From b1064661ee7fd731962c4d589693c4e04ffe8e59 Mon Sep 17 00:00:00 2001 From: wangmy Date: Tue, 11 Oct 2022 15:58:10 +0800 Subject: gnutls: upgrade 3.7.7 -> 3.7.8 Changelog: ========= ** libgnutls: In FIPS140 mode, RSA signature verification is an approved operation if the key has modulus with known sizes (1024, 1280, 1536, and 1792 bits), in addition to any modulus sizes larger than 2048 bits, according to SP800-131A rev2. ** libgnutls: gnutls_session_channel_binding performs additional checks when GNUTLS_CB_TLS_EXPORTER is requested. According to RFC9622 4.2, the "tls-exporter" channel binding is only usable when the handshake is bound to a unique master secret (i.e., either TLS 1.3 or extended master secret extension is negotiated). Otherwise the function now returns error. ** libgnutls: usage of the following functions, which are designed to loosen restrictions imposed by allowlisting mode of configuration, has been additionally restricted. Invoking them is now only allowed if system-wide TLS priority string has not been initialized yet: gnutls_digest_set_secure gnutls_sign_set_secure gnutls_sign_set_secure_for_certs gnutls_protocol_set_enabled (From OE-Core rev: 858886aa07d0c2c2ef2489996cc8eca5fbe931fa) Signed-off-by: Wang Mingyu Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie --- meta/recipes-support/gnutls/gnutls_3.7.7.bb | 90 ----------------------------- meta/recipes-support/gnutls/gnutls_3.7.8.bb | 90 +++++++++++++++++++++++++++++ 2 files changed, 90 insertions(+), 90 deletions(-) delete mode 100644 meta/recipes-support/gnutls/gnutls_3.7.7.bb create mode 100644 meta/recipes-support/gnutls/gnutls_3.7.8.bb (limited to 'meta/recipes-support/gnutls') diff --git a/meta/recipes-support/gnutls/gnutls_3.7.7.bb b/meta/recipes-support/gnutls/gnutls_3.7.7.bb deleted file mode 100644 index c7d782e4eb..0000000000 --- a/meta/recipes-support/gnutls/gnutls_3.7.7.bb +++ /dev/null @@ -1,90 +0,0 @@ -SUMMARY = "GNU Transport Layer Security Library" -DESCRIPTION = "a secure communications library implementing the SSL, \ -TLS and DTLS protocols and technologies around them." -HOMEPAGE = "https://gnutls.org/" -BUGTRACKER = "https://savannah.gnu.org/support/?group=gnutls" - -LICENSE = "GPL-3.0-or-later & LGPL-2.1-or-later" -LICENSE:${PN} = "LGPL-2.1-or-later" -LICENSE:${PN}-xx = "LGPL-2.1-or-later" -LICENSE:${PN}-bin = "GPL-3.0-or-later" -LICENSE:${PN}-openssl = "GPL-3.0-or-later" - -LIC_FILES_CHKSUM = "file://LICENSE;md5=71391c8e0c1cfe68077e7fce3b586283 \ - file://doc/COPYING;md5=c678957b0c8e964aa6c70fd77641a71e \ - file://doc/COPYING.LESSER;md5=a6f89e2100d9b6cdffcea4f398e37343" - -DEPENDS = "nettle gmp virtual/libiconv libunistring" -DEPENDS:append:libc-musl = " argp-standalone" - -SHRT_VER = "${@d.getVar('PV').split('.')[0]}.${@d.getVar('PV').split('.')[1]}" - -SRC_URI = "https://www.gnupg.org/ftp/gcrypt/gnutls/v${SHRT_VER}/gnutls-${PV}.tar.xz \ - file://arm_eabi.patch \ - file://0001-Creating-.hmac-file-should-be-excuted-in-target-envi.patch \ - " - -SRC_URI[sha256sum] = "be9143d0d58eab64dba9b77114aaafac529b6c0d7e81de6bdf1c9b59027d2106" - -inherit autotools texinfo pkgconfig gettext lib_package gtk-doc - -PACKAGECONFIG ??