Skip to content

Commit 41cef39

Browse files
padelsbachpadelsbach
committed
Make OpenSSL version match when building via build-wolfprovider.sh and install-openssl.sh
1 parent 935e104 commit 41cef39

File tree

4 files changed

+94
-149
lines changed

4 files changed

+94
-149
lines changed

‎debian/install-openssl.sh‎

Lines changed: 3 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323
set -e
2424

2525
REPO_ROOT=${GITHUB_WORKSPACE:-$(git rev-parse --show-toplevel)}
26+
source ${REPO_ROOT}/scripts/utils-general.sh
2627

2728
openssl_clone() {
2829
local debian_version=${1:-bookworm}
@@ -47,59 +48,9 @@ openssl_clone() {
4748
cd $openssl_dir
4849
}
4950

50-
openssl_patch_version() {
51-
local replace_default=${1:-0}
52-
printf "\tPatching OpenSSL version"
53-
# Patch the OpenSSL version with our BUILD_METADATA
54-
if [ "$replace_default" = "1" ]; then
55-
sed -i 's/BUILD_METADATA=.*/BUILD_METADATA=wolfProvider-replace-default/g' VERSION.dat
56-
else
57-
sed -i 's/BUILD_METADATA=.*/BUILD_METADATA=wolfProvider/g' VERSION.dat
58-
fi
59-
# Patch the OpenSSL RELEASE_DATE field with the current date in the format DD MMM YYYY
60-
sed -i "s/RELEASE_DATE=.*/RELEASE_DATE=$(date '+%d %b %Y')/g" VERSION.dat
61-
}
62-
63-
openssl_is_patched() {
64-
# Return 0 if patched, 1 if not
65-
local file="crypto/provider_predefined.c"
66-
67-
# File must exist to be patched
68-
[[ -f "$file" ]] || return 1
69-
70-
# Any time we see libwolfprov, we're patched
71-
if grep -q 'libwolfprov' -- "$file"; then
72-
return 0
73-
fi
74-
75-
# Not patched
76-
return 1
77-
}
78-
79-
openssl_patch() {
80-
local replace_default=${1:-0}
81-
82-
if openssl_is_patched; then
83-
printf "\tOpenSSL already patched\n"
84-
elif [ "$replace_default" = "1" ]; then
85-
printf "\tApplying OpenSSL default provider patch ... "
86-
87-
# Apply the patch
88-
patch -p1 < ${REPO_ROOT}/patches/openssl3-replace-default.patch
89-
if [ $? != 0 ]; then
90-
printf "ERROR.\n"
91-
printf "\n\nPatch application failed.\n"
92-
exit 1
93-
fi
94-
fi
95-
# Patch the OpenSSL version with our metadata
96-
openssl_patch_version $replace_default
97-
51+
openssl_build() {
9852
DEBFULLNAME="${DEBFULLNAME:-WolfSSL Developer}" DEBEMAIL="${DEBEMAIL:-support@wolfssl.com}" dch -l +wolfprov "Adjust VERSION.dat for custom build"
9953
DEBIAN_FRONTEND=noninteractive EDITOR=true dpkg-source --commit . adjust-version-dat
100-
}
101-
102-
openssl_build() {
10354
DEB_BUILD_OPTIONS="parallel=$(nproc) nocheck" dpkg-buildpackage -us -uc
10455
}
10556

@@ -171,7 +122,7 @@ main() {
171122
exit 0
172123
fi
173124

174-
if [ -n "output_dir" ]; then
125+
if [ -n "$output_dir" ]; then
175126
output_dir=$(realpath $output_dir)
176127
fi
177128

‎scripts/utils-general.sh‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
# the wolfProvider library
44

55
SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
6+
REPO_ROOT=${GITHUB_WORKSPACE:-$(git rev-parse --show-toplevel)}
67

78
if [ "$UTILS_GENERAL_LOADED" != "yes" ]; then # only set once
89
kill_servers() {
@@ -27,6 +28,7 @@ if [ "$UTILS_GENERAL_LOADED" != "yes" ]; then # only set once
2728
export UTILS_GENERAL_LOADED=yes
2829
fi
2930

31+
# Check if the current git repository matches the target commit/tag/branch
3032
# Usage: check_git_match <target_ref> [<repo_dir>]
3133
check_git_match() {
3234
local target_ref="$1"
@@ -64,3 +66,69 @@ check_git_match() {
6466
exit 1
6567
fi
6668
}
69+
70+
# Apply patch for OpenSSL version info
71+
openssl_patch_metadata() {
72+
local replace_default=${1:-0}
73+
local openssl_source_dir=${2:-.}
74+
printf "\tPatching OpenSSL version metadata ... "
75+
# Patch the OpenSSL version with our BUILD_METADATA
76+
if [ "$replace_default" = "1" ]; then
77+
sed -i 's/BUILD_METADATA=.*/BUILD_METADATA=wolfProvider-replace-default/g' $openssl_source_dir/VERSION.dat
78+
else
79+
sed -i 's/BUILD_METADATA=.*/BUILD_METADATA=wolfProvider/g' $openssl_source_dir/VERSION.dat
80+
fi
81+
# Patch the OpenSSL RELEASE_DATE field with the current date in the format DD MMM YYYY
82+
sed -i "s/RELEASE_DATE=.*/RELEASE_DATE=\"$(date '+%d %b %Y')\"/g" $openssl_source_dir/VERSION.dat
83+
84+
printf "Done.\n"
85+
}
86+
87+
# Check if replace-default patch is applied
88+
# Return 0 if patched, 1 if not
89+
openssl_is_patched() {
90+
local openssl_source_dir=${1:-.}
91+
local file="$openssl_source_dir/crypto/provider_predefined.c"
92+
local ret=1
93+
94+
# File must exist to be patched
95+
if [[ ! -f "$file" ]]; then
96+
printf "\tOpenSSL source file not found: %s\n" "$file"
97+
elif grep -q 'libwolfprov' -- "$file"; then
98+
# Any time we see libwolfprov, we're patched
99+
ret=0
100+
else
101+
: # Not patched
102+
fi
103+
104+
return $ret
105+
}
106+
107+
# Apply replace-default and version patches
108+
openssl_patch() {
109+
local replace_default=${1:-0}
110+
local openssl_source_dir=${2:-.}
111+
local patch_file="${REPO_ROOT}/patches/openssl3-replace-default.patch"
112+
113+
if openssl_is_patched $openssl_source_dir; then
114+
printf "\tOpenSSL already patched\n"
115+
elif [ "$replace_default" = "1" ]; then
116+
if [ ! -f "${patch_file}" ]; then
117+
printf "ERROR: OpenSSL replace-default patch file not found: ${patch_file}\n"
118+
printf " Looked in directory: $(dirname ${patch_file})\n"
119+
exit 1
120+
fi
121+
122+
printf "\tApplying OpenSSL default provider patch ... "
123+
124+
# Apply the patch
125+
patch -d $openssl_source_dir -p1 < ${patch_file}
126+
if [ $? != 0 ]; then
127+
printf "ERROR.\n"
128+
printf "\n\nPatch application failed.\n"
129+
exit 1
130+
fi
131+
fi
132+
# Patch the OpenSSL version with our metadata
133+
openssl_patch_metadata $replace_default $openssl_source_dir
134+
}

‎scripts/utils-openssl.sh‎

Lines changed: 6 additions & 79 deletions
Original file line numberDiff line numberDiff line change
@@ -97,97 +97,24 @@ clone_openssl() {
9797
fi
9898
}
9999

