* [PATCH v2 1/1] sign-file: Use OpenSSL provided define to compile out missing (deprecated) APIs
@ 2021-10-06 9:09 Lee Jones
0 siblings, 0 replies; only message in thread
From: Lee Jones @ 2021-10-06 9:09 UTC (permalink / raw)
To: lee.jones
Cc: linux-kernel, David Howells, David Woodhouse, Eric Biggers,
keyrings, Adam Langley
OpenSSL's ENGINE API is deprecated in OpenSSL v3.0.
Use OPENSSL_NO_ENGINE to ensure the ENGINE API is only used if it is
present. This will safeguard against compile errors when using SSL
implementations which lack support for this deprecated API.
>>> referenced by sign-file.c
>>> /tmp/sign-file-370a2f.o:(main)
error: undefined symbol: ENGINE_init
>>> referenced by sign-file.c
>>> /tmp/sign-file-370a2f.o:(main)
ld.lld: error: undefined symbol: ENGINE_ctrl_cmd_string
>>> referenced by sign-file.c
>>> /tmp/sign-file-370a2f.o:(main)
ld.lld: error: undefined symbol: ENGINE_load_private_key
>>> referenced by sign-file.c
>>> /tmp/sign-file-370a2f.o:(main)
HDRINST usr/include/linux/virtio_i2c.h
make[1]: *** [/src/kernel/scripts/Makefile.host:95: scripts/sign-file] Error 1
Cc: David Howells <dhowells@redhat.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: Eric Biggers <ebiggers@kernel.org>
Cc: keyrings@vger.kernel.org
Co-developed-by: Adam Langley <agl@google.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
---
v1 => v2:
- Update commit message, as suggested-by Eric Biggers
scripts/sign-file.c | 19 ++++++++++---------
1 file changed, 10 insertions(+), 9 deletions(-)
diff --git a/scripts/sign-file.c b/scripts/sign-file.c
index fbd34b8e8f578..fa3fa59db6669 100644
--- a/scripts/sign-file.c
+++ b/scripts/sign-file.c
@@ -135,7 +135,9 @@ static int pem_pw_cb(char *buf, int len, int w, void *v)
static EVP_PKEY *read_private_key(const char *private_key_name)
{
EVP_PKEY *private_key;
+ BIO *b;
+#ifndef OPENSSL_NO_ENGINE
if (!strncmp(private_key_name, "pkcs11:", 7)) {
ENGINE *e;
@@ -153,17 +155,16 @@ static EVP_PKEY *read_private_key(const char *private_key_name)
private_key = ENGINE_load_private_key(e, private_key_name,
NULL, NULL);
ERR(!private_key, "%s", private_key_name);
- } else {
- BIO *b;
-
- b = BIO_new_file(private_key_name, "rb");
- ERR(!b, "%s", private_key_name);
- private_key = PEM_read_bio_PrivateKey(b, NULL, pem_pw_cb,
- NULL);
- ERR(!private_key, "%s", private_key_name);
- BIO_free(b);
+ return private_key;
}
+#endif
+ b = BIO_new_file(private_key_name, "rb");
+ ERR(!b, "%s", private_key_name);
+ private_key = PEM_read_bio_PrivateKey(b, NULL, pem_pw_cb,
+ NULL);
+ ERR(!private_key, "%s", private_key_name);
+ BIO_free(b);
return private_key;
}
--
2.33.0.800.g4c38ced690-goog
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2021-10-06 9:09 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-10-06 9:09 [PATCH v2 1/1] sign-file: Use OpenSSL provided define to compile out missing (deprecated) APIs Lee Jones
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).