Skip to content

Commit f7605a1

Browse files
padelsbachpadelsbach
committed
Make OpenSSL version match when building via build-wolfprovider.sh and install-openssl.sh
1 parent 823dab8 commit f7605a1

File tree

4 files changed

+94
-150
lines changed

4 files changed

+94
-150
lines changed

‎debian/install-openssl.sh‎

Lines changed: 3 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323
set -e
2424

2525
REPO_ROOT=${GITHUB_WORKSPACE:-$(git rev-parse --show-toplevel)}
26+
source ${REPO_ROOT}/scripts/utils-general.sh
2627

2728
openssl_clone() {
2829
local debian_version=${1:-bookworm}
@@ -47,59 +48,9 @@ openssl_clone() {
4748
cd $openssl_dir
4849
}
4950

50-
openssl_patch_version() {
51-
local replace_default=${1:-0}
52-
printf "\tPatching OpenSSL version"
53-
# Patch the OpenSSL version with our BUILD_METADATA
54-
if [ "$replace_default" = "1" ]; then
55-
sed -i 's/BUILD_METADATA=.*/BUILD_METADATA=wolfProvider-replace-default/g' VERSION.dat
56-
else
57-
sed -i 's/BUILD_METADATA=.*/BUILD_METADATA=wolfProvider/g' VERSION.dat
58-
fi
59-
# Patch the OpenSSL RELEASE_DATE field with the current date in the format DD MMM YYYY
60-
sed -i "s/RELEASE_DATE=.*/RELEASE_DATE=$(date '+%d %b %Y')/g" VERSION.dat
61-
}
62-
63-
openssl_is_patched() {
64-
# Return 0 if patched, 1 if not
65-
local file="crypto/provider_predefined.c"
66-
67-
# File must exist to be patched
68-
[[ -f "$file" ]] || return 1
69-
70-
# Any time we see libwolfprov, we're patched
71-
if grep -q 'libwolfprov' -- "$file"; then
72-
return 0
73-
fi
74-
75-
# Not patched
76-
return 1
77-
}
78-
79-
openssl_patch() {
80-
local replace_default=${1:-0}
81-
82-
if openssl_is_patched; then
83-
printf "\tOpenSSL already patched\n"
84-
elif [ "$replace_default" = "1" ]; then
85-
printf "\tApplying OpenSSL default provider patch ... "
86-
87-
# Apply the patch
88-
patch -p1 < ${REPO_ROOT}/patches/openssl3-replace-default.patch
89-
if [ $? != 0 ]; then
90-
printf "ERROR.\n"
91-
printf "\n\nPatch application failed.\n"
92-
exit 1
93-
fi
94-
fi
95-
# Patch the OpenSSL version with our metadata
96-
openssl_patch_version $replace_default
97-
51+
openssl_build() {
9852
DEBFULLNAME="${DEBFULLNAME:-WolfSSL Developer}" DEBEMAIL="${DEBEMAIL:-support@wolfssl.com}" dch -l +wolfprov "Adjust VERSION.dat for custom build"
9953
DEBIAN_FRONTEND=noninteractive EDITOR=true dpkg-source --commit . adjust-version-dat
100-
}
101-
102-
openssl_build() {
10354
DEB_BUILD_OPTIONS="parallel=$(nproc) nocheck" dpkg-buildpackage -us -uc
10455
}
10556

@@ -171,7 +122,7 @@ main() {
171122
exit 0
172123
fi
173124

174-
if [ -n "output_dir" ]; then
125+
if [ -n "$output_dir" ]; then
175126
output_dir=$(realpath $output_dir)
176127
fi
177128

‎scripts/utils-general.sh‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ if [ "$UTILS_GENERAL_LOADED" != "yes" ]; then # only set once
2727
export UTILS_GENERAL_LOADED=yes
2828
fi
2929