= "libidn ${@bb.utils.filter('DISTRO_FEATURES', 'seccomp', d)}" - -# You must also have CONFIG_SECCOMP enabled in the kernel for -# seccomp to work. -PACKAGECONFIG[seccomp] = "--with-libseccomp-prefix=${STAGING_EXECPREFIXDIR},ac_cv_libseccomp=no,libseccomp" -PACKAGECONFIG[libidn] = "--with-idn,--without-idn,libidn2" -PACKAGECONFIG[libtasn1] = "--with-included-libtasn1=no,--with-included-libtasn1,libtasn1" -PACKAGECONFIG[p11-kit] = "--with-p11-kit,--without-p11-kit,p11-kit" -PACKAGECONFIG[tpm] = "--with-tpm,--without-tpm,trousers" -PACKAGECONFIG[fips] = "--enable-fips140-mode --with-libdl-prefix=${STAGING_BASELIBDIR}" - -EXTRA_OECONF = " \ - --enable-doc \ - --disable-libdane \ - --disable-guile \ - --disable-rpath \ - --enable-openssl-compatibility \ - --with-libpthread-prefix=${STAGING_DIR_HOST}${prefix} \ - --with-librt-prefix=${STAGING_DIR_HOST}${prefix} \ - --with-default-trust-store-file=${sysconfdir}/ssl/certs/ca-certificates.crt \ -" - -# Otherwise the tools try and use HOSTTOOLS_DIR/bash as a shell. -export POSIX_SHELL="${base_bindir}/sh" - -LDFLAGS:append:libc-musl = " -largp" - -do_configure:prepend() { - for dir in . lib; do - rm -f ${dir}/aclocal.m4 ${dir}/m4/libtool.m4 ${dir}/m4/lt*.m4 - done -} - -do_install:append:class-target() { - if ${@bb.utils.contains('PACKAGECONFIG', 'fips', 'true', 'false', d)}; then - install -d ${D}${bindir}/bin - install -m 0755 ${B}/lib/.libs/fipshmac ${D}/${bindir}/ - fi -} - -PACKAGES =+ "${PN}-openssl ${PN}-xx ${PN}-fips" - -FILES:${PN}-dev += "${bindir}/gnutls-cli-debug" -FILES:${PN}-openssl = "${libdir}/libgnutls-openssl.so.*" -FILES:${PN}-xx = "${libdir}/libgnutlsxx.so.*" -FILES:${PN}-fips = "${bindir}/fipshmac" - -BBCLASSEXTEND = "native nativesdk" - -pkg_postinst_ontarget:${PN}-fips () { - if test -x ${bindir}/fipshmac - then - mkdir ${sysconfdir}/gnutls - touch ${sysconfdir}/gnutls/config - ${bindir}/fipshmac ${libdir}/libgnutls.so.30.*.* > ${libdir}/.libgnutls.so.30.hmac - ${bindir}/fipshmac ${libdir}/libnettle.so.8.* > ${libdir}/.libnettle.so.8.hmac - ${bindir}/fipshmac ${libdir}/libgmp.so.10.*.* > ${libdir}/.libgmp.so.10.hmac - ${bindir}/fipshmac ${libdir}/libhogweed.so.6.* > ${libdir}/.libhogweed.so.6.hmac - fi -} diff --git a/meta/recipes-support/gnutls/gnutls_3.7.8.bb b/meta/recipes-support/gnutls/gnutls_3.7.8.bb new file mode 100644 index 0000000000..8f979a5b99 --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls_3.7.8.bb @@ -0,0 +1,90 @@ +SUMMARY = "GNU Transport Layer Security Library" +DESCRIPTION = "a secure communications library implementing the SSL, \ +TLS and DTLS protocols and technologies around them." +HOMEPAGE = "https://gnutls.org/" +BUGTRACKER = "https://savannah.gnu.org/support/?group=gnutls" + +LICENSE = "GPL-3.0-or-later & LGPL-2.1-or-later" +LICENSE:${PN} = "LGPL-2.1-or-later" +LICENSE:${PN}-xx = "LGPL-2.1-or-later" +LICENSE:${PN}-bin = "GPL-3.0-or-later" +LICENSE:${PN}-openssl = "GPL-3.0-or-later" + +LIC_FILES_CHKSUM = "file://LICENSE;md5=71391c8e0c1cfe68077e7fce3b586283 \ + file://doc/COPYING;md5=c678957b0c8e964aa6c70fd77641a71e \ + file://doc/COPYING.LESSER;md5=a6f89e2100d9b6cdffcea4f398e37343" + +DEPENDS = "nettle gmp virtual/libiconv libunistring" +DEPENDS:append:libc-musl = " argp-standalone" + +SHRT_VER = "${@d.getVar('PV').split('.')