Skip to content

Commit 1b2ab01

Browse files
padelsbachpadelsbach
committed
Experimentally rolling back scripts and debian dirs
1 parent 41cef39 commit 1b2ab01

File tree

4 files changed

+149
-94
lines changed

4 files changed

+149
-94
lines changed

‎debian/install-openssl.sh‎

Lines changed: 52 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,6 @@
2323
set -e
2424

2525
REPO_ROOT=${GITHUB_WORKSPACE:-$(git rev-parse --show-toplevel)}
26-
source ${REPO_ROOT}/scripts/utils-general.sh
2726

2827
openssl_clone() {
2928
local debian_version=${1:-bookworm}
@@ -48,9 +47,59 @@ openssl_clone() {
4847
cd $openssl_dir
4948
}
5049

51-
openssl_build() {
50+
openssl_patch_version() {
51+
local replace_default=${1:-0}
52+
printf "\tPatching OpenSSL version"
53+
# Patch the OpenSSL version with our BUILD_METADATA
54+
if [ "$replace_default" = "1" ]; then
55+
sed -i 's/BUILD_METADATA=.*/BUILD_METADATA=wolfProvider-replace-default/g' VERSION.dat
56+
else
57+
sed -i 's/BUILD_METADATA=.*/BUILD_METADATA=wolfProvider/g' VERSION.dat
58+
fi
59+
# Patch the OpenSSL RELEASE_DATE field with the current date in the format DD MMM YYYY
60+
sed -i "s/RELEASE_DATE=.*/RELEASE_DATE=$(date '+%d %b %Y')/g" VERSION.dat
61+
}
62+
63+
openssl_is_patched() {
64+
# Return 0 if patched, 1 if not
65+
local file="crypto/provider_predefined.c"
66+
67+
# File must exist to be patched
68+
[[ -f "$file" ]] || return 1
69+
70+
# Any time we see libwolfprov, we're patched
71+
if grep -q 'libwolfprov' -- "$file"; then
72+
return 0
73+
fi
74+
75+
# Not patched
76+
return 1
77+
}
78+
79+
openssl_patch() {
80+
local replace_default=${1:-0}
81+
82+
if openssl_is_patched; then
83+
printf "\tOpenSSL already patched\n"
84+
elif [ "$replace_default" = "1" ]; then
85+
printf "\tApplying OpenSSL default provider patch ... "
86+
87+
# Apply the patch
88+
patch -p1 < ${REPO_ROOT}/patches/openssl3-replace-default.patch
89+
if [ $? != 0 ]; then
90+
printf "ERROR.\n"
91+
printf "\n\nPatch application failed.\n"
92+
exit 1
93+
fi
94+
fi
95+
# Patch the OpenSSL version with our metadata
96+
openssl_patch_version $replace_default
97+
5298
DEBFULLNAME="${DEBFULLNAME:-WolfSSL Developer}" DEBEMAIL="${DEBEMAIL:-support@wolfssl.com}" dch -l +wolfprov "Adjust VERSION.dat for custom build"
5399
DEBIAN_FRONTEND=noninteractive EDITOR=true dpkg-source --commit . adjust-version-dat
100+
}
101+
102+
openssl_build() {
54103
DEB_BUILD_OPTIONS="parallel=$(nproc) nocheck" dpkg-buildpackage -us -uc
55104
}
56105

@@ -122,7 +171,7 @@ main() {
122171
exit 0
123172
fi
124173

125-
if [ -n "$output_dir" ]; then
174+
if [ -n "output_dir" ]; then
126175
output_dir=$(realpath $output_dir)
127176
fi
128177

‎scripts/utils-general.sh‎

Lines changed: 0 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@
33
# the wolfProvider library
44

55
SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
6-
REPO_ROOT=${GITHUB_WORKSPACE:-$(git rev-parse --show-toplevel)}
76

87
if [ "$UTILS_GENERAL_LOADED" != "yes" ]; then # only set once
98
kill_servers() {
@@ -28,7 +27,6 @@ if [ "$UTILS_GENERAL_LOADED" != "yes" ]; then # only set once
2827
export UTILS_GENERAL_LOADED=yes
2928
fi
3029

