Add openssl 1.1
cover Add openssl 1.1
This patch series introduces the recipe for openssl 1.1 (openssl 1.0 is preserved but renamed to openssl10), and does a few necessary adjustmenets and updates to other recipes. The reason it's marked RFC is that there is one known remaining issue to
resolve: specifically, u-boot needs to be ported to 1.1 before this series can be merged, otherwise there's a dependency conflict when building native u-boot. This should be resolved quite soon, but it isn't yet (as of u-boot v2017.05).
Openssl 1.1 is an opt-out; it has the same recipe name as openssl 1.0 had, and so all dependencies are compiled with it by default. If there's an API issue, please fix it, or adjust the recipe to depend on 'openssl10' (which is a lesser solution, and subject to openssl 1.0 eventually being removed from oe-core).
Please review the following changes for suitability for inclusion. If you have any objections or suggestions for improvement, please respond to the patches. If you agree with the changes, please provide your Acked-by.
The following changes since commit 381897c64069ea43d595380a3ae913bcc79cf7e1:
build-appliance-image: Update to master head revision (2017-05-01 08:56:47 +0100)
are available in the git repository at:
git://git.yoctoproject.org/poky-contrib akanavin/openssl-1.1
http://git.yoctoproject.org/cgit.cgi/poky-contrib/log/?h=akanavin/openssl-1.1
Alexander Kanavin (10):
python: update to 3.5.3
openssl: add a 1.1 version
u-boot-mkimage: depend on openssl 1.0
bind: fix upstream version check
bind: update to 9.10.5
openssh: depend on openssl 1.0
apr-util: add support for openssl 1.1 via backported patch
cryptodev-tests: depend on openssl 1.0
mailx: depend on openssl 1.0
gstreamer-plugins-bad: replace openssl dependency with nettle for hls
plugin
meta/conf/distro/include/no-static-libs.inc | 3 +
meta/conf/distro/include/security_flags.inc | 2 +-
meta/recipes-bsp/u-boot/u-boot-mkimage_2017.01.bb | 2 +-
...0001-build-use-pkg-config-to-find-libxml2.patch | 14 +-
...=> 0001-confgen-don-t-build-unix.o-twice.patch} | 17 +-
.../bind/bind/CVE-2016-1285.patch | 154 ----------
.../bind/bind/CVE-2016-1286_1.patch | 79 -----
.../bind/bind/CVE-2016-1286_2.patch | 317 ---------------------
.../bind/bind/CVE-2016-2088.patch | 247 ----------------
.../bind/bind/CVE-2016-2775.patch | 90 ------
.../bind/bind/CVE-2016-2776.patch | 123 --------
.../bind/bind/mips1-not-support-opcode.diff | 104 -------
.../bind/{bind_9.10.3-P3.bb => bind_9.10.5.bb} | 27 +-
meta/recipes-connectivity/openssh/openssh_7.4p1.bb | 3 +-
...ve-test-that-requires-running-as-non-root.patch | 49 ++++
...1-Take-linking-flags-from-LDFLAGS-env-var.patch | 43 +++
.../recipes-connectivity/openssl/openssl/run-ptest | 4 +-
.../openssl/{openssl.inc => openssl10.inc} | 14 +-
...build-with-clang-using-external-assembler.patch | 0
.../{openssl => openssl10}/Makefiles-ptest.patch | 0
.../Use-SHA256-not-MD5-as-default-digest.patch | 0
.../configure-musl-target.patch | 0
.../{openssl => openssl10}/configure-targets.patch | 0
.../debian/c_rehash-compat.patch | 0
.../openssl/{openssl => openssl10}/debian/ca.patch | 0
.../debian/debian-targets.patch | 0
.../{openssl => openssl10}/debian/man-dir.patch | 0
.../debian/man-section.patch | 0
.../{openssl => openssl10}/debian/no-rpath.patch | 0
.../debian/no-symbolic.patch | 0
.../{openssl => openssl10}/debian/pic.patch | 0
.../debian/version-script.patch | 0
.../debian1.0.2/block_digicert_malaysia.patch | 0
.../debian1.0.2/block_diginotar.patch | 0
.../debian1.0.2/version-script.patch | 0
.../engines-install-in-libdir-ssl.patch | 0
.../openssl/{openssl => openssl10}/find.pl | 0
.../fix-cipher-des-ede3-cfb1.patch | 0
.../{openssl => openssl10}/oe-ldflags.patch | 0
.../openssl-1.0.2a-x32-asm.patch | 0
...-pointer-dereference-in-EVP_DigestInit_ex.patch | 0
.../{openssl => openssl10}/openssl-c_rehash.sh | 0
.../openssl-fix-des.pod-error.patch | 0
.../openssl-util-perlpath.pl-cwd.patch | 0
.../openssl_fix_for_x32.patch | 0
.../openssl/{openssl => openssl10}/parallel.patch | 0
.../{openssl => openssl10}/ptest-deps.patch | 0
.../ptest_makefile_deps.patch | 0
.../openssl/openssl10/run-ptest | 2 +
.../{openssl => openssl10}/shared-libs.patch | 0
.../{openssl_1.0.2k.bb => openssl10_1.0.2k.bb} | 4 +-
.../recipes-connectivity/openssl/openssl_1.1.0e.bb | 146 ++++++++++
...on3-native_3.5.2.bb => python3-native_3.5.3.bb} | 8 +-
...the-shell-version-of-python-config-that-w.patch | 10 +-
...pile.patch => 0001-cross-compile-support.patch} | 56 ++--
.../python3/python3-fix-CVE-2016-1000110.patch | 148 ----------
.../python/python3/upstream-random-fixes.patch | 288 +++++++++----------
.../python/{python3_3.5.2.bb => python3_3.5.3.bb} | 9 +-
meta/recipes-extended/mailx/mailx_12.5-5.bb | 2 +-
.../cryptodev/cryptodev-tests_1.8.bb | 2 +-
.../gstreamer/gstreamer1.0-plugins-bad.inc | 4 +-
.../recipes-support/apr/apr-util/openssl-1.1.patch | 253 ++++++++++++++++
meta/recipes-support/apr/apr-util_1.5.4.bb | 1 +
63 files changed, 732 insertions(+), 1493 deletions(-)
rename meta/recipes-connectivity/bind/bind/{bind-confgen-build-unix.o-once.patch => 0001-confgen-don-t-build-unix.o-twice.patch} (80%)
delete mode 100644 meta/recipes-connectivity/bind/bind/CVE-2016-1285.patch
delete mode 100644 meta/recipes-connectivity/bind/bind/CVE-2016-1286_1.patch
delete mode 100644 meta/recipes-connectivity/bind/bind/CVE-2016-1286_2.patch
delete mode 100644 meta/recipes-connectivity/bind/bind/CVE-2016-2088.patch
delete mode 100644 meta/recipes-connectivity/bind/bind/CVE-2016-2775.patch
delete mode 100644 meta/recipes-connectivity/bind/bind/CVE-2016-2776.patch
delete mode 100644 meta/recipes-connectivity/bind/bind/mips1-not-support-opcode.diff
rename meta/recipes-connectivity/bind/{bind_9.10.3-P3.bb => bind_9.10.5.bb} (82%)
create mode 100644 meta/recipes-connectivity/openssl/openssl/0001-Remove-test-that-requires-running-as-non-root.patch
create mode 100644 meta/recipes-connectivity/openssl/openssl/0001-Take-linking-flags-from-LDFLAGS-env-var.patch
mode change 100755 => 100644 meta/recipes-connectivity/openssl/openssl/run-ptest
rename meta/recipes-connectivity/openssl/{openssl.inc => openssl10.inc} (95%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/0001-Fix-build-with-clang-using-external-assembler.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/Makefiles-ptest.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/Use-SHA256-not-MD5-as-default-digest.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/configure-musl-target.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/configure-targets.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian/c_rehash-compat.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian/ca.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian/debian-targets.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian/man-dir.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian/man-section.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian/no-rpath.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian/no-symbolic.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian/pic.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian/version-script.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian1.0.2/block_digicert_malaysia.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian1.0.2/block_diginotar.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian1.0.2/version-script.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/engines-install-in-libdir-ssl.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/find.pl (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/fix-cipher-des-ede3-cfb1.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/oe-ldflags.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/openssl-1.0.2a-x32-asm.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/openssl-avoid-NULL-pointer-dereference-in-EVP_DigestInit_ex.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/openssl-c_rehash.sh (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/openssl-fix-des.pod-error.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/openssl-util-perlpath.pl-cwd.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/openssl_fix_for_x32.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/parallel.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/ptest-deps.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/ptest_makefile_deps.patch (100%)
create mode 100755 meta/recipes-connectivity/openssl/openssl10/run-ptest
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/shared-libs.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl_1.0.2k.bb => openssl10_1.0.2k.bb} (97%)
create mode 100644 meta/recipes-connectivity/openssl/openssl_1.1.0e.bb
rename meta/recipes-devtools/python/{python3-native_3.5.2.bb => python3-native_3.5.3.bb} (90%)
rename meta/recipes-devtools/python/python3/{000-cross-compile.patch => 0001-cross-compile-support.patch} (65%)
delete mode 100644 meta/recipes-devtools/python/python3/python3-fix-CVE-2016-1000110.patch
rename meta/recipes-devtools/python/{python3_3.5.2.bb => python3_3.5.3.bb} (96%)
create mode 100644 meta/recipes-support/apr/apr-util/openssl-1.1.patchSignature · 1 line
2.11.0
RFC PATCH 1/10 python: update to 3.5.3
Prior versions of python do not support openssl 1.1; updating to Python 3.6 on the other hand is a lot more involved, and so should be done by a specialist/maintainer.
LICENSE checksum change due to copyright years.
