[RFC] Remove OpenSSL 1.x support #157

juimonen · 2023-04-14T08:39:30Z

Remove OpenSSL 1.x support as it is reaching end-of-life in many distros.

marc-hb · 2023-04-14T15:40:16Z

This definitely requires a TEST PR in SOF before merge.

marc-hb · 2023-04-14T17:26:08Z

thesofproject/sof#7444 fails because (among others?) https://github.com/zephyrproject-rtos/docker-image/pkgs/container/zephyr-build v0.24 was still based on Ubuntu 20.04

marc-hb · 2023-04-14T18:06:48Z

The latest ghcr.io/zephyrproject-rtos/zephyr-build:v0.26.1 is based on Ubuntu 22.04, which has openssl3. Yeah!

However it also has /opt/toolchains/zephyr-sdk-0.16.0, which will mismatch with zephyr-sdk-0.15.2_windows-x86_64.zip (df1ba222306d)

@aborisovich could you please upgrade zephyr-sdk-0.15.2_windows-x86_64.zip to zephyr-sdk-0.16.0_windows-x86_64.zip in sof/.github/workflows/zephyr.yml?

Then this will be enough on the Linux side (TESTED!)

EDIT: this has already been merged, not needed anymore.

--- a/zephyr/docker-run.sh
+++ b/zephyr/docker-run.sh
@@ -54,7 +54,7 @@ main()
 
 run_command()
 {
-    # zephyr-build:v0.24.13 has /opt/toolchains/zephyr-sdk-0.15.2
+    # zephyr-build:v0.26.1 has /opt/toolchains/zephyr-sdk-0.16.0
     # https://hub.docker.com/r/zephyrprojectrtos/zephyr-build/tags
     #
     # Keep this SDK version identical to the one in
@@ -63,7 +63,7 @@ run_command()
            --workdir /zep_workspace \
            $SOF_DOCKER_RUN \
            --env REAL_CC --env http_proxy --env https_proxy \
-           ghcr.io/zephyrproject-rtos/zephyr-build:v0.24.13 \
+           ghcr.io/zephyrproject-rtos/zephyr-build:v0.26.1 \
            ./sof/scripts/sudo-cwd.sh "$@"
 }

marc-hb · 2023-04-17T18:32:44Z

CMakeLists.txt

 endif()

-target_link_libraries(rimage PRIVATE crypto)
+find_package(OpenSSL REQUIRED)


Nice!

Could you go one step further and try this? It should make openssl 1 fail faster and much more clearly.

Suggested change

find_package(OpenSSL REQUIRED)

find_package(OpenSSL 3...3.9999 REQUIRED)

This would hopefully provide a much clearer error than the D:/a/sof/sof/workspace/sof/rimage/src/pkcs1_5.c:93:15: error: implicit declaration of function ‘EVP_PKEY_private_check’; did you mean ‘EVP_PKEY_param_check’? and similar found in https://github.com/thesofproject/sof/actions/runs/4830399599/jobs/8606585483?pr=7444

lgirdwood

@juimonen any update ?

juimonen · 2023-04-25T06:36:47Z

@lgirdwood not sure how we should test this.... @marc-hb any ideas? how could I use temporarily "test updated" build container, so to get all images signed with ssl3 and CI tested...

marc-hb · 2023-04-25T15:17:33Z

@juimonen you can test this with my zephyr/docker-run.sh patch above. This will make the build different from Windows which will temporarily break the Linux versus Windows check but for temporary testing that's OK.

EDIT: this will NOT test everything because some systems may not use that script. But it will provide some testing and feedback.

marc-hb · 2023-04-28T18:23:04Z

Linux build is OK but https://github.com/thesofproject/sof/actions/runs/4830399599/jobs/8606585483?pr=7444 looks like the Windows build misses OpenSSL3? @aborisovich can you help?

marc-hb · 2023-05-14T17:35:21Z

Zephyr main branch is upgrading to Zephyr SDK 0.16.1

marc-hb · 2023-05-25T16:44:53Z

Great news: the Zephyr container has been upgraded to Ubuntu 22 by thesofproject/sof#7645 and we had some Windows updates too.

@juimonen can you give this another try?

lgirdwood · 2023-07-04T09:13:25Z

@juimonen ping.

lgirdwood · 2023-07-24T14:13:53Z

@juimonen ping

Remove OpenSSL 1.x support as it is reaching end-of-life in many distros. Signed-off-by: Jaska Uimonen <jaska.uimonen@intel.com>

juimonen · 2023-07-26T13:36:17Z

@lgirdwood @marc-hb @aborisovich still not compiling for windows... not sure can it be somehow updated for ssl3?
test PR here thesofproject/sof#7444

lgirdwood · 2023-07-26T15:13:10Z

@mwasko @abonislawski @aborisovich SDL requires SSL3, need to update Windows.

juimonen · 2023-07-28T04:57:44Z

@marc-hb @fredoh9 @aiChaoSONG (put here everyone who might know about CI)... I tried this locally with both sof docker image and zephyr docker image, and it compiles in both -> means they have ssl3 support. However there is some errors still in some CI compilation (even outside windows builds)... Can someone take a look at thesofproject/sof#7444 results, so do we need to do still some CI update, so that we don't have any ssl1 things left?

marc-hb · 2023-07-28T21:58:05Z

Can someone take a look at thesofproject/sof#7444 results, so do we need to do still some CI update, so that we don't have any ssl1 things left?

