<div dir="ltr"><div dir="ltr"><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, 20 Nov 2019 at 18:36, Mark Hatle <<a href="mailto:mark.hatle@kernel.crashing.org">mark.hatle@kernel.crashing.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><br>
<br>
On 11/20/19 12:18 PM, Ryan Harkin wrote:<br>
> Hi all,<br>
> <br>
> I'm struggling with backporting OpenSSL to my Sumo build [1], so wondered if<br>
> anyone else had done something similar with success.<br>
> <br>
> I copied "meta/recipes-connectivity/openssl" from Poky master branch [2] into my<br>
> own layer [3]. It didn't pick up, so I discovered I needed to add<br>
> a PREFERRED_VERSION, eg:<br>
> <br>
> +PREFERRED_VERSION_openssl ?= "1.1.%"<br>
> +PREFERRED_VERSION_openssl-native ?= "1.1.%"<br>
> +PREFERRED_VERSION_nativesdk-openssl ?= "1.1.%"<br>
> <br>
> Now it builds fine. However, I no longer have /usr/bin/openssl in my disk image.<br>
> <br>
> It doesn't appear in FILES_${PN}, and adding it to the recipes doesn't seem to<br>
> make any difference.<br>
> <br>
> What am I missing?<br>
> <br>
> Thanks,<br>
> Ryan.<br>
> <br>
> [1] I'm looking for CVE fixes, 1.0.2p has a lot of CVEs.<br>
<br>
You know that 1.0.2 and 1.1 APIs are not compatible? So you will need to update<br>
everything that needs OpenSSL to understand the new API.<br></blockquote><div><br></div><div>So far, we're only using it in a shell script to sign an image and later verify the image, so I've assumed, perhaps naively, that the API changes won't matter...</div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<br>
For CVE fixes, typically you would patch 1.0.2p, or update to the latest<br>
(1.0.2t) as you go. (If you have an OSV, this should be part of the services<br>
that they offer you.) </blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<br>
In my opinion, 1.0.2 will be around for at least another 4-5 years due to the<br>
number of people actively using it in the world. Until 1.1/3.0 (won't be a 2.0<br>
from what I read) exists and has a FIPS-140-2 support available -- people will<br>
continue to use 1.0.2 and maintain it as necessary for security.<br>
<br>
As an FYI: <a href="http://git.yoctoproject.org/cgit/cgit.cgi/meta-openssl102/" rel="noreferrer" target="_blank">http://git.yoctoproject.org/cgit/cgit.cgi/meta-openssl102/</a><br>
<br>
This version is for thud, warrior, zeus and master. It is intended to be<br>
maintained until either 1.0.2 is no longer maintainable -- or the FIPS-140-2<br>
needs have been met by OpenSSL.<br></blockquote><div><br></div><div>Great, that looks like a better option anyway, assuming it has the latest fixes I need, and doesn't give me the same build problem. Thanks for pointing it out. I'll give it a go.</div><div><br></div><div>Thanks,</div><div>Ryan.</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<br>
--Mark<br>
<br>
> [2] <a href="http://git.yoctoproject.org/git/poky" rel="noreferrer" target="_blank">http://git.yoctoproject.org/git/poky</a><br>
> I'm at SHA a616ffebdc, so I copied <a href="http://openssl_1.1.1d.bb" rel="noreferrer" target="_blank">openssl_1.1.1d.bb</a> <<a href="http://openssl_1.1.1d.bb" rel="noreferrer" target="_blank">http://openssl_1.1.1d.bb</a>><br>
> and all the other files in the directory.<br>
> <br>
> [3] I have a clone of Linaro's meta-backports. I'm trying to generate a patch to<br>
> submit for review there.<br>
> <a href="https://git.linaro.org/openembedded/meta-backports.git" rel="noreferrer" target="_blank">https://git.linaro.org/openembedded/meta-backports.git</a><br>
> <br>
</blockquote></div></div>