30+
# Check if the current git repository matches the target commit/tag/branch
3031
# Usage: check_git_match <target_ref> [<repo_dir>]
3132
check_git_match() {
3233
local target_ref="$1"
@@ -64,3 +65,69 @@ check_git_match() {
6465
exit 1
6566
fi
6667
}
68+
69+
# Apply patch for OpenSSL version info
70+
openssl_patch_metadata() {
71+
local replace_default=${1:-0}
72+
local openssl_source_dir=${2:-.}
73+
printf "\tPatching OpenSSL version metadata ... "
74+
# Patch the OpenSSL version with our BUILD_METADATA
75+
if [ "$replace_default" = "1" ]; then
76+
sed -i 's/BUILD_METADATA=.*/BUILD_METADATA=wolfProvider-replace-default/g' $openssl_source_dir/VERSION.dat
77+
else
78+
sed -i 's/BUILD_METADATA=.*/BUILD_METADATA=wolfProvider/g' $openssl_source_dir/VERSION.dat
79+
fi
80+
# Patch the OpenSSL RELEASE_DATE field with the current date in the format DD MMM YYYY
81+
sed -i "s/RELEASE_DATE=.*/RELEASE_DATE=\"$(date '+%d %b %Y')\"/g" $openssl_source_dir/VERSION.dat
82+
83+
printf "Done.\n"
84+
}
85+
86+
# Check if replace-default patch is applied
87+
# Return 0 if patched, 1 if not
88+
openssl_is_patched() {
89+
local openssl_source_dir=${1:-.}
90+
local file="$openssl_source_dir/crypto/provider_predefined.c"
91+
local ret=1
92+
93+
# File must exist to be patched
94+
if [[ ! -f "$file" ]]; then
95+
printf "\tOpenSSL source file not found: %s\n" "$file"
96+
elif grep -q 'libwolfprov' -- "$file"; then
97+
# Any time we see libwolfprov, we're patched
98+
ret=0
99+
else
100+
: # Not patched
101+
fi
102+
103+
return $ret
104+
}
105+
106+
# Apply replace-default and version patches
107+
openssl_patch() {
108+
local replace_default=${1:-0}
109+
local openssl_source_dir=${2:-.}
110+
local patch_file="${SCRIPT_DIR}/../patches/openssl3-replace-default.patch"
111+
112+
if openssl_is_patched $openssl_source_dir; then
113+
printf "\tOpenSSL already patched\n"
114+
elif [ "$replace_default" = "1" ]; then
115+
if [ ! -f "${patch_file}" ]; then
116+
printf "ERROR: OpenSSL replace-default patch file not found: ${patch_file}\n"
117+
printf " Looked in directory: $(dirname ${patch_file})\n"
118+
exit 1
119+
fi
120+
121+
printf "\tApplying OpenSSL default provider patch ... "
122+
123+
# Apply the patch
124+
patch -d $openssl_source_dir -p1 < ${patch_file}
125+
if [ $? != 0 ]; then
126+
printf "ERROR.\n"
127+
printf "\n\nPatch application failed.\n"
128+
exit 1
129+
fi
130+
fi
131+
# Patch the OpenSSL version with our metadata
132+
openssl_patch_metadata $replace_default $openssl_source_dir
133+
}

‎scripts/utils-openssl.sh‎

Lines changed: 7 additions & 80 deletions
Original file line numberDiff line numberDiff line change
@@ -100,97 +100,24 @@ clone_openssl() {
100100
fi
101101
}
102102

