} -name *.h -o -name *.pc -o -name *.so`; do
+ rm $file
+ done
+ rm ${PKGD}/usr/bin/openssl
+ rm ${PKGD}/usr/bin/c_rehash
+ rmdir ${PKGD}/usr/bin
+
+}
diff --git a/meta/recipes-connectivity/openssl/openssl/0001-Fix-build-with-clang-using-external-assembler.patch b/meta/recipes-connectivity/openssl/openssl10/0001-Fix-build-with-clang-using-external-assembler.patch
similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl/0001-Fix-build-with-clang-using-external-assembler.patch
rename to meta/recipes-connectivity/openssl/openssl10/0001-Fix-build-with-clang-using-external-assembler.patch
diff --git a/meta/recipes-connectivity/openssl/openssl/Makefiles-ptest.patch b/meta/recipes-connectivity/openssl/openssl10/Makefiles-ptest.patch
similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl/Makefiles-ptest.patch
rename to meta/recipes-connectivity/openssl/openssl10/Makefiles-ptest.patch
diff --git a/meta/recipes-connectivity/openssl/openssl/Use-SHA256-not-MD5-as-default-digest.patch b/meta/recipes-connectivity/openssl/openssl10/Use-SHA256-not-MD5-as-default-digest.patch
similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl/Use-SHA256-not-MD5-as-default-digest.patch
rename to meta/recipes-connectivity/openssl/openssl10/Use-SHA256-not-MD5-as-default-digest.patch
diff --git a/meta/recipes-connectivity/openssl/openssl/configure-musl-target.patch b/meta/recipes-connectivity/openssl/openssl10/configure-musl-target.patch
similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl/configure-musl-target.patch
rename to meta/recipes-connectivity/openssl/openssl10/configure-musl-target.patch
diff --git a/meta/recipes-connectivity/openssl/openssl/configure-targets.patch b/meta/recipes-connectivity/openssl/openssl10/configure-targets.patch
similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl/configure-targets.patch
rename to meta/recipes-connectivity/openssl/openssl10/configure-targets.patch
diff --git a/meta/recipes-connectivity/openssl/openssl/debian/c_rehash-compat.patch b/meta/recipes-connectivity/openssl/openssl10/debian/c_rehash-compat.patch
similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl/debian/c_rehash-compat.patch
rename to meta/recipes-connectivity/openssl/openssl10/debian/c_rehash-compat.patch
diff --git a/meta/recipes-connectivity/openssl/openssl/debian/ca.patch b/meta/recipes-connectivity/openssl/openssl10/debian/ca.patch
similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl/debian/ca.patch
rename to meta/recipes-connectivity/openssl/openssl10/debian/ca.patch
diff --git a/meta/recipes-connectivity/openssl/openssl/debian/debian-targets.patch b/meta/recipes-connectivity/openssl/openssl10/debian/debian-targets.patch
similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl/debian/debian-targets.patch
rename to meta/recipes-connectivity/openssl/openssl10/debian/debian-targets.patch
diff --git a/meta/recipes-connectivity/openssl/openssl/debian/man-dir.patch b/meta/recipes-connectivity/openssl/openssl10/debian/man-dir.patch
similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl/debian/man-dir.patch
rename to meta/recipes-connectivity/openssl/openssl10/debian/man-dir.patch
diff --git a/meta/recipes-connectivity/openssl/openssl/debian/man-section.patch b/meta/recipes-connectivity/openssl/openssl10/debian/man-section.patch
similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl/debian/man-section.patch
rename to meta/recipes-connectivity/openssl/openssl10/debian/man-section.patch
diff --git a/meta/recipes-connectivity/openssl/openssl/debian/no-rpath.patch b/meta/recipes-connectivity/openssl/openssl10/debian/no-rpath.patch
similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl/debian/no-rpath.patch
rename to meta/recipes-connectivity/openssl/openssl10/debian/no-rpath.patch
diff --git a/meta/recipes-connectivity/openssl/openssl/debian/no-symbolic.patch b/meta/recipes-connectivity/openssl/openssl10/debian/no-symbolic.patch
similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl/debian/no-symbolic.patch
rename to meta/recipes-connectivity/openssl/openssl10/debian/no-symbolic.patch
diff --git a/meta/recipes-connectivity/openssl/openssl/debian/pic.patch b/meta/recipes-connectivity/openssl/openssl10/debian/pic.patch
similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl/debian/pic.patch
rename to meta/recipes-connectivity/openssl/openssl10/debian/pic.patch
diff --git a/meta/recipes-connectivity/openssl/openssl/debian/version-script.patch b/meta/recipes-connectivity/openssl/openssl10/debian/version-script.patch
similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl/debian/version-script.patch
rename to meta/recipes-connectivity/openssl/openssl10/debian/version-script.patch
diff --git a/meta/recipes-connectivity/openssl/openssl/debian1.0.2/block_digicert_malaysia.patch b/meta/recipes-connectivity/openssl/openssl10/debian1.0.2/block_digicert_malaysia.patch
similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl/debian1.0.2/block_digicert_malaysia.patch
rename to meta/recipes-connectivity/openssl/openssl10/debian1.0.2/block_digicert_malaysia.patch
diff --git a/meta/recipes-connectivity/openssl/openssl/debian1.0.2/block_diginotar.patch b/meta/recipes-connectivity/openssl/openssl10/debian1.0.2/block_diginotar.patch
similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl/debian1.0.2/block_diginotar.patch
rename to meta/recipes-connectivity/openssl/openssl10/debian1.0.2/block_diginotar.patch
diff --git a/meta/recipes-connectivity/openssl/openssl/debian1.0.2/soname.patch b/meta/recipes-connectivity/openssl/openssl10/debian1.0.2/soname.patch
similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl/debian1.0.2/soname.patch
rename to meta/recipes-connectivity/openssl/openssl10/debian1.0.2/soname.patch
diff --git a/meta/recipes-connectivity/openssl/openssl/debian1.0.2/version-script.patch b/meta/recipes-connectivity/openssl/openssl10/debian1.0.2/version-script.patch
similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl/debian1.0.2/version-script.patch
rename to meta/recipes-connectivity/openssl/openssl10/debian1.0.2/version-script.patch
diff --git a/meta/recipes-connectivity/openssl/openssl/engines-install-in-libdir-ssl.patch b/meta/recipes-connectivity/openssl/openssl10/engines-install-in-libdir-ssl.patch
similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl/engines-install-in-libdir-ssl.patch
rename to meta/recipes-connectivity/openssl/openssl10/engines-install-in-libdir-ssl.patch
diff --git a/meta/recipes-connectivity/openssl/openssl/find.pl b/meta/recipes-connectivity/openssl/openssl10/find.pl
similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl/find.pl
rename to meta/recipes-connectivity/openssl/openssl10/find.pl
diff --git a/meta/recipes-connectivity/openssl/openssl/oe-ldflags.patch b/meta/recipes-connectivity/openssl/openssl10/oe-ldflags.patch
similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl/oe-ldflags.patch
rename to meta/recipes-connectivity/openssl/openssl10/oe-ldflags.patch
diff --git a/meta/recipes-connectivity/openssl/openssl/openssl-1.0.2a-x32-asm.patch b/meta/recipes-connectivity/openssl/openssl10/openssl-1.0.2a-x32-asm.patch
similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl/openssl-1.0.2a-x32-asm.patch
rename to meta/recipes-connectivity/openssl/openssl10/openssl-1.0.2a-x32-asm.patch
diff --git a/meta/recipes-connectivity/openssl/openssl10/openssl-c_rehash.sh b/meta/recipes-connectivity/openssl/openssl10/openssl-c_rehash.sh
new file mode 100644
index 00000000000..6620fdcb53f
--- /dev/null
+++ b/meta/recipes-connectivity/openssl/openssl10/openssl-c_rehash.sh
@@ -0,0 +1,222 @@
+#!/bin/sh
+#
+# Ben Secrest <blsecres@gmail.com>
+#
+# sh c_rehash script, scan all files in a directory
+# and add symbolic links to their hash values.
+#
+# based on the c_rehash perl script distributed with openssl
+#
+# LICENSE: See OpenSSL license
+# ^^acceptable?^^
+#
+
+# default certificate location
+DIR=/etc/openssl
+
+# for filetype bitfield
+IS_CERT=$(( 1 << 0 ))
+IS_CRL=$(( 1 << 1 ))
+
+
+# check to see if a file is a certificate file or a CRL file
+# arguments:
+# 1. the filename to be scanned
+# returns:
+# bitfield of file type; uses ${IS_CERT} and ${IS_CRL}
+#
+check_file()
+{
+ local IS_TYPE=0
+
+ # make IFS a newline so we can process grep output line by line
+ local OLDIFS=${IFS}
+ IFS=$( printf "\n" )
+
+ # XXX: could be more efficient to have two 'grep -m' but is -m portable?
+ for LINE in $( grep '^-----BEGIN .*-----' ${1} )
+ do
+ if echo ${LINE} \
+ | grep -q -E '^-----BEGIN (X509 |TRUSTED )?CERTIFICATE-----'
+ then
+ IS_TYPE=$(( ${IS_TYPE} | ${IS_CERT} ))
+
+ if [ $(( ${IS_TYPE} & ${IS_CRL} )) -ne 0 ]
+ then
+ break
+ fi
+ elif echo ${LINE} | grep -q '^-----BEGIN X509 CRL-----'
+ then
+ IS_TYPE=$(( ${IS_TYPE} | ${IS_CRL} ))
+
+ if [ $(( ${IS_TYPE} & ${IS_CERT} )) -ne 0 ]
+ then
+ break
+ fi
+ fi
+ done
+
+ # restore IFS
+ IFS=${OLDIFS}
+
+ return ${IS_TYPE}
+}
+
+
+#
+# use openssl to fingerprint a file
+# arguments:
+# 1. the filename to fingerprint
+# 2. the method to use (x509, crl)
+# returns:
+# none
+# assumptions:
+# user will capture output from last stage of pipeline
+#
+fingerprint()
+{
+ ${SSL_CMD} ${2} -fingerprint -noout -in ${1} | sed 's/^.*=//' | tr -d ':'
+}
+
+
+#
+# link_hash - create links to certificate files
+# arguments:
+# 1. the filename to create a link for
+# 2. the type of certificate being linked (x509, crl)
+# returns:
+# 0 on success, 1 otherwise
+#
+link_hash()
+{
+ local FINGERPRINT=$( fingerprint ${1} ${2} )
+ local HASH=$( ${SSL_CMD} ${2} -hash -noout -in ${1} )
+ local SUFFIX=0
+ local LINKFILE=''
+ local TAG=''
+
+ if [ ${2} = "crl" ]
+ then
+ TAG='r'
+ fi
+
+ LINKFILE=${HASH}.${TAG}${SUFFIX}
+
