Re: [OE-core] [PATCH] openssl: add fips support

[Yi Zhao <yi.zhao@windriver.com>]

On 5/9/25 17:56, Alexander Kanavin wrote:
> On Fri, 9 May 2025 at 11:38, Yi Zhao via lists.openembedded.org
> <yi.zhao=eng.windriver.com@lists.openembedded.org> wrote:
>> * Add pkg_postinst_ontarget for openssl-ossl-module-fips to ensure the
>>    config file fipsmodule.cnf is created on target.
>> +       # Generate fipsmodule.cnf on first boot
>> +       if ${@bb.utils.contains('PACKAGECONFIG', 'fips', 'true', 'false', d)}; then
>> +               rm -f ${D}${libdir}/ssl-3/fipsmodule.cnf
>> +       fi
>> +pkg_postinst_ontarget:${PN}-ossl-module-fips () {
>> +       if test -f ${libdir}/ossl-modules/fips.so; then
>> +               ${bindir}/openssl fipsinstall -out ${libdir}/ssl-3/fipsmodule.cnf -module ${libdir}/ossl-modules/fips.so
>> +       fi
>> +}
>> +
> This needs to be better explained:
>
> - why is the standard fipsmodule.cnf deleted in do_install? If
> upstream installs it, then why can't we simply use it?
>
> - why re-generation of that file has to happen on target? Can we use
> native openssl instead? Or run target openssl with qemu usermode?

The "openssl fipsinstall" command will do the following things:
1. Runs the FIPS module self tests on target
2. Generates config file fipsmodule.conf containing information about 
the module such as the calculated MAC of the FIPS module and the MAC of 
the value of the self tests status

We should not use the same fipsmodule.cnf on different machines. So it 
will be generated on the target.


//Yi


>
> Alex