31-
# Check if the current git repository matches the target commit/tag/branch
3230
# Usage: check_git_match <target_ref> [<repo_dir>]
3331
check_git_match() {
3432
local target_ref="$1"
@@ -66,69 +64,3 @@ check_git_match() {
6664
exit 1
6765
fi
6866
}
69-
70-
# Apply patch for OpenSSL version info
71-
openssl_patch_metadata() {
72-
local replace_default=${1:-0}
73-
local openssl_source_dir=${2:-.}
74-
printf "\tPatching OpenSSL version metadata ... "
75-
# Patch the OpenSSL version with our BUILD_METADATA
76-
if [ "$replace_default" = "1" ]; then
77-
sed -i 's/BUILD_METADATA=.*/BUILD_METADATA=wolfProvider-replace-default/g' $openssl_source_dir/VERSION.dat
78-
else
79-
sed -i 's/BUILD_METADATA=.*/BUILD_METADATA=wolfProvider/g' $openssl_source_dir/VERSION.dat
80-
fi
81-
# Patch the OpenSSL RELEASE_DATE field with the current date in the format DD MMM YYYY
82-
sed -i "s/RELEASE_DATE=.*/RELEASE_DATE=\"$(date '+%d %b %Y')\"/g" $openssl_source_dir/VERSION.dat
83-
84-
printf "Done.\n"
85-
}
86-
87-
# Check if replace-default patch is applied
88-
# Return 0 if patched, 1 if not
89-
openssl_is_patched() {
90-
local openssl_source_dir=${1:-.}
91-
local file="$openssl_source_dir/crypto/provider_predefined.c"
92-
local ret=1
93-
94-
# File must exist to be patched
95-
if [[ ! -f "$file" ]]; then
96-
printf "\tOpenSSL source file not found: %s\n" "$file"
97-
elif grep -q 'libwolfprov' -- "$file"; then
98-
# Any time we see libwolfprov, we're patched
99-
ret=0
100-
else
101-
: # Not patched
102-
fi
103-
104-
return $ret
105-
}
106-
107-
# Apply replace-default and version patches
108-
openssl_patch() {
109-
local replace_default=${1:-0}
110-
local openssl_source_dir=${2:-.}
111-
local patch_file="${REPO_ROOT}/patches/openssl3-replace-default.patch"
112-
113-
if openssl_is_patched $openssl_source_dir; then
114-
printf "\tOpenSSL already patched\n"
115-
elif [ "$replace_default" = "1" ]; then
116-
if [ ! -f "${patch_file}" ]; then
117-
printf "ERROR: OpenSSL replace-default patch file not found: ${patch_file}\n"
118-
printf " Looked in directory: $(dirname ${patch_file})\n"
119-
exit 1
120-
fi
121-
122-
printf "\tApplying OpenSSL default provider patch ... "
123-
124-
# Apply the patch
125-
patch -d $openssl_source_dir -p1 < ${patch_file}
126-
if [ $? != 0 ]; then
127-
printf "ERROR.\n"
128-
printf "\n\nPatch application failed.\n"
129-
exit 1
130-
fi
131-
fi
132-
# Patch the OpenSSL version with our metadata
133-
openssl_patch_metadata $replace_default $openssl_source_dir
134-
}

‎scripts/utils-openssl.sh‎

Lines changed: 79 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -97,24 +97,97 @@ clone_openssl() {
9797
fi
9898
}
9999

