openssl 1.1.1 update

From: Alexander Kanavin <[email protected]>

License-Update: URI fix

Signed-off-by Alexander Kanavin <[email protected]>

---
 .../{ca-certificates_20170717.bb => ca-certificates_20180409.bb}      | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 rename meta/recipes-support/ca-certificates/{ca-certificates_20170717.bb => ca-certificates_20180409.bb} (95%)

meta/recipes-support/ca-certificates/ca-certificates_20180409.bb renamed from meta/recipes-support/ca-certificates/ca-certificates_20170717.bb +1 -1

similarity index 95%
rename from meta/recipes-support/ca-certificates/ca-certificates_20170717.bb
rename to meta/recipes-support/ca-certificates/ca-certificates_20180409.bb
index 24d3a6e..0d57083 100644
@@ -5,7 +5,7 @@ This derived from Debian's CA Certificates."
 HOMEPAGE = "http://packages.debian.org/sid/ca-certificates"
 SECTION = "misc"
 LICENSE = "GPL-2.0+ & MPL-2.0"
-LIC_FILES_CHKSUM = "file://debian/copyright;md5=e7358b9541ccf3029e9705ed8de57968"
+LIC_FILES_CHKSUM = "file://debian/copyright;md5=aeb420429b1659507e0a5a1b123e8308"
 
 # This is needed to ensure we can run the postinst at image creation time
 DEPENDS = ""

meta/recipes-support/ca-certificates/ca-certificates_20180409.bb DEPENDS_class-nativesdk = "openssl-native" · line 17

Quoted 2 lines

meta/recipes-support/ca-certificates/ca-certificates_20180409.bb renamed from meta/recipes-support/ca-certificates/ca-certificates_20170717.bb +1 -1

-SRCREV = "34b8e19e541b8af4076616b2e170c7a70cdaded0"
+SRCREV = "dbbd11e56af93bb79f21d0ee6059a901f83f70a5"

It fails in do_patch for me.
Patch 0002-update-ca-certificates-use-SYSROOT.patch does not apply (enforce with -f)

2018-08-29 16:30 GMT+02:00 Khem Raj <[email protected]>:

Quoted 6 lines

meta/recipes-support/ca-certificates/ca-certificates_20180409.bb DEPENDS_class-nativesdk = "openssl-native" · line 17

Quoted 2 lines

meta/recipes-support/ca-certificates/ca-certificates_20180409.bb renamed from meta/recipes-support/ca-certificates/ca-certificates_20170717.bb +1 -1

-SRCREV = "34b8e19e541b8af4076616b2e170c7a70cdaded0"
+SRCREV = "dbbd11e56af93bb79f21d0ee6059a901f83f70a5"

It fails in do_patch for me.
Patch 0002-update-ca-certificates-use-SYSROOT.patch does not apply (enforce with -f)

Works for me though. I just did a cleansstate and build to double check. Can you try on plain poky master please?

This patch series updates openssl to the soon-to-be released 1.1.1 version (latest news is 11 September), sets it as default, and removes dependencies on openssl 1.0 entirely from oe-core. openssl 1.0 remains available as openssl10 recipe.

The following changes since commit a8368651ffed1bd6c4715a37dfe9f40c48ca23c4:

bitbake: fetcher: Fixed remote removal not throwing exception. (2018-08-28 10:32:08 +0100)

are available in the git repository at:

git://push.yoctoproject.org/poky-contrib akanavin/openssl-1.1.1

Alexander Kanavin (6):
openssl: rename openssl 1.0.x to openssl10 and make openssl 1.1.x the
default version
cryptodev-tests: port to openssl 1.1
openssl: update to 1.1.1
libressl: add a recipe to support openssh
openssh: depend on libressl
ca-certificates: update to 20180409

 meta/conf/distro/include/default-versions.inc      |   3 -
 meta/conf/distro/include/maintainers.inc           |   2 +
 ...c-libraries-with-their-library-dependenci.patch |  73 +++++++++++++++
 .../libressl/libressl_2.8.0.bb                     |  35 +++++++
 meta/recipes-connectivity/openssh/openssh_7.7p1.bb |   2 +-
 .../{openssl => files}/environment.d-openssl.sh    |   0
 ...1-Take-linking-flags-from-LDFLAGS-env-var.patch |  43 ---------
 ...SLDIR-and-ENGINESDIR-CFLAGS-to-be-control.patch |  39 --------
 ...build-with-clang-using-external-assembler.patch |   0
 .../0001-allow-manpages-to-be-disabled.patch       |   0
 ...penssl-force-soft-link-to-avoid-rare-race.patch |   0
 .../Makefiles-ptest.patch                          |   0
 .../Use-SHA256-not-MD5-as-default-digest.patch     |   0
 .../configure-musl-target.patch                    |   0
 .../configure-targets.patch                        |   0
 .../debian/c_rehash-compat.patch                   |   0
 .../debian/debian-targets.patch                    |   0
 .../debian/man-dir.patch                           |   0
 .../debian/man-section.patch                       |   0
 .../debian/no-rpath.patch                          |   0
 .../debian/no-symbolic.patch                       |   0
 .../{openssl-1.0.2p => openssl10}/debian/pic.patch |   0
 .../debian1.0.2/block_digicert_malaysia.patch      |   0
 .../debian1.0.2/block_diginotar.patch              |   0
 .../debian1.0.2/soname.patch                       |   0
 .../debian1.0.2/version-script.patch               |   0
 .../engines-install-in-libdir-ssl.patch            |   0
 .../{openssl-1.0.2p => openssl10}/oe-ldflags.patch |   0
 .../openssl-c_rehash.sh                            |   0
 .../openssl-fix-des.pod-error.patch                |   0
 .../openssl_fix_for_x32.patch                      |   0
 .../{openssl-1.0.2p => openssl10}/parallel.patch   |   0
 .../{openssl-1.0.2p => openssl10}/ptest-deps.patch |   0
 .../ptest_makefile_deps.patch                      |   0
 .../reproducible-cflags.patch                      |   0
 .../reproducible-mkbuildinf.patch                  |   0
 .../{openssl-1.0.2p => openssl10}/run-ptest        |   0
 .../shared-libs.patch                              |   0
 .../{openssl_1.0.2p.bb => openssl10_1.0.2p.bb}     |  31 +++++--
 .../{openssl_1.1.0i.bb => openssl_1.1.1-pre9.bb}   |  23 +++--
 .../cryptodev/cryptodev-tests_1.9.bb               |   3 +-
 .../files/0001-Port-tests-to-openssl-1.1.patch     | 103 +++++++++++++++++++++
 ...tes_20170717.bb => ca-certificates_20180409.bb} |   4 +-
 43 files changed, 255 insertions(+), 106 deletions(-)
 create mode 100644 meta/recipes-connectivity/libressl/libressl/0001-Link-dynamic-libraries-with-their-library-dependenci.patch
 create mode 100644 meta/recipes-connectivity/libressl/libressl_2.8.0.bb
 rename meta/recipes-connectivity/openssl/{openssl => files}/environment.d-openssl.sh (100%)
 delete mode 100644 meta/recipes-connectivity/openssl/openssl/0001-Take-linking-flags-from-LDFLAGS-env-var.patch
 delete mode 100644 meta/recipes-connectivity/openssl/openssl/0001-allow-OPENSSLDIR-and-ENGINESDIR-CFLAGS-to-be-control.patch
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/0001-Fix-build-with-clang-using-external-assembler.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/0001-allow-manpages-to-be-disabled.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/0001-openssl-force-soft-link-to-avoid-rare-race.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/Makefiles-ptest.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/Use-SHA256-not-MD5-as-default-digest.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/configure-musl-target.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/configure-targets.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian/c_rehash-compat.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian/debian-targets.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian/man-dir.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian/man-section.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian/no-rpath.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian/no-symbolic.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian/pic.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian1.0.2/block_digicert_malaysia.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian1.0.2/block_diginotar.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian1.0.2/soname.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian1.0.2/version-script.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/engines-install-in-libdir-ssl.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/oe-ldflags.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/openssl-c_rehash.sh (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/openssl-fix-des.pod-error.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/openssl_fix_for_x32.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/parallel.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/ptest-deps.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/ptest_makefile_deps.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/reproducible-cflags.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/reproducible-mkbuildinf.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/run-ptest (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/shared-libs.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl_1.0.2p.bb => openssl10_1.0.2p.bb} (91%)
 rename meta/recipes-connectivity/openssl/{openssl_1.1.0i.bb => openssl_1.1.1-pre9.bb} (83%)
 create mode 100644 meta/recipes-kernel/cryptodev/files/0001-Port-tests-to-openssl-1.1.patch
 rename meta/recipes-support/ca-certificates/{ca-certificates_20170717.bb => ca-certificates_20180409.bb} (95%)

--
2.7.4

--
_______________________________________________
Openembedded-core mailing list
[email protected]
http://lists.openembedded.org/mailman/listinfo/openembedded-core

musl/mips seems to fail due to this see

http://errors.yoctoproject.org/Errors/Details/188615/

Quoted 115 lines · Alexander Kanavin

This patch series updates openssl to the soon-to-be released 1.1.1 version (latest news is 11 September), sets it as default, and removes dependencies on openssl 1.0 entirely from oe-core. openssl 1.0 remains available as openssl10 recipe.

The following changes since commit a8368651ffed1bd6c4715a37dfe9f40c48ca23c4:

bitbake: fetcher: Fixed remote removal not throwing exception. (2018-08-28 10:32:08 +0100)

are available in the git repository at:

git://push.yoctoproject.org/poky-contrib akanavin/openssl-1.1.1

Alexander Kanavin (6):
openssl: rename openssl 1.0.x to openssl10 and make openssl 1.1.x the
default version
cryptodev-tests: port to openssl 1.1
openssl: update to 1.1.1
libressl: add a recipe to support openssh
openssh: depend on libressl
ca-certificates: update to 20180409

