source: postlfs/security/gnutls.xml@ 50e505a

10.0 10.1 11.0 11.1 8.4 9.0 9.1 bdubbs/svn elogind lazarus qt5new trunk upgradedb xry111/intltool xry111/test-20220226
Last change on this file since 50e505a was 50e505a, checked in by Bruce Dubbs <bdubbs@…>, 4 years ago

Fix gnutls url

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@20816 af4574ff-66df-0310-9fd7-8a98e5e911e0

  • Property mode set to 100644
File size: 12.7 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY gnutls-download-http "&gnupg-http;/gnutls/v3.6/gnutls-&gnutls-version;.tar.xz">
8 <!-- Something is wrong with ftp server and it confuses curl when currency runs it -->
9 <!-- <!ENTITY gnutls-download-ftp "&gnupg-ftp;/gnutls/v3.6/gnutls-&gnutls-version;.tar.xz"> -->
10 <!ENTITY gnutls-download-ftp " ">
11 <!ENTITY gnutls-md5sum "3474849e1bbd4d16403b82ab2579000b">
12 <!ENTITY gnutls-size "7.8 MB">
13 <!ENTITY gnutls-buildsize "148 MB (add 90 MB for tests)">
14 <!ENTITY gnutls-time "0.7 SBU (using parallelism=4; add 7.0 SBU for tests)">
15]>
16
17<sect1 id="gnutls" xreflabel="GnuTLS-&gnutls-version;">
18 <?dbhtml filename="gnutls.html"?>
19
20 <sect1info>
21 <othername>$LastChangedBy$</othername>
22 <date>$Date$</date>
23 </sect1info>
24
25 <title>GnuTLS-&gnutls-version;</title>
26
27 <indexterm zone="gnutls">
28 <primary sortas="a-GnuTLS">GnuTLS</primary>
29 </indexterm>
30
31 <sect2 role="package">
32 <title>Introduction to GnuTLS</title>
33
34 <para>
35 The <application>GnuTLS</application> package contains libraries and
36 userspace tools which provide a secure layer over a reliable transport
37 layer. Currently the <application>GnuTLS</application> library implements
38 the proposed standards by the IETF's TLS working group. Quoting from the
39 TLS protocol specification:
40 </para>
41
42 <para>
43 <quote>The TLS protocol provides communications privacy over the
44 Internet. The protocol allows client/server applications to communicate in
45 a way that is designed to prevent eavesdropping, tampering, or message
46 forgery.</quote>
47 </para>
48
49 <para>
50 <application>GnuTLS</application> provides support for TLS 1.2, TLS 1.1,
51 TLS 1.0, and SSL 3.0 protocols, TLS extensions, including server name and max
52 record size. Additionally, the library supports authentication using the
53 SRP protocol, X.509 certificates and OpenPGP keys, along with support for
54 the TLS Pre-Shared-Keys (PSK) extension, the Inner Application (TLS/IA)
55 extension and X.509 and OpenPGP certificate handling.
56 </para>
57
58 &lfs83_checked;
59
60 <bridgehead renderas="sect3">Package Information</bridgehead>
61 <itemizedlist spacing="compact">
62 <listitem>
63 <para>
64 Download (HTTP): <ulink url="&gnutls-download-http;"/>
65 </para>
66 </listitem>
67 <listitem>
68 <para>
69 Download (FTP): <ulink url="&gnutls-download-ftp;"/>
70 </para>
71 </listitem>
72 <listitem>
73 <para>
74 Download MD5 sum: &gnutls-md5sum;
75 </para>
76 </listitem>
77 <listitem>
78 <para>
79 Download size: &gnutls-size;
80 </para>
81 </listitem>
82 <listitem>
83 <para>
84 Estimated disk space required: &gnutls-buildsize;
85 </para>
86 </listitem>
87 <listitem>
88 <para>
89 Estimated build time: &gnutls-time;
90 </para>
91 </listitem>
92 </itemizedlist>
93
94 <bridgehead renderas="sect3">GnuTLS Dependencies</bridgehead>
95
96 <bridgehead renderas="sect4">Required</bridgehead>
97 <para role="required">
98 <xref linkend="nettle"/>
99 </para>
100
101 <bridgehead renderas="sect4">Recommended</bridgehead>
102 <para role="recommended">
103 <xref linkend="make-ca"/>,
104 <xref linkend="libunistring"/>,
105 <xref linkend="libtasn1"/>, and
106 <xref linkend="p11-kit"/>
107 </para>
108
109 <bridgehead renderas="sect4">Optional</bridgehead>
110 <para role="optional">
111 <xref linkend="doxygen"/>,
112 <xref linkend="gtk-doc"/>,
113 <xref linkend="guile"/>,
114 <xref linkend="libidn"/> or
115 <xref linkend="libidn2"/>
116 <xref linkend="net-tools"/> (used during the test suite),
117 <xref linkend="texlive"/> or <xref linkend="tl-installer"/>,
118 <xref linkend="unbound"/> (to build the DANE library),
119 <xref linkend="valgrind"/> (used during the test suite),
120 <ulink url="&gnu-http;/autogen/">autogen</ulink>,
121 <ulink url="https://cmocka.org/">cmocka</ulink> and
122 <ulink url="http://ftp.debian.org/debian/pool/main/d/datefudge/">datefudge</ulink> (used during the test suite if the DANE library is built), and
123 <ulink url="&sourceforge-dl;/trousers/">Trousers</ulink> (Trusted Platform Module support)
124 </para>
125
126 <note><para>
127 Note that if you do not install <xref linkend="libtasn1"/>, an older
128 version shipped in the <application>GnuTLS</application> tarball will be
129 used instead.
130 </para></note>
131
132 <para condition="html" role="usernotes">User Notes:
