1805215 - Require openssl >= 1.1.1e in the openpgp.configure

Status: RESOLVED FIXED

(MailNews Core :: Security: OpenPGP, defect)

Description

[Jan Horak [:jhorak]]

The EVP_PKEY_CTX_set_dsa_paramgen_q_bits not declared while building comm/third_party/rnp/src/lib/crypto/dsa_ossl.cpp. It seems to appear in 1.1.1e and later: https://github.com/nodejs/node/pull/44561 so we probably need to specify the 'e' version for the pkg-config too.

Comment 1

[Jan Horak [:jhorak]]

Attachment: Bug 1805215 - Require openssl >= 1.1.1e. r=kaie

The EVP_PKEY_CTX_set_dsa_paramgen_q_bits is declared only in >= 1.1.1e.

Comment 2

[Nickolay Olshevsky]

Thanks for spotting this, created issue on RNP side as well: https://github.com/rnpgp/rnp/issues/1951
Jan, could you please specify which systems ship pre-1.1.1e (but 1.1.1) OpenSSL? I.e. does it make sense to workaround this in any way?

Comment 3

[Kai Engert [:KaiE:]]

Fine with me, but we should make Rob aware!

Comment 4

[Kai Engert [:KaiE:]]

Rob, is this safe to apply?

Comment 5

[Rob Lemley [:rjl]]

feedback+ with the changes I added.

Thanks for catching that Jan!

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/59ec68eaede3
Require openssl >= 1.1.1e. r=kaie

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/62e4325b05cb
follow-up, fix linting. rs=black-lint DONTBUILD

Comment 8

[Rob Lemley [:rjl]]

Comment on attachment 9307838 [details]
Bug 1805215 - Require openssl >= 1.1.1e. r=kaie

[Approval Request Comment]
Regression caused by (bug #): N/A
User impact if declined: Probably not
Testing completed (on c-c, etc.): local build testing on c-c
Risk to taking this patch (and alternatives if risky): Low risk. Official builds do not build librnp against OpenSSL. This is a correctness fix that simply sets the required version correctly at configure time.

Comment 9

[Wayne Mery (:wsmwk)]

Comment on attachment 9307838 [details]
Bug 1805215 - Require openssl >= 1.1.1e. r=kaie

[Triage Comment]
Approved for beta

Comment 10

[Daniel Darnell [:dandarnell]]

Thunderbird 109.0b2:
https://hg.mozilla.org/releases/comm-beta/rev/0827ef4fdc47
https://hg.mozilla.org/releases/comm-beta/rev/c692b73d66cf

Comment 11

[Rob Lemley [:rjl]]

If bug 1799123 is uplifted, this must go with it.

Comment 12

[Rob Lemley [:rjl]]

Comment on attachment 9307838 [details]
Bug 1805215 - Require openssl >= 1.1.1e. r=kaie

[Approval Request Comment]
Regression caused by (bug #): 1799123
User impact if declined: N/A
Testing completed (on c-c, etc.): beta
Risk to taking this patch (and alternatives if risky):
Goes with bug 1799123 to fix a version check error at build time. Does not affect official builds.

Comment 13

[Wayne Mery (:wsmwk)]

Comment on attachment 9307838 [details]
Bug 1805215 - Require openssl >= 1.1.1e. r=kaie

[Triage Comment]
Approved for esr102

Comment 14

[Rob Lemley [:rjl]]

Thunderbird 102.8.0:
https://hg.mozilla.org/releases/comm-esr102/rev/92843bcad160
https://hg.mozilla.org/releases/comm-esr102/rev/216a382d66f1