IOS 模拟器在 OS-x 上编译 FIPS/Openssl 解决方案时出现 FIPS 签名不匹配
<p><p>我正在尝试在 <strong>IOS 模拟器</strong> 上获得 OpenSSL/FIPS 构建 fork 。我尝试过的每个组合都会产生编译/链接错误，或者在构建时我得到 FIPS 签名不匹配(我已经尝试了很多很多的脚本排列和设置组合)。</p>
<p>这是我正在使用的最新配置:
工具集:
XCODE V 5 .1
SDK 版本 7.1</p>
<p>对于 FIPS 模块，我使用的是基于用户手册附录 E 的脚本
对于 OpenSSL 构建，我使用的是基于 <a href="https://github.com/x2on/OpenSSL-for-iPhone" rel="noreferrer noopener nofollow">https://github.com/x2on/OpenSSL-for-iPhone</a> 的脚本。 </p>
<h2>FIPS 模块构建脚本:</h2>
<pre><code>gunzip openssl-fips-2.0.1.tar.gz
tar xf openssl-fips-2.0.1.tar
. setenv-reset.sh
. setenv-darwin-i386.sh
gunzip ios-incore-2.0.1.tar.gz
tar xf ios-incore-2.0.1.tar
cd openssl-fips-2.0.1
./config fipscanisterbuild
make
cd ios
make
cp ./incore_macho /usr/local/bin
cd ..
make clean
rm -f *.dylib
. ../setenv-reset.sh
. ../setenv-ios-11.sh
./config fipscanisterbuild
make
make install
Here are the Enviornment Variables
=========================
MACHINE =i386
RELEASE =
SYSTEM =iphoneos
BUILD =build
CROSS_TOP =/Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer
CROSS_SDK =iPhoneSimulator7.1.sdk
BUILD_TOOLS =
CC =
CROSS_TYPE =Simulator
CROSS_CHAIN =
C_INCLUDE_PATH =
CPLUS_INCLUDE_PATH =
HOSTCC =/usr/bin/cc
HOSTCFLAGS =-arch i386
CROSS_COMPILE =/Users/scoleman/dev/IOSFipsBuilds/iosFIPSUsersManual/dev925/openssl-fips-2.0.1/iOS/
FIPS_SIG =/Users/scoleman/dev/IOSFipsBuilds/iosFIPSUsersManual/dev925/openssl-fips-2.0.1/iOS/incore_macho
IOS_TARGET =darwin-iphoneos-cross
IOS_INSTALLDIR =/usr/local/ssl/Release-iphoneos
CONFIG_OPTIONS =no-asm no-shared --openssldir=/usr/local/ssl/Release-iphoneos
CROSS_ARCH =
CROSS_DEVELOPER =/Applications//Xcode.app/Contents/Developer
CROSS_SYSROOT =
IOS_TARGET =
</code></pre>
<h2>Openssl 模块构建脚本</h2>
<pre><code>VERSION="1.0.1i" #
SDKVERSION=`xcrun -sdk iphoneos --show-sdk-version` #
# Don't change anything under this line! #
CURRENTPATH=`pwd`
//ARCHS="i386 x86_64 armv7 armv7s arm64"
ARCHS="i386"
DEVELOPER=`xcode-select -print-path`
mkdir -p "${CURRENTPATH}/src"
mkdir -p "${CURRENTPATH}/bin"
mkdir -p "${CURRENTPATH}/lib"
tar zxf openssl-${VERSION}.tar.gz -C "${CURRENTPATH}/src"
cd "${CURRENTPATH}/src/openssl-${VERSION}"
for ARCH in ${ARCHS}
do
if [[ "${ARCH}" == "i386" || "${ARCH}" == "x86_64" ]];
then
PLATFORM="iPhoneSimulator"
else
sed -ie "s!static volatile sig_atomic_t intr_signal;!static volatile intr_signal;!" "crypto/ui/ui_openssl.c"
PLATFORM="iPhoneOS"
fi
export CROSS_TOP="${DEVELOPER}/Platforms/${PLATFORM}.platform/Developer"
export CROSS_SDK="${PLATFORM}${SDKVERSION}.sdk"
export BUILD_TOOLS="${DEVELOPER}"
export CC="${BUILD_TOOLS}/usr/bin/gcc -arch ${ARCH}"
mkdir -p "${CURRENTPATH}/bin/${PLATFORM}${SDKVERSION}-${ARCH}.sdk"
LOG="${CURRENTPATH}/bin/${PLATFORM}${SDKVERSION}-${ARCH}.sdk/build-openssl-${VERSION}.log"
set +e
if [[ "$VERSION" =~ 1.0.0. ]]; then
./Configure BSD-generic32 --openssldir="${CURRENTPATH}/bin/${PLATFORM}${SDKVERSION}-${ARCH}.sdk" > "${LOG}" 2>&1
elif [ "${ARCH}" == "x86_64" ]; then
./Configure darwin64-x86_64-cc --openssldir="${CURRENTPATH}/bin/${PLATFORM}${SDKVERSION}-${ARCH}.sdk" > "${LOG}" 2>&1
else
