From Fedora Project Wiki

< Changes

Revision as of 14:53, 6 March 2024 by Dbelyavs (talk | contribs) (Created page with "= Disable Openssl engine support = {{Change_Proposal_Banner}} == Summary == We disable support of engines in OpenSSL == Owner == <!-- For change proposals to qualify as self-contained, owners of all affected packages need to be included here. Alternatively, a SIG can be listed as an owner if it owns all affected packages. This should link to your home wiki page so we know who you are. --> * Name: Dmitry Belyavskiy * Email: dbelyavs@redhat.com <!-...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)

Disable Openssl engine support

Important.png
This is a proposed Change for Fedora Linux.
This document represents a proposed Change. As part of the Changes process, proposals are publicly announced in order to receive community feedback. This proposal will only be implemented if approved by the Fedora Engineering Steering Committee.

Summary

We disable support of engines in OpenSSL

Owner


Current status

  • Targeted release: Fedora Linux 41
  • Last updated: 2024-03-06
  • [<will be assigned by the Wrangler> devel thread]
  • FESCo issue: <will be assigned by the Wrangler>
  • Tracker bug: <will be assigned by the Wrangler>
  • Release notes tracker: <will be assigned by the Wrangler>

Detailed Description

We are going to build OpenSSL without engine support. Engines are not FIPS compatible and corresponding API is deprecated since OpenSSL 3.0. The engine functionality we are aware of (PKCS#11, TPM) is either covered by providers or will be covered soon.

Feedback

Benefit to Fedora

We get rid of deprecated functionality and enforce using up-to-date API. Engine support is deprecated in OpenSSL upstream, and after provider migration caused some deficiencies with engine support. No new features will be added to engine. So we reduce maintenance burden and potentially attack surface.

It follows approach planned for CentOS 10.

Scope

For most of the packages the maintainers will just have to rebuild their packages after the OpenSSL change lands in compose. For several packages some patches should be implemented to prevent compilation errors.

  • Other developers: -

This change probably requires mass-rebuild.

  • Policies and guidelines: We need reject/modify packages providing OpenSSL engines
  • Trademark approval: N/A (not needed for this Change)
  • Alignment with Community Initiatives:

Upgrade/compatibility impact

OpenSSL engines will no longer be supported. Engines will not be supported in openssl configuration files (presumably silently ignored). Users will have to reconfigure systems to providers if they use engines.


How To Test

OpenSSL libcrypto.so doesn't export any ENGINE_* symbols (~120 lines). Application is normally built.



User Experience

Users will have to reconfigure systems to providers if they use engines. No other changes are expected.

Dependencies

In theory, all OpenSSL-dependent packages. In practice, only those that explicitly use ENGINE api.


Contingency Plan

Reenable engine support but remove engine header file to allow old applications work preventing appearing new ones.

  • Contingency mechanism: (What to do? Who will do it?) rebuild OpenSSL and dependent packages
  • Contingency deadline: beta freeze?
  • Blocks release? Yes


Documentation

TBD


Release Notes

TBD