<div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr">Just FYI:<div><br></div><div>This won't work if someone uses only openssl10 in the image (a bit difficult to do with current master, but still some people have to do it), in case someone needs it as well, here is how Gentoo makes ca-certificate backwards compatible with old openssl:</div><div><a href="https://github.com/gentoo/gentoo/commit/03f9b674ca3315198c72849e8dd77583974759c2#diff-1801ddca78e57240592ef16b1c5262e7">https://github.com/gentoo/gentoo/commit/03f9b674ca3315198c72849e8dd77583974759c2#diff-1801ddca78e57240592ef16b1c5262e7</a><br></div><div>more details in:</div><div><a href="https://bugs.gentoo.org/653382">https://bugs.gentoo.org/653382</a><br></div><div><br></div><div>Basically using (good old) shell c_rehash implementation from separate recipe:</div><div><a href="https://github.com/gentoo/gentoo/blob/master/app-misc/c_rehash/c_rehash-1.7-r1.ebuild">https://github.com/gentoo/gentoo/blob/master/app-misc/c_rehash/c_rehash-1.7-r1.ebuild</a><br></div><div>instead of "openssl rehash" in update-ca-certificates script.</div><div><br></div><div>Cheers,</div></div></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Mar 19, 2019 at 1:41 AM Otavio Salvador <<a href="mailto:otavio@ossystems.com.br">otavio@ossystems.com.br</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">We had a c_rehash shell re-implementation being used for the native<br>
package however the ca-certificates now uses the openssl rehash<br>
internal application so there is no use for the c_rehash anymore.<br>
<br>
Signed-off-by: Otavio Salvador <<a href="mailto:otavio@ossystems.com.br" target="_blank">otavio@ossystems.com.br</a>><br>
---<br>
<br>
Changes in v3:<br>
- remove c_rehash completely<br>
- fix ca-certificates recipe comment<br>
<br>
Changes in v2:<br>
- updated commit log<br>
<br>
.../openssl/openssl/openssl-c_rehash.sh | 222 ------------------<br>
.../openssl/<a href="http://openssl_1.1.1a.bb" rel="noreferrer" target="_blank">openssl_1.1.1a.bb</a> | 13 +-<br>
.../<a href="http://ca-certificates_20190110.bb" rel="noreferrer" target="_blank">ca-certificates_20190110.bb</a> | 2 +-<br>
3 files changed, 2 insertions(+), 235 deletions(-)<br>
delete mode 100644 meta/recipes-connectivity/openssl/openssl/openssl-c_rehash.sh<br>
<br>
diff --git a/meta/recipes-connectivity/openssl/openssl/openssl-c_rehash.sh b/meta/recipes-connectivity/openssl/openssl/openssl-c_rehash.sh<br>
deleted file mode 100644<br>
index 6620fdcb53..0000000000<br>
--- a/meta/recipes-connectivity/openssl/openssl/openssl-c_rehash.sh<br>
+++ /dev/null<br>
@@ -1,222 +0,0 @@<br>
-#!/bin/sh<br>
-#<br>
-# Ben Secrest <<a href="mailto:blsecres@gmail.com" target="_blank">blsecres@gmail.com</a>><br>
-#<br>
-# sh c_rehash script, scan all files in a directory<br>
-# and add symbolic links to their hash values.<br>
-#<br>
-# based on the c_rehash perl script distributed with openssl<br>
-#<br>