103-
is_openssl_patched() {
104-
# Return 0 if patched, 1 if not
105-
local dir="${OPENSSL_SOURCE_DIR:?OPENSSL_SOURCE_DIR not set}"
106-
local file="${dir%/}/crypto/provider_predefined.c"
107-
108-
# File must exist to be patched
109-
[[ -f "$file" ]] || return 1
110-
111-
# Any time we see libwolfprov, we're patched
112-
if grep -q 'libwolfprov' -- "$file"; then
113-
return 0
114-
fi
115-
116-
# Not patched
117-
return 1
118-
}
119-
120-
patch_openssl_version() {
121-
# Patch the OpenSSL version (wolfProvider/openssl-source/VERSION.dat)
122-
# with our BUILD_METADATA, depending on the FIPS flag. Either "wolfProvider" or "wolfProvider-fips".
123-
if [ ${WOLFSSL_ISFIPS:-0} -eq 1 ]; then
124-
sed -i 's/BUILD_METADATA=.*/BUILD_METADATA=wolfProvider-fips/g' ${OPENSSL_SOURCE_DIR}/VERSION.dat
125-
else
126-
sed -i 's/BUILD_METADATA=.*/BUILD_METADATA=wolfProvider-nonfips/g' ${OPENSSL_SOURCE_DIR}/VERSION.dat
127-
fi
128-
129-
# Patch the OpenSSL RELEASE_DATE field with the current date in the format DD MMM YYYY
130-
sed -i "s/RELEASE_DATE=.*/RELEASE_DATE=$(date '+%d %b %Y')/g" ${OPENSSL_SOURCE_DIR}/VERSION.dat
131-
}
132-
133-
patch_openssl() {
134-
if [ "$WOLFPROV_REPLACE_DEFAULT" = "1" ]; then
135-
136-
if [ -d "${OPENSSL_INSTALL_DIR}" ]; then
137-
# If openssl is already installed, patching makes no sense as
138-
# it will not be rebuilt. It may already be built as patched,
139-
# just return and let check_openssl_replace_default_mismatch
140-
# check for the mismatch.
141-
return 0
142-
fi
143-
144-
printf "\tApplying OpenSSL default provider patch ... "
145-
pushd ${OPENSSL_SOURCE_DIR} &> /dev/null
146-
147-
# Check if patch is already applied
148-
if is_openssl_patched; then
149-
printf "Already applied.\n"
150-
popd &> /dev/null
151-
return 0
152-
fi
153-
154-
# Apply the patch
155-
patch -p1 < ${SCRIPT_DIR}/../patches/openssl3-replace-default.patch >>$LOG_FILE 2>&1
156-
if [ $? != 0 ]; then
157-
printf "ERROR.\n"
158-
printf "\n\nPatch application failed. Last 40 lines of log:\n"
159-
tail -n 40 $LOG_FILE
160-
do_cleanup
161-
exit 1
162-
fi
163-
patch_openssl_version
164-
printf "Done.\n"
165-
166-
popd &> /dev/null
167-
else
168-
printf "\tPatching OpenSSL version only ... "
169-
pushd ${OPENSSL_SOURCE_DIR} &> /dev/null
170-
patch_openssl_version
171-
printf "Done.\n"
172-
popd &> /dev/null
173-
fi
174-
}
175-
176103
check_openssl_replace_default_mismatch() {
177-
local openssl_is_patched=0
104+
local is_patched=0
178105

179106
# Check if the source was patched for --replace-default
180-
if is_openssl_patched; then
181-
openssl_is_patched=1
107+
if openssl_is_patched $OPENSSL_SOURCE_DIR; then
108+
is_patched=1
182109
printf "INFO: OpenSSL source modified - wolfProvider integrated as default provider (non-stock build).\n"
183110
fi
184111

185112
# Check for mismatch
186-
if [ "$WOLFPROV_REPLACE_DEFAULT" = "1" ] && [ "$openssl_is_patched" = "0" ]; then
113+
if [ "$WOLFPROV_REPLACE_DEFAULT" = "1" ] && [ "$is_patched" = "0" ]; then
187114
printf "ERROR: --replace-default build mode mismatch!\n"
188115
printf "Existing OpenSSL was built WITHOUT --replace-default patch\n"
189116
printf "Current request: --replace-default build\n\n"
190117
printf "Fix: ./scripts/build-wolfprovider.sh --distclean\n"
191118
printf "Then rebuild with desired configuration.\n"
192119
exit 1
193-
elif [ "$WOLFPROV_REPLACE_DEFAULT" != "1" ] && [ "$openssl_is_patched" = "1" ]; then
120+
elif [ "$WOLFPROV_REPLACE_DEFAULT" != "1" ] && [ "$is_patched" = "1" ]; then
194121
printf "ERROR: Standard build mode mismatch!\n"
195122
printf "Existing OpenSSL was built WITH --replace-default patch\n"
196123
printf "Current request: standard build\n\n"
@@ -203,7 +130,7 @@ check_openssl_replace_default_mismatch() {
203130
install_openssl() {
204131
printf "\nInstalling OpenSSL ${OPENSSL_TAG} ...\n"
205132
clone_openssl
206-
patch_openssl
133+
openssl_patch "$WOLFPROV_REPLACE_DEFAULT" "${OPENSSL_SOURCE_DIR}"
207134
check_openssl_replace_default_mismatch
208135

