Makefile revision 364
25cc5fbba63f84b47e389af749f55abbbde71c8cChristian Maeder# CDDL HEADER START
25cc5fbba63f84b47e389af749f55abbbde71c8cChristian Maeder# The contents of this file are subject to the terms of the
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder# Common Development and Distribution License (the "License").
43b4c41fbb07705c9df321221ab9cb9832460407Christian Maeder# You may not use this file except in compliance with the License.
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder# or http://www.opensolaris.org/os/licensing.
43b4c41fbb07705c9df321221ab9cb9832460407Christian Maeder# See the License for the specific language governing permissions
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder# and limitations under the License.
f2f9df2e17e70674f0bf426ed1763c973ee4cde0Christian Maeder# When distributing Covered Code, include this CDDL HEADER in each
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder# If applicable, add the following below this CDDL HEADER, with the
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder# fields enclosed by brackets "[]" replaced with your own identifying
1aee4aaddde105264c1faf394d88e302c05094ffChristian Maeder# information: Portions Copyright [yyyy] [name of copyright owner]
a53841f6d6e86ac751c12a33dc8aadf53f59d977Klaus Luettich# CDDL HEADER END
a53841f6d6e86ac751c12a33dc8aadf53f59d977Klaus Luettich# Copyright (c) 2011, Oracle and/or its affiliates. All rights reserved.
01e383014b555bbcf639c0ca60c5810b3eff83c0Christian Maeder# This component is not to be installed. It is used from openssl-0.9.8-fips-140
3b06e23643a9f65390cb8c1caabe83fa7e87a708Till Mossakowski# to build FIPS-140 certified OpenSSL libraries.
1aee4aaddde105264c1faf394d88e302c05094ffChristian Maederinclude ../../../make-rules/shared-macros.mk
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian MaederCOMPONENT_SRC = $(COMPONENT_NAME)-$(COMPONENT_VERSION)
ac0bbbcb2774629bb87986e69cf53d3402c5f575Christian MaederCOMPONENT_ARCHIVE_HASH= sha1:f09c3040da6cdd8bdd8c9cf01af8f14f89ee84d1
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian MaederCOMPONENT_ARCHIVE_URL = http://www.openssl.org/source/$(COMPONENT_ARCHIVE)
c0c2380bced8159ff0297ece14eba948bd236471Christian Maeder# In order to build a 32bit version on a 64bit system the isalist(1) command
8410667510a76409aca9bb24ff0eda0420088274Christian Maeder# must be substituted for the 32bit build so that amd64|sparcv9 is not part of
6a79849bed67264c396dddb3e9c184bdfc1a1bc9Christian Maeder# its output. isalist is used internally when configuring the canister before
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder# building it. In order to allow make install to be run as a no-op we have to
8410667510a76409aca9bb24ff0eda0420088274Christian Maeder# fake "make install" since we do not want to install the files anywhere. The
404166b9366552e9ec5abb87a37c76ec8a815fb7Klaus Luettich# command sets U1 and U2 are defined in the FIPS 1.2 security policy and must be
b1f59a4ea7c96f4c03a4d7cfcb9c5e66871cfbbbChristian Maeder# run as shown there. Nothing from the tarball can be modified. We use the U2
3e61f574717499939bd8e0ff538ea9e7b72d4e2dKlaus Luettich# command set, see below.
8ef75f1cc0437656bf622cec5ac9e8ea221da8f2Christian MaederFAKE_APPS = $(FAKE_ISALIST) $(FAKE_MAKE) $(FAKE_CC)
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder# Do not use $(PWD), it would not work if run from a different directory with
356fa49fe3e6a8398f92d13e9f920d0f093697ecChristian Maeder# "gmake -C" as we do from openssl-0.9.8-fips-140.
8d97ef4f234681b11bb5924bd4d03adef858d2d2Christian MaederOPENSSL_FIPS_HMAC = 79193087e8115df76d3de1f346f7410df79cf6e0
e593b89bfd4952698dc37feced21cefe869d87a2Christian Maeder# There is a broken link in the tarball which causes cp(1) to fail which would
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder# fail the whole configure process. It's safer to get rid of the link than
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder# adding "true" at the end of COMPONENT_PRE_CONFIGURE_ACTION since that could
7cc09dd93962a2155c34d209d1d4cd7d7b838264Christian Maeder# hide real issues.
1aee4aaddde105264c1faf394d88e302c05094ffChristian MaederCOMPONENT_PRE_CONFIGURE_ACTION = ( cd $(@D); \
1aee4aaddde105264c1faf394d88e302c05094ffChristian Maeder $(RM) $(SOURCE_DIR)/test/fips_aes_data; $(CP) -r $(SOURCE_DIR)/* .; )
7cc09dd93962a2155c34d209d1d4cd7d7b838264Christian Maeder# There is a specific way that must be followed to build the FIPS-140 canister.
1aee4aaddde105264c1faf394d88e302c05094ffChristian Maeder# It is "./config fipscanisterbuild; make; make install" and is called a command
1aee4aaddde105264c1faf394d88e302c05094ffChristian Maeder# set "U2" in the OpenSSL FIPS-140 User Guide.
1aee4aaddde105264c1faf394d88e302c05094ffChristian MaederCONFIGURE_ENV += FIPS_SITE_LD=$(LD) PATH=$(FIPS_PATH_$(BITS))
356fa49fe3e6a8398f92d13e9f920d0f093697ecChristian MaederCOMPONENT_BUILD_ENV += FIPS_SITE_LD=$(LD) REALCC=$(CC) MYMAKE=$(MAKE)
356fa49fe3e6a8398f92d13e9f920d0f093697ecChristian Maeder# You should not use this target with this component unless testing or
0206ab93ef846e4e0885996d052b9b73b9dc66b0Christian Maeder# debugging. The OpenSSL FIPS-140 policy is strict and full U2 command set
f13d1e86e58da53680e78043e8df182eed867efbChristian Maeder# should be run. See above for more information.
757e6c79ec40491d45dc72c82b5eb59a386634b0Jian Chun Wang# We must make the "install" target a no-op (but must run it to be compliant).
757e6c79ec40491d45dc72c82b5eb59a386634b0Jian Chun Wang# See above for more information.
c6fcd42c6d6d9dae8c7835c24fcb7ce8531a9050Christian Maederinstall: $(BUILD_DIR_32)/.verified $(BUILD_DIR_64)/.verified
c55a0f77be7e88d3620b419ec8961f4379a586e3Klaus Luettich# This is a recommended set of commands to verify that the FIPS-140 mode can be
36f63902db2b3463faa9f59912ad106e2d5aaa24Klaus Luettich# used and that we used the correct tarball.
36f63902db2b3463faa9f59912ad106e2d5aaa24Klaus Luettich$(BUILD_DIR)/%/.verified: $(BUILD_DIR)/%/.installed
363939beade943a02b31004cea09dec34fa8a6d9Christian Maeder $(ENV) - OPENSSL_FIPS=1 LD_LIBRARY_PATH=$(@D) \
8cacad2a09782249243b80985f28e9387019fe40Christian Maeder $(@D)/apps/openssl sha1 -hmac $(OPENSSL_FIPS_HMAC_KEY) \
a7c27282e71cf4505026645f96d4f5cb8a284e32Christian Maeder $(NAWK) '{ if ($$2 != "$(OPENSSL_FIPS_HMAC)") exit 1 }'