meta/recipes-connectivity/openssl/openssl_3.0.1.bb

   1 SUMMARY = "Secure Socket Layer"
   2 DESCRIPTION = "Secure Socket Layer (SSL) binary and related cryptographic tools."
   3 HOMEPAGE = "http://www.openssl.org/"
   4 BUGTRACKER = "http://www.openssl.org/news/vulnerabilities.html"
   5 SECTION = "libs/network"
   6
   7 LICENSE = "Apache-2.0"
   8 LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=c75985e733726beaba57bc5253e96d04"
   9
  10 SRC_URI = "http://www.openssl.org/source/openssl-${PV}.tar.gz \
  11            file://run-ptest \
  12            file://0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch \
  13            file://afalg.patch \
  14            file://0001-Configure-do-not-tweak-mips-cflags.patch \
  15            file://reproducibility.patch \
  16            "
  17
  18 SRC_URI:append:class-nativesdk = " \
  19            file://environment.d-openssl.sh \
  20            "
  21
  22 SRC_URI[sha256sum] = "c311ad853353bce796edad01a862c50a8a587f62e7e2100ef465ab53ec9b06d1"
  23
  24 inherit lib_package multilib_header multilib_script ptest perlnative
  25 MULTILIB_SCRIPTS = "${PN}-bin:${bindir}/c_rehash"
  26
  27 PACKAGECONFIG ?= ""
  28 PACKAGECONFIG:class-native = ""
  29 PACKAGECONFIG:class-nativesdk = ""
  30
  31 PACKAGECONFIG[cryptodev-linux] = "enable-devcryptoeng,disable-devcryptoeng,cryptodev-linux,,cryptodev-module"
  32 PACKAGECONFIG[no-tls1] = "no-tls1"
  33 PACKAGECONFIG[no-tls1_1] = "no-tls1_1"
  34
  35 B = "${WORKDIR}/build"
  36 do_configure[cleandirs] = "${B}"
  37
  38 #| ./libcrypto.so: undefined reference to `getcontext'
  39 #| ./libcrypto.so: undefined reference to `setcontext'
  40 #| ./libcrypto.so: undefined reference to `makecontext'
  41 EXTRA_OECONF:append:libc-musl = " no-async"
  42 EXTRA_OECONF:append:libc-musl:powerpc64 = " no-asm"
  43
  44 # adding devrandom prevents openssl from using getrandom() which is not available on older glibc versions
  45 # (native versions can be built with newer glibc, but then relocated onto a system with older glibc)
  46 EXTRA_OECONF:class-native = "--with-rand-seed=os,devrandom"
  47 EXTRA_OECONF:class-nativesdk = "--with-rand-seed=os,devrandom"
  48
  49 # Relying on hardcoded built-in paths causes openssl-native to not be relocateable from sstate.
  50 CFLAGS:append:class-native = " -DOPENSSLDIR=/not/builtin -DENGINESDIR=/not/builtin"
  51 CFLAGS:append:class-nativesdk = " -DOPENSSLDIR=/not/builtin -DENGINESDIR=/not/builtin"
  52
  53 # This allows disabling deprecated or undesirable crypto algorithms.
  54 # The default is to trust upstream choices.
  55 DEPRECATED_CRYPTO_FLAGS ?= ""
  56
  57 do_configure () {
  58         # When we upgrade glibc but not uninative we see obtuse failures in openssl. Make
  59         # the issue really clear that perl isn't functional due to symbol mismatch issues.
