Bug 11091

Summary:	update openssl to 1.1
Product:	[Build System, Metadata & Runtime] OE-Core	Reporter:	Alexander Kanavin <alex.kanavin>
Component:	core	Assignee:	Alexander Kanavin <alex.kanavin>
Status:	RESOLVED FIXED	QA Contact:
Severity:	enhancement
Priority:	Medium+	CC:	mark.hatle, meta.mr.watcher, meta.watcher, randy.macleod, ross.burton
Version:	2.3
Target Milestone:	2.4 M3
Hardware:	x86
OS:	Multiple
Whiteboard:	LET
OS type for building Yocto:	---	Type of Regression:	---
Verified:		Documentation change:	No (bug/feature does not impact docs)

Description Alexander Kanavin 2017-02-21 09:47:14 UTC

This is non-trivial [1] and so should be a separate task outside of regular package update crunch. Initial recipe is here [2]

[1] http://lists.openembedded.org/pipermail/openembedded-core/2016-December/130132.html

[2] https://git.yoctoproject.org/cgit/cgit.cgi/poky-contrib/log/?h=akanavin/openssl-1.1

Comment 1 Mark Hatle 2017-05-03 15:41:47 UTC

At present, we expect we will still need the 1.0.x version of OpenSSL.

This is due to various issues like the FIPS-140-2 module, as well as the EOL policy for 1.1 is shorter then the current 1.0.2.

Comment 2 Alexander Kanavin 2017-05-04 08:21:45 UTC

Openssl 1.0 will be provided for as long as it's supported upstream, but it will not be the default. If you want or need 1.0, the recipe should explictly ask for it (DEPENDS = "openssl10").

Openssl 1.1 will be updated again to a newer not-yet-released version before it goes out of support.

Can you review and test the patchset please? It's basically ready, and is held up only by u-boot still stuck at 1.0 (they have incomplete patches, which they can't quite finish off). Due to dependency chains this causes a file conflict with 1.1.

Comment 3 Ross Burton 2017-08-08 10:44:20 UTC

I think this new logcheck warning is from the ssl upgrade:

[log_check] WARNING: StartCom_Certification_Authority.pem does not contain a certificate or CRL: skipping