building openssl 1.1.1 for Solaris 10

classic Classic list List threaded Threaded
13 messages Options
Reply | Threaded
Open this post in threaded view
|

building openssl 1.1.1 for Solaris 10

tim.j.culhane
Hi,

Are there instructions  somewhere for building and installing openssl 1.1.1
from source for Solaris 10?

Many thanks,

Tim


Reply | Threaded
Open this post in threaded view
|

RE: building openssl 1.1.1 for Solaris 10

Michael Wojcik
> From: openssl-users [mailto:[hidden email]] On Behalf Of
> [hidden email]
> Sent: Friday, April 03, 2020 10:49
>
> Are there instructions  somewhere for building and installing openssl 1.1.1
> from source for Solaris 10?

You mean beyond what's in INSTALL and NOTES.UNIX? What is your specific issue?

--
Michael Wojcik
Distinguished Engineer, Micro Focus


Reply | Threaded
Open this post in threaded view
|

RE: building openssl 1.1.1 for Solaris 10

Quanah Gibson-Mount


--On Friday, April 3, 2020 6:31 PM +0000 Michael Wojcik
<[hidden email]> wrote:

>> From: openssl-users [mailto:[hidden email]] On Behalf
>> Of [hidden email]
>> Sent: Friday, April 03, 2020 10:49
>>
>> Are there instructions  somewhere for building and installing openssl
>> 1.1.1 from source for Solaris 10?
>
> You mean beyond what's in INSTALL and NOTES.UNIX? What is your specific
> issue?

They may have run into <https://github.com/openssl/openssl/issues/6333>
which the OpenSSL project seems disinclined to fix.

--Quanah



--

Quanah Gibson-Mount
Product Architect
Symas Corporation
Packaged, certified, and supported LDAP solutions powered by OpenLDAP:
<http://www.symas.com>
Reply | Threaded
Open this post in threaded view
|

RE: building openssl 1.1.1 for Solaris 10

Michael Wojcik
> From: Quanah Gibson-Mount [mailto:[hidden email]]
> Sent: Friday, April 03, 2020 12:06
>
> --On Friday, April 3, 2020 6:31 PM +0000 Michael Wojcik
> <[hidden email]> wrote:
>
> >> From: openssl-users [mailto:[hidden email]] On Behalf
> >> Of [hidden email]
> >> Sent: Friday, April 03, 2020 10:49
> >>
> >> Are there instructions  somewhere for building and installing openssl
> >> 1.1.1 from source for Solaris 10?
> >
> > You mean beyond what's in INSTALL and NOTES.UNIX? What is your specific
> > issue?
>
> They may have run into <https://github.com/openssl/openssl/issues/6333>
> which the OpenSSL project seems disinclined to fix.

Perhaps, but we have no way of knowing that. That's why specific questions are important.

--
Michael Wojcik
Distinguished Engineer, Micro Focus



Reply | Threaded
Open this post in threaded view
|

RE: building openssl 1.1.1 for Solaris 10

tim.j.culhane
No, not run into that issue.

Just wondering if there is a  man page  or similar on openssl.org  which
describes the steps.

Tim


-----Original Message-----
From: openssl-users <[hidden email]> On Behalf Of Michael
Wojcik
Sent: Friday 3 April 2020 19:49
To: [hidden email]
Subject: RE: building openssl 1.1.1 for Solaris 10

> From: Quanah Gibson-Mount [mailto:[hidden email]]
> Sent: Friday, April 03, 2020 12:06
>
> --On Friday, April 3, 2020 6:31 PM +0000 Michael Wojcik
> <[hidden email]> wrote:
>
> >> From: openssl-users [mailto:[hidden email]] On
> >> Behalf Of [hidden email]
> >> Sent: Friday, April 03, 2020 10:49
> >>
> >> Are there instructions  somewhere for building and installing
> >> openssl
> >> 1.1.1 from source for Solaris 10?
> >
> > You mean beyond what's in INSTALL and NOTES.UNIX? What is your
> > specific issue?
>
> They may have run into
> <https://github.com/openssl/openssl/issues/6333>
> which the OpenSSL project seems disinclined to fix.