Drop upstreamed python3-fix-CVE-2016-1000110.patch
Rebase upstream-random-fixes.patch (taken from
https://github.com/python/cpython/commit/ff558f5aba40bd173f336503def886a12f8db016 )
Rebase 0001-Do-not-use-the-shell-version-of-python-config-that-w.patch
Rebase 000-cross-compile.patch
---
...on3-native_3.5.2.bb => python3-native_3.5.3.bb} | 8 +-
...the-shell-version-of-python-config-that-w.patch | 10 +-
...pile.patch => 0001-cross-compile-support.patch} | 56 ++--
.../python3/python3-fix-CVE-2016-1000110.patch | 148 -----------
.../python/python3/upstream-random-fixes.patch | 288 ++++++++++-----------
.../python/{python3_3.5.2.bb => python3_3.5.3.bb} | 9 +-
6 files changed, 180 insertions(+), 339 deletions(-)
rename meta/recipes-devtools/python/{python3-native_3.5.2.bb => python3-native_3.5.3.bb} (90%)
rename meta/recipes-devtools/python/python3/{000-cross-compile.patch => 0001-cross-compile-support.patch} (65%)
delete mode 100644 meta/recipes-devtools/python/python3/python3-fix-CVE-2016-1000110.patch
rename meta/recipes-devtools/python/{python3_3.5.2.bb => python3_3.5.3.bb} (96%)meta/recipes-devtools/python/python3-native_3.5.3.bb renamed from meta/recipes-devtools/python/python3-native_3.5.2.bb +4 -4
@@ -7,7 +7,7 @@ DISTRO_SRC_URI_linuxstdbase = "" SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \ file://12-distutils-prefix-is-inside-staging-area.patch \ file://python-config.patch \ -file://000-cross-compile.patch \ +file://0001-cross-compile-support.patch \ file://030-fixup-include-dirs.patch \ file://070-dont-clean-ipkg-install.patch \ file://080-distutils-dont_adjust_files.patch \
@@ -26,10 +26,10 @@ file://setup.py-check-cross_compiling-when-get-FLAGS.patch \ file://0001-Do-not-use-the-shell-version-of-python-config-that-w.patch \ " -SRC_URI[md5sum] = "8906efbacfcdc7c3c9198aeefafd159e" -SRC_URI[sha256sum] = "0010f56100b9b74259ebcd5d4b295a32324b58b517403a10d1a2aa7cb22bca40" +SRC_URI[md5sum] = "57d1f8bfbabf4f2500273fb0706e6f21" +SRC_URI[sha256sum] = "eefe2ad6575855423ab630f5b51a8ef6e5556f774584c06beab4926f930ddbb0" -LIC_FILES_CHKSUM = "file://LICENSE;md5=6b60258130e4ed10d3101517eb5b9385" +LIC_FILES_CHKSUM = "file://LICENSE;md5=b680ed99aa60d350c65a65914494207e" # exclude pre-releases for both python 2.x and 3.x UPSTREAM_CHECK_REGEX = "[Pp]ython-(?P<pver>\d+(\.\d+)+).tar"
meta/recipes-devtools/python/python3/0001-Do-not-use-the-shell-version-of-python-config-that-w.patch +5 -5
@@ -1,4 +1,4 @@ -From 045c99b5f1eb6e4e0d8ad1ef9f0ba6574f738150 Mon Sep 17 00:00:00 2001 +From 04df959365e2b54d7503edf0e5534ff094284f2d Mon Sep 17 00:00:00 2001 From: Alexander Kanavin <[email protected]> Date: Fri, 23 Oct 2015 12:25:09 +0300 Subject: [PATCH] Do not use the shell version of python-config that was
@@ -14,13 +14,13 @@ Signed-off-by: Alexander Kanavin <[email protected]> 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/Makefile.pre.in b/Makefile.pre.in -index d7fc9a0..47e60bc 100644 +index 236f005..5c4337f 100644 --- a/Makefile.pre.in +++ b/Makefile.pre.in -@@ -1270,12 +1270,9 @@ python-config: $(srcdir)/Misc/python-config.in Misc/python-config.sh +@@ -1348,12 +1348,9 @@ python-config: $(srcdir)/Misc/python-config.in Misc/python-config.sh sed -e "s,@EXENAME@,$(BINDIR)/python$(LDVERSION)$(EXE)," < $(srcdir)/Misc/python-config.in >python-config.py # Replace makefile compat. variable references with shell script compat. ones; $(VAR) -> ${VAR} - sed -e 's,\$$(\([A-Za-z0-9_]*\)),\$$\{\1\},g' < Misc/python-config.sh >python-config + LC_ALL=C sed -e 's,\$$(\([A-Za-z0-9_]*\)),\$$\{\1\},g' < Misc/python-config.sh >python-config - # On Darwin, always use the python version of the script, the shell - # version doesn't use the compiler customizations that are provided - # in python (_osx_support.py).
@@ -34,5 +34,5 @@ index d7fc9a0..47e60bc 100644 # Install the include files -- -2.1.4 +2.11.0
meta/recipes-devtools/python/python3/0001-cross-compile-support.patch renamed from meta/recipes-devtools/python/python3/000-cross-compile.patch +32 -24
106 lines not on this page · raw message
meta/recipes-devtools/python/python3/python3-fix-CVE-2016-1000110.patch deleted +0 -148
148 lines not on this page · raw message
meta/recipes-devtools/python/python3/upstream-random-fixes.patch +135 -153
503 lines not on this page · raw message
meta/recipes-devtools/python/python3_3.5.3.bb renamed from meta/recipes-devtools/python/python3_3.5.2.bb +4 -5
@@ -8,7 +8,7 @@ DISTRO_SRC_URI ?= "file://sitecustomize.py" DISTRO_SRC_URI_linuxstdbase = "" SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \ file://python-config.patch \ -file://000-cross-compile.patch \ +file://0001-cross-compile-support.patch \ file://030-fixup-include-dirs.patch \ file://070-dont-clean-ipkg-install.patch \ file://080-distutils-dont_adjust_files.patch \
@@ -35,13 +35,12 @@ SRC_URI += "\ file://setup.py-check-cross_compiling-when-get-FLAGS.patch \ file://setup.py-find-libraries-in-staging-dirs.patch \ file://configure.ac-fix-LIBPL.patch \ - file://python3-fix-CVE-2016-1000110.patch \ file://upstream-random-fixes.patch \ " -SRC_URI[md5sum] = "8906efbacfcdc7c3c9198aeefafd159e" -SRC_URI[sha256sum] = "0010f56100b9b74259ebcd5d4b295a32324b58b517403a10d1a2aa7cb22bca40" +SRC_URI[md5sum] = "57d1f8bfbabf4f2500273fb0706e6f21" +SRC_URI[sha256sum] = "eefe2ad6575855423ab630f5b51a8ef6e5556f774584c06beab4926f930ddbb0" -LIC_FILES_CHKSUM = "file://LICENSE;md5=6b60258130e4ed10d3101517eb5b9385" +LIC_FILES_CHKSUM = "file://LICENSE;md5=b680ed99aa60d350c65a65914494207e" # exclude pre-releases for both python 2.x and 3.x UPSTREAM_CHECK_REGEX = "[Pp]ython-(?P<pver>\d+(\.\d+)+).tar"
Signature · 1 line
2.11.0
RFC PATCH 2/10 openssl: add a 1.1 version
In reply to Alexander KanavinExisting openssl 1.0 recipe is renamed to openssl10; it will continue to be provided for as long as upstream supports it (and there are still several recipes which do not work with openssl 1.1 due to API differences).
A few files (such as openssl binary) are no longer installed by openssl 1.0, because they clash with openssl 1.1.
---
meta/conf/distro/include/no-static-libs.inc | 3 +
meta/conf/distro/include/security_flags.inc | 2 +-
...ve-test-that-requires-running-as-non-root.patch | 49 +++++++
...1-Take-linking-flags-from-LDFLAGS-env-var.patch | 43 ++++++
.../recipes-connectivity/openssl/openssl/run-ptest | 4 +-
.../openssl/{openssl.inc => openssl10.inc} | 14 +-
...build-with-clang-using-external-assembler.patch | 0
.../{openssl => openssl10}/Makefiles-ptest.patch | 0
.../Use-SHA256-not-MD5-as-default-digest.patch | 0
.../configure-musl-target.patch | 0
.../{openssl => openssl10}/configure-targets.patch | 0
.../debian/c_rehash-compat.patch | 0
.../openssl/{openssl => openssl10}/debian/ca.patch | 0
.../debian/debian-targets.patch | 0
.../{openssl => openssl10}/debian/man-dir.patch | 0
.../debian/man-section.patch | 0
.../{openssl => openssl10}/debian/no-rpath.patch | 0
.../debian/no-symbolic.patch | 0
.../{openssl => openssl10}/debian/pic.patch | 0
.../debian/version-script.patch | 0
.../debian1.0.2/block_digicert_malaysia.patch | 0
.../debian1.0.2/block_diginotar.patch | 0
.../debian1.0.2/version-script.patch | 0
.../engines-install-in-libdir-ssl.patch | 0
.../openssl/{openssl => openssl10}/find.pl | 0
.../fix-cipher-des-ede3-cfb1.patch | 0
.../{openssl => openssl10}/oe-ldflags.patch | 0
.../openssl-1.0.2a-x32-asm.patch | 0
...-pointer-dereference-in-EVP_DigestInit_ex.patch | 0
.../{openssl => openssl10}/openssl-c_rehash.sh | 0
.../openssl-fix-des.pod-error.patch | 0
.../openssl-util-perlpath.pl-cwd.patch | 0
.../openssl_fix_for_x32.patch | 0
.../openssl/{openssl => openssl10}/parallel.patch | 0
.../{openssl => openssl10}/ptest-deps.patch | 0
.../ptest_makefile_deps.patch | 0
.../openssl/openssl10/run-ptest | 2 +
.../{openssl => openssl10}/shared-libs.patch | 0
.../{openssl_1.0.2k.bb => openssl10_1.0.2k.bb} | 4 +-
.../recipes-connectivity/openssl/openssl_1.1.0e.bb | 146 +++++++++++++++++++++
40 files changed, 261 insertions(+), 6 deletions(-)
create mode 100644 meta/recipes-connectivity/openssl/openssl/0001-Remove-test-that-requires-running-as-non-root.patch
create mode 100644 meta/recipes-connectivity/openssl/openssl/0001-Take-linking-flags-from-LDFLAGS-env-var.patch
mode change 100755 => 100644 meta/recipes-connectivity/openssl/openssl/run-ptest
rename meta/recipes-connectivity/openssl/{openssl.inc => openssl10.inc} (95%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/0001-Fix-build-with-clang-using-external-assembler.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/Makefiles-ptest.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/Use-SHA256-not-MD5-as-default-digest.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/configure-musl-target.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/configure-targets.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian/c_rehash-compat.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian/ca.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian/debian-targets.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian/man-dir.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian/man-section.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian/no-rpath.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian/no-symbolic.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian/pic.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian/version-script.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian1.0.2/block_digicert_malaysia.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian1.0.2/block_diginotar.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/debian1.0.2/version-script.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/engines-install-in-libdir-ssl.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/find.pl (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/fix-cipher-des-ede3-cfb1.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/oe-ldflags.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/openssl-1.0.2a-x32-asm.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/openssl-avoid-NULL-pointer-dereference-in-EVP_DigestInit_ex.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/openssl-c_rehash.sh (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/openssl-fix-des.pod-error.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/openssl-util-perlpath.pl-cwd.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/openssl_fix_for_x32.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/parallel.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/ptest-deps.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/ptest_makefile_deps.patch (100%)
create mode 100755 meta/recipes-connectivity/openssl/openssl10/run-ptest
rename meta/recipes-connectivity/openssl/{openssl => openssl10}/shared-libs.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl_1.0.2k.bb => openssl10_1.0.2k.bb} (97%)
create mode 100644 meta/recipes-connectivity/openssl/openssl_1.1.0e.bbmeta/conf/distro/include/no-static-libs.inc +3 -0
@@ -25,6 +25,9 @@ DISABLE_STATIC_pn-openjade-native = "" DISABLE_STATIC_pn-openssl = "" DISABLE_STATIC_pn-openssl-native = "" DISABLE_STATIC_pn-nativesdk-openssl = "" +DISABLE_STATIC_pn-openssl10 = "" +DISABLE_STATIC_pn-openssl10-native = "" +DISABLE_STATIC_pn-nativesdk-openssl10 = "" # libssp-static-dev included in build-appliance DISABLE_STATIC_pn-gcc-runtime = "" # libusb1-native is used to build static dfu-util-native
meta/conf/distro/include/security_flags.inc +1 -1
@@ -68,7 +68,7 @@ SECURITY_CFLAGS_pn-libpcre = "${SECURITY_NO_PIE_CFLAGS}" SECURITY_CFLAGS_pn-libproxy = "${SECURITY_NO_PIE_CFLAGS}" SECURITY_CFLAGS_pn-mesa = "${SECURITY_NO_PIE_CFLAGS}" SECURITY_CFLAGS_pn-mesa-gl = "${SECURITY_NO_PIE_CFLAGS}" -SECURITY_CFLAGS_pn-openssl = "${SECURITY_NO_PIE_CFLAGS}" +SECURITY_CFLAGS_pn-openssl10 = "${SECURITY_NO_PIE_CFLAGS}" SECURITY_CFLAGS_pn-opensp = "${SECURITY_NO_PIE_CFLAGS}" SECURITY_CFLAGS_pn-ppp = "${SECURITY_NO_PIE_CFLAGS}" SECURITY_CFLAGS_pn-python = "${SECURITY_NO_PIE_CFLAGS}"
meta/recipes-connectivity/openssl/openssl/0001-Remove-test-that-requires-running-as-non-root.patch new file +49 -0
49 lines not on this page · raw message
meta/recipes-connectivity/openssl/openssl/0001-Take-linking-flags-from-LDFLAGS-env-var.patch new file +43 -0
43 lines not on this page · raw message
meta/recipes-connectivity/openssl/openssl/run-ptest +3 -1
@@ -1,2 +1,4 @@ #!/bin/sh -make -k runtest +cd test +OPENSSL_ENGINES=../engines BLDTOP=.. SRCTOP=.. perl run_tests.pl +cd ..
