Skip to content
Snippets Groups Projects
  • Eneas U de Queiroz's avatar
    0dc5fc8f
    openssl: add legacy provider · 0dc5fc8f
    Eneas U de Queiroz authored
    
    This adapts the engine build infrastructure to allow building providers,
    and packages the legacy provider.  Providers are the successors of
    engines, which have been deprecated.
    
    The legacy provider supplies OpenSSL implementations of algorithms that
    have been deemed legacy, including DES, IDEA, MDC2, SEED, and Whirlpool.
    
    Even though these algorithms are implemented in a separate package,
    their removal makes the regular library smaller by 3%, so the build
    options will remain to allow lean custom builds.  Their defaults will
    change to 'y' if not bulding for a small flash, so that the regular
    legacy package will contain a complete set of algorithms.
    
    The engine build and configuration structure was changed to accomodate
    providers, and adapt to the new style of openssl.cnf in version 3.0.
    
    There is not a clean upgrade path for the /etc/ssl/openssl.cnf file,
    installed by the openssl-conf package.  It is recommended to rename or
    remove the old config file when flashing an image with the updated
    openssl-conf package, then apply the changes manually.
    
    An old openssl.cnf file will silently work, but new engine or provider
    packages will not be enabled.  Any remaining engine config files under
    /etc/ssl/engines.cnf.d can be removed.
    
    On the build side, the include file used by engine packages was renamed
    to openssl-module.mk, so the engine packages in other feeds need to
    adapt.
    
    Signed-off-by: default avatarEneas U de Queiroz <cotequeiroz@gmail.com>
    openssl: add legacy provider
    Eneas U de Queiroz authored
    
    This adapts the engine build infrastructure to allow building providers,
    and packages the legacy provider.  Providers are the successors of
    engines, which have been deprecated.
    
    The legacy provider supplies OpenSSL implementations of algorithms that
    have been deemed legacy, including DES, IDEA, MDC2, SEED, and Whirlpool.
    
    Even though these algorithms are implemented in a separate package,
    their removal makes the regular library smaller by 3%, so the build
    options will remain to allow lean custom builds.  Their defaults will
    change to 'y' if not bulding for a small flash, so that the regular
    legacy package will contain a complete set of algorithms.
    
    The engine build and configuration structure was changed to accomodate
    providers, and adapt to the new style of openssl.cnf in version 3.0.
    
    There is not a clean upgrade path for the /etc/ssl/openssl.cnf file,
    installed by the openssl-conf package.  It is recommended to rename or
    remove the old config file when flashing an image with the updated
    openssl-conf package, then apply the changes manually.
    
    An old openssl.cnf file will silently work, but new engine or provider
    packages will not be enabled.  Any remaining engine config files under
    /etc/ssl/engines.cnf.d can be removed.
    
    On the build side, the include file used by engine packages was renamed
    to openssl-module.mk, so the engine packages in other feeds need to
    adapt.
    
    Signed-off-by: default avatarEneas U de Queiroz <cotequeiroz@gmail.com>