rebuilding OpenSSL under Strawberry Perl

[Thomas J Pinkl]

I need to rebuild OpenSSL 1.0.1e to include the FIPS object module,
under Strawberry Perl 5.16.x for both 32-bit and 64-bit platforms.

Can anyone point me to the procedure that was used to build the non-FIPS
capable OpenSSL 1.0.1e under Strawberry Perl?

--
Thomas J. Pinkl

[kmx]

Here are build logs for both 32/64bit openssl builds:
http://pastebin.com/MQPWc6iu
http://pastebin.com/wYTWEcPw

What exactly are you looking for?

--
kmx

[Curtis Jewell]

I'll help out here:

kmx: I think he needs the command lines/batch files used for the process
when you created the build, and the procedure to set up a build
environment - that way, he can follow the procedures used in
http://www.openssl.org/docs/fips/UserGuide-2.0.pdf chapter 4 to do the
rebuild.

Mr. Pinkl: (Once you get that information from kmx) In Strawberry Perl's
case, the Microsoft Windows directions in that file are the wrong
direction to go - the build environment for Strawberry Perl is more
'Unix/Linux' style than Microsoft Windows style (Strawberry Perl
specifically uses gcc instead of Microsoft Visual C++, for example.)

--Curtis

--
Curtis Jewell http://strawberryperl.com/
pe...@csjewell.fastmail.us http://csjewell.dreamwidth.org/

Strawberry Perl for Windows betas: http://strawberryperl.com/beta/

[kmx]

In that case here is the build script:
http://svn.ali.as/cpan/users/kmx/strawberry_packs_devel/build/go-build.sh

--
kmx

[Thomas J Pinkl]

On 08/31/2013 10:44 AM, Curtis Jewell wrote:
> I'll help out here:
>
> kmx: I think he needs the command lines/batch files used for the process
> when you created the build, and the procedure to set up a build
> environment - that way, he can follow the procedures used in
> http://www.openssl.org/docs/fips/UserGuide-2.0.pdf chapter 4 to do the
> rebuild.
>
> Mr. Pinkl: (Once you get that information from kmx) In Strawberry Perl's
> case, the Microsoft Windows directions in that file are the wrong
> direction to go - the build environment for Strawberry Perl is more
> 'Unix/Linux' style than Microsoft Windows style (Strawberry Perl
> specifically uses gcc instead of Microsoft Visual C++, for example.)
>
> --Curtis

Curtis, you are correct. That's exactly what I'm looking for.

On 09/01/2013 03:01 PM, kmx wrote:
> In that case here is the build script:
> http://svn.ali.as/cpan/users/kmx/strawberry_packs_devel/build/go-build.sh

kmx, thanks for the build script. Is there any information available to
how to set up the build environment, prior to running that script?

--
Thomas J. Pinkl

[Thomas J Pinkl]

On 09/01/2013 03:01 PM, kmx wrote:

> In that case here is the build script:
> http://svn.ali.as/cpan/users/kmx/strawberry_packs_devel/build/go-build.sh

Do you patch the standard openssl 1.0.1e distribution in order to get it
to build under the MinGW provided with Strawberry Perl?

I'm still unsuccessful in building openssl 1.0.1e with fips 2.0.5.

--
Thomas J. Pinkl
1002 Elbow Lane
Warrington, PA 18976
T: (215) 491-0761

[kmx]

On 6.9.2013 2:41, Thomas J Pinkl wrote:
> On 09/01/2013 03:01 PM, kmx wrote:
>> In that case here is the build script:
>> http://svn.ali.as/cpan/users/kmx/strawberry_packs_devel/build/go-build.sh
>
> Do you patch the standard openssl 1.0.1e distribution in order to get it
> to build under the MinGW provided with Strawberry Perl?

There are no patches, strawberry perl is bundleded with genuine 1.0.1e
version (I always run openssl test suite and nothing fails)

>
> I'm still unsuccessful in building openssl 1.0.1e with fips 2.0.5.

I'll try and let you know.

--
kmx

[kmx]

Thomas,

openssl-fips-2.0.5 seems to build fine for me, here is how you can do it:

1/ download MSYS environment from http://sourceforge.net/projects/perlmingw/files/MSYS%20Environment%20for%20End%20Users/

2/ unpack standard-msys-20111122.7z into - e.g. c:\dev\msys

3/ make sure you have gcc compiler from strawberry perl in your PATH - e.g. c:\strawberry\c\bin

4/ unpack sources
    openssl-fips-2.0.5.tag.gz into e.g. c:\dev\openssl-fips-2.0.5
    openssl-1.0.1e.tar.gz into c:\dev\openssl-1.0.1e

5/ start c:\dev\msys\msys.bat

6/ in MSYS prompt
    $ cd /c/dev/openssl-fips-2.0.5
    $ ./Configure mingw64 shared --prefix=/c/dev/output
    $ make
    $ make install
    $ cd /c/dev/openssl-1.0.1e
    $ ./Configure mingw64 shared fips --with-fipsdir=/c/dev/output --prefix=/c/dev/output
    $ make depend
    $ make
    $ make install_sw

NOTE: for 32bit Windows use "./Configure mingw ..." instead of "./Configure mingw64 ..."

7/ take the results from c:\dev\output

In strawberry perl we do a bit of kung-fu with *.a renaming
    libcrypto.dll.a >> libeay32.a
    libssl.dll.a >> libssleay32.a
    libssl.dll.a >> libssl32.a         (yes, duplicity)
    + we completely drop static libraries libcrypto.a, libssl.a

--
kmx

[Thomas J Pinkl]

On 09/10/2013 04:35 AM, kmx wrote:
> openssl-fips-2.0.5 seems to build fine for me, here is how you can do it:

kmx, thanks for taking the time to help with this. My build is failing
at step 6 (see below).

> 1/ download MSYS environment from
> http://sourceforge.net/projects/perlmingw/files/MSYS%20Environment%20for%20End%20Users/
>
> 2/ unpack standard-msys-20111122.7z into - e.g. c:\dev\msys
>
> 3/ make sure you have gcc compiler from strawberry perl in your PATH -
> e.g. c:\strawberry\c\bin
>
> 4/ unpack sources
> openssl-fips-2.0.5.tag.gz into e.g. c:\dev\openssl-fips-2.0.5
> openssl-1.0.1e.tar.gz into c:\dev\openssl-1.0.1e
>
> 5/ start c:\dev\msys\msys.bat
>
> 6/ in MSYS prompt
> $ cd /c/dev/openssl-fips-2.0.5
> $ ./Configure mingw64 shared --prefix=/c/dev/output
> $ make
> $ make install
> $ cd /c/dev/openssl-1.0.1e
> $ ./Configure mingw64 shared fips --with-fipsdir=/c/dev/output
> --prefix=/c/dev/output
> $ make depend
> $ make
> $ make install_sw
>
> NOTE: for 32bit Windows use "./Configure mingw ..." instead of
> "./Configure mingw64 ..."

I am using "mingw" since I'm on a 32-bit system. I used "/c/OpenSSL" as
the prefix and fipsdir.

The "make" for openssl-1.0.1e fails for me with:

make[4]: Entering directory `/c/dev/openssl-1.0.1e'
Creating library file: libcrypto.dll.a
libcrypto.a(uplink.o):uplink.c:(.text+0x30): multiple definition of
`OPENSSL_Uplink'
c:/OpenSSL/lib/fipscanister.o:uplink.c:(.text+0x3ac20): first defined
here libcrypto.a(uplink-x86.o):uplink-x86.s:(.data+0x0): multiple
definition of `OPENSSL_UplinkTable'
c:/OpenSSL/lib/fipscanister.o:uplink-x86.s:(.data+0x140): first defined
here
c:/sbperl/c/bin/../lib/gcc/i686-w64-mingw32/4.6.3/../../../../i686-w64-mingw32/bin/ld.exe:
c:/OpenSSL/lib/fipscanister.o: bad reloc address 0xa in section
`.text.unlikely'
collect2: ld returned 1 exit status
make[4]: *** [link_a.cygwin] Error 1
make[4]: Leaving directory `/c/dev/openssl-1.0.1e'
make[3]: *** [do_cygwin-shared] Error 2
make[3]: Leaving directory `/c/dev/openssl-1.0.1e'
make[2]: *** [libcrypto.dll.a] Error 2
make[2]: Leaving directory `/c/dev/openssl-1.0.1e'
make[1]: *** [shared] Error 2
make[1]: Leaving directory `/c/dev/openssl-1.0.1e/crypto'
make: *** [build_crypto] Error 1

Any ideas?

> 7/ take the results from c:\dev\output
>
> In strawberry perl we do a bit of kung-fu with *.a renaming
> libcrypto.dll.a >> libeay32.a
> libssl.dll.a >> libssleay32.a
> libssl.dll.a >> libssl32.a (yes, duplicity)
> + we completely drop static libraries libcrypto.a, libssl.a
> --
> kmx

What are the .dll.a files then?

[kmx]

I can reproduce your failure. My first build was 64bit and went fine.

I am afraid it is an issue with openssl-fips and/or openssl configure script or makefile.

--
kmx

[Thomas J Pinkl]

On 09/12/2013 04:17 PM, kmx wrote:
> I can reproduce your failure. My first build was 64bit and went fine.
>
> I am afraid it is an issue with openssl-fips and/or openssl configure
> script or makefile.

Thanks. At least I now know it's not something with my system.

I appreciate your help.

--
Thomas J. Pinkl