From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mga02.intel.com (mga02.intel.com [134.134.136.20]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 84B0B81F5B for ; Mon, 27 Feb 2017 07:39:10 -0800 (PST) Received: from orsmga004.jf.intel.com ([10.7.209.38]) by orsmga101.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 27 Feb 2017 07:39:10 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.35,215,1484035200"; d="scan'208";a="62579986" Received: from fmsmsx103.amr.corp.intel.com ([10.18.124.201]) by orsmga004.jf.intel.com with ESMTP; 27 Feb 2017 07:39:10 -0800 Received: from fmsmsx125.amr.corp.intel.com (10.18.125.40) by FMSMSX103.amr.corp.intel.com (10.18.124.201) with Microsoft SMTP Server (TLS) id 14.3.248.2; Mon, 27 Feb 2017 07:39:09 -0800 Received: from shsmsx152.ccr.corp.intel.com (10.239.6.52) by FMSMSX125.amr.corp.intel.com (10.18.125.40) with Microsoft SMTP Server (TLS) id 14.3.248.2; Mon, 27 Feb 2017 07:39:09 -0800 Received: from shsmsx103.ccr.corp.intel.com ([169.254.4.20]) by SHSMSX152.ccr.corp.intel.com ([169.254.6.132]) with mapi id 14.03.0248.002; Mon, 27 Feb 2017 23:39:07 +0800 From: "Long, Qin" To: Laszlo Ersek , "edk2-devel@ml01.01.org" CC: "Ye, Ting" , "Wu, Jiaxin" Thread-Topic: [edk2] [PATCH v2] CryptoPkg/OpensslLib: Upgrade OpenSSL version to 1.0.2k Thread-Index: AQHSkOePlYeIgFSrl0W3pfZtVtG1+aF8+x2w Date: Mon, 27 Feb 2017 15:39:06 +0000 Message-ID: References: <20170227072044.7852-1-qin.long@intel.com> <835bfb25-4ad8-89d0-73bc-1856455d9d31@redhat.com> In-Reply-To: <835bfb25-4ad8-89d0-73bc-1856455d9d31@redhat.com> Accept-Language: zh-CN, en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.239.127.40] MIME-Version: 1.0 Subject: Re: [PATCH v2] CryptoPkg/OpensslLib: Upgrade OpenSSL version to 1.0.2k X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Feb 2017 15:39:10 -0000 Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Laszlo, Thanks for validations. And, I knew CRLF issue is really annoying here. Just keep this in 1.0.2xx s= eries for consistency, and we will remove the patch totally in next 1.1.0xx= . :-) Best Regards & Thanks, LONG, Qin > -----Original Message----- > From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of > Laszlo Ersek > Sent: Monday, February 27, 2017 6:52 PM > To: Long, Qin ; edk2-devel@ml01.01.org > Cc: Ye, Ting ; Wu, Jiaxin > Subject: Re: [edk2] [PATCH v2] CryptoPkg/OpensslLib: Upgrade OpenSSL > version to 1.0.2k >=20 > On 02/27/17 08:20, Qin Long wrote: > > v2: > > Re-generate the patch after the new OpensslLibCrypto instance. > > > > OpenSSL 1.0.2k was released with several severity fixes at > > 26-Jan-2017 (https://www.openssl.org/news/secadv/20170126.txt). > > This patch is to upgrade the supported OpenSSL version in > > CryptoPkg/OpensslLib to catch the latest release 1.0.2k. > > > > Cc: Ye Ting > > Cc: Wu Jiaxin > > Cc: Laszlo Ersek > > Contributed-under: TianoCore Contribution Agreement 1.0 > > Signed-off-by: Qin Long > > --- > > CryptoPkg/CryptoPkg.dec | 4 ++-- > > ...ssl-1.0.2j.patch =3D> EDKII_openssl-1.0.2k.patch} | 26 +++++++++++-= ------- > --- > > CryptoPkg/Library/OpensslLib/Install.cmd | 2 +- > > CryptoPkg/Library/OpensslLib/Install.sh | 2 +- > > CryptoPkg/Library/OpensslLib/OpensslLib.inf | 6 ++--- > > CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf | 6 ++--- > > CryptoPkg/Library/OpensslLib/Patch-HOWTO.txt | 26 +++++++++++---= - > ------- > > 7 files changed, 36 insertions(+), 36 deletions(-) rename > > CryptoPkg/Library/OpensslLib/{EDKII_openssl-1.0.2j.patch =3D> > > EDKII_openssl-1.0.2k.patch} (96%) >=20 > (1) For the next OpenSSL update, please push the patch to your personal > repository, so we can fetch the patch with "git". Patches from the list c= an be > applied, but this one is particularly hard for that, because it contains = hunks > for both CRLF and LF files. I had to split the patch email manually and t= o apply > it in two steps. >=20 > (2) I test-built the patch / OpenSSL 1.0.2k with Ia32, Ia32X64 and X64 OV= MF, > with -D TLS_ENABLE. >=20 > (3) I test-built the same without -D TLS_ENABLE. >=20 > (4) I test-built the same for aarch64 / ArmVirtQemu. >=20 > (5) For functional testing, I used the Ia32X64 OVMF binary from (3) (i.e.= , no > TLS). >=20 > (5a) The new firmware binary continued to reject an unsigned image: >=20 > [Security] 3rd party image[0] can be loaded after EndOfDxe: > PciRoot(0x0)/Pci(0x1E,0x0)/Pci(0x1,0x0)/Pci(0x5,0x0)/Scsi(0x0,0x1)/CDROM( > 0x0,0x21,0x143C)/\EFI\BOOT\BOOTX64.EFI. > DxeImageVerificationLib: Image is not signed and SHA256 hash of image is > not found in DB/DBX. > The image doesn't pass verification: > PciRoot(0x0)/Pci(0x1E,0x0)/Pci(0x1,0x0)/Pci(0x5,0x0)/Scsi(0x0,0x1)/CDROM( > 0x0,0x21,0x143C)/\EFI\BOOT\BOOTX64.EFI >=20 > (5b) The new fw binary continued to accept signed images, using previousl= y > enrolled certificates. I tested two operating systems (Fedora and Windows > 8.1), also using their internal methods to test whether SB was enabled > (dmesg and confirm-SecureBootUEFI, respectively). >=20 > (5c) after manually removing PK, I could boot the (obviously unsigned) UE= FI > shell from removable media. >=20 > (5d) Also from the CD-ROM image / UEFI shell, I could then run our > downstream (but public, of course) "EnrollDefaultKeys.efi" utility. > After that, the behavior returned to 5a and 5b; i.e. Secure Boot mode was > reenabled. Hence, >=20 > Tested-by: Laszlo Ersek >=20 > (6) The patch looks good to me. Thankfully the downstream (edk2-only) > OpenSSL patch needed no real updates (only line numbers seem to differ a > bit). Also, both INF files are updated in sync. Thus, >=20 > Reviewed-by: Laszlo Ersek >=20 > Thanks! > Laszlo >=20 >=20 > > > > diff --git a/CryptoPkg/CryptoPkg.dec b/CryptoPkg/CryptoPkg.dec index > > eee26cbccc..27c832707a 100644 > > --- a/CryptoPkg/CryptoPkg.dec > > +++ b/CryptoPkg/CryptoPkg.dec > > @@ -4,7 +4,7 @@ > > # This Package provides cryptographic-related libraries for UEFI secu= rity > modules. > > # It also provides a test application to test libraries. > > # > > -# Copyright (c) 2009 - 2016, Intel Corporation. All rights > > reserved.
> > +# Copyright (c) 2009 - 2017, Intel Corporation. All rights > > +reserved.
