-
Notifications
You must be signed in to change notification settings - Fork 32
wolfProvider Layers Refactor #121
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
night1rider
merged 21 commits into
wolfSSL:refactor-meta-wolfssl
from
aidangarske:refactor-meta-wolfssl
Nov 27, 2025
Merged
Changes from all commits
Commits
Show all changes
21 commits
Select commit
Hold shift + click to select a range
736f698
Merged refactor and new test changes
9820e20
Combine refactor changes and add replace default and fips modes
f4d7fae
Add working and tested fips, replace default, non-fips, non-replace-d…
2a60196
Add FIPS replace default to layers and test all options
88f4d38
Refactor bbappends to be more yocto like
dac219a
Add overide to openssl configure
aidangarske 665fc2e
Address comment concerns
aidangarske 4fddcd3
Only do neccesary simlinks
aidangarske 46e1e88
Only do neccesary simlinks
aidangarske a98887f
Convert wolfprovider test bbappend to inc file
aidangarske 81d491e
Add Image minimals for all wolfprovider modes
aidangarske d67fc3d
Fully tested images
aidangarske 573e976
Get conf files from source
aidangarske a837a20
Merge branch 'refactor-meta-wolfssl' into refactor-meta-wolfssl
aidangarske 64f7f86
fix stamp.h in append rather than main .bb
aidangarske 4937c2d
Update wolfprovider include files with local changes
aidangarske c13ed44
Add messages for debug files
aidangarske 78f1c35
Follow Debian convention for provider config in openssl.cnf
aidangarske 717e3d2
Append conf fil
aidangarske e9ff1ac
Merge remote-tracking branch 'upstream/refactor-meta-wolfssl' into re…
aidangarske e8db004
Fix naming for new fips rename
aidangarske File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
82 changes: 82 additions & 0 deletions
82
inc/wolfprovider/openssl/openssl-enable-wolfprovider-replace-default.inc
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,82 @@ | ||
| # OpenSSL wolfProvider REPLACE-DEFAULT mode configuration | ||
| # This file is included when wolfProvider is configured to replace OpenSSL's default crypto provider | ||
| # It should be included from the image recipe when replace-default mode is desired | ||
|
|
||
| # Build OpenSSL as plain, non-FIPS OpenSSL | ||
| # wolfProvider will provide FIPS functionality using wolfSSL FIPS | ||
|
|
||
| PACKAGECONFIG:class-target = "" | ||
| EXTRA_OECONF:append:class-target = " no-fips shared " | ||
|
|
||
| # OpenSSL target-only tweaks for replace-default mode | ||
| do_configure:prepend:class-target () { | ||
| set -eu | ||
|
|
||
| # Be explicit about where we are | ||
| echo "TARGET do_configure prepend: S='${S}', B='${B}'" | ||
|
|
||
| vfile="${S}/VERSION.dat" | ||
|
|
||
| # Sanity check: VERSION.dat must exist at the top of the OpenSSL tree | ||
| if [ ! -f $vfile ]; then | ||
| echo "ERROR: $vfile not found in ${S}" >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| echo "Injecting BUILD_METADATA into VERSION.dat (target only)" | ||
| sed -i 's/^BUILD_METADATA=.*/BUILD_METADATA=wolfProvider/' $vfile | ||
|
|
||
| # Optional FIPS tag based on image features | ||
| if echo "${IMAGE_FEATURES}" | grep -qw "fips"; then | ||
| sed -i 's/^BUILD_METADATA=.*/BUILD_METADATA=wolfProvider-fips/' $vfile | ||
| fi | ||
|
|
||
| } | ||
|
|
||
| # Override do_configure to filter enable-fips from the actual configure command | ||
| do_configure:append:class-target () { | ||
| # The base do_configure uses ${PACKAGECONFIG_CONFARGS} which still has enable-fips | ||
| # We need to regenerate it without enable-fips | ||
| # Re-run configure with enable-fips explicitly removed | ||
| if [ -f "${B}/configdata.pm" ] && grep -q "enable-fips" "${B}/configdata.pm" 2>/dev/null; then | ||
| bbwarn "REPLACE-DEFAULT MODE: FIPS detected in config, forcing reconfigure without FIPS" | ||
| cd "${B}" | ||
| # Get the target from the original config | ||
| target=$(grep "our \$config{target}" "${B}/configdata.pm" 2>/dev/null | sed "s/.*'\(.*\)'.*/\1/" || echo "linux-x86_64") | ||
| # Reconfigure without enable-fips | ||
| HASHBANGPERL="/usr/bin/env perl" PERL=perl PERL5LIB="${S}/external/perl/Text-Template-1.46/lib/" \ | ||
| perl "${S}/Configure" no-fips shared ${EXTRA_OECONF} ${DEPRECATED_CRYPTO_FLAGS} \ | ||
| --prefix=${prefix} --openssldir=${libdir}/ssl-3 --libdir=${libdir} "$target" | ||
| perl "${B}/configdata.pm" --dump | ||
| fi | ||
| } | ||
|
|
||
| # Ensure provider is present on TARGET runtime (doesn't touch -native/-nativesdk) | ||
| RDEPENDS:libcrypto3:append:class-target = " wolfprovider" | ||
|
|
||
| # Bring in the replace-default patch (target only) | ||
| SRC_URI:append:class-target = " \ | ||
| git://github.com/wolfSSL/wolfProvider.git;protocol=https;nobranch=1;rev=v1.1.0;destsuffix=git/wolfProvider \ | ||
| " | ||
|
|
||
| python do_patch:append:class-target () { | ||
| import os, subprocess | ||
| s = d.getVar("S") | ||
| patch_path = os.path.join(d.getVar("WORKDIR"), "git/wolfProvider/patches/openssl3-replace-default.patch") | ||
| bb.note("REPLACE-DEFAULT MODE: Checking if patch needs to be applied") | ||
| # Try to apply patch; if it fails with "already applied", log it and continue | ||
| try: | ||
| # First check with --dry-run to see if patch can be applied | ||
| result = subprocess.run(["patch", "-d", s, "-p1", "-i", patch_path, "--dry-run"], | ||
| capture_output=True, text=True, check=False) | ||
| if result.returncode == 0: | ||
| bb.note("REPLACE-DEFAULT MODE: Patch can be applied, applying now...") | ||
| subprocess.run(["patch", "-d", s, "-p1", "-i", patch_path], check=True) | ||
| else: | ||
| bb.note("REPLACE-DEFAULT MODE: Patch already applied or cannot apply, skipping") | ||
| bb.debug(1, f"Patch check output: {result.stderr}") | ||
| except Exception as e: | ||
| bb.warn(f"REPLACE-DEFAULT MODE: Error applying patch: {e}") | ||
| } | ||
|
|
||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,2 +1,6 @@ | ||
| # OpenSSL standalone wolfProvider mode configuration | ||
| # Include this file for standard wolfProvider integration as a provider plugin | ||
|
|
||
| EXTRA_OECONF += " no-fips shared " | ||
|
|
||
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| # Configuration to enable wolfprovider FIPS support in wolfssl | ||
