<div dir="ltr"><div>Hi Andre,</div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, 20 Nov 2019 at 19:27, Andre McCurdy <<a href="mailto:armccurdy@gmail.com">armccurdy@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On Wed, Nov 20, 2019 at 11:09 AM Mark Hatle<br>
<<a href="mailto:mark.hatle@kernel.crashing.org" target="_blank">mark.hatle@kernel.crashing.org</a>> wrote:<br>
> On 11/20/19 1:06 PM, Ryan Harkin wrote:<br>
> > On Wed, 20 Nov 2019 at 18:36, Mark Hatle <<a href="mailto:mark.hatle@kernel.crashing.org" target="_blank">mark.hatle@kernel.crashing.org</a><br>
> > <mailto:<a href="mailto:mark.hatle@kernel.crashing.org" target="_blank">mark.hatle@kernel.crashing.org</a>>> wrote:<br>
> ><br>
> > You know that 1.0.2 and 1.1 APIs are not compatible? So you will need to update<br>
> > everything that needs OpenSSL to understand the new API.<br>
> ><br>
> ><br>
> > So far, we're only using it in a shell script to sign an image and later verify<br>
> > the image, so I've assumed, perhaps naively, that the API changes won't matter...<br>
><br>
> Correct, but there may be other components of the system that could be using the<br>
> API that you are unaware of. On a system as old as Sumo, you will need to take<br>
> precautions to ensure that ONLY the 1.1x version is being used. (There may be<br>
> an openssl10 for compatibility that will need to be blacklisted.)<br>
><br>
> > For CVE fixes, typically you would patch 1.0.2p, or update to the latest<br>
> > (1.0.2t) as you go. (If you have an OSV, this should be part of the services<br>
> > that they offer you.)<br>
> ><br>
> ><br>
> > In my opinion, 1.0.2 will be around for at least another 4-5 years due to the<br>
> > number of people actively using it in the world. Until 1.1/3.0 (won't be a 2.0<br>
> > from what I read) exists and has a FIPS-140-2 support available -- people will<br>
> > continue to use 1.0.2 and maintain it as necessary for security.<br>
> ><br>
> > As an FYI: <a href="http://git.yoctoproject.org/cgit/cgit.cgi/meta-openssl102/" rel="noreferrer" target="_blank">http://git.yoctoproject.org/cgit/cgit.cgi/meta-openssl102/</a><br>
> ><br>
> > This version is for thud, warrior, zeus and master. It is intended to be<br>
> > maintained until either 1.0.2 is no longer maintainable -- or the FIPS-140-2<br>
> > needs have been met by OpenSSL.<br>
> ><br>
> ><br>
> > Great, that looks like a better option anyway, assuming it has the latest fixes<br>
> > I need, and doesn't give me the same build problem. Thanks for pointing it out.<br>
> > I'll give it a go.<br>
><br>
> It's better to work with the Sumo version for your needs. I just posted that as<br>
> an example of openssl 1.0.2 being needed still by others, even as oe-core/Yocto<br>
> Project have changed their defaults.<br>
<br>
If you want an up to date openssl 1.0.2 recipe which is compatible<br>
with Sumo, you can find one here:<br>
<br>
<a href="https://github.com/armcc/meta-plumewifi" rel="noreferrer" target="_blank">https://github.com/armcc/meta-plumewifi</a><br>
<br>
I'm only actively testing it with OE 1.6 (Daisy) and OE 2.7 (Warrior)<br>
but it should work for all versions in between (and if it doesn't I'll<br>
accept patches or try to fix it).<br></blockquote><div><br></div><div>Thanks! It looks similar to the tree Mark Hatle pointed out to me. Two diffs jump out:</div><div><br></div><div>- Your repo adds the RPROVIDES for openssl-bin to "Be compatible with the openssl 1.1.x recipe".</div><div>- Mark's repo has two extra patches:</div><div> file://0001-Fix-BN_LLONG-breakage.patch \<br> file://0001-Fix-DES_LONG-breakage.patch \</div><div><br></div><div>Regards,</div><div>Ryan.</div></div></div>