meta/recipes-connectivity/openssl/openssl10.inc renamed from meta/recipes-connectivity/openssl/openssl.inc +12 -2
@@ -37,8 +37,6 @@ FILES_${PN} =+ " ${libdir}/ssl/*" FILES_${PN}-misc = "${libdir}/ssl/misc" RDEPENDS_${PN}-misc = "${@bb.utils.filter('PACKAGECONFIG', 'perl', d)}" -PROVIDES += "openssl10" - # Add the openssl.cnf file to the openssl-conf package. Make the libcrypto # package RRECOMMENDS on this package. This will enable the configuration # file to be installed for both the base openssl package and the libcrypto
@@ -250,3 +248,15 @@ do_install_append_class-native() { } BBCLASSEXTEND = "native nativesdk" + +PACKAGE_PREPROCESS_FUNCS += "openssl_package_preprocess" + +openssl_package_preprocess () { + for file in `find ${PKGD} -name *.h -o -name *.pc -o -name *.so`; do + rm $file + done + rm ${PKGD}/usr/bin/openssl + rm ${PKGD}/usr/bin/c_rehash + rmdir ${PKGD}/usr/bin + +}
meta/recipes-connectivity/openssl/openssl10/0001-Fix-build-with-clang-using-external-assembler.patch renamed from meta/recipes-connectivity/openssl/openssl/0001-Fix-build-with-clang-using-external-assembler.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/Makefiles-ptest.patch renamed from meta/recipes-connectivity/openssl/openssl/Makefiles-ptest.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/Use-SHA256-not-MD5-as-default-digest.patch renamed from meta/recipes-connectivity/openssl/openssl/Use-SHA256-not-MD5-as-default-digest.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/configure-musl-target.patch renamed from meta/recipes-connectivity/openssl/openssl/configure-musl-target.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/configure-targets.patch renamed from meta/recipes-connectivity/openssl/openssl/configure-targets.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/debian/c_rehash-compat.patch renamed from meta/recipes-connectivity/openssl/openssl/debian/c_rehash-compat.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/debian/ca.patch renamed from meta/recipes-connectivity/openssl/openssl/debian/ca.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/debian/debian-targets.patch renamed from meta/recipes-connectivity/openssl/openssl/debian/debian-targets.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/debian/man-dir.patch renamed from meta/recipes-connectivity/openssl/openssl/debian/man-dir.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/debian/man-section.patch renamed from meta/recipes-connectivity/openssl/openssl/debian/man-section.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/debian/no-rpath.patch renamed from meta/recipes-connectivity/openssl/openssl/debian/no-rpath.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/debian/no-symbolic.patch renamed from meta/recipes-connectivity/openssl/openssl/debian/no-symbolic.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/debian/pic.patch renamed from meta/recipes-connectivity/openssl/openssl/debian/pic.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/debian/version-script.patch renamed from meta/recipes-connectivity/openssl/openssl/debian/version-script.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/debian1.0.2/block_digicert_malaysia.patch renamed from meta/recipes-connectivity/openssl/openssl/debian1.0.2/block_digicert_malaysia.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/debian1.0.2/block_diginotar.patch renamed from meta/recipes-connectivity/openssl/openssl/debian1.0.2/block_diginotar.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/debian1.0.2/version-script.patch renamed from meta/recipes-connectivity/openssl/openssl/debian1.0.2/version-script.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/engines-install-in-libdir-ssl.patch renamed from meta/recipes-connectivity/openssl/openssl/engines-install-in-libdir-ssl.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/find.pl renamed from meta/recipes-connectivity/openssl/openssl/find.pl +0 -0
meta/recipes-connectivity/openssl/openssl10/fix-cipher-des-ede3-cfb1.patch renamed from meta/recipes-connectivity/openssl/openssl/fix-cipher-des-ede3-cfb1.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/oe-ldflags.patch renamed from meta/recipes-connectivity/openssl/openssl/oe-ldflags.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/openssl-1.0.2a-x32-asm.patch renamed from meta/recipes-connectivity/openssl/openssl/openssl-1.0.2a-x32-asm.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/openssl-avoid-NULL-pointer-dereference-in-EVP_DigestInit_ex.patch renamed from meta/recipes-connectivity/openssl/openssl/openssl-avoid-NULL-pointer-dereference-in-EVP_DigestInit_ex.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/openssl-c_rehash.sh renamed from meta/recipes-connectivity/openssl/openssl/openssl-c_rehash.sh +0 -0
meta/recipes-connectivity/openssl/openssl10/openssl-fix-des.pod-error.patch renamed from meta/recipes-connectivity/openssl/openssl/openssl-fix-des.pod-error.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/openssl-util-perlpath.pl-cwd.patch renamed from meta/recipes-connectivity/openssl/openssl/openssl-util-perlpath.pl-cwd.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/openssl_fix_for_x32.patch renamed from meta/recipes-connectivity/openssl/openssl/openssl_fix_for_x32.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/parallel.patch renamed from meta/recipes-connectivity/openssl/openssl/parallel.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/ptest-deps.patch renamed from meta/recipes-connectivity/openssl/openssl/ptest-deps.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/ptest_makefile_deps.patch renamed from meta/recipes-connectivity/openssl/openssl/ptest_makefile_deps.patch +0 -0
meta/recipes-connectivity/openssl/openssl10/run-ptest new file +2 -0
@@ -0,0 +1,2 @@ +#!/bin/sh +make -k runtest
meta/recipes-connectivity/openssl/openssl10/shared-libs.patch renamed from meta/recipes-connectivity/openssl/openssl/shared-libs.patch +0 -0
meta/recipes-connectivity/openssl/openssl10_1.0.2k.bb renamed from meta/recipes-connectivity/openssl/openssl_1.0.2k.bb +2 -2
@@ -1,4 +1,4 @@ -require openssl.inc +require openssl10.inc # For target side versions of openssl enable support for OCF Linux driver # if they are available.
@@ -12,7 +12,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=27ffa5d74bb5a337056c14b2ef93fbf6" export DIRS = "crypto ssl apps engines" export OE_LDFLAGS="${LDFLAGS}" -SRC_URI += "file://find.pl;subdir=${BP}/util/ \ +SRC_URI += "file://find.pl;subdir=openssl-${PV}/util/ \ file://run-ptest \ file://openssl-c_rehash.sh \ file://configure-targets.patch \
meta/recipes-connectivity/openssl/openssl_1.1.0e.bb new file +146 -0
146 lines not on this page · raw message
Signature · 1 line
2.11.0
RFC PATCH 3/10 u-boot-mkimage: depend on openssl 1.0
In reply to Alexander KanavinPatches have been circulating [1] but nothing
showed up in git repo yet.
[1] https://lists.denx.de/pipermail/u-boot/2017-April/285915.html
--- meta/recipes-bsp/u-boot/u-boot-mkimage_2017.01.bb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
meta/recipes-bsp/u-boot/u-boot-mkimage_2017.01.bb +1 -1
@@ -3,7 +3,7 @@ require u-boot-common_${PV}.inc SRC_URI += "file://default-gcc.patch" SUMMARY = "U-Boot bootloader image creation tool" -DEPENDS = "openssl" +DEPENDS = "openssl10" EXTRA_OEMAKE_class-target = 'CROSS_COMPILE="${TARGET_PREFIX}" CC="${CC} ${CFLAGS} ${LDFLAGS}" HOSTCC="${BUILD_CC} ${BUILD_CFLAGS} ${BUILD_LDFLAGS}" STRIP=true V=1' EXTRA_OEMAKE_class-native = 'CC="${BUILD_CC} ${BUILD_CFLAGS} ${BUILD_LDFLAGS}" HOSTCC="${BUILD_CC} ${BUILD_CFLAGS} ${BUILD_LDFLAGS}" STRIP=true V=1'
Signature · 1 line
2.11.0
RFC PATCH 4/10 bind: fix upstream version check
In reply to Alexander Kanavin--- meta/recipes-connectivity/bind/bind_9.10.3-P3.bb | 3 +++ 1 file changed, 3 insertions(+)
meta/recipes-connectivity/bind/bind_9.10.3-P3.bb +3 -0
@@ -31,6 +31,9 @@ SRC_URI = "ftp://ftp.isc.org/isc/bind9/${PV}/${BPN}-${PV}.tar.gz \ file://CVE-2016-6170.patch \ " +UPSTREAM_CHECK_URI = "ftp://ftp.isc.org/isc/bind9/" +UPSTREAM_CHECK_REGEX = "(?P<pver>9(\.\d+)+(-P\d+)*)/" + SRC_URI[md5sum] = "bcf7e772b616f7259420a3edc5df350a" SRC_URI[sha256sum] = "690810d1fbb72afa629e74638d19cd44e28d2b2e5eb63f55c705ad85d1a4cb83"
Signature · 1 line
2.11.0
RFC PATCH 5/10 bind: update to 9.10.5
In reply to Alexander KanavinThis is needed to support openssl 1.1; updating to 9.11.x should be done later by recipe maintainer.
Drop upstreamed patches.