  60         cat <<- EOF > ${WORKDIR}/perltest
  61         #!/usr/bin/env perl
  62         use POSIX;
  63         EOF
  64         chmod a+x ${WORKDIR}/perltest
  65         ${WORKDIR}/perltest
  66
  67         os=${HOST_OS}
  68         case $os in
  69         linux-gnueabi |\
  70         linux-gnuspe |\
  71         linux-musleabi |\
  72         linux-muslspe |\
  73         linux-musl )
  74                 os=linux
  75                 ;;
  76         *)
  77                 ;;
  78         esac
  79         target="$os-${HOST_ARCH}"
  80         case $target in
  81         linux-arc)
  82                 target=linux-latomic
  83                 ;;
  84         linux-arm*)
  85                 target=linux-armv4
  86                 ;;
  87         linux-aarch64*)
  88                 target=linux-aarch64
  89                 ;;
  90         linux-i?86 | linux-viac3)
  91                 target=linux-x86
  92                 ;;
  93         linux-gnux32-x86_64 | linux-muslx32-x86_64 )
  94                 target=linux-x32
  95                 ;;
  96         linux-gnu64-x86_64)
  97                 target=linux-x86_64
  98                 ;;
  99         linux-mips | linux-mipsel)
 100                 # specifying TARGET_CC_ARCH prevents openssl from (incorrectly) adding target architecture flags
 101                 target="linux-mips32 ${TARGET_CC_ARCH}"
 102                 ;;
 103         linux-gnun32-mips*)
 104                 target=linux-mips64
 105                 ;;
 106         linux-*-mips64 | linux-mips64 | linux-*-mips64el | linux-mips64el)
 107                 target=linux64-mips64
 108                 ;;
 109         linux-microblaze* | linux-nios2* | linux-sh3 | linux-sh4 | linux-arc*)
 110                 target=linux-generic32
 111                 ;;
 112         linux-powerpc)
 113                 target=linux-ppc
 114                 ;;
 115         linux-powerpc64)
 116                 target=linux-ppc64
 117                 ;;
 118         linux-powerpc64le)
 119                 target=linux-ppc64le
 120                 ;;
 121         linux-riscv32)
 122                 target=linux-generic32
 123                 ;;
 124         linux-riscv64)
 125                 target=linux-generic64
 126                 ;;
 127         linux-sparc | linux-supersparc)
 128                 target=linux-sparcv9
 129                 ;;
 130         mingw32-x86_64)
 131                 target=mingw64
 132                 ;;
 133         esac
 134
 135         useprefix=${prefix}
 136         if [ "x$useprefix" = "x" ]; then
 137                 useprefix=/
 138         fi
 139         # WARNING: do not set compiler/linker flags (-I/-D etc.) in EXTRA_OECONF, as they will fully replace the
 140         # environment variables set by bitbake. Adjust the environment variables instead.
 141         HASHBANGPERL="/usr/bin/env perl" PERL=perl PERL5LIB="${S}/external/perl/Text-Template-1.46/lib/" \
 142         perl ${S}/Configure ${EXTRA_OECONF} ${PACKAGECONFIG_CONFARGS} ${DEPRECATED_CRYPTO_FLAGS} --prefix=$useprefix --openssldir=${libdir}/ssl-3 --libdir=${libdir} $target
 143         perl ${B}/configdata.pm --dump
 144 }
 145
 146 do_install () {
 147         oe_runmake DESTDIR="${D}" MANDIR="${mandir}" MANSUFFIX=ssl install
 148
 149         oe_multilib_header openssl/opensslconf.h
 150         oe_multilib_header openssl/configuration.h
 151
 152         # Create SSL structure for packages such as ca-certificates which
 153         # contain hard-coded paths to /etc/ssl. Debian does the same.
 154         install -d ${D}${sysconfdir}/ssl
 155         mv ${D}${libdir}/ssl-3/certs \
 156            ${D}${libdir}/ssl-3/private \
 157            ${D}${libdir}/ssl-3/openssl.cnf \
 158            ${D}${sysconfdir}/ssl/
 159
 160         # Although absolute symlinks would be OK for the target, they become
 161         # invalid if native or nativesdk are relocated from sstate.
 162         ln -sf ${@oe.path.relative('${libdir}/ssl-3', '${sysconfdir}/ssl/certs')} ${D}${libdir}/ssl-3/certs
 163         ln -sf ${@oe.path.relative('${libdir}/ssl-3', '${sysconfdir}/ssl/private')} ${D}${libdir}/ssl-3/private
 164         ln -sf ${@oe.path.relative('${libdir}/ssl-3', '${sysconfdir}/ssl/openssl.cnf')} ${D}${libdir}/ssl-3/openssl.cnf
 165 }
 166
 167 do_install:append:class-native () {
