]> code.ossystems Code Review - openembedded-core.git/commit
ca-certificates: Fix openssl runtime cert dependencies
authorKhem Raj <raj.khem@gmail.com>
Sun, 18 Apr 2021 22:53:10 +0000 (15:53 -0700)
committerAnuj Mittal <anuj.mittal@intel.com>
Fri, 23 Apr 2021 15:20:01 +0000 (23:20 +0800)
commitb2a233c9c5fb919d6507683bdf27a4435a2b5285
tree3876c0fe71a2c2864a1b7fe4449c3c79b96199d2
parente9693b562a46c0e019d05e01174e7f8c8e13b6e3
ca-certificates: Fix openssl runtime cert dependencies

With commit dc778c70449ee5401b5a24ad18b22b88338c47c5, dependency was
moved to openssl-bin which in itself was a fine change, but dropping
dependency on openssl too should have been kept along, dropping this
meant that openssl binary wont be able to validate secure connections as
the CApath files wont be installed, which infact are required for
openssl bins to work, following call e.g. fails

$ openssl s_client -connect google.com:443

....
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 256 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 20 (unable to get local issuer certificate)
....

The local issuer certs are not found in default location
/usr/lib/ssh-1.1/certs, this dir and its content is installed by openssl package
therefore re-add the dependency on openssl

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Cc: Andrei Gherzan <andrei@gherzan.ro>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit eaf377315efc73d6ffe361372a873918b3bb3bf5)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
meta/recipes-support/ca-certificates/ca-certificates_20210119.bb