File openssl-ibmca-README.patch of Package openssl-ibmca.2284
--- README.orig 2011-05-02 11:50:50.000000000 -0600 +++ README 2015-10-26 21:56:28.282437000 -0600 @@ -1,51 +1,36 @@ +openssl-ibmca 1.2.0 May 2011 - README for the OpenSSL 0.9.8 IBMCA engine +Description +=========== - Author: Mike Halcrow <mhalcrow@us.ibm.com> - Report bugs: opencryptoki-users@lists.sf.net +openssl-ibmca is an OpenSSL engine that uses the libica library under s390x +to accelerate cryptographic operations. +See the man page for more details: +$ man ibmca -ABOUT -This package contains the dynamic IBMCA engine. +Installation +============ -BUILDING +To install this package in Linux, please refer to the INSTALL file. - Requirements: OpenSSL 0.9.8, libICA - By default, the build will assume that you have a custom openssl installed -in /usr/local/ssl. +Source code +=========== - $ configure [--enable-debug] [--with-openssl=/path/to/custom/openssl] \ - [--with-engines-dir=/path/to/openssl/engines/directory] - $ make - # make install +Git repository: +git clone git://git.code.sf.net/p/opencryptoki/ibmca openssl-ibmca -Included in this package is a sample openssl.cnf file (openssl.cnf.sample), -which can be used to turn on use of the IBMCA engine in apps where OpenSSL -config support is compiled in. In order to enable the IBMCA engine, the -content from this file should be concatenated to the existing openssl.cnf file -on the host. -During the build process, the path to the engines/ directory is substituted in -for the dynamic_path parameter in the ibmca section. By default, this path to -the engines/ directory is relative to the OpenSSL installation target. With no -parameters passed to the ./configure script, this target is /usr/local/ssl, -and so the default entry in the sample openssl.cnf file is: +Support +======= -dynamic_path = /usr/local/ssl/lib/engines/libibmca.so +To report a bug please send an email to opencryptoki-users@lists.sf.net +including the following information in the email: -If OpenSSL is installed to a different location, then the --with-openssl= -option should be passed to the ./configure script. For instance, if ---with-openssl=/usr is given, then the entry in the sample openssl.cnf file -is: +* distro release +* openssl-ibmca release +* bug description +* steps to reproduce the bug -dynamic_path = /usr/lib/engines/libibmca.so - -If the OpenSSL engines directory is located elsewhere, then that location must -be specified in the --with-engines-dir= option. For instance, if the engines/ -directory is under /usr/lib64, then the ./configure script will need the -option --with-engines-dir=/usr/lib64/engines, which will produce this entry in -the sample openssl.cnf file: - -dynamic_path = /usr/lib64/engines/libibmca.so \ No newline at end of file --- AUTHORS.orig 2011-05-02 11:50:50.000000000 -0600 +++ AUTHORS 2015-10-26 21:56:13.976134000 -0600 @@ -1 +1 @@ - +Mike Halcrow <mhalcrow@us.ibm.com> --- INSTALL.orig 2011-05-02 11:50:50.000000000 -0600 +++ INSTALL 2015-10-26 21:57:39.457775000 -0600 @@ -1,182 +1,76 @@ -Basic Installation -================== - - These are generic installation instructions. - - The `configure' shell script attempts to guess correct values for -various system-dependent variables used during compilation. It uses -those values to create a `Makefile' in each directory of the package. -It may also create one or more `.h' files containing system-dependent -definitions. Finally, it creates a shell script `config.status' that -you can run in the future to recreate the current configuration, a file -`config.cache' that saves the results of its tests to speed up -reconfiguring, and a file `config.log' containing compiler output -(useful mainly for debugging `configure'). - - If you need to do unusual things to compile the package, please try -to figure out how `configure' could check whether to do them, and mail -diffs or instructions to the address given in the `README' so they can -be considered for the next release. If at some point `config.cache' -contains results you don't want to keep, you may remove or edit it. - - The file `configure.in' is used to create `configure' by a program -called `autoconf'. You only need `configure.in' if you want to change -it or regenerate `configure' using a newer version of `autoconf'. - -The simplest way to compile this package is: - - 1. `cd' to the directory containing the package's source code