 meta/conf/distro/include/default-versions.inc      |   3 -
 meta/conf/distro/include/maintainers.inc           |   2 +
 ...c-libraries-with-their-library-dependenci.patch |  73 +++++++++++++++
 .../libressl/libressl_2.8.0.bb                     |  35 +++++++
 meta/recipes-connectivity/openssh/openssh_7.7p1.bb |   2 +-
 .../{openssl => files}/environment.d-openssl.sh    |   0
 ...1-Take-linking-flags-from-LDFLAGS-env-var.patch |  43 ---------
 ...SLDIR-and-ENGINESDIR-CFLAGS-to-be-control.patch |  39 --------
 ...build-with-clang-using-external-assembler.patch |   0
 .../0001-allow-manpages-to-be-disabled.patch       |   0
 ...penssl-force-soft-link-to-avoid-rare-race.patch |   0
 .../Makefiles-ptest.patch                          |   0
 .../Use-SHA256-not-MD5-as-default-digest.patch     |   0
 .../configure-musl-target.patch                    |   0
 .../configure-targets.patch                        |   0
 .../debian/c_rehash-compat.patch                   |   0
 .../debian/debian-targets.patch                    |   0
 .../debian/man-dir.patch                           |   0
 .../debian/man-section.patch                       |   0
 .../debian/no-rpath.patch                          |   0
 .../debian/no-symbolic.patch                       |   0
 .../{openssl-1.0.2p => openssl10}/debian/pic.patch |   0
 .../debian1.0.2/block_digicert_malaysia.patch      |   0
 .../debian1.0.2/block_diginotar.patch              |   0
 .../debian1.0.2/soname.patch                       |   0
 .../debian1.0.2/version-script.patch               |   0
 .../engines-install-in-libdir-ssl.patch            |   0
 .../{openssl-1.0.2p => openssl10}/oe-ldflags.patch |   0
 .../openssl-c_rehash.sh                            |   0
 .../openssl-fix-des.pod-error.patch                |   0
 .../openssl_fix_for_x32.patch                      |   0
 .../{openssl-1.0.2p => openssl10}/parallel.patch   |   0
 .../{openssl-1.0.2p => openssl10}/ptest-deps.patch |   0
 .../ptest_makefile_deps.patch                      |   0
 .../reproducible-cflags.patch                      |   0
 .../reproducible-mkbuildinf.patch                  |   0
 .../{openssl-1.0.2p => openssl10}/run-ptest        |   0
 .../shared-libs.patch                              |   0
 .../{openssl_1.0.2p.bb => openssl10_1.0.2p.bb}     |  31 +++++--
 .../{openssl_1.1.0i.bb => openssl_1.1.1-pre9.bb}   |  23 +++--
 .../cryptodev/cryptodev-tests_1.9.bb               |   3 +-
 .../files/0001-Port-tests-to-openssl-1.1.patch     | 103 +++++++++++++++++++++
 ...tes_20170717.bb => ca-certificates_20180409.bb} |   4 +-
 43 files changed, 255 insertions(+), 106 deletions(-)
 create mode 100644 meta/recipes-connectivity/libressl/libressl/0001-Link-dynamic-libraries-with-their-library-dependenci.patch
 create mode 100644 meta/recipes-connectivity/libressl/libressl_2.8.0.bb
 rename meta/recipes-connectivity/openssl/{openssl => files}/environment.d-openssl.sh (100%)
 delete mode 100644 meta/recipes-connectivity/openssl/openssl/0001-Take-linking-flags-from-LDFLAGS-env-var.patch
 delete mode 100644 meta/recipes-connectivity/openssl/openssl/0001-allow-OPENSSLDIR-and-ENGINESDIR-CFLAGS-to-be-control.patch
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/0001-Fix-build-with-clang-using-external-assembler.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/0001-allow-manpages-to-be-disabled.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/0001-openssl-force-soft-link-to-avoid-rare-race.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/Makefiles-ptest.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/Use-SHA256-not-MD5-as-default-digest.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/configure-musl-target.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/configure-targets.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian/c_rehash-compat.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian/debian-targets.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian/man-dir.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian/man-section.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian/no-rpath.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian/no-symbolic.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian/pic.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian1.0.2/block_digicert_malaysia.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian1.0.2/block_diginotar.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian1.0.2/soname.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian1.0.2/version-script.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/engines-install-in-libdir-ssl.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/oe-ldflags.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/openssl-c_rehash.sh (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/openssl-fix-des.pod-error.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/openssl_fix_for_x32.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/parallel.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/ptest-deps.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/ptest_makefile_deps.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/reproducible-cflags.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/reproducible-mkbuildinf.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/run-ptest (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/shared-libs.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl_1.0.2p.bb => openssl10_1.0.2p.bb} (91%)
 rename meta/recipes-connectivity/openssl/{openssl_1.1.0i.bb => openssl_1.1.1-pre9.bb} (83%)
 create mode 100644 meta/recipes-kernel/cryptodev/files/0001-Port-tests-to-openssl-1.1.patch
 rename meta/recipes-support/ca-certificates/{ca-certificates_20170717.bb => ca-certificates_20180409.bb} (95%)

--
2.7.4

--
_______________________________________________
Openembedded-core mailing list
[email protected]
http://lists.openembedded.org/mailman/listinfo/openembedded-core

The recipe has a guard for this, but maybe it stopped working, I'll take a look:

#| ./libcrypto.so: undefined reference to `getcontext'
#| ./libcrypto.so: undefined reference to `setcontext'
#| ./libcrypto.so: undefined reference to `makecontext'

CPPFLAGS_append_libc-musl = " -DOPENSSL_NO_ASYNC"

Alex

2018-08-31 8:22 GMT+02:00 Khem Raj <[email protected]>:

Quoted 120 lines

musl/mips seems to fail due to this see

http://errors.yoctoproject.org/Errors/Details/188615/

Quoted 115 lines · Alexander Kanavin

This patch series updates openssl to the soon-to-be released 1.1.1 version (latest news is 11 September), sets it as default, and removes dependencies on openssl 1.0 entirely from oe-core. openssl 1.0 remains available as openssl10 recipe.

The following changes since commit a8368651ffed1bd6c4715a37dfe9f40c48ca23c4:

bitbake: fetcher: Fixed remote removal not throwing exception. (2018-08-28 10:32:08 +0100)

are available in the git repository at:

git://push.yoctoproject.org/poky-contrib akanavin/openssl-1.1.1

Alexander Kanavin (6):
openssl: rename openssl 1.0.x to openssl10 and make openssl 1.1.x the
default version
cryptodev-tests: port to openssl 1.1
openssl: update to 1.1.1
libressl: add a recipe to support openssh
openssh: depend on libressl
ca-certificates: update to 20180409

 meta/conf/distro/include/default-versions.inc      |   3 -
 meta/conf/distro/include/maintainers.inc           |   2 +
 ...c-libraries-with-their-library-dependenci.patch |  73 +++++++++++++++
 .../libressl/libressl_2.8.0.bb                     |  35 +++++++
 meta/recipes-connectivity/openssh/openssh_7.7p1.bb |   2 +-
 .../{openssl => files}/environment.d-openssl.sh    |   0
 ...1-Take-linking-flags-from-LDFLAGS-env-var.patch |  43 ---------
 ...SLDIR-and-ENGINESDIR-CFLAGS-to-be-control.patch |  39 --------
 ...build-with-clang-using-external-assembler.patch |   0
 .../0001-allow-manpages-to-be-disabled.patch       |   0
 ...penssl-force-soft-link-to-avoid-rare-race.patch |   0
 .../Makefiles-ptest.patch                          |   0
 .../Use-SHA256-not-MD5-as-default-digest.patch     |   0
 .../configure-musl-target.patch                    |   0
 .../configure-targets.patch                        |   0
 .../debian/c_rehash-compat.patch                   |   0
 .../debian/debian-targets.patch                    |   0
 .../debian/man-dir.patch                           |   0
 .../debian/man-section.patch                       |   0
 .../debian/no-rpath.patch                          |   0
 .../debian/no-symbolic.patch                       |   0
 .../{openssl-1.0.2p => openssl10}/debian/pic.patch |   0
 .../debian1.0.2/block_digicert_malaysia.patch      |   0
 .../debian1.0.2/block_diginotar.patch              |   0
 .../debian1.0.2/soname.patch                       |   0
 .../debian1.0.2/version-script.patch               |   0
 .../engines-install-in-libdir-ssl.patch            |   0
 .../{openssl-1.0.2p => openssl10}/oe-ldflags.patch |   0
 .../openssl-c_rehash.sh                            |   0
 .../openssl-fix-des.pod-error.patch                |   0
 .../openssl_fix_for_x32.patch                      |   0
 .../{openssl-1.0.2p => openssl10}/parallel.patch   |   0
 .../{openssl-1.0.2p => openssl10}/ptest-deps.patch |   0
 .../ptest_makefile_deps.patch                      |   0
 .../reproducible-cflags.patch                      |   0
 .../reproducible-mkbuildinf.patch                  |   0
 .../{openssl-1.0.2p => openssl10}/run-ptest        |   0
 .../shared-libs.patch                              |   0
 .../{openssl_1.0.2p.bb => openssl10_1.0.2p.bb}     |  31 +++++--
 .../{openssl_1.1.0i.bb => openssl_1.1.1-pre9.bb}   |  23 +++--
 .../cryptodev/cryptodev-tests_1.9.bb               |   3 +-
 .../files/0001-Port-tests-to-openssl-1.1.patch     | 103 +++++++++++++++++++++
 ...tes_20170717.bb => ca-certificates_20180409.bb} |   4 +-
 43 files changed, 255 insertions(+), 106 deletions(-)
 create mode 100644 meta/recipes-connectivity/libressl/libressl/0001-Link-dynamic-libraries-with-their-library-dependenci.patch
 create mode 100644 meta/recipes-connectivity/libressl/libressl_2.8.0.bb
 rename meta/recipes-connectivity/openssl/{openssl => files}/environment.d-openssl.sh (100%)
 delete mode 100644 meta/recipes-connectivity/openssl/openssl/0001-Take-linking-flags-from-LDFLAGS-env-var.patch
 delete mode 100644 meta/recipes-connectivity/openssl/openssl/0001-allow-OPENSSLDIR-and-ENGINESDIR-CFLAGS-to-be-control.patch
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/0001-Fix-build-with-clang-using-external-assembler.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/0001-allow-manpages-to-be-disabled.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/0001-openssl-force-soft-link-to-avoid-rare-race.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/Makefiles-ptest.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/Use-SHA256-not-MD5-as-default-digest.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/configure-musl-target.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/configure-targets.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian/c_rehash-compat.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian/debian-targets.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian/man-dir.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian/man-section.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian/no-rpath.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian/no-symbolic.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian/pic.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian1.0.2/block_digicert_malaysia.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian1.0.2/block_diginotar.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian1.0.2/soname.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian1.0.2/version-script.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/engines-install-in-libdir-ssl.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/oe-ldflags.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/openssl-c_rehash.sh (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/openssl-fix-des.pod-error.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/openssl_fix_for_x32.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/parallel.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/ptest-deps.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/ptest_makefile_deps.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/reproducible-cflags.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/reproducible-mkbuildinf.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/run-ptest (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/shared-libs.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl_1.0.2p.bb => openssl10_1.0.2p.bb} (91%)
 rename meta/recipes-connectivity/openssl/{openssl_1.1.0i.bb => openssl_1.1.1-pre9.bb} (83%)
 create mode 100644 meta/recipes-kernel/cryptodev/files/0001-Port-tests-to-openssl-1.1.patch
 rename meta/recipes-support/ca-certificates/{ca-certificates_20170717.bb => ca-certificates_20180409.bb} (95%)

--
2.7.4

--
_______________________________________________
Openembedded-core mailing list
[email protected]
http://lists.openembedded.org/mailman/listinfo/openembedded-core

I just did a quick musl build for qemux86, and " -DOPENSSL_NO_ASYNC" is there as expected. Something in your setup overrides it maybe? What does bitbake -e openssl say?

Alex

2018-08-31 11:30 GMT+02:00 Alexander Kanavin <[email protected]>:

Quoted 131 lines

The recipe has a guard for this, but maybe it stopped working, I'll take a look:

#| ./libcrypto.so: undefined reference to `getcontext'
#| ./libcrypto.so: undefined reference to `setcontext'
#| ./libcrypto.so: undefined reference to `makecontext'

CPPFLAGS_append_libc-musl = " -DOPENSSL_NO_ASYNC"

Alex

2018-08-31 8:22 GMT+02:00 Khem Raj <[email protected]>:

Quoted 120 lines

musl/mips seems to fail due to this see

http://errors.yoctoproject.org/Errors/Details/188615/

Quoted 115 lines · Alexander Kanavin

This patch series updates openssl to the soon-to-be released 1.1.1 version (latest news is 11 September), sets it as default, and removes dependencies on openssl 1.0 entirely from oe-core. openssl 1.0 remains available as openssl10 recipe.

