pool/openssl-3
SHA256
2
0
Fork 2
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Accepting request 1234617 from security:tls

Browse Source 
OBS-URL: https://build.opensuse.org/request/show/1234617
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl-3?expand=0&rev=35
This commit is contained in:
Ana Guerrero 2025-01-05 14:27:00 +00:00 committed by Git OBS Bridge
commit 8853ae0bcf
4 changed files with 43 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
openssl-3.changes
View File

@ -1,3 +1,17 @@
-------------------------------------------------------------------
Mon Dec 23 20:14:08 UTC 2024 - Giuliano Belinassi <giuliano.belinassi@suse.com>
- Add support for userspace livepatching on ppc64le (jsc#PED-11850).
- Use gcc-13 for ppc64le.
-------------------------------------------------------------------
Tue Dec 17 12:42:19 UTC 2024 - Pedro Monreal <pmonreal@suse.com>
- Fix evp_properties section in the openssl.cnf file [bsc#1234647]
* Rebase patches:
- openssl-Add-support-for-PROFILE-SYSTEM-system-default-cipher.patch
- openssl-TESTS-Disable-default-provider-crypto-policies.patch
-------------------------------------------------------------------
Tue Nov 12 15:46:20 UTC 2024 - Pedro Monreal <pmonreal@suse.com>

31
openssl-3.spec
View File

@ -1,7 +1,7 @@
#
# spec file for package openssl-3
#
# Copyright (c) 2024 SUSE LLC
# Copyright (c) 2025 SUSE LLC
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
@ -146,13 +146,20 @@ Patch65: openssl-3-fix-sha3-squeeze-ppc64.patch
Patch66: openssl-3-fix-quic_multistream_test.patch
BuildRequires: pkgconfig
%if 0%{?sle_version} >= 150400 || 0%{?suse_version} >= 1550
# ulp-macros is available according to SUSE version.
%ifarch x86_64
%if 0%{?sle_version} >= 150400 || 0%{?suse_version} >= 1540
BuildRequires: ulp-macros
%else
# Define ulp-macros macros as empty
%define cflags_livepatching ""
%define pack_ipa_dumps echo "Livepatching is disabled in this build"
%endif
%endif
%ifarch ppc64le
%if 0%{?sle_version} >= 150700 || 0%{?suse_version} >= 1570
BuildRequires: gcc13
BuildRequires: ulp-macros
%endif
%endif
BuildRequires: pkgconfig
BuildRequires: pkgconfig(zlib)
Requires: libopenssl3 = %{version}-%{release}
@ -246,6 +253,14 @@ export MACHINE=armv5el
export MACHINE=armv6l
%endif
# In ppc64le we need gcc-13 for userspace livepatching until we have the
# required -fpatchable-functions-entry patch merged into the mainline
%ifarch ppc64le
%if 0%{?sle_version} >= 150700 || 0%{?suse_version} >= 1570
export CC=gcc-13
export CXX=g++-13
%endif
%endif
./Configure \
enable-camellia \
%ifarch x86_64 aarch64 ppc64le
@ -264,7 +279,7 @@ export MACHINE=armv6l
--libdir=%{_lib} \
--openssldir=%{ssletcdir} \
%{optflags} \
%{cflags_livepatching} \
%{?cflags_livepatching} \
-Wa,--noexecstack \
-Wl,-z,relro,-z,now \
-fno-common \
@ -324,7 +339,7 @@ gcc -o showciphers %{optflags} -I%{buildroot}%{_includedir} %{SOURCE5} -L%{build
LD_LIBRARY_PATH=%{buildroot}%{_libdir} ./showciphers
%install
%{pack_ipa_dumps}
%{?pack_ipa_dumps}
%make_install %{?_smp_mflags} MANSUFFIX=%{man_suffix}
rename so.%{sover} so.%{version} %{buildroot}%{_libdir}/*.so.%{sover}

3
openssl-Add-support-for-PROFILE-SYSTEM-system-default-cipher.patch
View File

@ -322,12 +322,13 @@ Index: openssl-3.2.3/apps/openssl.cnf
===================================================================
--- openssl-3.2.3.orig/apps/openssl.cnf
+++ openssl-3.2.3/apps/openssl.cnf
@@ -52,6 +52,11 @@ tsa_policy3 = 1.2.3.4.5.7
@@ -52,6 +52,12 @@ tsa_policy3 = 1.2.3.4.5.7
[openssl_init]
providers = provider_sect
+# Load default TLS policy configuration
+ssl_conf = ssl_module
+alg_section = evp_properties
+
+[ evp_properties ]
+# This section is intentionally added empty here to be tuned on particular systems

6
openssl-TESTS-Disable-default-provider-crypto-policies.patch
View File

@ -2,16 +2,18 @@ Index: openssl-3.2.3/apps/openssl.cnf
===================================================================
--- openssl-3.2.3.orig/apps/openssl.cnf
+++ openssl-3.2.3/apps/openssl.cnf
@@ -45,7 +45,7 @@ tsa_policy3 = 1.2.3.4.5.7
@@ -45,8 +45,8 @@ tsa_policy3 = 1.2.3.4.5.7
[openssl_init]
providers = provider_sect
# Load default TLS policy configuration
-ssl_conf = ssl_module
-alg_section = evp_properties
+##ssl_conf = ssl_module
+##alg_section = evp_properties
[ evp_properties ]
# This section is intentionally added empty here to be tuned on particular systems
@@ -60,20 +60,20 @@ ssl_conf = ssl_module
@@ -61,20 +61,20 @@ alg_section = evp_properties
# to side-channel attacks and as such have been deprecated.
[provider_sect]