100-
is_openssl_patched() {
101-
# Return 0 if patched, 1 if not
102-
local dir="${OPENSSL_SOURCE_DIR:?OPENSSL_SOURCE_DIR not set}"
103-
local file="${dir%/}/crypto/provider_predefined.c"
104-
105-
# File must exist to be patched
106-
[[ -f "$file" ]] || return 1
107-
108-
# Any time we see libwolfprov, we're patched
109-
if grep -q 'libwolfprov' -- "$file"; then
110-
return 0
111-
fi
112-
113-
# Not patched
114-
return 1
115-
}
116-
117-
patch_openssl_version() {
118-
# Patch the OpenSSL version (wolfProvider/openssl-source/VERSION.dat)
119-
# with our BUILD_METADATA, depending on the FIPS flag. Either "wolfProvider" or "wolfProvider-fips".
120-
if [ ${WOLFSSL_ISFIPS:-0} -eq 1 ]; then
121-
sed -i 's/BUILD_METADATA=.*/BUILD_METADATA=wolfProvider-fips/g' ${OPENSSL_SOURCE_DIR}/VERSION.dat
122-
else
123-
sed -i 's/BUILD_METADATA=.*/BUILD_METADATA=wolfProvider-nonfips/g' ${OPENSSL_SOURCE_DIR}/VERSION.dat
124-
fi
125-
126-
# Patch the OpenSSL RELEASE_DATE field with the current date in the format DD MMM YYYY
127-
sed -i "s/RELEASE_DATE=.*/RELEASE_DATE=$(date '+%d %b %Y')/g" ${OPENSSL_SOURCE_DIR}/VERSION.dat
128-
}
129-
130-
patch_openssl() {
131-
if [ "$WOLFPROV_REPLACE_DEFAULT" = "1" ]; then
132-
133-
if [ -d "${OPENSSL_INSTALL_DIR}" ]; then
134-
# If openssl is already installed, patching makes no sense as
135-
# it will not be rebuilt. It may already be built as patched,
136-
# just return and let check_openssl_replace_default_mismatch
137-
# check for the mismatch.
138-
return 0
139-
fi
140-
141-
printf "\tApplying OpenSSL default provider patch ... "
142-
pushd ${OPENSSL_SOURCE_DIR} &> /dev/null
143-
144-
# Check if patch is already applied
145-
if is_openssl_patched; then
146-
printf "Already applied.\n"
147-
popd &> /dev/null
148-
return 0
149-
fi
150-
151-
# Apply the patch
152-
patch -p1 < ${SCRIPT_DIR}/../patches/openssl3-replace-default.patch >>$LOG_FILE 2>&1
153-
if [ $? != 0 ]; then
154-
printf "ERROR.\n"
155-
printf "\n\nPatch application failed. Last 40 lines of log:\n"
156-
tail -n 40 $LOG_FILE
157-
do_cleanup
158-
exit 1
159-
fi
160-
patch_openssl_version
161-
printf "Done.\n"
162-
163-
popd &> /dev/null
164-
else
165-
printf "\tPatching OpenSSL version only ... "
166-
pushd ${OPENSSL_SOURCE_DIR} &> /dev/null
167-
patch_openssl_version
168-
printf "Done.\n"
169-
popd &> /dev/null
170-
fi
171-
}
172-
173100
check_openssl_replace_default_mismatch() {
174-
local openssl_is_patched=0
101+
local is_patched=0
175102

176103
# Check if the source was patched for --replace-default
177-
if is_openssl_patched; then
178-
openssl_is_patched=1
104+
if openssl_is_patched $OPENSSL_SOURCE_DIR; then
105+
is_patched=1
179106
printf "INFO: OpenSSL source modified - wolfProvider integrated as default provider (non-stock build).\n"
180107
fi
181108

182109
# Check for mismatch
183-
if [ "$WOLFPROV_REPLACE_DEFAULT" = "1" ] && [ "$openssl_is_patched" = "0" ]; then
110+
if [ "$WOLFPROV_REPLACE_DEFAULT" = "1" ] && [ "$is_patched" = "0" ]; then
184111
printf "ERROR: --replace-default build mode mismatch!\n"
185112
printf "Existing OpenSSL was built WITHOUT --replace-default patch\n"
186113
printf "Current request: --replace-default build\n\n"
187114
printf "Fix: ./scripts/build-wolfprovider.sh --distclean\n"
188115
printf "Then rebuild with desired configuration.\n"
189116
exit 1
190-
elif [ "$WOLFPROV_REPLACE_DEFAULT" != "1" ] && [ "$openssl_is_patched" = "1" ]; then
117+
elif [ "$WOLFPROV_REPLACE_DEFAULT" != "1" ] && [ "$is_patched" = "1" ]; then
191118
printf "ERROR: Standard build mode mismatch!\n"
192119
printf "Existing OpenSSL was built WITH --replace-default patch\n"
193120
printf "Current request: standard build\n\n"
@@ -200,7 +127,7 @@ check_openssl_replace_default_mismatch() {
200127
install_openssl() {
201128
printf "\nInstalling OpenSSL ${OPENSSL_TAG} ...\n"
202129
clone_openssl
203-
patch_openssl
130+
openssl_patch "$WOLFPROV_REPLACE_DEFAULT" "${OPENSSL_SOURCE_DIR}"
204131
check_openssl_replace_default_mismatch
205132