Perhaps, but we have no way of knowing that. That's why specific questions
are important.

--
Michael Wojcik
Distinguished Engineer, Micro Focus




Reply | Threaded
Open this post in threaded view
|

RE: building openssl 1.1.1 for Solaris 10

Michael Wojcik
> From: [hidden email] [mailto:[hidden email]]
> Sent: Friday, April 03, 2020 15:21
>
> Just wondering if there is a  man page  or similar on openssl.org  which
> describes the steps.

As I noted before, INSTALL and NOTES.TXT. Those are in the root of the OpenSSL source distribution.

--
Michael Wojcik
Distinguished Engineer, Micro Focus


Reply | Threaded
Open this post in threaded view
|

RE: building openssl 1.1.1 for Solaris 10

tim.j.culhane
Hi,

Ok, attempting to build openssl 1.1.1e  now.

As prompted by the config script  I'm  running Configure as  follows:

./Configure solaris64-sparcv9-cc --prefix=/opt/openssl/1.1.1
--openssldir=/opt/openssl/1.1.1

That completes successfully.  However, when I then run gmake I see  warnings
like the below:


cc: Warning: -xarch=v9 is deprecated, use -m64 to create 64-bit programs

How can I configure the makefiles so they use  '-m64'.

I tried passing  '-m64' as an argument to the Configure script but that
didn't make any difference.

Regards,

Tim


-----Original Message-----
From: openssl-users <[hidden email]> On Behalf Of Michael
Wojcik
Sent: Friday 3 April 2020 23:17
To: [hidden email]
Subject: RE: building openssl 1.1.1 for Solaris 10

> From: [hidden email] [mailto:[hidden email]]
> Sent: Friday, April 03, 2020 15:21
>
> Just wondering if there is a  man page  or similar on openssl.org  
> which describes the steps.

As I noted before, INSTALL and NOTES.TXT. Those are in the root of the
OpenSSL source distribution.

--
Michael Wojcik
Distinguished Engineer, Micro Focus



Reply | Threaded
Open this post in threaded view
|

RE: building openssl 1.1.1 for Solaris 10

Michael Wojcik
> From: [hidden email] [mailto:[hidden email]]
> Sent: Monday, April 06, 2020 06:35
> To: Michael Wojcik; [hidden email]
> Subject: RE: building openssl 1.1.1 for Solaris 10
>
> Ok, attempting to build openssl 1.1.1e  now.
>
> As prompted by the config script  I'm  running Configure as  follows:
>
> ./Configure solaris64-sparcv9-cc --prefix=/opt/openssl/1.1.1
> --openssldir=/opt/openssl/1.1.1
>
> That completes successfully.  However, when I then run gmake I see  warnings
> like the below:
>
>
> cc: Warning: -xarch=v9 is deprecated, use -m64 to create 64-bit programs
>
> How can I configure the makefiles so they use  '-m64'.

As far as I know you can't, except by editing Configurations/10-main.conf (one of the inputs to the Configure script). The -xarch=... flags are hard-coded there.

Personally I wouldn't worry about it. -xarch is deprecated, but it still works. (And -m64 is not, as I understand it, exactly equivalent to -xarch anyway. I'm a bit suspicious of that warning from cc; I'd think you'd want -mcpu=... as well as -m64. But I haven't looked at the Sun C compiler options for some years.)

What version of the C compiler are you using? Note these comments in 10-main.conf:

# SC4.0 doesn't pass 'make test', upgrade to SC5.0 or SC4.2.
# SC4.2 is ok, better than gcc even on bn as long as you tell it -xarch=v8
# SC5.0 note: Compiler common patch 107357-01 or later is required!

Some people prefer to use gcc on Solaris for this reason.

--
Michael Wojcik
Distinguished Engineer, Micro Focus



Reply | Threaded
Open this post in threaded view
|

RE: building openssl 1.1.1 for Solaris 10

tim.j.culhane
Hi,

I'm using  gcc 4.9.2


So, should I just ignore that warning and let the gmake continue?

Tim


-----Original Message-----
From: openssl-users <[hidden email]> On Behalf Of Michael
Wojcik
Sent: Monday 6 April 2020 15:31
To: [hidden email]
Subject: RE: building openssl 1.1.1 for Solaris 10

> From: [hidden email] [mailto:[hidden email]]
> Sent: Monday, April 06, 2020 06:35
> To: Michael Wojcik; [hidden email]
> Subject: RE: building openssl 1.1.1 for Solaris 10
>
> Ok, attempting to build openssl 1.1.1e  now.
>
> As prompted by the config script  I'm  running Configure as  follows:
>
> ./Configure solaris64-sparcv9-cc --prefix=/opt/openssl/1.1.1
> --openssldir=/opt/openssl/1.1.1
>
> That completes successfully.  However, when I then run gmake I see  
> warnings like the below:
>
>
> cc: Warning: -xarch=v9 is deprecated, use -m64 to create 64-bit
> programs
>
> How can I configure the makefiles so they use  '-m64'.

As far as I know you can't, except by editing Configurations/10-main.conf
(one of the inputs to the Configure script). The -xarch=... flags are
hard-coded there.

Personally I wouldn't worry about it. -xarch is deprecated, but it still
works. (And -m64 is not, as I understand it, exactly equivalent to -xarch
anyway. I'm a bit suspicious of that warning from cc; I'd think you'd want
-mcpu=... as well as -m64. But I haven't looked at the Sun C compiler
options for some years.)

What version of the C compiler are you using? Note these comments in
10-main.conf:

# SC4.0 doesn't pass 'make test', upgrade to SC5.0 or SC4.2.
# SC4.2 is ok, better than gcc even on bn as long as you tell it -xarch=v8 #
SC5.0 note: Compiler common patch 107357-01 or later is required!

Some people prefer to use gcc on Solaris for this reason.

--
Michael Wojcik
Distinguished Engineer, Micro Focus




Reply | Threaded
Open this post in threaded view
|

RE: building openssl 1.1.1 for Solaris 10

Michael Wojcik
> From: [hidden email] [mailto:[hidden email]]
> Sent: Monday, April 06, 2020 09:15
>
> I'm using  gcc 4.9.2
>
>
> So, should I just ignore that warning and let the gmake continue?

Yes, that's what I would recommend. If it bugs you, you could always experiment with changing it, and if you find a version that works better you could submit a PR to the OpenSSL team; but everyone else seems to have decided to live with the warnings.

--
Michael Wojcik
Distinguished Engineer, Micro Focus



Reply | Threaded
Open this post in threaded view
|

RE: building openssl 1.1.1 for Solaris 10

tim.j.culhane
Hi again,

I ran the gmake  and it fails with the below  ld errors.

Is this the  known issue mentioned previously with building openssl on Sparc
or is it caused by something else?

Thanks,

Tim



${LDCMD:-cc} -xarch=v9 -xstrconst -Xa -xO5 -xdepend -m64 -L. -mt \
-o apps/openssl apps/asn1pars.o apps/ca.o apps/ciphers.o apps/cms.o
apps/crl.o apps/crl2p7.o apps/dgst.o apps/dhparam.o apps/dsa.o
apps/dsaparam.o
apps/ec.o apps/ecparam.o apps/enc.o apps/engine.o apps/errstr.o
apps/gendsa.o apps/genpkey.o apps/genrsa.o apps/nseq.o apps/ocsp.o
apps/openssl.o apps/pass
wd.o apps/pkcs12.o apps/pkcs7.o apps/pkcs8.o apps/pkey.o apps/pkeyparam.o
apps/pkeyutl.o apps/prime.o apps/rand.o apps/rehash.o apps/req.o apps/rsa.o
apps/
rsautl.o apps/s_client.o apps/s_server.o apps/s_time.o apps/sess_id.o
apps/smime.o apps/speed.o apps/spkac.o apps/srp.o apps/storeutl.o apps/ts.o
apps/veri
fy.o apps/version.o apps/x509.o \
apps/libapps.a -lssl -lcrypto -lsocket -lnsl -ldl -lpthread
cc: Warning: -xarch=v9 is deprecated, use -m64 to create 64-bit programs
ld: warning: relocation warning: R_SPARC_COPY: file ./libcrypto.so: symbol
PBE2PARAM_it: relocation bound to a symbol with STV_PROTECTED visibility
ld: warning: relocation warning: R_SPARC_COPY: file ./libcrypto.so: symbol
PBKDF2PARAM_it: relocation bound to a symbol with STV_PROTECTED visibility
ld: warning: relocation warning: R_SPARC_COPY: file ./libcrypto.so: symbol
SCRYPT_PARAMS_it: relocation bound to a symbol with STV_PROTECTED visibility
ld: warning: relocation warning: R_SPARC_COPY: file ./libcrypto.so: symbol
PBEPARAM_it: relocation bound to a symbol with STV_PROTECTED visibility
Undefined first referenced
symbol in file
clock_gettime ./libcrypto.so
ld: fatal: symbol referencing errors. No output written to apps/openssl
gmake[1]: *** [Makefile:2228: apps/openssl] Error 2

