* [Buildroot] [PATCH v3] package/libressl: bump version to 4.4.0
@ 2026-10-30 15:19 Peter Seiderer via buildroot
2026-11-01 22:44 ` Thomas Petazzoni via buildroot
0 siblings, 1 reply; 4+ messages in thread
From: Peter Seiderer via buildroot @ 2026-10-30 15:19 UTC (permalink / raw)
To: buildroot; +Cc: Julien Olivain, Peter Seiderer
- bump version to 4.4.0 (for details see [1])
- enable 'ENABLE_ASM=OFF' for aarch64, fixes (for some combinations of
gcc/binutils/target-cpu):
bootlin-aarch64-glibc-old/build/libressl-4.4.0/crypto/sha/sha1_aarch64_ce.S:105: Error: unknown architectural extension `sha2'
bootlin-aarch64-glibc-old/build/libressl-4.4.0/crypto/sha/sha1_aarch64_ce.S:156: Error: selected processor does not support `sha1c q18,s19,v28.4s'
- handle stack protector/ENABLE_HARDENING flag, fixes
"undefined reference to `__stack_chk_fail_local'"
[1] https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.4.0-relnotes.txt
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
---
Changes v2 -> v3:
- fix 'ENABLE_ASM=OFF' comment formating
Changes v1 -> v2:
- enable 'ENABLE_ASM=OFF' for aarch64
- handle stack protector/ENABLE_HARDENING flag
---
package/libressl/libressl.hash | 2 +-
package/libressl/libressl.mk | 14 +++++++++++---
2 files changed, 12 insertions(+), 4 deletions(-)
diff --git a/package/libressl/libressl.hash b/package/libressl/libressl.hash
index b64df284fc..e3978baa63 100644
--- a/package/libressl/libressl.hash
+++ b/package/libressl/libressl.hash
@@ -1,4 +1,4 @@
# From https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/SHA256
-sha256 57c8b2f8c6f9505587abaeddab003ea243d615edb7ed71957968121fc6316bd6 libressl-4.3.4.tar.gz
+sha256 7d02522ad5070b9adb32eb253ecabce181184a3750cf65abac0675ee908687c1 libressl-4.4.0.tar.gz
# Locally computed
sha256 9853507b8821c3f277aa60bf554eade41441ef06b2df538d247183ad28789b7f COPYING
diff --git a/package/libressl/libressl.mk b/package/libressl/libressl.mk
index 6d6de78213..a618079ea9 100644
--- a/package/libressl/libressl.mk
+++ b/package/libressl/libressl.mk
@@ -4,7 +4,7 @@
#
################################################################################
-LIBRESSL_VERSION = 4.3.4
+LIBRESSL_VERSION = 4.4.0
LIBRESSL_SITE = https://ftp.openbsd.org/pub/OpenBSD/LibreSSL
LIBRESSL_LICENSE = ISC (new additions), OpenSSL or SSLeay (original OpenSSL code)
LIBRESSL_LICENSE_FILES = COPYING
@@ -13,11 +13,19 @@ LIBRESSL_INSTALL_STAGING = YES
LIBRESSL_CONF_OPTS = -DLIBRESSL_TESTS=OFF -DOPENSSLDIR="/etc/ssl"
# Otherwise fails to build with undefined reference to
-# `bn_mul_add_words'
-ifeq ($(BR2_powerpc)$(BR2_mips64)$(BR2_mips64el),y)
+# `bn_mul_add_words' or for some aarch64 combinations (gcc/binutils/target-cpu)
+# with "Error: unknown architectural extension `sha2'
+ifeq ($(BR2_aarch64)$(BR2_powerpc)$(BR2_mips64)$(BR2_mips64el),y)
LIBRESSL_CONF_OPTS += -DENABLE_ASM=OFF
endif
+# Avoid linking problem: "undefined reference to `__stack_chk_fail_local'"
+ifeq ($(BR2_TOOLCHAIN_HAS_SSP),y)
+LIBRESSL_CONF_OPTS += -DENABLE_HARDENING=ON
+else
+LIBRESSL_CONF_OPTS += -DENABLE_HARDENING=OFF
+endif
+
ifeq ($(BR2_PACKAGE_LIBRESSL_BIN),)
define LIBRESSL_REMOVE_BIN
$(RM) -f $(TARGET_DIR)/usr/bin/openssl
--
2.56.0