Rebase bind-confgen-build-unix.o-once.patch and 0001-build-use-pkg-config-to-find-libxml2.patch
Add support for Python 3 bindings
---
...0001-build-use-pkg-config-to-find-libxml2.patch | 14 +-
...=> 0001-confgen-don-t-build-unix.o-twice.patch} | 17 +-
.../bind/bind/CVE-2016-1285.patch | 154 ----------
.../bind/bind/CVE-2016-1286_1.patch | 79 -----
.../bind/bind/CVE-2016-1286_2.patch | 317 ---------------------
.../bind/bind/CVE-2016-2088.patch | 247 ----------------
.../bind/bind/CVE-2016-2775.patch | 90 ------
.../bind/bind/CVE-2016-2776.patch | 123 --------
.../bind/bind/mips1-not-support-opcode.diff | 104 -------
.../bind/{bind_9.10.3-P3.bb => bind_9.10.5.bb} | 24 +-
10 files changed, 28 insertions(+), 1141 deletions(-)
rename meta/recipes-connectivity/bind/bind/{bind-confgen-build-unix.o-once.patch => 0001-confgen-don-t-build-unix.o-twice.patch} (80%)
delete mode 100644 meta/recipes-connectivity/bind/bind/CVE-2016-1285.patch
delete mode 100644 meta/recipes-connectivity/bind/bind/CVE-2016-1286_1.patch
delete mode 100644 meta/recipes-connectivity/bind/bind/CVE-2016-1286_2.patch
delete mode 100644 meta/recipes-connectivity/bind/bind/CVE-2016-2088.patch
delete mode 100644 meta/recipes-connectivity/bind/bind/CVE-2016-2775.patch
delete mode 100644 meta/recipes-connectivity/bind/bind/CVE-2016-2776.patch
delete mode 100644 meta/recipes-connectivity/bind/bind/mips1-not-support-opcode.diff
rename meta/recipes-connectivity/bind/{bind_9.10.3-P3.bb => bind_9.10.5.bb} (83%)meta/recipes-connectivity/bind/bind/0001-build-use-pkg-config-to-find-libxml2.patch +10 -4
@@ -1,3 +1,8 @@ +From 8031da48a6a3cb01e907dd199ad4f34c90b22969 Mon Sep 17 00:00:00 2001 +From: Ross Burton <[email protected]> +Date: Thu, 7 May 2015 15:30:53 +0100 +Subject: [PATCH 6/9] bind: update libxml2 detection patch + xml2-config is disabled, so change the configure script to use pkgconfig to find libxml2.
@@ -7,15 +12,16 @@ Signed-off-by: Ross Burton <[email protected]> Update context for version 9.10.3-P2. Signed-off-by: Kai Kang <[email protected]> + --- configure.in | 23 +++-------------------- 1 file changed, 3 insertions(+), 20 deletions(-) diff --git a/configure.in b/configure.in -index 0db826d..75819eb 100644 +index cb66823..5112f3a 100644 --- a/configure.in +++ b/configure.in -@@ -2107,26 +2107,9 @@ case "$use_libxml2" in +@@ -2281,26 +2281,9 @@ case "$use_libxml2" in DST_LIBXML2_INC="" ;; auto|yes)
@@ -25,7 +31,7 @@ index 0db826d..75819eb 100644 - libxml2_cflags=`xml2-config --cflags` - ;; - *) -- if test "$use_libxml2" = "yes" ; then +- if test "yes" = "$use_libxml2" ; then - AC_MSG_RESULT(no) - AC_MSG_ERROR(required libxml2 version not available) - else
@@ -46,5 +52,5 @@ index 0db826d..75819eb 100644 ;; esac -- -2.1.4 +2.11.0
meta/recipes-connectivity/bind/bind/0001-confgen-don-t-build-unix.o-twice.patch renamed from meta/recipes-connectivity/bind/bind/bind-confgen-build-unix.o-once.patch +9 -8
@@ -1,6 +1,6 @@ -From 9b40619ff6fddfef2758ba797789f8487f412df3 Mon Sep 17 00:00:00 2001 -From: Robert Yang <[email protected]> -Date: Mon, 16 Feb 2015 00:50:01 -0800 +From c9c7ac9c7e231f086bfa1e4c63fe1213cd2b2694 Mon Sep 17 00:00:00 2001 +From: Alexander Kanavin <[email protected]> +Date: Mon, 3 Apr 2017 14:29:18 +0300 Subject: [PATCH] confgen: don't build unix.o twice Fixed:
@@ -17,28 +17,29 @@ problem. Upstream-Status: Pending Signed-off-by: Robert Yang <[email protected]> +Signed-off-by: Alexander Kanavin <[email protected]> --- - bin/confgen/Makefile.in | 4 ++-- + bin/confgen/Makefile.in | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/bin/confgen/Makefile.in b/bin/confgen/Makefile.in -index 8b3e5aa..4868a24 100644 +index dca272f..02becce 100644 --- a/bin/confgen/Makefile.in +++ b/bin/confgen/Makefile.in @@ -74,11 +74,11 @@ rndc-confgen.@O@: rndc-confgen.c ddns-confgen.@O@: ddns-confgen.c ${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -c ${srcdir}/ddns-confgen.c --rndc-confgen@EXEEXT@: rndc-confgen.@O@ util.@O@ keygen.@O@ ${UOBJS} ${CONFDEPLIBS} +-rndc-confgen@EXEEXT@: rndc-confgen.@O@ util.@O@ keygen.@O@ ${UOBJS} ${CONFDEPLIBS} +rndc-confgen@EXEEXT@: rndc-confgen.@O@ util.@O@ keygen.@O@ ${CONFDEPLIBS} $(SUBDIRS) export BASEOBJS="rndc-confgen.@O@ util.@O@ keygen.@O@ ${UOBJS}"; \ ${FINALBUILDCMD} --ddns-confgen@EXEEXT@: ddns-confgen.@O@ util.@O@ keygen.@O@ ${UOBJS} ${CONFDEPLIBS} +-ddns-confgen@EXEEXT@: ddns-confgen.@O@ util.@O@ keygen.@O@ ${UOBJS} ${CONFDEPLIBS} +ddns-confgen@EXEEXT@: ddns-confgen.@O@ util.@O@ keygen.@O@ ${CONFDEPLIBS} $(SUBDIRS) export BASEOBJS="ddns-confgen.@O@ util.@O@ keygen.@O@ ${UOBJS}"; \ ${FINALBUILDCMD} -- -1.7.9.5 +2.11.0
meta/recipes-connectivity/bind/bind/CVE-2016-1285.patch deleted +0 -154
154 lines not on this page · raw message
meta/recipes-connectivity/bind/bind/CVE-2016-1286_1.patch deleted +0 -79
79 lines not on this page · raw message
meta/recipes-connectivity/bind/bind/CVE-2016-1286_2.patch deleted +0 -317
317 lines not on this page · raw message
meta/recipes-connectivity/bind/bind/CVE-2016-2088.patch deleted +0 -247
247 lines not on this page · raw message
meta/recipes-connectivity/bind/bind/CVE-2016-2775.patch deleted +0 -90
90 lines not on this page · raw message
meta/recipes-connectivity/bind/bind/CVE-2016-2776.patch deleted +0 -123
123 lines not on this page · raw message
meta/recipes-connectivity/bind/bind/mips1-not-support-opcode.diff deleted +0 -104
104 lines not on this page · raw message
meta/recipes-connectivity/bind/bind_9.10.5.bb renamed from meta/recipes-connectivity/bind/bind_9.10.3-P3.bb +9 -15
@@ -3,39 +3,30 @@ HOMEPAGE = "http://www.isc.org/sw/bind/" SECTION = "console/network" LICENSE = "ISC & BSD" -LIC_FILES_CHKSUM = "file://COPYRIGHT;md5=0a95f52a0ab6c5f52dedc9a45e7abb3f" +LIC_FILES_CHKSUM = "file://COPYRIGHT;md5=dba46507446198119bcde32a4feaab43" -DEPENDS = "openssl libcap" +DEPENDS = "openssl libcap python3" SRC_URI = "ftp://ftp.isc.org/isc/bind9/${PV}/${BPN}-${PV}.tar.gz \ file://conf.patch \ file://make-etc-initd-bind-stop-work.patch \ - file://mips1-not-support-opcode.diff \ file://dont-test-on-host.patch \ file://generate-rndc-key.sh \ file://named.service \ file://bind9 \ file://init.d-add-support-for-read-only-rootfs.patch \ - file://bind-confgen-build-unix.o-once.patch \ + file://0001-confgen-don-t-build-unix.o-twice.patch \ file://0001-build-use-pkg-config-to-find-libxml2.patch \ file://bind-ensure-searching-for-json-headers-searches-sysr.patch \ file://0001-gen.c-extend-DIRNAMESIZE-from-256-to-512.patch \ file://0001-lib-dns-gen.c-fix-too-long-error.patch \ - file://CVE-2016-1285.patch \ - file://CVE-2016-1286_1.patch \ - file://CVE-2016-1286_2.patch \ - file://CVE-2016-2088.patch \ - file://CVE-2016-2775.patch \ - file://CVE-2016-2776.patch \ - file://CVE-2016-8864.patch \ - file://CVE-2016-6170.patch \ " UPSTREAM_CHECK_URI = "ftp://ftp.isc.org/isc/bind9/" UPSTREAM_CHECK_REGEX = "(?P<pver>9(\.\d+)+(-P\d+)*)/" -SRC_URI[md5sum] = "bcf7e772b616f7259420a3edc5df350a" -SRC_URI[sha256sum] = "690810d1fbb72afa629e74638d19cd44e28d2b2e5eb63f55c705ad85d1a4cb83" +SRC_URI[md5sum] = "8359e000eaec76efd6dfa186c12c3b93" +SRC_URI[sha256sum] = "71688d2e134e42205075eef93cc1b78b42a140a2d61bf8263afc9c92fc872b0e" ENABLE_IPV6 = "--enable-ipv6=${@bb.utils.contains('DISTRO_FEATURES', 'ipv6', 'yes', 'no', d)}" EXTRA_OECONF = " ${ENABLE_IPV6} --with-randomdev=/dev/random --disable-threads \
@@ -43,8 +34,9 @@ EXTRA_OECONF = " ${ENABLE_IPV6} --with-randomdev=/dev/random --disable-threads \ --with-gssapi=no --with-ecdsa=yes \ --sysconfdir=${sysconfdir}/bind \ --with-openssl=${STAGING_LIBDIR}/.. \ + --with-python=python3 \ " -inherit autotools update-rc.d systemd useradd pkgconfig +inherit autotools update-rc.d systemd useradd pkgconfig python3native # PACKAGECONFIGs readline and libedit should NOT be set at same time PACKAGECONFIG ?= "readline"
@@ -67,9 +59,11 @@ RDEPENDS_${PN} = "python3-core" RDEPENDS_${PN}-dev = "" PACKAGE_BEFORE_PN += "${PN}-utils" +PACKAGES += "python3-${PN}" FILES_${PN}-utils = "${bindir}/host ${bindir}/dig" FILES_${PN}-dev += "${bindir}/isc-config.h" FILES_${PN} += "${sbindir}/generate-rndc-key.sh" +FILES_python3-${PN} += "${PYTHON_SITEPACKAGES_DIR}" do_install_prepend() { # clean host path in isc-config.sh before the hardlink created
Signature · 1 line
2.11.0
RFC PATCH 6/10 openssh: depend on openssl 1.0
In reply to Alexander KanavinThe proposed openssl 1.1 patches are here:
https://github.com/openssh/openssh-portable/pull/48
Openssl maintainers are not in a hurry to get 1.1 support in; if it doesn't show up within reasonable time, we can take a patch from Fedora:
http://lists.mindrot.org/pipermail/openssh-unix-dev/2016-November/035454.html
--- meta/recipes-connectivity/openssh/openssh_7.4p1.bb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
meta/recipes-connectivity/openssh/openssh_7.4p1.bb +2 -1
@@ -8,7 +8,8 @@ SECTION = "console/network" LICENSE = "BSD" LIC_FILES_CHKSUM = "file://LICENCE;md5=e326045657e842541d3f35aada442507" -DEPENDS = "zlib openssl" +# openssl 1.1 patches are proposed at https://github.com/openssh/openssh-portable/pull/48 +DEPENDS = "zlib openssl10" DEPENDS += "${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'libpam', '', d)}" SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar.gz \
Signature · 1 line
2.11.0
RFC PATCH 7/10 apr-util: add support for openssl 1.1 via backported patch
In reply to Alexander Kanavin--- .../recipes-support/apr/apr-util/openssl-1.1.patch | 253 +++++++++++++++++++++ meta/recipes-support/apr/apr-util_1.5.4.bb | 1 + 2 files changed, 254 insertions(+) create mode 100644 meta/recipes-support/apr/apr-util/openssl-1.1.patch
meta/recipes-support/apr/apr-util/openssl-1.1.patch new file +253 -0