# - original line:./Configure iphoneos-cross --openssldir="${CURRENTPATH}/bin/${PLATFORM}${SDKVERSION}-${ARCH}.sdk" > "${LOG}" 2>&1
## this line was changed to add fips --with-fipsdir=/usr/local/ssl/Release-iphoneos
./Configure iphoneos-cross --openssldir="${CURRENTPATH}/bin/${PLATFORM}${SDKVERSION}-${ARCH}.sdk" fips --with-fipsdir=/usr/local/ssl/Release-iphoneos > "${LOG}" 2>&1
fi
if [ $? != 0 ];
then
echo "Problem while configure - Please check ${LOG}"
exit 1
fi
# add -isysroot to CC=
sed -ie "s!^CFLAG=!CFLAG=-isysroot ${CROSS_TOP}/SDKs/${CROSS_SDK} -miphoneos-version-min=7.0 !" "Makefile"
echo "PLATFORM = $PLATFORM"
echo "CROSS_TOP = $CROSS_TOP"
echo "CROSS_SDK = $CROSS_SDK"
echo "BUILD_TOOLS = $BUILD_TOOLS"
echo "-isysroot ${CROSS_TOP}/SDKs/${CROSS_SDK}"
echo "CC = $CC"
make >> "${LOG}" 2>&1
set -e
make install >> "${LOG}" 2>&1
make clean >> "${LOG}" 2>&1
done
echo "Build library..."
lipo -create ${CURRENTPATH}/bin/iPhoneSimulator${SDKVERSION}-i386.sdk/lib/libssl.a-output ${CURRENTPATH}/lib/libssl.a
lipo -create ${CURRENTPATH}/bin/iPhoneSimulator${SDKVERSION}-i386.sdk/lib/libcrypto.a-output ${CURRENTPATH}/lib/libcrypto.a
mkdir -p ${CURRENTPATH}/include
cp -R ${CURRENTPATH}/bin/iPhoneSimulator${SDKVERSION}-i386.sdk/include/openssl ${CURRENTPATH}/include/
echo "Building done."
echo "Cleaning up..."
rm -rf ${CURRENTPATH}/src/openssl-${VERSION}
echo "Done."
Here are the Environment Variables:
--------------------------
PLATFORM = iPhoneSimulator
CROSS_TOP = /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer
CROSS_SDK = iPhoneSimulator7.1.sdk
BUILD_TOOLS = /Applications/Xcode.app/Contents/Developer
-isysroot /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator7.1.sdk
CC = /Applications/Xcode.app/Contents/Developer/usr/bin/gcc -arch i386
</code></pre></p>
<br><hr><h1><strong>Best Answer-推荐答案</ strong></h1><br>
<p><blockquote>
<p>I'm trying to get a OpenSSL/FIPS build forking on the IOS simulator. Every combination I've tried gives wither compile/link errors, or when it does build I get a FIPS signature mismatch (and I've tried many, many permutations of scripts and combinations of settings).</p>
</blockquote>
<p>您好像少了一步。 <code>incore_macho</code> 对生成的二进制文件的调用在哪里？在这里，“生成的二进制文件”是您应用中的可执行文件。</p>
<p>在 OpenSSL 示例中，在 Taget 的 <strong><em>Build Phases</em></strong> 下有一个名为 <strong><em>Embed Fingerprint</em></strong> 的自定义构建步骤(它在项目级别不可用)。您可以在 <a href="https://www.openssl.org/docs/fips/UserGuide-2.0.pdf" rel="noreferrer noopener nofollow">OpenSSL User Guide 2.0 for the FIPS Object Module</a> 中找到示例, 附录 E.2。截图转载如下:</p>
<p> <img src="/image/4TT2I.png" alt="enter image description here"/> </p>
<p>您可能还会发现 <a href="https://github.com/noloader/incore_macho" rel="noreferrer noopener nofollow">this useful</a> .它是一个更新的 <code>incore_macho</code>，包括对 dylibs(用于越狱设备)和 ARM64 的支持。我很确定它包含 ARMv7s 支持。</p></p>
<p style="font-size: 20px;">关于IOS 模拟器在 OS-x 上编译 FIPS/Openssl 解决方案时出现 FIPS 签名不匹配，我们在Stack Overflow上找到一个类似的问题：
<a href="https://stackoverflow.com/questions/26068600/" rel="noreferrer noopener nofollow" style="color: red;">
https://stackoverflow.com/questions/26068600/
</a>
</p>
页:
[1]