+ while [ -f ${LINKFILE} ]
+ do
+ if [ ${FINGERPRINT} = $( fingerprint ${LINKFILE} ${2} ) ]
+ then
+ echo "NOTE: Skipping duplicate file ${1}" >&2
+ return 1
+ fi
+
+ SUFFIX=$(( ${SUFFIX} + 1 ))
+ LINKFILE=${HASH}.${TAG}${SUFFIX}
+ done
+
+ echo "${3} => ${LINKFILE}"
+
+ # assume any system with a POSIX shell will either support symlinks or
+ # do something to handle this gracefully
+ ln -s ${3} ${LINKFILE}
+
+ return 0
+}
+
+
+# hash_dir create hash links in a given directory
+hash_dir()
+{
+ echo "Doing ${1}"
+
+ cd ${1}
+
+ ls -1 * 2>/dev/null | while read FILE
+ do
+ if echo ${FILE} | grep -q -E '^[[:xdigit:]]{8}\.r?[[:digit:]]+$' \
+ && [ -h "${FILE}" ]
+ then
+ rm ${FILE}
+ fi
+ done
+
+ ls -1 *.pem *.cer *.crt *.crl 2>/dev/null | while read FILE
+ do
+ REAL_FILE=${FILE}
+ # if we run on build host then get to the real files in rootfs
+ if [ -n "${SYSROOT}" -a -h ${FILE} ]
+ then
+ FILE=$( readlink ${FILE} )
+ # check the symlink is absolute (or dangling in other word)
+ if [ "x/" = "x$( echo ${FILE} | cut -c1 -)" ]
+ then
+ REAL_FILE=${SYSROOT}/${FILE}
+ fi
+ fi
+
+ check_file ${REAL_FILE}
+ local FILE_TYPE=${?}
+ local TYPE_STR=''
+
+ if [ $(( ${FILE_TYPE} & ${IS_CERT} )) -ne 0 ]
+ then
+ TYPE_STR='x509'
+ elif [ $(( ${FILE_TYPE} & ${IS_CRL} )) -ne 0 ]
+ then
+ TYPE_STR='crl'
+ else
+ echo "NOTE: ${FILE} does not contain a certificate or CRL: skipping" >&2
+ continue
+ fi
+
+ link_hash ${REAL_FILE} ${TYPE_STR} ${FILE}
+ done
+}
+
+
+# choose the name of an ssl application
+if [ -n "${OPENSSL}" ]
+then
+ SSL_CMD=$(which ${OPENSSL} 2>/dev/null)
+else
+ SSL_CMD=/usr/bin/openssl
+ OPENSSL=${SSL_CMD}
+ export OPENSSL
+fi
+
+# fix paths
+PATH=${PATH}:${DIR}/bin
+export PATH
+
+# confirm existance/executability of ssl command
+if ! [ -x ${SSL_CMD} ]
+then
+ echo "${0}: rehashing skipped ('openssl' program not available)" >&2
+ exit 0
+fi
+
+# determine which directories to process
+old_IFS=$IFS
+if [ ${#} -gt 0 ]
+then
+ IFS=':'
+ DIRLIST=${*}
+elif [ -n "${SSL_CERT_DIR}" ]
+then
+ DIRLIST=$SSL_CERT_DIR
+else
+ DIRLIST=${DIR}/certs
+fi
+
+IFS=':'
+
+# process directories
+for CERT_DIR in ${DIRLIST}
+do
+ if [ -d ${CERT_DIR} -a -w ${CERT_DIR} ]
+ then
+ IFS=$old_IFS
+ hash_dir ${CERT_DIR}
+ IFS=':'
+ fi
+done
diff --git a/meta/recipes-connectivity/openssl/openssl/openssl-fix-des.pod-error.patch b/meta/recipes-connectivity/openssl/openssl10/openssl-fix-des.pod-error.patch
similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl/openssl-fix-des.pod-error.patch
rename to meta/recipes-connectivity/openssl/openssl10/openssl-fix-des.pod-error.patch
diff --git a/meta/recipes-connectivity/openssl/openssl/openssl-util-perlpath.pl-cwd.patch b/meta/recipes-connectivity/openssl/openssl10/openssl-util-perlpath.pl-cwd.patch
similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl/openssl-util-perlpath.pl-cwd.patch
rename to meta/recipes-connectivity/openssl/openssl10/openssl-util-perlpath.pl-cwd.patch
diff --git a/meta/recipes-connectivity/openssl/openssl/openssl_fix_for_x32.patch b/meta/recipes-connectivity/openssl/openssl10/openssl_fix_for_x32.patch
similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl/openssl_fix_for_x32.patch
rename to meta/recipes-connectivity/openssl/openssl10/openssl_fix_for_x32.patch
diff --git a/meta/recipes-connectivity/openssl/openssl/parallel.patch b/meta/recipes-connectivity/openssl/openssl10/parallel.patch
similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl/parallel.patch
rename to meta/recipes-connectivity/openssl/openssl10/parallel.patch
diff --git a/meta/recipes-connectivity/openssl/openssl/ptest-deps.patch b/meta/recipes-connectivity/openssl/openssl10/ptest-deps.patch
similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl/ptest-deps.patch
rename to meta/recipes-connectivity/openssl/openssl10/ptest-deps.patch
diff --git a/meta/recipes-connectivity/openssl/openssl/ptest_makefile_deps.patch b/meta/recipes-connectivity/openssl/openssl10/ptest_makefile_deps.patch
similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl/ptest_makefile_deps.patch
rename to meta/recipes-connectivity/openssl/openssl10/ptest_makefile_deps.patch
diff --git a/meta/recipes-connectivity/openssl/openssl10/run-ptest b/meta/recipes-connectivity/openssl/openssl10/run-ptest
new file mode 100755
index 00000000000..3b20fce1ee9
--- /dev/null
+++ b/meta/recipes-connectivity/openssl/openssl10/run-ptest
@@ -0,0 +1,2 @@
+#!/bin/sh
+make -k runtest
diff --git a/meta/recipes-connectivity/openssl/openssl/shared-libs.patch b/meta/recipes-connectivity/openssl/openssl10/shared-libs.patch
similarity index 100%
rename from meta/recipes-connectivity/openssl/openssl/shared-libs.patch
rename to meta/recipes-connectivity/openssl/openssl10/shared-libs.patch
diff --git a/meta/recipes-connectivity/openssl/openssl_1.0.2l.bb b/meta/recipes-connectivity/openssl/openssl10_1.0.2l.bb