The following changes since commit a8368651ffed1bd6c4715a37dfe9f40c48ca23c4:

bitbake: fetcher: Fixed remote removal not throwing exception. (2018-08-28 10:32:08 +0100)

are available in the git repository at:

git://push.yoctoproject.org/poky-contrib akanavin/openssl-1.1.1

Alexander Kanavin (6):
openssl: rename openssl 1.0.x to openssl10 and make openssl 1.1.x the
default version
cryptodev-tests: port to openssl 1.1
openssl: update to 1.1.1
libressl: add a recipe to support openssh
openssh: depend on libressl
ca-certificates: update to 20180409

 meta/conf/distro/include/default-versions.inc      |   3 -
 meta/conf/distro/include/maintainers.inc           |   2 +
 ...c-libraries-with-their-library-dependenci.patch |  73 +++++++++++++++
 .../libressl/libressl_2.8.0.bb                     |  35 +++++++
 meta/recipes-connectivity/openssh/openssh_7.7p1.bb |   2 +-
 .../{openssl => files}/environment.d-openssl.sh    |   0
 ...1-Take-linking-flags-from-LDFLAGS-env-var.patch |  43 ---------
 ...SLDIR-and-ENGINESDIR-CFLAGS-to-be-control.patch |  39 --------
 ...build-with-clang-using-external-assembler.patch |   0
 .../0001-allow-manpages-to-be-disabled.patch       |   0
 ...penssl-force-soft-link-to-avoid-rare-race.patch |   0
 .../Makefiles-ptest.patch                          |   0
 .../Use-SHA256-not-MD5-as-default-digest.patch     |   0
 .../configure-musl-target.patch                    |   0
 .../configure-targets.patch                        |   0
 .../debian/c_rehash-compat.patch                   |   0
 .../debian/debian-targets.patch                    |   0
 .../debian/man-dir.patch                           |   0
 .../debian/man-section.patch                       |   0
 .../debian/no-rpath.patch                          |   0
 .../debian/no-symbolic.patch                       |   0
 .../{openssl-1.0.2p => openssl10}/debian/pic.patch |   0
 .../debian1.0.2/block_digicert_malaysia.patch      |   0
 .../debian1.0.2/block_diginotar.patch              |   0
 .../debian1.0.2/soname.patch                       |   0
 .../debian1.0.2/version-script.patch               |   0
 .../engines-install-in-libdir-ssl.patch            |   0
 .../{openssl-1.0.2p => openssl10}/oe-ldflags.patch |   0
 .../openssl-c_rehash.sh                            |   0
 .../openssl-fix-des.pod-error.patch                |   0
 .../openssl_fix_for_x32.patch                      |   0
 .../{openssl-1.0.2p => openssl10}/parallel.patch   |   0
 .../{openssl-1.0.2p => openssl10}/ptest-deps.patch |   0
 .../ptest_makefile_deps.patch                      |   0
 .../reproducible-cflags.patch                      |   0
 .../reproducible-mkbuildinf.patch                  |   0
 .../{openssl-1.0.2p => openssl10}/run-ptest        |   0
 .../shared-libs.patch                              |   0
 .../{openssl_1.0.2p.bb => openssl10_1.0.2p.bb}     |  31 +++++--
 .../{openssl_1.1.0i.bb => openssl_1.1.1-pre9.bb}   |  23 +++--
 .../cryptodev/cryptodev-tests_1.9.bb               |   3 +-
 .../files/0001-Port-tests-to-openssl-1.1.patch     | 103 +++++++++++++++++++++
 ...tes_20170717.bb => ca-certificates_20180409.bb} |   4 +-
 43 files changed, 255 insertions(+), 106 deletions(-)
 create mode 100644 meta/recipes-connectivity/libressl/libressl/0001-Link-dynamic-libraries-with-their-library-dependenci.patch
 create mode 100644 meta/recipes-connectivity/libressl/libressl_2.8.0.bb
 rename meta/recipes-connectivity/openssl/{openssl => files}/environment.d-openssl.sh (100%)
 delete mode 100644 meta/recipes-connectivity/openssl/openssl/0001-Take-linking-flags-from-LDFLAGS-env-var.patch
 delete mode 100644 meta/recipes-connectivity/openssl/openssl/0001-allow-OPENSSLDIR-and-ENGINESDIR-CFLAGS-to-be-control.patch
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/0001-Fix-build-with-clang-using-external-assembler.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/0001-allow-manpages-to-be-disabled.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/0001-openssl-force-soft-link-to-avoid-rare-race.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/Makefiles-ptest.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/Use-SHA256-not-MD5-as-default-digest.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/configure-musl-target.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/configure-targets.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian/c_rehash-compat.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian/debian-targets.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian/man-dir.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian/man-section.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian/no-rpath.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian/no-symbolic.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian/pic.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian1.0.2/block_digicert_malaysia.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian1.0.2/block_diginotar.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian1.0.2/soname.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian1.0.2/version-script.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/engines-install-in-libdir-ssl.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/oe-ldflags.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/openssl-c_rehash.sh (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/openssl-fix-des.pod-error.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/openssl_fix_for_x32.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/parallel.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/ptest-deps.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/ptest_makefile_deps.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/reproducible-cflags.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/reproducible-mkbuildinf.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/run-ptest (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/shared-libs.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl_1.0.2p.bb => openssl10_1.0.2p.bb} (91%)
 rename meta/recipes-connectivity/openssl/{openssl_1.1.0i.bb => openssl_1.1.1-pre9.bb} (83%)
 create mode 100644 meta/recipes-kernel/cryptodev/files/0001-Port-tests-to-openssl-1.1.patch
 rename meta/recipes-support/ca-certificates/{ca-certificates_20170717.bb => ca-certificates_20180409.bb} (95%)

--
2.7.4

--
_______________________________________________
Openembedded-core mailing list
[email protected]
http://lists.openembedded.org/mailman/listinfo/openembedded-core

This patch series updates openssl to the soon-to-be released 1.1.1 version (latest news is 11 September), sets it as default, and removes dependencies on openssl 1.0 entirely from oe-core. openssl 1.0 remains available as openssl10 recipe.

The following changes since commit a8368651ffed1bd6c4715a37dfe9f40c48ca23c4:

bitbake: fetcher: Fixed remote removal not throwing exception. (2018-08-28 10:32:08 +0100)

are available in the git repository at:

git://push.yoctoproject.org/poky-contrib akanavin/openssl-1.1.1

Alexander Kanavin (6):
openssl: rename openssl 1.0.x to openssl10 and make openssl 1.1.x the
default version

cryptodev-tests: port to openssl 1.1
openssl: update to 1.1.1
libressl: add a recipe to support openssh
openssh: depend on libressl
ca-certificates: update to 20180409

 meta/conf/distro/include/default-versions.inc      |   3 -
 meta/conf/distro/include/maintainers.inc           |   2 +
 ...c-libraries-with-their-library-dependenci.patch |  73 +++++++++++++++
 .../libressl/libressl_2.8.0.bb                     |  35 +++++++
 meta/recipes-connectivity/openssh/openssh_7.7p1.bb |   2 +-
 .../{openssl => files}/environment.d-openssl.sh    |   0
 ...1-Take-linking-flags-from-LDFLAGS-env-var.patch |  43 ---------
 ...SLDIR-and-ENGINESDIR-CFLAGS-to-be-control.patch |  39 --------
 ...build-with-clang-using-external-assembler.patch |   0
 .../0001-allow-manpages-to-be-disabled.patch       |   0
 ...penssl-force-soft-link-to-avoid-rare-race.patch |   0
 .../Makefiles-ptest.patch                          |   0
 .../Use-SHA256-not-MD5-as-default-digest.patch     |   0
 .../configure-musl-target.patch                    |   0
 .../configure-targets.patch                        |   0
 .../debian/c_rehash-compat.patch                   |   0
 .../debian/debian-targets.patch                    |   0
 .../debian/man-dir.patch                           |   0
 .../debian/man-section.patch                       |   0
 .../debian/no-rpath.patch                          |   0
 .../debian/no-symbolic.patch                       |   0
 .../{openssl-1.0.2p => openssl10}/debian/pic.patch |   0
 .../debian1.0.2/block_digicert_malaysia.patch      |   0
 .../debian1.0.2/block_diginotar.patch              |   0
 .../debian1.0.2/soname.patch                       |   0
 .../debian1.0.2/version-script.patch               |   0
 .../engines-install-in-libdir-ssl.patch            |   0
 .../{openssl-1.0.2p => openssl10}/oe-ldflags.patch |   0
 .../openssl-c_rehash.sh                            |   0
 .../openssl-fix-des.pod-error.patch                |   0
 .../openssl_fix_for_x32.patch                      |   0
 .../{openssl-1.0.2p => openssl10}/parallel.patch   |   0
 .../{openssl-1.0.2p => openssl10}/ptest-deps.patch |   0
 .../ptest_makefile_deps.patch                      |   0
 .../reproducible-cflags.patch                      |   0
 .../reproducible-mkbuildinf.patch                  |   0
 .../{openssl-1.0.2p => openssl10}/run-ptest        |   0
 .../shared-libs.patch                              |   0
 .../{openssl_1.0.2p.bb => openssl10_1.0.2p.bb}     |  31 +++++--
 .../{openssl_1.1.0i.bb => openssl_1.1.1-pre9.bb}   |  23 +++--
 .../cryptodev/cryptodev-tests_1.9.bb               |   3 +-
 .../files/0001-Port-tests-to-openssl-1.1.patch     | 103 +++++++++++++++++++++
 ...tes_20170717.bb => ca-certificates_20180409.bb} |   4 +-
 43 files changed, 255 insertions(+), 106 deletions(-)
 create mode 100644 meta/recipes-connectivity/libressl/libressl/0001-Link-dynamic-libraries-with-their-library-dependenci.patch
 create mode 100644 meta/recipes-connectivity/libressl/libressl_2.8.0.bb
 rename meta/recipes-connectivity/openssl/{openssl => files}/environment.d-openssl.sh (100%)
 delete mode 100644 meta/recipes-connectivity/openssl/openssl/0001-Take-linking-flags-from-LDFLAGS-env-var.patch
 delete mode 100644 meta/recipes-connectivity/openssl/openssl/0001-allow-OPENSSLDIR-and-ENGINESDIR-CFLAGS-to-be-control.patch
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/0001-Fix-build-with-clang-using-external-assembler.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/0001-allow-manpages-to-be-disabled.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/0001-openssl-force-soft-link-to-avoid-rare-race.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/Makefiles-ptest.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/Use-SHA256-not-MD5-as-default-digest.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/configure-musl-target.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/configure-targets.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian/c_rehash-compat.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian/debian-targets.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian/man-dir.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian/man-section.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian/no-rpath.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian/no-symbolic.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian/pic.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian1.0.2/block_digicert_malaysia.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian1.0.2/block_diginotar.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian1.0.2/soname.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/debian1.0.2/version-script.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/engines-install-in-libdir-ssl.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/oe-ldflags.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/openssl-c_rehash.sh (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/openssl-fix-des.pod-error.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/openssl_fix_for_x32.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/parallel.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/ptest-deps.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/ptest_makefile_deps.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/reproducible-cflags.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/reproducible-mkbuildinf.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/run-ptest (100%)
 rename meta/recipes-connectivity/openssl/{openssl-1.0.2p => openssl10}/shared-libs.patch (100%)
 rename meta/recipes-connectivity/openssl/{openssl_1.0.2p.bb => openssl10_1.0.2p.bb} (91%)
 rename meta/recipes-connectivity/openssl/{openssl_1.1.0i.bb => openssl_1.1.1-pre9.bb} (83%)
 create mode 100644 meta/recipes-kernel/cryptodev/files/0001-Port-tests-to-openssl-1.1.patch
 rename meta/recipes-support/ca-certificates/{ca-certificates_20170717.bb => ca-certificates_20180409.bb} (95%)

--
2.7.4

--
_______________________________________________
Openembedded-core mailing list
[email protected]
http://lists.openembedded.org/mailman/listinfo/openembedded-core

