Skip to content

Commit e41dcd0

Browse files
aidangarskeaidangarske
authored
Merge pull request #298 from padelsbach/wp-non-replace-default
Re-enable non-replace-default builds
2 parents 1095646 + a29736f commit e41dcd0

File tree

14 files changed

+132
-96
lines changed

14 files changed

+132
-96
lines changed

‎.github/workflows/debian-package.yml‎

Lines changed: 42 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -27,9 +27,6 @@ jobs:
2727
replace_default: [ true ]
2828

2929
libwolfprov-standalone:
30-
# Standalone mode is disabled until we re-enable support for it in the debian build.
31-
if: false
32-
3330
runs-on: ubuntu-22.04
3431
needs: build_wolfprovider
3532
# Run inside Debian Bookworm to match packaging environment
@@ -43,11 +40,12 @@ jobs:
4340
matrix:
4441
wolfssl_ref: [ 'v5.8.2-stable' ]
4542
openssl_ref: [ 'openssl-3.5.2' ]
46-
replace_default: [ true ]
43+
replace_default: [ false ]
4744
env:
4845
WOLFSSL_PACKAGES_PATH: /tmp/wolfssl-packages
4946
OPENSSL_PACKAGES_PATH: /tmp/openssl-packages
5047
WOLFPROV_PACKAGES_PATH: /tmp/wolfprov-packages
48+
WOLFPROV_CONF_FILE: /etc/ssl/openssl.cnf.d/wolfprovider.conf
5149
steps:
5250
- name: Checkout wolfProvider
5351
uses: actions/checkout@v4
@@ -86,17 +84,16 @@ jobs:
8684
8785
- name: Test OpenSSL provider functionality
8886
run: |
89-
PROVIDER_CONF="/usr/lib/ssl/openssl.cnf.d/wolfprovider.conf"
90-
PROVIDER_CONF_BACKUP="/tmp/wolfprovider.conf.backup"
87+
WOLFPROV_CONF_BACKUP="/tmp/wolfprovider.conf.backup"
9188
9289
# Temporarily move wolfprovider config so we can toggle between providers
9390
echo "Temporarily disabling wolfprovider for default provider tests:"
9491
mkdir -p /tmp/openssl-test
95-
if [ -f $PROVIDER_CONF ]; then
96-
mv $PROVIDER_CONF $PROVIDER_CONF_BACKUP
97-
echo " - Moved $PROVIDER_CONF to $PROVIDER_CONF_BACKUP"
92+
if [ -f $WOLFPROV_CONF_FILE ]; then
93+
mv $WOLFPROV_CONF_FILE $WOLFPROV_CONF_BACKUP
94+
echo " - Moved $WOLFPROV_CONF_FILE to $WOLFPROV_CONF_BACKUP"
9895
else
99-
echo "$PROVIDER_CONF not found!"
96+
echo "$WOLFPROV_CONF_FILE not found!"
10097
exit 1
10198
fi
10299
@@ -106,16 +103,36 @@ jobs:
106103
107104
# Restore wolfprovider configuration
108105
echo "Restoring wolfprovider configuration:"
109-
if [ -f $PROVIDER_CONF_BACKUP ]; then
110-
mv $PROVIDER_CONF_BACKUP $PROVIDER_CONF
111-
echo " - Restored $PROVIDER_CONF from $PROVIDER_CONF_BACKUP"
106+
if [ -f $WOLFPROV_CONF_BACKUP ]; then
107+
mv $WOLFPROV_CONF_BACKUP $WOLFPROV_CONF_FILE
108+
echo " - Restored $WOLFPROV_CONF_FILE from $WOLFPROV_CONF_BACKUP"
112109
fi
113110
114111
echo "PASS: All provider interoperability tests successful"
115112
116113
- name: Uninstall package and verify cleanup
117114
run: |
118115
# Uninstall the package
116+
apt-get remove -y libwolfprov
117+
118+
# Verify default OpenSSL provider is active
119+
echo "Verifying Default Provider is Active:"
120+
openssl list -providers
121+
122+
# Verify that the default provider is present and active
123+
echo "Checking default provider status:"
124+
if openssl list -providers | grep -q "default" && \
125+
