Skip to content

Commit 5f42405

Browse files
craigcomstockcraigcomstock
committed
Changed all rhel-based packages to use vendored openssl
Previous issues with libpam modules linking to a different openssl version/api are no longer an issue. Ticket: ENT-13750 Changelog: title (cherry picked from commit 0e1f4e3) Conflicts: README.md build-scripts/compile-options build-scripts/package ci/fix-buildhost.sh deps-packaging/libcurl/cfbuild-libcurl.spec packaging/cfengine-nova/cfengine-nova.spec.in Many conflicts, some due to big refactor of scripts in master.
1 parent 9ecd500 commit 5f42405

9 files changed

Lines changed: 11 additions & 79 deletions

File tree

‎build-scripts/compile-options‎

Lines changed: 7 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -34,20 +34,9 @@ export PROJECT
3434
# When running manually, you can just export this variable.
3535
# It's a flag: if it's set to 1 - then we use system OpenSSL.
3636
# Otherwise, we build it.
37-
if [ x"$SYSTEM_SSL" = x ]
38-
then
39-
# default to using cfengine openssl
40-
SYSTEM_SSL=0
41-
# We don't bundle OpenSSL on some redhat-derived systems due to incompatability with libpam and our openssl.
42-
_OS_MAJOR_VERSION="$(echo "$OS_VERSION" | cut -d. -f1)"
43-
if [ "$OS" = "rhel" ] && expr "$_OS_MAJOR_VERSION" ">=" "8" >/dev/null
44-
then
45-
SYSTEM_SSL=1
46-
fi
47-
if [ "$OS" = "opensuse" ] || [ "$OS" = "sles" ]
48-
then
49-
if expr "$_OS_MAJOR_VERSION" ">=" "15"
50-
then
37+
if [ -z "$SYSTEM_SSL" ]; then
38+
if [ "$OS" = "opensuse" ] || [ "$OS" = "sles" ]; then
39+
if [ "$OS_VERSION_MAJOR" -ge "15" ]; then
5140
SYSTEM_SSL=1
5241
fi
5342
fi
@@ -119,6 +108,10 @@ case "$OS_FAMILY" in
119108
esac
120109

121110
var_append DEPS "$EMBEDDED_DB pcre2"
111+
if [ "$SYSTEM_SSL" != 1 ]; then
112+
# zlib is a compression library which is a dependency of OpenSSL.
113+
# TODO: can we remove zlib dependency? (CFE-4013)
114+
var_append DEPS "zlib"
122115

123116
if ! [ x"$SYSTEM_SSL" = x1 ]
124117
then

‎build-scripts/package‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -149,18 +149,12 @@ case "$PACKAGING" in
149149
echo "error: unable to determine selinux-policy package version"
150150
exit 1
151151
fi
152-
OPENSSL_VERSION=$(rpm -q --provides openssl-libs | grep OPENSSL_ | sed 's/^.*_\([0-9.]*\).*$/\1/' | sort -n | tail -1)
153-
if [ -z "$OPENSSL_VERSION" ]; then
154-
echo "error: unable to determine openssl package version"
155-
exit 1
156-
fi
157152
fi
158153

159154
sed \
160155
-e "s/@@VERSION@@/$RPM_VERSION/g" \
161156
-e "s/@@RELEASE@@/$safe_prefix$RPM_RELEASE/g" \
162157
-e "s/@@SELINUX_POLICY_VERSION@@/$SELINUX_POLICY_VERSION/g" \
163-
-e "s/@@OPENSSL_VERSION@@/$OPENSSL_VERSION/g" \
164158
-e "/^%pre\$/r $PREINSTALL" \
165159
-e "/^%post\$/r $POSTINSTALL" \
166160
-e "/^%preun\$/r $PREREMOVE" \

‎ci/cfengine-build-host-setup.cf‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -123,17 +123,13 @@ bundle agent cfengine_build_host_setup
123123
"platform-python-devel" -> { "cfbs shebang", "ENT-11338" }
124124
comment => "py3_shebang_fix macro needs /usr/bin/pathfix.py from platform-python-devel package";
125125

