mirror of
https://github.com/flatcar/scripts.git
synced 2025-08-09 22:16:58 +02:00
dev-libs/openssl: Sync with Gentoo
It's from Gentoo commit 414fc629d397bb756ad382342e99243dcc6ec508.
This commit is contained in:
Krzesimir Nowak
parent
d0c7277d47
commit
bc44aa3dce
@ -1,2 +1,2 @@
|
||||
DIST openssl-3.0.9.tar.gz 15181285 BLAKE2B cc1df41fa12ba4443e15e94f6ebdc5e103b9dab5eab2e1c8f74e6a74fa2c38207817921b65d7293cb241c190a910191c7163600bb75243adde0e2f9ec31cc885 SHA512 86c99146b37236419b110db77dd3ac3992e6bed78c258f0cc3434ca233460b4e17c0ac81d7058547fe9cb72a9fd80ee56d4b4916bb731dbe2bbcf1c3d46bf31a
|
||||
DIST openssl-3.0.9.tar.gz.asc 833 BLAKE2B 9943ac65f83f48465cae83b37a1d004f6be4622e53c3025166d42954abe9215f1a6c2af58d4aa2b45fa51182fee5019e740969f694655b6c592bb278c68aacef SHA512 9949de6b57d5aa21da1d4b68a29eb37e302403c983bd7d2d8769b320aac4268a9f9091c5fb182862a4f89a9099660939fe609df87c66991b75f7695faf357caf
|
||||
DIST openssl-3.0.12.tar.gz 15204575 BLAKE2B 1f00e33a5ed64a51cf28f0dbe7d53a9197c1edae7538dea9573394ee4dc03a885483d74b0b47a78b9067e87b4f420b9d7103f351bfec91710c168051cb7148df SHA512 63e003653dd1126c66e278969a626cdf0801b97da8b7076824d661e4a77e1572c3171cf7f006c972b95bcfa284889ee0362d8a46a851f7d8e743e2a1fe593b24
|
||||
DIST openssl-3.0.12.tar.gz.asc 833 BLAKE2B 5c7914e0449a1f2fad433544fa637263b237c2637b86960f904a7840ef6bd627728dfa45373e03a6ce7a0a4570d03e1dcd0188059bd5dbcc83d49d10be64dd39 SHA512 072d1572e6cc5240fed69c01b1f7f74958ceba33cec3b0a7f0db5929dc884381320fb737ec6b38f95ef81c855e2d382d7ecd19431a328b08efad70288ec4a964
|
||||
|
||||
@ -88,6 +88,10 @@ linux)
|
||||
alphaev56*|\
|
||||
alphaev[678]*)machine=alpha+bwx-${compiler};;
|
||||
alpha*) machine=alpha-${compiler};;
|
||||
arc64*b*) machine="generic64 -DB_ENDIAN";;
|
||||
arc64*) machine="generic64 -DL_ENDIAN";;
|
||||
arc*b*) machine="generic32 -DB_ENDIAN";;
|
||||
arc*) machine="generic32 -DL_ENDIAN";;
|
||||
armv[4-9]*b*) machine="armv4 -DB_ENDIAN";;
|
||||
armv[4-9]*) machine="armv4 -DL_ENDIAN";;
|
||||
arm*b*) machine="generic32 -DB_ENDIAN";;
|
||||
|
||||
@ -1,109 +0,0 @@
|
||||
https://github.com/openssl/openssl/commit/00e2f5eea29994d19293ec4e8c8775ba73678598
|
||||
https://github.com/openssl/openssl/commit/96318a8d21bed334d78797eca5b32790775d5f05
|
||||
|
||||
From 00e2f5eea29994d19293ec4e8c8775ba73678598 Mon Sep 17 00:00:00 2001
|
||||
From: Tomas Mraz <tomas@openssl.org>
|
||||
Date: Tue, 4 Jul 2023 17:30:35 +0200
|
||||
Subject: [PATCH] Do not ignore empty associated data with AES-SIV mode
|
||||
|
||||
The AES-SIV mode allows for multiple associated data items
|
||||
authenticated separately with any of these being 0 length.
|
||||
|
||||
The provided implementation ignores such empty associated data
|
||||
which is incorrect in regards to the RFC 5297 and is also
|
||||
a security issue because such empty associated data then become
|
||||
unauthenticated if an application expects to authenticate them.
|
||||
|
||||
Fixes CVE-2023-2975
|
||||
|
||||
Reviewed-by: Matt Caswell <matt@openssl.org>
|
||||
Reviewed-by: Paul Dale <pauli@openssl.org>
|
||||
(Merged from https://github.com/openssl/openssl/pull/21384)
|
||||
|
||||
(cherry picked from commit c426c281cfc23ab182f7d7d7a35229e7db1494d9)
|
||||
--- a/providers/implementations/ciphers/cipher_aes_siv.c
|
||||
+++ b/providers/implementations/ciphers/cipher_aes_siv.c
|
||||
@@ -120,14 +120,18 @@ static int siv_cipher(void *vctx, unsigned char *out, size_t *outl,
|
||||
if (!ossl_prov_is_running())
|
||||
return 0;
|
||||
|
||||
- if (inl == 0) {
|
||||
- *outl = 0;
|
||||
- return 1;
|
||||
- }
|
||||
+ /* Ignore just empty encryption/decryption call and not AAD. */
|
||||
+ if (out != NULL) {
|
||||
+ if (inl == 0) {
|
||||
+ if (outl != NULL)
|
||||
+ *outl = 0;
|
||||
+ return 1;
|
||||
+ }
|
||||
|
||||
- if (outsize < inl) {
|
||||
- ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL);
|
||||
- return 0;
|
||||
+ if (outsize < inl) {
|
||||
+ ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL);
|
||||
+ return 0;
|
||||
+ }
|
||||
}
|
||||
|
||||
if (ctx->hw->cipher(ctx, out, in, inl) <= 0)
|
||||
|
||||
From 96318a8d21bed334d78797eca5b32790775d5f05 Mon Sep 17 00:00:00 2001
|
||||
From: Tomas Mraz <tomas@openssl.org>
|
||||
Date: Tue, 4 Jul 2023 17:50:37 +0200
|
||||
Subject: [PATCH] Add testcases for empty associated data entries with AES-SIV
|
||||
|
||||
Reviewed-by: Matt Caswell <matt@openssl.org>
|
||||
Reviewed-by: Paul Dale <pauli@openssl.org>
|
||||
(Merged from https://github.com/openssl/openssl/pull/21384)
|
||||
|
||||
(cherry picked from commit 3993bb0c0c87e3ed0ab4274e4688aa814e164cfc)
|
||||
--- a/test/recipes/30-test_evp_data/evpciph_aes_siv.txt
|
||||
+++ b/test/recipes/30-test_evp_data/evpciph_aes_siv.txt
|
||||
@@ -20,6 +20,19 @@ Tag = 85632d07c6e8f37f950acd320a2ecc93
|
||||
Plaintext = 112233445566778899aabbccddee
|
||||
Ciphertext = 40c02b9690c4dc04daef7f6afe5c
|
||||
|
||||
+Cipher = aes-128-siv
|
||||
+Key = fffefdfcfbfaf9f8f7f6f5f4f3f2f1f0f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff
|
||||
+Tag = f1c5fdeac1f15a26779c1501f9fb7588
|
||||
+Plaintext = 112233445566778899aabbccddee
|
||||
+Ciphertext = 27e946c669088ab06da58c5c831c
|
||||
+
|
||||
+Cipher = aes-128-siv
|
||||
+Key = fffefdfcfbfaf9f8f7f6f5f4f3f2f1f0f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff
|
||||
+AAD =
|
||||
+Tag = d1022f5b3664e5a4dfaf90f85be6f28a
|
||||
+Plaintext = 112233445566778899aabbccddee
|
||||
+Ciphertext = b66cff6b8eca0b79f083b39a0901
|
||||
+
|
||||
Cipher = aes-128-siv
|
||||
Key = 7f7e7d7c7b7a79787776757473727170404142434445464748494a4b4c4d4e4f
|
||||
AAD = 00112233445566778899aabbccddeeffdeaddadadeaddadaffeeddccbbaa99887766554433221100
|
||||
@@ -29,6 +42,24 @@ Tag = 7bdb6e3b432667eb06f4d14bff2fbd0f
|
||||
Plaintext = 7468697320697320736f6d6520706c61696e7465787420746f20656e6372797074207573696e67205349562d414553
|
||||
Ciphertext = cb900f2fddbe404326601965c889bf17dba77ceb094fa663b7a3f748ba8af829ea64ad544a272e9c485b62a3fd5c0d
|
||||
|
||||
+Cipher = aes-128-siv
|
||||
+Key = 7f7e7d7c7b7a79787776757473727170404142434445464748494a4b4c4d4e4f
|
||||
+AAD = 00112233445566778899aabbccddeeffdeaddadadeaddadaffeeddccbbaa99887766554433221100
|
||||
+AAD =
|
||||
+AAD = 09f911029d74e35bd84156c5635688c0
|
||||
+Tag = 83ce6593a8fa67eb6fcd2819cedfc011
|
||||
+Plaintext = 7468697320697320736f6d6520706c61696e7465787420746f20656e6372797074207573696e67205349562d414553
|
||||
+Ciphertext = 30d937b42f71f71f93fc2d8d702d3eac8dc7651eefcd81120081ff29d626f97f3de17f2969b691c91b69b652bf3a6d
|
||||
+
|
||||
+Cipher = aes-128-siv
|
||||
+Key = 7f7e7d7c7b7a79787776757473727170404142434445464748494a4b4c4d4e4f
|
||||
+AAD =
|
||||
+AAD = 00112233445566778899aabbccddeeffdeaddadadeaddadaffeeddccbbaa99887766554433221100
|
||||
+AAD = 09f911029d74e35bd84156c5635688c0
|
||||
+Tag = 77dd4a44f5a6b41302121ee7f378de25
|
||||
+Plaintext = 7468697320697320736f6d6520706c61696e7465787420746f20656e6372797074207573696e67205349562d414553
|
||||
+Ciphertext = 0fcd664c922464c88939d71fad7aefb864e501b0848a07d39201c1067a7288f3dadf0131a823a0bc3d588e8564a5fe
|
||||
+
|
||||
Cipher = aes-192-siv
|
||||
Key = fffefdfcfbfaf9f8f7f6f5f4f3f2f1f0f0f1f2f3f4f5f6f7f8f9fafbfcfdfefffffefdfcfbfaf9f8f7f6f5f4f3f2f1f0
|
||||
AAD = 101112131415161718191a1b1c1d1e1f2021222324252627
|
||||
@ -1,120 +0,0 @@
|
||||
https://github.com/openssl/openssl/commit/1fa20cf2f506113c761777127a38bce5068740eb
|
||||
https://github.com/openssl/openssl/commit/8a62fd996cb1c22383ec75b4155d54dec4a1b0ee
|
||||
|
||||
From 1fa20cf2f506113c761777127a38bce5068740eb Mon Sep 17 00:00:00 2001
|
||||
From: Matt Caswell <matt@openssl.org>
|
||||
Date: Thu, 6 Jul 2023 16:36:35 +0100
|
||||
Subject: [PATCH] Fix DH_check() excessive time with over sized modulus
|
||||
|
||||
The DH_check() function checks numerous aspects of the key or parameters
|
||||
that have been supplied. Some of those checks use the supplied modulus
|
||||
value even if it is excessively large.
|
||||
|
||||
There is already a maximum DH modulus size (10,000 bits) over which
|
||||
OpenSSL will not generate or derive keys. DH_check() will however still
|
||||
perform various tests for validity on such a large modulus. We introduce a
|
||||
new maximum (32,768) over which DH_check() will just fail.
|
||||
|
||||
An application that calls DH_check() and supplies a key or parameters
|
||||
obtained from an untrusted source could be vulnerable to a Denial of
|
||||
Service attack.
|
||||
|
||||
The function DH_check() is itself called by a number of other OpenSSL
|
||||
functions. An application calling any of those other functions may
|
||||
similarly be affected. The other functions affected by this are
|
||||
DH_check_ex() and EVP_PKEY_param_check().