206133
pushd ${OPENSSL_SOURCE_DIR} &> /dev/null

‎scripts/verify-install.sh‎

Lines changed: 17 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -311,18 +311,18 @@ verify_wolfprovider() {
311311
# version: 1.0.2
312312
# status: active
313313

314-
# When replace-default is 0, expect:
315-
# $ openssl version
314+
# When using base openssl, expect:
315+
# $ openssl version
316316
# OpenSSL 3.0.17 1 Jul 2025 (Library: OpenSSL 3.0.17 1 Jul 2025
317317

318+
# When using wolfProvider's openssl with replace-default 0, expect:
319+
# openssl version
320+
# OpenSSL 3.0.17+wolfProvider 03 Nov 2025 (Library: OpenSSL 3.0.17+wolfProvider 03 Nov 2025)
321+
318322
# When replace-default is 1 and fips is 0, expect:
319-
# $ openssl version
323+
# $ openssl version
320324
# OpenSSL 3.0.17+wolfProvider-nonfips 30 Sep 2025 (Library: OpenSSL 3.0.17+wolfProvider-nonfips 30 Sep 2025)
321325

322-
# When fips is 1, expect:
323-
# $ openssl version
324-
# OpenSSL 3.0.17+wolfProvider-fips 11 Oct 2025 (Library: OpenSSL 3.0.17+wolfProvider-fips 11 Oct 2025)
325-
326326
# When fips is 1, expect:
327327
# $ dpkg -l | grep libwolfssl
328328
# ii libwolfssl 5.8.2+commercial.fips.linuxv5.2.4 amd64 wolfSSL encryption library
@@ -342,8 +342,8 @@ self_test() {
342342

343343
# Mock strings for openssl version
344344
local ver_base="OpenSSL 3.0.17 1 Jul 2025 (Library: OpenSSL 3.0.17 1 Jul 2025)"
345-
local ver_replace_default_nonfips="OpenSSL 3.0.17+wolfProvider-nonfips 30 Sep 2025 (Library: OpenSSL 3.0.17+wolfProvider-nonfips 30 Sep 2025)"
346-
local ver_replace_default_fips="OpenSSL 3.0.17+wolfProvider-fips 11 Oct 2025 (Library: OpenSSL 3.0.17+wolfProvider-fips 11 Oct 2025)"
345+
local ver_wp="OpenSSL 3.0.17+wolfProvider 03 Nov 2025 (Library: OpenSSL 3.0.17+wolfProvider 03 Nov 2025)"
346+
local ver_replace_default="OpenSSL 3.0.17+wolfProvider-nonfips 30 Sep 2025 (Library: OpenSSL 3.0.17+wolfProvider-nonfips 30 Sep 2025)"
347347

348348
# Mock strings for provider listings
349349
read -r -d '' providers_libwolfprov_nonfips <<'EOF'
@@ -447,27 +447,26 @@ EOF
447447

