From: Ross Burton <Ross.Burton@arm.com>
To: "mikko.rapeli@linaro.org" <mikko.rapeli@linaro.org>
Cc: Richard Purdie <richard.purdie@linuxfoundation.org>,
"openembedded-core@lists.openembedded.org"
<openembedded-core@lists.openembedded.org>
Subject: Re: [OE-core] [PATCH] python3-cryptography: workaround broken native functionality
Date: Thu, 15 Sep 2022 11:17:44 +0000 [thread overview]
Message-ID: <41221D4F-B1B5-4FFF-9F98-E8B4B8A035CB@arm.com> (raw)
In-Reply-To: <CAJFpGrNM3sqj0o0L3CtNOtiLsq=++sbxun5eGXZHPN+A-oT3Zg@mail.gmail.com>
On 14 Sep 2022, at 09:09, Mikko Rapeli via lists.openembedded.org <mikko.rapeli=linaro.org@lists.openembedded.org> wrote:
> Found the root cause. As suggested on #pyco too maybe native openssl
> was mising legacy support.
> It wasn't but loading the on purpose hidden openssl legacy.so was
> failing. It is located in
> recipe-sysroot-native/usr/lib/ossl-modules/legacy.so and only found
> via OPENSSL_MODULES
> variable which wasn't set for python3-native users. These custom
> variables are set in the native openssl
> wrapper script and this also fixes the not found openssl.cnf. Now I
> could send a patch which sets
> the OPENSSL_CONF, OPENSSL_ENGINES and OPENSSL_MODULES paths for python3
> users via python3native.bbclass:
I’m glad this was root-caused before it was merged, because yes, this is the ‘correct’ (best known) fix right now:
~/Yocto/meta-arm % git grep "export OPENSSL_MODULES"
meta-arm/recipes-bsp/trusted-firmware-m/trusted-firmware-m_1.6.0.bb:export OPENSSL_MODULES="${STAGING_LIBDIR_NATIVE}/ossl-modules"
meta-arm/recipes-security/optee-ftpm/optee-ftpm_git.bb:export OPENSSL_MODULES="${STAGING_LIBDIR_NATIVE}/ossl-modules"
meta-arm/recipes-security/optee/optee.inc:export OPENSSL_MODULES="${STAGING_LIBDIR_NATIVE}/ossl-modules”
A better solution is needed for sure. At least when the certificates can’t be found you get somewhat understandable errors, the python3-crypto error is opaque at best.
OpenSSL supporting runtime-relocation with a single variable would be nice, but iirc from glancing at the source code previously not a trivial change. That said it does cause sufficient pain that maybe we just have to carry the patch.
Alternatively, we extend the magic relocation to native recipes. Even less trivial…
Ross
next prev parent reply other threads:[~2022-09-15 11:18 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-09-13 9:34 [PATCH] python3-cryptography: workaround broken native functionality Mikko Rapeli
2022-09-13 10:01 ` [OE-core] " Richard Purdie
2022-09-13 10:29 ` Mikko Rapeli
2022-09-13 10:34 ` Richard Purdie
2022-09-13 11:13 ` Mikko Rapeli
2022-09-13 12:24 ` Richard Purdie
2022-09-14 8:09 ` Mikko Rapeli
2022-09-14 8:19 ` Alexander Kanavin
2022-09-14 8:43 ` Mikko Rapeli
2022-09-14 8:45 ` Alexander Kanavin
2022-09-14 8:51 ` Mikko Rapeli
2022-09-14 8:52 ` Alexander Kanavin
2022-09-14 8:58 ` Richard Purdie
2022-09-15 11:17 ` Ross Burton [this message]
2022-09-15 11:26 ` Mikko Rapeli
2022-09-15 11:36 ` Martin Jansa
2022-09-20 10:20 ` Mikko Rapeli
2022-09-20 11:35 ` Richard Purdie
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=41221D4F-B1B5-4FFF-9F98-E8B4B8A035CB@arm.com \
--to=ross.burton@arm.com \
--cc=mikko.rapeli@linaro.org \
--cc=openembedded-core@lists.openembedded.org \
--cc=richard.purdie@linuxfoundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox