From: Mikhail Novosyolov <m.novosyolov@rosalinux.ru>
To: keyrings@vger.kernel.org
Cc: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Subject: Re: sign-file: full functionality with modern LibreSSL
Date: Sun, 10 May 2020 18:51:15 +0300 [thread overview]
Message-ID: <375f18b9-c23a-7f59-4432-374816725a79@rosalinux.ru> (raw)
In-Reply-To: <f13b4174-bcfa-6569-0601-65a9bfc9bb92@rosalinux.ru>
19.03.2020 00:31, Mikhail Novosyolov пишет:
> Current pre-release version of LibreSSL has enabled CMS support,
> and now sign-file is fully functional with it.
>
> See https://github.com/libressl-portable/openbsd/commits/master
>
> To test buildability with current LibreSSL:
> ~$ git clone https://github.com/libressl-portable/portable.git
> ~$ cd portable && ./autogen.sh
> ~$ ./configure --prefix=/opt/libressl
> ~$ make
> ~# make install
> Go to the kernel source tree and:
> ~$ gcc -I/opt/libressl/include -L /opt/libressl/lib -lcrypto -Wl,-rpath,/opt/libressl/lib scripts/sign-file.c -o scripts/sign-file
>
> Fixes: f8688017 ("sign-file: fix build error in sign-file.c with libressl")
>
> Signed-off-by: Mikhail Novosyolov <m.novosyolov@rosalinux.ru>
I would like to remember about this.
LibreSSL 3.1.1 has been released, and this patch (https://patchwork.kernel.org/patch/11446123/) is required to sign kernel modules using libressl.
Libressl 3.1.1 can sign them with functional parity with OpenSSL.
> ---
> scripts/sign-file.c | 7 ++++---
> 1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/scripts/sign-file.c b/scripts/sign-file.c
> index fbd34b8e8f57..fd4d7c31d1bf 100644
> --- a/scripts/sign-file.c
> +++ b/scripts/sign-file.c
> @@ -41,9 +41,10 @@
> * signing with anything other than SHA1 - so we're stuck with that if such is
> * the case.
> */
> -#if defined(LIBRESSL_VERSION_NUMBER) || \
> - OPENSSL_VERSION_NUMBER < 0x10000000L || \
> - defined(OPENSSL_NO_CMS)
> +#if defined(OPENSSL_NO_CMS) || \
> + ( defined(LIBRESSL_VERSION_NUMBER) \
> + && (LIBRESSL_VERSION_NUMBER < 0x3010000fL) ) || \
> + OPENSSL_VERSION_NUMBER < 0x10000000L
> #define USE_PKCS7
> #endif
> #ifndef USE_PKCS7
prev parent reply other threads:[~2020-05-10 15:57 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-03-18 21:31 sign-file: full functionality with modern LibreSSL Mikhail Novosyolov
2020-05-10 15:51 ` Mikhail Novosyolov [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=375f18b9-c23a-7f59-4432-374816725a79@rosalinux.ru \
--to=m.novosyolov@rosalinux.ru \
--cc=keyrings@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).