At the moment 1.1.1 is in pre-release stage, however the final release should be available within a few weeks. The major selling point is that it supports the new TLS 1.3 specification. It will also be the new long term support version. More information:

https://www.openssl.org/policies/releasestrat.html

Signed-off-by Alexander Kanavin <[email protected]>

---
 ...1-Take-linking-flags-from-LDFLAGS-env-var.patch | 43 ----------------------
 ...SLDIR-and-ENGINESDIR-CFLAGS-to-be-control.patch | 39 --------------------
 .../{openssl_1.1.0i.bb => openssl_1.1.1-pre9.bb}   | 23 +++++++-----
 3 files changed, 14 insertions(+), 91 deletions(-)
 delete mode 100644 meta/recipes-connectivity/openssl/openssl/0001-Take-linking-flags-from-LDFLAGS-env-var.patch
 delete mode 100644 meta/recipes-connectivity/openssl/openssl/0001-allow-OPENSSLDIR-and-ENGINESDIR-CFLAGS-to-be-control.patch
 rename meta/recipes-connectivity/openssl/{openssl_1.1.0i.bb => openssl_1.1.1-pre9.bb} (83%)

meta/recipes-connectivity/openssl/openssl/0001-Take-linking-flags-from-LDFLAGS-env-var.patch deleted +0 -43

deleted file mode 100644
index 6ce4e47..0000000
@@ -1,43 +0,0 @@
-From 08face4353d80111973aba9c1304c92158cfad0e Mon Sep 17 00:00:00 2001
-From: Alexander Kanavin <[email protected]>
-Date: Tue, 28 Mar 2017 16:40:12 +0300
-Subject: [PATCH] Take linking flags from LDFLAGS env var
-
-This fixes "No GNU_HASH in the elf binary" issues.
-
-Upstream-Status: Inappropriate [oe-core specific]
-Signed-off-by: Alexander Kanavin <[email protected]>
----
- Configurations/unix-Makefile.tmpl | 2 +-
- Configure                         | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/Configurations/unix-Makefile.tmpl b/Configurations/unix-Makefile.tmpl
-index c029817..43b769b 100644
---- a/Configurations/unix-Makefile.tmpl
-+++ b/Configurations/unix-Makefile.tmpl
-@@ -173,7 +173,7 @@ CROSS_COMPILE= {- $config{cross_compile_prefix} -}
- CC= $(CROSS_COMPILE){- $target{cc} -}
- CFLAGS={- our $cflags2 = join(" ",(map { "-D".$_} @{$target{defines}}, @{$config{defines}}),"-DOPENSSLDIR=\"\\\"\$(OPENSSLDIR)\\\"\"","-DENGINESDIR=\"\\\"\$(ENGINESDIR)\\\"\"") -} {- $target{cflags} -} {- $config{cflags} -}
- CFLAGS_Q={- $cflags2 =~ s|([\\"])|\\$1|g; $cflags2 -} {- $config{cflags} -}
--LDFLAGS= {- $target{lflags} -}
-+LDFLAGS= {- $target{lflags}." ".$ENV{'LDFLAGS'} -}
- PLIB_LDFLAGS= {- $target{plib_lflags} -}
- EX_LIBS= {- $target{ex_libs} -} {- $config{ex_libs} -}
- LIB_CFLAGS={- $target{shared_cflag} || "" -}
-diff --git a/Configure b/Configure
-index aee7cc3..274d236 100755
---- a/Configure
-+++ b/Configure
-@@ -979,7 +979,7 @@ $config{build_file} = $target{build_file};
- $config{defines} = [];
- $config{cflags} = "";
- $config{ex_libs} = "";
--$config{shared_ldflag} = "";
-+$config{shared_ldflag} = $ENV{'LDFLAGS'};
- 
- # Make sure build_scheme is consistent.
- $target{build_scheme} = [ $target{build_scheme} ]
--- 
-2.11.0
-

meta/recipes-connectivity/openssl/openssl/0001-allow-OPENSSLDIR-and-ENGINESDIR-CFLAGS-to-be-control.patch deleted +0 -39

deleted file mode 100644
index 67d06fc..0000000
@@ -1,39 +0,0 @@
-From 26e98beb8a987cdc69699aaffc5599926fb1b293 Mon Sep 17 00:00:00 2001
-From: Andre McCurdy <[email protected]>
-Date: Fri, 17 Aug 2018 20:33:44 -0700
-Subject: [PATCH] allow OPENSSLDIR and ENGINESDIR CFLAGS to be controlled
-
-Upstream-Status: Inappropriate [OE Specific]
-
-Signed-off-by: Andre McCurdy <[email protected]>
----
- Configurations/unix-Makefile.tmpl | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/Configurations/unix-Makefile.tmpl b/Configurations/unix-Makefile.tmpl
-index 034d93e..2310d12 100644
---- a/Configurations/unix-Makefile.tmpl
-+++ b/Configurations/unix-Makefile.tmpl
-@@ -156,6 +156,10 @@ LIBDIR={- #
- ENGINESDIR={- use File::Spec::Functions;
-               catdir($prefix,$libdir,"engines-$sover") -}
- 
-+# Intermediate variables so the values defined via CFLAGS can be controlled.
-+OE_DOPENSSLDIR=$(OPENSSLDIR)
-+OE_DENGINESDIR=$(ENGINESDIR)
-+
- # Convenience variable for those who want to set the rpath in shared
- # libraries and applications
- LIBRPATH=$(INSTALLTOP)/$(LIBDIR)
-@@ -174,7 +178,7 @@ HTMLSUFFIX=html
- 
- CROSS_COMPILE= {- $config{cross_compile_prefix} -}
- CC= $(CROSS_COMPILE){- $target{cc} -}
--CFLAGS={- our $cflags2 = join(" ",(map { "-D".$_} @{$target{defines}}, @{$config{defines}}),"-DOPENSSLDIR=\"\\\"\$(OPENSSLDIR)\\\"\"","-DENGINESDIR=\"\\\"\$(ENGINESDIR)\\\"\"") -} {- $target{cflags} -} {- $config{cflags} -}
-+CFLAGS={- our $cflags2 = join(" ",(map { "-D".$_} @{$target{defines}}, @{$config{defines}}),"-DOPENSSLDIR=\"\\\"\$(OE_DOPENSSLDIR)\\\"\"","-DENGINESDIR=\"\\\"\$(OE_DENGINESDIR)\\\"\"") -} {- $target{cflags} -} {- $config{cflags} -}
- CFLAGS_Q={- $cflags2 =~ s|([\\"])|\\$1|g; $cflags2 -} {- $config{cflags} -}
- LDFLAGS= {- $target{lflags}." ".$ENV{'LDFLAGS'} -}
- PLIB_LDFLAGS= {- $target{plib_lflags} -}
--- 
-1.9.1
-

meta/recipes-connectivity/openssl/openssl_1.1.1-pre9.bb renamed from meta/recipes-connectivity/openssl/openssl_1.1.0i.bb +0 -4

similarity index 83%
rename from meta/recipes-connectivity/openssl/openssl_1.1.0i.bb
rename to meta/recipes-connectivity/openssl/openssl_1.1.1-pre9.bb
index a03f6ff..1917c33 100644
@@ -13,26 +13,30 @@ DEPENDS = "hostperl-runtime-native"
 SRC_URI = "http://www.openssl.org/source/openssl-${PV}.tar.gz \
            file://run-ptest \
            file://openssl-c_rehash.sh \
-           file://0001-Take-linking-flags-from-LDFLAGS-env-var.patch \
-           file://0001-allow-OPENSSLDIR-and-ENGINESDIR-CFLAGS-to-be-control.patch \
            "
 
 SRC_URI_append_class-nativesdk = " \
            file://environment.d-openssl.sh \
            "
 
-SRC_URI[md5sum] = "9495126aafd2659d357ea66a969c3fe1"
-SRC_URI[sha256sum] = "ebbfc844a8c8cc0ea5dc10b86c9ce97f401837f3fa08c17b2cdadc118253cf99"

Quoted 132 lines · Alexander Kanavin

At the moment 1.1.1 is in pre-release stage, however the final release should be available within a few weeks. The major selling point is that it supports the new TLS 1.3 specification. It will also be the new long term support version. More information:

https://www.openssl.org/policies/releasestrat.html

Signed-off-by Alexander Kanavin <[email protected]>

---
 ...1-Take-linking-flags-from-LDFLAGS-env-var.patch | 43 ----------------------
 ...SLDIR-and-ENGINESDIR-CFLAGS-to-be-control.patch | 39 --------------------
 .../{openssl_1.1.0i.bb => openssl_1.1.1-pre9.bb}   | 23 +++++++-----
 3 files changed, 14 insertions(+), 91 deletions(-)
 delete mode 100644 meta/recipes-connectivity/openssl/openssl/0001-Take-linking-flags-from-LDFLAGS-env-var.patch
 delete mode 100644 meta/recipes-connectivity/openssl/openssl/0001-allow-OPENSSLDIR-and-ENGINESDIR-CFLAGS-to-be-control.patch
 rename meta/recipes-connectivity/openssl/{openssl_1.1.0i.bb => openssl_1.1.1-pre9.bb} (83%)

meta/recipes-connectivity/openssl/openssl/0001-Take-linking-flags-from-LDFLAGS-env-var.patch deleted +0 -43

deleted file mode 100644
index 6ce4e47..0000000
@@ -1,43 +0,0 @@
-From 08face4353d80111973aba9c1304c92158cfad0e Mon Sep 17 00:00:00 2001
-From: Alexander Kanavin <[email protected]>
-Date: Tue, 28 Mar 2017 16:40:12 +0300
-Subject: [PATCH] Take linking flags from LDFLAGS env var
-
-This fixes "No GNU_HASH in the elf binary" issues.
-
-Upstream-Status: Inappropriate [oe-core specific]
-Signed-off-by: Alexander Kanavin <[email protected]>
----
- Configurations/unix-Makefile.tmpl | 2 +-
- Configure                         | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/Configurations/unix-Makefile.tmpl b/Configurations/unix-Makefile.tmpl
-index c029817..43b769b 100644
---- a/Configurations/unix-Makefile.tmpl
-+++ b/Configurations/unix-Makefile.tmpl
-@@ -173,7 +173,7 @@ CROSS_COMPILE= {- $config{cross_compile_prefix} -}
- CC= $(CROSS_COMPILE){- $target{cc} -}
- CFLAGS={- our $cflags2 = join(" ",(map { "-D".$_} @{$target{defines}}, @{$config{defines}}),"-DOPENSSLDIR=\"\\\"\$(OPENSSLDIR)\\\"\"","-DENGINESDIR=\"\\\"\$(ENGINESDIR)\\\"\"") -} {- $target{cflags} -} {- $config{cflags} -}
- CFLAGS_Q={- $cflags2 =~ s|([\\"])|\\$1|g; $cflags2 -} {- $config{cflags} -}
--LDFLAGS= {- $target{lflags} -}
-+LDFLAGS= {- $target{lflags}." ".$ENV{'LDFLAGS'} -}
- PLIB_LDFLAGS= {- $target{plib_lflags} -}
- EX_LIBS= {- $target{ex_libs} -} {- $config{ex_libs} -}
- LIB_CFLAGS={- $target{shared_cflag} || "" -}
-diff --git a/Configure b/Configure
-index aee7cc3..274d236 100755
---- a/Configure
-+++ b/Configure
-@@ -979,7 +979,7 @@ $config{build_file} = $target{build_file};
- $config{defines} = [];
- $config{cflags} = "";
- $config{ex_libs} = "";
--$config{shared_ldflag} = "";
-+$config{shared_ldflag} = $ENV{'LDFLAGS'};
-
- # Make sure build_scheme is consistent.
- $target{build_scheme} = [ $target{build_scheme} ]
---
-2.11.0
-

meta/recipes-connectivity/openssl/openssl/0001-allow-OPENSSLDIR-and-ENGINESDIR-CFLAGS-to-be-control.patch deleted +0 -39

