Question

我试图在 IOS模拟器上获得OpenSSL / FIPS构建分支。我尝试过的每一个组合都会产生编译/链接错误，或者当它构建时我会得到FIPS签名不匹配（我已经尝试了很多很多脚本和设置组合）。

这是我使用的最新配置：工具套装： XCODE V 5 .1 SDK版本7.1

对于FIPS模块，我使用基于用户手册附录E的脚本对于OpenSSL构建，我使用基于https://github.com/x2on/OpenSSL-for-iPhone

的脚本

FIPS模块构建脚本：

gunzip openssl-fips-2.0.1.tar.gz
tar xf openssl-fips-2.0.1.tar

. setenv-reset.sh
. setenv-darwin-i386.sh

gunzip ios-incore-2.0.1.tar.gz
tar xf ios-incore-2.0.1.tar

cd openssl-fips-2.0.1
./config fipscanisterbuild

make
cd ios
make

cp ./incore_macho /usr/local/bin

cd ..

make clean
rm -f *.dylib

. ../setenv-reset.sh
. ../setenv-ios-11.sh


./config fipscanisterbuild
 make
make install


Here are the Enviornment Variables
=========================
MACHINE =  i386
RELEASE = 
SYSTEM =  iphoneos
BUILD =  build
CROSS_TOP =  /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer
CROSS_SDK =  iPhoneSimulator7.1.sdk
BUILD_TOOLS = 
CC = 
CROSS_TYPE =  Simulator
CROSS_CHAIN = 
C_INCLUDE_PATH = 
CPLUS_INCLUDE_PATH = 
HOSTCC =  /usr/bin/cc
HOSTCFLAGS =  -arch i386
CROSS_COMPILE =  /Users/scoleman/dev/IOSFipsBuilds/iosFIPSUsersManual/dev925/openssl-fips-2.0.1/iOS/
FIPS_SIG =  /Users/scoleman/dev/IOSFipsBuilds/iosFIPSUsersManual/dev925/openssl-fips-2.0.1/iOS/incore_macho
IOS_TARGET =  darwin-iphoneos-cross
IOS_INSTALLDIR =  /usr/local/ssl/Release-iphoneos
CONFIG_OPTIONS =  no-asm no-shared --openssldir=/usr/local/ssl/Release-iphoneos
CROSS_ARCH = 
CROSS_DEVELOPER =  /Applications//Xcode.app/Contents/Developer
CROSS_SYSROOT = 
IOS_TARGET =

Openssl模块构建脚本

VERSION="1.0.1i"                                                          #
SDKVERSION=`xcrun -sdk iphoneos --show-sdk-version`                       #

# Don't change anything under this line!                                  #


CURRENTPATH=`pwd`
//ARCHS="i386 x86_64 armv7 armv7s arm64"
ARCHS="i386"
DEVELOPER=`xcode-select -print-path`

mkdir -p "${CURRENTPATH}/src"
mkdir -p "${CURRENTPATH}/bin"
mkdir -p "${CURRENTPATH}/lib"

tar zxf openssl-${VERSION}.tar.gz -C "${CURRENTPATH}/src"
cd "${CURRENTPATH}/src/openssl-${VERSION}"


for ARCH in ${ARCHS}
do
    if [[ "${ARCH}" == "i386" || "${ARCH}" == "x86_64" ]];
    then
        PLATFORM="iPhoneSimulator"
    else
        sed -ie "s!static volatile sig_atomic_t intr_signal;!static volatile intr_signal;!" "crypto/ui/ui_openssl.c"
        PLATFORM="iPhoneOS"
    fi

    export CROSS_TOP="${DEVELOPER}/Platforms/${PLATFORM}.platform/Developer"
    export CROSS_SDK="${PLATFORM}${SDKVERSION}.sdk"
    export BUILD_TOOLS="${DEVELOPER}"

    export CC="${BUILD_TOOLS}/usr/bin/gcc -arch ${ARCH}"
    mkdir -p "${CURRENTPATH}/bin/${PLATFORM}${SDKVERSION}-${ARCH}.sdk"
    LOG="${CURRENTPATH}/bin/${PLATFORM}${SDKVERSION}-${ARCH}.sdk/build-openssl-${VERSION}.log"

