summaryrefslogtreecommitdiffstats
path: root/meta/recipes-connectivity
diff options
context:
space:
mode:
authorMartin Hundebøll <martin@geanix.com>2018-11-08 09:25:24 +0100
committerRichard Purdie <richard.purdie@linuxfoundation.org>2018-11-14 11:14:39 +0000
commitc77d38acd63bc3b91ce0616c9595fc9a914906ba (patch)
tree204229e06dda57546a0c69b087c1e7d7bae8418f /meta/recipes-connectivity
parent62c15051ce0e69c9ac1fa6dedd5ee840707f882a (diff)
downloadpoky-c77d38acd63bc3b91ce0616c9595fc9a914906ba.tar.gz
openssl-1.1.1: remove build path from version info
The openssl build system generates buildinf.h containing the full compiler command line used to compile objects. This breaks reproducibility, as the compile command is baked into libcrypto, where it is used when running `openssl version -f`. Add stripped build variables for the compiler and cflags lines, and use those when generating buildinfo.h. This is based on a similar patch for older openssl versions: https://patchwork.openembedded.org/patch/147229/ (From OE-Core rev: cbc9b743a711f07c04cf9f5b2fc3f83da6d28913) Signed-off-by: Martin Hundebøll <martin@geanix.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-connectivity')
-rw-r--r--meta/recipes-connectivity/openssl/openssl/0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch70
-rw-r--r--meta/recipes-connectivity/openssl/openssl_1.1.1.bb1
2 files changed, 71 insertions, 0 deletions
diff --git a/meta/recipes-connectivity/openssl/openssl/0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch b/meta/recipes-connectivity/openssl/openssl/0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch
new file mode 100644
index 0000000000..80b62ab18c
--- /dev/null
+++ b/meta/recipes-connectivity/openssl/openssl/0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch
@@ -0,0 +1,70 @@
1From 3e1d00481093e10775eaf69d619c45b32a4aa7dc Mon Sep 17 00:00:00 2001
2From: =?UTF-8?q?Martin=20Hundeb=C3=B8ll?= <martin@geanix.com>
3Date: Tue, 6 Nov 2018 14:50:47 +0100
4Subject: [PATCH] buildinfo: strip sysroot and debug-prefix-map from compiler
5 info
6MIME-Version: 1.0
7Content-Type: text/plain; charset=UTF-8
8Content-Transfer-Encoding: 8bit
9
10The openssl build system generates buildinf.h containing the full
11compiler command line used to compile objects. This breaks
12reproducibility, as the compile command is baked into libcrypto, where
13it is used when running `openssl version -f`.
14
15Add stripped build variables for the compiler and cflags lines, and use
16those when generating buildinfo.h.
17
18This is based on a similar patch for older openssl versions:
19https://patchwork.openembedded.org/patch/147229/
20
21Upstream-Status: Inappropriate [OE specific]
22Signed-off-by: Martin Hundebøll <martin@geanix.com>
23---
24 Configurations/unix-Makefile.tmpl | 10 +++++++++-
25 crypto/build.info | 2 +-
26 2 files changed, 10 insertions(+), 2 deletions(-)
27
28diff --git a/Configurations/unix-Makefile.tmpl b/Configurations/unix-Makefile.tmpl
29index 16af4d2087..54c162784c 100644
30--- a/Configurations/unix-Makefile.tmpl
31+++ b/Configurations/unix-Makefile.tmpl
32@@ -317,13 +317,21 @@ BIN_LDFLAGS={- join(' ', $target{bin_lflags} || (),
33 '$(CNF_LDFLAGS)', '$(LDFLAGS)') -}
34 BIN_EX_LIBS=$(CNF_EX_LIBS) $(EX_LIBS)
35
36-# CPPFLAGS_Q is used for one thing only: to build up buildinf.h
37+# *_Q variables are used for one thing only: to build up buildinf.h
38 CPPFLAGS_Q={- $cppflags1 =~ s|([\\"])|\\$1|g;
39 $cppflags2 =~ s|([\\"])|\\$1|g;
40 $lib_cppflags =~ s|([\\"])|\\$1|g;
41 join(' ', $lib_cppflags || (), $cppflags2 || (),
42 $cppflags1 || ()) -}
43
44+CFLAGS_Q={- for (@{$config{CFLAGS}}) {
45+ s|-fdebug-prefix-map=[^ ]+|-fdebug-prefix-map=|g;
46+ }
47+ join(' ', @{$config{CFLAGS}}) -}
48+
49+CC_Q={- $config{CC} =~ s|--sysroot=[^ ]+|--sysroot=recipe-sysroot|g;
50+ join(' ', $config{CC}) -}
51+
52 PERLASM_SCHEME= {- $target{perlasm_scheme} -}
53
54 # For x86 assembler: Set PROCESSOR to 386 if you want to support
55diff --git a/crypto/build.info b/crypto/build.info
56index b515b7318e..8c9cee2a09 100644
57--- a/crypto/build.info
58+++ b/crypto/build.info
59@@ -10,7 +10,7 @@ EXTRA= ../ms/uplink-x86.pl ../ms/uplink.c ../ms/applink.c \
60 ppccpuid.pl pariscid.pl alphacpuid.pl arm64cpuid.pl armv4cpuid.pl
61
62 DEPEND[cversion.o]=buildinf.h
63-GENERATE[buildinf.h]=../util/mkbuildinf.pl "$(CC) $(LIB_CFLAGS) $(CPPFLAGS_Q)" "$(PLATFORM)"
64+GENERATE[buildinf.h]=../util/mkbuildinf.pl "$(CC_Q) $(CFLAGS_Q) $(CPPFLAGS_Q)" "$(PLATFORM)"
65 DEPEND[buildinf.h]=../configdata.pm
66
67 GENERATE[uplink-x86.s]=../ms/uplink-x86.pl $(PERLASM_SCHEME)
68--
692.19.1
70
diff --git a/meta/recipes-connectivity/openssl/openssl_1.1.1.bb b/meta/recipes-connectivity/openssl/openssl_1.1.1.bb
index b44089e82e..1234b64b86 100644
--- a/meta/recipes-connectivity/openssl/openssl_1.1.1.bb
+++ b/meta/recipes-connectivity/openssl/openssl_1.1.1.bb
@@ -17,6 +17,7 @@ SRC_URI = "http://www.openssl.org/source/openssl-${PV}.tar.gz \
17 file://0001-skip-test_symbol_presence.patch \ 17 file://0001-skip-test_symbol_presence.patch \
18 file://0002-fix-CVE-2018-0734.patch \ 18 file://0002-fix-CVE-2018-0734.patch \
19 file://0003-fix-CVE-2018-0735.patch \ 19 file://0003-fix-CVE-2018-0735.patch \
20 file://0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch \
20 " 21 "
21 22
22SRC_URI_append_class-nativesdk = " \ 23SRC_URI_append_class-nativesdk = " \