Yes, both the Jenkins nodes and Github Action for windows need some updates.

lgirdwood · 2023-07-31T10:48:22Z

@wszypelt @mwasko fyi - needs Windows update to use sssl3. Thanks!

wszypelt · 2023-07-31T12:22:18Z

@lgirdwood @mwasko @juimonen I will issue the appropriate ticket

lgirdwood · 2023-08-16T14:35:05Z

@alex-cri fyi.

kv2019i

Marking as -1, this needs to be resubmitted directly to SOF repo (rimage moved to sof/tools/rimage).

marc-hb · 2023-10-11T21:28:36Z

To easily move these commits to the main sof repo, see:

Transfer rimage git history to subdirectory tools/rimage/ in the sof git repo sof#8297 (comment)

Support unusual locations and prepares for OpenSSL 1 deprecation (as previously attempted in thesofproject/rimage#157) Signed-off-by: Marc Herbert <marc.herbert@intel.com>

Support unusual locations and deprecates OpenSSL 1 (as previously attempted in thesofproject/rimage#157) Will remove the OpenSSL 1 code later to give people some time to upgrade. Signed-off-by: Marc Herbert <marc.herbert@intel.com>

marc-hb · 2023-10-20T16:35:32Z

CMakeLists.txt


-target_link_libraries(rimage PRIVATE crypto)
+find_package(OpenSSL REQUIRED)
+target_link_libraries(rimage PRIVATE crypto OpenSSL::SSL)


Smaller dependency enough:

Suggested change

target_link_libraries(rimage PRIVATE crypto OpenSSL::SSL)

target_link_libraries(rimage PRIVATE crypto OpenSSL::crypto)

(OpenSSL::SSL depends on OpenSSL::crypto)

marc-hb · 2024-09-05T01:36:59Z

Filed new issue:

Remove openssl v1 support from rimage sof#9440

marc-hb mentioned this pull request Apr 14, 2023

west: test rimage with only ssl 3 support thesofproject/sof#7444

Closed

juimonen force-pushed the remove_ssl1 branch from 6f4a163 to 97aa73d Compare April 17, 2023 10:30

marc-hb reviewed Apr 17, 2023

View reviewed changes

lgirdwood reviewed Apr 24, 2023

View reviewed changes

juimonen force-pushed the remove_ssl1 branch from 97aa73d to 7affd21 Compare April 28, 2023 12:07

marc-hb mentioned this pull request May 15, 2023

Zephyr main branch requires 0.16.x SDK (Intel toolchain change) thesofproject/sof#7614

Closed

3 tasks

marc-hb added the bug Something isn't working label May 25, 2023

Remove OpenSSL 1.x support

c78a362

Remove OpenSSL 1.x support as it is reaching end-of-life in many distros. Signed-off-by: Jaska Uimonen <jaska.uimonen@intel.com>

juimonen force-pushed the remove_ssl1 branch from 7affd21 to c78a362 Compare July 26, 2023 12:51

kv2019i requested changes Oct 11, 2023

View reviewed changes

marc-hb mentioned this pull request Oct 18, 2023

rimage/cmake: add find_package(OpenSSL ...) thesofproject/sof#8349

Closed

marc-hb reviewed Oct 20, 2023

View reviewed changes

marc-hb mentioned this pull request Sep 5, 2024

Remove openssl v1 support from rimage thesofproject/sof#9440

Open

marc-hb closed this Sep 5, 2024

	find_package(OpenSSL REQUIRED)
	find_package(OpenSSL 3...3.9999 REQUIRED)

	target_link_libraries(rimage PRIVATE crypto OpenSSL::SSL)
	target_link_libraries(rimage PRIVATE crypto OpenSSL::crypto)

[RFC] Remove OpenSSL 1.x support #157

[RFC] Remove OpenSSL 1.x support #157

Uh oh!

Conversation

juimonen commented Apr 14, 2023

Uh oh!

marc-hb commented Apr 14, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

marc-hb commented Apr 14, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

marc-hb commented Apr 14, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

marc-hb Apr 17, 2023

Choose a reason for hiding this comment

Uh oh!

marc-hb Apr 28, 2023

Choose a reason for hiding this comment

Uh oh!

lgirdwood left a comment

Choose a reason for hiding this comment

Uh oh!

juimonen commented Apr 25, 2023

Uh oh!

marc-hb commented Apr 25, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

marc-hb commented Apr 28, 2023

Uh oh!

marc-hb commented May 14, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

marc-hb commented May 25, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

lgirdwood commented Jul 4, 2023

Uh oh!

lgirdwood commented Jul 24, 2023

Uh oh!

juimonen commented Jul 26, 2023

Uh oh!

lgirdwood commented Jul 26, 2023

Uh oh!

juimonen commented Jul 28, 2023

Uh oh!

marc-hb commented Jul 28, 2023

Uh oh!

lgirdwood commented Jul 31, 2023

Uh oh!

wszypelt commented Jul 31, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

lgirdwood commented Aug 16, 2023

Uh oh!

kv2019i left a comment

Choose a reason for hiding this comment

Uh oh!

marc-hb commented Oct 11, 2023

Uh oh!

marc-hb Oct 20, 2023

Choose a reason for hiding this comment

Uh oh!

marc-hb commented Sep 5, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

marc-hb commented Apr 14, 2023 •

edited

Loading

marc-hb commented Apr 14, 2023 •

edited

Loading

marc-hb commented Apr 14, 2023 •

edited

Loading

marc-hb commented Apr 25, 2023 •

edited

Loading

marc-hb commented May 14, 2023 •

edited

Loading

marc-hb commented May 25, 2023 •

edited

Loading

wszypelt commented Jul 31, 2023 •

edited

Loading