summaryrefslogtreecommitdiff
path: root/meta/recipes-connectivity/openssl
AgeCommit message (Collapse)AuthorFiles
2016-07-08meta: update patch metadataRoss Burton3
Enforce the correct tag names across all of oe-core for consistency. Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-07-01openssl: prevent warnings from openssl-c_rehash.shJoshua Lock1
The openssl-c_rehash.sh script reports duplicate files and files which don't contain a certificate or CRL by echoing a WARNING to stdout. This warning gets picked up by the log checker during rootfs and results in several warnings getting reported to the console during an image build. To prevent the log from being overrun by warnings related to certificates change these messages in openssl-c_rehash.sh to be prefixed with NOTE not WARNING. Signed-off-by: Joshua Lock <joshua.g.lock@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-06-01openssl: fix the dangling libcrypto.a symlinkMaxin B. John1
Update libcrypto.a symlink to the proper location. [YOCTO #9523] Signed-off-by: Maxin B. John <maxin.john@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-25openssl: Ensure SSL certificates are stored on sysconfdirOtavio Salvador1
Debian and other generic distributions has moved the certificates for sysconfdir (/etc/ssl) and made the libdir content to link for it. This provides several advantages specially for read-only rootfs. Another benefit is that it ensures foreign implementations (e.g: BoringSSL, from Chromium, when running with OpenSSL backend for the certificates) to find the content correctly. Signed-off-by: Otavio Salvador <otavio@ossystems.com.br> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-25openssl: Add Shell-Script based c_rehash utilityOtavio Salvador3
The PLD Linux distribution has ported the c_rehash[1] utility from Perl to Shell-Script, allowing it to be shipped by default. 1. https://git.pld-linux.org/?p=packages/openssl.git;a=blob;f=openssl-c_rehash.sh;h=0ea22637ee6dbce845a9e2caf62540aaaf5d0761 The OpenSSL upstream intends[2] to convert the utility for C however did not yet finished the conversion. 2. https://rt.openssl.org/Ticket/Display.html?id=2324 This patch adds this script and thus removed the Perl requirement for it. Signed-off-by: Otavio Salvador <otavio@ossystems.com.br> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-09openssl: Security fix via update to 1.0.2hArmin Kuster2
CVE-2016-2105 CVE-2016-2106 CVE-2016-2109 CVE-2016-2176 https://www.openssl.org/news/secadv/20160503.txt fixup openssl-avoid-NULL-pointer-dereference-in-EVP_DigestInit_ex.patch drop crypto_use_bigint_in_x86-64_perl.patch as that fix is in latest. Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-04-08openssl.inc: minor packaging cleanupAndre McCurdy1
libcrypto.so was explicitly added to FILES_${PN}-dev as part of moving libcrypto from libdir -> base_libdir to support dhclient [1]. However, the line has been unnecessary since ${base_libdir}/lib*.so files started to be included in FILES_${PN}-dev by default [2] (and it's still unnecessary now, after moving libcrypto from back to libdir to support ntp [3]). [1] http://git.openembedded.org/openembedded-core/commit/?id=01ea85f7f6c53c66c76d6f832518b28bf06ec072 [2] http://git.openembedded.org/openembedded-core/commit/?id=66c36bcb7d9368718453265e58bd5e3c854c786a [3] http://git.openembedded.org/openembedded-core/commit/?id=0be2ab32f690a2fcba0e821abe11460958bbc6dc Also define FILES_libssl using SOLIBS instead of a hardcoded pattern. Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-03-20openssl: don't move libcrypto to base_libdirChen Qi1
For now, if 'openssl' is enabled for ntp, ntp would still be built without openssl & libcrypto. This is because that ntp thinks openssl and libcrypto locates under the same directory. This patch removes the codes of moving libcrypto to base_libdir. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-03-06openssl: add a patch to fix parallel buildsRoss Burton2
Apply a patch taken from Gentoo to hopefully fix the remaining parallel make races. Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-03-03openssl: Security fix Drown via 1.0.2g updateArmin Kuster3
CVE-2016-0800 CVE-2016-0705 CVE-2016-0798 CVE-2016-0797 CVE-2016-0799 CVE-2016-0702 CVE-2016-0703 CVE-2016-0704 https://www.openssl.org/news/secadv/20160301.txt Updated 2 debian patches to match changes in 1.0.2g Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-06openssl.inc: drop obsolete mtx-1 and mtx-2 over-ridesAndre McCurdy1
Machine specific over-rides for mtx-1 (aka MeshCube) and mtx-2 (aka SurfBox 2nd generation) don't belong in oe-core. Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-02openssl: Explicitly set EXTRA_OEMAKE as requiredMike Crowe1
The openssl recipe currently relies on EXTRA_OEMAKE having been set to "-e MAKEFLAGS=" in bitbake.conf to operate. It is necessary to make this explicit so that the default in bitbake.conf can be changed. Signed-off-by: Mike Crowe <mac@mcrowe.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-01-29openssl: update 1.0.2e -> 1.0.2f ( CVE-2016-0701 CVE-2015-3197 )Andre McCurdy1
