mirror of
https://git.yoctoproject.org/meta-security
synced 2026-01-12 03:10:13 +00:00
tpm2-pkcs11: update to 1.8.0
The build patches are now included in the upstream, the local binary checkes can be disabled with --disable-ptool-checks, the boostrap doesn't need to be called if the release .tar.gz is used. Signed-off-by: Petr Gotthard <petr.gotthard@advantech.cz> Signed-off-by: Armin Kuster <akuster808@gmail.com>
This commit is contained in:
Petr Gotthard
committed by
Armin Kuster
Armin Kuster
parent
f576e38379
commit
d4fffc44f3
@@ -1,77 +0,0 @@
|
||||
From 9e3ef6f253f9427596baf3e7d748a79854cadfa9 Mon Sep 17 00:00:00 2001
|
||||
From: Armin Kuster <akuster808@gmail.com>
|
||||
Date: Wed, 14 Oct 2020 08:55:33 -0700
|
||||
Subject: [PATCH] remove local binary checkes
|
||||
|
||||
Signed-off-by: Armin Kuster <akuster808@gmail.com>
|
||||
|
||||
Upsteam-Status: Inappropriate
|
||||
These are only needed to run on the tartget so we add an RDPENDS.
|
||||
Not needed for building.
|
||||
|
||||
---
|
||||
configure.ac | 48 ------------------------------------------------
|
||||
1 file changed, 48 deletions(-)
|
||||
|
||||
diff --git a/configure.ac b/configure.ac
|
||||
index 50e7d4b..2b9abcf 100644
|
||||
--- a/configure.ac
|
||||
+++ b/configure.ac
|
||||
@@ -219,54 +219,6 @@ AX_PROG_JAVAC()
|
||||
AX_PROG_JAVA()
|
||||
m4_popdef([AC_MSG_ERROR])
|
||||
|
||||
-AC_CHECK_PROG([tpm2_createprimary], [tpm2_createprimary], [yes], [no])
|
||||
- AS_IF([test "x$tpm2_createprimary" != "xyes"],
|
||||
- [AC_MSG_ERROR([tpm2_ptool requires tpm2_createprimary, but executable not found.])])
|
||||
-
|
||||
-AC_CHECK_PROG([tpm2_create], [tpm2_create], [yes], [no])
|
||||
- AS_IF([test "x$tpm2_create" != "xyes"],
|
||||
- [AC_MSG_ERROR([tpm2_ptool requires tpm2_create, but executable not found.])])
|
||||
-
|
||||
-AC_CHECK_PROG([tpm2_evictcontrol], [tpm2_evictcontrol], [yes], [no])
|
||||
- AS_IF([test "x$tpm2_evictcontrol" != "xyes"],
|
||||
- [AC_MSG_ERROR([tpm2_ptool requires tpm2_evictcontrol, but executable not found.])])
|
||||
-
|
||||
-AC_CHECK_PROG([tpm2_readpublic], [tpm2_readpublic], [yes], [no])
|
||||
- AS_IF([test "x$tpm2_readpublic" != "xyes"],
|
||||
- [AC_MSG_ERROR([tpm2_ptool requires tpm2_readpublic, but executable not found.])])
|
||||
-
|
||||
-AC_CHECK_PROG([tpm2_load], [tpm2_load], [yes], [no])
|
||||
- AS_IF([test "x$tpm2_load" != "xyes"],
|
||||
- [AC_MSG_ERROR([tpm2_ptool requires tpm2_load, but executable not found.])])
|
||||
-
|
||||
-AC_CHECK_PROG([tpm2_loadexternal], [tpm2_loadexternal], [yes], [no])
|
||||
- AS_IF([test "x$tpm2_loadexternal" != "xyes"],
|
||||
- [AC_MSG_ERROR([tpm2_ptool requires tpm2_loadexternal, but executable not found.])])
|
||||
-
|
||||
-AC_CHECK_PROG([tpm2_unseal], [tpm2_unseal], [yes], [no])
|
||||
- AS_IF([test "x$tpm2_unseal" != "xyes"],
|
||||
- [AC_MSG_ERROR([tpm2_ptool requires tpm2_unseal, but executable not found.])])
|
||||
-
|
||||
-AC_CHECK_PROG([tpm2_encryptdecrypt], [tpm2_encryptdecrypt], [yes], [no])
|
||||
- AS_IF([test "x$tpm2_encryptdecrypt" != "xyes"],
|
||||
- [AC_MSG_ERROR([tpm2_ptool requires tpm2_encryptdecrypt, but executable not found.])])
|
||||
-
|
||||
-AC_CHECK_PROG([tpm2_sign], [tpm2_sign], [yes], [no])
|
||||
- AS_IF([test "x$tpm2_sign" != "xyes"],
|
||||
- [AC_MSG_ERROR([tpm2_ptool requires tpm2_sign, but executable not found.])])