deleted file mode 100644
index 67d06fc..0000000
@@ -1,39 +0,0 @@
-From 26e98beb8a987cdc69699aaffc5599926fb1b293 Mon Sep 17 00:00:00 2001
-From: Andre McCurdy <[email protected]>
-Date: Fri, 17 Aug 2018 20:33:44 -0700
-Subject: [PATCH] allow OPENSSLDIR and ENGINESDIR CFLAGS to be controlled
-
-Upstream-Status: Inappropriate [OE Specific]
-
-Signed-off-by: Andre McCurdy <[email protected]>
----
- Configurations/unix-Makefile.tmpl | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/Configurations/unix-Makefile.tmpl b/Configurations/unix-Makefile.tmpl
-index 034d93e..2310d12 100644
---- a/Configurations/unix-Makefile.tmpl
-+++ b/Configurations/unix-Makefile.tmpl
-@@ -156,6 +156,10 @@ LIBDIR={- #
- ENGINESDIR={- use File::Spec::Functions;
-               catdir($prefix,$libdir,"engines-$sover") -}
-
-+# Intermediate variables so the values defined via CFLAGS can be controlled.
-+OE_DOPENSSLDIR=$(OPENSSLDIR)
-+OE_DENGINESDIR=$(ENGINESDIR)
-+
- # Convenience variable for those who want to set the rpath in shared
- # libraries and applications
- LIBRPATH=$(INSTALLTOP)/$(LIBDIR)
-@@ -174,7 +178,7 @@ HTMLSUFFIX=html
-
- CROSS_COMPILE= {- $config{cross_compile_prefix} -}
- CC= $(CROSS_COMPILE){- $target{cc} -}
--CFLAGS={- our $cflags2 = join(" ",(map { "-D".$_} @{$target{defines}}, @{$config{defines}}),"-DOPENSSLDIR=\"\\\"\$(OPENSSLDIR)\\\"\"","-DENGINESDIR=\"\\\"\$(ENGINESDIR)\\\"\"") -} {- $target{cflags} -} {- $config{cflags} -}
-+CFLAGS={- our $cflags2 = join(" ",(map { "-D".$_} @{$target{defines}}, @{$config{defines}}),"-DOPENSSLDIR=\"\\\"\$(OE_DOPENSSLDIR)\\\"\"","-DENGINESDIR=\"\\\"\$(OE_DENGINESDIR)\\\"\"") -} {- $target{cflags} -} {- $config{cflags} -}
- CFLAGS_Q={- $cflags2 =~ s|([\\"])|\\$1|g; $cflags2 -} {- $config{cflags} -}
- LDFLAGS= {- $target{lflags}." ".$ENV{'LDFLAGS'} -}
- PLIB_LDFLAGS= {- $target{plib_lflags} -}
---
-1.9.1
-

meta/recipes-connectivity/openssl/openssl_1.1.1-pre9.bb renamed from meta/recipes-connectivity/openssl/openssl_1.1.0i.bb +0 -4

similarity index 83%
rename from meta/recipes-connectivity/openssl/openssl_1.1.0i.bb
rename to meta/recipes-connectivity/openssl/openssl_1.1.1-pre9.bb
index a03f6ff..1917c33 100644
@@ -13,26 +13,30 @@ DEPENDS = "hostperl-runtime-native"
 SRC_URI = "http://www.openssl.org/source/openssl-${PV}.tar.gz \
            file://run-ptest \
            file://openssl-c_rehash.sh \
-           file://0001-Take-linking-flags-from-LDFLAGS-env-var.patch \
-           file://0001-allow-OPENSSLDIR-and-ENGINESDIR-CFLAGS-to-be-control.patch \
            "
 
 SRC_URI_append_class-nativesdk = " \
            file://environment.d-openssl.sh \
            "
 
-SRC_URI[md5sum] = "9495126aafd2659d357ea66a969c3fe1"
-SRC_URI[sha256sum] = "ebbfc844a8c8cc0ea5dc10b86c9ce97f401837f3fa08c17b2cdadc118253cf99"

meta/recipes-connectivity/openssl/openssl_1.1.1-pre9.bb DEPENDS = "hostperl-runtime-native" · line 30

Quoted 10 lines

meta/recipes-connectivity/openssl/openssl_1.1.1-pre9.bb renamed from meta/recipes-connectivity/openssl/openssl_1.1.0i.bb +3 -1

+SRC_URI[md5sum] = "6aa32e976e2c9a4aee858ced135d2573"
+SRC_URI[sha256sum] = "95ebdfbb05e8451fb01a186ccaa4a7da0eff9a48999ede9fe1a7d90db75ccb4c"
 
 inherit lib_package multilib_header ptest
 
 #| ./libcrypto.so: undefined reference to `getcontext'
 #| ./libcrypto.so: undefined reference to `setcontext'
 #| ./libcrypto.so: undefined reference to `makecontext'
-EXTRA_OECONF_append_libc-musl = " -DOPENSSL_NO_ASYNC"
+CPPFLAGS_append_libc-musl = " -DOPENSSL_NO_ASYNC"

This change actually does not work. Correct way to disable async would be to add -no-async option to configure, something like below works

EXTRA_OECONF_append_libc-musl = " -no-async"

Otherwise we get undefined refs to {get|set}context APIs encoded into libcrypto.so

--
_______________________________________________
Openembedded-core mailing list
[email protected]
http://lists.openembedded.org/mailman/listinfo/openembedded-core

Quoted 147 lines · Khem Raj

Quoted 132 lines · Alexander Kanavin

At the moment 1.1.1 is in pre-release stage, however the final release should be available within a few weeks. The major selling point is that it supports the new TLS 1.3 specification. It will also be the new long term support version. More information:

https://www.openssl.org/policies/releasestrat.html

Signed-off-by Alexander Kanavin <[email protected]>

---
 ...1-Take-linking-flags-from-LDFLAGS-env-var.patch | 43 ----------------------
 ...SLDIR-and-ENGINESDIR-CFLAGS-to-be-control.patch | 39 --------------------
 .../{openssl_1.1.0i.bb => openssl_1.1.1-pre9.bb}   | 23 +++++++-----
 3 files changed, 14 insertions(+), 91 deletions(-)
 delete mode 100644 meta/recipes-connectivity/openssl/openssl/0001-Take-linking-flags-from-LDFLAGS-env-var.patch
 delete mode 100644 meta/recipes-connectivity/openssl/openssl/0001-allow-OPENSSLDIR-and-ENGINESDIR-CFLAGS-to-be-control.patch
 rename meta/recipes-connectivity/openssl/{openssl_1.1.0i.bb => openssl_1.1.1-pre9.bb} (83%)

meta/recipes-connectivity/openssl/openssl/0001-Take-linking-flags-from-LDFLAGS-env-var.patch deleted +0 -43

deleted file mode 100644
index 6ce4e47..0000000
@@ -1,43 +0,0 @@
-From 08face4353d80111973aba9c1304c92158cfad0e Mon Sep 17 00:00:00 2001
-From: Alexander Kanavin <[email protected]>
-Date: Tue, 28 Mar 2017 16:40:12 +0300
-Subject: [PATCH] Take linking flags from LDFLAGS env var
-
-This fixes "No GNU_HASH in the elf binary" issues.
-
-Upstream-Status: Inappropriate [oe-core specific]
-Signed-off-by: Alexander Kanavin <[email protected]>
----
- Configurations/unix-Makefile.tmpl | 2 +-
- Configure                         | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/Configurations/unix-Makefile.tmpl b/Configurations/unix-Makefile.tmpl
-index c029817..43b769b 100644
---- a/Configurations/unix-Makefile.tmpl
-+++ b/Configurations/unix-Makefile.tmpl
-@@ -173,7 +173,7 @@ CROSS_COMPILE= {- $config{cross_compile_prefix} -}
- CC= $(CROSS_COMPILE){- $target{cc} -}
- CFLAGS={- our $cflags2 = join(" ",(map { "-D".$_} @{$target{defines}}, @{$config{defines}}),"-DOPENSSLDIR=\"\\\"\$(OPENSSLDIR)\\\"\"","-DENGINESDIR=\"\\\"\$(ENGINESDIR)\\\"\"") -} {- $target{cflags} -} {- $config{cflags} -}
- CFLAGS_Q={- $cflags2 =~ s|([\\"])|\\$1|g; $cflags2 -} {- $config{cflags} -}
--LDFLAGS= {- $target{lflags} -}
-+LDFLAGS= {- $target{lflags}." ".$ENV{'LDFLAGS'} -}
- PLIB_LDFLAGS= {- $target{plib_lflags} -}
- EX_LIBS= {- $target{ex_libs} -} {- $config{ex_libs} -}
- LIB_CFLAGS={- $target{shared_cflag} || "" -}
-diff --git a/Configure b/Configure
-index aee7cc3..274d236 100755
---- a/Configure
-+++ b/Configure
-@@ -979,7 +979,7 @@ $config{build_file} = $target{build_file};
- $config{defines} = [];
- $config{cflags} = "";
- $config{ex_libs} = "";
--$config{shared_ldflag} = "";
-+$config{shared_ldflag} = $ENV{'LDFLAGS'};
-
- # Make sure build_scheme is consistent.
- $target{build_scheme} = [ $target{build_scheme} ]
---
-2.11.0
-

meta/recipes-connectivity/openssl/openssl/0001-allow-OPENSSLDIR-and-ENGINESDIR-CFLAGS-to-be-control.patch deleted +0 -39

deleted file mode 100644
index 67d06fc..0000000
@@ -1,39 +0,0 @@
-From 26e98beb8a987cdc69699aaffc5599926fb1b293 Mon Sep 17 00:00:00 2001
-From: Andre McCurdy <[email protected]>
-Date: Fri, 17 Aug 2018 20:33:44 -0700
-Subject: [PATCH] allow OPENSSLDIR and ENGINESDIR CFLAGS to be controlled
-
-Upstream-Status: Inappropriate [OE Specific]
-
-Signed-off-by: Andre McCurdy <[email protected]>
----
- Configurations/unix-Makefile.tmpl | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/Configurations/unix-Makefile.tmpl b/Configurations/unix-Makefile.tmpl
-index 034d93e..2310d12 100644
---- a/Configurations/unix-Makefile.tmpl
-+++ b/Configurations/unix-Makefile.tmpl
-@@ -156,6 +156,10 @@ LIBDIR={- #
- ENGINESDIR={- use File::Spec::Functions;
-               catdir($prefix,$libdir,"engines-$sover") -}
-
-+# Intermediate variables so the values defined via CFLAGS can be controlled.
-+OE_DOPENSSLDIR=$(OPENSSLDIR)
-+OE_DENGINESDIR=$(ENGINESDIR)
-+
- # Convenience variable for those who want to set the rpath in shared
- # libraries and applications
- LIBRPATH=$(INSTALLTOP)/$(LIBDIR)
-@@ -174,7 +178,7 @@ HTMLSUFFIX=html
-
- CROSS_COMPILE= {- $config{cross_compile_prefix} -}
- CC= $(CROSS_COMPILE){- $target{cc} -}
--CFLAGS={- our $cflags2 = join(" ",(map { "-D".$_} @{$target{defines}}, @{$config{defines}}),"-DOPENSSLDIR=\"\\\"\$(OPENSSLDIR)\\\"\"","-DENGINESDIR=\"\\\"\$(ENGINESDIR)\\\"\"") -} {- $target{cflags} -} {- $config{cflags} -}
-+CFLAGS={- our $cflags2 = join(" ",(map { "-D".$_} @{$target{defines}}, @{$config{defines}}),"-DOPENSSLDIR=\"\\\"\$(OE_DOPENSSLDIR)\\\"\"","-DENGINESDIR=\"\\\"\$(OE_DENGINESDIR)\\\"\"") -} {- $target{cflags} -} {- $config{cflags} -}
- CFLAGS_Q={- $cflags2 =~ s|([\\"])|\\$1|g; $cflags2 -} {- $config{cflags} -}
- LDFLAGS= {- $target{lflags}." ".$ENV{'LDFLAGS'} -}
- PLIB_LDFLAGS= {- $target{plib_lflags} -}
---
-1.9.1
-

meta/recipes-connectivity/openssl/openssl_1.1.1-pre9.bb renamed from meta/recipes-connectivity/openssl/openssl_1.1.0i.bb +0 -4

similarity index 83%
rename from meta/recipes-connectivity/openssl/openssl_1.1.0i.bb
rename to meta/recipes-connectivity/openssl/openssl_1.1.1-pre9.bb
index a03f6ff..1917c33 100644
@@ -13,26 +13,30 @@ DEPENDS = "hostperl-runtime-native"
 SRC_URI = "http://www.openssl.org/source/openssl-${PV}.tar.gz \
            file://run-ptest \
            file://openssl-c_rehash.sh \
-           file://0001-Take-linking-flags-from-LDFLAGS-env-var.patch \
-           file://0001-allow-OPENSSLDIR-and-ENGINESDIR-CFLAGS-to-be-control.patch \
            "
 