openssl list -providers | grep -q "OpenSSL Default Provider" && \
126+
openssl list -providers | grep -q "status: active"; then
127+
echo "Default provider is present and active"
128+
else
129+
echo "Default provider verification failed"
130+
echo "Provider output:"
131+
openssl list -providers
132+
exit 1
133+
fi
134+
135+
# Purge the package to remove all files
119136
apt-get remove --purge -y libwolfprov
120137
121138
# Verify the package is removed
@@ -128,27 +145,24 @@ jobs:
128145
fi
129146
130147
# Check if the config file is removed
131-
if [ -f /usr/lib/ssl/openssl.cnf.d/wolfprovider.conf ]; then
148+
if [ -f $WOLFPROV_CONF_FILE ]; then
132149
echo "wolfprovider.conf still exists after package removal"
133-
ls -la /usr/lib/ssl/openssl.cnf.d/
150+
ls -la $(dirname $WOLFPROV_CONF_FILE)
134151
exit 1
135152
else
136153
echo "wolfprovider.conf successfully removed"
137154
fi
138155
139156
# Check if the library files are removed
140-
if [ -f /usr/lib/*/ossl-modules/libwolfprov.so ]; then
157+
WOLFPROV_OBJS=$(find /usr/lib -name "libwolfprov.so*")
158+
if [ -n "$WOLFPROV_OBJS" ]; then
141159
echo "libwolfprov.so still exists after package removal"
142-
find /usr/lib -name "libwolfprov.so*" 2>/dev/null || true
160+
echo "$WOLFPROV_OBJS"
143161
exit 1
144162
else
145163
echo "libwolfprov.so successfully removed"
146164
fi
147165
148-
# Verify default OpenSSL provider is active
149-
echo "Verifying Default Provider is Active:"
150-
openssl list -providers
151-
152166
# Verify that the default provider is present and active
153167
echo "Checking default provider status:"
154168
if openssl list -providers | grep -q "default" && \
@@ -165,7 +179,7 @@ jobs:
165179
echo "Package uninstallation and cleanup verification successful"
166180
167181
168-
libwolfprov-with-openssl:
182+
libwolfprov-replace-default:
169183
runs-on: ubuntu-22.04
170184
needs: build_wolfprovider
171185
# Run inside Debian Bookworm to match packaging environment
@@ -184,6 +198,7 @@ jobs:
184198
WOLFSSL_PACKAGES_PATH: /tmp/wolfssl-packages
185199
OPENSSL_PACKAGES_PATH: /tmp/openssl-packages
186200
WOLFPROV_PACKAGES_PATH: /tmp/wolfprov-packages
201+
WOLFPROV_CONF_FILE: /etc/ssl/openssl.cnf.d/wolfprovider.conf
187202
steps:
188203
- name: Checkout wolfProvider
189204
uses: actions/checkout@v4
@@ -254,17 +269,18 @@ jobs:
254269
echo "Verifying wolfprov configuration..."
255270
256271
# Check if configuration file exists
257-
if [ -f /usr/lib/ssl/openssl.cnf.d/wolfprovider.conf ]; then
272+
if [ -f $WOLFPROV_CONF_FILE ]; then
258273
echo "SUCCESS: wolfprovider.conf exists"
259-
cat /usr/lib/ssl/openssl.cnf.d/wolfprovider.conf
274+
cat $WOLFPROV_CONF_FILE
260275
else
261276
echo "WARNING: wolfprovider.conf not found"
262277
fi
263278
264279
# Check if library file exists
265-
if [ -f /usr/lib/*/ossl-modules/libwolfprov.so ]; then
280+
WOLFPROV_OBJS=$(find /usr/lib -name "libwolfprov.so*")
281+
if [ -n "$WOLFPROV_OBJS" ]; then
266282
echo "SUCCESS: libwolfprov.so exists"
267-
find /usr/lib -name "libwolfprov.so*" 2>/dev/null
283+
echo "$WOLFPROV_OBJS"
268284
else
269285
echo "WARNING: libwolfprov.so not found"
270286
fi