and type - `./configure' to configure the package for your system. If you're - using `csh' on an old version of System V, you might need to type - `sh ./configure' instead to prevent `csh' from trying to execute - `configure' itself. - - Running `configure' takes awhile. While running, it prints some - messages telling which features it is checking for. - - 2. Type `make' to compile the package. - - 3. Optionally, type `make check' to run any self-tests that come with - the package. - - 4. Type `make install' to install the programs and any data files and - documentation. - - 5. You can remove the program binaries and object files from the - source code directory by typing `make clean'. To also remove the - files that `configure' created (so you can compile the package for - a different kind of computer), type `make distclean'. There is - also a `make maintainer-clean' target, but that is intended mainly - for the package's developers. If you use it, you may have to get - all sorts of other programs in order to regenerate files that came - with the distribution. - -Compilers and Options +INSTALLATION ON LINUX ===================== - Some systems require unusual options for compilation or linking that -the `configure' script does not know about. You can give `configure' -initial values for variables by setting them in the environment. Using -a Bourne-compatible shell, you can do that on the command line like -this: - CC=c89 CFLAGS=-O2 LIBS=-lposix ./configure - -Or on systems that have the `env' program, you can do it like this: - env CPPFLAGS=-I/usr/local/include LDFLAGS=-s ./configure - -Compiling For Multiple Architectures -==================================== - - You can compile the package for more than one kind of computer at the -same time, by placing the object files for each architecture in their -own directory. To do this, you must use a version of `make' that -supports the `VPATH' variable, such as GNU `make'. `cd' to the -directory where you want the object files and executables to go and run -the `configure' script. `configure' automatically checks for the -source code in the directory that `configure' is in and in `..'. - - If you have to use a `make' that does not supports the `VPATH' -variable, you have to compile the package for one architecture at a time -in the source code directory. After you have installed the package for -one architecture, use `make distclean' before reconfiguring for another -architecture. +Requirements +============ -Installation Names -================== +The requirements below are verified by the configure script. - By default, `make install' will install the package's files in -`/usr/local/bin', `/usr/local/man', etc. You can specify an -installation prefix other than `/usr/local' by giving `configure' the -option `--prefix=PATH'. - - You can specify separate installation prefixes for -architecture-specific files and architecture-independent files. If you -give `configure' the option `--exec-prefix=PATH', the package will use -PATH as the prefix for installing programs and libraries. -Documentation and other data files will still use the regular prefix. - - In addition, if you use an unusual directory layout you can give -options like `--bindir=PATH' to specify different values for particular -kinds of files. Run `configure --help' for a list of the directories -you can set and what kinds of files go in them. - - If the package supports it, you can cause programs to be installed -with an extra prefix or suffix on their names by giving `configure' the -option `--program-prefix=PREFIX' or `--program-suffix=SUFFIX'. - -Optional Features -================= - - Some packages pay attention to `--enable-FEATURE' options to -`configure', where FEATURE indicates an optional part of the package. -They may also pay attention to `--with-PACKAGE' options, where PACKAGE -is something like `gnu-as' or `x' (for the X Window System). The -`README' should mention any `--enable-' and `--with-' options that the -package recognizes. - - For packages that use the X Window System, `configure' can usually -find the X include and library files automatically, but if it doesn't, -you can use the `configure' options `--x-includes=DIR' and -`--x-libraries=DIR' to specify their locations. - -Specifying the System Type -========================== - - There may be some features `configure' can not figure out -automatically, but