Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Subject: Re: [PATCH v2 1/1] sign-file: Do not attempt to use the ENGINE_* API
 if it's not available
To:     Lee Jones <lee.jones@linaro.org>,
        Salvatore Bonaccorso <carnil@debian.org>
Cc:     Kees Cook <keescook@chromium.org>,
        David Howells <dhowells@redhat.com>,
        David Woodhouse <dwmw2@infradead.org>,
        keyrings@vger.kernel.org, Adam Langley <agl@google.com>,
        linux-kernel@vger.kernel.org, Eric Biggers <ebiggers@kernel.org>,
        Shuah Khan <skhan@linuxfoundation.org>
References: <20211005161833.1522737-1-lee.jones@linaro.org>
 <Yicwb+Ceiu8JjVIS@google.com> <202203100851.C00D9AB73@keescook>
 <YoCoySEUSzu9zthg@eldamar.lan> <YoDKiAfcFiyFRyQT@google.com>
From:   Shuah Khan <skhan@linuxfoundation.org>
Message-ID: <f3ca4041-df33-493e-96a9-4bf40498ebff@linuxfoundation.org>
Date:   Mon, 16 May 2022 09:39:07 -0600
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
 Thunderbird/78.8.1
MIME-Version: 1.0
In-Reply-To: <YoDKiAfcFiyFRyQT@google.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 5/15/22 3:40 AM, Lee Jones wrote:
> On Sun, 15 May 2022, Salvatore Bonaccorso wrote:
> 
>> Hi,
>>
>> On Thu, Mar 10, 2022 at 08:51:56AM -0800, Kees Cook wrote:
>>> On Tue, Mar 08, 2022 at 10:31:11AM +0000, Lee Jones wrote:
>>>> OpenSSL's ENGINE API is deprecated in OpenSSL v3.0.
>>>>
>>>> Use OPENSSL_NO_ENGINE to ensure the ENGINE API is only used if it is
>>>> present.  This will safeguard against compile errors when using SSL
>>>> implementations which lack support for this deprecated API.
>>>
>>> On Fedora rawhide, I'm still seeing a bunch of warnings:
>>>
>>> scripts/sign-file.c: In function 'display_openssl_errors':
>>> scripts/sign-file.c:89:9: warning: 'ERR_get_error_line' is deprecated: Since OpenSSL 3.0 [-Wdeprecat
>>> ed-declarations]
>>>     89 |         while ((e = ERR_get_error_line(&file, &line))) {
>>>        |         ^~~~~
>>> In file included from scripts/sign-file.c:29:
>>> /usr/include/openssl/err.h:411:15: note: declared here
>>>    411 | unsigned long ERR_get_error_line(const char **file, int *line);
>>>        |               ^~~~~~~~~~~~~~~~~~
>>> scripts/sign-file.c: In function 'drain_openssl_errors':
>>> scripts/sign-file.c:102:9: warning: 'ERR_get_error_line' is deprecated: Since OpenSSL 3.0 [-Wdepreca
>>> ted-declarations]
>>>    102 |         while (ERR_get_error_line(&file, &line)) {}
>>>        |         ^~~~~
>>> /usr/include/openssl/err.h:411:15: note: declared here
>>>    411 | unsigned long ERR_get_error_line(const char **file, int *line);
>>>        |               ^~~~~~~~~~~~~~~~~~
>>
>> FWIW, we are seeing the same now on Debian as Debian unstable is
>> moving to OpenSSL 3.0.
>>
>> https://lists.debian.org/debian-release/2022/05/msg00070.html
> 
> Did this patch help?
> 
> We've had a few confirmed reports now.
> 
> My guess is the maintainers are not currently monitoring.
> 
> With some more {Reviewed,Tested}-bys I'd be prepared to submit this
> via other means.  Either via my own repository or via Greg's.
> 
  
I am seeing the same issue on my test system after upgrading to
Ubuntu 22.04 LTS. This patch didn't fix the problem.

Please cc me on your future patches and I can test them.

thanks,
-- Shuah