similarity index 96%
rename from meta/recipes-connectivity/openssl/openssl_1.0.2l.bb
rename to meta/recipes-connectivity/openssl/openssl10_1.0.2l.bb
index a2ef2ac8fb6..cf0459c94b5 100644
--- a/meta/recipes-connectivity/openssl/openssl_1.0.2l.bb
+++ b/meta/recipes-connectivity/openssl/openssl10_1.0.2l.bb
@@ -1,4 +1,4 @@
-require openssl.inc
+require openssl10.inc
# For target side versions of openssl enable support for OCF Linux driver
# if they are available.
@@ -12,7 +12,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=057d9218c6180e1d9ee407572b2dd225"
export DIRS = "crypto ssl apps engines"
export OE_LDFLAGS="${LDFLAGS}"
-SRC_URI += "file://find.pl;subdir=${BP}/util/ \
+SRC_URI += "file://find.pl;subdir=openssl-${PV}/util/ \
file://run-ptest \
file://openssl-c_rehash.sh \
file://configure-targets.patch \
diff --git a/meta/recipes-connectivity/openssl/openssl_1.1.0f.bb b/meta/recipes-connectivity/openssl/openssl_1.1.0f.bb
new file mode 100644
index 00000000000..8fedab522f8
--- /dev/null
+++ b/meta/recipes-connectivity/openssl/openssl_1.1.0f.bb
@@ -0,0 +1,155 @@
+SUMMARY = "Secure Socket Layer"
+DESCRIPTION = "Secure Socket Layer (SSL) binary and related cryptographic tools."
+HOMEPAGE = "http://www.openssl.org/"
+BUGTRACKER = "http://www.openssl.org/news/vulnerabilities.html"
+SECTION = "libs/network"
+
+# "openssl | SSLeay" dual license
+LICENSE = "openssl"
+LIC_FILES_CHKSUM = "file://LICENSE;md5=cae6da10f4ffd9703214776d2aabce32"
+
+BBCLASSEXTEND = "native nativesdk"
+
+SRC_URI[md5sum] = "7b521dea79ab159e8ec879d2333369fa"
+SRC_URI[sha256sum] = "12f746f3f2493b2f39da7ecf63d7ee19c6ac9ec6a4fcd8c229da8a522cb12765"
+
+SRC_URI = "http://www.openssl.org/source/openssl-${PV}.tar.gz \
+ file://run-ptest \
+ file://openssl-c_rehash.sh \
+ file://0001-Take-linking-flags-from-LDFLAGS-env-var.patch \
+ file://0001-Remove-test-that-requires-running-as-non-root.patch \
+ "
+
+S = "${WORKDIR}/openssl-${PV}"
+
+inherit lib_package multilib_header ptest
+
+do_configure () {
+ os=${HOST_OS}
+ case $os in
+ linux-uclibc |\
+ linux-uclibceabi |\
+ linux-gnueabi |\
+ linux-uclibcspe |\
+ linux-gnuspe |\
+ linux-musl*)
+ os=linux
+ ;;
+ *)
+ ;;
+ esac
+ target="$os-${HOST_ARCH}"
+ case $target in
+ linux-arm)
+ target=linux-armv4
+ ;;
+ linux-armeb)
+ target=linux-armv4
+ ;;
+ linux-aarch64*)
+ target=linux-aarch64
+ ;;
+ linux-sh3)
+ target=linux-generic32
+ ;;
+ linux-sh4)
+ target=linux-generic32
+ ;;
+ linux-i486)
+ target=linux-elf
+ ;;
+ linux-i586 | linux-viac3)
+ target=linux-elf
+ ;;
+ linux-i686)
+ target=linux-elf
+ ;;
+ linux-gnux32-x86_64)
+ target=linux-x32
+ ;;
+ linux-gnu64-x86_64)
+ target=linux-x86_64
+ ;;
+ linux-mips)
+ # specifying TARGET_CC_ARCH prevents openssl from (incorrectly) adding target architecture flags
+ target="linux-mips32 ${TARGET_CC_ARCH}"
+ ;;
+ linux-mipsel)
+ target="linux-mips32 ${TARGET_CC_ARCH}"
+ ;;
+ linux-gnun32-mips*)
+ target=linux-mips64
+ ;;
+ linux-*-mips64 | linux-mips64)
+ target=linux64-mips64
+ ;;
+ linux-*-mips64el | linux-mips64el)
+ target=linux64-mips64
+ ;;
+ linux-microblaze*|linux-nios2*)
+ target=linux-generic32
+ ;;
+ linux-powerpc)
+ target=linux-ppc
+ ;;
+ linux-powerpc64)
+ target=linux-ppc64
+ ;;
+ linux-supersparc)
+ target=linux-sparcv9
+ ;;
+ linux-sparc)
+ target=linux-sparcv9
+ ;;
+ darwin-i386)
+ target=darwin-i386-cc
+ ;;
+ esac
+ useprefix=${prefix}
+ if [ "x$useprefix" = "x" ]; then
+ useprefix=/
+ fi
+ perl ./Configure ${EXTRA_OECONF} --prefix=$useprefix --openssldir=${libdir}/ssl-1.1 --libdir=`basename ${libdir}` $target
+}
+
+#| engines/afalg/e_afalg.c: In function 'eventfd':
+#| engines/afalg/e_afalg.c:110:20: error: '__NR_eventfd' undeclared (first use in this function)
+#| return syscall(__NR_eventfd, n);
+#| ^~~~~~~~~~~~
+EXTRA_OECONF_aarch64 += "no-afalgeng"
+
+#| ./libcrypto.so: undefined reference to `getcontext'
+#| ./libcrypto.so: undefined reference to `setcontext'
+#| ./libcrypto.so: undefined reference to `makecontext'
+EXTRA_OECONF_libc-musl += "-DOPENSSL_NO_ASYNC"
+
+do_install () {
+ oe_runmake DESTDIR="${D}" MANDIR="${mandir}" MANSUFFIX=ssl install
+ oe_multilib_header openssl/opensslconf.h
+}
+
+do_install_append_class-native () {
+ # Install a custom version of c_rehash that can handle sysroots properly.
