<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">On 20 April 2017 at 16:32, Jussi Kukkonen <span dir="ltr"><<a href="mailto:jussi.kukkonen@intel.com" target="_blank">jussi.kukkonen@intel.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Commit 7933fbbc637 "Security fix Drown via 1.0.2g update" included<br>
a version-script change from Debian that was an ABI change. It did<br>
not include the soname change that Debian did so we have been calling<br>
our ABI 1.0.0 but it really matches what others call 1.0.2.<br></blockquote><div><br></div><div>Just so it's clear: the new ABI was in krogoth and morty already with 1.0.0 soname. Not sure which option is least bad here.</div><div><br></div><div> Jussi</div><div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
Bump SONAME to match the ABI. In practice this changes both libcrypto<br>
and libssl sonames from 1.0.0 to 1.0.2.<br>
<br>
For background: Upstream does not do sonames so these are set by<br>
distros. In this case the ABI changes based on a build time<br>
configuration! Debian took the ABI changing configuration and bumped<br>
soname but e.g. Ubuntu kept the deprecated API and just made it not<br>
work, keeping soname. So both have same version of openssl but support<br>
different ABI (and expose different SONAME).<br>
<br>
Fixes [YOCTO #11396].<br>
<br>
Thanks to Alexander Larsson et al for detective work.<br>
<br>
Signed-off-by: Jussi Kukkonen <<a href="mailto:jussi.kukkonen@intel.com">jussi.kukkonen@intel.com</a>><br>
---<br>
.../openssl/openssl/debian1.0.<wbr>2/soname.patch | 13 +++++++++++++<br>
meta/recipes-connectivity/<wbr>openssl/<a href="http://openssl_1.0.2k.bb" rel="noreferrer" target="_blank">openssl_1.0.2k.bb</a> | 1 +<br>
2 files changed, 14 insertions(+)<br>
create mode 100644 meta/recipes-connectivity/<wbr>openssl/openssl/debian1.0.2/<wbr>soname.patch<br>
<br>
diff --git a/meta/recipes-connectivity/<wbr>openssl/openssl/debian1.0.2/<wbr>soname.patch b/meta/recipes-connectivity/<wbr>openssl/openssl/debian1.0.2/<wbr>soname.patch<br>
new file mode 100644<br>
index 0000000..f9cdfec<br>
--- /dev/null<br>
+++ b/meta/recipes-connectivity/<wbr>openssl/openssl/debian1.0.2/<wbr>soname.patch<br>
@@ -0,0 +1,13 @@<br>
+Index: openssl-1.0.2d/crypto/<wbr>opensslv.h<br>
+=============================<wbr>==============================<wbr>========<br>
+--- openssl-1.0.2d.orig/crypto/<wbr>opensslv.h<br>
++++ openssl-1.0.2d/crypto/<wbr>opensslv.h<br>
+@@ -88,7 +88,7 @@ extern "C" {<br>
+ * should only keep the versions that are binary compatible with the current.<br>
+ */<br>
+ # define SHLIB_VERSION_HISTORY ""<br>
+-# define SHLIB_VERSION_NUMBER "1.0.0"<br>
++# define SHLIB_VERSION_NUMBER "1.0.2"<br>
+<br>
+<br>
+ #ifdef __cplusplus<br>
diff --git a/meta/recipes-connectivity/<wbr>openssl/<a href="http://openssl_1.0.2k.bb" rel="noreferrer" target="_blank">openssl_1.0.2k.bb</a> b/meta/recipes-connectivity/<wbr>openssl/<a href="http://openssl_1.0.2k.bb" rel="noreferrer" target="_blank">openssl_1.0.2k.bb</a><br>
index 1c104142..83d1a50 100644<br>
--- a/meta/recipes-connectivity/<wbr>openssl/<a href="http://openssl_1.0.2k.bb" rel="noreferrer" target="_blank">openssl_1.0.2k.bb</a><br>
+++ b/meta/recipes-connectivity/<wbr>openssl/<a href="http://openssl_1.0.2k.bb" rel="noreferrer" target="_blank">openssl_1.0.2k.bb</a><br>
@@ -30,6 +30,7 @@ SRC_URI += "file://<a href="http://find.pl" rel="noreferrer" target="_blank">find.pl</a>;subdir=${BP}/<wbr>util/ \<br>
file://debian/no-symbolic.<wbr>patch \<br>
file://debian/pic.patch \<br>
file://debian1.0.2/version-<wbr>script.patch \<br>
+ file://debian1.0.2/soname.<wbr>patch \<br>
file://openssl_fix_for_x32.<wbr>patch \<br>
file://fix-cipher-des-ede3-<wbr>cfb1.patch \<br>
file://openssl-avoid-NULL-<wbr>pointer-dereference-in-EVP_<wbr>DigestInit_ex.patch \<br>
<span class="HOEnZb"><font color="#888888">--<br>
2.1.4<br>
<br>
</font></span></blockquote></div><br></div></div>