linux/poky.git/meta/recipes-connectivity/openssl/files, branch master

The poky repository master branch is no longer being updated.

2025-11-07T13:31:53+00:00

You can either: a) switch to individual clones of bitbake, openembedded-core, meta-yocto and yocto-docs b) use the new bitbake-setup You can find information about either approach in our documentation: https://docs.yoctoproject.org/ Note that "poky" the distro setting is still available in meta-yocto as before and we continue to use and maintain that. Long live Poky! Some further information on the background of this change can be found in: https://lists.openembedded.org/g/openembedded-architecture/message/2179 Signed-off-by: Richard Purdie

buildtools-tarball: fix unbound variable issues under 'set -u'

2025-09-15T16:57:23+00:00

When Bash runs with 'set -u' (nounset), accessing an unset variable directly (e.g. [ -z "$SSL_CERT_FILE" ]) causes a fatal "unbound variable" error. As a result, the fallback logic to set SSL_CERT_FILE/SSL_CERT_DIR is never triggered and the script aborts. The current code assumes these variables may be unset or empty, but does not guard against 'set -u'. This breaks builds in stricter shell environments or when users explicitly enable 'set -u'. Fix this by using parameter expansion with a default value, e.g. "${SSL_CERT_FILE:-}", so that unset variables are treated as empty strings. This preserves the intended logic (respect host env first, then CAFILE/CAPATH, then buildtools defaults) and makes the script robust under 'set -u'. (From OE-Core rev: 4d880c2eccd534133a2a4e6579d955605c0956ec) Signed-off-by: Haixiao Yan Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

buildtools-tarball: Make buildtools respects host CA certificates

2025-04-24T10:27:06+00:00

To adapt user network enviroment, buildtools should first try to use the user configured envs like SSL_CERT_FILE/CURL_CA_BUNDLE/..., if these envs is not set, then use the auto-detected ca file and ca path, and finally use the CA certificates in buildtools. nativesdk-openssl set OPENSSLDIR as "/not/builtin", need set SSL_CERT_FILE/SSL_CERT_DIR to work nativesdk-curl don't set default ca file, need SSL_CERT_FILE/SSL_CERT_DIR or CURL_CA_BUNDLE/CURL_CA_PATH to work nativesdk-git actually use libcurl, and GIT_SSL_CAPATH/GIT_SSL_CAINFO also works nativesdk-python3-requests will use cacert.pem under python module certifi by default, need to set REQUESTS_CA_BUNDLE (From OE-Core rev: 8a7ec52e9b35654bee48cd948c6c34c63db3e265) Signed-off-by: Changqing Li Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

buildtools-tarball: move setting of envvars to respective envfile

2025-04-11T10:49:59+00:00

* make git,curl,python3-requests align with openssl, move the setting of envvars into respective envfile * for environment.d-openssl.sh, also check if ca-certificates.crt exist before export envvars (From OE-Core rev: 9d8ebfcd55ad274e79cb81f162397c8f39f4287b) Signed-off-by: Changqing Li Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

openssl: fold result of sed invocation into environment file

2025-02-27T10:55:16+00:00

A long time ago, the environment.d-openssl.sh file was shared between openssl 1.0 and openssl 1.1 recipes, and sed was used to make the path right for the 1.1 version. Nowadays, with only a single recipe, this is a bit roundabout, so just use the proper path in the file directly. (From OE-Core rev: 291fe7db623b0974e7831e908e91b1f1259e0506) Signed-off-by: Rasmus Villemoes Signed-off-by: Richard Purdie

openssl: Fix SDK environment script to avoid unbound variable

2024-11-01T11:53:26+00:00

Avoid errors like: buildtools/sysroots/x86_64-pokysdk-linux/environment-setup.d/openssl.sh: line 6: BB_ENV_PASSTHROUGH_ADDITIONS: unbound variable by setting an explicit empty default value. (From OE-Core rev: 5a2a4910a22668f25679a47deaa9e2ed28665efa) Signed-off-by: Richard Purdie

openssl: Add passthrough variables to work with bitbake

2024-06-04T20:37:13+00:00

Now that bitbake uses websockets over SSL as hashserv and is correctly limiting hash equivalence only to things in the orginal SDK, bitbake builds from buildtools can fail due to broken SSL from buildtools. The issue is that the relocation variables are being removed from the environment. This could be fixed within bitbake or it could be fixed within the SDK environment. This patch does the latter for now. We really need to improve openssl relocation within the SDK in general. Fixing this has become more urgent to fix failing builds in automated testing. (From OE-Core rev: 6a20667c166fa3d7e2b6e8e8b442dec0fc75f349) Signed-off-by: Richard Purdie

openssl: Fix SSL_CERT_FILE to match ca-certs location

2022-10-26T22:01:01+00:00

In OE-Core d6b15d1e70b99185cf245d829ada5b6fb99ec1af, "openssl: export necessary env vars in SDK", the value added for SSL_CERT_FILE was in conflict with the value used elsewhere, such as in buildtools. This makes them match and fixes buildtools testsdk failures. (From OE-Core rev: 7d383a7fc6da666c80f2fc037af5f49a3388eb2b) Signed-off-by: Richard Purdie

openssl: export necessary env vars in SDK

2022-10-25T12:42:03+00:00

In current SDK, when running the following command in python shell, we get an error. $ python3 >>> from cryptography.hazmat.backends import openssl The error message is as below: cryptography.exceptions.InternalError: Unknown OpenSSL error. We could set OPENSSL_MODULES explicitly in nativesdk-openssl package so that when SDK is set up, it's in environment and we can get rid of the above error. Also, there are other env vars that need to be exported. And we export all of them to keep sync with openssl-native.bbclass. (From OE-Core rev: d6b15d1e70b99185cf245d829ada5b6fb99ec1af) Signed-off-by: Chen Qi Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

openssl: rename openssl 1.0.x to openssl10 and make openssl 1.1.x the default version

2018-09-04T10:03:56+00:00

I believe the time has come to do this: openssl 1.0 upstream support stops at the end of 2019, and we do not want a situation where a supported YP release contains an unsupported version of a critical security component. Openssl 1.0 can still be utilized by depending on 'openssl10' recipe. (From OE-Core rev: 876466145f2da93757ba3f92177d0f959f5fe975) Signed-off-by: Alexander Kanavin Signed-off-by: Richard Purdie