    set +e
    if [[ "$VERSION" =~ 1.0.0. ]]; then
        ./Configure BSD-generic32 --openssldir="${CURRENTPATH}/bin/${PLATFORM}${SDKVERSION}-${ARCH}.sdk" > "${LOG}" 2>&1
    elif [ "${ARCH}" == "x86_64" ]; then
        ./Configure darwin64-x86_64-cc --openssldir="${CURRENTPATH}/bin/${PLATFORM}${SDKVERSION}-${ARCH}.sdk" > "${LOG}" 2>&1
    else
            # - original line:  ./Configure iphoneos-cross --openssldir="${CURRENTPATH}/bin/${PLATFORM}${SDKVERSION}-${ARCH}.sdk" > "${LOG}" 2>&1
        ## this line was changed to add fips --with-fipsdir=/usr/local/ssl/Release-iphoneos
        ./Configure iphoneos-cross --openssldir="${CURRENTPATH}/bin/${PLATFORM}${SDKVERSION}-${ARCH}.sdk" fips --with-fipsdir=/usr/local/ssl/Release-iphoneos > "${LOG}" 2>&1

    fi

    if [ $? != 0 ];
    then 
        echo "Problem while configure - Please check ${LOG}"
        exit 1
    fi

    # add -isysroot to CC=
    sed -ie "s!^CFLAG=!CFLAG=-isysroot ${CROSS_TOP}/SDKs/${CROSS_SDK} -miphoneos-version-min=7.0 !" "Makefile"


    echo "PLATFORM = $PLATFORM"
    echo "CROSS_TOP = $CROSS_TOP"
    echo "CROSS_SDK = $CROSS_SDK"
    echo "BUILD_TOOLS = $BUILD_TOOLS"
    echo "-isysroot ${CROSS_TOP}/SDKs/${CROSS_SDK}"
    echo "CC = $CC"




        make >> "${LOG}" 2>&1


    set -e
    make install >> "${LOG}" 2>&1
    make clean >> "${LOG}" 2>&1
done

echo "Build library..."
lipo -create ${CURRENTPATH}/bin/iPhoneSimulator${SDKVERSION}-i386.sdk/lib/libssl.a  -output ${CURRENTPATH}/lib/libssl.a

lipo -create ${CURRENTPATH}/bin/iPhoneSimulator${SDKVERSION}-i386.sdk/lib/libcrypto.a  -output ${CURRENTPATH}/lib/libcrypto.a

mkdir -p ${CURRENTPATH}/include
cp -R ${CURRENTPATH}/bin/iPhoneSimulator${SDKVERSION}-i386.sdk/include/openssl ${CURRENTPATH}/include/
echo "Building done."
echo "Cleaning up..."
rm -rf ${CURRENTPATH}/src/openssl-${VERSION}
echo "Done."



Here are the Environment Variables:
--------------------------
PLATFORM = iPhoneSimulator
CROSS_TOP = /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer
CROSS_SDK = iPhoneSimulator7.1.sdk
BUILD_TOOLS = /Applications/Xcode.app/Contents/Developer
-isysroot /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator7.1.sdk
CC = /Applications/Xcode.app/Contents/Developer/usr/bin/gcc -arch i386

Answer 1

我试图在IOS模拟器上获得OpenSSL / FIPS构建分支。我尝试过的每一个组合都会产生编译/链接错误，或者当它构建时我会得到FIPS签名不匹配（我已经尝试了很多很多脚本和设置组合）。

看起来你错过了一步。在生成的二进制文件上调用incore_macho在哪里？在这里，＆＃34;产生二进制＆＃34;是您应用中的可执行文件。

在OpenSSL示例中，Taget Build Phases 下有一个名为 嵌入指纹 的自定义构建步骤（在项目级别不可用）。您可以在OpenSSL User Guide 2.0 for the FIPS Object Module附录E.2中找到该示例。屏幕截图如下：

enter image description here

您可能还会找到this useful。它是一个更新的incore_macho，包括对dylib（用于监狱设备）和ARM64的支持。我非常确定它包含ARMv7s支持。

在OS-x上编译FIPS / Openssl解决方案时，IOS模拟器获得FIPS签名不匹配

FIPS模块构建脚本：

Openssl模块构建脚本

1 个答案: