Skip to content

Commit 91fd452

Browse files
padelsbachpadelsbach
committed
When installing in standalone mode, don't modify system config
1 parent 823dab8 commit 91fd452

File tree

3 files changed

+115
-36
lines changed

3 files changed

+115
-36
lines changed

‎.github/workflows/debian-package.yml‎

Lines changed: 23 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -62,19 +62,36 @@ jobs:
6262
name: debian-packages-${{ matrix.fips_ref }}${{ matrix.replace_default && '-replace-default' || '' }}-${{ matrix.wolfssl_ref }}-${{ matrix.openssl_ref }}
6363
path: /tmp
6464

65-
- name: Install wolfSSL/OpenSSL/wolfprov packages
65+
- name: Install OpenSSL packages
6666
run: |
67-
apt install --reinstall -y --allow-downgrades --allow-change-held-packages \
68-
${{ env.WOLFSSL_PACKAGES_PATH }}/libwolfssl_*.deb
67+
if [ "${{ matrix.replace_default }}" = "true" ]; then
68+
# Install OpenSSL packages for replace-default mode
69+
apt install --reinstall -y --allow-downgrades --allow-change-held-packages \
70+
${{ env.OPENSSL_PACKAGES_PATH }}/openssl_*.deb \
71+
${{ env.OPENSSL_PACKAGES_PATH }}/libssl3_*.deb \
72+
${{ env.OPENSSL_PACKAGES_PATH }}/libssl-dev_*.deb
73+
else
74+
# Install standard OpenSSL packages
75+
apt-get update
76+
apt-get install -y \
77+
openssl libssl3 libssl-dev
78+
fi
6979
80+
- name: Install wolfSSL and wolfProvider packages
81+
run: |
7082
apt install --reinstall -y --allow-downgrades --allow-change-held-packages \
71-
${{ env.OPENSSL_PACKAGES_PATH }}/openssl_*.deb \
72-
${{ env.OPENSSL_PACKAGES_PATH }}/libssl3_*.deb \
73-
${{ env.OPENSSL_PACKAGES_PATH }}/libssl-dev_*.deb
83+
${{ env.WOLFSSL_PACKAGES_PATH }}/libwolfssl_*.deb
7484
7585
apt install --reinstall -y --allow-downgrades --allow-change-held-packages \
7686
${{ env.WOLFPROV_PACKAGES_PATH }}/libwolfprov_*.deb
7787
88+
# In standalone mode, use OPENSSL_CONF to enable wolfProvider.
89+
if [ "${{ matrix.replace_default }}" = "false" ]; then
90+
echo "Setting OPENSSL_CONF to /etc/ssl/openssl.cnf.d/wolfprovider.conf"
91+
# export OPENSSL_CONF=/etc/ssl/openssl.cnf.d/wolfprovider.conf
92+
echo "OPENSSL_CONF=/etc/ssl/openssl.cnf.d/wolfprovider.conf" >> "$GITHUB_ENV"
93+
fi
94+
7895
- name: Verify wolfProvider is properly installed
7996
run: |
8097
$GITHUB_WORKSPACE/scripts/verify-install.sh \

‎debian/install-wolfprov.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -188,8 +188,8 @@ main() {
188188
exit 1
189189
fi
190190

191-
if [ -n "output_dir" ]; then
192-
output_dir=$(realpath $output_dir)
191+
if [ -n "$output_dir" ]; then
192+
output_dir=$(realpath "$output_dir")
193193
fi
194194

195195
work_dir=$(mktemp -d)

‎debian/libwolfprov.postinst‎

Lines changed: 90 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,6 @@
11
#!/bin/sh
22
set -e
33

4-
# Define the include line to add to the openssl.cnf file
5-
INCLUDE_LINE=".include /etc/ssl/openssl.cnf.d/wolfprovider.conf"
6-
7-
# Search for the openssl.cnf file in /usr, /lib and /etc
8-
CONF_FILES=$(find /usr /lib /etc -name openssl.cnf 2>/dev/null)
9-
104
# Check if we are in replace-default mode by reading the openssl version
115
REPLACE_DEFAULT=0
126
if command -v openssl >/dev/null 2>&1; then
@@ -16,29 +10,97 @@ if command -v openssl >/dev/null 2>&1; then
1610
fi
1711
fi
1812