126-
suse_15::
127-
"libopenssl-devel" -> { "ENT-12528" }
128-
comment => "like redhat, suse 15+ needs to build with system openssl.";
129126

130127
(redhat_8|centos_8|redhat_9).(yum_dnf_conf_ok)::
131128
"java-1.8.0-openjdk-headless" package_policy => "delete",
132129
comment => "Installing Development Tools includes this jdk1.8 which we do not want.";
133130
"java-17-openjdk";
134131
"pkgconf" comment => "pkgconfig renamed to pkgconf in rhel8";
135132
"selinux-policy-devel" comment => "maybe add to _7 and _6?";
136-
"openssl-devel";
137133

138134
(redhat_9).(yum_dnf_conf_ok)::
139135
"perl-Sys-Hostname" comment => "Needed by __04_examples_outputs_check_outputs_cf";

‎ci/fix-buildhost.sh‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,10 +15,10 @@ if [ "$(uname)" = "HP-UX" ] || [ "$(uname)" = "SunOS" ]; then
1515
fi
1616
fi
1717

18-
# while ENT-13750 is in progress we need to ensure that OTHER builds include openssl devel packages on redhat-based platforms
18+
# ENT-13750 we return to vendored openssl on rpm platforms so remove possibly installed development packages
1919
if command -v zypper >/dev/null 2>/dev/null; then
20-
sudo zypper install -y libopenssl-devel || true
20+
sudo zypper remove -y libopenssl-devel || true
2121
fi
2222
if command -v yum >/dev/null 2>/dev/null; then
23-
sudo yum install -y openssl-devel || true
23+
sudo yum erase -y openssl-devel || true
2424
fi

‎deps-packaging/libcurl-hub/cfbuild-libcurl-hub.spec‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -18,12 +18,7 @@ AutoReqProv: no
1818
mkdir -p %{_builddir}
1919
%setup -q -n curl-%{curl_version}
2020

21-
# we don't bundle OpenSSL on RHEL 8 (and newer in the future)
22-
%if %{?rhel}%{!?rhel:0} > 7
23-
%define ssl_prefix /usr
24-
%else
2521
%define ssl_prefix %{prefix}
26-
%endif
2722

2823
./configure \
2924
--with-sysroot=%{prefix} \

‎deps-packaging/libcurl/cfbuild-libcurl.spec‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ AutoReqProv: no
1818
mkdir -p %{_builddir}
1919
%setup -q -n curl-%{curl_version}
2020

21-
%if "%{_system_ssl}" == "1"
21+
%if 0%{?SYSTEM_SSL}
2222
%define ssl_prefix /usr
2323
%else
2424
%define ssl_prefix %{prefix}

‎deps-packaging/openldap/cfbuild-openldap.spec‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -21,12 +21,7 @@ mkdir -p %{_builddir}
2121

2222
%patch0 -p0
2323

24-
# we don't bundle OpenSSL on RHEL 8 (and newer in the future)
25-
%if %{?rhel}%{!?rhel:0} > 7
26-
CPPFLAGS=-I%{buildprefix}/include:/usr/include
27-
%else
2824
CPPFLAGS=-I%{buildprefix}/include
29-
%endif
3025

3126
#
3227
# glibc-2.8 errorneously hides peercred(3) under #ifdef __USE_GNU.

‎packaging/cfengine-nova-hub/cfengine-nova-hub.spec.in‎

Lines changed: 0 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -27,23 +27,6 @@ Requires(post): /usr/sbin/usermod, /bin/sed
2727
Requires: selinux-policy >= @@SELINUX_POLICY_VERSION@@
2828
%endif
2929