@@ -0,0 +1,253 @@ +# commit f163d8b5af9185de80d24b4dd13951dd64872aa6 +# Author: Rainer Jung <[email protected]> +# Date: Sun Feb 7 14:40:46 2016 +0000 +# +# Add support for OpenSSL 1.1.0: +# - Switch configure test for OpenSSL libcrypto +# from BN_init() to BN_new(). +# - BN_init() is gone in OpenSSL 1.1.0. +# BN_new() exists at least since 0.9.8. +# - use OPENSSL_malloc_init() instead of +# CRYPTO_malloc_init +# - make cipherCtx a pointer. Type EVP_CIPHER_CTX +# is now opaque. +# - use EVP_CIPHER_CTX_new() in init() functions +# if initialised flag is not set (and set flag) +# - use EVP_CIPHER_CTX_free() in cleanup function +# - Improve reuse cleanup +# - call EVP_CIPHER_CTX_reset() resp. +# EVP_CIPHER_CTX_cleanup() in finish functions +# - call EVP_CIPHER_CTX_reset() resp. +# EVP_CIPHER_CTX_cleanup() when Update fails +# Backport of r1728958 and r1728963 from trunk. +# +# +# git-svn-id: https://svn.apache.org/repos/asf/apr/apr-util/branches/1.5.x@1728969 13f79535-47bb-0310-9956-ffa450edef68 +# + +Signed-off-by: Alexander Kanavin <[email protected]> +Upstream-Status: Backport +diff --git a/build/crypto.m4 b/build/crypto.m4 +index 9f9be6f..57884e3 100644 +--- a/build/crypto.m4 ++++ b/build/crypto.m4 +@@ -88,7 +88,7 @@ AC_DEFUN([APU_CHECK_CRYPTO_OPENSSL], [ + [ + if test "$withval" = "yes"; then + AC_CHECK_HEADERS(openssl/x509.h, [openssl_have_headers=1]) +- AC_CHECK_LIB(crypto, BN_init, AC_CHECK_LIB(ssl, SSL_accept, [openssl_have_libs=1],,-lcrypto)) ++ AC_CHECK_LIB(crypto, BN_new, AC_CHECK_LIB(ssl, SSL_accept, [openssl_have_libs=1],,-lcrypto)) + if test "$openssl_have_headers" != "0" && test "$openssl_have_libs" != "0"; then + apu_have_openssl=1 + fi +@@ -104,7 +104,7 @@ AC_DEFUN([APU_CHECK_CRYPTO_OPENSSL], [ + + AC_MSG_NOTICE(checking for openssl in $withval) + AC_CHECK_HEADERS(openssl/x509.h, [openssl_have_headers=1]) +- AC_CHECK_LIB(crypto, BN_init, AC_CHECK_LIB(ssl, SSL_accept, [openssl_have_libs=1],,-lcrypto)) ++ AC_CHECK_LIB(crypto, BN_new, AC_CHECK_LIB(ssl, SSL_accept, [openssl_have_libs=1],,-lcrypto)) + if test "$openssl_have_headers" != "0" && test "$openssl_have_libs" != "0"; then + apu_have_openssl=1 + APR_ADDTO(APRUTIL_LDFLAGS, [-L$withval/lib]) +@@ -113,7 +113,7 @@ AC_DEFUN([APU_CHECK_CRYPTO_OPENSSL], [ + + if test "$apu_have_openssl" != "1"; then + AC_CHECK_HEADERS(openssl/x509.h, [openssl_have_headers=1]) +- AC_CHECK_LIB(crypto, BN_init, AC_CHECK_LIB(ssl, SSL_accept, [openssl_have_libs=1],,-lcrypto)) ++ AC_CHECK_LIB(crypto, BN_new, AC_CHECK_LIB(ssl, SSL_accept, [openssl_have_libs=1],,-lcrypto)) + if test "$openssl_have_headers" != "0" && test "$openssl_have_libs" != "0"; then + apu_have_openssl=1 + APR_ADDTO(APRUTIL_LDFLAGS, [-L$withval/lib]) +diff --git a/crypto/apr_crypto_openssl.c b/crypto/apr_crypto_openssl.c +index 0740f93..7d61fca 100644 +--- a/crypto/apr_crypto_openssl.c ++++ b/crypto/apr_crypto_openssl.c +@@ -64,7 +64,7 @@ struct apr_crypto_block_t { + apr_pool_t *pool; + const apr_crypto_driver_t *provider; + const apr_crypto_t *f; +- EVP_CIPHER_CTX cipherCtx; ++ EVP_CIPHER_CTX *cipherCtx; + int initialised; + int ivSize; + int blockSize; +@@ -111,7 +111,11 @@ static apr_status_t crypto_shutdown_helper(void *data) + static apr_status_t crypto_init(apr_pool_t *pool, const char *params, + const apu_err_t **result) + { ++#if OPENSSL_VERSION_NUMBER < 0x10100000L + CRYPTO_malloc_init(); ++#else ++ OPENSSL_malloc_init(); ++#endif + ERR_load_crypto_strings(); + /* SSL_load_error_strings(); */ + OpenSSL_add_all_algorithms(); +@@ -134,7 +138,7 @@ static apr_status_t crypto_block_cleanup(apr_crypto_block_t *ctx) + { + + if (ctx->initialised) { +- EVP_CIPHER_CTX_cleanup(&ctx->cipherCtx); ++ EVP_CIPHER_CTX_free(ctx->cipherCtx); + ctx->initialised = 0; + } + +@@ -491,8 +495,10 @@ static apr_status_t crypto_block_encrypt_init(apr_crypto_block_t **ctx, + apr_pool_cleanup_null); + + /* create a new context for encryption */ +- EVP_CIPHER_CTX_init(&block->cipherCtx); +- block->initialised = 1; ++ if (!block->initialised) { ++ block->cipherCtx = EVP_CIPHER_CTX_new(); ++ block->initialised = 1; ++ } + + /* generate an IV, if necessary */ + usedIv = NULL; +@@ -519,16 +525,16 @@ static apr_status_t crypto_block_encrypt_init(apr_crypto_block_t **ctx, + + /* set up our encryption context */ + #if CRYPTO_OPENSSL_CONST_BUFFERS +- if (!EVP_EncryptInit_ex(&block->cipherCtx, key->cipher, config->engine, ++ if (!EVP_EncryptInit_ex(block->cipherCtx, key->cipher, config->engine, + key->key, usedIv)) { + #else +- if (!EVP_EncryptInit_ex(&block->cipherCtx, key->cipher, config->engine, (unsigned char *) key->key, (unsigned char *) usedIv)) { ++ if (!EVP_EncryptInit_ex(block->cipherCtx, key->cipher, config->engine, (unsigned char *) key->key, (unsigned char *) usedIv)) { + #endif + return APR_EINIT; + } + + /* Clear up any read padding */ +- if (!EVP_CIPHER_CTX_set_padding(&block->cipherCtx, key->doPad)) { ++ if (!EVP_CIPHER_CTX_set_padding(block->cipherCtx, key->doPad)) { + return APR_EPADDING; + } + +@@ -582,11 +588,16 @@ static apr_status_t crypto_block_encrypt(unsigned char **out, + } + + #if CRYPT_OPENSSL_CONST_BUFFERS +- if (!EVP_EncryptUpdate(&ctx->cipherCtx, (*out), &outl, in, inlen)) { ++ if (!EVP_EncryptUpdate(ctx->cipherCtx, (*out), &outl, in, inlen)) { + #else +- if (!EVP_EncryptUpdate(&ctx->cipherCtx, (*out), &outl, ++ if (!EVP_EncryptUpdate(ctx->cipherCtx, (*out), &outl, + (unsigned char *) in, inlen)) { + #endif ++#if OPENSSL_VERSION_NUMBER < 0x10100000L ++ EVP_CIPHER_CTX_cleanup(ctx->cipherCtx); ++#else ++ EVP_CIPHER_CTX_reset(ctx->cipherCtx); ++#endif + return APR_ECRYPT; + } + *outlen = outl; +@@ -616,14 +627,22 @@ static apr_status_t crypto_block_encrypt(unsigned char **out, + static apr_status_t crypto_block_encrypt_finish(unsigned char *out, + apr_size_t *outlen, apr_crypto_block_t *ctx) + { ++ apr_status_t rc = APR_SUCCESS; + int len = *outlen; + +- if (EVP_EncryptFinal_ex(&ctx->cipherCtx, out, &len) == 0) { +- return APR_EPADDING; ++ if (EVP_EncryptFinal_ex(ctx->cipherCtx, out, &len) == 0) { ++ rc = APR_EPADDING; ++ } ++ else { ++ *outlen = len; + } +- *outlen = len; ++#if OPENSSL_VERSION_NUMBER < 0x10100000L ++ EVP_CIPHER_CTX_cleanup(ctx->cipherCtx); ++#else ++ EVP_CIPHER_CTX_reset(ctx->cipherCtx); ++#endif + +- return APR_SUCCESS; ++ return rc; + + } + +@@ -662,8 +681,10 @@ static apr_status_t crypto_block_decrypt_init(apr_crypto_block_t **ctx, + apr_pool_cleanup_null); + + /* create a new context for encryption */ +- EVP_CIPHER_CTX_init(&block->cipherCtx); +- block->initialised = 1; ++ if (!block->initialised) { ++ block->cipherCtx = EVP_CIPHER_CTX_new(); ++ block->initialised = 1; ++ } + + /* generate an IV, if necessary */ + if (key->ivSize) { +@@ -674,16 +695,16 @@ static apr_status_t crypto_block_decrypt_init(apr_crypto_block_t **ctx, + + /* set up our encryption context */ + #if CRYPTO_OPENSSL_CONST_BUFFERS +- if (!EVP_DecryptInit_ex(&block->cipherCtx, key->cipher, config->engine, ++ if (!EVP_DecryptInit_ex(block->cipherCtx, key->cipher, config->engine, + key->key, iv)) { + #else +- if (!EVP_DecryptInit_ex(&block->cipherCtx, key->cipher, config->engine, (unsigned char *) key->key, (unsigned char *) iv)) { ++ if (!EVP_DecryptInit_ex(block->cipherCtx, key->cipher, config->engine, (unsigned char *) key->key, (unsigned char *) iv)) { + #endif + return APR_EINIT; + } + + /* Clear up any read padding */ +- if (!EVP_CIPHER_CTX_set_padding(&block->cipherCtx, key->doPad)) { ++ if (!EVP_CIPHER_CTX_set_padding(block->cipherCtx, key->doPad)) { + return APR_EPADDING; + } + +@@ -737,11 +758,16 @@ static apr_status_t crypto_block_decrypt(unsigned char **out, + } + + #if CRYPT_OPENSSL_CONST_BUFFERS +- if (!EVP_DecryptUpdate(&ctx->cipherCtx, *out, &outl, in, inlen)) { ++ if (!EVP_DecryptUpdate(ctx->cipherCtx, *out, &outl, in, inlen)) { + #else +- if (!EVP_DecryptUpdate(&ctx->cipherCtx, *out, &outl, (unsigned char *) in, ++ if (!EVP_DecryptUpdate(ctx->cipherCtx, *out, &outl, (unsigned char *) in, + inlen)) { + #endif ++#if OPENSSL_VERSION_NUMBER < 0x10100000L ++ EVP_CIPHER_CTX_cleanup(ctx->cipherCtx); ++#else ++ EVP_CIPHER_CTX_reset(ctx->cipherCtx); ++#endif + return APR_ECRYPT; + } + *outlen = outl; +@@ -771,15 +797,22 @@ static apr_status_t crypto_block_decrypt(unsigned char **out, + static apr_status_t crypto_block_decrypt_finish(unsigned char *out, + apr_size_t *outlen, apr_crypto_block_t *ctx) + { +- ++ apr_status_t rc = APR_SUCCESS; + int len = *outlen; + +- if (EVP_DecryptFinal_ex(&ctx->cipherCtx, out, &len) == 0) { +- return APR_EPADDING; ++ if (EVP_DecryptFinal_ex(ctx->cipherCtx, out, &len) == 0) { ++ rc = APR_EPADDING; + } +- *outlen = len; ++ else { ++ *outlen = len; ++ } ++#if OPENSSL_VERSION_NUMBER < 0x10100000L ++ EVP_CIPHER_CTX_cleanup(ctx->cipherCtx); ++#else ++ EVP_CIPHER_CTX_reset(ctx->cipherCtx); ++#endif + +- return APR_SUCCESS; ++ return rc; + + } +
meta/recipes-support/apr/apr-util_1.5.4.bb +1 -0
@@ -13,6 +13,7 @@ SRC_URI = "${APACHE_MIRROR}/apr/${BPN}-${PV}.tar.gz \ file://configfix.patch \ file://configure_fixes.patch \ file://run-ptest \ + file://openssl-1.1.patch \ " SRC_URI[md5sum] = "866825c04da827c6e5f53daff5569f42"
Signature · 1 line
2.11.0
RFC PATCH 8/10 cryptodev-tests: depend on openssl 1.0
In reply to Alexander KanavinUpstream ticket:
https://github.com/cryptodev-linux/cryptodev-linux/issues/22
--- meta/recipes-kernel/cryptodev/cryptodev-tests_1.8.bb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
meta/recipes-kernel/cryptodev/cryptodev-tests_1.8.bb +1 -1
@@ -2,7 +2,7 @@ require cryptodev.inc SUMMARY = "A test suite for /dev/crypto device driver" -DEPENDS += "openssl" +DEPENDS += "openssl10" SRC_URI += " \ file://0001-Add-the-compile-and-install-rules-for-cryptodev-test.patch \
Signature · 1 line
2.11.0
RFC PATCH 9/10 mailx: depend on openssl 1.0
In reply to Alexander KanavinWe only carry this recipe for LSB compatibility; if we need
a modern supported implementation of mail/mailx, then
s-nail (http://sdaoden.eu/code.html) or mailutils (http://mailutils.org/)
should be used.
