Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[openssl] Update openssl to 1.1.1g #11003

Closed
wants to merge 4 commits into from

Conversation

crackedmind
Copy link
Contributor

@crackedmind crackedmind commented Apr 24, 2020

Update openssl version from 1.1.1d to latest 1.1.1g. Also disable tests building to improve build time.

Fix #11127

@NancyLi1013
Copy link
Contributor

Hi @crackedmind
Could you please resolve the conflicts first?

@fcharlie
Copy link
Contributor

@NancyLi1013 openssl 1.1.1g is a security update with the vulnerability number CVE-2020-1967 so it should be updated as soon as possible. I suggest that you should not wait for the PR author to respond, but take the initiative to resolve the conflict. There is a branch here that has resolved the conflict. https://github.com/fcharlie/vcpkg/tree/openssl_cve

@NancyLi1013
Copy link
Contributor

@fcharlie thanks for your kindly reminder.
I resolved the conflicts just now.

@NancyLi1013
Copy link
Contributor

The regressions caused by gsoap is fixed in #11048.


vcpkg_download_distfile(OPENSSL_SOURCE_ARCHIVE
URLS "https://www.openssl.org/source/openssl-${OPENSSL_VERSION}.tar.gz" "https://www.openssl.org/source/old/1.1.1/openssl-${OPENSSL_VERSION}.tar.gz"
FILENAME "openssl-${OPENSSL_VERSION}.tar.gz"
SHA512 2bc9f528c27fe644308eb7603c992bac8740e9f0c3601a130af30c9ffebbf7e0f5c28b76a00bbb478bad40fbe89b4223a58d604001e1713da71ff4b7fe6a08a7
SHA512 01e3d0b1bceeed8fb066f542ef5480862001556e0f612e017442330bbd7e5faee228b2de3513d7fc347446b7f217e27de1003dc9d7214d5833b97593f3ec25ab
)

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you please update the way to handle copyright as
file(INSTALL ${MASTER_COPY_SOURCE_PATH}/LICENSE DESTINATION ${CURRENT_PACKAGES_DIR}/share/${PORT} RENAME copyright)?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

vcpkg_test_cmake(PACKAGE_NAME OpenSSL MODULE) is deprecated.
Could you please remove this?

else ()
message(FATAL_ERROR "Unsupported architecture")
endif()

vcpkg_find_acquire_program(PERL)
vcpkg_find_acquire_program(JOM)
get_filename_component(JOM_EXE_PATH ${JOM} DIRECTORY)
get_filename_component(PERL_EXE_PATH ${PERL} DIRECTORY)
set(ENV{PATH} "$ENV{PATH};${PERL_EXE_PATH};${JOM_EXE_PATH}")
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We prefer to use vcpkg_add_to_path() instead of set(ENV{PATH}).
Could you please update this?

@@ -8,15 +8,15 @@ endif()

vcpkg_find_acquire_program(PERL)

set(OPENSSL_VERSION 1.1.1d)
set(OPENSSL_VERSION 1.1.1g)

get_filename_component(PERL_EXE_PATH ${PERL} DIRECTORY)
set(ENV{PATH} "$ENV{PATH};${PERL_EXE_PATH}")
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We prefer to use vcpkg_add_to_path() instead of set(ENV{PATH}).
Could you please update this?

@@ -39,6 +39,7 @@ set(CONFIGURE_COMMAND ${PERL} Configure
enable-static-engine
enable-capieng
no-ssl2
no-tests
-utf-8
${OPENSSL_SHARED}
)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

vcpkg_test_cmake(PACKAGE_NAME OpenSSL MODULE) is deprecated.
Could you please remove this?

@NancyLi1013
Copy link
Contributor

/azp run

@azure-pipelines
Copy link

Azure Pipelines successfully started running 1 pipeline(s).

@NancyLi1013
Copy link
Contributor

@crackedmind
Could you please address the review suggestions?
Since this is a security update, it needs to be done as soon as possible.

Please let me know if you have enough time to continue to make the progress for this PR.

Thanks.

@NancyLi1013
Copy link
Contributor

/azp run

@azure-pipelines
Copy link

Azure Pipelines successfully started running 1 pipeline(s).

@NancyLi1013
Copy link
Contributor

/azp run

@azure-pipelines
Copy link

Azure Pipelines successfully started running 1 pipeline(s).

@NancyLi1013 NancyLi1013 added the category:port-update The issue is with a library, which is requesting update new revision label May 22, 2020
@NancyLi1013
Copy link
Contributor

Thanks for the PR; we're closing this for now since there's been no response. If you'd like to continue working on it, please reopen and ping us!

Septarius added a commit to Septarius/vcpkg that referenced this pull request Jun 12, 2020
The suggested changes from PR microsoft#11003

Along with one additional to remove the deprecated vcpkg_test_cmake from openssl-uwp\portfile.cmake as well.
vicroms pushed a commit that referenced this pull request Jun 29, 2020
* [openssl] Update version to 1.1.1g

* [openssl] Disable build tests

* [openssl-unix][openssl-uwp] use vcpkg_fail_port_install

* [openssl] Applying PR #11003 Suggestions

The suggested changes from PR #11003

Along with one additional to remove the deprecated vcpkg_test_cmake from openssl-uwp\portfile.cmake as well.

* Update ports/openssl-uwp/portfile.cmake

Co-authored-by: crackedmind <digital.stream.of.mind@gmail.com>
Co-authored-by: NancyLi1013 <46708020+NancyLi1013@users.noreply.github.com>
@crackedmind crackedmind deleted the update_openssl branch November 24, 2021 04:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
category:port-update The issue is with a library, which is requesting update new revision
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[openssl] update to 1.1.1g - CVE-2019-1563 & CVE-2019-1551
3 participants