100+
is_openssl_patched() {
101+
# Return 0 if patched, 1 if not
102+
local dir="${OPENSSL_SOURCE_DIR:?OPENSSL_SOURCE_DIR not set}"
103+
local file="${dir%/}/crypto/provider_predefined.c"
104+
105+
# File must exist to be patched
106+
[[ -f "$file" ]] || return 1
107+
108+
# Any time we see libwolfprov, we're patched
109+
if grep -q 'libwolfprov' -- "$file"; then
110+
return 0
111+
fi
112+
113+
# Not patched
114+
return 1
115+
}
116+
117+
patch_openssl_version() {
118+
# Patch the OpenSSL version (wolfProvider/openssl-source/VERSION.dat)
119+
# with our BUILD_METADATA, depending on the FIPS flag. Either "wolfProvider" or "wolfProvider-fips".
120+
if [ ${WOLFSSL_ISFIPS:-0} -eq 1 ]; then
121+
sed -i 's/BUILD_METADATA=.*/BUILD_METADATA=wolfProvider-fips/g' ${OPENSSL_SOURCE_DIR}/VERSION.dat
122+
else
123+
sed -i 's/BUILD_METADATA=.*/BUILD_METADATA=wolfProvider-nonfips/g' ${OPENSSL_SOURCE_DIR}/VERSION.dat
124+
fi
125+
126+
# Patch the OpenSSL RELEASE_DATE field with the current date in the format DD MMM YYYY
127+
sed -i "s/RELEASE_DATE=.*/RELEASE_DATE=$(date '+%d %b %Y')/g" ${OPENSSL_SOURCE_DIR}/VERSION.dat
128+
}
129+
130+
patch_openssl() {
131+
if [ "$WOLFPROV_REPLACE_DEFAULT" = "1" ]; then
132+
133+
if [ -d "${OPENSSL_INSTALL_DIR}" ]; then
134+
# If openssl is already installed, patching makes no sense as
135+
# it will not be rebuilt. It may already be built as patched,
136+
# just return and let check_openssl_replace_default_mismatch
137+
# check for the mismatch.
138+
return 0
139+
fi
140+
141+
printf "\tApplying OpenSSL default provider patch ... "
142+
pushd ${OPENSSL_SOURCE_DIR} &> /dev/null
143+
144+
# Check if patch is already applied
145+
if is_openssl_patched; then
146+
printf "Already applied.\n"
147+
popd &> /dev/null
148+
return 0
149+
fi
150+
151+
# Apply the patch
152+
patch -p1 < ${SCRIPT_DIR}/../patches/openssl3-replace-default.patch >>$LOG_FILE 2>&1
153+
if [ $? != 0 ]; then
154+
printf "ERROR.\n"
155+
printf "\n\nPatch application failed. Last 40 lines of log:\n"
156+
tail -n 40 $LOG_FILE
157+
do_cleanup
158+
exit 1
159+
fi
160+
patch_openssl_version
161+
printf "Done.\n"
162+
163+
popd &> /dev/null
164+
else
165+
printf "\tPatching OpenSSL version only ... "
166+
pushd ${OPENSSL_SOURCE_DIR} &> /dev/null
167+
patch_openssl_version
168+
printf "Done.\n"
169+
popd &> /dev/null
170+
fi
171+
}
172+
100173
check_openssl_replace_default_mismatch() {
101-
local is_patched=0
174+
local openssl_is_patched=0
102175

103176
# Check if the source was patched for --replace-default
104-
if openssl_is_patched $OPENSSL_SOURCE_DIR; then
105-
is_patched=1
177+
if is_openssl_patched; then
178+
openssl_is_patched=1
106179
printf "INFO: OpenSSL source modified - wolfProvider integrated as default provider (non-stock build).\n"
107180
fi
108181

109182
# Check for mismatch
110-
if [ "$WOLFPROV_REPLACE_DEFAULT" = "1" ] && [ "$is_patched" = "0" ]; then
183+
if [ "$WOLFPROV_REPLACE_DEFAULT" = "1" ] && [ "$openssl_is_patched" = "0" ]; then
111184
printf "ERROR: --replace-default build mode mismatch!\n"
112185
printf "Existing OpenSSL was built WITHOUT --replace-default patch\n"
113186
printf "Current request: --replace-default build\n\n"
114187
printf "Fix: ./scripts/build-wolfprovider.sh --distclean\n"
115188
printf "Then rebuild with desired configuration.\n"
116189
exit 1
117-
elif [ "$WOLFPROV_REPLACE_DEFAULT" != "1" ] && [ "$is_patched" = "1" ]; then
190+
elif [ "$WOLFPROV_REPLACE_DEFAULT" != "1" ] && [ "$openssl_is_patched" = "1" ]; then
118191
printf "ERROR: Standard build mode mismatch!\n"
119192
printf "Existing OpenSSL was built WITH --replace-default patch\n"
120193
printf "Current request: standard build\n\n"
@@ -127,7 +200,7 @@ check_openssl_replace_default_mismatch() {
127200
install_openssl() {
128201
printf "\nInstalling OpenSSL ${OPENSSL_TAG} ...\n"
129202
clone_openssl
130-
openssl_patch "$WOLFPROV_REPLACE_DEFAULT" "${OPENSSL_SOURCE_DIR}"
203+
patch_openssl
131204
check_openssl_replace_default_mismatch
132205