| # To enable debug add `--enable-debug --enable-keylog-export` to EXTRA_OECONF | ||
|
|
||
| EXTRA_OECONF += " --enable-fips=v5 --enable-opensslcoexist --enable-debug --enable-keylog-export" | ||
| TARGET_CFLAGS += " -DWOLFSSL_OLD_OID_SUM -DWOLFSSL_DH_EXTRA" | ||
|
|
||
| # Use a marker file to signal we are a FIPS build | ||
| WOLFSSL_ISFIPS = "1" | ||
|
|
||
| # commercial bundle missing stamp-h.in required by automake with 5.2.1 | ||
| do_configure:prepend() { | ||
| if [ ! -f ${S}/stamp-h.in ]; then | ||
| touch ${S}/stamp-h.in | ||
| fi | ||
| } | ||
|
|
||
| do_install:append() { | ||
| install -d ${D}${sysconfdir}/wolfssl | ||
| echo "1" > ${D}${sysconfdir}/wolfssl/fips-enabled | ||
| } | ||
|
|
||
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,5 +1,15 @@ | ||
| # Configuration to enable wolfprovider support in wolfssl | ||
| EXTRA_OECONF += " --enable-opensslcoexist --enable-cmac --enable-keygen --enable-sha --enable-des3 --enable-aesctr --enable-aesccm --enable-x963kdf --enable-compkey --enable-certgen --enable-aeskeywrap --enable-enckeys --enable-base16 " | ||
| TARGET_CFLAGS += " -DHAVE_AES_ECB -DWOLFSSL_AES_DIRECT -DWC_RSA_NO_PADDING -DWOLFSSL_PUBLIC_MP -DECC_MIN_KEY_SZ=192 -DHAVE_PUBLIC_FFDHE -DWOLFSSL_DH_EXTRA -DRSA_MIN_SIZE=1024" | ||
| TARGET_CFLAGS += " ${@'-DWOLFSSL_PSS_LONG_SALT -DWOLFSSL_PSS_SALT_LEN_DISCOVER' if d.getVar('WOLFSSL_TYPE') not in ("fips", "fips-ready") else ''}" | ||
| # To enable debug add `--enable-debug --enable-keylog-export` to EXTRA_OECONF | ||
|
|
||
| EXTRA_OECONF += " --enable-all-crypto --with-eccminsz=192 --with-max-ecc-bits=1024 --enable-opensslcoexist --enable-sha --enable-debug --enable-keylog-export" | ||
| TARGET_CFLAGS += " -DWC_RSA_NO_PADDING -DWOLFSSL_PUBLIC_MP -DHAVE_PUBLIC_FFDHE -DHAVE_FFDHE_6144 -DHAVE_FFDHE_8192 -DWOLFSSL_PSS_LONG_SALT -DWOLFSSL_PSS_SALT_LEN_DISCOVER -DRSA_MIN_SIZE=1024 -DWOLFSSL_OLD_OID_SUM" | ||
|
|
||
| # Use a marker file to signal we are a non-FIPS build | ||
| WOLFSSL_ISFIPS = "0" | ||
|
|
||
| do_install:append() { | ||
| install -d ${D}${sysconfdir}/wolfssl | ||
| echo "0" > ${D}${sysconfdir}/wolfssl/fips-enabled | ||
| } | ||
|
|
||
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,81 @@ | ||
| # Configuration to enable wolfProvider unit tests | ||
| # Modeled exactly after wolfcrypttest approach - simple and clean | ||
|
|
||
| FILESEXTRAPATHS:prepend := "${WOLFSSL_LAYERDIR}/recipes-examples/wolfprovider/wolfprovidertest/files:" | ||
| SRC_URI += "file://wolfprovidertest.sh" | ||
|
|
||
| # Unit test directory and binary names | ||
| WOLFPROVIDER_TEST_DIR = "${B}/test/.libs" | ||
| WOLFPROVIDER_TEST = "unit.test" | ||
| WOLFPROVIDER_TEST_YOCTO = "unit.test" | ||
| WOLFPROVIDER_INSTALL_DIR = "${D}${bindir}" | ||
| WOLFPROVIDER_CERTS_DIR = "${S}/certs" | ||
| WOLFPROVIDER_CERTS_INSTALL_DIR = "${D}${datadir}/wolfprovider-test/certs" | ||
|
|
||
| # Override CERTS_DIR to point to the installed location instead of build directory | ||
| CFLAGS:append = ' -DCERTS_DIR=\\"/usr/share/wolfprovider-test/certs\\"' | ||
