openssl: rename openssl 1.0.x to openssl10 and make openssl 1.1.x the default version
RFC PATCH 1/5 openssl: rename openssl 1.0.x to openssl10 and make openssl 1.1.x the default version
I believe the time has come to do this: openssl 1.0 upstream support stops at the end of 2019, and we do not want a situation where a supported YP release contains an unsupported version of a critical security component.
Openssl 1.0 can still be utilized by depending on 'openssl10' recipe.
Signed-off-by Alexander Kanavin <[email protected]>
---
meta/conf/distro/include/default-versions.inc | 3 ---
meta/conf/distro/include/maintainers.inc | 1 +
meta/recipes-connectivity/openssl/openssl10.inc | 17 +++++++++++++++--
...-Fix-build-with-clang-using-external-assembler.patch | 0
...001-openssl-force-soft-link-to-avoid-rare-race.patch | 0
.../{openssl-1.0.2o => openssl10}/Makefiles-ptest.patch | 0
.../Use-SHA256-not-MD5-as-default-digest.patch | 0
.../configure-musl-target.patch | 0
.../configure-targets.patch | 0
.../debian/c_rehash-compat.patch | 0
.../{openssl-1.0.2o => openssl10}/debian/ca.patch | 0
.../debian/debian-targets.patch | 0
.../{openssl-1.0.2o => openssl10}/debian/man-dir.patch | 0
.../debian/man-section.patch | 0
.../{openssl-1.0.2o => openssl10}/debian/no-rpath.patch | 0
.../debian/no-symbolic.patch | 0
.../{openssl-1.0.2o => openssl10}/debian/pic.patch | 0
.../debian1.0.2/block_digicert_malaysia.patch | 0
.../debian1.0.2/block_diginotar.patch | 0
.../debian1.0.2/soname.patch | 0
.../debian1.0.2/version-script.patch | 0
.../engines-install-in-libdir-ssl.patch | 0
.../openssl/{openssl-1.0.2o => openssl10}/find.pl | 0
.../{openssl-1.0.2o => openssl10}/oe-ldflags.patch | 0
.../{openssl-1.0.2o => openssl10}/openssl-c_rehash.sh | 0
.../openssl-fix-des.pod-error.patch | 0
.../openssl-util-perlpath.pl-cwd.patch | 0
.../openssl_fix_for_x32.patch | 0
.../{openssl-1.0.2o => openssl10}/parallel.patch | 0
.../{openssl-1.0.2o => openssl10}/ptest-deps.patch | 0
.../ptest_makefile_deps.patch | 0
.../reproducible-cflags.patch | 0
.../reproducible-mkbuildinf.patch | 0
.../openssl/{openssl-1.0.2o => openssl10}/run-ptest | 0
.../{openssl-1.0.2o => openssl10}/shared-libs.patch | 0
.../openssl/{openssl_1.0.2o.bb => openssl10_1.0.2o.bb} | 0
36 files changed, 16 insertions(+), 5 deletions(-)
rename meta/recipes-connectivity/openssl/{openssl-1.0.2o => openssl10}/0001-Fix-build-with-clang-using-external-assembler.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.2o => openssl10}/0001-openssl-force-soft-link-to-avoid-rare-race.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.2o => openssl10}/Makefiles-ptest.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.2o => openssl10}/Use-SHA256-not-MD5-as-default-digest.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.2o => openssl10}/configure-musl-target.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.2o => openssl10}/configure-targets.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.2o => openssl10}/debian/c_rehash-compat.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.2o => openssl10}/debian/ca.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.2o => openssl10}/debian/debian-targets.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.2o => openssl10}/debian/man-dir.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.2o => openssl10}/debian/man-section.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.2o => openssl10}/debian/no-rpath.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.2o => openssl10}/debian/no-symbolic.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.2o => openssl10}/debian/pic.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.2o => openssl10}/debian1.0.2/block_digicert_malaysia.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.2o => openssl10}/debian1.0.2/block_diginotar.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.2o => openssl10}/debian1.0.2/soname.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.2o => openssl10}/debian1.0.2/version-script.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.2o => openssl10}/engines-install-in-libdir-ssl.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.2o => openssl10}/find.pl (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.2o => openssl10}/oe-ldflags.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.2o => openssl10}/openssl-c_rehash.sh (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.2o => openssl10}/openssl-fix-des.pod-error.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.2o => openssl10}/openssl-util-perlpath.pl-cwd.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.2o => openssl10}/openssl_fix_for_x32.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.2o => openssl10}/parallel.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.2o => openssl10}/ptest-deps.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.2o => openssl10}/ptest_makefile_deps.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.2o => openssl10}/reproducible-cflags.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.2o => openssl10}/reproducible-mkbuildinf.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.2o => openssl10}/run-ptest (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.2o => openssl10}/shared-libs.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl_1.0.2o.bb => openssl10_1.0.2o.bb} (100%)meta/conf/distro/include/default-versions.inc +0 -3
@@ -2,6 +2,3 @@ # Default preferred versions # -PREFERRED_VERSION_openssl = "1.0.%" -PREFERRED_VERSION_openssl-native = "1.0.%" -PREFERRED_VERSION_nativesdk-openssl = "1.0.%"
meta/conf/distro/include/maintainers.inc +1 -0
@@ -544,6 +544,7 @@ RECIPE_MAINTAINER_pn-ofono = "Maxin B. John <[email protected]>" RECIPE_MAINTAINER_pn-oh-puzzles = "Maxin B. John <[email protected]>" RECIPE_MAINTAINER_pn-openssh = "Armin Kuster <[email protected]>" RECIPE_MAINTAINER_pn-openssl = "Alexander Kanavin <[email protected]>" +RECIPE_MAINTAINER_pn-openssl10 = "Alexander Kanavin <[email protected]>" RECIPE_MAINTAINER_pn-opkg = "Alejandro del Castillo <[email protected]>" RECIPE_MAINTAINER_pn-opkg-arch-config = "Alejandro del Castillo <[email protected]>" RECIPE_MAINTAINER_pn-opkg-keyrings = "Alejandro del Castillo <[email protected]>"