--- meta/recipes-extended/mailx/mailx_12.5-5.bb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
meta/recipes-extended/mailx/mailx_12.5-5.bb +1 -1
@@ -9,7 +9,7 @@ SECTION = "console/network" LICENSE = "BSD & MPL-1" LIC_FILES_CHKSUM = "file://COPYING;md5=4202a0a62910cf94f7af8a3436a2a2dd" -DEPENDS = "openssl" +DEPENDS = "openssl10" SRC_URI = "http://snapshot.debian.org/archive/debian/20160728T043443Z/pool/main/h/heirloom-mailx/heirloom-mailx_12.5.orig.tar.gz;name=archive \ file://0001-Don-t-reuse-weak-symbol-optopt-to-fix-FTBFS-on-mips.patch \
Signature · 1 line
2.11.0
RFC PATCH 10/10 gstreamer-plugins-bad: replace openssl dependency with nettle for hls plugin
In reply to Alexander KanavinIt has not been ported to openssl 1.1 (and there's nothing in upstream git), but it's possible to use nettle or gcrypt intead.
--- meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad.inc | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad.inc +1 -3
@@ -40,9 +40,7 @@ PACKAGECONFIG[flite] = "--enable-flite,--disable-flite,flite-alsa" PACKAGECONFIG[fluidsynth] = "--enable-fluidsynth,--disable-fluidsynth,fluidsynth" PACKAGECONFIG[gles2] = "--enable-gles2,--disable-gles2,virtual/libgles2" PACKAGECONFIG[gtk] = "--enable-gtk3,--disable-gtk3,gtk+3" -# ensure OpenSSL is used for HLS AES description instead of nettle -# (OpenSSL is a shared dependency with dtls) -PACKAGECONFIG[hls] = "--enable-hls --with-hls-crypto=openssl,--disable-hls,openssl" +PACKAGECONFIG[hls] = "--enable-hls --with-hls-crypto=nettle,--disable-hls,nettle" PACKAGECONFIG[kms] = "--enable-kms,--disable-kms,libdrm" PACKAGECONFIG[libmms] = "--enable-libmms,--disable-libmms,libmms" PACKAGECONFIG[libssh2] = "--enable-libssh2,--disable-libssh2,libssh2"
Signature · 1 line
2.11.0
Won't this cause a lot of issues for those of us that require FIPS? I don't think 1.1 is expected to get FIPS support for some time.
--
Mike
Quoted 2 lines · Michael
Won't this cause a lot of issues for those of us that require FIPS? I don't think 1.1 is expected to get FIPS support for some time.
https://www.openssl.org/blog/blog/2016/07/20/fips/#comment-3277656289
"There's been a delay on starting due to a priority focus on finishing the TLS 1.3 implementation; we're still waiting on a final TLS 1.3 spec.
Schedule estimates are difficult, not only because we haven't actually started yet but because the FIPS 140 validation process is notoriously unpredictable. Based on the first five open source based validations I would be surprised to see a final approved validation in less than two years after we start, but my prognostications have been wrong before."
Would you be okay with staying on yocto 2.3 release until this is resolved? Otherwise, this can be delayed somewhat, but "we haven't started yet; we have no idea how long it's gonna take; probably two years or more" does not seem like a reasonable ask. There are other users of oe-core, who do not care about FIPS, and at the same time do want to have 1.1.
Alex
Sitting on 2.3 wouldn't be too much an issue for me, but I can't speak for others that may be in the same situation. Do these patches / new versions require 1.1.0 or break backwards compatibility with 1.0.2?
It would be nice if it could be handled by the PREFFERED_VERSION/PREFERRERED_PROVIDER.
-----Original Message-----
From: Alexander Kanavin [mailto:[email protected]]
Sent: Wednesday, May 10, 2017 10:16 AM
To: Davis, Michael; [email protected]
Subject: Re: [OE-core] [RFC PATCH 00/10] Add openssl 1.1
Quoted 2 lines · Michael
Won't this cause a lot of issues for those of us that require FIPS? I don't think 1.1 is expected to get FIPS support for some time.
https://www.openssl.org/blog/blog/2016/07/20/fips/#comment-3277656289
"There's been a delay on starting due to a priority focus on finishing the TLS 1.3 implementation; we're still waiting on a final TLS 1.3 spec.
Schedule estimates are difficult, not only because we haven't actually started yet but because the FIPS 140 validation process is notoriously unpredictable. Based on the first five open source based validations I would be surprised to see a final approved validation in less than two years after we start, but my prognostications have been wrong before."
Would you be okay with staying on yocto 2.3 release until this is resolved? Otherwise, this can be delayed somewhat, but "we haven't started yet; we have no idea how long it's gonna take; probably two years or more" does not seem like a reasonable ask. There are other users of oe-core, who do not care about FIPS, and at the same time do want to have 1.1.
Alex
Quoted 3 lines · Michael
Sitting on 2.3 wouldn't be too much an issue for me, but I can't speak for others that may be in the same situation. Do these patches / new versions require 1.1.0 or break backwards compatibility with 1.0.2?
It would be nice if it could be handled by the PREFFERED_VERSION/PREFERRERED_PROVIDER.
PREFERRED_ thing is not possible, unfortunately. 1.1 is API incompatible with 1.0, and so both need to be provided at the same time, with recipes explicitly telling which one they need. Most of the patchset is moving various recipes to newer, 1.1 compatible versions, so we minimize the need for 1.0.
1.0 will be provided for as long as upstream supports it, which should be another two years or so.
Alex
Quoted 7 lines · Alexander Kanavin
This patch series introduces the recipe for openssl 1.1 (openssl 1.0 is preserved but renamed to openssl10), and does a few necessary adjustmenets and updates to other recipes. The reason it's marked RFC is that there is one known remaining issue to
resolve: specifically, u-boot needs to be ported to 1.1 before this series can be merged, otherwise there's a dependency conflict when building native u-boot. This should be resolved quite soon, but it isn't yet (as of u-boot v2017.05).
Quoted 8 lines
Openssl 1.1 is an opt-out; it has the same recipe name as openssl 1.0 had, and so all dependencies are compiled with it by default. If there's an API issue, please fix it, or adjust the recipe to depend on 'openssl10' (which is a lesser solution, and subject to openssl 1.0 eventually being removed from oe-core).
Please review the following changes for suitability for inclusion. If you have any objections or suggestions for improvement, please respond to the patches. If you agree with the changes, please provide your Acked-by
Quoted 141 lines
.