> > # This program and the accompanying materials # are licensed and > > made available under the terms and conditions of the BSD License # > > which accompanies this distribution. The full text of the license may > > be found at @@ -24,7 +24,7 @@ > > > > [Includes] > > Include > > - Library/OpensslLib/openssl-1.0.2j/include > > + Library/OpensslLib/openssl-1.0.2k/include > > > > [LibraryClasses] > > ## @libraryclass Provides basic library functions for cryptographi= c > primitives. > > diff --git a/CryptoPkg/Library/OpensslLib/EDKII_openssl-1.0.2j.patch > > b/CryptoPkg/Library/OpensslLib/EDKII_openssl-1.0.2k.patch > > similarity index 96% > > rename from CryptoPkg/Library/OpensslLib/EDKII_openssl-1.0.2j.patch > > rename to CryptoPkg/Library/OpensslLib/EDKII_openssl-1.0.2k.patch > > index ecd13a9d5f..cc0ce6822e 100644 > > --- a/CryptoPkg/Library/OpensslLib/EDKII_openssl-1.0.2j.patch > > +++ b/CryptoPkg/Library/OpensslLib/EDKII_openssl-1.0.2k.patch > > @@ -1,8 +1,8 @@ > > diff --git a/Configure b/Configure > > -index c39f71a..98dd1d0 100755 > > +index 5da7cad..c2cc9c5 100755 > > --- a/Configure > > +++ b/Configure > > -@@ -609,6 +609,9 @@ my %table=3D( > > +@@ -611,6 +611,9 @@ my %table=3D( > > # with itself, Applink is never engaged and can as well be omitted. > > "mingw64", "gcc:-mno-cygwin -DL_ENDIAN -O3 -Wall > > -DWIN32_LEAN_AND_MEAN -DUNICODE -D_UNICODE::- > D_MT:MINGW64:-lws2_32 > > -lgdi32 -lcrypt32:SIXTY_FOUR_BIT RC4_CHUNK_LL DES_INT > > EXPORT_VAR_AS_FN:${x86_64_asm}:mingw64:win32:cygwin-shared:- > D_WINDLL:- > > mno-cygwin:.dll.a", > > > > @@ -12,7 +12,7 @@ index c39f71a..98dd1d0 100755 > > # UWIN > > "UWIN", "cc:-DTERMIOS -DL_ENDIAN -O -Wall:::UWIN::BN_LLONG > > ${x86_gcc_des} ${x86_gcc_opts}:${no_asm}:win32", > > > > -@@ -1083,7 +1086,7 @@ if (defined($disabled{"md5"}) || > > defined($disabled{"sha"}) > > +@@ -1085,7 +1088,7 @@ if (defined($disabled{"md5"}) || > > +defined($disabled{"sha"}) > > } > > > > if (defined($disabled{"ec"}) || defined($disabled{"dsa"}) @@ -22,10 > > +22,10 @@ index c39f71a..98dd1d0 100755 > > $disabled{"gost"} =3D "forced"; > > } > > diff --git a/apps/apps.c b/apps/apps.c -index 9fdc3e0..6c183b0 100644 > > +index c487bd9..64ade15 100644 > > --- a/apps/apps.c > > +++ b/apps/apps.c > > -@@ -2375,6 +2375,8 @@ int args_verify(char ***pargs, int *pargc, > > +@@ -2386,6 +2386,8 @@ int args_verify(char ***pargs, int *pargc, > > flags |=3D X509_V_FLAG_PARTIAL_CHAIN; > > else if (!strcmp(arg, "-no_alt_chains")) > > flags |=3D X509_V_FLAG_NO_ALT_CHAINS; @@ -254,7 +254,7 @@ > > index d5a5514..bede55c 100644 > > goto err; > > > > diff --git a/crypto/bn/bn_prime.c b/crypto/bn/bn_prime.c -index > > 1d25687..ad641c3 100644 > > +index 8177fd2..4dab3bb 100644 > > --- a/crypto/bn/bn_prime.c > > +++ b/crypto/bn/bn_prime.c > > @@ -131,7 +131,7 @@ > > @@ -298,7 +298,7 @@ index 1d25687..ad641c3 100644 > > if (ctx !