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [Buildroot] [PATCH v3] package/libressl: bump version to 4.4.0
2026-10-30 15:19 [Buildroot] [PATCH v3] package/libressl: bump version to 4.4.0 Peter Seiderer via buildroot
@ 2026-11-01 22:44 ` Thomas Petazzoni via buildroot
2026-11-02 13:44 ` Peter Seiderer via buildroot
0 siblings, 1 reply; 4+ messages in thread
From: Thomas Petazzoni via buildroot @ 2026-11-01 22:44 UTC (permalink / raw)
To: Peter Seiderer; +Cc: buildroot, Julien Olivain
On Fri, Oct 30, 2026 at 04:19:50PM +0100, Peter Seiderer via buildroot wrote:
> +# Avoid linking problem: "undefined reference to `__stack_chk_fail_local'"
> +ifeq ($(BR2_TOOLCHAIN_HAS_SSP),y)
> +LIBRESSL_CONF_OPTS += -DENABLE_HARDENING=ON
> +else
> +LIBRESSL_CONF_OPTS += -DENABLE_HARDENING=OFF
> +endif
This should most likely be an unconditional
-DENABLE_HARDENING=OFF. Indeed, we have a global BR2_SSP_NONE /
BR2_SSP_REGULAR / BR2_SSP_STRONG / BR2_SSP_ALL that decides whether we
want SSP or not.
Thanks!
Thomas
--
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [Buildroot] [PATCH v3] package/libressl: bump version to 4.4.0
2026-11-01 22:44 ` Thomas Petazzoni via buildroot
@ 2026-11-02 13:44 ` Peter Seiderer via buildroot
2026-11-02 17:17 ` Thomas Petazzoni via buildroot
0 siblings, 1 reply; 4+ messages in thread
From: Peter Seiderer via buildroot @ 2026-11-02 13:44 UTC (permalink / raw)
To: Thomas Petazzoni; +Cc: buildroot, Julien Olivain
Hello Thomas,
On Sun, 1 Nov 2026 23:44:43 +0100, Thomas Petazzoni <thomas.petazzoni@bootlin.com> wrote:
> On Fri, Oct 30, 2026 at 04:19:50PM +0100, Peter Seiderer via buildroot wrote:
>
> > +# Avoid linking problem: "undefined reference to `__stack_chk_fail_local'"
> > +ifeq ($(BR2_TOOLCHAIN_HAS_SSP),y)
> > +LIBRESSL_CONF_OPTS += -DENABLE_HARDENING=ON
> > +else
> > +LIBRESSL_CONF_OPTS += -DENABLE_HARDENING=OFF
> > +endif
>
> This should most likely be an unconditional
> -DENABLE_HARDENING=OFF. Indeed, we have a global BR2_SSP_NONE /
> BR2_SSP_REGULAR / BR2_SSP_STRONG / BR2_SSP_ALL that decides whether we
> want SSP or not.
Same for all other packages?
package/aircrack-ng/aircrack-ng.mk:ifeq ($(BR2_TOOLCHAIN_HAS_SSP),y)
package/botan/botan.mk:ifeq ($(BR2_TOOLCHAIN_HAS_SSP),y)
package/btop/btop.mk:ifneq ($(BR2_TOOLCHAIN_HAS_SSP),y)
package/linux-tools/linux-tool-rtla.mk.in:ifeq ($(BR2_TOOLCHAIN_HAS_SSP),)
package/linux-tools/linux-tool-tmon.mk.in:ifeq ($(BR2_TOOLCHAIN_HAS_SSP),)
package/monit/monit.mk: ax_cv_check_cflags___fstack_protector_all=$(if $(BR2_TOOLCHAIN_HAS_SSP),yes,no) \
package/mosh/mosh.mk:ifeq ($(BR2_TOOLCHAIN_HAS_SSP),)
package/ntp/ntp.mk:ifeq ($(BR2_TOOLCHAIN_HAS_SSP),y)
package/powerpc-utils/powerpc-utils.mk: ax_cv_check_cflags___fstack_protector_all=$(if $(BR2_TOOLCHAIN_HAS_SSP),yes,no)
package/psmisc/psmisc.mk:ifeq ($(BR2_TOOLCHAIN_HAS_SSP),)
package/radvd/radvd.mk:ifeq ($(BR2_TOOLCHAIN_HAS_SSP),y)
package/ruby/ruby.mk:ifeq ($(BR2_TOOLCHAIN_HAS_SSP),)
package/stunnel/stunnel.mk: ax_cv_check_cflags___fstack_protector_strong=$(if $(BR2_TOOLCHAIN_HAS_SSP),yes,no) \
package/vlc/vlc.mk: ax_cv_check_cflags___fstack_protector_strong=$(if $(BR2_TOOLCHAIN_HAS_SSP),yes,no)
Regards,
Peter
>
> Thanks!
>
> Thomas
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [Buildroot] [PATCH v3] package/libressl: bump version to 4.4.0
2026-11-02 13:44 ` Peter Seiderer via buildroot
@ 2026-11-02 17:17 ` Thomas Petazzoni via buildroot
0 siblings, 0 replies; 4+ messages in thread
From: Thomas Petazzoni via buildroot @ 2026-11-02 17:17 UTC (permalink / raw)
To: Peter Seiderer; +Cc: buildroot, Julien Olivain
On Mon, Nov 02, 2026 at 02:44:41PM +0100, Peter Seiderer wrote:
> package/aircrack-ng/aircrack-ng.mk:ifeq ($(BR2_TOOLCHAIN_HAS_SSP),y)
> package/botan/botan.mk:ifeq ($(BR2_TOOLCHAIN_HAS_SSP),y)
> package/btop/btop.mk:ifneq ($(BR2_TOOLCHAIN_HAS_SSP),y)
> package/linux-tools/linux-tool-rtla.mk.in:ifeq ($(BR2_TOOLCHAIN_HAS_SSP),)
> package/linux-tools/linux-tool-tmon.mk.in:ifeq ($(BR2_TOOLCHAIN_HAS_SSP),)
> package/monit/monit.mk: ax_cv_check_cflags___fstack_protector_all=$(if $(BR2_TOOLCHAIN_HAS_SSP),yes,no) \
> package/mosh/mosh.mk:ifeq ($(BR2_TOOLCHAIN_HAS_SSP),)
> package/ntp/ntp.mk:ifeq ($(BR2_TOOLCHAIN_HAS_SSP),y)
> package/powerpc-utils/powerpc-utils.mk: ax_cv_check_cflags___fstack_protector_all=$(if $(BR2_TOOLCHAIN_HAS_SSP),yes,no)
> package/psmisc/psmisc.mk:ifeq ($(BR2_TOOLCHAIN_HAS_SSP),)
> package/radvd/radvd.mk:ifeq ($(BR2_TOOLCHAIN_HAS_SSP),y)
> package/ruby/ruby.mk:ifeq ($(BR2_TOOLCHAIN_HAS_SSP),)
> package/stunnel/stunnel.mk: ax_cv_check_cflags___fstack_protector_strong=$(if $(BR2_TOOLCHAIN_HAS_SSP),yes,no) \
> package/vlc/vlc.mk: ax_cv_check_cflags___fstack_protector_strong=$(if $(BR2_TOOLCHAIN_HAS_SSP),yes,no)
In theory, I would say yes. But of course, it's hard to have a general
judgment. When I say for example:
ifeq ($(BR2_TOOLCHAIN_HAS_SSP),y)
NTP_CONF_OPTS += --with-hardenfile=linux
else
NTP_CONF_OPTS += --with-hardenfile=default
endif
it all depends on what this hardenfile option actually does.
Thomas
--
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-11-02 17:17 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-30 15:19 [Buildroot] [PATCH v3] package/libressl: bump version to 4.4.0 Peter Seiderer via buildroot
2026-11-01 22:44 ` Thomas Petazzoni via buildroot
2026-11-02 13:44 ` Peter Seiderer via buildroot
2026-11-02 17:17 ` Thomas Petazzoni via buildroot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox