Skip to content

Commit 41eacf4

Browse files
Robert Marshallbalasankarc
Robert Marshall
and
balasankarc
committed
Merge branch 'bump-openssl-3' into 'master'
Allow OpenSSL 3.2.1 builds See merge request https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/7416 Merged-by: Robert Marshall <[email protected]> Approved-by: Andrew Patterson <[email protected]> Approved-by: Robert Marshall <[email protected]> Co-authored-by: Balasankar 'Balu' C <[email protected]>
2 parents 1f61d53 + 20735c5 commit 41eacf4

File tree

4 files changed

+160
-74
lines changed

4 files changed

+160
-74
lines changed

‎config/projects/gitlab.rb

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,8 @@
9393
else
9494
runtime_dependency 'libatomic1'
9595
end
96+
97+
allowed_lib /libatomic.so.1/ if OhaiHelper.raspberry_pi?
9698
end
9799

98100
# FIPs requires system OpenSSL packages to run

‎config/software/openssl.rb

Lines changed: 6 additions & 74 deletions
Original file line numberDiff line numberDiff line change
@@ -1,75 +1,7 @@
1-
#
2-
# Copyright 2012-2019, Chef Software Inc.
3-
#
4-
# Licensed under the Apache License, Version 2.0 (the "License");
5-
# you may not use this file except in compliance with the License.
6-
# You may obtain a copy of the License at
7-
#
8-
# http://www.apache.org/licenses/LICENSE-2.0
9-
#
10-
# Unless required by applicable law or agreed to in writing, software
11-
# distributed under the License is distributed on an "AS IS" BASIS,
12-
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13-
# See the License for the specific language governing permissions and
14-
# limitations under the License.
15-
#
16-
require "#{Omnibus::Config.project_root}/lib/gitlab/ohai_helper.rb"
1+
openssl_software_definition = if Gitlab::Util.get_env('OPENSSL_VERSION')&.start_with?("3")
2+
File.join(Omnibus::Config.software_dir, 'openssl_3.rb')
3+
else
4+
File.join(Omnibus::Config.software_dir, 'openssl_1.rb')
5+
end
176

18-
name 'openssl'
19-
20-
license 'OpenSSL'
21-
license_file 'LICENSE'
22-
23-
skip_transitive_dependency_licensing true
24-
25-
dependency 'cacerts'
26-
27-
version = Gitlab::Version.new('openssl', 'OpenSSL_1_1_1w')
28-
29-
default_version version.print(false)
30-
display_version version.print(false).delete_prefix('OpenSSL_').tr('_', '.')
31-
vendor 'openssl'
32-
33-
source git: version.remote
34-
35-
build do
36-
env = with_standard_compiler_flags(with_embedded_path)
37-
38-
configure_args = [
39-
"--prefix=#{install_dir}/embedded",
40-
'no-comp',
41-
'no-idea',
42-
'no-mdc2',
43-
'no-rc5',
44-
'no-ssl2',
45-
'no-ssl3',
46-
'no-zlib',
47-
'shared',
48-
]
49-
50-
prefix = if linux? && s390x?
51-
# With gcc > 4.3 on s390x there is an error building
52-
# with inline asm enabled
53-
'./Configure linux64-s390x -DOPENSSL_NO_INLINE_ASM'
54-
elsif OhaiHelper.raspberry_pi?
55-
'./Configure linux-generic32'
56-
else
57-
'./config'
58-
end
59-
configure_cmd = "#{prefix} disable-gost"
60-
61-
# Out of abundance of caution, we put the feature flags first and then
62-
# the crazy platform specific compiler flags at the end.
63-
configure_args << env['CFLAGS'] << env['LDFLAGS']
64-
65-
configure_command = configure_args.unshift(configure_cmd).join(' ')
66-
67-
command configure_command, env: env, in_msys_bash: true
68-
69-
patch source: "openssl-1.1.1f-do-not-install-docs.patch", env: env
70-
71-
make 'depend', env: env
72-
# make -j N on openssl is not reliable
73-
make env: env
74-
make 'install', env: env
75-
end
7+
instance_eval(IO.read(openssl_software_definition))