133206
pushd ${OPENSSL_SOURCE_DIR} &> /dev/null

‎scripts/verify-install.sh‎

Lines changed: 18 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -311,18 +311,18 @@ verify_wolfprovider() {
311311
# version: 1.0.2
312312
# status: active
313313

314-
# When using base openssl, expect:
315-
# $ openssl version
314+
# When replace-default is 0, expect:
315+
# $ openssl version
316316
# OpenSSL 3.0.17 1 Jul 2025 (Library: OpenSSL 3.0.17 1 Jul 2025
317317

318-
# When using wolfProvider's openssl with replace-default 0, expect:
319-
# openssl version
320-
# OpenSSL 3.0.17+wolfProvider 03 Nov 2025 (Library: OpenSSL 3.0.17+wolfProvider 03 Nov 2025)
321-
322318
# When replace-default is 1 and fips is 0, expect:
323-
# $ openssl version
319+
# $ openssl version
324320
# OpenSSL 3.0.17+wolfProvider-nonfips 30 Sep 2025 (Library: OpenSSL 3.0.17+wolfProvider-nonfips 30 Sep 2025)
325321

322+
# When fips is 1, expect:
323+
# $ openssl version
324+
# OpenSSL 3.0.17+wolfProvider-fips 11 Oct 2025 (Library: OpenSSL 3.0.17+wolfProvider-fips 11 Oct 2025)
325+
326326
# When fips is 1, expect:
327327
# $ dpkg -l | grep libwolfssl
328328
# ii libwolfssl 5.8.2+commercial.fips.linuxv5.2.4 amd64 wolfSSL encryption library
@@ -342,8 +342,8 @@ self_test() {
342342

343343
# Mock strings for openssl version
344344
local ver_base="OpenSSL 3.0.17 1 Jul 2025 (Library: OpenSSL 3.0.17 1 Jul 2025)"
345-
local ver_wp="OpenSSL 3.0.17+wolfProvider 03 Nov 2025 (Library: OpenSSL 3.0.17+wolfProvider 03 Nov 2025)"
346-
local ver_replace_default="OpenSSL 3.0.17+wolfProvider-nonfips 30 Sep 2025 (Library: OpenSSL 3.0.17+wolfProvider-nonfips 30 Sep 2025)"
345+
local ver_replace_default_nonfips="OpenSSL 3.0.17+wolfProvider-nonfips 30 Sep 2025 (Library: OpenSSL 3.0.17+wolfProvider-nonfips 30 Sep 2025)"
346+
local ver_replace_default_fips="OpenSSL 3.0.17+wolfProvider-fips 11 Oct 2025 (Library: OpenSSL 3.0.17+wolfProvider-fips 11 Oct 2025)"
347347

348348
# Mock strings for provider listings
349349
read -r -d '' providers_libwolfprov_nonfips <<'EOF'
@@ -447,26 +447,27 @@ EOF
447447

