[meta-security][PATCH 1/2] softHSM: add pkg

[meta-security][PATCH 1/2] softHSM: add pkg

[akuster]

Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
 recipes-security/softHSM/softhsm_2.6.1.bb | 30 +++++++++++++++++++++++
 1 file changed, 30 insertions(+)
 create mode 100644 recipes-security/softHSM/softhsm_2.6.1.bb

diff --git a/recipes-security/softHSM/softhsm_2.6.1.bb b/recipes-security/softHSM/softhsm_2.6.1.bb
new file mode 100644
index 0000000..74e837a
--- /dev/null
+++ b/recipes-security/softHSM/softhsm_2.6.1.bb
@@ -0,0 +1,30 @@
+SUMMARY = "SoftHSM is an implementation of a cryptographic store accessible through a PKCS #11 interface."
+HOMEPAGE = "www.opendnssec.org"
+
+LICENSE = "BSD"
+LIC_FILES_CHKSUM = "file://LICENSE;md5=ef3f77a3507c3d91e75b9f2bdaee4210"
+
+DEPENDS = "sqlite3"
+
+SRC_URI = "https://dist.opendnssec.org/source/softhsm-2.6.1.tar.gz"
+SRC_URI[sha256sum] = "61249473054bcd1811519ef9a989a880a7bdcc36d317c9c25457fc614df475f2"
+
+inherit autotools pkgconfig siteinfo
+
+EXTRA_OECONF += " --with-sqlite3=${STAGING_DIR_HOST}/usr"
+EXTRA_OECONF += "${@oe.utils.conditional('SITEINFO_BITS', '64', ' --enable-64bit', '', d)}"
+
+PACKAGECONFIG ?= "pk11 openssl"
+
+PACKAGECONFIG[npm] = ",--disable-non-paged-memory"
+PACKAGECONFIG[ecc] = "--enable-ecc,--disable-ecc"
+PACKAGECONFIG[gost] = "--enable-gost,--disable-gost"
+PACKAGECONFIG[eddsa] = "--enable-eddsa, --disable-eddsa"
+PACKAGECONFIG[fips] = "--enable-fips, --disable-fips"
+PACKAGECONFIG[notvisable] = "--disable-visibility"
+PACKAGECONFIG[openssl] = "--with-openssl=${STAGING_DIR_HOST}/usr --with-crypto-backend=openssl, --without-openssl, openssl, openssl"
+PACKAGECONFIG[botan] = "--with-botan=${STAGING_DIR_HOST}/usr --with-crypto-backend=botan, --without-botan, botan"
+PACKAGECONFIG[migrate] = "--with-migrate"
+PACKAGECONFIG[pk11] = "--enable-p11-kit --with-p11-kit==${STAGING_DIR_HOST}/usr, --without-p11-kit, p11-kit, p11-kit"
+
+RDEPENDS_${PN} = "sqlite3"
-- 
2.17.1

[meta-security][PATCH 2/2] packagegroup-core-security: add softHSM

[akuster]

Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
 recipes-core/packagegroup/packagegroup-core-security.bb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/recipes-core/packagegroup/packagegroup-core-security.bb b/recipes-core/packagegroup/packagegroup-core-security.bb
index 1d01800..4d98631 100644
--- a/recipes-core/packagegroup/packagegroup-core-security.bb
+++ b/recipes-core/packagegroup/packagegroup-core-security.bb
@@ -36,6 +36,7 @@ RDEPENDS_packagegroup-security-utils = "\
     python3-privacyidea \
     python3-fail2ban \
     python3-scapy \
+    softhsm \
     ${@bb.utils.contains_any("TUNE_FEATURES", "riscv32 ", "", " libseccomp",d)} \
     ${@bb.utils.contains("DISTRO_FEATURES", "pam", "sssd google-authenticator-libpam", "",d)} \
     ${@bb.utils.contains("DISTRO_FEATURES", "pax", "pax-utils packctl", "",d)} \
-- 
2.17.1

Re: [yocto] [meta-security][PATCH 1/2] softHSM: add pkg

[Ricardo Salveti]

Hi,

On Sun, Sep 27, 2020 at 7:16 PM akuster <akuster808@gmail.com> wrote:
>
> Signed-off-by: Armin Kuster <akuster808@gmail.com>
> ---
>  recipes-security/softHSM/softhsm_2.6.1.bb | 30 +++++++++++++++++++++++
>  1 file changed, 30 insertions(+)
>  create mode 100644 recipes-security/softHSM/softhsm_2.6.1.bb

Was going over recipes that were duplicated over layers, and this one
is a newer version of a similar recipe that is already in meta-oe
(which is a dependency of this layer).

Should we drop the one from meta-oe or should we just update that one
with the content from this recipe and then remove from meta-security?

Thanks,
-- 
Ricardo Salveti

Re: [yocto] [meta-security][PATCH 1/2] softHSM: add pkg

[akuster]

On 11/3/20 2:52 PM, Ricardo Salveti wrote:
> Hi,
>
> On Sun, Sep 27, 2020 at 7:16 PM akuster <akuster808@gmail.com> wrote:
>> Signed-off-by: Armin Kuster <akuster808@gmail.com>
>> ---
>>  recipes-security/softHSM/softhsm_2.6.1.bb | 30 +++++++++++++++++++++++
>>  1 file changed, 30 insertions(+)
>>  create mode 100644 recipes-security/softHSM/softhsm_2.6.1.bb
> Was going over recipes that were duplicated over layers, and this one
> is a newer version of a similar recipe that is already in meta-oe
> (which is a dependency of this layer).
>
> Should we drop the one from meta-oe or should we just update that one
> with the content from this recipe and then remove from meta-security?

No. meta-oe is lower in the stack so I should drop the one in
meta-security and update the one in meta-oe.
I didn't notice the recipe already existed. its all about timing and
effort at this point. we may have time.

thanks for reminding me.

-armin
>
> Thanks,