=3D NULL) { > > BN_CTX_end(ctx); > > BN_CTX_free(ctx); > > -@@ -375,10 +380,9 @@ static int witness(BIGNUM *w, const BIGNUM *a, > > const BIGNUM *a1, > > +@@ -376,10 +381,9 @@ static int witness(BIGNUM *w, const BIGNUM *a, > > +const BIGNUM *a1, > > return 1; > > } > > > > @@ -861,7 +861,7 @@ index 585aa8b..04c6cfc 100644 > > /* > > * Borland C seems too stupid to be able to shift and do longs in > > the diff --git a/crypto/evp/evp.h b/crypto/evp/evp.h -index > > 39ab793..ad1e350 100644 > > +index d258ef8..376f260 100644 > > --- a/crypto/evp/evp.h > > +++ b/crypto/evp/evp.h > > @@ -602,11 +602,13 @@ int EVP_MD_CTX_copy(EVP_MD_CTX *out, > const > > EVP_MD_CTX *in); @@ -1470,7 +1470,7 @@ index bbc3189..29695f9 > 100644 > > + +#endif /* OPENSSL_NO_STDIO */ diff --git a/crypto/x509/x509_vfy.c > > b/crypto/x509/x509_vfy.c -index 8334b3f..d075f66 100644 > > +index b147201..5bf3f07 100644 > > --- a/crypto/x509/x509_vfy.c > > +++ b/crypto/x509/x509_vfy.c > > @@ -1064,6 +1064,8 @@ static int check_crl_time(X509_STORE_CTX *ctx, > > X509_CRL *crl, int notify) @@ -1915,10 +1915,10 @@ index > 499f0e8..5672f99 100644 > > os.data =3D NULL; > > os.length =3D 0; > > diff --git a/ssl/ssl_cert.c b/ssl/ssl_cert.c -index f48ebae..ac4f08c > > 100644 > > +index 1be6fb0..cbec97c 100644 > > --- a/ssl/ssl_cert.c > > +++ b/ssl/ssl_cert.c > > -@@ -857,12 +857,12 @@ int SSL_CTX_add_client_CA(SSL_CTX *ctx, X509 > > *x) > > +@@ -855,12 +855,12 @@ int SSL_CTX_add_client_CA(SSL_CTX *ctx, X509 > > +*x) > > return (add_client_CA(&(ctx->client_CA), x)); > > } > > > > @@ -1932,7 +1932,7 @@ index f48ebae..ac4f08c 100644 > > /** > > * Load CA certs from a file into a ::STACK. Note that it is somewhat > misnamed; > > * it doesn't really have anything to do with clients (except that a > > common use -@@ -930,7 +930,6 @@ STACK_OF(X509_NAME) > > *SSL_load_client_CA_file(const char *file) > > +@@ -928,7 +928,6 @@ STACK_OF(X509_NAME) > > +*SSL_load_client_CA_file(const char *file) > > ERR_clear_error(); > > return (ret); > > } > > @@ -1940,7 +1940,7 @@ index f48ebae..ac4f08c 100644 > > > > /** > > * Add a file of certs to a stack. > > -@@ -1050,6 +1049,7 @@ int > > SSL_add_dir_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack, > > +@@ -1048,6 +1047,7 @@ int > > +SSL_add_dir_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack, > > CRYPTO_w_unlock(CRYPTO_LOCK_READDIR); > > return ret; > > } > > diff --git a/CryptoPkg/Library/OpensslLib/Install.cmd > > b/CryptoPkg/Library/OpensslLib/Install.cmd > > index 093414d4b8..e040cda259 100755 > > --- a/CryptoPkg/Library/OpensslLib/Install.cmd > > +++ b/CryptoPkg/Library/OpensslLib/Install.cmd > > @@ -1,4 +1,4 @@ > > -cd openssl-1.0.2j > > +cd openssl-1.0.2k > > copy ..\opensslconf.h crypto > > if not exist include\openssl mkdir include\openssl > > copy e_os2.h include\openssl > > diff --git a/CryptoPkg/Library/OpensslLib/Install.sh > > b/CryptoPkg/Library/OpensslLib/Install.sh > > index 7bd55f6ae3..40811e20a6 100755 > > --- a/CryptoPkg/Library/OpensslLib/Install.sh > > +++ b/CryptoPkg/Library/OpensslLib/Install.sh > > @@ -1,6 +1,6 @@ > > #!/bin/sh > > > > -cd openssl-1.0.2j > > +cd openssl-1.0.2k > > cp ../opensslconf.h crypto > > mkdir -p include/openssl > > cp e_os2.h include/openssl > > diff --git a/CryptoPkg/Library/OpensslLib/OpensslLib.inf > > b/CryptoPkg/Library/OpensslLib/OpensslLib.inf > > index 42f523a611..3acc397ace 100644 > > --- a/CryptoPkg/Library/OpensslLib/OpensslLib.inf > > +++ b/CryptoPkg/Library/OpensslLib/OpensslLib.inf > > @@ -1,7 +1,7 @@ > > ## @file > > # This module provides openSSL Library implementation. > > # > > -# Copyright (c) 2010 - 2016, Intel Corporation. All rights > > reserved.
> > +# Copyright (c) 2010 - 2017, Intel Corporation. All rights > > +reserved.