 168         create_wrapper ${D}${bindir}/openssl \
 169             OPENSSL_CONF=${libdir}/ssl-3/openssl.cnf \
 170             SSL_CERT_DIR=${libdir}/ssl-3/certs \
 171             SSL_CERT_FILE=${libdir}/ssl-3/cert.pem \
 172             OPENSSL_ENGINES=${libdir}/engines-3 \
 173             OPENSSL_MODULES=${libdir}/ossl-modules
 174 }
 175
 176 do_install:append:class-nativesdk () {
 177         mkdir -p ${D}${SDKPATHNATIVE}/environment-setup.d
 178         install -m 644 ${WORKDIR}/environment.d-openssl.sh ${D}${SDKPATHNATIVE}/environment-setup.d/openssl.sh
 179         sed 's|/usr/lib/ssl/|/usr/lib/ssl-3/|g' -i ${D}${SDKPATHNATIVE}/environment-setup.d/openssl.sh
 180 }
 181
 182 PTEST_BUILD_HOST_FILES += "configdata.pm"
 183 PTEST_BUILD_HOST_PATTERN = "perl_version ="
 184 do_install_ptest () {
 185         install -d ${D}${PTEST_PATH}/test
 186         install -m755 ${B}/test/p_test.so ${D}${PTEST_PATH}/test
 187         install -m755 ${B}/test/provider_internal_test.cnf ${D}${PTEST_PATH}/test
 188
 189         # Prune the build tree
 190         rm -f ${B}/fuzz/*.* ${B}/test/*.*
 191
 192         cp ${S}/Configure ${B}/configdata.pm ${D}${PTEST_PATH}
 193         sed 's|${S}|${PTEST_PATH}|g' -i ${D}${PTEST_PATH}/configdata.pm
 194         cp -r ${S}/external ${B}/test ${S}/test ${B}/fuzz ${S}/util ${B}/util ${D}${PTEST_PATH}
 195
 196         # For test_shlibload
 197         ln -s ${libdir}/libcrypto.so.1.1 ${D}${PTEST_PATH}/
 198         ln -s ${libdir}/libssl.so.1.1 ${D}${PTEST_PATH}/
 199
 200         install -d ${D}${PTEST_PATH}/apps
 201         ln -s ${bindir}/openssl ${D}${PTEST_PATH}/apps
 202         install -m644 ${S}/apps/*.pem ${S}/apps/*.srl ${S}/apps/openssl.cnf ${D}${PTEST_PATH}/apps
 203         install -m755 ${B}/apps/CA.pl ${D}${PTEST_PATH}/apps
 204
 205         install -d ${D}${PTEST_PATH}/engines
 206         install -m755 ${B}/engines/dasync.so ${D}${PTEST_PATH}/engines
 207         install -m755 ${B}/engines/loader_attic.so ${D}${PTEST_PATH}/engines
 208         install -m755 ${B}/engines/ossltest.so ${D}${PTEST_PATH}/engines
 209
 210         install -d ${D}${PTEST_PATH}/providers
 211         install -m755 ${B}/providers/legacy.so ${D}${PTEST_PATH}/providers
 212
 213         install -d ${D}${PTEST_PATH}/Configurations
 214         cp -rf ${S}/Configurations/* ${D}${PTEST_PATH}/Configurations/
 215
 216         # seems to be needed with perl 5.32.1
 217         install -d ${D}${PTEST_PATH}/util/perl/recipes
 218         cp ${D}${PTEST_PATH}/test/recipes/tconversion.pl ${D}${PTEST_PATH}/util/perl/recipes/
 219
 220         sed 's|${S}|${PTEST_PATH}|g' -i ${D}${PTEST_PATH}/util/wrap.pl
 221 }
 222
 223 # Add the openssl.cnf file to the openssl-conf package. Make the libcrypto
 224 # package RRECOMMENDS on this package. This will enable the configuration
 225 # file to be installed for both the openssl-bin package and the libcrypto
 226 # package since the openssl-bin package depends on the libcrypto package.
 227
 228 PACKAGES =+ "libcrypto libssl openssl-conf ${PN}-engines ${PN}-misc"
 229
 230 FILES:libcrypto = "${libdir}/libcrypto${SOLIBS}"
 231 FILES:libssl = "${libdir}/libssl${SOLIBS}"
 232 FILES:openssl-conf = "${sysconfdir}/ssl/openssl.cnf \
 233                       ${libdir}/ssl-3/openssl.cnf* \
 234                       "
 235 FILES:${PN}-engines = "${libdir}/engines-3"
 236 # ${prefix} comes from what we pass into --prefix at configure time (which is used for INSTALLTOP)
 237 FILES:${PN}-engines:append:mingw32:class-nativesdk = " ${prefix}${libdir}/engines-3"
 238 FILES:${PN}-misc = "${libdir}/ssl-3/misc ${bindir}/c_rehash"
 239 FILES:${PN} =+ "${libdir}/ssl-3/* ${libdir}/ossl-modules/"
 240 FILES:${PN}:append:class-nativesdk = " ${SDKPATHNATIVE}/environment-setup.d/openssl.sh"
 241
 242 CONFFILES:openssl-conf = "${sysconfdir}/ssl/openssl.cnf"
 243
 244 RRECOMMENDS:libcrypto += "openssl-conf"
 245 RDEPENDS:${PN}-misc = "perl"
 246 RDEPENDS:${PN}-ptest += "openssl-bin perl perl-modules bash sed"
 247
 248 RDEPENDS:${PN}-bin += "openssl-conf"
 249
 250 BBCLASSEXTEND = "native nativesdk"
 251
 252 CVE_PRODUCT = "openssl:openssl"
 253
 254 CVE_VERSION_SUFFIX = "alphabetical"
 255
 256 # Only affects OpenSSL >= 1.1.1 in combination with Apache < 2.4.37
 257 # Apache in meta-webserver is already recent enough
 258 CVE_CHECK_IGNORE += "CVE-2019-0190"