448448
# Positive cases per comment expectations
449449
run_case "pos: replace_default=0,fips=0" 0 0 0 0 ver_base providers_libwolfprov_nonfips dpkg_installed_nonfips
450-
run_case "pos: replace_default=1,fips=0" 0 0 1 0 ver_replace_default_nonfips providers_default_wolf_nonfips dpkg_installed_nonfips
451-
run_case "pos: replace_default=1,fips=1" 0 1 1 0 ver_replace_default_fips providers_default_wolf_fips dpkg_installed_fips
450+
run_case "pos: replace_default=1,fips=0" 0 0 1 0 ver_replace_default providers_default_wolf_nonfips dpkg_installed_nonfips
452451
run_case "pos: replace_default=0,fips=1" 0 1 0 0 ver_base providers_libwolfprov_fips dpkg_installed_fips
453452
# run positive test cases with providers_default_openssl_only
454453
run_case "pos: no_wp true with OpenSSL default, default provider" 0 0 0 1 ver_base providers_default_openssl_only dpkg_installed_nonfips
455-
run_case "pos: no_wp true but wolfProvider active" 1 0 0 1 ver_base providers_libwolfprov_nonfips dpkg_installed_nonfips
454+
run_case "pos: no_wp true but wolfProvider active" 1 0 0 1 ver_wp providers_libwolfprov_nonfips dpkg_installed_nonfips
456455

457456
# Negative cases
458-
run_case "neg: rd=0 but OpenSSL replace-default" 1 0 0 0 ver_replace_default_nonfips providers_libwolfprov_nonfips dpkg_installed_nonfips
457+
run_case "neg: rd=0 but OpenSSL replace-default" 1 0 0 0 ver_replace_default providers_libwolfprov_nonfips dpkg_installed_nonfips
458+
run_case "neg: rd=0 but OpenSSL wp metadata" 1 0 0 0 ver_wp providers_libwolfprov_nonfips dpkg_installed_nonfips
459459
run_case "neg: rd=0 but provider default" 1 0 0 0 ver_base providers_both_default_and_libwolfprov dpkg_installed_nonfips
460460
run_case "neg: rd=0 but no providers listed" 1 0 0 0 ver_base providers_none dpkg_installed_nonfips
461461
run_case "neg: rd=0 missing provider" 1 0 0 0 ver_base providers_default_openssl_only dpkg_installed_nonfips
462-
run_case "neg: rd=1,fips=0 but OpenSSL FIPS" 1 0 1 0 ver_replace_default_fips providers_default_wolf_nonfips dpkg_installed_nonfips
463-
run_case "neg: rd=1,fips=0 but provider FIPS" 1 0 1 0 ver_replace_default_nonfips providers_default_wolf_fips dpkg_installed_nonfips
464-
run_case "neg: rd=1,fips=0 but no providers listed" 1 0 1 0 ver_replace_default_nonfips providers_none dpkg_installed_nonfips
465-
run_case "neg: rd=1,fips=1 but OpenSSL non-FIPS" 1 1 1 0 ver_replace_default_nonfips providers_default_wolf_fips dpkg_installed_fips
462+
run_case "neg: rd=1,fips=0 but provider FIPS" 1 0 1 0 ver_replace_default providers_default_wolf_fips dpkg_installed_nonfips
463+
run_case "neg: rd=1,fips=0 but no providers listed" 1 0 1 0 ver_replace_default providers_none dpkg_installed_nonfips
464+
run_case "neg: rd=1,fips=1 but OpenSSL non-FIPS" 1 1 1 0 ver_replace_default providers_default_wolf_fips dpkg_installed_fips
466465
run_case "neg: fips=1 but wolfSSL non-FIPS" 1 1 0 0 ver_base providers_libwolfprov_fips dpkg_installed_nonfips
467466

468467
# no_wp positive and negative cases
469468
run_case "neg: no_wp true with OpenSSL default, default provider" 1 0 0 1 ver_base providers_none dpkg_installed_nonfips
470-
run_case "neg: no_wp true but wolfProvider active" 1 0 0 1 ver_base providers_libwolfprov_nonfips dpkg_installed_nonfips
469+
run_case "neg: no_wp true but wolfProvider active" 1 0 0 1 ver_wp providers_libwolfprov_nonfips dpkg_installed_nonfips
471470

472471
log_info "self_test results: ${pass_count} passed, ${fail_count} failed"
473472
if [ "$fail_count" -gt 0 ]; then

0 commit comments

Comments
 (0)