209136
pushd ${OPENSSL_SOURCE_DIR} &> /dev/null
@@ -266,7 +193,7 @@ init_openssl() {
266193
if [ "$WOLFPROV_REPLACE_DEFAULT" = "1" ]; then
267194
OPENSSL_OPTS+=" --replace-default"
268195
fi
269-
$SCRIPT_DIR/debian/install-openssl.sh $OPENSSL_OPTS --output-dir ${REPO_DIR}/..
196+
$SCRIPT_DIR/debian/install-openssl.sh $OPENSSL_OPTS --output-dir ..
270197
else
271198
install_openssl
272199
fi

‎scripts/verify-install.sh‎

Lines changed: 17 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -310,18 +310,18 @@ verify_wolfprovider() {
310310
# version: 1.0.2
311311
# status: active
312312

313-
# When replace-default is 0, expect:
314-
# $ openssl version
313+
# When using base openssl, expect:
314+
# $ openssl version
315315
# OpenSSL 3.0.17 1 Jul 2025 (Library: OpenSSL 3.0.17 1 Jul 2025
316316

317+
# When using wolfProvider's openssl with replace-default 0, expect:
318+
# openssl version
319+
# OpenSSL 3.0.17+wolfProvider 03 Nov 2025 (Library: OpenSSL 3.0.17+wolfProvider 03 Nov 2025)
320+
317321
# When replace-default is 1 and fips is 0, expect:
318-
# $ openssl version
322+
# $ openssl version
319323
# OpenSSL 3.0.17+wolfProvider-nonfips 30 Sep 2025 (Library: OpenSSL 3.0.17+wolfProvider-nonfips 30 Sep 2025)
320324

321-
# When fips is 1, expect:
322-
# $ openssl version
323-
# OpenSSL 3.0.17+wolfProvider-fips 11 Oct 2025 (Library: OpenSSL 3.0.17+wolfProvider-fips 11 Oct 2025)
324-
325325
# When fips is 1, expect:
326326
# $ dpkg -l | grep libwolfssl
327327
# ii libwolfssl 5.8.2+commercial.fips.linuxv5.2.4 amd64 wolfSSL encryption library
@@ -341,8 +341,8 @@ self_test() {
341341

342342
# Mock strings for openssl version
343343
local ver_base="OpenSSL 3.0.17 1 Jul 2025 (Library: OpenSSL 3.0.17 1 Jul 2025)"
344-
local ver_replace_default_nonfips="OpenSSL 3.0.17+wolfProvider-nonfips 30 Sep 2025 (Library: OpenSSL 3.0.17+wolfProvider-nonfips 30 Sep 2025)"
345-
local ver_replace_default_fips="OpenSSL 3.0.17+wolfProvider-fips 11 Oct 2025 (Library: OpenSSL 3.0.17+wolfProvider-fips 11 Oct 2025)"
344+
local ver_wp="OpenSSL 3.0.17+wolfProvider 03 Nov 2025 (Library: OpenSSL 3.0.17+wolfProvider 03 Nov 2025)"
345+
local ver_replace_default="OpenSSL 3.0.17+wolfProvider-nonfips 30 Sep 2025 (Library: OpenSSL 3.0.17+wolfProvider-nonfips 30 Sep 2025)"
346346

347347
# Mock strings for provider listings
348348
read -r -d '' providers_libwolfprov_nonfips <<'EOF'
@@ -446,27 +446,26 @@ EOF
446446

