gnutls: Give library a default trust location
PATCH 1/2 gnutls: Give library a default trust location
Gnutls is building with no default location to look for CA certs. Since there are buildroot packages to provide these, configure it to use them by default.
Configure gnutls to find them using the bundle file which contains all certs, rather than looking in the cert directory. When gnutls is told to use the directory, it loads *every* file in it. This means it loads the bundle with all certs, then loads each cert a second time using the individual pem files, and then loads them all the third time via the hash symlinks to the pem files.
When p11-kit is enabled, use its trust module instead of the bundle file. p11-kit can be configured to use the bundle (the default), but it can do other things too, such as integrate with the "trust" command for adding and removing trust anchors.
--- package/gnutls/gnutls.mk | 7 +++++++ 1 file changed, 7 insertions(+)
package/gnutls/gnutls.mk +7 -0
@@ -95,4 +95,11 @@ else GNUTLS_CONF_OPTS += --without-zlib endif +# Provide a default CA cert location +ifeq ($(BR2_PACKAGE_P11_KIT),y) +GNUTLS_CONF_OPTS += --with-default-trust-store-pkcs11=pkcs11:model=p11-kit-trust +else ifeq ($(BR2_PACKAGE_CA_CERTIFICATES),y) +GNUTLS_CONF_OPTS += --with-default-trust-store-file=/etc/ssl/certs/ca-certificates.crt +endif + $(eval $(autotools-package))
Signature · 1 line
2.14.4
PATCH 2/2 libcurl: Use GnuTLS's default cert path
libcurl doesn't find any trust path for CA certs when it cross-compiles. When using OpenSSL, it is explicitly configured to use the SSL cert directory with OpenSSL style hash files in it. But with GnuTLS, it gets nothing.
Rather than configure libcurl to use the OpenSSL directory or a bundle file, configure it to use the GnuTLS default. This way the CA certs path can be configured in one place (gnutls) and then libcurl and anyone else who uses gnutls can default to that.
Also, when libcurl with gnutls is configured to use a directory, it ends up loading each cert three times.
--- package/libcurl/libcurl.mk | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
package/libcurl/libcurl.mk +2 -1
@@ -50,7 +50,8 @@ LIBCURL_CONF_OPTS += -without-ssl endif ifeq ($(BR2_PACKAGE_LIBCURL_GNUTLS),y) -LIBCURL_CONF_OPTS += --with-gnutls=$(STAGING_DIR)/usr +LIBCURL_CONF_OPTS += --with-gnutls=$(STAGING_DIR)/usr \ + --with-ca-fallback LIBCURL_DEPENDENCIES += gnutls else LIBCURL_CONF_OPTS += --without-gnutls
Signature · 1 line
2.14.4
PATCH 1/2 gnutls: Give library a default trust location
In reply to Trent PiephoHello,
Quoted 16 lines · Trent Piepho
Gnutls is building with no default location to look for CA certs. Since there are buildroot packages to provide these, configure it to use them by default.
Configure gnutls to find them using the bundle file which contains all certs, rather than looking in the cert directory. When gnutls is told to use the directory, it loads *every* file in it. This means it loads the bundle with all certs, then loads each cert a second time using the individual pem files, and then loads them all the third time via the hash symlinks to the pem files.
When p11-kit is enabled, use its trust module instead of the bundle file. p11-kit can be configured to use the bundle (the default), but it can do other things too, such as integrate with the "trust" command for adding and removing trust anchors.
Quoted 4 lines
Signed-off-by Trent Piepho <[email protected]>--- package/gnutls/gnutls.mk | 7 +++++++ 1 file changed, 7 insertions(+)
Both patches applied. Thanks!
Thomas
Signature · 3 lines
Thomas Petazzoni, CTO, Bootlin Embedded Linux and Kernel engineering https://bootlin.com
PATCH 1/2 gnutls: Give library a default trust location
In reply to Trent PiephoQuoted 13 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Trent" == Trent Piepho <[email protected]> writes:
Gnutls is building with no default location to look for CA certs. Since there are buildroot packages to provide these, configure it to use them by default.
Configure gnutls to find them using the bundle file which contains all certs, rather than looking in the cert directory. When gnutls is told to use the directory, it loads *every* file in it. This means it loads the bundle with all certs, then loads each cert a second time using the individual pem files, and then loads them all the third time via the hash symlinks to the pem files.
Quoted 6 lines
When p11-kit is enabled, use its trust module instead of the bundle file. p11-kit can be configured to use the bundle (the default), but it can do other things too, such as integrate with the "trust" command for adding and removing trust anchors.
Signed-off-by Trent Piepho <[email protected]>
Committed both to 2018.02.x, 2018.08.x and 2018.11.x, thanks.
Signature · 1 line
Bye, Peter Korsgaard