 SRC_URI_append_class-nativesdk = " \
            file://environment.d-openssl.sh \
            "
 
-SRC_URI[md5sum] = "9495126aafd2659d357ea66a969c3fe1"
-SRC_URI[sha256sum] = "ebbfc844a8c8cc0ea5dc10b86c9ce97f401837f3fa08c17b2cdadc118253cf99"

meta/recipes-connectivity/openssl/openssl_1.1.1-pre9.bb DEPENDS = "hostperl-runtime-native" · line 30

Quoted 10 lines

meta/recipes-connectivity/openssl/openssl_1.1.1-pre9.bb renamed from meta/recipes-connectivity/openssl/openssl_1.1.0i.bb +3 -1

+SRC_URI[md5sum] = "6aa32e976e2c9a4aee858ced135d2573"
+SRC_URI[sha256sum] = "95ebdfbb05e8451fb01a186ccaa4a7da0eff9a48999ede9fe1a7d90db75ccb4c"
 
 inherit lib_package multilib_header ptest
 
 #| ./libcrypto.so: undefined reference to `getcontext'
 #| ./libcrypto.so: undefined reference to `setcontext'
 #| ./libcrypto.so: undefined reference to `makecontext'
-EXTRA_OECONF_append_libc-musl = " -DOPENSSL_NO_ASYNC"
+CPPFLAGS_append_libc-musl = " -DOPENSSL_NO_ASYNC"

This change actually does not work. Correct way to disable async would be to add -no-async option to configure, something like below works

Quoted 1 line

EXTRA_OECONF_append_libc-musl = " -no-async"

That should be " no-async", ie without the leading "-".

https://github.com/openssl/openssl/blob/OpenSSL_1_1_0i/INSTALL#L233

Quoted 13 lines

Otherwise we get undefined refs to {get|set}context APIs encoded into libcrypto.so

--
_______________________________________________
Openembedded-core mailing list
[email protected]
http://lists.openembedded.org/mailman/listinfo/openembedded-core

From: Alexander Kanavin <[email protected]>

I believe the time has come to do this: openssl 1.0 upstream support stops at the end
of 2019, and we do not want a situation where a supported YP release contains an
unsupported version of a critical security component.

Openssl 1.0 can still be utilized by depending on 'openssl10' recipe.

Quoted 10 lines · Alexander Kanavin

From: Alexander Kanavin <[email protected]>

I believe the time has come to do this: openssl 1.0 upstream support stops at the end
of 2019, and we do not want a situation where a supported YP release contains an
unsupported version of a critical security component.

Openssl 1.0 can still be utilized by depending on 'openssl10' recipe.

This still isn't true for most recipes, as long as there is something depending on openssl in the dependency tree, it will
cause do_prepare_recipe_sysroot failures like last time

ERROR: The file /usr/lib/libssl.so is installed by both openssl10 and openssl, aborting
DEBUG: Python function extend_recipe_sysroot finished
DEBUG: Python function do_prepare_recipe_sysroot finished
ERROR: Function failed: extend_recipe_sysroot

From 15 failures caused by openssl-1.1 detected in my builds, just changing DEPENDS from openssl to openssl10 didn't help in any case.

From: Alexander Kanavin <[email protected]>

This leaves openssh as the only recipe that requires openssl 1.0 (or libressl).

Signed-off-by Alexander Kanavin <[email protected]>

---
 .../cryptodev/cryptodev-tests_1.9.bb               |   3 +-
 .../files/0001-Port-tests-to-openssl-1.1.patch     | 103 +++++++++++++++++++++
 2 files changed, 105 insertions(+), 1 deletion(-)
 create mode 100644 meta/recipes-kernel/cryptodev/files/0001-Port-tests-to-openssl-1.1.patch

meta/recipes-kernel/cryptodev/cryptodev-tests_1.9.bb +2 -1

index 9afb3de..617db6c 100644
@@ -2,10 +2,11 @@ require cryptodev.inc
 
 SUMMARY = "A test suite for /dev/crypto device driver"
 
-DEPENDS += "openssl10"
+DEPENDS += "openssl"
 
 SRC_URI += " \
 file://0001-Add-the-compile-and-install-rules-for-cryptodev-test.patch \
+file://0001-Port-tests-to-openssl-1.1.patch \
 "
 
 EXTRA_OEMAKE='KERNEL_DIR="${STAGING_EXECPREFIXDIR}" PREFIX="${D}"'

meta/recipes-kernel/cryptodev/files/0001-Port-tests-to-openssl-1.1.patch new file +63 -0

new file mode 100644
index 0000000..c969126
@@ -0,0 +1,103 @@
+From 2fe4bdeb8cdd0b0f46d9caed807812855d51ea56 Mon Sep 17 00:00:00 2001
+From: Alexander Kanavin <[email protected]>
+Date: Wed, 28 Mar 2018 20:11:05 +0300
+Subject: [PATCH] Port tests to openssl 1.1
+
+Upstream-Status: Accepted [https://github.com/cryptodev-linux/cryptodev-linux/pull/36]
+Signed-off-by: Alexander Kanavin <[email protected]>
+
+---
+ tests/openssl_wrapper.c | 33 +++++++++++++++++++++++++++++++++
+ 1 file changed, 33 insertions(+)
+
+diff --git a/tests/openssl_wrapper.c b/tests/openssl_wrapper.c
+index 038c58f..dea2496 100644
+--- a/tests/openssl_wrapper.c
++++ b/tests/openssl_wrapper.c
+@@ -4,6 +4,7 @@
+ #include <openssl/aes.h>
+ #include <openssl/evp.h>
+ #include <openssl/hmac.h>
++#include <openssl/opensslv.h>
+
+ //#define DEBUG
+
+@@ -23,10 +24,17 @@ enum ctx_type {
+       ctx_type_md,
+ };
+
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
++union openssl_ctx {
++      HMAC_CTX *hmac;
++      EVP_MD_CTX *md;
++};
++#else
+ union openssl_ctx {
+       HMAC_CTX hmac;
+       EVP_MD_CTX md;
+ };
++#endif
+
+ struct ctx_mapping {
+       __u32 ses;
+@@ -63,6 +71,16 @@ static void remove_mapping(__u32 ses)
+       switch (mapping->type) {
+       case ctx_type_none:
+               break;
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
++      case ctx_type_hmac:
++              dbgp("%s: calling HMAC_CTX_free\n", __func__);
++              HMAC_CTX_free(mapping->ctx.hmac);
++              break;
++      case ctx_type_md:
++              dbgp("%s: calling EVP_MD_CTX_free\n", __func__);
++              EVP_MD_CTX_free(mapping->ctx.md);
++              break;
++#else
+       case ctx_type_hmac:
+               dbgp("%s: calling HMAC_CTX_cleanup\n", __func__);
+               HMAC_CTX_cleanup(&mapping->ctx.hmac);
+@@ -71,6 +89,7 @@ static void remove_mapping(__u32 ses)
+               dbgp("%s: calling EVP_MD_CTX_cleanup\n", __func__);
+               EVP_MD_CTX_cleanup(&mapping->ctx.md);
+               break;

meta/recipes-kernel/cryptodev/files/0001-Port-tests-to-openssl-1.1.patch new file +8 -0

++
++              dbgp("calling HMAC_CTX_new");
++              ctx = HMAC_CTX_new();
++#else
+               ctx = &mapping->ctx.hmac;
+
+               dbgp("calling HMAC_CTX_init");
+               HMAC_CTX_init(ctx);

meta/recipes-kernel/cryptodev/files/0001-Port-tests-to-openssl-1.1.patch new file +12 -1

++
++              dbgp("calling EVP_MD_CTX_new");
++              ctx = EVP_MD_CTX_new();
++#else
+               ctx = &mapping->ctx.md;
+
+               dbgp("calling EVP_MD_CTX_init");
+               EVP_MD_CTX_init(ctx);
++#endif
+               dbgp("calling EVP_DigestInit");
+               EVP_DigestInit(ctx, sess_to_evp_md(sess));
+       }
--

2.7.4

--
_______________________________________________
Openembedded-core mailing list
[email protected]
http://lists.openembedded.org/mailman/listinfo/openembedded-core

Quoted 23 lines · Martin Jansa

Quoted 10 lines · Alexander Kanavin

From: Alexander Kanavin <[email protected]>

I believe the time has come to do this: openssl 1.0 upstream support stops at the end
of 2019, and we do not want a situation where a supported YP release contains an
unsupported version of a critical security component.

Openssl 1.0 can still be utilized by depending on 'openssl10' recipe.

This still isn't true for most recipes, as long as there is something depending on openssl in the dependency tree, it will
cause do_prepare_recipe_sysroot failures like last time

ERROR: The file /usr/lib/libssl.so is installed by both openssl10 and openssl, aborting
DEBUG: Python function extend_recipe_sysroot finished
DEBUG: Python function do_prepare_recipe_sysroot finished
ERROR: Function failed: extend_recipe_sysroot

Quoted 2 lines

From 15 failures caused by openssl-1.1 detected in my builds, just changing DEPENDS from openssl to openssl10 didn't help in any case.

That isn't good news. Do you have an idea of which components are in the dependency chains and if any of them are common? It'd also be useful to understand which ones are breaking...

I pointed this earlier before merge as well meta-openembedded has 40 odd recipes failing due to openssl 1.1 upgrade

http://errors.yoctoproject.org/Errors/Build/67457/?page=2&limit=50

so obvious fix was to keep them pinned to openssl10 and i created couple of fixes
to start

https://patchwork.openembedded.org/patch/154517/
https://patchwork.openembedded.org/patch/154516/

and the effects are showing up where sysroot task now starts to fail for dependent
recipes here

http://errors.yoctoproject.org/Errors/Details/190427/
http://errors.yoctoproject.org/Errors/Details/190433/

in meta-oe certain recipes can be upgraded and we can get openssl 1.1 support
but others like the two examples I cited above do not have openSSL 1.1 port.
so I think we can not live without openSSL 1.0 and OpenSSL 2.0 being able to
co-exist.

Quoted 3 lines · Khem Raj

I pointed this earlier before merge as well meta-openembedded has 40 odd recipes failing due to openssl 1.1 upgrade

Sorry, I think I missed something somewhere as I thought the indications were the bigger problems like qt5 were working now :/.

Quoted 16 lines

http://errors.yoctoproject.org/Errors/Build/67457/?page=2&limit=50

so obvious fix was to keep them pinned to openssl10 and i created couple of fixes
to start

https://patchwork.openembedded.org/patch/154517/
https://patchwork.openembedded.org/patch/154516/

and the effects are showing up where sysroot task now starts to fail for dependent
recipes here

http://errors.yoctoproject.org/Errors/Details/190427/
http://errors.yoctoproject.org/Errors/Details/190433/

Quoted 7 lines

in meta-oe certain recipes can be upgraded and we can get openssl 1.1 support
but others like the two examples I cited above do not have openSSL 1.1 port.
so I think we can not live without openSSL 1.0 and OpenSSL 2.0 being able to
co-exist.

The latter link is php 7.2 which should have openssl 1.1 support
(https://bugs.php.net/bug.php?id=72360).

For the former, libgdata doesn't have an openssl depends so I guessed at liboauth pulling it in which does have an openssl 1.1 patch at:
https://github.com/x42/liboauth/issues/9

Quoted 33 lines · On Tue, Sep 4, 2018 at 3:58 PM <[email protected]> wrote:

Quoted 3 lines · Khem Raj

I pointed this earlier before merge as well meta-openembedded has 40 odd recipes failing due to openssl 1.1 upgrade

Sorry, I think I missed something somewhere as I thought the indications were the bigger problems like qt5 were working now :/.