‎config/software/openssl_1.rb

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
#
2+
# Copyright 2012-2019, Chef Software Inc.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
#
16+
require "#{Omnibus::Config.project_root}/lib/gitlab/ohai_helper.rb"
17+
18+
name 'openssl'
19+
20+
license 'OpenSSL'
21+
license_file 'LICENSE'
22+
23+
skip_transitive_dependency_licensing true
24+
25+
dependency 'cacerts'
26+
27+
version = Gitlab::Version.new('openssl', 'OpenSSL_1_1_1w')
28+
29+
default_version version.print(false)
30+
display_version version.print(false).delete_prefix('OpenSSL_').tr('_', '.')
31+
vendor 'openssl'
32+
33+
source git: version.remote
34+
35+
build do
36+
env = with_standard_compiler_flags(with_embedded_path)
37+
38+
configure_args = [
39+
"--prefix=#{install_dir}/embedded",
40+
'no-comp',
41+
'no-idea',
42+
'no-mdc2',
43+
'no-rc5',
44+
'no-ssl2',
45+
'no-ssl3',
46+
'no-zlib',
47+
'shared',
48+
]
49+
50+
prefix = if linux? && s390x?
51+
# With gcc > 4.3 on s390x there is an error building
52+
# with inline asm enabled
53+
'./Configure linux64-s390x -DOPENSSL_NO_INLINE_ASM'
54+
elsif OhaiHelper.raspberry_pi?
55+
'./Configure linux-generic32'
56+
else
57+
'./config'
58+
end
59+
configure_cmd = "#{prefix} disable-gost"
60+
61+
# Out of abundance of caution, we put the feature flags first and then
62+
# the crazy platform specific compiler flags at the end.
63+
configure_args << env['CFLAGS'] << env['LDFLAGS']
64+
65+
configure_command = configure_args.unshift(configure_cmd).join(' ')
66+
67+
command configure_command, env: env, in_msys_bash: true
68+
69+
patch source: "openssl-1.1.1f-do-not-install-docs.patch", env: env
70+
71+
make 'depend', env: env
72+
# make -j N on openssl is not reliable
73+
make env: env
74+
make 'install', env: env
75+
end

‎config/software/openssl_3.rb

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
#
2+
# Copyright 2012-2019, Chef Software Inc.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
#
16+
require "#{Omnibus::Config.project_root}/lib/gitlab/ohai_helper.rb"
17+
18+
name 'openssl'
19+
20+
license 'Apache-2.0'
21+
license_file 'LICENSE.txt'
22+
23+
skip_transitive_dependency_licensing true
24+
25+
dependency 'cacerts'
26+
27+
version = Gitlab::Version.new('openssl', 'openssl-3.2.1')
28+
29+
default_version version.print(false)
30+
display_version version.print(false).delete_prefix('openssl-')
31+
32+
vendor 'openssl'
33+
34+
source git: version.remote
35+
36+
build do
37+
env = with_standard_compiler_flags(with_embedded_path)
38+
39+
configure_args = [
40+
"--prefix=#{install_dir}/embedded",
41+
"--libdir=#{install_dir}/embedded/lib",
42+
'no-unit-test',
43+
'no-docs',
44+
'no-comp',
45+
'no-idea',
46+
'no-mdc2',
47+
'no-rc5',
48+
'no-ssl3',
49+
'no-zlib',
50+
'shared',
51+
]
52+
53+
prefix = if linux? && s390x?
54+
# With gcc > 4.3 on s390x there is an error building
55+
# with inline asm enabled
56+
'./Configure linux64-s390x -DOPENSSL_NO_INLINE_ASM'
57+
elsif OhaiHelper.raspberry_pi?
58+
# 32-bit arm OSs require linking against libatomic
59+
'./Configure linux-latomic'
60+
else
61+
'./config'
62+
end
63+
configure_cmd = "#{prefix} disable-gost"
64+
65+
# Out of abundance of caution, we put the feature flags first and then
66+
# the crazy platform specific compiler flags at the end.
67+
configure_args << env['CFLAGS'] << env['LDFLAGS']
68+
69+
configure_command = configure_args.unshift(configure_cmd).join(' ')
70+
71+
command configure_command, env: env, in_msys_bash: true
72+
73+
make 'depend', env: env
74+
# make -j N on openssl is not reliable
75+
make env: env
76+
make 'install', env: env
77+
end

0 commit comments

Comments
 (0)