30-
# we don't bundle OpenSSL on RHEL 8 (and newer in the future)
31-
%if %{?rhel}%{!?rhel:0} == 8
32-
Requires: libssl.so.1.1()(64bit) libssl.so.1.1(OPENSSL_1_1_0)(64bit) libssl.so.1.1(OPENSSL_1_1_1)(64bit)
33-
Requires: libcrypto.so.1.1()(64bit) libcrypto.so.1.1(OPENSSL_1_1_0)(64bit)
34-
Requires: openssl
35-
%endif
36-
37-
# We build against systems with the latest available dependencies such as OpenSSL.
38-
# We use rpm -q --provides to determine the highest API present in OpenSSL and then use that as a Requires.
39-
# OPENSSL_VERSION is determined in build-scripts/package script.
40-
# This should ensure that when packages are installed with yum/dnf any required OpenSSL package upgrades will be performed or the installation will fail.
41-
%if %{?rhel}%{!?rhel:0} > 8
42-
Requires: libcrypto.so.3()(64bit) libcrypto.so.3(OPENSSL_@@OPENSSL_VERSION@@)(64bit)
43-
Requires: libssl.so.3()(64bit) libssl.so.3(OPENSSL_@@OPENSSL_VERSION@@)(64bit)
44-
Requires: openssl
45-
%endif
46-
4730
# cfbs/Build requires Python 3.5+ (not available on RHEL 6)
4831
%if %{?rhel}%{!?rhel:0} == 7
4932
Requires: python3 >= 3.5
@@ -100,10 +83,6 @@ rm -f %{prefix}/ssl/misc/tsget
10083
rm -f %{prefix}/ssl/openssl.cnf.dist
10184
rm -f %{prefix}/ssl/misc/tsget.pl
10285

103-
# Add an openssl symlink if openssl binary doesn't exist
104-
if ! [ -f $RPM_BUILD_ROOT%{prefix}/bin/openssl ]; then
105-
ln -s `which openssl` $RPM_BUILD_ROOT%{prefix}/bin/openssl
106-
fi
10786

10887
# Hub does not need cf-upgrade, it is only present in host packages
10988
rm -f $RPM_BUILD_ROOT%{prefix}/bin/cf-upgrade
@@ -237,16 +216,11 @@ exit 0
237216
# init.d script enterprise part
238217
%{prefix}/bin/cfengine3-nova-hub-init-d.sh
239218

240-
# OpenSSL tools (we don't bundle OpenSSL on RHEL 8)
241-
# Note that prefix/bin/openssl is outside of `if`, since
242-
# on RHEL8 it's a symlink to a system-wide openssl binary
243219
%{prefix}/bin/openssl
244-
%if %{?rhel}%{!?rhel:0} <= 7
245220
%dir %{prefix}/ssl
246221
%{prefix}/ssl/openssl.cnf
247222
%{prefix}/ssl/ct_log_list.cnf
248223
%{prefix}/ssl/ct_log_list.cnf.dist
249-
%endif
250224

251225
%prefix/bin/git
252226
%prefix/bin/gitk

‎packaging/cfengine-nova/cfengine-nova.spec.in‎

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -23,21 +23,6 @@ Recommends: gzip
2323
Requires: selinux-policy >= @@SELINUX_POLICY_VERSION@@
2424
%endif
2525

26-
# we don't bundle OpenSSL on RHEL 8 (and newer in the future)
27-
%if %{?rhel}%{!?rhel:0} == 8
28-
Requires: libssl.so.1.1()(64bit) libssl.so.1.1(OPENSSL_1_1_0)(64bit) libssl.so.1.1(OPENSSL_1_1_1)(64bit)
29-
Requires: libcrypto.so.1.1()(64bit) libcrypto.so.1.1(OPENSSL_1_1_0)(64bit)
30-
%endif
31-
32-
# We build against systems with the latest available dependencies such as OpenSSL.
33-
# We use rpm -q --provides to determine the highest API present in OpenSSL and then use that as a Requires.
34-
# OPENSSL_VERSION is determined in build-scripts/package script.
35-
# This should ensure that when packages are installed with yum/dnf any required OpenSSL package upgrades will be performed or the installation will fail.
36-
%if %{?rhel}%{!?rhel:0} > 8
37-
Requires: libcrypto.so.3()(64bit) libcrypto.so.3(OPENSSL_@@OPENSSL_VERSION@@)(64bit)
38-
Requires: libssl.so.3()(64bit) libssl.so.3(OPENSSL_@@OPENSSL_VERSION@@)(64bit)
39-
%endif
40-
4126
AutoReqProv: no
4227

4328
%if %{?with_debugsym}%{!?with_debugsym:0}

0 commit comments

Comments
 (0)