| CXXFLAGS:append = ' -DCERTS_DIR=\\"/usr/share/wolfprovider-test/certs\\"' | ||
|
|
||
| # Simple installation using Python function, exactly like wolfcrypttest | ||
| python () { | ||
| # Get the environment variables | ||
| test_dir = d.getVar('WOLFPROVIDER_TEST_DIR', True) | ||
| test_bin = d.getVar('WOLFPROVIDER_TEST', True) | ||
| test_yocto = d.getVar('WOLFPROVIDER_TEST_YOCTO', True) | ||
| install_dir = d.getVar('WOLFPROVIDER_INSTALL_DIR', True) | ||
| certs_dir = d.getVar('WOLFPROVIDER_CERTS_DIR', True) | ||
| certs_install_dir = d.getVar('WOLFPROVIDER_CERTS_INSTALL_DIR', True) | ||
|
|
||
| bbnote = 'bbnote "Installing wolfProvider Tests"\n' | ||
| installDir = 'install -m 0755 -d "%s"\n' % (install_dir) | ||
|
|
||
| # Try multiple locations for the test binary (exactly like wolfcrypttest) | ||
| cpTest = 'if [ -f "%s/%s" ]; then cp "%s/%s" "%s/%s"; ' % (test_dir, test_bin, test_dir, test_bin, install_dir, test_yocto) | ||
| cpTest += 'elif [ -f "${B}/test/%s" ]; then cp "${B}/test/%s" "%s/%s"; ' % (test_bin, test_bin, install_dir, test_yocto) | ||
| cpTest += 'elif [ -f "${B}/%s" ]; then cp "${B}/%s" "%s/%s"; fi\n' % (test_bin, test_bin, install_dir, test_yocto) | ||
|
|
||
| # Install wrapper script | ||
| installScript = 'cp "${WORKDIR}/wolfprovidertest.sh" "%s/wolfprovidertest"\n' % (install_dir) | ||
| installScript += 'chmod 755 "%s/wolfprovidertest"\n' % (install_dir) | ||
|
|
||
| # Install certificates | ||
| installCerts = 'bbnote "Installing wolfProvider Certificates"\n' | ||
| installCerts += 'install -m 0755 -d "%s"\n' % (certs_install_dir) | ||
| installCerts += 'if [ -d "%s" ]; then cp -r %s/*.pem %s/ 2>/dev/null || true; fi\n' % (certs_dir, certs_dir, certs_install_dir) | ||
|
|
||
| d.appendVar('do_install', bbnote) | ||
| d.appendVar('do_install', installDir) | ||
| d.appendVar('do_install', cpTest) | ||
| d.appendVar('do_install', installScript) | ||
| d.appendVar('do_install', installCerts) | ||
| } | ||
|
|
||
| # Append test files and library files to FILES using Python | ||
| python __anonymous() { | ||
| pn = d.getVar('PN') | ||
|
|
||
| # Get existing FILES value (set by autotools class and base recipe) | ||
| existing_files = d.getVar('FILES:' + pn) or '' | ||
|
|
||
| # Append our test files (don't re-add library files - they're in base recipe FILES) | ||
| new_files = existing_files + ' ' + ' '.join([ | ||
| '${bindir}/wolfprovidertest', | ||
| '${bindir}/unit.test', | ||
| '${datadir}/wolfprovider-test/certs/*' | ||
| ]) | ||
|
|
||
| # Set the combined value (this avoids the "replaces original key" warning) | ||
| d.setVar('FILES:' + pn, new_files) | ||
|
|
||
| # Same approach for RDEPENDS | ||
| existing_rdepends = d.getVar('RDEPENDS:' + pn) or '' | ||
| new_rdepends = existing_rdepends + ' bash wolfproviderenv' | ||
| d.setVar('RDEPENDS:' + pn, new_rdepends) | ||
|
|
||
| # Same approach for INSANE_SKIP | ||
| existing_skip = d.getVar('INSANE_SKIP:' + pn) or '' | ||
| new_skip = existing_skip + ' dev-so build-deps' | ||
| d.setVar('INSANE_SKIP:' + pn, new_skip) | ||
| } | ||
|
|
||
|
|
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.