meta/recipes-connectivity/openssl/openssl10.inc +15 -2
@@ -11,8 +11,6 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=f9a8f968107345e0b75aa8c2ecaa7ec8" DEPENDS = "makedepend-native hostperl-runtime-native" DEPENDS_append_class-target = " openssl-native" -PROVIDES += "openssl10" - SRC_URI = "http://www.openssl.org/source/openssl-${PV}.tar.gz \ " S = "${WORKDIR}/openssl-${PV}"
@@ -283,3 +281,18 @@ do_install_append_class-native() { BBCLASSEXTEND = "native nativesdk" +PACKAGE_PREPROCESS_FUNCS += "openssl_package_preprocess" + +# openssl 1.0 development files and executable binaries clash with openssl 1.1 +# files when installed into target rootfs. So we don't put them into +# packages, but they continue to be provided via target sysroot for +# cross-compilation on the host, if some software still depends on openssl 1.0. +openssl_package_preprocess () { + for file in `find ${PKGD} -name *.h -o -name *.pc -o -name *.so`; do + rm $file + done + rm ${PKGD}/usr/bin/openssl + rm ${PKGD}/usr/bin/c_rehash + rmdir ${PKGD}/usr/bin + +}
meta/recipes-connectivity/openssl/openssl10/0001-Fix-build-with-clang-using-external-assembler.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.2o/0001-Fix-build-with-clang-using-external-assembler.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/0001-openssl-force-soft-link-to-avoid-rare-race.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.2o/0001-openssl-force-soft-link-to-avoid-rare-race.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/Makefiles-ptest.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.2o/Makefiles-ptest.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/Use-SHA256-not-MD5-as-default-digest.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.2o/Use-SHA256-not-MD5-as-default-digest.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/configure-musl-target.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.2o/configure-musl-target.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/configure-targets.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.2o/configure-targets.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/debian/c_rehash-compat.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.2o/debian/c_rehash-compat.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/debian/ca.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.2o/debian/ca.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/debian/debian-targets.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.2o/debian/debian-targets.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/debian/man-dir.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.2o/debian/man-dir.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/debian/man-section.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.2o/debian/man-section.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/debian/no-rpath.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.2o/debian/no-rpath.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/debian/no-symbolic.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.2o/debian/no-symbolic.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/debian/pic.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.2o/debian/pic.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/debian1.0.2/block_digicert_malaysia.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.2o/debian1.0.2/block_digicert_malaysia.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/debian1.0.2/block_diginotar.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.2o/debian1.0.2/block_diginotar.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/debian1.0.2/soname.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.2o/debian1.0.2/soname.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/debian1.0.2/version-script.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.2o/debian1.0.2/version-script.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/engines-install-in-libdir-ssl.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.2o/engines-install-in-libdir-ssl.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/find.pl renamed from meta/recipes-connectivity/openssl/openssl-1.0.2o/find.pl +0 -0
meta/recipes-connectivity/openssl/openssl10/oe-ldflags.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.2o/oe-ldflags.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/openssl-c_rehash.sh renamed from meta/recipes-connectivity/openssl/openssl-1.0.2o/openssl-c_rehash.sh +0 -0
meta/recipes-connectivity/openssl/openssl10/openssl-fix-des.pod-error.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.2o/openssl-fix-des.pod-error.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/openssl-util-perlpath.pl-cwd.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.2o/openssl-util-perlpath.pl-cwd.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/openssl_fix_for_x32.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.2o/openssl_fix_for_x32.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/parallel.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.2o/parallel.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/ptest-deps.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.2o/ptest-deps.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/ptest_makefile_deps.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.2o/ptest_makefile_deps.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/reproducible-cflags.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.2o/reproducible-cflags.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/reproducible-mkbuildinf.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.2o/reproducible-mkbuildinf.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/run-ptest renamed from meta/recipes-connectivity/openssl/openssl-1.0.2o/run-ptest +0 -0
meta/recipes-connectivity/openssl/openssl10/shared-libs.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.2o/shared-libs.patch +0 -0
meta/recipes-connectivity/openssl/openssl10_1.0.2o.bb renamed from meta/recipes-connectivity/openssl/openssl_1.0.2o.bb +0 -0
Signature · 1 line
2.16.1
RFC PATCH 2/5 cryptodev-tests: port to openssl 1.1
This leaves openssh as the only recipe that requires openssl 1.0 (or libressl).