[0]}.${@d.getVar('PV').split('.')[1]}" + +SRC_URI = "https://www.gnupg.org/ftp/gcrypt/gnutls/v${SHRT_VER}/gnutls-${PV}.tar.xz \ + file://arm_eabi.patch \ + file://0001-Creating-.hmac-file-should-be-excuted-in-target-envi.patch \ + " + +SRC_URI[sha256sum] = "c58ad39af0670efe6a8aee5e3a8b2331a1200418b64b7c51977fb396d4617114" + +inherit autotools texinfo pkgconfig gettext lib_package gtk-doc + +PACKAGECONFIG ??= "libidn ${@bb.utils.filter('DISTRO_FEATURES', 'seccomp', d)}" + +# You must also have CONFIG_SECCOMP enabled in the kernel for +# seccomp to work. +PACKAGECONFIG[seccomp] = "--with-libseccomp-prefix=${STAGING_EXECPREFIXDIR},ac_cv_libseccomp=no,libseccomp" +PACKAGECONFIG[libidn] = "--with-idn,--without-idn,libidn2" +PACKAGECONFIG[libtasn1] = "--with-included-libtasn1=no,--with-included-libtasn1,libtasn1" +PACKAGECONFIG[p11-kit] = "--with-p11-kit,--without-p11-kit,p11-kit" +PACKAGECONFIG[tpm] = "--with-tpm,--without-tpm,trousers" +PACKAGECONFIG[fips] = "--enable-fips140-mode --with-libdl-prefix=${STAGING_BASELIBDIR}" + +EXTRA_OECONF = " \ + --enable-doc \ + --disable-libdane \ + --disable-guile \ + --disable-rpath \ + --enable-openssl-compatibility \ + --with-libpthread-prefix=${STAGING_DIR_HOST}${prefix} \ + --with-librt-prefix=${STAGING_DIR_HOST}${prefix} \ + --with-default-trust-store-file=${sysconfdir}/ssl/certs/ca-certificates.crt \ +" + +# Otherwise the tools try and use HOSTTOOLS_DIR/bash as a shell. +export POSIX_SHELL="${base_bindir}/sh" + +LDFLAGS:append:libc-musl = " -largp" + +do_configure:prepend() { + for dir in . lib; do + rm -f ${dir}/aclocal.m4 ${dir}/m4/libtool.m4 ${dir}/m4/lt*.m4 + done +} + +do_install:append:class-target() { + if ${@bb.utils.contains('PACKAGECONFIG', 'fips', 'true', 'false', d)}; then + install -d ${D}${bindir}/bin + install -m 0755 ${B}/lib/.libs/fipshmac ${D}/${bindir}/ + fi +} + +PACKAGES =+ "${PN}-openssl ${PN}-xx ${PN}-fips" + +FILES:${PN}-dev += "${bindir}/gnutls-cli-debug" +FILES:${PN}-openssl = "${libdir}/libgnutls-openssl.so.*" +FILES:${PN}-xx = "${libdir}/libgnutlsxx.so.*" +FILES:${PN}-fips = "${bindir}/fipshmac" + +BBCLASSEXTEND = "native nativesdk" + +pkg_postinst_ontarget:${PN}-fips () { + if test -x ${bindir}/fipshmac + then + mkdir ${sysconfdir}/gnutls + touch ${sysconfdir}/gnutls/config + ${bindir}/fipshmac ${libdir}/libgnutls.so.30.*.* > ${libdir}/.libgnutls.so.30.hmac + ${bindir}/fipshmac ${libdir}/libnettle.so.8.* > ${libdir}/.libnettle.so.8.hmac + ${bindir}/fipshmac ${libdir}/libgmp.so.10.*.* > ${libdir}/.libgmp.so.10.hmac + ${bindir}/fipshmac ${libdir}/libhogweed.so.6.* > ${libdir}/.libhogweed.so.6.hmac + fi +} -- cgit v1.2.3-54-g00ecf