|
||||
|
||||
CVE-2023-3446
|
||||
|
||||
Reviewed-by: Paul Dale <pauli@openssl.org>
|
||||
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
|
||||
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
|
||||
Reviewed-by: Tomas Mraz <tomas@openssl.org>
|
||||
(Merged from https://github.com/openssl/openssl/pull/21451)
|
||||
|
||||
(cherry picked from commit 9e0094e2aa1b3428a12d5095132f133c078d3c3d)
|
||||
--- a/crypto/dh/dh_check.c
|
||||
+++ b/crypto/dh/dh_check.c
|
||||
@@ -152,6 +152,12 @@ int DH_check(const DH *dh, int *ret)
|
||||
if (nid != NID_undef)
|
||||
return 1;
|
||||
|
||||
+ /* Don't do any checks at all with an excessively large modulus */
|
||||
+ if (BN_num_bits(dh->params.p) > OPENSSL_DH_CHECK_MAX_MODULUS_BITS) {
|
||||
+ ERR_raise(ERR_LIB_DH, DH_R_MODULUS_TOO_LARGE);
|
||||
+ return 0;
|
||||
+ }
|
||||
+
|
||||
if (!DH_check_params(dh, ret))
|
||||
return 0;
|
||||
|
||||
--- a/include/openssl/dh.h
|
||||
+++ b/include/openssl/dh.h
|
||||
@@ -89,7 +89,11 @@ int EVP_PKEY_CTX_get0_dh_kdf_ukm(EVP_PKEY_CTX *ctx, unsigned char **ukm);
|
||||
# include <openssl/dherr.h>
|
||||
|
||||
# ifndef OPENSSL_DH_MAX_MODULUS_BITS
|
||||
-# define OPENSSL_DH_MAX_MODULUS_BITS 10000
|
||||
+# define OPENSSL_DH_MAX_MODULUS_BITS 10000
|
||||
+# endif
|
||||
+
|
||||
+# ifndef OPENSSL_DH_CHECK_MAX_MODULUS_BITS
|
||||
+# define OPENSSL_DH_CHECK_MAX_MODULUS_BITS 32768
|
||||
# endif
|
||||
|
||||
# define OPENSSL_DH_FIPS_MIN_MODULUS_BITS 1024
|
||||
|
||||
From 8a62fd996cb1c22383ec75b4155d54dec4a1b0ee Mon Sep 17 00:00:00 2001
|
||||
From: Matt Caswell <matt@openssl.org>
|
||||
Date: Fri, 7 Jul 2023 14:39:48 +0100
|
||||
Subject: [PATCH] Add a test for CVE-2023-3446
|
||||
|
||||
Confirm that the only errors DH_check() finds with DH parameters with an
|
||||
excessively long modulus is that the modulus is too large. We should not
|
||||
be performing time consuming checks using that modulus.
|
||||
|
||||
Reviewed-by: Paul Dale <pauli@openssl.org>
|
||||
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
|
||||
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
|
||||
Reviewed-by: Tomas Mraz <tomas@openssl.org>
|
||||
(Merged from https://github.com/openssl/openssl/pull/21451)
|
||||
|
||||
(cherry picked from commit ede782b4c8868d1f09c9cd237f82b6f35b7dba8b)
|
||||
--- a/test/dhtest.c
|
||||
+++ b/test/dhtest.c
|
||||
@@ -73,7 +73,7 @@ static int dh_test(void)
|
||||
goto err1;
|
||||
|
||||
/* check fails, because p is way too small */
|
||||
- if (!DH_check(dh, &i))
|
||||
+ if (!TEST_true(DH_check(dh, &i)))
|
||||
goto err2;
|
||||
i ^= DH_MODULUS_TOO_SMALL;
|
||||
if (!TEST_false(i & DH_CHECK_P_NOT_PRIME)
|
||||
@@ -124,6 +124,17 @@ static int dh_test(void)
|
||||
/* We'll have a stale error on the queue from the above test so clear it */
|
||||
ERR_clear_error();
|
||||
|
||||
+ /* Modulus of size: dh check max modulus bits + 1 */
|
||||
+ if (!TEST_true(BN_set_word(p, 1))
|
||||
+ || !TEST_true(BN_lshift(p, p, OPENSSL_DH_CHECK_MAX_MODULUS_BITS)))
|
||||
+ goto err3;
|
||||
+
|
||||
+ /*
|
||||
+ * We expect no checks at all for an excessively large modulus
|
||||
+ */
|
||||
+ if (!TEST_false(DH_check(dh, &i)))
|
||||
+ goto err3;
|
||||
+
|
||||
/*
|
||||
* II) key generation
|
||||
*/
|
||||
@@ -138,7 +149,7 @@ static int dh_test(void)
|
||||
goto err3;
|
||||
|
||||
/* ... and check whether it is valid */
|
||||
- if (!DH_check(a, &i))
|
||||
+ if (!TEST_true(DH_check(a, &i)))
|
||||
goto err3;
|
||||
if (!TEST_false(i & DH_CHECK_P_NOT_PRIME)
|
||||
|| !TEST_false(i & DH_CHECK_P_NOT_SAFE_PRIME)
|
||||
@ -1,3 +0,0 @@
|
||||
d /etc/ssl - - - - -
|
||||
d /etc/ssl/private 0700 - - - -
|
||||
L /etc/ssl/openssl.cnf - - - - ../../usr/share/ssl/openssl.cnf
|
||||
@ -6,7 +6,6 @@
|
||||
<name>Gentoo Base System</name>
|
||||
</maintainer>
|
||||
<use>
|
||||
<flag name="asm">Support assembly hand optimized crypto functions (i.e. faster run time)</flag>
|
||||
<flag name="bindist">Disable/Restrict EC algorithms (as they seem to be patented) -- note: changes the ABI</flag>
|
||||
<flag name="fips">Enable FIPS provider</flag>
|
||||
<flag name="ktls">Enable support for Kernel implementation of TLS (kTLS)</flag>
|
||||
|
||||
@ -3,10 +3,9 @@
|
||||
|
||||
EAPI=8
|
||||
|
||||
VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/openssl.org.asc
|
||||
TMPFILES_OPTIONAL=1
|
||||
VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssl.org.asc
|
||||
inherit edo flag-o-matic linux-info toolchain-funcs
|
||||
inherit multilib multilib-minimal multiprocessing preserve-libs verify-sig tmpfiles
|
||||
inherit multilib multilib-minimal multiprocessing preserve-libs verify-sig
|
||||
|
||||
DESCRIPTION="Robust, full-featured Open Source Toolkit for the Transport Layer Security (TLS)"
|
||||
HOMEPAGE="https://www.openssl.org/"
|
||||
@ -20,7 +19,7 @@ if [[ ${PV} == 9999 ]] ; then
|
||||
else
|
||||
SRC_URI="mirror://openssl/source/${MY_P}.tar.gz
|
||||
verify-sig? ( mirror://openssl/source/${MY_P}.tar.gz.asc )"
|
||||
KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos"
|
||||
KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
|
||||
fi
|
||||
|
||||
S="${WORKDIR}"/${MY_P}
|
||||
@ -30,11 +29,7 @@ SLOT="0/3" # .so version of libssl/libcrypto
|
||||
IUSE="+asm cpu_flags_x86_sse2 fips ktls rfc3779 sctp static-libs test tls-compression vanilla verify-sig weak-ssl-ciphers"
|
||||
RESTRICT="!test? ( test )"
|
||||
|
||||
# Flatcar: Gentoo dropped dependency on c_rehash, a required tool for
|
||||
# generating certs, and does not provide a built-in tool either.
|
||||
# Continue shipping it.
|
||||
COMMON_DEPEND="
|
||||
>=app-misc/c_rehash-1.7-r1
|
||||
tls-compression? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] )
|
||||
"
|
||||
BDEPEND="
|
||||
@ -45,7 +40,7 @@ BDEPEND="
|
||||
sys-devel/bc
|
||||
sys-process/procps
|
||||
)
|
||||
verify-sig? ( >=sec-keys/openpgp-keys-openssl-20230207 )"
|
||||
verify-sig? ( >=sec-keys/openpgp-keys-openssl-20230801 )"
|
||||
|
||||
DEPEND="${COMMON_DEPEND}"
|
||||
RDEPEND="${COMMON_DEPEND}"
|
||||
@ -55,11 +50,6 @@ MULTILIB_WRAPPED_HEADERS=(
|
||||
/usr/include/openssl/configuration.h
|
||||
)
|
||||
|
||||
PATCHES=(
|
||||
"${FILESDIR}"/${P}-CVE-2023-2975.patch
|
||||
"${FILESDIR}"/${P}-CVE-2023-3446.patch
|
||||
)