The following changes since commit
381897c64069ea43d595380a3ae913bcc79cf7e1:build-appliance-image: Update to master head revision (2017-05-01 08:56:47 +0100)are available in the git repository at:
git://git.yoctoproject.org/poky-contribakanavin/openssl-1.1
http://git.yoctoproject.org/cgit.cgi/poky-contrib/log/?h=akanavin/openssl-1.1Alexander Kanavin (10):
python: update to 3.5.3
openssl: add a 1.1 version
u-boot-mkimage: depend on openssl 1.0
bind: fix upstream version check
bind: update to 9.10.5
openssh: depend on openssl 1.0
apr-util: add support for openssl 1.1 via backported patch
cryptodev-tests: depend on openssl 1.0
mailx: depend on openssl 1.0
gstreamer-plugins-bad: replace openssl dependency with nettle for hls
pluginmeta/conf/distro/include/no-static-libs.inc | 3 + meta/conf/distro/include/security_flags.inc | 2 +- meta/recipes-bsp/u-boot/u-boot-mkimage_2017.01.bb | 2 +- ...0001-build-use-pkg-config-to-find-libxml2.patch | 14 +- ...=> 0001-confgen-don-t-build-unix.o-twice.patch} | 17 +- .../bind/bind/CVE-2016-1285.patch | 154 ---------- .../bind/bind/CVE-2016-1286_1.patch | 79 ----- .../bind/bind/CVE-2016-1286_2.patch | 317 --------------------- .../bind/bind/CVE-2016-2088.patch | 247 ---------------- .../bind/bind/CVE-2016-2775.patch | 90 ------ .../bind/bind/CVE-2016-2776.patch | 123 -------- .../bind/bind/mips1-not-support-opcode.diff | 104 ------- .../bind/{bind_9.10.3-P3.bb => bind_9.10.5.bb} | 27 +- meta/recipes-connectivity/openssh/openssh_7.4p1.bb | 3 +- ...ve-test-that-requires-running-as-non-root.patch | 49 ++++ ...1-Take-linking-flags-from-LDFLAGS-env-var.patch | 43 +++ .../recipes-connectivity/openssl/openssl/run-ptest | 4 +- .../openssl/{openssl.inc => openssl10.inc} | 14 +- ...build-with-clang-using-external-assembler.patch | 0 .../{openssl => openssl10}/Makefiles-ptest.patch | 0 .../Use-SHA256-not-MD5-as-default-digest.patch | 0 .../configure-musl-target.patch | 0 .../{openssl => openssl10}/configure-targets.patch | 0 .../debian/c_rehash-compat.patch | 0 .../openssl/{openssl => openssl10}/debian/ca.patch | 0 .../debian/debian-targets.patch | 0 .../{openssl => openssl10}/debian/man-dir.patch | 0 .../debian/man-section.patch | 0 .../{openssl => openssl10}/debian/no-rpath.patch | 0 .../debian/no-symbolic.patch | 0 .../{openssl => openssl10}/debian/pic.patch | 0 .../debian/version-script.patch | 0 .../debian1.0.2/block_digicert_malaysia.patch | 0 .../debian1.0.2/block_diginotar.patch | 0 .../debian1.0.2/version-script.patch | 0 .../engines-install-in-libdir-ssl.patch | 0 .../openssl/{openssl => openssl10}/find.pl | 0 .../fix-cipher-des-ede3-cfb1.patch | 0 .../{openssl => openssl10}/oe-ldflags.patch | 0 .../openssl-1.0.2a-x32-asm.patch | 0 ...-pointer-dereference-in-EVP_DigestInit_ex.patch | 0 .../{openssl => openssl10}/openssl-c_rehash.sh | 0 .../openssl-fix-des.pod-error.patch | 0 .../openssl-util-perlpath.pl-cwd.patch | 0 .../openssl_fix_for_x32.patch | 0 .../openssl/{openssl => openssl10}/parallel.patch | 0 .../{openssl => openssl10}/ptest-deps.patch | 0 .../ptest_makefile_deps.patch | 0 .../openssl/openssl10/run-ptest | 2 + .../{openssl => openssl10}/shared-libs.patch | 0 .../{openssl_1.0.2k.bb => openssl10_1.0.2k.bb} | 4 +- .../recipes-connectivity/openssl/openssl_1.1.0e.bb | 146 ++++++++++ ...on3-native_3.5.2.bb => python3-native_3.5.3.bb} | 8 +- ...the-shell-version-of-python-config-that-w.patch | 10 +- ...pile.patch => 0001-cross-compile-support.patch} | 56 ++-- .../python3/python3-fix-CVE-2016-1000110.patch | 148 ---------- .../python/python3/upstream-random-fixes.patch | 288 +++++++++---------- .../python/{python3_3.5.2.bb => python3_3.5.3.bb} | 9 +- meta/recipes-extended/mailx/mailx_12.5-5.bb | 2 +- .../cryptodev/cryptodev-tests_1.8.bb | 2 +- .../gstreamer/gstreamer1.0-plugins-bad.inc | 4 +- .../recipes-support/apr/apr-util/openssl-1.1.patch | 253 ++++++++++++++++ meta/recipes-support/apr/apr-util_1.5.4.bb | 1 + 63 files changed, 732 insertions(+), 1493 deletions(-)rename
meta/recipes-connectivity/bind/bind/{bind-confgen-build-unix.o-once.patch=> 0001-confgen-don-t-build-unix.o-twice.patch} (80%) delete mode 100644meta/recipes-connectivity/bind/bind/CVE-2016-1285.patch
delete mode 100644meta/recipes-connectivity/bind/bind/CVE-2016-1286_1.patch
delete mode 100644meta/recipes-connectivity/bind/bind/CVE-2016-1286_2.patch
delete mode 100644meta/recipes-connectivity/bind/bind/CVE-2016-2088.patch
delete mode 100644meta/recipes-connectivity/bind/bind/CVE-2016-2775.patch
delete mode 100644meta/recipes-connectivity/bind/bind/CVE-2016-2776.patch
delete mode 100644meta/recipes-connectivity/bind/bind/mips1-not-support-opcode.diff
rename meta/recipes-connectivity/bind/{bind_9.10.3-P3.bb => bind_9.10.5.bb} (82%)
create mode 100644meta/recipes-connectivity/openssl/openssl/0001-Remove-test-that-requires-running-as-non-root.patchcreate mode 100644meta/recipes-connectivity/openssl/openssl/0001-Take-linking-flags-from-LDFLAGS-env-var.patchmode change 100755 => 100644 meta/recipes-connectivity/openssl/openssl/run-ptest
rename meta/recipes-connectivity/openssl/{openssl.inc => openssl10.inc} (95%)
rename meta/recipes-connectivity/openssl/{openssl =>openssl10}/0001-Fix-build-with-clang-using-external-assembler.patch(100%) rename meta/recipes-connectivity/openssl/{openssl =>openssl10}/Makefiles-ptest.patch(100%)
rename meta/recipes-connectivity/openssl/{openssl =>openssl10}/Use-SHA256-not-MD5-as-default-digest.patch(100%) rename meta/recipes-connectivity/openssl/{openssl =>openssl10}/configure-musl-target.patch(100%)
rename meta/recipes-connectivity/openssl/{openssl =>openssl10}/configure-targets.patch(100%)
rename meta/recipes-connectivity/openssl/{openssl =>openssl10}/debian/c_rehash-compat.patch(100%)
rename meta/recipes-connectivity/openssl/{openssl =>openssl10}/debian/ca.patch(100%)
rename meta/recipes-connectivity/openssl/{openssl =>openssl10}/debian/debian-targets.patch(100%)
rename meta/recipes-connectivity/openssl/{openssl =>openssl10}/debian/man-dir.patch(100%)
rename meta/recipes-connectivity/openssl/{openssl =>openssl10}/debian/man-section.patch(100%)
rename meta/recipes-connectivity/openssl/{openssl =>openssl10}/debian/no-rpath.patch(100%)
rename meta/recipes-connectivity/openssl/{openssl =>openssl10}/debian/no-symbolic.patch(100%)
rename meta/recipes-connectivity/openssl/{openssl =>openssl10}/debian/pic.patch(100%)
rename meta/recipes-connectivity/openssl/{openssl =>openssl10}/debian/version-script.patch(100%)
rename meta/recipes-connectivity/openssl/{openssl =>openssl10}/debian1.0.2/block_digicert_malaysia.patch(100%) rename meta/recipes-connectivity/openssl/{openssl =>openssl10}/debian1.0.2/block_diginotar.patch(100%)
rename meta/recipes-connectivity/openssl/{openssl =>openssl10}/debian1.0.2/version-script.patch(100%)
rename meta/recipes-connectivity/openssl/{openssl =>openssl10}/engines-install-in-libdir-ssl.patch(100%)
rename meta/recipes-connectivity/openssl/{openssl =>openssl10}/find.pl(100%)
rename meta/recipes-connectivity/openssl/{openssl =>openssl10}/fix-cipher-des-ede3-cfb1.patch(100%)
rename meta/recipes-connectivity/openssl/{openssl =>openssl10}/oe-ldflags.patch(100%)
rename meta/recipes-connectivity/openssl/{openssl =>openssl10}/openssl-1.0.2a-x32-asm.patch(100%)
rename meta/recipes-connectivity/openssl/{openssl =>openssl10}/openssl-avoid-NULL-pointer-dereference-in-EVP_DigestInit_ex.patch(100%) rename meta/recipes-connectivity/openssl/{openssl =>openssl10}/openssl-c_rehash.sh(100%)
rename meta/recipes-connectivity/openssl/{openssl =>openssl10}/openssl-fix-des.pod-error.patch(100%)
rename meta/recipes-connectivity/openssl/{openssl =>openssl10}/openssl-util-perlpath.pl-cwd.patch(100%)
rename meta/recipes-connectivity/openssl/{openssl =>openssl10}/openssl_fix_for_x32.patch(100%)
rename meta/recipes-connectivity/openssl/{openssl =>openssl10}/parallel.patch(100%)
rename meta/recipes-connectivity/openssl/{openssl =>openssl10}/ptest-deps.patch(100%)
rename meta/recipes-connectivity/openssl/{openssl =>openssl10}/ptest_makefile_deps.patch(100%)
create mode 100755 meta/recipes-connectivity/openssl/openssl10/run-ptest
rename meta/recipes-connectivity/openssl/{openssl =>openssl10}/shared-libs.patch(100%)
rename meta/recipes-connectivity/openssl/{openssl_1.0.2k.bb => openssl10_1.0.2k.bb} (97%)
create mode 100644 meta/recipes-connectivity/openssl/openssl_1.1.0e.bb
rename meta/recipes-devtools/python/{python3-native_3.5.2.bb => python3-native_3.5.3.bb} (90%)
renamemeta/recipes-devtools/python/python3/{000-cross-compile.patch=> 0001-cross-compile-support.patch} (65%) delete mode 100644meta/recipes-devtools/python/python3/python3-fix-CVE-2016-1000110.patch
rename meta/recipes-devtools/python/{python3_3.5.2.bb => python3_3.5.3.bb} (96%)
create mode 100644meta/recipes-support/apr/apr-util/openssl-1.1.patch
Quoted 10 lines · Alexander Kanavin
Quoted 3 lines · Michael
Sitting on 2.3 wouldn't be too much an issue for me, but I can't speak for others that may be in the same situation. Do these patches / new versions require 1.1.0 or break backwards compatibility with 1.0.2?
It would be nice if it could be handled by the PREFFERED_VERSION/PREFERRERED_PROVIDER.
PREFERRED_thing is not possible, unfortunately. 1.1 is API incompatible with 1.0, and so both need to be provided at the same time, with recipes explicitly telling which one they need. Most of the patchset is moving various recipes to newer, 1.1 compatible versions, so we minimize the need for 1.0.1.0 will be provided for as long as upstream supports it, which should be another two years or so.
Why not do this in a "softer" way - make the new 1.1 package have the obscured name (and not be preferred by default)? That way existing uses of the older 1.0 package can continue but users can migrate to 1.1 as they see fit?
Signature · 4 lines
------------------------------------------------------------ Gary Thomas | Consulting for the MLB Associates | Embedded world ------------------------------------------------------------
Quoted 4 lines · Gary Thomas
Why not do this in a "softer" way - make the new 1.1 package have the obscured name (and not be preferred by default)? That way existing uses of the older 1.0 package can continue but users can migrate to 1.1 as they see fit?
I have an answer which you might not particularly like. But here goes:
What will actually happen is that no one will do anything to port their stuff until it's time to remove 1.0 because upstream has EOLd it. And then there'll still be complaints that more time is needed for the transition. I'd like to gently push people to plan this transition already now - and it's as gentle as it can be: if you pull from master and your things no longer build, make one simple change and they will. It's part and parcel of being on the bleeding edge, or rebasing to the new yocto release: not everything works exactly as before, and most components are newer and different and not always fully compatible.
The other reason is that it's more work for me: I would have to update everything in oe-core to use the new recipe, instead of fixing just a few recipes that need to stay with 1.0. And then again the same thing will happen when 1.2 is out.
Alex
Could we offload the 1.0.2 supported recipes to something similar to meta-gplv2? Then the rest of the Yocto world can move on and those that need 1.0.x can seek it out.
-----Original Message-----
From: [email protected] [mailto:[email protected]] On Behalf Of Alexander Kanavin
Sent: Wednesday, May 10, 2017 2:34 PM
To: Gary Thomas; [email protected]
Subject: Re: [OE-core] [RFC PATCH 00/10] Add openssl 1.1
Quoted 4 lines · Gary Thomas
Why not do this in a "softer" way - make the new 1.1 package have the obscured name (and not be preferred by default)? That way existing uses of the older 1.0 package can continue but users can migrate to 1.1 as they see fit?