+ # This version is used for example when installing ca-certificates during
+ # image creation.
+ install -Dm 0755 ${WORKDIR}/openssl-c_rehash.sh ${D}${bindir}/c_rehash
+ sed -i -e 's,/etc/openssl,${sysconfdir}/ssl,g' ${D}${bindir}/c_rehash
+}
+
+do_install_ptest() {
+ cp -r * ${D}${PTEST_PATH}
+
+ # Putting .so files in ptest package will mess up the dependencies of the main openssl package
+ # so we rename them to .so.ptest and patch the test accordingly
+ mv ${D}${PTEST_PATH}/libcrypto.so ${D}${PTEST_PATH}/libcrypto.so.ptest
+ mv ${D}${PTEST_PATH}/libssl.so ${D}${PTEST_PATH}/libssl.so.ptest
+ sed -i 's/$target{shared_extension_simple}/".so.ptest"/' ${D}${PTEST_PATH}/test/recipes/90-test_shlibload.t
+}
+
+RDEPENDS_${PN}-ptest += "perl-module-file-spec-functions"
+
+FILES_${PN} =+ " ${libdir}/ssl-1.1/*"
+
+PACKAGES =+ "${PN}-engines"
+FILES_${PN}-engines = "${libdir}/engines-1.1"
+
--
2.13.2
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [PATCH 2/4] openssh: depend on openssl 1.0
2017-08-08 15:30 [PATCH 0/4] Add openssl 1.1 Alexander Kanavin
2017-08-08 15:30 ` [PATCH 1/4] openssl: add a 1.1 version Alexander Kanavin
@ 2017-08-08 15:30 ` Alexander Kanavin
2017-08-08 15:30 ` [PATCH 3/4] cryptodev-tests: " Alexander Kanavin
2017-08-08 15:30 ` [PATCH 4/4] gstreamer-plugins-bad: replace openssl dependency with nettle for hls plugin Alexander Kanavin
3 siblings, 0 replies; 12+ messages in thread
From: Alexander Kanavin @ 2017-08-08 15:30 UTC (permalink / raw)
To: openembedded-core
The proposed openssl 1.1 patches are here:
https://github.com/openssh/openssh-portable/pull/48
Openssl maintainers are not in a hurry to get 1.1 support in;
if it doesn't show up within reasonable time, we can take a patch
from Fedora:
http://lists.mindrot.org/pipermail/openssh-unix-dev/2016-November/035454.html
Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
---
meta/recipes-connectivity/openssh/openssh_7.5p1.bb | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/meta/recipes-connectivity/openssh/openssh_7.5p1.bb b/meta/recipes-connectivity/openssh/openssh_7.5p1.bb
index 7bd313bb4e8..3b8fd7d1cc5 100644
--- a/meta/recipes-connectivity/openssh/openssh_7.5p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_7.5p1.bb
@@ -8,7 +8,8 @@ SECTION = "console/network"
LICENSE = "BSD"
LIC_FILES_CHKSUM = "file://LICENCE;md5=e326045657e842541d3f35aada442507"
-DEPENDS = "zlib openssl"
+# openssl 1.1 patches are proposed at https://github.com/openssh/openssh-portable/pull/48
+DEPENDS = "zlib openssl10"
DEPENDS += "${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'libpam', '', d)}"
SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar.gz \
--
2.13.2
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [PATCH 3/4] cryptodev-tests: depend on openssl 1.0
2017-08-08 15:30 [PATCH 0/4] Add openssl 1.1 Alexander Kanavin
2017-08-08 15:30 ` [PATCH 1/4] openssl: add a 1.1 version Alexander Kanavin
2017-08-08 15:30 ` [PATCH 2/4] openssh: depend on openssl 1.0 Alexander Kanavin
@ 2017-08-08 15:30 ` Alexander Kanavin
2017-08-08 15:30 ` [PATCH 4/4] gstreamer-plugins-bad: replace openssl dependency with nettle for hls plugin Alexander Kanavin
3 siblings, 0 replies; 12+ messages in thread
From: Alexander Kanavin @ 2017-08-08 15:30 UTC (permalink / raw)
To: openembedded-core
Upstream ticket:
https://github.com/cryptodev-linux/cryptodev-linux/issues/22
Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
---
meta/recipes-kernel/cryptodev/cryptodev-tests_1.9.bb | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/recipes-kernel/cryptodev/cryptodev-tests_1.9.bb b/meta/recipes-kernel/cryptodev/cryptodev-tests_1.9.bb
index 9cb5dcb94f0..9afb3de217e 100644
--- a/meta/recipes-kernel/cryptodev/cryptodev-tests_1.9.bb
+++ b/meta/recipes-kernel/cryptodev/cryptodev-tests_1.9.bb
@@ -2,7 +2,7 @@ require cryptodev.inc
SUMMARY = "A test suite for /dev/crypto device driver"
-DEPENDS += "openssl"
+DEPENDS += "openssl10"
SRC_URI += " \
file://0001-Add-the-compile-and-install-rules-for-cryptodev-test.patch \
--
2.13.2
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [PATCH 4/4] gstreamer-plugins-bad: replace openssl dependency with nettle for hls plugin
2017-08-08 15:30 [PATCH 0/4] Add openssl 1.1 Alexander Kanavin
` (2 preceding siblings ...)
2017-08-08 15:30 ` [PATCH 3/4] cryptodev-tests: " Alexander Kanavin
@ 2017-08-08 15:30 ` Alexander Kanavin
2017-08-08 15:58 ` Mark Hatle
3 siblings, 1 reply; 12+ messages in thread
From: Alexander Kanavin @ 2017-08-08 15:30 UTC (permalink / raw)
To: openembedded-core
It has not been ported to openssl 1.1 (and there's nothing in upstream git),
but it's possible to use nettle or gcrypt intead.
Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
---
meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad.inc | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad.inc b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad.inc
index e964fef3f20..7427772a45f 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad.inc
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad.inc
@@ -40,9 +40,7 @@ PACKAGECONFIG[flite] = "--enable-flite,--disable-flite,flite-alsa"
PACKAGECONFIG[fluidsynth] = "--enable-fluidsynth,--disable-fluidsynth,fluidsynth"
PACKAGECONFIG[gles2] = "--enable-gles2,--disable-gles2,virtual/libgles2"
PACKAGECONFIG[gtk] = "--enable-gtk3,--disable-gtk3,gtk+3"
-# ensure OpenSSL is used for HLS AES description instead of nettle
-# (OpenSSL is a shared dependency with dtls)
-PACKAGECONFIG[hls] = "--enable-hls --with-hls-crypto=openssl,--disable-hls,openssl"
+PACKAGECONFIG[hls] = "--enable-hls --with-hls-crypto=nettle,--disable-hls,nettle"
PACKAGECONFIG[kms] = "--enable-kms,--disable-kms,libdrm"
PACKAGECONFIG[libmms] = "--enable-libmms,--disable-libmms,libmms"
PACKAGECONFIG[libssh2] = "--enable-libssh2,--disable-libssh2,libssh2"
--
2.13.2
^ permalink raw reply related [flat|nested] 12+ messages in thread
* Re: [PATCH 4/4] gstreamer-plugins-bad: replace openssl dependency with nettle for hls plugin
2017-08-08 15:30 ` [PATCH 4/4] gstreamer-plugins-bad: replace openssl dependency with nettle for hls plugin Alexander Kanavin
@ 2017-08-08 15:58 ` Mark Hatle
2017-08-08 17:35 ` Alexander Kanavin
0 siblings, 1 reply; 12+ messages in thread
From: Mark Hatle @ 2017-08-08 15:58 UTC (permalink / raw)
To: openembedded-core
On 8/8/17 10:30 AM, Alexander Kanavin wrote:
> It has not been ported to openssl 1.1 (and there's nothing in upstream git),
> but it's possible to use nettle or gcrypt intead.
>
> Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
> ---
> meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad.inc | 4 +---
> 1 file changed, 1 insertion(+), 3 deletions(-)
>
> diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad.inc b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad.inc
> index e964fef3f20..7427772a45f 100644
> --- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad.inc
> +++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad.inc
> @@ -40,9 +40,7 @@ PACKAGECONFIG[flite] = "--enable-flite,--disable-flite,flite-alsa"
> PACKAGECONFIG[fluidsynth] = "--enable-fluidsynth,--disable-fluidsynth,fluidsynth"
> PACKAGECONFIG[gles2] = "--enable-gles2,--disable-gles2,virtual/libgles2"
> PACKAGECONFIG[gtk] = "--enable-gtk3,--disable-gtk3,gtk+3"
> -# ensure OpenSSL is used for HLS AES description instead of nettle
> -# (OpenSSL is a shared dependency with dtls)
> -PACKAGECONFIG[hls] = "--enable-hls --with-hls-crypto=openssl,--disable-hls,openssl"
> +PACKAGECONFIG[hls] = "--enable-hls --with-hls-crypto=nettle,--disable-hls,nettle"
Can we somehow make openssl(10) or nettle a choice when compiling?
I ask because I've worked on a few systems where people seem to want one
encryption engine for as much of the system as possible (usually openssl).
While gstreamer has not been a problem in such systems, I could see it being
something that would need to be considered.
Otherwise no concerns with the rest of the patch set.
> PACKAGECONFIG[kms] = "--enable-kms,--disable-kms,libdrm"
> PACKAGECONFIG[libmms] = "--enable-libmms,--disable-libmms,libmms"
> PACKAGECONFIG[libssh2] = "--enable-libssh2,--disable-libssh2,libssh2"
>
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH 4/4] gstreamer-plugins-bad: replace openssl dependency with nettle for hls plugin
2017-08-08 15:58 ` Mark Hatle
@ 2017-08-08 17:35 ` Alexander Kanavin
2017-08-08 18:55 ` Mark Hatle
2017-08-08 19:14 ` Burton, Ross
0 siblings, 2 replies; 12+ messages in thread
From: Alexander Kanavin @ 2017-08-08 17:35 UTC (permalink / raw)
To: Mark Hatle, openembedded-core
On 08/08/2017 06:58 PM, Mark Hatle wrote:
> Can we somehow make openssl(10) or nettle a choice when compiling?
>
> I ask because I've worked on a few systems where people seem to want one
> encryption engine for as much of the system as possible (usually openssl).
> While gstreamer has not been a problem in such systems, I could see it being
> something that would need to be considered.
This would need to be done across all recipes where such choice is
supported, as a 'preferred crypto engine' distro feature. There's been
talk of doing this, but I don't remember what was the outcome.
Also, the plugin needs to be ported to 1.1 first, as the choice will
otherwise be taken away when 1.0 goes EOL.
