Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:18 as permitted sender) client-ip=2620:137:e000::1:18;
Date:   Wed, 2 Mar 2022 12:52:02 -0800
From:   Kees Cook <keescook@chromium.org>
To:     Lee Jones <lee.jones@linaro.org>
Cc:     Eric Biggers <ebiggers@kernel.org>, Adam Langley <agl@google.com>,
        linux-kernel@vger.kernel.org, David Howells <dhowells@redhat.com>,
        David Woodhouse <dwmw2@infradead.org>, keyrings@vger.kernel.org
Subject: Re: [PATCH 1/1] sign-file: Use OpenSSL provided define to compile
 out deprecated APIs
Message-ID: <202203021251.1DB0383C@keescook>
References: <20211005161833.1522737-1-lee.jones@linaro.org>
 <YVyE3Ax1PRtiBwf+@gmail.com>
 <CAL9PXLws4DjvPB=1KNpom3W52pXNauXQ4V==MprDx73YQ1-sgg@mail.gmail.com>
 <YVyKc51r2tfMmQuO@gmail.com>
 <YVyVNkijABL7CxnM@google.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <YVyVNkijABL7CxnM@google.com>
Precedence: bulk

On Tue, Oct 05, 2021 at 07:11:02PM +0100, Lee Jones wrote:
> On Tue, 05 Oct 2021, Eric Biggers wrote:
> 
> > On Tue, Oct 05, 2021 at 10:14:58AM -0700, Adam Langley wrote:
> > > On Tue, Oct 5, 2021 at 10:01 AM Eric Biggers <ebiggers@kernel.org> wrote:
> > > > I ran into these same -Wdeprecated-declarations compiler warnings on another
> > > > project that uses the ENGINE API to access OpenSSL's support for PKCS#11 tokens.
> > > > The conclusion was that in OpenSSL 3.0, the new API for PKCS#11 support isn't
> > > > actually ready yet, so we had to keep using the ENGINE API and just add
> > > > -Wno-deprecated-declarations to the compiler flags.
> > > >
> > > > Your patch just removes support for PKCS#11 in that case, which seems
> > > > undesirable.  (Unless no one is actually using it?)
> > > 
> > > The patch removes support when OPENSSL_NO_ENGINE is defined, but
> > > that's not defined by default in OpenSSL 3.0. (Unless something
> > > changed recently.)
> > > 
> > > When OPENSSL_NO_ENGINE is defined, ENGINE support is not compiled into
> > > OpenSSL and the headers don't include the functions:
> > > https://github.com/openssl/openssl/blob/master/include/openssl/engine.h
> > > .
> > 
> > Okay so this patch is actually a build fix for when OpenSSL doesn't include
> > ENGINE support?
> 
> Correct.
> 
> > Currently this patch claims that it's removing the use of a
> > "deprecated" API, which is something entirely different.
> 
> I see your point.
> 
> Happy to rejig the commit message if that would help.

*thread necromancy*

Hi,

These warnings are quite noisy on Fedora rawhide and other distros that
have moved to OpenSSL 3.0. It's not clear to me from this thread if this
patch is actually the correct fix?

-Kees

-- 
Kees Cook