-# LICENSE: See OpenSSL license<br>
-# ^^acceptable?^^<br>
-#<br>
-<br>
-# default certificate location<br>
-DIR=/etc/openssl<br>
-<br>
-# for filetype bitfield<br>
-IS_CERT=$(( 1 << 0 ))<br>
-IS_CRL=$(( 1 << 1 ))<br>
-<br>
-<br>
-# check to see if a file is a certificate file or a CRL file<br>
-# arguments:<br>
-# 1. the filename to be scanned<br>
-# returns:<br>
-# bitfield of file type; uses ${IS_CERT} and ${IS_CRL}<br>
-#<br>
-check_file()<br>
-{<br>
- local IS_TYPE=0<br>
-<br>
- # make IFS a newline so we can process grep output line by line<br>
- local OLDIFS=${IFS}<br>
- IFS=$( printf "\n" )<br>
-<br>
- # XXX: could be more efficient to have two 'grep -m' but is -m portable?<br>
- for LINE in $( grep '^-----BEGIN .*-----' ${1} )<br>
- do<br>
- if echo ${LINE} \<br>
- | grep -q -E '^-----BEGIN (X509 |TRUSTED )?CERTIFICATE-----'<br>
- then<br>
- IS_TYPE=$(( ${IS_TYPE} | ${IS_CERT} ))<br>
-<br>
- if [ $(( ${IS_TYPE} & ${IS_CRL} )) -ne 0 ]<br>
- then<br>
- break<br>
- fi<br>
- elif echo ${LINE} | grep -q '^-----BEGIN X509 CRL-----'<br>
- then<br>
- IS_TYPE=$(( ${IS_TYPE} | ${IS_CRL} ))<br>
-<br>
- if [ $(( ${IS_TYPE} & ${IS_CERT} )) -ne 0 ]<br>
- then<br>
- break<br>
- fi<br>
- fi<br>
- done<br>
-<br>
- # restore IFS<br>
- IFS=${OLDIFS}<br>
-<br>
- return ${IS_TYPE}<br>
-}<br>
-<br>
-<br>
-#<br>
-# use openssl to fingerprint a file<br>
-# arguments:<br>
-# 1. the filename to fingerprint<br>
-# 2. the method to use (x509, crl)<br>
-# returns:<br>
-# none<br>
-# assumptions:<br>
-# user will capture output from last stage of pipeline<br>
-#<br>
-fingerprint()<br>
-{<br>
- ${SSL_CMD} ${2} -fingerprint -noout -in ${1} | sed 's/^.*=//' | tr -d ':'<br>
-}<br>
-<br>
-<br>
-#<br>
-# link_hash - create links to certificate files<br>
-# arguments:<br>
-# 1. the filename to create a link for<br>
-# 2. the type of certificate being linked (x509, crl)<br>
-# returns:<br>
-# 0 on success, 1 otherwise<br>
-#<br>
-link_hash()<br>
-{<br>
- local FINGERPRINT=$( fingerprint ${1} ${2} )<br>
- local HASH=$( ${SSL_CMD} ${2} -hash -noout -in ${1} )<br>
- local SUFFIX=0<br>
- local LINKFILE=''<br>
- local TAG=''<br>
-<br>
- if [ ${2} = "crl" ]<br>
- then<br>
- TAG='r'<br>
- fi<br>
-<br>
- LINKFILE=${HASH}.${TAG}${SUFFIX}<br>
-<br>
- while [ -f ${LINKFILE} ]<br>
- do<br>
- if [ ${FINGERPRINT} = $( fingerprint ${LINKFILE} ${2} ) ]<br>
- then<br>
- echo "NOTE: Skipping duplicate file ${1}" >&2<br>
- return 1<br>
- fi <br>
-<br>
- SUFFIX=$(( ${SUFFIX} + 1 ))<br>
- LINKFILE=${HASH}.${TAG}${SUFFIX}<br>
- done<br>
-<br>
- echo "${3} => ${LINKFILE}"<br>
-<br>
- # assume any system with a POSIX shell will either support symlinks or<br>
- # do something to handle this gracefully<br>
- ln -s ${3} ${LINKFILE}<br>
-<br>
- return 0<br>
-}<br>
-<br>
-<br>
-# hash_dir create hash links in a given directory<br>
-hash_dir()<br>
-{<br>
- echo "Doing ${1}"<br>
-<br>
- cd ${1}<br>
-<br>
- ls -1 * 2>/dev/null | while read FILE<br>
- do<br>
- if echo ${FILE} | grep -q -E '^[[:xdigit:]]{8}\.r?[[:digit:]]+$' \<br>
- && [ -h "${FILE}" ]<br>
- then<br>
- rm ${FILE}<br>
- fi<br>
- done<br>
-<br>
- ls -1 *.pem *.cer *.crt *.crl 2>/dev/null | while read FILE<br>
- do<br>
- REAL_FILE=${FILE}<br>
- # if we run on build host then get to the real files in rootfs<br>
- if [ -n "${SYSROOT}" -a -h ${FILE} ]<br>
- then<br>
- FILE=$( readlink ${FILE} )<br>
- # check the symlink is absolute (or dangling in other word)<br>
- if [ "x/" = "x$( echo ${FILE} | cut -c1 -)" ]<br>
- then<br>
- REAL_FILE=${SYSROOT}/${FILE}<br>
- fi<br>
- fi<br>
-<br>
- check_file ${REAL_FILE}<br>
- local FILE_TYPE=${?}<br>
- local TYPE_STR=''<br>
-<br>
- if [ $(( ${FILE_TYPE} & ${IS_CERT} )) -ne 0 ]<br>
- then<br>
- TYPE_STR='x509'<br>
- elif [ $(( ${FILE_TYPE} & ${IS_CRL} )) -ne 0 ]<br>
- then<br>
- TYPE_STR='crl'<br>
- else<br>
- echo "NOTE: ${FILE} does not contain a certificate or CRL: skipping" >&2<br>
- continue<br>
- fi<br>
-<br>
- link_hash ${REAL_FILE} ${TYPE_STR} ${FILE}<br>
- done<br>
-}<br>
-<br>
-<br>
-# choose the name of an ssl application<br>
-if [ -n "${OPENSSL}" ]<br>
-then<br>
- SSL_CMD=$(which ${OPENSSL} 2>/dev/null)<br>
-else<br>
- SSL_CMD=/usr/bin/openssl<br>
- OPENSSL=${SSL_CMD}<br>
- export OPENSSL<br>
-fi<br>
-<br>
-# fix paths<br>
-PATH=${PATH}:${DIR}/bin<br>
-export PATH<br>
-<br>
-# confirm existance/executability of ssl command<br>
-if ! [ -x ${SSL_CMD} ]<br>
-then<br>
- echo "${0}: rehashing skipped ('openssl' program not available)" >&2<br>
- exit 0<br>
-fi<br>
-<br>
-# determine which directories to process<br>
-old_IFS=$IFS<br>
-if [ ${#} -gt 0 ]<br>
-then<br>
- IFS=':'<br>
- DIRLIST=${*}<br>
-elif [ -n "${SSL_CERT_DIR}" ]<br>
-then<br>
- DIRLIST=$SSL_CERT_DIR<br>
-else<br>
- DIRLIST=${DIR}/certs<br>
-fi<br>
-<br>
-IFS=':'<br>
-<br>
-# process directories<br>
-for CERT_DIR in ${DIRLIST}<br>
-do<br>
- if [ -d ${CERT_DIR} -a -w ${CERT_DIR} ]<br>
- then<br>
- IFS=$old_IFS<br>
- hash_dir ${CERT_DIR}<br>
- IFS=':'<br>
- fi<br>
-done<br>
diff --git a/meta/recipes-connectivity/openssl/<a href="http://openssl_1.1.1a.bb" rel="noreferrer" target="_blank">openssl_1.1.1a.bb</a> b/meta/recipes-connectivity/openssl/<a href="http://openssl_1.1.1a.bb" rel="noreferrer" target="_blank">openssl_1.1.1a.bb</a><br>
index 4a626a4fcd..d03a225df8 100644<br>
--- a/meta/recipes-connectivity/openssl/<a href="http://openssl_1.1.1a.bb" rel="noreferrer" target="_blank">openssl_1.1.1a.bb</a><br>
+++ b/meta/recipes-connectivity/openssl/<a href="http://openssl_1.1.1a.bb" rel="noreferrer" target="_blank">openssl_1.1.1a.bb</a><br>
@@ -13,7 +13,6 @@ DEPENDS = "hostperl-runtime-native"<br>
<br>
SRC_URI = "<a href="http://www.openssl.org/source/openssl-$%7BPV%7D.tar.gz" rel="noreferrer" target="_blank">http://www.openssl.org/source/openssl-${PV}.tar.gz</a> \<br>
file://run-ptest \<br>
- file://openssl-c_rehash.sh \<br>
file://0001-skip-test_symbol_presence.patch \<br>
file://0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch \<br>