needs to determine by the type of host the package -will run on. Usually `configure' can figure that out, but if it prints -a message saying it can not guess the host type, give it the -`--host=TYPE' option. TYPE can either be a short name for the system -type, such as `sun4', or a canonical name with three fields: - CPU-COMPANY-SYSTEM - -See the file `config.sub' for the possible values of each field. If -`config.sub' isn't included in this package, then this package doesn't -need to know the host type. - - If you are building compiler tools for cross-compiling, you can also -use the `--target=TYPE' option to select the type of system they will -produce code for and the `--build=TYPE' option to select the type of -system on which you are compiling the package. - -Sharing Defaults -================ - - If you want to set default values for `configure' scripts to share, -you can create a site shell script called `config.site' that gives -default values for variables like `CC', `cache_file', and `prefix'. -`configure' looks for `PREFIX/share/config.site' if it exists, then -`PREFIX/etc/config.site' if it exists. Or, you can set the -`CONFIG_SITE' environment variable to the location of the site script. -A warning: not all `configure' scripts look for a site script. +Build requirements: +* make +* an ANSI C compiler +* openssl >= 0.9.8 +* libica >= 2.4.0 + +Runtime requirements: +* openssl >= 0.9.8 +* libica >= 2.4.0 -Operation Controls -================== - `configure' recognizes the following options to control how it -operates. +Basic Installation +================== -`--cache-file=FILE' - Use and save the results of the tests in FILE instead of - `./config.cache'. Set FILE to `/dev/null' to disable caching, for - debugging `configure'. - -`--help' - Print a summary of the options to `configure', and exit. - -`--quiet' -`--silent' -`-q' - Do not print messages saying which checks are being made. To - suppress all normal output, redirect it to `/dev/null' (any error - messages will still be shown). - -`--srcdir=DIR' - Look for the package's source code in directory DIR. Usually - `configure' can determine that directory automatically. - -`--version' - Print the version of Autoconf used to generate the `configure' - script, and exit. +$ ./configure [--enable-debug] +$ make +$ make install + +This will configure, build and install the package in a default location, +which is /usr/local/lib. It means that the libibmca.so will be installed +in /usr/local/lib/libibmca.so by default. If you want to install it +anywhere else, run "configure" passing the new location via prefix +argument, for example:: + +$ ./configure --prefix=/usr/lib64/openssl/engines + + +Enabling IBMCA +============== + +Included in this package is a sample openssl.cnf file (openssl.cnf.sample), +which can be used to turn on use of the IBMCA engine in apps where OpenSSL +config support is compiled in. + +In order to enable IBMCA, use the following instructions to apply the +configurations from openssl.cnf.sample to the openssl.cnf file installed +in the host by the openssl package. WARNING: you may want to save the +original openssl.cnf file before changing it. + +1) In openssl.cnf.sample, the dynamic_path variable is set to the default +location, which is /usr/local/lib/libibmca.so. However, if the libibmca.so +library has been installed anywhere else, then update the dynamic_path +variable. + +2) Locate where the openssl.cnf file has been installed in the host (e.g. +rpm -ql openssl | grep openssl.cnf) and append the openssl.cnf.sample file +to it. + +$ cat openssl.cnf.sample >> /path/to/openssl.cnf + +3) In openssl.cnf, move the openssl_conf variable from the bottom to the +top of the file, such as in the example below: + +HOME = . +RANDFILE = $ENV::HOME/.rnd +openssl_conf = openssl_def + +4) Finally, check if the ibmca is now enabled. The command below +should return the ibmca engine and all the supported cryptographic methods. + +$ openssl engine -c +(dynamic) Dynamic engine loading support +(ibmca) Ibmca hardware engine support + [RAND, DES-ECB, DES-CBC, DES-OFB, DES-CFB, DES-EDE3, DES-EDE3-CBC, DES-EDE3-OFB, + DES-EDE3-CFB, AES-128-ECB, AES-192-ECB, AES-256-ECB, AES-128-CBC, AES-192-CBC, + AES-256-CBC, AES-128-OFB, AES-192-OFB, AES-256-OFB, AES-128-CFB, AES-192-CFB, + AES-256-CFB, SHA1, SHA256, SHA512] -`configure' also accepts some other, not widely useful, options.