Major changes between OpenSSL 1.0.2e and OpenSSL 1.0.2f [28 Jan 2016] o DH small subgroups (CVE-2016-0701) o SSLv2 doesn't block disabled ciphers (CVE-2015-3197) Updated LICENSE hash due to change in copyright year. Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-01-11meta: rename perl-native-runtimeEd Bartosh1
The code in native.bbclass adds -native suffix to the package names that don't have it. perl-native-runtime becomes perl-native-runtime-native because of this. Renamed perl-native-runtime -> hostperl-runtime-native to avoid mangling it and to conform with the naming convetion for native packages. Signed-off-by: Ed Bartosh <ed.bartosh@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-12-16meta: more removals of redunant FILES_${PN}-dbgRoss Burton1
In some recipes overly-split -dbg packages were merged into PN-dbg. Unless there's a very good reason, recipes should have a single -dev and -dbg package. Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-12-12openssl: Add musl configuration supportKhem Raj3
use termios instead of termio Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-12-12openssl: update to 1.0.2eAlexander Kanavin1
[YOCTO #8765] [YOCTO #8758] Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-12-01openssl: enable parallel makeRoss Burton1
openssl 1.0.2d fixes the parallel make problems (commit 8e6bb99), so enable parallel make again. [ YOCTO #7347 ] Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-11-25openssl: fix ptest issuesWenzong Fan1
* follow symbolic links while copying sources from test/* * install required target files to remove Make errors: make[2]: *** No rule to make target 'xxx', needed by 'yyy'. * fix hardcode pathes: /usr/lib -> ${libdir}, /usr/bin -> ${bindir} Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-11-25openssl: use subdir= instead of moving files in do_configure_prepend()Ross Burton1
For clarity and correctness of source archiving, don't move find.pl from WORKDIR to S in do_configure_prepend but tell the fetcher to put it in the right place when unpacking. Also re-order the files in SRC_URI so that patches are grouped together. Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-11-25openssl: sanity check that the bignum module is presentRoss Burton1
The crypto_use_bigint_in_x86-64_perl patch uses the "bigint" module to transparently support 64-bit integers on 32-bit hosts. Whilst bigint (part of bignum) is a core Perl module not all distributions install it (notable Fedora 23). As the error message when bignum isn't installed is obscure, add a task to check that it is available and alert the user if it isn't. [ YOCTO #8562 ] Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-11-16meta: Fix typos in Upstream-Status labelsPaul Eggleton1
We need these to be consistent so they are possible to programmatically read. Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-11-16openssl: fix mips64 configure supportWenzong Fan1
Match target name linux-mips64 as well, all mips64 targets will have mips(32) userspace. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-09-29openssl: fix ptest failuresMaxin B. John2
Remove dependencies for test targets. Otherwise, during ptest execution, "make" tries to rebuild those executables and fails there. [YOCTO #8059] Signed-off-by: Maxin B. John <maxin.john@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-09-28openssl: Add mapping for nios2Marek Vasut1
Map nios2 architecture to linux-generic32 target. Signed-off-by: Marek Vasut <marex@denx.de> Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-07-10openssl: upgrade to 1.0.2dJan Wetter2
This upgrade fixes CVE-2015-1793 Removed openssl-fix-link.patch. The linking issue has been fixed in openssl. Signed-off-by: Jan Wetter <jan.wetter@mikrom.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-07-01openssl: upgrade to 1.0.2cRoy Li3
upgrade to fix the CVE: CVE-2015-1788..CVE-2015-1792 and CVE-2014-8176 remove a backport patch update the c_rehash-compat.patch Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-06-23openssl: fix building on x32 systemsCristian Iorga2
Fix build on Fedora 21 i686. When building on x32 systems where the default type is 32bit, make sure that 64bit integers can be represented transparently. Signed-off-by: Cristian Iorga <cristian.iorga@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-05-30openssl: Backport upstreamed version of patch to fix build on mips64Khem Raj3
Previous patch had a concern as well and this is a direct backport of the patch fixing the problem. Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-05-23openssl: Fix build with gcc5 on mips64Khem Raj2
Patch is submitted upstream as well Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-05-23openssl: drop the padlock_conf.patchRoy Li2
padlock_conf.patch will enable the padlock engine by default, but this engine does not work on some 32bit machine, and lead to openssl unable to work Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-05-14openssl/orc: virtclass-native -> class-nativeRobert Yang1
The virtclass-native is out of date. Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-04-30openssl: remove 3 patchesRobert Yang3