Signed-off-by Alexander Kanavin <[email protected]>
--- .../cryptodev/cryptodev-tests_1.9.bb | 3 +- .../files/0001-Port-tests-to-openssl-1.1.patch | 103 +++++++++++++++++++++ 2 files changed, 105 insertions(+), 1 deletion(-) create mode 100644 meta/recipes-kernel/cryptodev/files/0001-Port-tests-to-openssl-1.1.patch
meta/recipes-kernel/cryptodev/cryptodev-tests_1.9.bb +2 -1
@@ -2,10 +2,11 @@ require cryptodev.inc SUMMARY = "A test suite for /dev/crypto device driver" -DEPENDS += "openssl10" +DEPENDS += "openssl" SRC_URI += " \ file://0001-Add-the-compile-and-install-rules-for-cryptodev-test.patch \ +file://0001-Port-tests-to-openssl-1.1.patch \ " EXTRA_OEMAKE='KERNEL_DIR="${STAGING_EXECPREFIXDIR}" PREFIX="${D}"'
meta/recipes-kernel/cryptodev/files/0001-Port-tests-to-openssl-1.1.patch new file +103 -0
103 lines not on this page · raw message
Signature · 1 line
2.16.1
RFC PATCH 3/5 openssl: update to 1.1.1
In reply to Alexander KanavinAt the moment 1.1.1 is in pre-release stage, however the final release should be available within a few weeks. The major selling point is that it supports the new TLS 1.3 specification. At the moment it is not clear whether this also will be a long term support version of openssl; we can make the decision to merge this version once that is made clear by upstream. More information:
https://www.openssl.org/policies/releasestrat.html
Signed-off-by Alexander Kanavin <[email protected]>
---
...1-Take-linking-flags-from-LDFLAGS-env-var.patch | 43 ----------------------
.../{openssl_1.1.0h.bb => openssl_1.1.1-pre4.bb} | 21 +++++------
2 files changed, 10 insertions(+), 54 deletions(-)
delete mode 100644 meta/recipes-connectivity/openssl/openssl/0001-Take-linking-flags-from-LDFLAGS-env-var.patch
rename meta/recipes-connectivity/openssl/{openssl_1.1.0h.bb => openssl_1.1.1-pre4.bb} (83%)meta/recipes-connectivity/openssl/openssl/0001-Take-linking-flags-from-LDFLAGS-env-var.patch deleted +0 -43
@@ -1,43 +0,0 @@ -From 08face4353d80111973aba9c1304c92158cfad0e Mon Sep 17 00:00:00 2001 -From: Alexander Kanavin <[email protected]> -Date: Tue, 28 Mar 2017 16:40:12 +0300 -Subject: [PATCH] Take linking flags from LDFLAGS env var - -This fixes "No GNU_HASH in the elf binary" issues. - -Upstream-Status: Inappropriate [oe-core specific] -Signed-off-by: Alexander Kanavin <[email protected]> ---- - Configurations/unix-Makefile.tmpl | 2 +- - Configure | 2 +- - 2 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/Configurations/unix-Makefile.tmpl b/Configurations/unix-Makefile.tmpl -index c029817..43b769b 100644 ---- a/Configurations/unix-Makefile.tmpl -+++ b/Configurations/unix-Makefile.tmpl -@@ -173,7 +173,7 @@ CROSS_COMPILE= {- $config{cross_compile_prefix} -} - CC= $(CROSS_COMPILE){- $target{cc} -} - CFLAGS={- our $cflags2 = join(" ",(map { "-D".$_} @{$target{defines}}, @{$config{defines}}),"-DOPENSSLDIR=\"\\\"\$(OPENSSLDIR)\\\"\"","-DENGINESDIR=\"\\\"\$(ENGINESDIR)\\\"\"") -} {- $target{cflags} -} {- $config{cflags} -} - CFLAGS_Q={- $cflags2 =~ s|([\\"])|\\$1|g; $cflags2 -} {- $config{cflags} -} --LDFLAGS= {- $target{lflags} -} -+LDFLAGS= {- $target{lflags}." ".$ENV{'LDFLAGS'} -} - PLIB_LDFLAGS= {- $target{plib_lflags} -} - EX_LIBS= {- $target{ex_libs} -} {- $config{ex_libs} -} - LIB_CFLAGS={- $target{shared_cflag} || "" -} -diff --git a/Configure b/Configure -index aee7cc3..274d236 100755 ---- a/Configure -+++ b/Configure -@@ -979,7 +979,7 @@ $config{build_file} = $target{build_file}; - $config{defines} = []; - $config{cflags} = ""; - $config{ex_libs} = ""; --$config{shared_ldflag} = ""; -+$config{shared_ldflag} = $ENV{'LDFLAGS'}; - - # Make sure build_scheme is consistent. - $target{build_scheme} = [ $target{build_scheme} ] --- -2.11.0 -
meta/recipes-connectivity/openssl/openssl_1.1.1-pre4.bb renamed from meta/recipes-connectivity/openssl/openssl_1.1.0h.bb +10 -11
@@ -10,13 +10,12 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=d57d511030c9d66ef5f5966bee5a7eff" BBCLASSEXTEND = "native nativesdk" -SRC_URI[md5sum] = "5271477e4d93f4ea032b665ef095ff24" -SRC_URI[sha256sum] = "5835626cde9e99656585fc7aaa2302a73a7e1340bf8c14fd635a62c66802a517" +SRC_URI[md5sum] = "07c3f6831fb6dfe975795ef7bbbee9fc" +SRC_URI[sha256sum] = "df2d5fcc2a878525611c75b9e9116fbcfbce8d9b96419a16eda5fb11ecc428f6" SRC_URI = "http://www.openssl.org/source/openssl-${PV}.tar.gz \ file://run-ptest \ file://openssl-c_rehash.sh \ - file://0001-Take-linking-flags-from-LDFLAGS-env-var.patch \ " S = "${WORKDIR}/openssl-${PV}"
