From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6F9AAC433EF for ; Wed, 2 Mar 2022 20:52:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243770AbiCBUxA (ORCPT ); Wed, 2 Mar 2022 15:53:00 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57006 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242896AbiCBUws (ORCPT ); Wed, 2 Mar 2022 15:52:48 -0500 Received: from mail-pj1-x102b.google.com (mail-pj1-x102b.google.com [IPv6:2607:f8b0:4864:20::102b]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 51109AF1F9 for ; Wed, 2 Mar 2022 12:52:04 -0800 (PST) Received: by mail-pj1-x102b.google.com with SMTP id v4so2864933pjh.2 for ; Wed, 02 Mar 2022 12:52:04 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to; bh=1/zjEbSfhRRwQcZ+Urt/JTyvvofyCg2mmN4lvs+NezQ=; b=Oep9w9nuZJVR02ibZvrEcTVkv0YiWk56vRe7ZtORUExSC9xXaEYaPW4RK27O5kGvyw b4DdWZ8EywmcbRx8/foJt0NiNzP04MVr1kyq41Q+6NG2YsRUk1l2yIDKqY8vnFl2LdnQ NwqWJD2CnGnvj295X5nkl6oYxqgwfqhBgsqZM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to; bh=1/zjEbSfhRRwQcZ+Urt/JTyvvofyCg2mmN4lvs+NezQ=; b=l6d2HcTk1mN11gUsacdb0hHavMwei9HI9wHr73TTQ+HBRQPKgGm1H8d75kK0iFz3Cj drSniiKNxF48+DyGFUEkdVHV1sOHsu74X8YA/pPjk4Ht9CBbYJbUbsu/3UhEweMytGW2 nBLkAc0ZMw2xKMZ5mDLzNvauLsYIB/vcskJKgB99PIEZmXTJwDm3YBvj/2s/xWv8E5cz LF0+MthbxyB9IThSxRoy3NsfBz2Bp2yTqx8Olxu+THMom+NLTsWQqyC054HtQX3C7eQS EZ+Z45kNuqHT+rfekPJgvRqaHR5mP28SvAUqll1U6N20E/8eCXVPgR6cEnl/14Q2nbr3 9uRA== X-Gm-Message-State: AOAM531Wp9vEOHWb48l13O/wYJ0eWA0tX5z1QqtKt8xzYG+KVwJahLfk JL5mxpxwDIdaiOxuyS8EN5VDbA== X-Google-Smtp-Source: ABdhPJyywT7+4z2Og3DinCge0OBdaL2iq4lk9mSh5O2CZZ5d2WMPgmh0kS9M4Dj9llTUA5VewclR8A== X-Received: by 2002:a17:902:8f83:b0:151:5c71:a6e6 with SMTP id z3-20020a1709028f8300b001515c71a6e6mr20427267plo.126.1646254323838; Wed, 02 Mar 2022 12:52:03 -0800 (PST) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id a12-20020a056a000c8c00b004e1a76f0a8asm71669pfv.51.2022.03.02.12.52.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 02 Mar 2022 12:52:03 -0800 (PST) Date: Wed, 2 Mar 2022 12:52:02 -0800 From: Kees Cook To: Lee Jones Cc: Eric Biggers , Adam Langley , linux-kernel@vger.kernel.org, David Howells , David Woodhouse , keyrings@vger.kernel.org Subject: Re: [PATCH 1/1] sign-file: Use OpenSSL provided define to compile out deprecated APIs Message-ID: <202203021251.1DB0383C@keescook> References: <20211005161833.1522737-1-lee.jones@linaro.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Precedence: bulk List-ID: X-Mailing-List: keyrings@vger.kernel.org On Tue, Oct 05, 2021 at 07:11:02PM +0100, Lee Jones wrote: > On Tue, 05 Oct 2021, Eric Biggers wrote: > > > On Tue, Oct 05, 2021 at 10:14:58AM -0700, Adam Langley wrote: > > > On Tue, Oct 5, 2021 at 10:01 AM Eric Biggers wrote: > > > > I ran into these same -Wdeprecated-declarations compiler warnings on another > > > > project that uses the ENGINE API to access OpenSSL's support for PKCS#11 tokens. > > > > The conclusion was that in OpenSSL 3.0, the new API for PKCS#11 support isn't > > > > actually ready yet, so we had to keep using the ENGINE API and just add > > > > -Wno-deprecated-declarations to the compiler flags. > > > > > > > > Your patch just removes support for PKCS#11 in that case, which seems > > > > undesirable. (Unless no one is actually using it?) > > > > > > The patch removes support when OPENSSL_NO_ENGINE is defined, but > > > that's not defined by default in OpenSSL 3.0. (Unless something > > > changed recently.) > > > > > > When OPENSSL_NO_ENGINE is defined, ENGINE support is not compiled into > > > OpenSSL and the headers don't include the functions: > > > https://github.com/openssl/openssl/blob/master/include/openssl/engine.h > > > . > > > > Okay so this patch is actually a build fix for when OpenSSL doesn't include > > ENGINE support? > > Correct. > > > Currently this patch claims that it's removing the use of a > > "deprecated" API, which is something entirely different. > > I see your point. > > Happy to rejig the commit message if that would help. *thread necromancy* Hi, These warnings are quite noisy on Fedora rawhide and other distros that have moved to OpenSSL 3.0. It's not clear to me from this thread if this patch is actually the correct fix? -Kees -- Kees Cook