Skip to content

Make the Makefile more robust #267

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jbdelcuv merged 3 commits into from
Oct 17, 2025
Merged

Make the Makefile more robust #267

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1a8ec38
Update Makefile to execute recipes only when OpenSSL tarball and/or
jbdelcuv Oct 17, 2025
0795718
Stop downloading OpenSSL 3.1.6 now that the Makefile has been properly
jbdelcuv Oct 17, 2025
04a0b9f
Define OSSL_FIPS_SOURCE_DIR_SET to enable the clean_dirs target.
jbdelcuv Oct 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,7 +70,6 @@ jobs:
wget https://download.01.org/intel-sgx/sgx-linux/2.26/distro/ubuntu22.04-server/sgx_linux_x64_sdk_2.26.100.0.bin;
chmod +x *.bin; echo yes | ./sgx_linux_x64_sdk_2.*.bin;
wget https://www.openssl.org/source/openssl-3.0.17.tar.gz --directory-prefix=openssl_source/;
wget https://www.openssl.org/source/openssl-3.1.6.tar.gz --directory-prefix=openssl_source/;
source sgxsdk/environment; cd Linux; make sgxssl_no_mitigation
- name: Perform CodeQL Analysis
Expand Down
24 changes: 18 additions & 6 deletions openssl_source/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,13 +37,19 @@ FIPSMODULE:=fips.so
FIPSMODULECONF:=fipsmodule.cnf
LIBDIR := lib64

OPENSSL_VERSION := $(shell ls *3.1.*.tar.gz | head -1 | grep -o '[^/]*$$' | sed -s -- 's/\.tar\.gz//')
OSSL_FIPS_SOURCE_DIR := $(CURDIR)/$(OPENSSL_VERSION)-source-fips
OSSL_FIPS_INSTALL_DIR := $(CURDIR)/$(OPENSSL_VERSION)-install-fips
OSSL_FIPS_BUILD_DIR := $(CURDIR)/$(OPENSSL_VERSION)-build-fips
OPENSSL_VERSION := $(shell ls *3.1.*.tar.gz 2>/dev/null | sort -V | tail -1 | sed -s -- 's/\.tar\.gz$$//')
ifeq ($(OPENSSL_VERSION),)
$(info No matching OpenSSL 3.1 tarball found for FIPS provider support.)
else
$(info Found OpenSSL version $(OPENSSL_VERSION) for FIPS provider support.)
OSSL_FIPS_SOURCE_DIR := $(CURDIR)/$(OPENSSL_VERSION)-source-fips
OSSL_FIPS_BUILD_DIR := $(CURDIR)/$(OPENSSL_VERSION)-build-fips
OSSL_FIPS_INSTALL_DIR := $(CURDIR)/$(OPENSSL_VERSION)-install-fips
OSSL_FIPS_SOURCE_DIR_SET = $(shell test -d $(OSSL_FIPS_SOURCE_DIR) && echo 1 || echo 0)
OSSL_FIPS_BUILD_DIR_SET = $(shell test -d $(OSSL_FIPS_BUILD_DIR) && echo 1 || echo 0)
OSSL_FIPS_INSTALL_DIR_SET = $(shell test -d $(OSSL_FIPS_INSTALL_DIR) && echo 1 || echo 0)
endif

OSSL_FIPS_BUILD_DIR_SET := $(shell test -d $(OSSL_FIPS_BUILD_DIR) && echo 1 || echo 0)
OSSL_FIPS_INSTALL_DIR_SET := $(shell test -d $(OSSL_FIPS_INSTALL_DIR) && echo 1 || echo 0)

BUILD_TARGET = fips

Expand All @@ -55,6 +61,7 @@ fips:
@echo OSSL_FIPS_SOURCE_DIR is $(OSSL_FIPS_SOURCE_DIR)
@echo OSSL_FIPS_INSTALL_DIR is $(OSSL_FIPS_INSTALL_DIR)
@echo OSSL_FIPS_BUILD_DIR is $(OSSL_FIPS_BUILD_DIR)
ifneq ($(OPENSSL_VERSION),)
rm -rf $(OSSL_FIPS_SOURCE_DIR)/
rm -rf $(OSSL_FIPS_INSTALL_DIR)/
rm -rf $(OSSL_FIPS_BUILD_DIR)/
Expand All @@ -64,6 +71,7 @@ fips:
tar xvf $(OPENSSL_VERSION).tar.gz -C $(OSSL_FIPS_SOURCE_DIR) --strip-components=1 > /dev/null
cd $(OSSL_FIPS_BUILD_DIR) && $(OSSL_FIPS_SOURCE_DIR)/Configure enable-fips --with-rand-seed=rdcpu --prefix=$(OSSL_FIPS_INSTALL_DIR) && \
$(MAKE) -j$(shell getconf _NPROCESSORS_ONLN) && $(MAKE) install_fips
endif

# Install the FIPS provider and its configuration file in the SGX SDK location
install:
Expand All @@ -83,13 +91,15 @@ endif

# Remove the FIPS provider and configuration file from the SGX SDK location
uninstall:
ifeq ($(OSSL_FIPS_INSTALL_DIR_SET), 1)
@echo "*** Uninstalling FIPS module"
@echo "uninstall $(SGX_SDK)/$(LIBDIR)/$(FIPSMODULE)"
rm -f $(SGX_SDK)/$(LIBDIR)/$(FIPSMODULE)

@echo "*** Uninstalling FIPS module configuration"
@echo "uninstall $(SGX_SDK)/$(LIBDIR)/$(FIPSMODULECONF)"
rm -f $(SGX_SDK)/$(LIBDIR)/$(FIPSMODULECONF)
endif

clean:
ifeq ($(OSSL_FIPS_BUILD_DIR_SET), 1)
Expand All @@ -98,8 +108,10 @@ ifeq ($(OSSL_FIPS_BUILD_DIR_SET), 1)
endif

clean_dirs:
ifeq ($(OSSL_FIPS_SOURCE_DIR_SET), 1)
@rm -rf $(OSSL_FIPS_SOURCE_DIR)/
@rm -rf $(OSSL_FIPS_INSTALL_DIR)/
@rm -rf $(OSSL_FIPS_BUILD_DIR)/
endif
Comment on lines +111 to +115
Copy link

Copilot AI Oct 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The conditional check uses OSSL_FIPS_SOURCE_DIR_SET which is never defined in the code. This variable is not set anywhere in the Makefile, so the condition will always be false. The check should likely use OSSL_FIPS_BUILD_DIR_SET or OSSL_FIPS_INSTALL_DIR_SET instead, or a new variable OSSL_FIPS_SOURCE_DIR_SET should be defined similar to lines 48-49.

Copilot uses AI. Check for mistakes.
Copy link
Contributor Author

@jbdelcuv jbdelcuv Oct 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You're right. Initially, I was planning to use one of the defined variables OSSL_FIPS_BUILD_DIR_SET or OSSL_FIPS_INSTALL_DIR_SET. However, since I'm using OSSL_FIPS_SOURCE_DIR_SET, I pushed a commit that defines it.


clean_all: clean clean_dirs
Loading