> > # This program and the accompanying materials # are licensed and > > made available under the terms and conditions of the BSD License # > > which accompanies this distribution. The full text of the license may > > be found at @@ -20,7 +20,7 @@ > > MODULE_TYPE =3D BASE > > VERSION_STRING =3D 1.0 > > LIBRARY_CLASS =3D OpensslLib > > - DEFINE OPENSSL_PATH =3D openssl-1.0.2j > > + DEFINE OPENSSL_PATH =3D openssl-1.0.2k > > DEFINE OPENSSL_FLAGS =3D -DL_ENDIAN - > DOPENSSL_SMALL_FOOTPRINT -D_CRT_SECURE_NO_DEPRECATE - > D_CRT_NONSTDC_NO_DEPRECATE > > > > # > > @@ -551,7 +551,7 @@ > > # C4702: Potentially uninitialized local variable name used > > # C4311: pointer truncation from 'type' to 'type' > > # > > - MSFT:*_*_IA32_CC_FLAGS =3D -U_WIN32 -U_WIN64 -U_MSC_VER > $(OPENSSL_FLAGS) /wd4244 /wd4245 /wd4701 /wd4702 /wd4706 > > + MSFT:*_*_IA32_CC_FLAGS =3D -U_WIN32 -U_WIN64 -U_MSC_VER > $(OPENSSL_FLAGS) /wd4244 /wd4245 /wd4267 /wd4701 /wd4702 /wd4706 > > MSFT:*_*_X64_CC_FLAGS =3D -U_WIN32 -U_WIN64 -U_MSC_VER > $(OPENSSL_FLAGS) /wd4133 /wd4244 /wd4245 /wd4267 /wd4701 /wd4305 > /wd4306 /wd4702 /wd4706 /wd4311 > > MSFT:*_*_IPF_CC_FLAGS =3D -U_WIN32 -U_WIN64 -U_MSC_VER > $(OPENSSL_FLAGS) /wd4133 /wd4244 /wd4245 /wd4267 /wd4701 /wd4305 > /wd4306 /wd4702 /wd4706 > > > > diff --git a/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf > > b/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf > > index 9a03c2cf10..b788e0c013 100644 > > --- a/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf > > +++ b/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf > > @@ -1,7 +1,7 @@ > > ## @file > > # This module provides openSSL Library implementation. > > # > > -# Copyright (c) 2010 - 2016, Intel Corporation. All rights > > reserved.
> > +# Copyright (c) 2010 - 2017, Intel Corporation. All rights > > +reserved.
> > # This program and the accompanying materials # are licensed and > > made available under the terms and conditions of the BSD License # > > which accompanies this distribution. The full text of the license may > > be found at @@ -20,7 +20,7 @@ > > MODULE_TYPE =3D BASE > > VERSION_STRING =3D 1.0 > > LIBRARY_CLASS =3D OpensslLib > > - DEFINE OPENSSL_PATH =3D openssl-1.0.2j > > + DEFINE OPENSSL_PATH =3D openssl-1.0.2k > > DEFINE OPENSSL_FLAGS =3D -DL_ENDIAN - > DOPENSSL_SMALL_FOOTPRINT -D_CRT_SECURE_NO_DEPRECATE - > D_CRT_NONSTDC_NO_DEPRECATE > > > > # > > @@ -501,7 +501,7 @@ > > # C4702: Potentially uninitialized local variable name used > > # C4311: pointer truncation from 'type' to 'type' > > # > > - MSFT:*_*_IA32_CC_FLAGS =3D -U_WIN32 -U_WIN64 -U_MSC_VER > $(OPENSSL_FLAGS) /wd4244 /wd4245 /wd4701 /wd4702 /wd4706 > > + MSFT:*_*_IA32_CC_FLAGS =3D -U_WIN32 -U_WIN64 -U_MSC_VER > $(OPENSSL_FLAGS) /wd4244 /wd4245 /wd4267 /wd4701 /wd4702 /wd4706 > > MSFT:*_*_X64_CC_FLAGS =3D -U_WIN32 -U_WIN64 -U_MSC_VER > $(OPENSSL_FLAGS) /wd4133 /wd4244 /wd4245 /wd4267 /wd4701 /wd4305 > /wd4306 /wd4702 /wd4706 /wd4311 > > MSFT:*_*_IPF_CC_FLAGS =3D -U_WIN32 -U_WIN64 -U_MSC_VER > $(OPENSSL_FLAGS) /wd4133 /wd4244 /wd4245 /wd4267 /wd4701 /wd4305 > /wd4306 /wd4702 /wd4706 > > > > diff --git a/CryptoPkg/Library/OpensslLib/Patch-HOWTO.txt > > b/CryptoPkg/Library/OpensslLib/Patch-HOWTO.txt > > index d7e3d9e875..8418802ac7 100644 > > --- a/CryptoPkg/Library/OpensslLib/Patch-HOWTO.txt > > +++ b/CryptoPkg/Library/OpensslLib/Patch-HOWTO.txt > > @@ -17,36 +17,36 @@ cryptography. This patch will enable openssl buildi= ng > under UEFI environment. > > > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > > OpenSSL-Version > > > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > > - Current supported OpenSSL version for UEFI Crypto Library is 1.0.2j. > > - http://www.openssl.org/source/openssl-1.0.2j.tar.gz > > + Current supported OpenSSL version for UEFI Crypto Library is 1.0.2k. > > + http://www.openssl.org/source/openssl-1.0.2k.tar.gz > > > > > > > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > > HOW to Install Openssl for UEFI Building > > > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D -1. Download OpenSSL 1.0.2j from offici= al website: > > - http://www.openssl.org/source/openssl-1.0.2j.tar.gz > > +1. Download OpenSSL 1.0.2k from official website: > > + http://www.openssl.org/source/openssl-1.0.2k.tar.gz > > > > - NOTE: Some web browsers may rename the downloaded TAR file to > openssl-1.0.2j.tar.tar. > > - When you do the download, rename the "openssl-1.0.2j.tar.tar= " to > > - "openssl-1.0.2j.tar.gz" or rename the local downloaded file = with > ".tar.tar" > > + NOTE: Some web browsers may rename the downloaded TAR file to > openssl-1.0.2k.tar.tar. > > + When you do the download, rename the "openssl-1.0.2k.tar.tar= " to > > + "openssl-1.0.2k.tar.gz" or rename the local downloaded file = with > ".tar.tar" > > extension to ".tar.gz". > > > > -2. Extract TAR into CryptoPkg/Library/OpensslLib/openssl-1.0.2j > > +2. Extract TAR into CryptoPkg/Library/OpensslLib/openssl-1.0.2k > > > > NOTE: If you use WinZip to unpack the openssl source in Windows, > please > > uncheck the WinZip smart CR/LF conversion option (WINZIP: Op= tions - > -> > > Configuration --> Miscellaneous --> "TAR file smart CR/LF > conversion"). > > > > -3. Apply this patch: EDKII_openssl-1.0.2j.patch, and make > > installation > > +3. Apply this patch: EDKII_openssl-1.0.2k.patch, and make > > +installation > > > > For Windows Environment: > > ------------------------ > > 1) Make sure the patch utility has been installed in your machine. > > Install Cygwin or get the patch utility binary from > > http://gnuwin32.sourceforge.net/packages/patch.htm > > - 2) cd $(WORKSPACE)\CryptoPkg\Library\OpensslLib\openssl-1.0.2j > > - 3) patch -p1 -i ..\EDKII_openssl-1.0.2j.patch > > + 2) cd $(WORKSPACE)\CryptoPkg\Library\OpensslLib\openssl-1.0.2k > > + 3) patch -p1 -i ..\EDKII_openssl-1.0.2k.patch > > 4) cd .. > > 5) Install.cmd > > > > @@ -54,8 +54,8 @@ cryptography. This patch will enable openssl building > under UEFI environment. > > ----------------------- > > 1) Make sure the patch utility has been installed in your machine. > > Patch utility is available from http://directory.fsf.org/projec= t/patch/ > > - 2) cd $(WORKSPACE)/CryptoPkg/Library/OpensslLib/openssl-1.0.2j > > - 3) patch -p1 -i ../EDKII_openssl-1.0.2j.patch > > + 2) cd $(WORKSPACE)/CryptoPkg/Library/OpensslLib/openssl-1.0.2k > > + 3) patch -p1 -i ../EDKII_openssl-1.0.2k.patch > > 4) cd .. > > 5) ./Install.sh > > > > >=20 > _______________________________________________ > edk2-devel mailing list > edk2-devel@lists.01.org > https://lists.01.org/mailman/listinfo/edk2-devel