|
||||
-
|
||||
-AC_CHECK_PROG([tpm2_getcap], [tpm2_getcap], [yes], [no])
|
||||
- AS_IF([test "x$tpm2_getcap" != "xyes"],
|
||||
- [AC_MSG_ERROR([tpm2_ptool requires tpm2_getcap, but executable not found.])])
|
||||
-
|
||||
-AC_CHECK_PROG([tpm2_import], [tpm2_import], [yes], [no])
|
||||
- AS_IF([test "x$tpm2_import" != "xyes"],
|
||||
- [AC_MSG_ERROR([tpm2_ptool requires tpm2_import, but executable not found.])])
|
||||
-
|
||||
-AC_CHECK_PROG([tpm2_changeauth], [tpm2_changeauth], [yes], [no])
|
||||
- AS_IF([test "x$tpm2_changeauth" != "xyes"],
|
||||
- [AC_MSG_ERROR([tpm2_ptool requires tpm2_changeauth, but executable not found.])])
|
||||
-
|
||||
AC_DEFUN([integration_test_checks], [
|
||||
|
||||
PKG_CHECK_MODULES([OPENSC_PKCS11],[opensc-pkcs11],,
|
||||
--
|
||||
2.17.1
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,93 +0,0 @@
|
||||
From d33e5ef0b11125fe4683d7bfa17023e24997f587 Mon Sep 17 00:00:00 2001
|
||||
From: William Roberts <william.c.roberts@intel.com>
|
||||
Date: Fri, 3 Sep 2021 11:30:50 -0500
|
||||
Subject: [PATCH 2/2] ossl: require version 1.1.0 or greater
|
||||
|
||||
THIS DROPS SUPPORT FOR OSSL 1.0.2.
|
||||
|
||||
Signed-off-by: William Roberts <william.c.roberts@intel.com>
|
||||
|
||||
Upstream-Status: Backport
|
||||
Signed-off-by: Armin Kuster <akuster808@gmail.com>
|
||||
---
|
||||
configure.ac | 2 +-
|
||||
src/lib/ssl_util.h | 43 +++++--------------------------------------
|
||||
2 files changed, 6 insertions(+), 39 deletions(-)
|
||||
|
||||
diff --git a/configure.ac b/configure.ac
|
||||
index a7aeaf5..94fb5d4 100644
|
||||
--- a/configure.ac
|
||||
+++ b/configure.ac
|
||||
@@ -55,7 +55,7 @@ PKG_CHECK_EXISTS([tss2-esys >= 3.0],
|
||||
# require sqlite3 and libcrypto
|
||||
PKG_CHECK_MODULES([SQLITE3], [sqlite3])
|
||||
PKG_CHECK_MODULES([YAML], [yaml-0.1])
|
||||
-PKG_CHECK_MODULES([CRYPTO], [libcrypto >= 1.0.2g])
|
||||
+PKG_CHECK_MODULES([CRYPTO], [libcrypto >= 1.1.0])
|
||||
|
||||
# check for pthread
|
||||
AX_PTHREAD([],[AC_MSG_ERROR([Cannot find pthread])])
|
||||
diff --git a/src/lib/ssl_util.h b/src/lib/ssl_util.h
|
||||
index 9909fd6..2591728 100644
|
||||
--- a/src/lib/ssl_util.h
|
||||
+++ b/src/lib/ssl_util.h
|
||||
@@ -15,51 +15,18 @@
|
||||
#include "log.h"
|
||||
#include "twist.h"
|
||||
|
||||
-#if (OPENSSL_VERSION_NUMBER < 0x1010000fL && !defined(LIBRESSL_VERSION_NUMBER)) || (defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x20700000L) /* OpenSSL 1.1.0 */
|
||||
-#define LIB_TPM2_OPENSSL_OPENSSL_PRE11
|
||||
-/* LibreSSL does not appear to have evperr.h, so their is no need to define this otherwise */
|
||||
-#elif (OPENSSL_VERSION_NUMBER >= 0x1010100fL) /* OpenSSL 1.1.1 */
|
||||
+#if (OPENSSL_VERSION_NUMBER >= 0x1010100fL) /* OpenSSL 1.1.1 */
|
||||
#define LIB_TPM2_OPENSSL_OPENSSL_POST111 0x1010100f
|
||||
#endif
|
||||
|
||||
-#if (OPENSSL_VERSION_NUMBER >= 0x30000000) /* OpenSSL 3.0.0 */
|
||||
-#define LIB_TPM2_OPENSSL_OPENSSL_POST300 0x1010100f
|
||||
+#if defined(LIB_TPM2_OPENSSL_OPENSSL_POST111)
|
||||
+#include <openssl/evperr.h>
|
||||
#endif
|
||||
|
||||
-/* OpenSSL Backwards Compat APIs */
|
||||
-#if defined(LIB_TPM2_OPENSSL_OPENSSL_PRE11)
|
||||
-#include <string.h>
|
||||
-size_t EC_POINT_point2buf(const EC_GROUP *group, const EC_POINT *point,
|
||||
- point_conversion_form_t form,
|
||||
- unsigned char **pbuf, BN_CTX *ctx);
|
||||
-
|
||||
-const unsigned char *ASN1_STRING_get0_data(const ASN1_STRING *x);
|
||||
-
|
||||
-int RSA_set0_key(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d);
|
||||
-
|
||||
-int ECDSA_SIG_set0(ECDSA_SIG *sig, BIGNUM *r, BIGNUM *s);
|
||||
-
|
||||
-EC_KEY *EVP_PKEY_get0_EC_KEY(EVP_PKEY *pkey);
|
||||
-
|
||||
-static inline void *OPENSSL_memdup(const void *dup, size_t l) {
|
||||
-
|
||||
- void *p = OPENSSL_malloc(l);
|
||||
- if (!p) {
|
||||
- return NULL;
|
||||
- }
|
||||
-
|
||||
- memcpy(p, dup, l);
|
||||
- return p;
|
||||
-}
|
||||
-
|
||||
-#endif
|
||||
-
|
||||
-#ifndef RSA_PSS_SALTLEN_DIGEST
|
||||
-#define RSA_PSS_SALTLEN_DIGEST -1
|
||||
+#if (OPENSSL_VERSION_NUMBER >= 0x30000000) /* OpenSSL 3.0.0 */
|
||||
+#define LIB_TPM2_OPENSSL_OPENSSL_POST300 0x1010100f
|
||||
#endif
|
||||
|
||||
-/* Utility APIs */
|
||||
-
|
||||
#define SSL_UTIL_LOGE(m) LOGE("%s: %s", m, ERR_error_string(ERR_get_error(), NULL));
|
||||
|
||||
CK_RV ssl_util_attrs_to_evp(attr_list *attrs, EVP_PKEY **outpkey);
|
||||
--
|
||||
2.25.1
|
||||
|
||||
@@ -1,12 +0,0 @@
|
||||
Upstream-Status: OE specific
|
||||
Signed-off-by: Armin Kuster <akuster808@gmail.com>
|
||||
|
||||
Index: git/bootstrap
|
||||
===================================================================
|
||||
--- git.orig/bootstrap
|
||||
+++ git/bootstrap
|
||||
@@ -27,4 +27,3 @@ echo "Generating file lists: ${VARS_FILE
|
||||
) > ${VARS_FILE}
|
||||
|
||||
mkdir -p m4
|
||||
-${AUTORECONF} --install --sym $@
|
||||
@@ -6,21 +6,17 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=0fc19f620a102768d6dbd1e7166e78ab"
|
||||
|
||||
DEPENDS = "autoconf-archive pkgconfig sqlite3 openssl libtss2-dev tpm2-tools libyaml p11-kit python3-setuptools-native"
|
||||
|
||||
SRC_URI = "git://github.com/tpm2-software/tpm2-pkcs11.git;branch=master;protocol=https \
|
||||
file://bootstrap_fixup.patch \
|
||||
file://0001-remove-local-binary-checkes.patch \
|
||||
file://0001-ssl-compile-against-OSSL-3.0.patch \
|
||||
file://0002-ossl-require-version-1.1.0-or-greater.patch \
|
||||
"
|
||||
SRC_URI = "https://github.com/tpm2-software/${BPN}/releases/download/${PV}/${BPN}-${PV}.tar.gz"
|
||||
|
||||
SRCREV = "11fd2532ce10e97834a57dfb25bff6c613a5a851"
|
||||
|
||||
S = "${WORKDIR}/git"
|
||||
SRC_URI[sha256sum] = "79f28899047defd6b4b72b7268dd56abf27774954022315f818c239af33e05bd"
|
||||
|
||||
inherit autotools-brokensep pkgconfig python3native
|
||||
|
||||
do_configure:prepend () {
|
||||
${S}/bootstrap
|
||||
EXTRA_OECONF += "--disable-ptool-checks"
|
||||
|
||||
do_configure:prepend() {
|
||||
# do not extract the version number from git
|
||||
sed -i -e 's/m4_esyscmd_s(\[git describe --tags --always --dirty\])/${PV}/' ${S}/configure.ac
|
||||
}
|
||||
|
||||
do_compile:append() {
|
||||
Reference in New Issue
Block a user