|
||||
|
||||
pkg_setup() {
|
||||
if use ktls ; then
|
||||
if kernel_is -lt 4 18 ; then
|
||||
@ -91,7 +81,7 @@ src_unpack() {
|
||||
# Can delete this once test fix patch is dropped
|
||||
if use verify-sig ; then
|
||||
# Needed for downloaded patch (which is unsigned, which is fine)
|
||||
verify-sig_verify_detached "${DISTDIR}"/${P}.tar.gz{,.asc}
|
||||
verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.gz{,.asc}
|
||||
fi
|
||||
|
||||
default
|
||||
@ -133,6 +123,7 @@ src_configure() {
|
||||
# code. This has been in the ebuild for > 10 years but even in 2022,
|
||||
# it's still relevant:
|
||||
# - https://github.com/llvm/llvm-project/issues/55255
|
||||
# - https://github.com/openssl/openssl/issues/12247
|
||||
# - https://github.com/openssl/openssl/issues/18225
|
||||
# - https://github.com/openssl/openssl/issues/18663#issuecomment-1181478057
|
||||
# Don't remove the no strict aliasing bits below!
|
||||
@ -231,16 +222,18 @@ multilib_src_test() {
|
||||
}
|
||||
|
||||
multilib_src_install() {
|
||||
emake DESTDIR="${D}" install_sw
|
||||
# Only -j1 is supported for the install targets:
|
||||
# https://github.com/openssl/openssl/issues/21999#issuecomment-1771150305
|
||||
emake DESTDIR="${D}" -j1 install_sw
|
||||
if use fips; then
|
||||
emake DESTDIR="${D}" install_fips
|
||||
emake DESTDIR="${D}" -j1 install_fips
|
||||
# Regen this in pkg_preinst, bug 900625
|
||||
rm "${ED}${SSL_CNF_DIR}"/fipsmodule.cnf || die
|
||||
fi
|
||||
|
||||
if multilib_is_native_abi; then
|
||||
emake DESTDIR="${D}" install_ssldirs
|
||||
emake DESTDIR="${D}" DOCDIR='$(INSTALLTOP)'/share/doc/${PF} install_docs
|
||||
emake DESTDIR="${D}" -j1 install_ssldirs
|
||||
emake DESTDIR="${D}" DOCDIR='$(INSTALLTOP)'/share/doc/${PF} -j1 install_docs
|
||||
fi
|
||||
|
||||
# This is crappy in that the static archives are still built even
|
||||
@ -260,21 +253,15 @@ multilib_src_install_all() {
|
||||
|
||||
dodoc {AUTHORS,CHANGES,NEWS,README,README-PROVIDERS}.md doc/*.txt doc/${PN}-c-indent.el
|
||||
|
||||
# Create the certs directory
|
||||
keepdir ${SSL_CNF_DIR}/certs
|
||||
|
||||
# bug #254521
|
||||
dodir /etc/sandbox.d
|
||||
echo 'SANDBOX_PREDICT="/dev/crypto"' > "${ED}"/etc/sandbox.d/10openssl
|
||||
|
||||
# flatcar changes: do not keep the sample CA files in `/etc`
|
||||
rm -rf "${ED}"${SSL_CNF_DIR}
|
||||
|
||||
# flatcar changes: save the default `openssl.cnf` in `/usr`
|
||||
dodir /usr/share/ssl
|
||||
insinto /usr/share/ssl
|
||||
doins "${S}"/apps/openssl.cnf
|
||||
dotmpfiles "${FILESDIR}"/openssl.conf
|
||||
|
||||
# flatcar changes: package `tmpfiles.d` setup for SDK bootstrapping.
|
||||
systemd-tmpfiles --create --root="${ED}" "${FILESDIR}"/openssl.conf
|
||||
diropts -m0700
|
||||
keepdir ${SSL_CNF_DIR}/private
|
||||
}
|
||||
|
||||
pkg_preinst() {
|
||||
@ -290,3 +277,12 @@ pkg_preinst() {
|
||||
preserve_old_lib /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
|
||||
/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
|
||||
}
|
||||
|
||||
pkg_postinst() {
|
||||
ebegin "Running 'openssl rehash ${EROOT}${SSL_CNF_DIR}/certs' to rebuild hashes (bug #333069)"
|
||||
openssl rehash "${EROOT}${SSL_CNF_DIR}/certs"
|
||||
eend $?
|
||||
|
||||
preserve_old_lib_notify /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
|
||||
/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
|
||||
}
|
||||
Loading…
Reference in New Issue
Block a user