‎.gitignore‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,8 @@ test/**/*.trs
8484
test/**/*.o
8585
test/**/.deps/
8686
test/**/.dirstamp
87+
req_outputs
88+
scripts/cmd_test/req-test.log
8789

8890
IDE/Android/android-ndk-r26b/
8991
IDE/Android/openssl-source/
@@ -117,4 +119,6 @@ debian/libssl3*
117119
!debian/*.postrm
118120
!debian/*.docs
119121
!debian/*.links
122+
!debian/*.triggers
123+
!debian/shlib.local
120124

‎debian/control‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,8 @@ Build-Depends:
1414
Package: libwolfprov
1515
Architecture: any
1616
Multi-Arch: same
17-
Depends: ${shlibs:Depends}, ${misc:Depends}, libssl3 (>= 3.0.3), libwolfssl (>= 5.8.2), openssl
17+
Depends: ${shlibs:Depends}, ${misc:Depends}, libssl3 (>= 3.0.3), libwolfssl (>= 5.8.2)
18+
Recommends: openssl
1819
Provides: ${variant:provides}
1920
XB-Variant: ${variant}
2021
Description: wolfProvider library for OpenSSL — ${variant:desc}
@@ -43,9 +44,8 @@ Architecture: any
4344
Section: utils
4445
Multi-Arch: foreign
4546
Depends: ${shlibs:Depends}, ${misc:Depends}
46-
Description: Secure Sockets Layer toolkit - command line interface
47+
Description: Secure Sockets Layer toolkit - command line interface (wolfProvider build)
4748
This package contains the OpenSSL command line utility.
48-
Built for use with wolfProvider.
4949

5050
Package: libssl3
5151
Architecture: any

‎debian/libwolfprov.install‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
usr/lib/*/ossl-modules/libwolfprov.so.0.0.0
2-
usr/lib/ssl/openssl.cnf.d
3-
usr/lib/ssl/openssl.cnf.d/wolfprovider.conf
2+
etc/ssl/openssl.cnf.d
3+
etc/ssl/openssl.cnf.d/wolfprovider.conf

‎debian/libwolfprov.postinst‎

Lines changed: 35 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -1,35 +1,44 @@
11
#!/bin/sh
22
set -e
33

4-
# We currently only support "replace default" mode.
5-
# In this mode, we don't need to modify the system openssl.cnf file
6-
# since our modified openssl references libwolfprov.so explicitly.
7-
# In the future, we should add scripting here to find the system openssl.cnf file
8-
# and add the include line to it. Note that the code below
9-
# references a hardcoded path which may not be correct for all systems.
4+
# Define the include line to add to the openssl.cnf file
5+
INCLUDE_LINE=".include /etc/ssl/openssl.cnf.d/wolfprovider.conf"
106

11-
# INCLUDE_LINE=".include /usr/lib/ssl/openssl.cnf.d/wolfprovider.conf"
12-
# CONF_FILE="/usr/lib/ssl/openssl.cnf"
13-
# CONF_DEFAULT="/usr/share/openssl-defaults/openssl.cnf"
7+
# Search for the openssl.cnf file in /usr, /lib and /etc
8+
CONF_FILES=$(find /usr /lib /etc -name openssl.cnf 2>/dev/null)
149

15-
# # Copy from our template if it doesn't exist
16-
# if [ ! -f "$CONF_FILE" ]; then
17-
# echo "Config file does not exist: $CONF_FILE"
18-
# if [ -f "$CONF_DEFAULT" ]; then
19-
# install -Dm644 "$CONF_DEFAULT" "$CONF_FILE"
20-
# else
21-
# echo "Default config file does not exist: $CONF_DEFAULT"
22-
# exit 1
23-
# fi
24-
# fi
10+
# Check if we are in replace-default mode by reading the openssl version
11+
REPLACE_DEFAULT=0
12+
if command -v openssl >/dev/null 2>&1; then
13+
OPENSSL_VERSION=$(openssl version)
14+
if echo "$OPENSSL_VERSION" | grep -q "wolfProvider"; then
15+
REPLACE_DEFAULT=1
16+
fi
17+
fi
2518