448448
# Positive cases per comment expectations
449449
run_case "pos: replace_default=0,fips=0" 0 0 0 0 ver_base providers_libwolfprov_nonfips dpkg_installed_nonfips
450-
run_case "pos: replace_default=1,fips=0" 0 0 1 0 ver_replace_default providers_default_wolf_nonfips dpkg_installed_nonfips
450+
run_case "pos: replace_default=1,fips=0" 0 0 1 0 ver_replace_default_nonfips providers_default_wolf_nonfips dpkg_installed_nonfips
451+
run_case "pos: replace_default=1,fips=1" 0 1 1 0 ver_replace_default_fips providers_default_wolf_fips dpkg_installed_fips
451452
run_case "pos: replace_default=0,fips=1" 0 1 0 0 ver_base providers_libwolfprov_fips dpkg_installed_fips
452453
# run positive test cases with providers_default_openssl_only
453454
run_case "pos: no_wp true with OpenSSL default, default provider" 0 0 0 1 ver_base providers_default_openssl_only dpkg_installed_nonfips
454-
run_case "pos: no_wp true but wolfProvider active" 1 0 0 1 ver_wp providers_libwolfprov_nonfips dpkg_installed_nonfips
455+
run_case "pos: no_wp true but wolfProvider active" 1 0 0 1 ver_base providers_libwolfprov_nonfips dpkg_installed_nonfips
455456

456457
# Negative cases
457-
run_case "neg: rd=0 but OpenSSL replace-default" 1 0 0 0 ver_replace_default providers_libwolfprov_nonfips dpkg_installed_nonfips
458-
run_case "neg: rd=0 but OpenSSL wp metadata" 1 0 0 0 ver_wp providers_libwolfprov_nonfips dpkg_installed_nonfips
458+
run_case "neg: rd=0 but OpenSSL replace-default" 1 0 0 0 ver_replace_default_nonfips providers_libwolfprov_nonfips dpkg_installed_nonfips
459459
run_case "neg: rd=0 but provider default" 1 0 0 0 ver_base providers_both_default_and_libwolfprov dpkg_installed_nonfips
460460
run_case "neg: rd=0 but no providers listed" 1 0 0 0 ver_base providers_none dpkg_installed_nonfips
461461
run_case "neg: rd=0 missing provider" 1 0 0 0 ver_base providers_default_openssl_only dpkg_installed_nonfips
462-
run_case "neg: rd=1,fips=0 but provider FIPS" 1 0 1 0 ver_replace_default providers_default_wolf_fips dpkg_installed_nonfips
463-
run_case "neg: rd=1,fips=0 but no providers listed" 1 0 1 0 ver_replace_default providers_none dpkg_installed_nonfips
464-
run_case "neg: rd=1,fips=1 but OpenSSL non-FIPS" 1 1 1 0 ver_replace_default providers_default_wolf_fips dpkg_installed_fips
462+
run_case "neg: rd=1,fips=0 but OpenSSL FIPS" 1 0 1 0 ver_replace_default_fips providers_default_wolf_nonfips dpkg_installed_nonfips
463+
run_case "neg: rd=1,fips=0 but provider FIPS" 1 0 1 0 ver_replace_default_nonfips providers_default_wolf_fips dpkg_installed_nonfips
464+
run_case "neg: rd=1,fips=0 but no providers listed" 1 0 1 0 ver_replace_default_nonfips providers_none dpkg_installed_nonfips
465+
run_case "neg: rd=1,fips=1 but OpenSSL non-FIPS" 1 1 1 0 ver_replace_default_nonfips providers_default_wolf_fips dpkg_installed_fips
465466
run_case "neg: fips=1 but wolfSSL non-FIPS" 1 1 0 0 ver_base providers_libwolfprov_fips dpkg_installed_nonfips
466467

467468
# no_wp positive and negative cases
468469
run_case "neg: no_wp true with OpenSSL default, default provider" 1 0 0 1 ver_base providers_none dpkg_installed_nonfips
469-
run_case "neg: no_wp true but wolfProvider active" 1 0 0 1 ver_wp providers_libwolfprov_nonfips dpkg_installed_nonfips
470+
run_case "neg: no_wp true but wolfProvider active" 1 0 0 1 ver_base providers_libwolfprov_nonfips dpkg_installed_nonfips
470471

471472
log_info "self_test results: ${pass_count} passed, ${fail_count} failed"
472473
if [ "$fail_count" -gt 0 ]; then

0 commit comments

Comments
 (0)