Switching to OpenSSL 1.1.1 in Yocto Morty release

Switching to OpenSSL 1.1.1 in Yocto Morty release

[Nikolay Merinov]

[-- Attachment #1.1: Type: text/plain, Size: 639 bytes --]

Hi, 

Our company interested in updating an old Yocto releases (especially the Morty release) to use the OpenSSL version 1.1.1. 

Can Yocto Project integrate all necessary changes if Inango prepares all required modification to compile all the code that exists in Poky Morty distribution with OpenSSL 1.1.1b (version used for Thud release)? 

Regards, 
Nikolai 
-- 
[ http://inango.com/ |   ] 
Nikolai Merinov 
Architect, Arch Group 
[ mailto:n.merinov@inango-systems.com | n.merinov@inango-systems.com ] 
T +7 343 298 0147 C +7 912 229 2564 
[ http://inango.com/ | inango.com ] [ https://www.linkedin.com/company/inango ] 

[-- Attachment #1.2: Type: text/html, Size: 2006 bytes --]

[-- Attachment #2: dummyfile.0.part --]
[-- Type: image/png, Size: 1818 bytes --]

[-- Attachment #3: dummyfile.1.part --]
[-- Type: image/png, Size: 541 bytes --]

Re: [yocto] Switching to OpenSSL 1.1.1 in Yocto Morty release

[Nicolas Dechesne]

hey,

On Tue, Jan 14, 2020 at 2:51 PM Nikolay Merinov via
Lists.Yoctoproject.Org
<n.merinov=inango-systems.com@lists.yoctoproject.org> wrote:
>
> Hi,
>
> Our company interested in updating an old Yocto releases (especially the Morty release) to use the OpenSSL version 1.1.1.
>
> Can Yocto Project integrate all necessary changes if Inango prepares all required modification to compile all the code that exists in Poky Morty distribution with OpenSSL 1.1.1b (version used for Thud release)?

morty is no longer maintained by the project. I suppose you will get
more voices here.. but I don't expect such changes would be merged in
the morty branch in poky. Also API/ABI breaks are typically prohibited
in releases.
however what you could (and should?) do is to create your own layer
and share it with everyone, in case someone wants/needs morty +
openssl 1.1.1. A similar layer exists here:
http://git.yoctoproject.org/cgit/cgit.cgi/meta-openssl102
It is for users of recent releases willing to use the old version of openssl..

You can submit your layer to the OE layer index, so that users can
easily find it.

>
> Regards,
> Nikolai
> --
> Nikolai Merinov
> Architect, Arch Group
> n.merinov@inango-systems.com
> T +7 343 298 0147 C +7 912 229 2564
> inango.com
> 

Re: [yocto] Switching to OpenSSL 1.1.1 in Yocto Morty release

[Alexander Kanavin]

[-- Attachment #1.1: Type: text/plain, Size: 831 bytes --]

On Tue, 14 Jan 2020 at 14:51, Nikolay Merinov via Lists.Yoctoproject.Org
<n.merinov=inango-systems.com@lists.yoctoproject.org> wrote:

> Our company interested in updating an old Yocto releases (especially the
> Morty release) to use the OpenSSL version 1.1.1.
>
> Can Yocto Project integrate all necessary changes if Inango prepares all
> required modification to compile all the code that exists in Poky Morty
> distribution with OpenSSL 1.1.1b (version used for Thud release)?
>

I assume you want to upgrade because openssl 1.0 is no longer supported
upstream, and you want to keep your stack secure, is that so? What is the
reason behind it?

What I am getting at is that updating just one component will not solve the
security problem; you need to update your products to a supported Yocto
release.

Alex

[-- Attachment #1.2: Type: text/html, Size: 1420 bytes --]

[-- Attachment #2: dummyfile.0.part --]
[-- Type: image/png, Size: 1818 bytes --]

[-- Attachment #3: dummyfile.1.part --]
[-- Type: image/png, Size: 541 bytes --]

Re: [yocto] Switching to OpenSSL 1.1.1 in Yocto Morty release

[Richard Purdie]

On Tue, 2020-01-14 at 15:50 +0200, Nikolay Merinov via
Lists.Yoctoproject.Org wrote:
> Our company interested in updating an old Yocto releases (especially
> the Morty release) to use the OpenSSL version 1.1.1.
> 
> Can Yocto Project integrate all necessary changes if Inango prepares
> all required modification to compile all the code that exists in Poky
> Morty distribution with OpenSSL 1.1.1b (version used for Thud
> release)?

Our new stable branch maintenance plans are here:

https://wiki.yoctoproject.org/wiki/LTS

Have a look at those, particularly the community section to see whether
this may qualify as a community maintained mixin style layer for morty?

We couldn't integrate these into morty itself but this could be
potentially be acceptable as a mixin type piece of work that could be
shared.

Cheers,

Richard

Re: [yocto] Switching to OpenSSL 1.1.1 in Yocto Morty release

[Nikolay Merinov]

Hi Richard,

Thank you for your answer. We'll consider this possibility.

Regards,
Nikolai

----- Original Message -----
> From: "Richard Purdie" <richard.purdie@linuxfoundation.org>
> To: "n merinov" <n.merinov@inango-systems.com>, "yocto" <yocto@lists.yoctoproject.org>
> Sent: Wednesday, January 15, 2020 3:08:27 AM
> Subject: Re: [yocto] Switching to OpenSSL 1.1.1 in Yocto Morty release

> On Tue, 2020-01-14 at 15:50 +0200, Nikolay Merinov via
> Lists.Yoctoproject.Org wrote:
>> Our company interested in updating an old Yocto releases (especially
>> the Morty release) to use the OpenSSL version 1.1.1.
>> 
>> Can Yocto Project integrate all necessary changes if Inango prepares
>> all required modification to compile all the code that exists in Poky
>> Morty distribution with OpenSSL 1.1.1b (version used for Thud
>> release)?
> 
> Our new stable branch maintenance plans are here:
> 
> https://wiki.yoctoproject.org/wiki/LTS
> 
> Have a look at those, particularly the community section to see whether
> this may qualify as a community maintained mixin style layer for morty?
> 
> We couldn't integrate these into morty itself but this could be
> potentially be acceptable as a mixin type piece of work that could be
> shared.
> 
> Cheers,
> 
> Richard