<div dir="ltr"><div dir="ltr"><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, 20 Nov 2019 at 21:29, Ryan Harkin <<a href="mailto:ryan.harkin@linaro.org">ryan.harkin@linaro.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div dir="ltr"><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, 20 Nov 2019 at 19:09, Mark Hatle <<a href="mailto:mark.hatle@kernel.crashing.org" target="_blank">mark.hatle@kernel.crashing.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><br>
<br>
On 11/20/19 1:06 PM, Ryan Harkin wrote:<br>
> <br>
> <br>
> On Wed, 20 Nov 2019 at 18:36, Mark Hatle <<a href="mailto:mark.hatle@kernel.crashing.org" target="_blank">mark.hatle@kernel.crashing.org</a><br>
> <mailto:<a href="mailto:mark.hatle@kernel.crashing.org" target="_blank">mark.hatle@kernel.crashing.org</a>>> wrote:<br>
> <br>
> <br>
> <br>
> On 11/20/19 12:18 PM, Ryan Harkin wrote:<br>
> > Hi all,<br>
> ><br>
> > I'm struggling with backporting OpenSSL to my Sumo build [1], so wondered if<br>
> > anyone else had done something similar with success.<br>
> ><br>
> > I copied "meta/recipes-connectivity/openssl" from Poky master branch [2]<br>
> into my<br>
> > own layer [3]. It didn't pick up, so I discovered I needed to add<br>
> > a PREFERRED_VERSION, eg:<br>
> ><br>
> > +PREFERRED_VERSION_openssl ?= "1.1.%"<br>
> > +PREFERRED_VERSION_openssl-native ?= "1.1.%"<br>
> > +PREFERRED_VERSION_nativesdk-openssl ?= "1.1.%"<br>
> ><br>
> > Now it builds fine. However, I no longer have /usr/bin/openssl in my disk<br>
> image.<br>
> ><br>
> > It doesn't appear in FILES_${PN}, and adding it to the recipes doesn't seem to<br>
> > make any difference.<br>
> ><br>
> > What am I missing?<br>
> ><br>
> > Thanks,<br>
> > Ryan.<br>
> ><br>
> > [1] I'm looking for CVE fixes, 1.0.2p has a lot of CVEs.<br>
> <br>
> You know that 1.0.2 and 1.1 APIs are not compatible? So you will need to update<br>
> everything that needs OpenSSL to understand the new API.<br>
> <br>
> <br>
> So far, we're only using it in a shell script to sign an image and later verify<br>
> the image, so I've assumed, perhaps naively, that the API changes won't matter...<br>
<br>
Correct, but there may be other components of the system that could be using the<br>
API that you are unaware of. On a system as old as Sumo, you will need to take<br>
precautions to ensure that ONLY the 1.1x version is being used. (There may be<br>
an openssl10 for compatibility that will need to be blacklisted.)<br></blockquote><div><br></div><div>Good point. I'll check on it once I get it to work.</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<br>
> <br>
> For CVE fixes, typically you would patch 1.0.2p, or update to the latest<br>
> (1.0.2t) as you go. (If you have an OSV, this should be part of the services<br>
> that they offer you.) <br>
> <br>
> <br>
> In my opinion, 1.0.2 will be around for at least another 4-5 years due to the<br>
> number of people actively using it in the world. Until 1.1/3.0 (won't be a 2.0<br>
> from what I read) exists and has a FIPS-140-2 support available -- people will<br>
> continue to use 1.0.2 and maintain it as necessary for security.<br>
> <br>
> As an FYI: <a href="http://git.yoctoproject.org/cgit/cgit.cgi/meta-openssl102/" rel="noreferrer" target="_blank">http://git.yoctoproject.org/cgit/cgit.cgi/meta-openssl102/</a><br>
> <br>
> This version is for thud, warrior, zeus and master. It is intended to be<br>
> maintained until either 1.0.2 is no longer maintainable -- or the FIPS-140-2<br>
> needs have been met by OpenSSL.<br>
> <br>
> <br>
> Great, that looks like a better option anyway, assuming it has the latest fixes<br>
> I need, and doesn't give me the same build problem. Thanks for pointing it out.<br>
> I'll give it a go.<br>
<br>
It's better to work with the Sumo version for your needs. I just posted that as<br>
an example of openssl 1.0.2 being needed still by others, even as oe-core/Yocto<br>
Project have changed their defaults.<br></blockquote><div><br></div>I pulled the whole openssl dir from your repo, added the layer.conf changes to my layer.conf and rebuilt openssl and my image.<br><br>Unfortunately, I still have no /usr/bin/openssl in my disk image. So I've added the RPROVIDES from Andre's in a vain attempt to get it to work:<br><br>RPROVIDES_${PN} += "openssl-bin"</div><div class="gmail_quote"><br>... although I'm not hopeful it'll do the trick...</div></div></blockquote><div><br></div><div>It didn't work. Once thing that's puzzling me: where is the package "openssl-bin"? I can only find references to it, but no package.</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div class="gmail_quote"><br><div></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<br>
--Mark<br>
<br>
> Thanks,<br>
> Ryan.<br>
> <br>
> <br>
> <br>
> --Mark<br>
> <br>
> > [2] <a href="http://git.yoctoproject.org/git/poky" rel="noreferrer" target="_blank">http://git.yoctoproject.org/git/poky</a><br>
> > I'm at SHA a616ffebdc, so I copied <a href="http://openssl_1.1.1d.bb" rel="noreferrer" target="_blank">openssl_1.1.1d.bb</a><br>
> <<a href="http://openssl_1.1.1d.bb" rel="noreferrer" target="_blank">http://openssl_1.1.1d.bb</a>> <<a href="http://openssl_1.1.1d.bb" rel="noreferrer" target="_blank">http://openssl_1.1.1d.bb</a>><br>
> > and all the other files in the directory.<br>
> ><br>
> > [3] I have a clone of Linaro's meta-backports. I'm trying to generate a<br>
> patch to<br>
> > submit for review there.<br>
> > <a href="https://git.linaro.org/openembedded/meta-backports.git" rel="noreferrer" target="_blank">https://git.linaro.org/openembedded/meta-backports.git</a><br>
> ><br>
> <br>
</blockquote></div></div>
</blockquote></div></div>