file://afalg.patch \<br>
@@ -149,12 +148,6 @@ do_install_append_class-native () {<br>
SSL_CERT_DIR=${libdir}/ssl-1.1/certs \<br>
SSL_CERT_FILE=${libdir}/ssl-1.1/cert.pem \<br>
OPENSSL_ENGINES=${libdir}/ssl-1.1/engines<br>
-<br>
- # Install a custom version of c_rehash that can handle sysroots properly.<br>
- # This version is used for example when installing ca-certificates during<br>
- # image creation.<br>
- install -Dm 0755 ${WORKDIR}/openssl-c_rehash.sh ${D}${bindir}/c_rehash<br>
- sed -i -e 's,/etc/openssl,${sysconfdir}/ssl,g' ${D}${bindir}/c_rehash<br>
}<br>
<br>
do_install_append_class-nativesdk () {<br>
@@ -196,7 +189,7 @@ FILES_libcrypto = "${libdir}/libcrypto${SOLIBS}"<br>
FILES_libssl = "${libdir}/libssl${SOLIBS}"<br>
FILES_openssl-conf = "${sysconfdir}/ssl/openssl.cnf"<br>
FILES_${PN}-engines = "${libdir}/engines-1.1"<br>
-FILES_${PN}-misc = "${libdir}/ssl-1.1/misc ${bindir}/c_rehash"<br>
+FILES_${PN}-misc = "${libdir}/ssl-1.1/misc"<br>
FILES_${PN} =+ "${libdir}/ssl-1.1/*"<br>
FILES_${PN}_append_class-nativesdk = " ${SDKPATHNATIVE}/environment-setup.d/openssl.sh"<br>
<br>
@@ -211,7 +204,3 @@ RREPLACES_openssl-conf = "openssl10-conf"<br>
RCONFLICTS_openssl-conf = "openssl10-conf"<br>
<br>
BBCLASSEXTEND = "native nativesdk"<br>
-<br>
-inherit multilib_script<br>
-<br>
-MULTILIB_SCRIPTS = "${PN}-bin:${bindir}/c_rehash"<br>
diff --git a/meta/recipes-support/ca-certificates/<a href="http://ca-certificates_20190110.bb" rel="noreferrer" target="_blank">ca-certificates_20190110.bb</a> b/meta/recipes-support/ca-certificates/<a href="http://ca-certificates_20190110.bb" rel="noreferrer" target="_blank">ca-certificates_20190110.bb</a><br>
index b9f57900c8..4c0425302f 100644<br>
--- a/meta/recipes-support/ca-certificates/<a href="http://ca-certificates_20190110.bb" rel="noreferrer" target="_blank">ca-certificates_20190110.bb</a><br>
+++ b/meta/recipes-support/ca-certificates/<a href="http://ca-certificates_20190110.bb" rel="noreferrer" target="_blank">ca-certificates_20190110.bb</a><br>
@@ -11,7 +11,7 @@ LIC_FILES_CHKSUM = "file://debian/copyright;md5=aeb420429b1659507e0a5a1b123e8308<br>
DEPENDS = ""<br>
DEPENDS_class-native = "openssl-native"<br>
DEPENDS_class-nativesdk = "openssl-native"<br>
-# Need c_rehash from openssl and run-parts from debianutils<br>
+# Need rehash from openssl and run-parts from debianutils<br>
PACKAGE_WRITE_DEPS += "openssl-native debianutils-native"<br>
<br>
SRCREV = "c28799b138b044c963d24c4a69659b6e5486e3be"<br>
-- <br>
2.21.0<br>
<br>
-- <br>
_______________________________________________<br>
Openembedded-core mailing list<br>
<a href="mailto:Openembedded-core@lists.openembedded.org" target="_blank">Openembedded-core@lists.openembedded.org</a><br>
<a href="http://lists.openembedded.org/mailman/listinfo/openembedded-core" rel="noreferrer" target="_blank">http://lists.openembedded.org/mailman/listinfo/openembedded-core</a><br>
</blockquote></div>