-----Original Message-----
From: openssl-users <[hidden email]> On Behalf Of Michael
Wojcik
Sent: Monday 6 April 2020 16:58
To: [hidden email]
Subject: RE: building openssl 1.1.1 for Solaris 10

> From: [hidden email] [mailto:[hidden email]]
> Sent: Monday, April 06, 2020 09:15
>
> I'm using  gcc 4.9.2
>
>
> So, should I just ignore that warning and let the gmake continue?

Yes, that's what I would recommend. If it bugs you, you could always
experiment with changing it, and if you find a version that works better you
could submit a PR to the OpenSSL team; but everyone else seems to have
decided to live with the warnings.

--
Michael Wojcik
Distinguished Engineer, Micro Focus




Reply | Threaded
Open this post in threaded view
|

RE: building openssl 1.1.1 for Solaris 10

Michael Wojcik
> From: [hidden email] [mailto:[hidden email]]
> Sent: Tuesday, April 07, 2020 01:25
>
> I ran the gmake  and it fails with the below  ld errors.
>
> Is this the  known issue mentioned previously with building openssl on Sparc
> or is it caused by something else?
>
> ...
>
> Undefined first referenced
> symbol in file
> clock_gettime ./libcrypto.so

It appears that's a known issue with building OpenSSL 1.1.1 on Solaris 10. (I think we haven't run into this in my team because we're now on Solaris 11, but I haven't investigated.)

Quanah Gibson-Mount mentioned this in a reply to your first post in this thread:

> They may have run into <https://github.com/openssl/openssl/issues/6333>
> which the OpenSSL project seems disinclined to fix.

If you look at that issue, you'll see people have posted workarounds. I believe it's just a matter of linking with an additional library.

--
Michael Wojcik
Distinguished Engineer, Micro Focus



Reply | Threaded
Open this post in threaded view
|

Re: building openssl 1.1.1 for Solaris 10

Jeff Wieland
In reply to this post by tim.j.culhane
Michael Wojcik wrote:

>> From: [hidden email] [mailto:[hidden email]]
>> Sent: Tuesday, April 07, 2020 01:25
>>
>> I ran the gmake  and it fails with the below  ld errors.
>>
>> Is this the  known issue mentioned previously with building openssl on Sparc
>> or is it caused by something else?
>>
>> ...
>>
>> Undefined first referenced
>> symbol in file
>> clock_gettime ./libcrypto.so
> It appears that's a known issue with building OpenSSL 1.1.1 on Solaris 10. (I think we haven't run into this in my team because we're now on Solaris 11, but I haven't investigated.)
>
> Quanah Gibson-Mount mentioned this in a reply to your first post in this thread:
>
>> They may have run into <https://github.com/openssl/openssl/issues/6333>
>> which the OpenSSL project seems disinclined to fix.
> If you look at that issue, you'll see people have posted workarounds. I believe it's just a matter of linking with an additional library.
>
> --
> Michael Wojcik
> Distinguished Engineer, Micro Focus
>
>
>

On Solaris 10, you need to link with -lrt to pick up the clock_gettime
functions.  If you do something like "export LDFLAGS='-lrt'" before you
invoke Configure, it should work.

--
Jeff Wieland, UNIX/Network Systems Administrator
Purdue University IT Infrastructure Services UNIX Platforms