Rebuilding openssl with Elliptic Curves on CentOS 6.4

The strategy is:

1) Download the "official" CentOS source package (.src.rpm)
2) Modify the .spec file to enable elliptic curves. (change no-EC to enable-EC)
3) Rebuild the package using mock. 

The build is performed on a fresh Amazon Cloud server which allows anyone to precisely duplicate every step that is taken below.

# 1. Log into AWS (Amazon Web Services) and create a public key. 
# 2. Download your public key and install into your local client e.g. putty or ssh.
# 3. Instantiate a CentOS 6.4 machine using AWS marketplace for machine images. (free)
# 4. Log into your new Centos 6.4 using ssh or putty, update and install a few packages:

Update the newly installed Centos and install development tools

yum -y update  # Update all packages on a new machine
yum -y groupinstall 'Development tools'

Install mock, a super package builder, from the Fedora EPEL repository. Mock is the secret weapon of CentOS (and many other distros) package builders.

yum -y localinstall --nogpgcheck http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm # Install EPEL (EL6 extra packages) repository 
yum -y install fedora-packager  # Install mock from EPEL repository

Make a new user "abcd" added to group "mock". User abcd will be used for package rebuilding. Note: group "mock" was automatically created by yum when we installed fedora-packager.

userdel -rf abcd ; useradd -G mock abcd ; su abcd

Fetch the latest CentOS openssl source package and "unpack" it with mock

cd ~ ; curl -O http://vault.centos.org/6.4/os/Source/SPackages/openssl-1.0.0-27.el6.src.rpm
/usr/bin/mock --rebuild ~/openssl-1.0.0-27.el6.src.rpm

We see output lines like this

# INFO: mock.py version 1.1.32 starting...
# Start: build setup for openssl-1.0.0-27.el6.src.rpm
# Start: rpmbuild -bb openssl-1.0.0-27.el6.src.rpm
# Start: Outputting list of installed packages

Finally, after a long time, we see

# INFO: Results and/or logs in: /var/lib/mock/epel-6-x86_64/result

Move the mock build results to a safe place

rm -rf /home/abcd/build ; mv /var/lib/mock/epel-6-x86_64/root/builddir/build/ /home/abcd ; # Move to a safe place

Download a replacement source file (.tar.gz) and a patch file from openssl.org

cd /home/abcd/build/SOURCES
curl -O http://www.openssl.org/source/openssl-1.0.0.tar.gz # Download corresponding source tarball from openssl
curl -o patch300.patch http://cvs.openssl.org/patchset?cn=19998 # Download this patch to fix a test error

Edit the openssl.spec file to

# 1. Enable elliptic curves (enable-EC)
# 2. Disable the hobble-openssl script (which erases EC files)
# 3. Update the release mumber to .EC.1
# 4. Include the newly downloaded .tar.bz as source
# 5. Include the newly downloaded patch file

cd ../SPECS
sed -i -e "s/no-ec/enable-ec/; s/no-ecdh/enable-ecdh/; s/no-ecdsa/enable-ecdsa/" openssl.spec # Enable EC
sed -i -e "s/^Source1: hobble-openssl/#&/; s/^%.SOURCE1. /#&/" openssl.spec # Disable the "hobble" script
sed -i -e "s/^Release.*dist\}/&.EC.1/" openssl.spec # Also change release number by adding .EC.1
sed -i -e "s/-usa.tar.bz2/.tar.gz/" openssl.spec # Change the source tarball
sed -i -e "s/^Patch78.*/&\nPatch300: patch300.patch\n/" openssl.spec # Add the new patch
sed -i -e "s/^%patch78.*/&\n%patch300 -p1 \n/" openssl.spec # Add the new patch again

Ceate a new source package using the edited ("enable-EC") openssl.spec

/usr/bin/mock --buildsrpm --spec  ~/build/SPECS/openssl.spec --sources  ~/build/SOURCES # Do a source rebuild

Use the new source package to create a new openssl package

cp /var/lib/mock/epel-6-x86_64/root/builddir/build/SRPMS/openssl-1.0.0-27.el6.EC.1.src.rpm /home/abcd
cd ~ ; /usr/bin/mock --rebuild openssl-1.0.0-27.el6.EC.1.src.rpm

Summarized here http://pastebin.centos.org/3070

Thanks to pj on Freenode for all the help.

closed as off-topic by EightBitTony, Anthon, slm, Zelda, echox Apr 30 '14 at 14:08

  • This question does not appear to be about Unix or Linux within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Why are you not using mock to build the package? – Ignacio Vazquez-Abrams Jun 29 '13 at 1:39
  • 1
    1. cough 2. It will flatten a good chunk of the curve. 3. It was used to build the package in the first place. – Ignacio Vazquez-Abrams Jun 29 '13 at 1:47
  • Yes, you should install mock from EPEL. The CentOS maintainers and EPEL maintainers have an understanding in that they generally don't step on each other's toes (plus, there is a decent amount of overlap in the groups). – Ignacio Vazquez-Abrams Jun 29 '13 at 2:43
  • 1
    fedoraproject.org/wiki/Projects/Mock Good description of mock – neonzeon Jul 4 '13 at 18:07
  • 4
    This question appears to be off-topic because it doesn't appear to be a question. – EightBitTony Apr 30 '14 at 10:26