<div dir="ltr">Hi,<div><br></div><div>I'd say if you start looking at CVE/security issues, I think best option is to update the whole thing as any breach should be fixed.</div><div>As you are working on NXP product, updating Yocto version should be quite straightforward, by replacing krogoth branch to rocko.</div><div>You can watch this presentation <a href="https://www.youtube.com/watch?v=F5R8VXnfwYw">https://www.youtube.com/watch?v=F5R8VXnfwYw</a> that indroduces a particular workflow t<span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:small;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">o ease version migrations.</span><br></div><div><br></div><div>Best regards,</div><div>Vincent</div></div><div class="gmail_extra"><br><div class="gmail_quote">2018-03-23 20:53 GMT+01:00 Ryan Pabis (pabisr) <span dir="ltr"><<a href="mailto:pabisr@cisco.com" target="_blank">pabisr@cisco.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="white" lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="m_1366815990309656769WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">All,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">I’m working on a bundled package from NXP that’s based on Yocto Krogroth (so 2015 ish). But now I need to update openssl from 1.0.2d to 1.0.2n to fix multiple CVE vulnerabilities. However, this is proving
to be quite difficult. I’ve been able to upgrade curl, expat, python, etc. by adding the new component to my layer and then updating the layer.conf file. But it appears openssl is different.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">If I try the same approach with openssl the first thing that goes wrong is the <a href="http://openssl_1.0.2n.bb" target="_blank">openssl_1.0.2n.bb</a> file complains about the python function .filter not being supported as well as hostperl-runtime-native not
being found. So, I fix those by reverting back to .contains and changing to perl-native-runtime. That seems to solve the .bb problem. However, then I get an rpm error. Which I fix by upgrading to 4.14.1. However, now I’m stuck with an ‘ar’ error that
I can’t figure out. <u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">So, my question is A) Is this the right approach or should I be updating the entire openembedded layer (if so are there instructions anywhere on how to do that?) and B). If my approach is ok what is causing
the ‘ar’ error since this built previously with openssl 1.0.2d?<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Here is snippet of the error.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| gcc -I.. -I../.. -I../modes -I../asn1 -I../evp -I../../include -fPIC -DOPENSSL_PIC -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DHAVE_CRYPTODEV -DUSE_CRYPTODEV_DIGESTS
-DL_ENDIAN -DTERMIO -isystem/home/pabisr/inode/<wbr>build/tmp/sysroots/x86_64-<wbr>linux/usr/include -O2 -pipe -Wall -Wa,--noexecstack -DHAVE_CRYPTODEV -DUSE_CRYPTODEV_DIGESTS -fPIC -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m
-DRC4_ASM -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -isystem/home/pabisr/inode/<wbr>build/tmp/sysroots/x86_64-<wbr>linux/usr/include -c -o obj_xref.o obj_xref.c<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif;color:red">| ar ../../libcrypto.a o_names.o obj_dat.o obj_lib.o obj_err.o obj_xref.o<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| ar: invalid option -- '.'<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| Usage: ar [emulation options] [-]{dmpqrstx}[<wbr>abcDfilMNoPsSTuvV] [--plugin <name>] [member-name] [count] archive-file file...<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| ar -M [<mri-script]<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| commands:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| d - delete file(s) from the archive<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| m[ab] - move file(s) in the archive<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| p - print file(s) found in the archive<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| q[f] - quick append file(s) to the archive<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| r[ab][f][u] - replace existing or insert new file(s) into the archive<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| s - act as ranlib<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| t - display contents of archive<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| x[o] - extract file(s) from the archive<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| command specific modifiers:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| [a] - put file(s) after [member-name]<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| [b] - put file(s) before [member-name] (same as [i])<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| [D] - use zero for timestamps and uids/gids (default)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| [U] - use actual timestamps and uids/gids<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| [N] - use instance [count] of name<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| [f] - truncate inserted file names<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| [P] - use full path names when matching<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| [o] - preserve original dates<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| [u] - only replace files that are newer than current archive contents<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| generic modifiers:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| [c] - do not warn if the library had to be created<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| [s] - create an archive index (cf. ranlib)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| [S] - do not build a symbol table<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| [T] - make a thin archive<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| [v] - be verbose<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| [V] - display the version number<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| @<file> - read options from <file><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| --target=BFDNAME - specify the target object format as BFDNAME<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| optional:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| --plugin <p> - load the specified plugin<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| emulation options:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| No emulation specific options<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| ar: supported targets: elf64-x86-64 elf32-i386 elf32-iamcu elf32-x86-64 a.out-i386-linux pei-i386 pei-x86-64 elf64-l1om elf64-k1om elf64-little elf64-big elf32-little elf32-big
pe-x86-64 pe-bigobj-x86-64 pe-i386 plugin srec symbolsrec verilog tekhex binary ihex<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| Makefile:37: recipe for target 'lib' failed<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| make[2]: *** [lib] Error 1<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| make[2]: Leaving directory '/home/pabisr/inode/build/tmp/<wbr>work/x86_64-linux/openssl-<wbr>native/1.0.2n-r0/openssl-1.0.<wbr>2n/crypto/objects'<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| Makefile:88: recipe for target 'subdirs' failed<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| make[1]: *** [subdirs] Error 1<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| make[1]: Leaving directory '/home/pabisr/inode/build/tmp/<wbr>work/x86_64-linux/openssl-<wbr>native/1.0.2n-r0/openssl-1.0.<wbr>2n/crypto'<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| Makefile:288: recipe for target 'build_crypto' failed<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| make: *** [build_crypto] Error 1<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| WARNING: exit code 1 from a shell command.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| ERROR: oe_runmake failed<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">| ERROR: Function failed: do_compile (log file is located at /home/pabisr/inode/build/tmp/<wbr>work/x86_64-linux/openssl-<wbr>native/1.0.2n-r0/temp/log.do_<wbr>compile.102235)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">ERROR: Task 87 (virtual:native:/home/pabisr/<wbr>inode/sources/meta-inode-eval/<wbr>recipes-connectivity/openssl/<a href="http://openssl_1.0.2n.bb" target="_blank">o<wbr>penssl_1.0.2n.bb</a>, do_compile) failed with exit code '1'<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">NOTE: Tasks Summary: Attempted 240 tasks of which 231 didn't need to be rerun and 1 failed.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">Waiting for 0 running tasks to finish:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">Summary: 1 task failed:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif"> virtual:native:/home/pabisr/<wbr>inode/sources/meta-inode-eval/<wbr>recipes-connectivity/openssl/<a href="http://openssl_1.0.2n.bb" target="_blank">o<wbr>penssl_1.0.2n.bb</a>, do_compile<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">Summary: There was 1 WARNING message shown.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New",serif">Summary: There were 2 ERROR messages shown, returning a non-zero exit code.<u></u><u></u></span></p>
</div>
</div>
<br>--<br>
______________________________<wbr>_________________<br>
Openembedded-core mailing list<br>
<a href="mailto:Openembedded-core@lists.openembedded.org">Openembedded-core@lists.<wbr>openembedded.org</a><br>
<a href="http://lists.openembedded.org/mailman/listinfo/openembedded-core" rel="noreferrer" target="_blank">http://lists.openembedded.org/<wbr>mailman/listinfo/openembedded-<wbr>core</a><br>
<br></blockquote></div><br></div>