Alex
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH 4/4] gstreamer-plugins-bad: replace openssl dependency with nettle for hls plugin
2017-08-08 17:35 ` Alexander Kanavin
@ 2017-08-08 18:55 ` Mark Hatle
2017-08-08 22:54 ` Andre McCurdy
2017-08-09 11:05 ` Alexander Kanavin
2017-08-08 19:14 ` Burton, Ross
1 sibling, 2 replies; 12+ messages in thread
From: Mark Hatle @ 2017-08-08 18:55 UTC (permalink / raw)
To: Alexander Kanavin, openembedded-core
On 8/8/17 12:35 PM, Alexander Kanavin wrote:
> On 08/08/2017 06:58 PM, Mark Hatle wrote:
>> Can we somehow make openssl(10) or nettle a choice when compiling?
>>
>> I ask because I've worked on a few systems where people seem to want one
>> encryption engine for as much of the system as possible (usually openssl).
>> While gstreamer has not been a problem in such systems, I could see it being
>> something that would need to be considered.
>
> This would need to be done across all recipes where such choice is
> supported, as a 'preferred crypto engine' distro feature. There's been
> talk of doing this, but I don't remember what was the outcome.
>
> Also, the plugin needs to be ported to 1.1 first, as the choice will
> otherwise be taken away when 1.0 goes EOL.
For now I'm fine with 1.0 support. So something like:
# ensure OpenSSL is used for HLS AES description instead of nettle
# (OpenSSL is a shared dependency with dtls)
PACKAGECONFIG[hls_openssl10] = "--enable-hls
--with-hls-crypto=openssl,--disable-hls,openssl10"
PACKAGECONFIG[hls] = "--enable-hls
--with-hls-crypto=nettle,--disable-hls,nettle"
But my concern is changing the choice of encryption engine could break various
existing uses. (Like I said, -I- don't have that use, but I expect others do..
perhaps not with gstreamer-plugins-bad though?)
--Mark
> Alex
>
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH 4/4] gstreamer-plugins-bad: replace openssl dependency with nettle for hls plugin
2017-08-08 17:35 ` Alexander Kanavin
2017-08-08 18:55 ` Mark Hatle
@ 2017-08-08 19:14 ` Burton, Ross
2017-08-08 20:41 ` Mark Hatle
1 sibling, 1 reply; 12+ messages in thread
From: Burton, Ross @ 2017-08-08 19:14 UTC (permalink / raw)
To: Alexander Kanavin; +Cc: OE-core
[-- Attachment #1: Type: text/plain, Size: 1234 bytes --]
On 8 August 2017 at 18:35, Alexander Kanavin <
alexander.kanavin@linux.intel.com> wrote:
> On 08/08/2017 06:58 PM, Mark Hatle wrote:
>
>> Can we somehow make openssl(10) or nettle a choice when compiling?
>>
>> I ask because I've worked on a few systems where people seem to want one
>> encryption engine for as much of the system as possible (usually openssl).
>> While gstreamer has not been a problem in such systems, I could see it
>> being
>> something that would need to be considered.
>>
>
> This would need to be done across all recipes where such choice is
> supported, as a 'preferred crypto engine' distro feature. There's been talk
> of doing this, but I don't remember what was the outcome.
>
There was a bug for this but I literally closed it earlier today on the
grounds that it would mean patching every user of a crypto library to add
an abstraction and alternative codepaths. If you don't patch every
instance then there is no point in a global option.
We can have packageconfigs, and expose the choice if the upstream does, but
I think the only sane option is to leave it to the user to set the
options. It's trivial enough to blacklist openssl if you never want to use
it.
Ross
[-- Attachment #2: Type: text/html, Size: 1755 bytes --]
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH 4/4] gstreamer-plugins-bad: replace openssl dependency with nettle for hls plugin
2017-08-08 19:14 ` Burton, Ross
@ 2017-08-08 20:41 ` Mark Hatle
0 siblings, 0 replies; 12+ messages in thread
From: Mark Hatle @ 2017-08-08 20:41 UTC (permalink / raw)
To: Burton, Ross, Alexander Kanavin; +Cc: OE-core
On 8/8/17 2:14 PM, Burton, Ross wrote:
> On 8 August 2017 at 18:35, Alexander Kanavin <alexander.kanavin@linux.intel.com
> <mailto:alexander.kanavin@linux.intel.com>> wrote:
>
> On 08/08/2017 06:58 PM, Mark Hatle wrote:
>
> Can we somehow make openssl(10) or nettle a choice when compiling?
>
> I ask because I've worked on a few systems where people seem to want one
> encryption engine for as much of the system as possible (usually openssl).
> While gstreamer has not been a problem in such systems, I could see it being
> something that would need to be considered.
>
>
> This would need to be done across all recipes where such choice is
> supported, as a 'preferred crypto engine' distro feature. There's been talk
> of doing this, but I don't remember what was the outcome.
>
>
> There was a bug for this but I literally closed it earlier today on the grounds
> that it would mean patching every user of a crypto library to add an abstraction
> and alternative codepaths. If you don't patch every instance then there is no
> point in a global option.
Getting a bit off-topic here, but...
I do expect that at some point in the future someone will come along and offer a
distribution wide setting for preferred (and alternative) encryption and make
the associated changes to the various recipes to enforce this.
Many of the systems I am working with are starting to have those types of needs.
A preferred encryption resource that everything that can - should use. Along
with alternatives that are 'acceptable' if the primary isn't available.
Otherwise other encryption would be prohibited and should trigger an automatic
blacklist or failure.
(In this case, there is a lot of work to be done, and potentially any encryption
user/provider [even internal] needs to be audited. This is not an 'over night'
process... thus I doubt you'll be seeing it tomorrow from anyone here.)
So don't necessarily dismiss the idea -- but I do think it's outside of the
immediate scope for the Yocto Project itself, but I would expect something to
eventually be presented by a member of the larger OpenEmbedded community.
--Mark
> We can have packageconfigs, and expose the choice if the upstream does, but I
> think the only sane option is to leave it to the user to set the options. It's
> trivial enough to blacklist openssl if you never want to use it.
>
> Ross
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH 4/4] gstreamer-plugins-bad: replace openssl dependency with nettle for hls plugin
2017-08-08 18:55 ` Mark Hatle
@ 2017-08-08 22:54 ` Andre McCurdy
2017-08-09 11:05 ` Alexander Kanavin
1 sibling, 0 replies; 12+ messages in thread
From: Andre McCurdy @ 2017-08-08 22:54 UTC (permalink / raw)
To: Mark Hatle; +Cc: OE Core mailing list
On Tue, Aug 8, 2017 at 11:55 AM, Mark Hatle <mark.hatle@windriver.com> wrote:
> On 8/8/17 12:35 PM, Alexander Kanavin wrote:
>> On 08/08/2017 06:58 PM, Mark Hatle wrote:
>>> Can we somehow make openssl(10) or nettle a choice when compiling?
>>>
>>> I ask because I've worked on a few systems where people seem to want one
>>> encryption engine for as much of the system as possible (usually openssl).
>>> While gstreamer has not been a problem in such systems, I could see it being
>>> something that would need to be considered.
>>
>> This would need to be done across all recipes where such choice is
>> supported, as a 'preferred crypto engine' distro feature. There's been
>> talk of doing this, but I don't remember what was the outcome.
>>
>> Also, the plugin needs to be ported to 1.1 first, as the choice will
>> otherwise be taken away when 1.0 goes EOL.
>
> For now I'm fine with 1.0 support. So something like:
>
> # ensure OpenSSL is used for HLS AES description instead of nettle
> # (OpenSSL is a shared dependency with dtls)
> PACKAGECONFIG[hls_openssl10] = "--enable-hls
> --with-hls-crypto=openssl,--disable-hls,openssl10"
>
> PACKAGECONFIG[hls] = "--enable-hls
> --with-hls-crypto=nettle,--disable-hls,nettle"
>
> But my concern is changing the choice of encryption engine could break various
> existing uses. (Like I said, -I- don't have that use, but I expect others do..
> perhaps not with gstreamer-plugins-bad though?)
I looked at the gstreamer code briefly and the crypto dependency seems
fairly trivial (basically just AES decryption) so switching between
openssl and nettle doesn't look like it's going to be a big risk (even
for users obliged to avoid the LGPLv3 version of nettle in oe-core).
For reference, the problem with openssl 1.1 seems to be that gstreamer
embeds an openssl EVP_CIPHER_CTX struct directly within the
GstHLSDemuxStream struct, but openssl 1.1 requires that such structs
are now allocated and freed dynamically:
https://wiki.openssl.org/index.php/OpenSSL_1.1.0_Changes
https://cgit.freedesktop.org/gstreamer/gst-plugins-bad/tree/ext/hls/gsthlsdemux.h#n84
>
> --
> _______________________________________________
> Openembedded-core mailing list
> Openembedded-core@lists.openembedded.org
> http://lists.openembedded.org/mailman/listinfo/openembedded-core
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH 4/4] gstreamer-plugins-bad: replace openssl dependency with nettle for hls plugin
2017-08-08 18:55 ` Mark Hatle
2017-08-08 22:54 ` Andre McCurdy
@ 2017-08-09 11:05 ` Alexander Kanavin
1 sibling, 0 replies; 12+ messages in thread
From: Alexander Kanavin @ 2017-08-09 11:05 UTC (permalink / raw)
To: Mark Hatle, openembedded-core
On 08/08/2017 09:55 PM, Mark Hatle wrote:
> For now I'm fine with 1.0 support. So something like:
>
> # ensure OpenSSL is used for HLS AES description instead of nettle
> # (OpenSSL is a shared dependency with dtls)
> PACKAGECONFIG[hls_openssl10] = "--enable-hls
> --with-hls-crypto=openssl,--disable-hls,openssl10"
>
> PACKAGECONFIG[hls] = "--enable-hls
> --with-hls-crypto=nettle,--disable-hls,nettle"
Sure, I can amend the patch.
> But my concern is changing the choice of encryption engine could break various
> existing uses. (Like I said, -I- don't have that use, but I expect others do..
> perhaps not with gstreamer-plugins-bad though?)
You can say the same thing about almost anything that goes into master.
In this case it doesn't matter, as there is a trivial way to revert the
choice, but if the change was more involved, I would appreciate more
specific evidence that this indeed causes real problems.
Alex
^ permalink raw reply [flat|nested] 12+ messages in thread
end of thread, other threads:[~2017-08-09 11:08 UTC | newest]
Thread overview: 12+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-08-08 15:30 [PATCH 0/4] Add openssl 1.1 Alexander Kanavin
2017-08-08 15:30 ` [PATCH 1/4] openssl: add a 1.1 version Alexander Kanavin
2017-08-08 15:30 ` [PATCH 2/4] openssh: depend on openssl 1.0 Alexander Kanavin
2017-08-08 15:30 ` [PATCH 3/4] cryptodev-tests: " Alexander Kanavin
2017-08-08 15:30 ` [PATCH 4/4] gstreamer-plugins-bad: replace openssl dependency with nettle for hls plugin Alexander Kanavin
2017-08-08 15:58 ` Mark Hatle
2017-08-08 17:35 ` Alexander Kanavin
2017-08-08 18:55 ` Mark Hatle
2017-08-08 22:54 ` Andre McCurdy
2017-08-09 11:05 ` Alexander Kanavin
2017-08-08 19:14 ` Burton, Ross
2017-08-08 20:41 ` Mark Hatle
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.