19-
if [ $REPLACE_DEFAULT -eq 1 ]; then
20-
# Remove INCLUDE_LINE from each CONF_FILE
21-
# Replace default mode should automatically find wolfProvider.
22-
# Using the config file or OPENSSL_CONF will cause:
23-
# 1. the provider name to be 'libwolfprov' instead of 'default'
24-
# 2. the provider init call to happen twice
25-
# Neither of these is harmful, but it's not ideal.
26-
for CONF_FILE in $CONF_FILES; do
27-
# Remove any line containing both ".include" and "wolfprovider.conf"
28-
sed -i '/\.include/ { /wolfprovider\.conf/ d; }' "$CONF_FILE"
29-
printf "Removed wolfprovider include line(s) from %s\n" "$CONF_FILE"
30-
done
31-
else
32-
# For each CONF_FILE, apply the include line to the openssl.cnf file, if not already applied
33-
for CONF_FILE in $CONF_FILES; do
34-
if grep -qF "$INCLUDE_LINE" "$CONF_FILE"; then
35-
echo "Include line already exists in $CONF_FILE"
36-
else
37-
echo "Adding include for wolfprovider to $CONF_FILE..."
38-
echo "$INCLUDE_LINE" >> "$CONF_FILE"
39-
fi
40-
done
13+
if [ "$1" = "configure" ]; then
14+
if [ $REPLACE_DEFAULT -eq 1 ]; then
15+
cat <<'EOF'
16+
============================================================
17+
wolfProvider Installation Notes
18+
============================================================
19+
20+
wolfProvider is installed in replace-default mode with a
21+
patched version of OpenSSL that uses wolfProvider as the
22+
crypto backend. wolfProvider will appear as the 'default'
23+
provider.
24+
25+
No other conf file modifications or environment variables
26+
are required.
27+
28+
To verify installation, run:
29+
openssl version
30+
openssl list -providers
31+
32+
wolfProvider configuration file installed at:
33+
/etc/ssl/openssl.cnf.d/wolfprovider.conf
34+
35+
============================================================
36+
EOF
37+
else
38+
cat <<'EOF'
39+
============================================================
40+
wolfProvider Installation Notes
41+
============================================================
42+
43+
To use wolfProvider with OpenSSL, choose ONE of the options
44+
below depending on your use case.
45+
46+
1) System-wide enable:
47+
48+
Add the following line to your /etc/ssl/openssl.cnf:
49+
50+
.include /etc/ssl/openssl.cnf.d/wolfprovider.conf
51+
52+
This makes wolfProvider available via the default OpenSSL
53+
configuration for all applications on the system.
54+
55+
56+
2) Per-command enable (no system-wide changes)
57+
58+
Set OPENSSL_CONF when running OpenSSL commands:
59+
60+
OPENSSL_CONF=/etc/ssl/openssl.cnf.d/wolfprovider.conf \
61+
openssl <command>
62+
63+
This uses wolfProvider only for commands where the
64+
environment variable is set.
65+
66+
67+
3) Application-level integration (for developers)
68+
69+
In your application, you can create a dedicated OpenSSL
70+
library context and explicitly load wolfProvider, e.g.:
71+
72+
OSSL_LIB_CTX *wpLibCtx = OSSL_LIB_CTX_new();
73+
OSSL_PROVIDER *wpProv = OSSL_PROVIDER_load(wpLibCtx, "wolfprovider");
74+
/* Use wpLibCtx with EVP, etc. */
75+
EVP_function(wpLibCtx, ...);
76+
OSSL_PROVIDER_unload(wpProv);
77+
OSSL_LIB_CTX_free(wpLibCtx);
78+
79+
This keeps wolfProvider usage scoped to specific code paths
80+
without requiring any system-wide configuration changes.
81+
82+
To verify installation and configuration, run:
83+
openssl version
84+
openssl list -providers
85+
86+
wolfProvider configuration file installed at:
87+
/etc/ssl/openssl.cnf.d/wolfprovider.conf
88+
89+
============================================================
90+
EOF
91+
fi
4192
fi
4293

94+
# Search for the openssl.cnf file in /usr, /lib and /etc
95+
CONF_FILES=$(find /usr /lib /etc -name openssl.cnf 2>/dev/null)
96+
97+
# Warn user on install or removal if our config file is already included.
98+
for CONF_FILE in $CONF_FILES; do
99+
if grep '.include' "$CONF_FILE" | grep -q "wolfprovider.conf"; then
100+
echo "WARNING: wolfprovider.conf is already included in $CONF_FILE"
101+
fi
102+
done
103+
104+
43105
#DEBHELPER#
44106
exit 0

0 commit comments

Comments
 (0)