@@ -114,20 +113,20 @@ do_configure () { if [ "x$useprefix" = "x" ]; then useprefix=/ fi - libdirleaf="$(echo ${libdir} | sed s:$useprefix::)" - perl ./Configure ${EXTRA_OECONF} --prefix=$useprefix --openssldir=${libdir}/ssl-1.1 --libdir=${libdirleaf} $target + # WARNING: do not set compiler/linker flags (-I/-D etc.) in EXTRA_OECONF, as they will fully replace the + # environment variables set by bitbake. Adjust the environment variables instead. + perl ./Configure ${EXTRA_OECONF} --prefix=$useprefix --openssldir=${libdir}/ssl-1.1 --libdir=${libdir} $target } -#| engines/afalg/e_afalg.c: In function 'eventfd': -#| engines/afalg/e_afalg.c:110:20: error: '__NR_eventfd' undeclared (first use in this function) -#| return syscall(__NR_eventfd, n); -#| ^~~~~~~~~~~~ -EXTRA_OECONF_aarch64 += "no-afalgeng" +# This prevents openssl from using getrandom() which is not available on older glibc versions +# (native versions can be built with newer glibc, but then relocated onto a system with older glibc) +EXTRA_OECONF_class-native += "--with-rand-seed=devrandom" +EXTRA_OECONF_class-nativesdk += "--with-rand-seed=devrandom" #| ./libcrypto.so: undefined reference to `getcontext' #| ./libcrypto.so: undefined reference to `setcontext' #| ./libcrypto.so: undefined reference to `makecontext' -EXTRA_OECONF_libc-musl += "-DOPENSSL_NO_ASYNC" +CPPFLAGS_libc-musl += "-DOPENSSL_NO_ASYNC" do_install () { oe_runmake DESTDIR="${D}" MANDIR="${mandir}" MANSUFFIX=ssl install
Signature · 1 line
2.16.1
Re: [RFC][PATCH 3/5] openssl: update to 1.1.1
Quoted 50 lines · Alexander Kanavin
At the moment 1.1.1 is in pre-release stage, however the final release should be available within a few weeks. The major selling point is that it supports the new TLS 1.3 specification. At the moment it is not clear whether this also will be a long term support version of openssl; we can make the decision to merge this version once that is made clear by upstream. More information:
https://www.openssl.org/policies/releasestrat.html
Signed-off-by Alexander Kanavin <[email protected]>--- ...1-Take-linking-flags-from-LDFLAGS-env-var.patch | 43 ---------------------- .../{openssl_1.1.0h.bb => openssl_1.1.1-pre4.bb} | 21 +++++------ 2 files changed, 10 insertions(+), 54 deletions(-) delete mode 100644 meta/recipes-connectivity/openssl/openssl/0001-Take-linking-flags-from-LDFLAGS-env-var.patch rename meta/recipes-connectivity/openssl/{openssl_1.1.0h.bb => openssl_1.1.1-pre4.bb} (83%)meta/recipes-connectivity/openssl/openssl_1.1.1-pre4.bb renamed from meta/recipes-connectivity/openssl/openssl_1.1.0h.bb +5
-5@@ -10,13 +10,12 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=d57d511030c9d66ef5f5966bee5a7eff" BBCLASSEXTEND = "native nativesdk" -SRC_URI[md5sum] = "5271477e4d93f4ea032b665ef095ff24" -SRC_URI[sha256sum] = "5835626cde9e99656585fc7aaa2302a73a7e1340bf8c14fd635a62c66802a517" +SRC_URI[md5sum] = "07c3f6831fb6dfe975795ef7bbbee9fc" +SRC_URI[sha256sum] = "df2d5fcc2a878525611c75b9e9116fbcfbce8d9b96419a16eda5fb11ecc428f6" SRC_URI = "http://www.openssl.org/source/openssl-${PV}.tar.gz \ file://run-ptest \ file://openssl-c_rehash.sh \ - file://0001-Take-linking-flags-from-LDFLAGS-env-var.patch \ " S = "${WORKDIR}/openssl-${PV}"@@ -114,20 +113,20 @@ do_configure () { if [ "x$useprefix" = "x" ]; then useprefix=/ fi - libdirleaf="$(echo ${libdir} | sed s:$useprefix::)" - perl ./Configure ${EXTRA_OECONF} --prefix=$useprefix --openssldir=${libdir}/ssl-1.1 --libdir=${libdirleaf} $target + # WARNING: do not set compiler/linker flags (-I/-D etc.) in EXTRA_OECONF, as they will fully replace the + # environment variables set by bitbake. Adjust the environment variables instead. + perl ./Configure ${EXTRA_OECONF} --prefix=$useprefix --openssldir=${libdir}/ssl-1.1 --libdir=${libdir} $target }
meta/recipes-connectivity/openssl/openssl_1.1.1-pre4.bb do_configure () { · line 124
Quoted 10 lines
meta/recipes-connectivity/openssl/openssl_1.1.1-pre4.bb renamed from meta/recipes-connectivity/openssl/openssl_1.1.0h.bb +4
-5-#| engines/afalg/e_afalg.c: In function 'eventfd': -#| engines/afalg/e_afalg.c:110:20: error: '__NR_eventfd' undeclared (first use in this function) -#| return syscall(__NR_eventfd, n); -#| ^~~~~~~~~~~~ -EXTRA_OECONF_aarch64 += "no-afalgeng" +# This prevents openssl from using getrandom() which is not available on older glibc versions +# (native versions can be built with newer glibc, but then relocated onto a system with older glibc) +EXTRA_OECONF_class-native += "--with-rand-seed=devrandom" +EXTRA_OECONF_class-nativesdk += "--with-rand-seed=devrandom"
Better to avoid += with an over-ride since it doesn't do what most new users etc expect. Better to use _append instead (or just the over-ride on it's own, if over-riding the original value is what you intended to do).
meta/recipes-connectivity/openssl/openssl_1.1.1-pre4.bb do_configure () { · line 129
Quoted 5 lines
meta/recipes-connectivity/openssl/openssl_1.1.1-pre4.bb renamed from meta/recipes-connectivity/openssl/openssl_1.1.0h.bb +1
-1#| ./libcrypto.so: undefined reference to `getcontext' #| ./libcrypto.so: undefined reference to `setcontext' #| ./libcrypto.so: undefined reference to `makecontext' -EXTRA_OECONF_libc-musl += "-DOPENSSL_NO_ASYNC" +CPPFLAGS_libc-musl += "-DOPENSSL_NO_ASYNC"
Same comment here.
Quoted 3 lines
meta/recipes-connectivity/openssl/openssl_1.1.1-pre4.bb renamed from meta/recipes-connectivity/openssl/openssl_1.1.0h.bb +0
-1do_install () { oe_runmake DESTDIR="${D}" MANDIR="${mandir}" MANSUFFIX=ssl install --
Re: [RFC][PATCH 3/5] openssl: update to 1.1.1
Quoted 6 lines · Andre McCurdy
Quoted 6 lines
meta/recipes-connectivity/openssl/openssl_1.1.1-pre4.bb renamed from meta/recipes-connectivity/openssl/openssl_1.1.0h.bb +1
-5-#| engines/afalg/e_afalg.c: In function 'eventfd': -#| engines/afalg/e_afalg.c:110:20: error: '__NR_eventfd' undeclared (first use in this function) -#| return syscall(__NR_eventfd, n); -#| ^~~~~~~~~~~~ -EXTRA_OECONF_aarch64 += "no-afalgeng" +# This prevents openssl from using getrandom() which is not available on older glibc versions
Quoted 8 lines
meta/recipes-connectivity/openssl/openssl_1.1.1-pre4.bb do_configure () { · line 124
Quoted 3 lines
meta/recipes-connectivity/openssl/openssl_1.1.1-pre4.bb renamed from meta/recipes-connectivity/openssl/openssl_1.1.0h.bb +3
-0+# (native versions can be built with newer glibc, but then relocated onto a system with older glibc) +EXTRA_OECONF_class-native += "--with-rand-seed=devrandom" +EXTRA_OECONF_class-nativesdk += "--with-rand-seed=devrandom"Better to avoid += with an over-ride since it doesn't do what most new users etc expect. Better to use
_appendinstead (or just the over-ride on it's own, if over-riding the original value is what you intended to do).
Thanks, I will fix this. The whole += vs. _append is a design shortcoming in bitbake I'd say, as it's a regular source of confusion, and can't be automatically QA'd.
Alex
Re: [RFC][PATCH 3/5] openssl: update to 1.1.1
Quoted 20 lines · Alexander Kanavin
Quoted 10 lines · Andre McCurdy
Quoted 10 lines
(quoted diff) +0
-2-#| engines/afalg/e_afalg.c: In function 'eventfd': -#| engines/afalg/e_afalg.c:110:20: error: '__NR_eventfd' undeclared(first use in this function)
meta/recipes-connectivity/openssl/openssl_1.1.1-pre4.bb renamed from meta/recipes-connectivity/openssl/openssl_1.1.0h.bb +1
-3-#| return syscall(__NR_eventfd, n); -#| ^~~~~~~~~~~~ -EXTRA_OECONF_aarch64 += "no-afalgeng" +# This prevents openssl from using getrandom() which is not available onolder glibc versions
+# (native versions can be built with newer glibc, but then relocatedQuoted 8 lines
meta/recipes-connectivity/openssl/openssl_1.1.1-pre4.bb do_configure () { · line 124
Quoted 3 lines
onto a system with older glibc)
meta/recipes-connectivity/openssl/openssl_1.1.1-pre4.bb renamed from meta/recipes-connectivity/openssl/openssl_1.1.0h.bb +2
-0+EXTRA_OECONF_class-native += "--with-rand-seed=devrandom" +EXTRA_OECONF_class-nativesdk += "--with-rand-seed=devrandom"Better to avoid += with an over-ride since it doesn't do what most new users etc expect. Better to use
_appendinstead (or just the over-ride on it's own, if over-riding the original value is what you intended to do).
Quoted 3 lines
Thanks, I will fix this. The whole += vs.
_appendis a design shortcoming in bitbake I'd say, as it's a regular source of confusion, and can't be automatically QA'd.
Yes, fully agree. We would save new users a lot of time and confusion if the parser just failed with an error on any attempt to use += with an over-ride. I've seen it cause bugs many times.
RFC PATCH 4/5 libressl: add a recipe to support openssh
In reply to Alexander KanavinAfter reading through this:
https://github.com/openssh/openssh-portable/pull/48
and this thread:
https://lists.mindrot.org/pipermail/openssh-unix-dev/2017-October/036344.html
I've concluded that this is the best of the three not-great options. The alternatives:
- bundle libressl inside openssh packages
- keep openssh dependent on openssl 1.0 and wait until upstream does something
are both inferior. Libressl is used with openssh in OpenBSD and in OS X, so it did get at least some testing in the real world.
Signed-off-by Alexander Kanavin <[email protected]>
--- ...c-libraries-with-their-library-dependenci.patch | 74 ++++++++++++++++++++++ .../libressl/libressl_2.7.2.bb | 31 +++++++++ 2 files changed, 105 insertions(+) create mode 100644 meta/recipes-connectivity/libressl/libressl/0001-Link-dynamic-libraries-with-their-library-dependenci.patch create mode 100644 meta/recipes-connectivity/libressl/libressl_2.7.2.bb
meta/recipes-connectivity/libressl/libressl/0001-Link-dynamic-libraries-with-their-library-dependenci.patch new file +74 -0
@@ -0,0 +1,74 @@ +From 2e433aa5bb243c608930bdb46fbf55a31231a7bd Mon Sep 17 00:00:00 2001 +From: Alexander Kanavin <[email protected]> +Date: Mon, 9 Apr 2018 18:02:56 +0300 +Subject: [PATCH] Link dynamic libraries with their library dependencies. + +It does seem like outside of OpenBSD, no one has actually used libressl yet. + +Upstream-Status: Pending +Signed-off-by: Alexander Kanavin <[email protected]> +--- + CMakeLists.txt | 7 ++++++- + crypto/CMakeLists.txt | 1 + + ssl/CMakeLists.txt | 2 +- + 3 files changed, 8 insertions(+), 2 deletions(-) + +diff --git a/CMakeLists.txt b/CMakeLists.txt +index 1c6bd67..2c1078d 100644 +--- a/CMakeLists.txt ++++ b/CMakeLists.txt +@@ -265,6 +265,7 @@ endif() + set(OPENSSL_LIBS tls ssl crypto) + + if(WIN32) ++ set(OPENSSL_LIB_LIBS ws2_32) + set(OPENSSL_LIBS ${OPENSSL_LIBS} ws2_32) + endif() + +@@ -274,16 +275,20 @@ if(HAVE_CLOCK_GETTIME) + endif() + + if(CMAKE_SYSTEM_NAME MATCHES "Linux") ++ set(OPENSSL_LIB_LIBS pthread) ++ set(OPENSSL_LIBS ${OPENSSL_LIBS} pthread) + check_library_exists(rt clock_gettime "time.h" HAVE_CLOCK_GETTIME) + if (HAVE_CLOCK_GETTIME) ++ set(OPENSSL_LIB_LIBS ${OPENSSL_LIB_LIBS} rt) + set(OPENSSL_LIBS ${OPENSSL_LIBS} rt) + endif() +- set(OPENSSL_LIBS ${OPENSSL_LIBS} pthread) + endif() + if(CMAKE_SYSTEM_NAME MATCHES "HP-UX") ++ set(OPENSSL_LIB_LIBS pthread) + set(OPENSSL_LIBS ${OPENSSL_LIBS} pthread) + endif() + if(CMAKE_SYSTEM_NAME MATCHES "SunOS") ++ set(OPENSSL_LIB_LIBS nsl socket) + set(OPENSSL_LIBS ${OPENSSL_LIBS} nsl socket) + endif() + +diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt +index 2fa08a5..32ab649 100644 +--- a/crypto/CMakeLists.txt ++++ b/crypto/CMakeLists.txt +@@ -811,6 +811,7 @@ endif() + + add_library(crypto ${CRYPTO_SRC}) + if (BUILD_SHARED_LIBS) ++ target_link_libraries(crypto ${OPENSSL_LIB_LIBS}) + export_symbol(crypto ${CMAKE_CURRENT_BINARY_DIR}/crypto_p.sym) + if (WIN32) + target_link_libraries(crypto Ws2_32.lib) +diff --git a/ssl/CMakeLists.txt b/ssl/CMakeLists.txt +index e87e0f6..e53e5ea 100644 +--- a/ssl/CMakeLists.txt ++++ b/ssl/CMakeLists.txt +@@ -50,7 +50,7 @@ set( + add_library(ssl ${SSL_SRC}) + if (BUILD_SHARED_LIBS) + export_symbol(ssl ${CMAKE_CURRENT_SOURCE_DIR}/ssl.sym) +- target_link_libraries(ssl crypto) ++ target_link_libraries(ssl crypto ${OPENSSL_LIB_LIBS}) + if (WIN32) + target_link_libraries(ssl Ws2_32.lib) + set(SSL_POSTFIX -${SSL_MAJOR_VERSION})
meta/recipes-connectivity/libressl/libressl_2.7.2.bb new file +31 -0
@@ -0,0 +1,31 @@ +SUMMARY = "Drop-in replacement for openssl 1.0.x, maintained by OpenBSD" +DESCRIPTION = "LibreSSL is a version of the TLS/crypto stack forked from \ + OpenSSL in 2014, with goals of modernizing the codebase, \ + improving security, and applying best practice development processes. " +HOMEPAGE = "http://www.libressl.org/" + +LICENSE = "openssl" +LIC_FILES_CHKSUM = "file://COPYING;md5=01f9bb4d275f5eeea905377bef3de622" + +SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-${PV}.tar.gz \ + file://0001-Link-dynamic-libraries-with-their-library-dependenci.patch \ + " +SRC_URI[md5sum] = "97aee636dfce1eb6ec6f38687bee0760" +SRC_URI[sha256sum] = "917a8779c342177ff3751a2bf955d0262d1d8916a4b408930c45cef326700995" + +inherit cmake + +EXTRA_OECMAKE = "-DOPENSSLDIR=${sysconfdir}/libressl -DBUILD_SHARED_LIBS=ON" + +PACKAGE_PREPROCESS_FUNCS += "libressl_package_preprocess" + +# libressl development files and executable binaries clash with openssl 1.1 +# files when installed into target rootfs. So we don't put them into +# packages, but they continue to be provided via target sysroot for +# cross-compilation on the host, if some software needs specifically libressl. +libressl_package_preprocess () { + for file in `find ${PKGD} -name *.h -o -name *.pc -o -name *.so`; do + rm $file + done +} +
Signature · 1 line
2.16.1
Re: [RFC][PATCH 4/5] libressl: add a recipe to support openssh
Quoted 30 lines · Alexander Kanavin
After reading through this:
https://github.com/openssh/openssh-portable/pull/48
and this thread:
https://lists.mindrot.org/pipermail/openssh-unix-dev/2017-October/036344.html
I've concluded that this is the best of the three not-great options. The alternatives:
- bundle libressl inside openssh packages
- keep openssh dependent on openssl 1.0 and wait until upstream does somethingare both inferior. Libressl is used with openssh in OpenBSD and in OS X, so it did get at least some testing in the real world.
Signed-off-by Alexander Kanavin <[email protected]>--- ...c-libraries-with-their-library-dependenci.patch | 74 ++++++++++++++++++++++ .../libressl/libressl_2.7.2.bb | 31 +++++++++ 2 files changed, 105 insertions(+) create mode 100644 meta/recipes-connectivity/libressl/libressl/0001-Link-dynamic-libraries-with-their-library-dependenci.patch create mode 100644 meta/recipes-connectivity/libressl/libressl_2.7.2.bbmeta/recipes-connectivity/libressl/libressl/0001-Link-dynamic-libraries-with-their-library-dependenci.patch new file +0
-0
meta/recipes-connectivity/libressl/libressl/0001-Link-dynamic-libraries-with-their-library-dependenci.patch line 6
Quoted 6 lines
meta/recipes-connectivity/libressl/libressl/0001-Link-dynamic-libraries-with-their-library-dependenci.patch new file +6
-0@@ -0,0 +1,74 @@ +From 2e433aa5bb243c608930bdb46fbf55a31231a7bd Mon Sep 17 00:00:00 2001 +From: Alexander Kanavin <[email protected]> +Date: Mon, 9 Apr 2018 18:02:56 +0300 +Subject: [PATCH] Link dynamic libraries with their library dependencies. + +It does seem like outside of OpenBSD, no one has actually used libressl yet.
I played around with completely replacing openssl with libressl a year or so ago and it went fairly smoothly (at least as far as I tested). That was with libressl 2.4.2 and my recipe built with autotools rather than cmake though. Did you try to build with autotools? That still appears to be the option mentioned first in the libressl README.
Quoted 112 lines
meta/recipes-connectivity/libressl/libressl/0001-Link-dynamic-libraries-with-their-library-dependenci.patch new file +67
-0+Upstream-Status: Pending +Signed-off-by: Alexander Kanavin <[email protected]> +--- + CMakeLists.txt | 7 ++++++- + crypto/CMakeLists.txt | 1 + + ssl/CMakeLists.txt | 2 +- + 3 files changed, 8 insertions(+), 2 deletions(-) + +diff --git a/CMakeLists.txt b/CMakeLists.txt +index 1c6bd67..2c1078d 100644 +--- a/CMakeLists.txt ++++ b/CMakeLists.txt +@@ -265,6 +265,7 @@ endif() + set(OPENSSL_LIBS tls ssl crypto) + + if(WIN32) ++ set(OPENSSL_LIB_LIBS ws2_32) + set(OPENSSL_LIBS ${OPENSSL_LIBS} ws2_32) + endif() + +@@ -274,16 +275,20 @@ if(HAVE_CLOCK_GETTIME) + endif() + + if(CMAKE_SYSTEM_NAME MATCHES "Linux") ++ set(OPENSSL_LIB_LIBS pthread) ++ set(OPENSSL_LIBS ${OPENSSL_LIBS} pthread) + check_library_exists(rt clock_gettime "time.h" HAVE_CLOCK_GETTIME) + if (HAVE_CLOCK_GETTIME) ++ set(OPENSSL_LIB_LIBS ${OPENSSL_LIB_LIBS} rt) + set(OPENSSL_LIBS ${OPENSSL_LIBS} rt) + endif() +- set(OPENSSL_LIBS ${OPENSSL_LIBS} pthread) + endif() + if(CMAKE_SYSTEM_NAME MATCHES "HP-UX") ++ set(OPENSSL_LIB_LIBS pthread) + set(OPENSSL_LIBS ${OPENSSL_LIBS} pthread) + endif() + if(CMAKE_SYSTEM_NAME MATCHES "SunOS") ++ set(OPENSSL_LIB_LIBS nsl socket) + set(OPENSSL_LIBS ${OPENSSL_LIBS} nsl socket) + endif() + +diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt +index 2fa08a5..32ab649 100644 +--- a/crypto/CMakeLists.txt ++++ b/crypto/CMakeLists.txt +@@ -811,6 +811,7 @@ endif() + + add_library(crypto ${CRYPTO_SRC}) + if (BUILD_SHARED_LIBS) ++ target_link_libraries(crypto ${OPENSSL_LIB_LIBS}) + export_symbol(crypto ${CMAKE_CURRENT_BINARY_DIR}/crypto_p.sym) + if (WIN32) + target_link_libraries(crypto Ws2_32.lib) +diff --git a/ssl/CMakeLists.txt b/ssl/CMakeLists.txt +index e87e0f6..e53e5ea 100644 +--- a/ssl/CMakeLists.txt ++++ b/ssl/CMakeLists.txt +@@ -50,7 +50,7 @@ set( + add_library(ssl ${SSL_SRC}) + if (BUILD_SHARED_LIBS) + export_symbol(ssl ${CMAKE_CURRENT_SOURCE_DIR}/ssl.sym) +- target_link_libraries(ssl crypto) ++ target_link_libraries(ssl crypto ${OPENSSL_LIB_LIBS}) + if (WIN32) + target_link_libraries(ssl Ws2_32.lib) + set(SSL_POSTFIX -${SSL_MAJOR_VERSION})meta/recipes-connectivity/libressl/libressl_2.7.2.bb new file +31
-1@@ -0,0 +1,31 @@ +SUMMARY = "Drop-in replacement for openssl 1.0.x, maintained by OpenBSD" +DESCRIPTION = "LibreSSL is a version of the TLS/crypto stack forked from \ + OpenSSL in 2014, with goals of modernizing the codebase, \ + improving security, and applying best practice development processes. " +HOMEPAGE = "http://www.libressl.org/" + +LICENSE = "openssl" +LIC_FILES_CHKSUM = "file://COPYING;md5=01f9bb4d275f5eeea905377bef3de622" + +SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-${PV}.tar.gz \ + file://0001-Link-dynamic-libraries-with-their-library-dependenci.patch \ + " +SRC_URI[md5sum] = "97aee636dfce1eb6ec6f38687bee0760" +SRC_URI[sha256sum] = "917a8779c342177ff3751a2bf955d0262d1d8916a4b408930c45cef326700995" + +inherit cmake + +EXTRA_OECMAKE = "-DOPENSSLDIR=${sysconfdir}/libressl -DBUILD_SHARED_LIBS=ON" + +PACKAGE_PREPROCESS_FUNCS += "libressl_package_preprocess" + +# libressl development files and executable binaries clash with openssl 1.1 +# files when installed into target rootfs. So we don't put them into +# packages, but they continue to be provided via target sysroot for +# cross-compilation on the host, if some software needs specifically libressl. +libressl_package_preprocess () { + for file in `find ${PKGD} -name *.h -o -name *.pc -o -name *.so`; do + rm $file + done +} + --2.16.1
--
_______________________________________________
Openembedded-core mailing list
[email protected]
http://lists.openembedded.org/mailman/listinfo/openembedded-core
Re: [RFC][PATCH 4/5] libressl: add a recipe to support openssh
Quoted 5 lines · Andre McCurdy
I played around with completely replacing openssl with libressl a year or so ago and it went fairly smoothly (at least as far as I tested). That was with libressl 2.4.2 and my recipe built with autotools rather than cmake though. Did you try to build with autotools? That still appears to be the option mentioned first in the libressl README.