Quoted 16 lines

http://errors.yoctoproject.org/Errors/Build/67457/?page=2&limit=50

so obvious fix was to keep them pinned to openssl10 and i created couple of fixes
to start

https://patchwork.openembedded.org/patch/154517/
https://patchwork.openembedded.org/patch/154516/

and the effects are showing up where sysroot task now starts to fail for dependent
recipes here

http://errors.yoctoproject.org/Errors/Details/190427/
http://errors.yoctoproject.org/Errors/Details/190433/

Quoted 7 lines

in meta-oe certain recipes can be upgraded and we can get openssl 1.1 support
but others like the two examples I cited above do not have openSSL 1.1 port.
so I think we can not live without openSSL 1.0 and OpenSSL 2.0 being able to
co-exist.

Quoted 7 lines

The latter link is php 7.2 which should have openssl 1.1 support
(https://bugs.php.net/bug.php?id=72360).

For the former, libgdata doesn't have an openssl depends so I guessed at liboauth pulling it in which does have an openssl 1.1 patch at:
https://github.com/x42/liboauth/issues/9

Thanks for pointers and they do help. However IMO the problem that Martin decribed
is going to be a real blocker. Unless we can provide a solution to let both openssl versions
coexist, this change is going to be problematic since we maintain several old recipes which
would have to be fixed for openssl 1.1 and this can take time, right now we are only seeing
meta-openembedded layers, we don't even know all other layers which might get into similar
issues.

Quoted 42 lines · Khem Raj

Quoted 33 lines · On Tue, Sep 4, 2018 at 3:58 PM <[email protected]> wrote:

Quoted 3 lines · Khem Raj

I pointed this earlier before merge as well meta-openembedded has 40 odd recipes failing due to openssl 1.1 upgrade

Sorry, I think I missed something somewhere as I thought the indications were the bigger problems like qt5 were working now :/.

Quoted 16 lines

http://errors.yoctoproject.org/Errors/Build/67457/?page=2&limit=50

so obvious fix was to keep them pinned to openssl10 and i created couple of fixes
to start

https://patchwork.openembedded.org/patch/154517/
https://patchwork.openembedded.org/patch/154516/

and the effects are showing up where sysroot task now starts to fail for dependent
recipes here

http://errors.yoctoproject.org/Errors/Details/190427/
http://errors.yoctoproject.org/Errors/Details/190433/

Quoted 7 lines

in meta-oe certain recipes can be upgraded and we can get openssl 1.1 support
but others like the two examples I cited above do not have openSSL 1.1 port.
so I think we can not live without openSSL 1.0 and OpenSSL 2.0 being able to
co-exist.

Quoted 7 lines

The latter link is php 7.2 which should have openssl 1.1 support
(https://bugs.php.net/bug.php?id=72360).

For the former, libgdata doesn't have an openssl depends so I guessed at liboauth pulling it in which does have an openssl 1.1 patch at:
https://github.com/x42/liboauth/issues/9

Quoted 11 lines

Thanks for pointers and they do help. However IMO the problem that Martin decribed
is going to be a real blocker. Unless we can provide a solution to let both openssl versions
coexist, this change is going to be problematic since we maintain several old recipes which
would have to be fixed for openssl 1.1 and this can take time, right now we are only seeing
meta-openembedded layers, we don't even know all other layers which might get into similar
issues.

To be clear, the issue is ( foo depends on openssl 1.1 and bar ) and ( bar depends on openssl 1.0 ), right?

Anyway, just for reference, it looks like Debian is packaging both openssl 1.0 and 1.1:

https://packages.debian.org/source/sid/openssl1.0
https://packages.debian.org/source/sid/openssl

In the case of liboauth, they avoid to need to patch by configuring liboauth to build with nss instead of openssl.

Quoted 56 lines · Khem Raj

Quoted 42 lines · On Tue, Sep 4, 2018 at 3:58 PM <[email protected]> wrote:

Quoted 33 lines · Khem Raj

Quoted 3 lines

I pointed this earlier before merge as well meta-openembedded has 40 odd recipes failing due to openssl 1.1 upgrade

Sorry, I think I missed something somewhere as I thought the indications were the bigger problems like qt5 were working now :/.

Quoted 16 lines

http://errors.yoctoproject.org/Errors/Build/67457/?page=2&limit=50

so obvious fix was to keep them pinned to openssl10 and i created couple of fixes
to start

https://patchwork.openembedded.org/patch/154517/
https://patchwork.openembedded.org/patch/154516/

and the effects are showing up where sysroot task now starts to fail for dependent
recipes here

http://errors.yoctoproject.org/Errors/Details/190427/
http://errors.yoctoproject.org/Errors/Details/190433/

Quoted 7 lines

in meta-oe certain recipes can be upgraded and we can get openssl 1.1 support
but others like the two examples I cited above do not have openSSL 1.1 port.
so I think we can not live without openSSL 1.0 and OpenSSL 2.0 being able to
co-exist.

Quoted 7 lines

The latter link is php 7.2 which should have openssl 1.1 support
(https://bugs.php.net/bug.php?id=72360).

For the former, libgdata doesn't have an openssl depends so I guessed at liboauth pulling it in which does have an openssl 1.1 patch at:
https://github.com/x42/liboauth/issues/9

Quoted 11 lines

Thanks for pointers and they do help. However IMO the problem that Martin decribed
is going to be a real blocker. Unless we can provide a solution to let both openssl versions
coexist, this change is going to be problematic since we maintain several old recipes which
would have to be fixed for openssl 1.1 and this can take time, right now we are only seeing
meta-openembedded layers, we don't even know all other layers which might get into similar
issues.

Quoted 2 lines

To be clear, the issue is ( foo depends on openssl 1.1 and bar ) and ( bar depends on openssl 1.0 ), right?

yes.

Quoted 9 lines

Anyway, just for reference, it looks like Debian is packaging both openssl 1.0 and 1.1:

https://packages.debian.org/source/sid/openssl1.0
https://packages.debian.org/source/sid/openssl

In the case of liboauth, they avoid to need to patch by configuring liboauth to build with nss instead of openssl.

this is already taken care see
http://git.openembedded.org/meta-openembedded-contrib/commit/?h=kraj/master&id=b1f87edc4202d6238c469dde358819c534b35751

but thats just one case.
--
_______________________________________________
Openembedded-core mailing list
[email protected]
http://lists.openembedded.org/mailman/listinfo/openembedded-core

I am also disappointed to see that openssl10 does not help much, however, I do not believe we should wait another year, and hope the problem would take care of itself - this clearly did not happen over the past year. Let's just look at failing recipes one by one and investigate what needs to be done for them. I've done this for everything in oe-core, and so it does not need openssl10 anymore (except one issue with openssh on arm64). It might be that much of the failing stuff is simply out of date.

Making 1.0 and 1.0 coexist in a sysroot means one of them has to be renamed into, say, libssl10.so, and everything that is using it patched accordingly. Not really possible. Yes, upstream has botched this transition badly. If you have better ideas, let me know please.

2018-09-05 6:54 GMT+02:00 Khem Raj <[email protected]>:

Quoted 81 lines · Andre McCurdy

Quoted 56 lines · Khem Raj

Quoted 42 lines · On Tue, Sep 4, 2018 at 3:58 PM <[email protected]> wrote:

Quoted 33 lines · Khem Raj

Quoted 3 lines

I pointed this earlier before merge as well meta-openembedded has 40 odd recipes failing due to openssl 1.1 upgrade

Sorry, I think I missed something somewhere as I thought the indications were the bigger problems like qt5 were working now :/.

Quoted 16 lines

http://errors.yoctoproject.org/Errors/Build/67457/?page=2&limit=50

so obvious fix was to keep them pinned to openssl10 and i created couple of fixes
to start

https://patchwork.openembedded.org/patch/154517/
https://patchwork.openembedded.org/patch/154516/

and the effects are showing up where sysroot task now starts to fail for dependent
recipes here

http://errors.yoctoproject.org/Errors/Details/190427/
http://errors.yoctoproject.org/Errors/Details/190433/

Quoted 7 lines

in meta-oe certain recipes can be upgraded and we can get openssl 1.1 support
but others like the two examples I cited above do not have openSSL 1.1 port.
so I think we can not live without openSSL 1.0 and OpenSSL 2.0 being able to
co-exist.

Quoted 7 lines

The latter link is php 7.2 which should have openssl 1.1 support
(https://bugs.php.net/bug.php?id=72360).

For the former, libgdata doesn't have an openssl depends so I guessed at liboauth pulling it in which does have an openssl 1.1 patch at:
https://github.com/x42/liboauth/issues/9

Quoted 11 lines

Thanks for pointers and they do help. However IMO the problem that Martin decribed
is going to be a real blocker. Unless we can provide a solution to let both openssl versions
coexist, this change is going to be problematic since we maintain several old recipes which
would have to be fixed for openssl 1.1 and this can take time, right now we are only seeing
meta-openembedded layers, we don't even know all other layers which might get into similar
issues.

Quoted 2 lines

To be clear, the issue is ( foo depends on openssl 1.1 and bar ) and ( bar depends on openssl 1.0 ), right?

yes.

Quoted 9 lines

Anyway, just for reference, it looks like Debian is packaging both openssl 1.0 and 1.1:

https://packages.debian.org/source/sid/openssl1.0
https://packages.debian.org/source/sid/openssl

In the case of liboauth, they avoid to need to patch by configuring liboauth to build with nss instead of openssl.

this is already taken care see
http://git.openembedded.org/meta-openembedded-contrib/commit/?h=kraj/master&id=b1f87edc4202d6238c469dde358819c534b35751

but thats just one case.
--
_______________________________________________
Openembedded-core mailing list
[email protected]
http://lists.openembedded.org/mailman/listinfo/openembedded-core

Signature · 4 lines

_______________________________________________
Openembedded-core mailing list
[email protected]
http://lists.openembedded.org/mailman/listinfo/openembedded-core

Quoted 97 lines · Alexander Kanavin

From: Alexander Kanavin <[email protected]>

This leaves openssh as the only recipe that requires openssl 1.0 (or libressl).

Signed-off-by Alexander Kanavin <[email protected]>

---
 .../cryptodev/cryptodev-tests_1.9.bb               |   3 +-
 .../files/0001-Port-tests-to-openssl-1.1.patch     | 103 +++++++++++++++++++++
 2 files changed, 105 insertions(+), 1 deletion(-)
 create mode 100644 meta/recipes-kernel/cryptodev/files/0001-Port-tests-to-openssl-1.1.patch

meta/recipes-kernel/cryptodev/cryptodev-tests_1.9.bb +2 -1

index 9afb3de..617db6c 100644
@@ -2,10 +2,11 @@ require cryptodev.inc
 
 SUMMARY = "A test suite for /dev/crypto device driver"
 
-DEPENDS += "openssl10"
+DEPENDS += "openssl"
 
 SRC_URI += " \
 file://0001-Add-the-compile-and-install-rules-for-cryptodev-test.patch \
+file://0001-Port-tests-to-openssl-1.1.patch \
 "
 