Removed: - openssl-avoid-NULL-pointer-dereference-in-dh_pub_encode.patch - upgate-vegsion-script-for-1.0.2.patch Since they are already in the source. - make-targets.patch It removed test dir from DIRS, which is not needed any more since we need build it. Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-04-15crypto: use bigint in x86-64 perlArmin Kuster2
on some hosts openssl fails to build with this error: ghash-x86_64.s: Assembler messages: ghash-x86_64.s:890: Error: junk '.15473355479995e+19' after expression backported fix from community. Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-03-24openssl: 1.0.2 -> 1.0.2aRichard Purdie2
Patch updated to drop TERMIO flags since these are the default on Linux anyway (see https://git.openssl.org/?p=openssl.git;a=commit;h=64e6bf64b36136d487e2fbf907f09612e69ae911) Also drop patch merged upstream. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-03-09openssl: Upgrade to 1.0.2Saul Wold16
Rebased numerous patches removed aarch64 initial work since it's part of upstream now Imported a few additional patches from Debian to support the version-script and blacklist additional bad certificates. Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-02-23Revert "openssl: fix and enable parallel build"Richard Purdie1
This reverts commit 7502fa5febdd7a2281d626f7040782fb1f9af59e. We keep seeing parallel make failures in openssl :( Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-02-19openssl: disable SSLv3 by defaultBrendan Le Foll1
Because of the SSLv3 POODLE vulnerability, it's preferred to simply disable SSLv3 even if patched with the TLS_FALLBACK_SCSV Signed-off-by: Brendan Le Foll <brendan.le.foll@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-02-15openssl: upgrade to 1.0.1kMaxin B. John1
Upgrade includes 8 CVE bug fixes Signed-off-by: Maxin B. John <maxin.john@enea.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-02-14openssl: fix and enable parallel buildRobert Yang2
Fixed: Cannot create directory image/usr: File exists make: *** [install_sw] Error 17 Create /usr to avoid race issues. Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
2015-02-14openssl: Add mapping for microblaze architectureNathan Rossi1
Map the microblaze architecture to the linux-generic32 target. Signed-off-by: Nathan Rossi <nathan.rossi@xilinx.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-01-07openssl: fix hard paths in native opensslAndré Draszik1
This causes the package to not be relocateable from sstate The OpenSSL binaries respect a few environment variables for determining locations of files, so we now use these to point the binaries to the relocated locations. [YOCTO #6827] Signed-off-by: André Draszik <adraszik@digisoft.tv> Signed-off-by: Saul Wold <sgw@linux.intel.com>
2014-10-18openssl: upgrade to 1.0.1jRoss Burton1
Signed-off-by: Ross Burton <ross.burton@intel.com>
2014-08-27openssl: Re-add linux-uclibc tupleKhem Raj1
With last restructuring for musl, some of uclibc targets got ignored fsl/ppc and ARM worked ok since they use special target triplets which were already considered but other like mips, x86 and so on failed Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-08-23openssl: add DEPENDS on openssl-native for rehashJackie Huang1
'make rehash' used the compiled openssl to get hash value for files, it always failed when cross compiling: /path/to/openssl/1.0.1i-r0/openssl-1.0.1i/util/shlib_wrap.sh: line 96: /path/to/openssl/1.0.1i-r0/openssl-1.0.1i/util/../apps/openssl: cannot execute binary file so add DEPENDS on openssl-native for target package and use it instead of the one compiled from target package. Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-08-16openssl: Repace if-else with case and add musl tripletKhem Raj1
Simplifies the code and adds knowlwdge about musl targets Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-08-11openssl: upgrade to 1.0.1iPaul Eggleton2
Removed one patch merged upstream. Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-06-09openssl: fix ptestsPaul Eggleton3
Add some missing dependencies and fix the Makefile in order to get most of the ptest tests working (specifically test_bn, test_verify, test_cms, test_srp and test_heartbeat). test_verify still fails for unknown reasons (perhaps some of the now expired certificates weren't meant to have expired as far as the test is concerned?) but at least it has the certificates to run now. Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
2014-06-09openssl: upgrade to 1.0.1hPaul Eggleton5
Fixes the following security issues: * CVE-2014-0224 * CVE-2014-0221 * CVE-2014-0195 * CVE-2014-3470 The patch for CVE-2010-5298, CVE-2014-0198 and a fix for building the documentation are integrated upstream in this release and so were dropped. Additionally, a patch from upstream was added in order to fix a failure during do_compile_ptest_base. A similar upgrade was also submitted by Yao Xinpan <yaoxp@cn.fujitsu.com> and Lei Maohui <leimaohui@cn.fujitsu.com>. Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
2014-05-29openssl: add openssl-CVE-2010-5298.patch SRC_URIRoy Li2
make openssl-CVE-2010-5298.patch truely work Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-20 15:29:12 +0000