That's not however the options I would take first, as the recipe maintainer :) Autotools is horrible in many ways; while cmake is not great, it's definitely less horrible.
Alex
Re: [RFC][PATCH 4/5] libressl: add a recipe to support openssh
Quoted 11 lines · Alexander Kanavin
Quoted 6 lines · Andre McCurdy
I played around with completely replacing openssl with libressl a year or so ago and it went fairly smoothly (at least as far as I tested). That was with libressl 2.4.2 and my recipe built with autotools rather than cmake though. Did you try to build with autotools? That still appears to be the option mentioned first in the libressl README.
That's not however the options I would take first, as the recipe maintainer :) Autotools is horrible in many ways; while cmake is not great, it's definitely less horrible.
Well, as you're the one writing the recipe you get to make the choice :-) But if one "just works" and the other requires patches that might sway the choice a little. I wasn't sure if you'd even looked at the autotools build.
Either option is a vast improvement on the openssl build system though. Libressl seems to have done a lot of valuable cleanup in that respect.
RFC PATCH 5/5 openssh: update to 7.7p1 and depend on libressl
In reply to Alexander KanavinPlease see the previous commit for the libressl rationale.
Signed-off-by Alexander Kanavin <[email protected]>
---
.../openssh/{openssh_7.6p1.bb => openssh_7.7p1.bb} | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
rename meta/recipes-connectivity/openssh/{openssh_7.6p1.bb => openssh_7.7p1.bb} (97%)meta/recipes-connectivity/openssh/openssh_7.7p1.bb renamed from meta/recipes-connectivity/openssh/openssh_7.6p1.bb +3 -3
@@ -9,7 +9,7 @@ LICENSE = "BSD" LIC_FILES_CHKSUM = "file://LICENCE;md5=429658c6612f3a9b1293782366ab29d8" # openssl 1.1 patches are proposed at https://github.com/openssh/openssh-portable/pull/48 -DEPENDS = "zlib openssl10" +DEPENDS = "zlib libressl" DEPENDS += "${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'libpam', '', d)}" SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar.gz \
@@ -29,8 +29,8 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar PAM_SRC_URI = "file://sshd" -SRC_URI[md5sum] = "06a88699018e5fef13d4655abfed1f63" -SRC_URI[sha256sum] = "a323caeeddfe145baaa0db16e98d784b1fbc7dd436a6bf1f479dfd5cd1d21723" +SRC_URI[md5sum] = "68ba883aff6958297432e5877e9a0fe2" +SRC_URI[sha256sum] = "d73be7e684e99efcd024be15a30bffcbe41b012b2f7b3c9084aed621775e6b8f" inherit useradd update-rc.d update-alternatives systemd
Signature · 1 line
2.16.1
✗ patchtest: failure for "[RFC] openssl: rename openssl ..." and 4 more
In reply to Alexander Kanavin== Series Details ==
Series: "[RFC] openssl: rename openssl ..." and 4 more
Revision: 1
URL : https://patchwork.openembedded.org/series/11748/
State : failure
== Summary ==
Thank you for submitting this patch series to OpenEmbedded Core. This is an automated response. Several tests have been executed on the proposed series by patchtest resulting in the following failures:
* Issue LIC_FILES_CHKSUM changed on target openssl but there is no "License-Update" tag in commit message [test_lic_files_chksum_modified_not_mentioned]
Suggested fix Include "License-Update: <description>" into the commit message with a brief description
Current checksum file://LICENSE;md5=f475368924827d06d4b416111c8bdb77
New checksum file://LICENSE;md5=d57d511030c9d66ef5f5966bee5a7eff
* Issue Patches not removed from tree [test_src_uri_left_files]
Suggested fix Amend the patch containing the software patch file removal
Patch
Patch engines-install-in-libdir-ssl.patch Patch ptest-deps.patch Patch openssl_fix_for_x32.patch Patch c_rehash-compat.patch Patch no-symbolic.patch Patch oe-ldflags.patch Patch ptest_makefile_deps.patch Patch openssl-util-perlpath.pl-cwd.patch Patch debian-targets.patch Patch 0001-openssl-force-soft-link-to-avoid-rare-race.patch Patch man-dir.patch Patch pic.patch Patch block_diginotar.patch Patch parallel.patch Patch Makefiles-ptest.patch Patch man-section.patch Patch block_digicert_malaysia.patch Patch configure-targets.patch Patch 0001-Fix-build-with-clang-using-external-assembler.patch Patch reproducible-mkbuildinf.patch Patch no-rpath.patch Patch soname.patch Patch ca.patch Patch shared-libs.patch Patch Use-SHA256-not-MD5-as-default-digest.patch Patch reproducible-cflags.patch Patch configure-musl-target.patch Patch openssl-fix-des.pod-error.patch Patch version-script.patch
If you believe any of these test results are incorrect, please reply to the mailing list ([email protected]) raising your concerns. Otherwise we would appreciate you correcting the issues and submitting a new version of the patchset if applicable. Please ensure you add/increment the version number when sending the new version (i.e. [PATCH] -> [PATCH v2] -> [PATCH v3] -> ...).
---
Guidelines: https://www.openembedded.org/wiki/Commit_Patch_Message_Guidelines Test framework: http://git.yoctoproject.org/cgit/cgit.cgi/patchtest Test suite: http://git.yoctoproject.org/cgit/cgit.cgi/patchtest-oe
Quoted 1 line · Alexander Kanavin
Openssl 1.0 can still be utilized by depending on 'openssl10' recipe.
Does this really work now?
I think it will fail again when both openssl versions end up in RSS.
Quoted 6 lines · Martin Jansa
Quoted 1 line · Alexander Kanavin
Openssl 1.0 can still be utilized by depending on 'openssl10' recipe.
Does this really work now?
I think it will fail again when both openssl versions end up in RSS.
The only known case where this happened was Qt5 (because it also wanted python), and Qt5 gained openssl 1.1 support in the latest released version.
Alex