 EXTRA_OEMAKE='KERNEL_DIR="${STAGING_EXECPREFIXDIR}" PREFIX="${D}"'

meta/recipes-kernel/cryptodev/files/0001-Port-tests-to-openssl-1.1.patch new file +63 -0

new file mode 100644
index 0000000..c969126
@@ -0,0 +1,103 @@
+From 2fe4bdeb8cdd0b0f46d9caed807812855d51ea56 Mon Sep 17 00:00:00 2001
+From: Alexander Kanavin <[email protected]>
+Date: Wed, 28 Mar 2018 20:11:05 +0300
+Subject: [PATCH] Port tests to openssl 1.1
+
+Upstream-Status: Accepted [https://github.com/cryptodev-linux/cryptodev-linux/pull/36]
+Signed-off-by: Alexander Kanavin <[email protected]>
+
+---
+ tests/openssl_wrapper.c | 33 +++++++++++++++++++++++++++++++++
+ 1 file changed, 33 insertions(+)
+
+diff --git a/tests/openssl_wrapper.c b/tests/openssl_wrapper.c
+index 038c58f..dea2496 100644
+--- a/tests/openssl_wrapper.c
++++ b/tests/openssl_wrapper.c
+@@ -4,6 +4,7 @@
+ #include <openssl/aes.h>
+ #include <openssl/evp.h>
+ #include <openssl/hmac.h>
++#include <openssl/opensslv.h>
+
+ //#define DEBUG
+
+@@ -23,10 +24,17 @@ enum ctx_type {
+       ctx_type_md,
+ };
+
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
++union openssl_ctx {
++      HMAC_CTX *hmac;
++      EVP_MD_CTX *md;
++};
++#else
+ union openssl_ctx {
+       HMAC_CTX hmac;
+       EVP_MD_CTX md;
+ };
++#endif
+
+ struct ctx_mapping {
+       __u32 ses;
+@@ -63,6 +71,16 @@ static void remove_mapping(__u32 ses)
+       switch (mapping->type) {
+       case ctx_type_none:
+               break;
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
++      case ctx_type_hmac:
++              dbgp("%s: calling HMAC_CTX_free\n", __func__);
++              HMAC_CTX_free(mapping->ctx.hmac);
++              break;
++      case ctx_type_md:
++              dbgp("%s: calling EVP_MD_CTX_free\n", __func__);
++              EVP_MD_CTX_free(mapping->ctx.md);
++              break;
++#else
+       case ctx_type_hmac:
+               dbgp("%s: calling HMAC_CTX_cleanup\n", __func__);
+               HMAC_CTX_cleanup(&mapping->ctx.hmac);
+@@ -71,6 +89,7 @@ static void remove_mapping(__u32 ses)
+               dbgp("%s: calling EVP_MD_CTX_cleanup\n", __func__);
+               EVP_MD_CTX_cleanup(&mapping->ctx.md);
+               break;

meta/recipes-kernel/cryptodev/files/0001-Port-tests-to-openssl-1.1.patch line 73

Quoted 10 lines

meta/recipes-kernel/cryptodev/files/0001-Port-tests-to-openssl-1.1.patch new file +10 -0

++#endif
+       }
+       memset(mapping, 0, sizeof(*mapping));
+ }
+@@ -127,10 +146,17 @@ static int openssl_hmac(struct session_op *sess, struct crypt_op *cop)
+
+               mapping->ses = sess->ses;
+               mapping->type = ctx_type_hmac;
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
++              ctx = mapping->ctx.hmac;

Assigning the (uninitialised?) value of mapping->ctx.hmac to ctx here looks redundant?

Quoted 8 lines

meta/recipes-kernel/cryptodev/files/0001-Port-tests-to-openssl-1.1.patch new file +8 -0

++
++              dbgp("calling HMAC_CTX_new");
++              ctx = HMAC_CTX_new();
++#else
+               ctx = &mapping->ctx.hmac;
+
+               dbgp("calling HMAC_CTX_init");
+               HMAC_CTX_init(ctx);

meta/recipes-kernel/cryptodev/files/0001-Port-tests-to-openssl-1.1.patch line 91

Quoted 10 lines

meta/recipes-kernel/cryptodev/files/0001-Port-tests-to-openssl-1.1.patch new file +10 -0

++#endif
+               dbgp("calling HMAC_Init_ex");
+               if (!HMAC_Init_ex(ctx, sess->mackey, sess->mackeylen,
+                               sess_to_evp_md(sess), NULL)) {
+@@ -172,10 +198,17 @@ static int openssl_md(struct session_op *sess, struct crypt_op *cop)
+
+               mapping->ses = sess->ses;
+               mapping->type = ctx_type_md;
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
++              ctx = mapping->ctx.md;

And same comment here.

Quoted 20 lines

meta/recipes-kernel/cryptodev/files/0001-Port-tests-to-openssl-1.1.patch new file +12 -1

++
++              dbgp("calling EVP_MD_CTX_new");
++              ctx = EVP_MD_CTX_new();
++#else
+               ctx = &mapping->ctx.md;
+
+               dbgp("calling EVP_MD_CTX_init");
+               EVP_MD_CTX_init(ctx);
++#endif
+               dbgp("calling EVP_DigestInit");
+               EVP_DigestInit(ctx, sess_to_evp_md(sess));
+       }
--

2.7.4

--
_______________________________________________
Openembedded-core mailing list
[email protected]
http://lists.openembedded.org/mailman/listinfo/openembedded-core

But patching the components to use libssl10 might actually work (unlike
just changing DEPENDS to openssl10).

It's not only conflicting in build-time in RSS, but it will conflict on target as well. You either need to migrate all components included in image to 1.1 or all stay on 1.0.

Quoted 7 lines · Martin Jansa

But patching the components to use libssl10 might actually work (unlike
just changing DEPENDS to openssl10).

It's not only conflicting in build-time in RSS, but it will conflict on target as well. You either need to migrate all components included in image to 1.1 or all stay on 1.0.

That isn't quite the case. For OE-Core we have images using both 1.0 (openssh) and 1.1 installed together. Its true there are some issues if you try and parallel install both the -dev packages but normal target images are working.

We could probably "fix" the -dev images to an extent by making 1.1 replace 1.0 dev pieces.

The build time sysroot problem is harder unfortunately, I've ideas about things we might be able to do but haven't experimented as yet.

Cheers,

Richard
--
_______________________________________________
Openembedded-core mailing list
[email protected]
http://lists.openembedded.org/mailman/listinfo/openembedded-core

Quoted 15 lines · Richard Purdie

Quoted 7 lines · Martin Jansa

But patching the components to use libssl10 might actually work (unlike
just changing DEPENDS to openssl10).

It's not only conflicting in build-time in RSS, but it will conflict on target as well. You either need to migrate all components included in image to 1.1 or all stay on 1.0.

That isn't quite the case. For OE-Core we have images using both 1.0 (openssh) and 1.1 installed together. Its true there are some issues if you try and parallel install both the -dev packages but normal target images are working.

Quoted 6 lines

We could probably "fix" the -dev images to an extent by making 1.1 replace 1.0 dev pieces.

The build time sysroot problem is harder unfortunately, I've ideas about things we might be able to do but haven't experimented as yet.

If runtime conflicts are clear

I think we can install the headers into /usr/include/openssl10/ and dev libs into /usr/lib/openssl10
and provide a openssl10.pc file to we can use pkgconfig in packages

Quoted 17 lines · Khem Raj

Quoted 15 lines · Richard Purdie

Quoted 7 lines · Martin Jansa

But patching the components to use libssl10 might actually work (unlike
just changing DEPENDS to openssl10).

It's not only conflicting in build-time in RSS, but it will conflict on target as well. You either need to migrate all components included in image to 1.1 or all stay on 1.0.

That isn't quite the case. For OE-Core we have images using both 1.0 (openssh) and 1.1 installed together. Its true there are some issues if you try and parallel install both the -dev packages but normal target images are working.

Quoted 8 lines

Quoted 6 lines

We could probably "fix" the -dev images to an extent by making 1.1 replace 1.0 dev pieces.

The build time sysroot problem is harder unfortunately, I've ideas about things we might be able to do but haven't experimented as yet.

If runtime conflicts are clear

I don't think the runtime issues are clear.

Being able to install both versions of openssl on the target and have them be used by different applications is one case (already solved by different sonames).

But the builds that are failing in meta-oe are a different case - a single application is indirectly linked against both versions of openssl. Loading two versions of openssl into the same address space at runtime hasn't been solved... and may not be realistically solvable
- e.g. what happens if code in an app compiled against openssl 1.1 tries to share an openssl data type with code in a library compiled against openssl 1.0?

Quoted 3 lines

I think we can install the headers into /usr/include/openssl10/ and dev libs into /usr/lib/openssl10
and provide a openssl10.pc file to we can use pkgconfig in packages

--
_______________________________________________
Openembedded-core mailing list
[email protected]
http://lists.openembedded.org/mailman/listinfo/openembedded-core

https://wiki.debian.org/OpenSSL-1.1 says it will cause runtime bugs like segmentation faults or just misbehaving applications.

Quoted 42 lines · Andre McCurdy

Quoted 17 lines · Khem Raj

Quoted 15 lines · Richard Purdie

Quoted 7 lines · Martin Jansa

But patching the components to use libssl10 might actually work (unlike
just changing DEPENDS to openssl10).

It's not only conflicting in build-time in RSS, but it will conflict on target as well. You either need to migrate all components included in image to 1.1 or all stay on 1.0.

That isn't quite the case. For OE-Core we have images using both 1.0 (openssh) and 1.1 installed together. Its true there are some issues if you try and parallel install both the -dev packages but normal target images are working.

Quoted 8 lines

Quoted 6 lines

We could probably "fix" the -dev images to an extent by making 1.1 replace 1.0 dev pieces.

The build time sysroot problem is harder unfortunately, I've ideas about things we might be able to do but haven't experimented as yet.

If runtime conflicts are clear

I don't think the runtime issues are clear.

Being able to install both versions of openssl on the target and have them be used by different applications is one case (already solved by different sonames).

But the builds that are failing in meta-oe are a different case - a single application is indirectly linked against both versions of openssl. Loading two versions of openssl into the same address space at runtime hasn't been solved... and may not be realistically solvable
- e.g. what happens if code in an app compiled against openssl 1.1 tries to share an openssl data type with code in a library compiled against openssl 1.0?

Quoted 46 lines · Martin Jansa

https://wiki.debian.org/OpenSSL-1.1 says it will cause runtime bugs like segmentation faults or just misbehaving applications.

Quoted 42 lines · Andre McCurdy

Quoted 17 lines · Khem Raj

Quoted 15 lines · Richard Purdie

Quoted 7 lines · Martin Jansa

But patching the components to use libssl10 might actually work (unlike
just changing DEPENDS to openssl10).

It's not only conflicting in build-time in RSS, but it will conflict on target as well. You either need to migrate all components included in image to 1.1 or all stay on 1.0.

That isn't quite the case. For OE-Core we have images using both 1.0 (openssh) and 1.1 installed together. Its true there are some issues if you try and parallel install both the -dev packages but normal target images are working.

Quoted 8 lines

Quoted 6 lines

We could probably "fix" the -dev images to an extent by making 1.1 replace 1.0 dev pieces.

The build time sysroot problem is harder unfortunately, I've ideas about things we might be able to do but haven't experimented as yet.

If runtime conflicts are clear

I don't think the runtime issues are clear.

Being able to install both versions of openssl on the target and have them be used by different applications is one case (already solved by different sonames).

But the builds that are failing in meta-oe are a different case - a single application is indirectly linked against both versions of openssl. Loading two versions of openssl into the same address space at runtime hasn't been solved... and may not be realistically solvable
- e.g. what happens if code in an app compiled against openssl 1.1 tries to share an openssl data type with code in a library compiled against openssl 1.0?

Any further comments?

How are the meta-oe world builds looking now after the recent fixes? Are there still issues?

From: Alexander Kanavin <[email protected]>

I believe the time has come to do this: openssl 1.0 upstream support stops at the end of 2019, and we do not want a situation where a supported YP release contains an unsupported version of a critical security component.

Openssl 1.0 can still be utilized by depending on 'openssl10' recipe.

Signed-off-by Alexander Kanavin <[email protected]>

---

...

BBCLASSEXTEND = "native nativesdk"

meta/recipes-connectivity/openssl/openssl10_1.0.2p.bb renamed from meta/recipes-connectivity/openssl/openssl_1.0.2p.bb +5 -0

+PACKAGE_PREPROCESS_FUNCS += "openssl_package_preprocess"
+
+# openssl 1.0 development files and executable binaries clash with openssl 1.1
+# files when installed into target rootfs. So we don't put them into
+# packages, but they continue to be provided via target sysroot for