26-
# # Add include for wolfprovider config file if not already present
27-
# if grep -qF "$INCLUDE_LINE" "$CONF_FILE"; then
28-
# echo "Include line already exists in $CONF_FILE"
29-
# else
30-
# echo "Adding include for wolfprovider to $CONF_FILE..."
31-
# sed -i "/^openssl_conf/ a $INCLUDE_LINE" "$CONF_FILE"
32-
# fi
19+
if [ $REPLACE_DEFAULT -eq 1 ]; then
20+
# Remove INCLUDE_LINE from each CONF_FILE
21+
# Replace default mode should automatically find wolfProvider.
22+
# Using the config file or OPENSSL_CONF will cause:
23+
# 1. the provider name to be 'libwolfprov' instead of 'default'
24+
# 2. the provider init call to happen twice
25+
# Neither of these is harmful, but it's not ideal.
26+
for CONF_FILE in $CONF_FILES; do
27+
# Remove any line containing both ".include" and "wolfprovider.conf"
28+
sed -i '/\.include/ { /wolfprovider\.conf/ d; }' "$CONF_FILE"
29+
printf "Removed wolfprovider include line(s) from %s\n" "$CONF_FILE"
30+
done
31+
else
32+
# For each CONF_FILE, apply the include line to the openssl.cnf file, if not already applied
33+
for CONF_FILE in $CONF_FILES; do
34+
if grep -qF "$INCLUDE_LINE" "$CONF_FILE"; then
35+
echo "Include line already exists in $CONF_FILE"
36+
else
37+
echo "Adding include for wolfprovider to $CONF_FILE..."
38+
echo "$INCLUDE_LINE" >> "$CONF_FILE"
39+
fi
40+
done
41+
fi
3342

3443
#DEBHELPER#
3544
exit 0

‎debian/libwolfprov.postrm‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
#!/bin/sh
2+
set -e
3+
4+
# On removal/purge of libwolfprov, ensure any include of wolfprovider.conf
5+
# is removed from system openssl.cnf files to avoid stale includes.
6+
7+
# Search for the openssl.cnf file in /usr, /lib and /etc
8+
CONF_FILES=$(find /usr /lib /etc -name openssl.cnf 2>/dev/null)
9+
10+
case "$1" in
11+
remove|purge)
12+
for CONF_FILE in $CONF_FILES; do
13+
# Remove any line containing both ".include" and "wolfprovider.conf"
14+
sed -i '/\.include/ { /wolfprovider\.conf/ d; }' "$CONF_FILE"
15+
printf "Removed wolfprovider include line(s) from %s\n" "$CONF_FILE"
16+
done
17+
;;
18+
esac
19+
20+
#DEBHELPER#
21+
exit 0
22+
23+

‎debian/libwolfprov.triggers‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# Re-run our setup whenever OpenSSL config or module dirs change
2+
interest-noawait /etc/ssl/openssl.cnf
3+
interest-noawait /etc/ssl/openssl.cnf.d
4+
interest-noawait /lib/ssl/openssl.cnf
5+
interest-noawait /lib/ssl/openssl.cnf.d
6+

‎debian/openssl.install‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
usr/bin/openssl
2-
usr/share/openssl-defaults/openssl.cnf
2+
etc/ssl/openssl.cnf

‎debian/openssl.links‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# openssl expects the conf file under /usr/lib/ssl, so ensure the symlink
2+
# is set to match the normal install
3+
/etc/ssl/openssl.cnf /usr/lib/ssl/openssl.cnf
4+
# Other symlinks expected by Debian
5+
/etc/ssl/certs /usr/lib/ssl/certs
6+
/etc/ssl/private /usr/lib/ssl/private

‎debian/openssl.postinst‎

Lines changed: 0 additions & 19 deletions
This file was deleted.

0 commit comments

Comments
 (0)