447447
# Positive cases per comment expectations
448448
run_case "pos: replace_default=0,fips=0" 0 0 0 0 ver_base providers_libwolfprov_nonfips dpkg_installed_nonfips
449-
run_case "pos: replace_default=1,fips=0" 0 0 1 0 ver_replace_default_nonfips providers_default_wolf_nonfips dpkg_installed_nonfips
450-
run_case "pos: replace_default=1,fips=1" 0 1 1 0 ver_replace_default_fips providers_default_wolf_fips dpkg_installed_fips
449+
run_case "pos: replace_default=1,fips=0" 0 0 1 0 ver_replace_default providers_default_wolf_nonfips dpkg_installed_nonfips
451450
run_case "pos: replace_default=0,fips=1" 0 1 0 0 ver_base providers_libwolfprov_fips dpkg_installed_fips
452451
# run positive test cases with providers_default_openssl_only
453452
run_case "pos: no_wp true with OpenSSL default, default provider" 0 0 0 1 ver_base providers_default_openssl_only dpkg_installed_nonfips
454-
run_case "pos: no_wp true but wolfProvider active" 1 0 0 1 ver_base providers_libwolfprov_nonfips dpkg_installed_nonfips
453+
run_case "pos: no_wp true but wolfProvider active" 1 0 0 1 ver_wp providers_libwolfprov_nonfips dpkg_installed_nonfips
455454

456455
# Negative cases
457-
run_case "neg: rd=0 but OpenSSL replace-default" 1 0 0 0 ver_replace_default_nonfips providers_libwolfprov_nonfips dpkg_installed_nonfips
456+
run_case "neg: rd=0 but OpenSSL replace-default" 1 0 0 0 ver_replace_default providers_libwolfprov_nonfips dpkg_installed_nonfips
457+
run_case "neg: rd=0 but OpenSSL wp metadata" 1 0 0 0 ver_wp providers_libwolfprov_nonfips dpkg_installed_nonfips
458458
run_case "neg: rd=0 but provider default" 1 0 0 0 ver_base providers_both_default_and_libwolfprov dpkg_installed_nonfips
459459
run_case "neg: rd=0 but no providers listed" 1 0 0 0 ver_base providers_none dpkg_installed_nonfips
460460
run_case "neg: rd=0 missing provider" 1 0 0 0 ver_base providers_default_openssl_only dpkg_installed_nonfips
461-
run_case "neg: rd=1,fips=0 but OpenSSL FIPS" 1 0 1 0 ver_replace_default_fips providers_default_wolf_nonfips dpkg_installed_nonfips
462-
run_case "neg: rd=1,fips=0 but provider FIPS" 1 0 1 0 ver_replace_default_nonfips providers_default_wolf_fips dpkg_installed_nonfips
463-
run_case "neg: rd=1,fips=0 but no providers listed" 1 0 1 0 ver_replace_default_nonfips providers_none dpkg_installed_nonfips
464-
run_case "neg: rd=1,fips=1 but OpenSSL non-FIPS" 1 1 1 0 ver_replace_default_nonfips providers_default_wolf_fips dpkg_installed_fips
461+
run_case "neg: rd=1,fips=0 but provider FIPS" 1 0 1 0 ver_replace_default providers_default_wolf_fips dpkg_installed_nonfips
462+
run_case "neg: rd=1,fips=0 but no providers listed" 1 0 1 0 ver_replace_default providers_none dpkg_installed_nonfips
463+
run_case "neg: rd=1,fips=1 but OpenSSL non-FIPS" 1 1 1 0 ver_replace_default providers_default_wolf_fips dpkg_installed_fips
465464
run_case "neg: fips=1 but wolfSSL non-FIPS" 1 1 0 0 ver_base providers_libwolfprov_fips dpkg_installed_nonfips
466465

467466
# no_wp positive and negative cases
468467
run_case "neg: no_wp true with OpenSSL default, default provider" 1 0 0 1 ver_base providers_none dpkg_installed_nonfips
469-
run_case "neg: no_wp true but wolfProvider active" 1 0 0 1 ver_base providers_libwolfprov_nonfips dpkg_installed_nonfips
468+
run_case "neg: no_wp true but wolfProvider active" 1 0 0 1 ver_wp providers_libwolfprov_nonfips dpkg_installed_nonfips
470469

471470
log_info "self_test results: ${pass_count} passed, ${fail_count} failed"
472471
if [ "$fail_count" -gt 0 ]; then

0 commit comments

Comments
 (0)