I have an answer which you might not particularly like. But here goes:
What will actually happen is that no one will do anything to port their stuff until it's time to remove 1.0 because upstream has EOLd it. And then there'll still be complaints that more time is needed for the transition. I'd like to gently push people to plan this transition already now - and it's as gentle as it can be: if you pull from master and your things no longer build, make one simple change and they will. It's part and parcel of being on the bleeding edge, or rebasing to the new yocto release: not everything works exactly as before, and most components are newer and different and not always fully compatible.
The other reason is that it's more work for me: I would have to update everything in oe-core to use the new recipe, instead of fixing just a few recipes that need to stay with 1.0. And then again the same thing will happen when 1.2 is out.
Alex
Signature · 4 lines
_______________________________________________ Openembedded-core mailing list [email protected] http://lists.openembedded.org/mailman/listinfo/openembedded-core
Quoted 2 lines · Michael
Could we offload the 1.0.2 supported recipes to something similar to meta-gplv2? Then the rest of the Yocto world can move on and those that need 1.0.x can seek it out.
Maybe in 2019, when 1.0.2 will be reaching EOL, but definitely not now. I don't think anyone will be happy if openssh (1.0 only for now) is removed from oe-core, and everyone has to seek an additional layer to keep that and other things running.
1.0.2 is fully supported by upstream, and they will provide bugfixes for another 2.5 years. There is nothing wrong with keeping it in oe-core, unlike the gplv2 recipes which were both badly out of date and not really getting tested.
Alex
Quoted 8 lines · Alexander Kanavin
Quoted 4 lines · Gary Thomas
Why not do this in a "softer" way - make the new 1.1 package have the obscured name (and not be preferred by default)? That way existing uses of the older 1.0 package can continue but users can migrate to 1.1 as they see fit?
I have an answer which you might not particularly like. But here goes:
Quoted 9 lines
What will actually happen is that no one will do anything to port their stuff until it's time to remove 1.0 because upstream has EOLd it. And then there'll still be complaints that more time is needed for the transition. I'd like to gently push people to plan this transition already now - and it's as gentle as it can be: if you pull from master and your things no longer build, make one simple change and they will. It's part and parcel of being on the bleeding edge, or rebasing to the new yocto release: not everything works exactly as before, and most components are newer and different and not always fully compatible.
It is a cross distro item really we should find out what other Linux distributions are doing about it moving forward unless major distros also have same policy there won't be much momentum this would gain among the packages ecosystems this could also help in sharing the porting burden
Quoted 14 lines
The other reason is that it's more work for me: I would have to update everything in oe-core to use the new recipe, instead of fixing just a few recipes that need to stay with 1.0. And then again the same thing will happen when 1.2 is out.
Alex
--
_______________________________________________
Openembedded-core mailing list
[email protected]
http://lists.openembedded.org/mailman/listinfo/openembedded-core
I think most of the major distros have either switched or are in the process this year.
From: [email protected] [mailto:[email protected]] On Behalf Of Khem Raj
Sent: Wednesday, May 10, 2017 3:36 PM
To: Alexander Kanavin; Gary Thomas; [email protected]
Subject: Re: [OE-core] [RFC PATCH 00/10] Add openssl 1.1
On Wed, May 10, 2017 at 12:34 PM Alexander Kanavin <[email protected]<mailto:[email protected]>> wrote:
Quoted 4 lines · Gary Thomas
Why not do this in a "softer" way - make the new 1.1 package have the obscured name (and not be preferred by default)? That way existing uses of the older 1.0 package can continue but users can migrate to 1.1 as they see fit?
I have an answer which you might not particularly like. But here goes:
What will actually happen is that no one will do anything to port their stuff until it's time to remove 1.0 because upstream has EOLd it. And then there'll still be complaints that more time is needed for the transition. I'd like to gently push people to plan this transition already now - and it's as gentle as it can be: if you pull from master and your things no longer build, make one simple change and they will. It's part and parcel of being on the bleeding edge, or rebasing to the new yocto release: not everything works exactly as before, and most components are newer and different and not always fully compatible.
It is a cross distro item really we should find out what other Linux distributions are doing about it moving forward unless major distros also have same policy there won't be much momentum this would gain among the packages ecosystems this could also help in sharing the porting burden
The other reason is that it's more work for me: I would have to update everything in oe-core to use the new recipe, instead of fixing just a few recipes that need to stay with 1.0. And then again the same thing will happen when 1.2 is out.
Alex
--
_______________________________________________
Openembedded-core mailing list [email protected]<mailto:[email protected]>
http://lists.openembedded.org/mailman/listinfo/openembedded-core
Quoted 3 lines · Michael
I think most of the major distros have either switched or are in the process this year.
are there some info on the policy decisions of other distros ? we should try to follow the suite then
Quoted 60 lines
From: [email protected] [mailto:[email protected]] On Behalf Of Khem Raj
Sent: Wednesday, May 10, 2017 3:36 PM
To: Alexander Kanavin; Gary Thomas; [email protected]
Subject: Re: [OE-core] [RFC PATCH 00/10] Add openssl 1.1On Wed, May 10, 2017 at 12:34 PM Alexander Kanavin <[email protected]> wrote:
Quoted 4 lines · Gary Thomas
Why not do this in a "softer" way - make the new 1.1 package have the obscured name (and not be preferred by default)? That way existing uses of the older 1.0 package can continue but users can migrate to 1.1 as they see fit?
I have an answer which you might not particularly like. But here goes:
What will actually happen is that no one will do anything to port their stuff until it's time to remove 1.0 because upstream has EOLd it. And then there'll still be complaints that more time is needed for the transition. I'd like to gently push people to plan this transition already now - and it's as gentle as it can be: if you pull from master and your things no longer build, make one simple change and they will. It's part and parcel of being on the bleeding edge, or rebasing to the new yocto release: not everything works exactly as before, and most components are newer and different and not always fully compatible.
It is a cross distro item really we should find out what other Linux distributions are doing about it moving forward unless major distros also have same policy there won't be much momentum this would gain among the packages ecosystems this could also help in sharing the porting burden
The other reason is that it's more work for me: I would have to update everything in oe-core to use the new recipe, instead of fixing just a few recipes that need to stay with 1.0. And then again the same thing will happen when 1.2 is out.
Alex
--
_______________________________________________
Openembedded-core mailing list
[email protected]
http://lists.openembedded.org/mailman/listinfo/openembedded-core
Quoted 8 lines · Khem Raj
Quoted 3 lines · Michael
I think most of the major distros have either switched or are in the process this year.
are there some info on the policy decisions of other distros ? we should try to follow the suite then
Both Fedora and Debian default to 1.1 in their upcoming versions. 1.0 is provided only as a legacy package. So same as here.
Alex
Re: [RFC PATCH 05/10] bind: update to 9.10.5
In reply to Alexander KanavinQuoted 5 lines · Alexander Kanavin
-LIC_FILES_CHKSUM = "file://COPYRIGHT;md5=0a95f52a0ab6c5f52dedc9a45e7abb 3f"
+LIC_FILES_CHKSUM = "file://COPYRIGHT;md5=dba46507446198119bcde32a4feaab 43"
No explanation for this change.
Ross
Quoted 8 lines · Khem Raj
Quoted 3 lines · Michael
I think most of the major distros have either switched or are in the process this year.
are there some info on the policy decisions of other distros ? we should try to follow the suite then
Khem,
https://wiki.debian.org/OpenSSL-1.1
Binary packages have X.Y version in the package name:
libssl1.1_1.1.0c-2~bpo8+1_amd64.deb libssl1.0.0_1.0.2k-1~bpo8+1_amd64.deb
As of OE, we've handled such updates with incompatible API in the past similarly - gstreamer vs. gstreamer010
Signature · 1 line
Denys
Quoted 59 lines
Quoted 54 lines
From: [email protected] [mailto:[email protected]] On Behalf Of Khem Raj
Sent: Wednesday, May 10, 2017 3:36 PM
To: Alexander Kanavin; Gary Thomas; [email protected]
Subject: Re: [OE-core] [RFC PATCH 00/10] Add openssl 1.1On Wed, May 10, 2017 at 12:34 PM Alexander Kanavin <[email protected]> wrote:
Quoted 4 lines · Gary Thomas
Why not do this in a "softer" way - make the new 1.1 package have the obscured name (and not be preferred by default)? That way existing uses of the older 1.0 package can continue but users can migrate to 1.1 as they see fit?
I have an answer which you might not particularly like. But here goes:
What will actually happen is that no one will do anything to port their stuff until it's time to remove 1.0 because upstream has EOLd it. And then there'll still be complaints that more time is needed for the transition. I'd like to gently push people to plan this transition already now - and it's as gentle as it can be: if you pull from master and your things no longer build, make one simple change and they will. It's part and parcel of being on the bleeding edge, or rebasing to the new yocto release: not everything works exactly as before, and most components are newer and different and not always fully compatible.
It is a cross distro item really we should find out what other Linux distributions are doing about it moving forward unless major distros also have same policy there won't be much momentum this would gain among the packages ecosystems this could also help in sharing the porting burden
The other reason is that it's more work for me: I would have to update everything in oe-core to use the new recipe, instead of fixing just a few recipes that need to stay with 1.0. And then again the same thing will happen when 1.2 is out.
Alex
--
_______________________________________________
Openembedded-core mailing list
[email protected]
http://lists.openembedded.org/mailman/listinfo/openembedded-coreSignature · 4 lines
_______________________________________________ Openembedded-core mailing list [email protected] http://lists.openembedded.org/mailman/listinfo/openembedded-core
Quoted 12 lines · Denys Dmytriyenko
Quoted 8 lines · Khem Raj
Quoted 3 lines · Michael
I think most of the major distros have either switched or are in the process this year.
are there some info on the policy decisions of other distros ? we should try to follow the suite then
Khem,
Quoted 8 lines
https://wiki.debian.org/OpenSSL-1.1
Binary packages have X.Y version in the package name:
libssl1.1_1.1.0c-2~bpo8+1_amd64.deb libssl1.0.0_1.0.2k-1~bpo8+1_amd64.debAs of OE, we've handled such updates with incompatible API in the past similarly - gstreamer vs. gstreamer010
yes we have, my point was if were flying against the headwind or not,
Quoted 11 lines · Alexander Kanavin
Quoted 8 lines · Khem Raj
Quoted 3 lines · Michael
I think most of the major distros have either switched or are in the process this year.
are there some info on the policy decisions of other distros ? we should try to follow the suite then
Both Fedora and Debian default to 1.1 in their upcoming versions. 1.0 is provided only as a legacy package. So same as here.
I recommend members of the Yocto project to chime in as most are commercial entities and may have reasons they want Poky to stay on an LTS openssl version. OE can decide to do something different. That should be possible. Is this an OE TSC issue??
- armin
Quoted 3 lines
Alex
Re: [RFC PATCH 05/10] bind: update to 9.10.5
In reply to Burton, RossQuoted 7 lines · Ross
-LIC_FILES_CHKSUM = "file://COPYRIGHT;md5=0a95f52a0ab6c5f52dedc9a45e7abb3f" +LIC_FILES_CHKSUM = "file://COPYRIGHT;md5=dba46507446198119bcde32a4feaab43"No explanation for this change.
Thanks, updated.
Alex