From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 5C8481A1E3E for ; Thu, 29 Sep 2016 12:26:45 -0700 (PDT) Received: from int-mx13.intmail.prod.int.phx2.redhat.com (int-mx13.intmail.prod.int.phx2.redhat.com [10.5.11.26]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id BDDB4291CE9; Thu, 29 Sep 2016 19:26:44 +0000 (UTC) Received: from lacos-laptop-7.usersys.redhat.com (ovpn-116-12.phx2.redhat.com [10.3.116.12]) by int-mx13.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id u8TJQhBG023650; Thu, 29 Sep 2016 15:26:43 -0400 To: "Long, Qin" References: <20160929060925.11152-1-qin.long@intel.com> <4d0f4c4f-6b5f-aa73-a965-ba97704aa6af@redhat.com> Cc: "Ye, Ting" , "edk2-devel@ml01.01.org" , "Woodhouse, David" From: Laszlo Ersek Message-ID: Date: Thu, 29 Sep 2016 21:26:42 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.3.0 MIME-Version: 1.0 In-Reply-To: X-Scanned-By: MIMEDefang 2.68 on 10.5.11.26 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.26]); Thu, 29 Sep 2016 19:26:44 +0000 (UTC) Subject: Re: [Patch] CryptoPkg/OpensslLib: Upgrade OpenSSL version to 1.0.2j X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Sep 2016 19:26:45 -0000 Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit On 09/29/16 16:22, Long, Qin wrote: > Sure, refer to https://github.com/qloong/edk2/tree/dev-openssl-1.0.2j > Thanks, Laszlo. I used the Ia32X64 build of OVMF with a Fedora guest to test this update. I checked: - boot with Secure Boot having been enabled previously (using 1.0.2h) - clearing Secure Boot and booting an unsigned binary - enrolling certificates again and booting with SB enabled (checking both unsigned and signed) Tested-by: Laszlo Ersek Thanks Laszlo > -----Original Message----- > From: Laszlo Ersek [mailto:lersek@redhat.com] > Sent: Thursday, September 29, 2016 5:23 PM > To: Long, Qin > Cc: edk2-devel@ml01.01.org; Ye, Ting ; Woodhouse, David > Subject: Re: [edk2] [Patch] CryptoPkg/OpensslLib: Upgrade OpenSSL version to 1.0.2j > > On 09/29/16 08:09, Qin Long wrote: >> Two official releases (OpenSSL 1.0.2i and 1.0.2j) were available with >> several severity fixes at 22-Sep-2016 and 26-Sep-2016 with several >> security fixes. Refer to >> https://www.openssl.org/news/secadv/20160922.txt and >> https://www.openssl.org/news/secadv/20160926.txt. >> This patch is to upgrade the supported OpenSSL version in >> CryptoPkg/OpensslLib to catch the latest release 1.0.2j. >> >> Cc: Ting Ye >> Cc: David Woodhouse >> Contributed-under: TianoCore Contribution Agreement 1.0 >> Signed-off-by: Qin Long >> --- >> CryptoPkg/CryptoPkg.dec | 2 +- >> ...ssl-1.0.2h.patch => EDKII_openssl-1.0.2j.patch} | 171 ++++++--------------- >> CryptoPkg/Library/OpensslLib/Install.cmd | 2 +- >> CryptoPkg/Library/OpensslLib/Install.sh | 2 +- >> CryptoPkg/Library/OpensslLib/OpensslLib.inf | 2 +- >> CryptoPkg/Library/OpensslLib/Patch-HOWTO.txt | 26 ++-- >> 6 files changed, 62 insertions(+), 143 deletions(-) rename >> CryptoPkg/Library/OpensslLib/{EDKII_openssl-1.0.2h.patch => >> EDKII_openssl-1.0.2j.patch} (92%) > > Can you please push this patch to a personal git repo of yours, and publish the URL and branch name on the list? I'd like to test the patch. > > Thanks! > Laszlo > > _______________________________________________ > edk2-devel mailing list > edk2-devel@lists.01.org > https://lists.01.org/mailman/listinfo/edk2-devel >