133 <ulink url="&blfs-wiki;/gnutls"/>
134 </para>
135 </sect2>
136
137 <sect2 role="installation">
138 <title>Installation of GnuTLS</title>
139
140 <para>
141 Install <application>GnuTLS</application> by running the
142 following commands:
143 </para>
144
145<screen><userinput>./configure --prefix=/usr \
146 --with-default-trust-store-pkcs11="pkcs11:" &amp;&amp;
147make</userinput></screen>
148
149 <para>
150 To test the results, issue: <command>make check</command>. If a prior
151 version of <application>GnuTLS</application> (or the same version but
152 without all of the recommended dependencies) has been installed, some
153 tests may fail. If <filename>/usr/lib/libgnutls.so</filename> and the
154 target of that symlink are moved or renamed so that they cannot be found,
155 all tests should pass and the install procedure will restore
156 <filename>libgnutls.so</filename> and the versioned library it points to.
157 </para>
158
159 <para>
160 Now, as the <systemitem class="username">root</systemitem>
161 user:
162 </para>
163
164<screen role="root"><userinput>make install</userinput></screen>
165
166 <para>
167 If you passed <option>--enable-gtk-doc</option> to the
168 <command>configure</command> script, the API will automatically be
169 installed. Otherwise, if desired, you can still install the API
170 documentation to the <filename
171 class="directory">/usr/share/gtk-doc/html/gnutls</filename> directory
172 using the following command as the <systemitem
173 class="username">root</systemitem> user:
174 </para>
175
176<screen role="root"><userinput>make -C doc/reference install-data-local</userinput></screen>
177
178 </sect2>
179
180 <sect2 role="commands">
181 <title>Command Explanations</title>
182
183 <para>
184 <parameter>--with-default-trust-store-pkcs11="pkcs11:"</parameter>: This
185 switch tells gnutls to use the PKCS #11 trust store as the default trust.
186 Omit this switch if <xref linkend="p11-kit"/> is not installed.
187 </para>
188
189 <para>
190 <option>--with-default-trust-store-file=/etc/pki/tls/certs/ca-bundle.crt</option>:
191 This switch tells <command>configure</command> where to find the
192 legacy CA certificate bundle and to use it instead of PKCS #11 module
193 by default. Use this if <xref linkend="p11-kit"/> is not installed.
194 </para>
195
196 <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
197 href="../../xincludes/gtk-doc-rebuild.xml"/>
198
199 <para>
200 <option>--enable-openssl-compatibility</option>:
201 Use this switch if you wish to build the OpenSSL compatibility library.
202 </para>
203
204 <para>
205 <option>--without-p11-kit</option>: use this switch if you have not
206 installed <application>p11-kit</application>.
207 </para>
208
209 <para>
210 <option>--with-included-unistring</option>: uses the bundled version of
211 libunistring, instead of the system one. Use this switch if you have not
212 installed <xref linkend="libunistring"/>.
213 </para>
214
215 </sect2>
216
217 <sect2 role="content">
218 <title>Contents</title>
219
220 <segmentedlist>
221 <segtitle>Installed Programs</segtitle>
222 <segtitle>Installed Libraries</segtitle>
223 <segtitle>Installed Directories</segtitle>
224
225 <seglistitem>
226 <seg>
227 certtool, danetool, gnutls-cli, gnutls-cli-debug,
228 gnutls-serv, ocsptool, p11tool, psktool, and srptool
229 </seg>
230 <seg>
231 libgnutls.so, libgnutls-dane.so, libgnutlsxx.so,
232 libgnutls-openssl.so (optional), and
233 /usr/lib/guile/2.2/guile-gnutls-v-2.so
234 </seg>
235 <seg>
236 /usr/{include,share/gtk-doc/html,share/guile/site/2.2}/gnutls
237 </seg>
238 </seglistitem>
239 </segmentedlist>
240
241 <variablelist>
242 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
243 <?dbfo list-presentation="list"?>
244 <?dbhtml list-presentation="table"?>
245
246 <varlistentry id="certtool">
247 <term><command>certtool</command></term>
248 <listitem>
249 <para>
250 is used to generate X.509 certificates, certificate requests,
251 and private keys.
252 </para>
253 <indexterm zone="gnutls certtool">
254 <primary sortas="b-certtool">certtool</primary>
255 </indexterm>
256 </listitem>
257 </varlistentry>
258
259 <varlistentry id="danetool">
260 <term><command>danetool</command></term>
261 <listitem>
262 <para>
263 is a tool used to generate and check DNS resource records
264 for the DANE protocol.
265 </para>
266 <indexterm zone="gnutls danetool">
267 <primary sortas="b-danetool">danetool</primary>
268 </indexterm>
269 </listitem>
270 </varlistentry>
271
272 <varlistentry id="gnutls-cli">
273 <term><command>gnutls-cli</command></term>
274 <listitem>
275 <para>
276 is a simple client program to set up a TLS connection to some
277 other computer.
278 </para>
279 <indexterm zone="gnutls gnutls-cli">
280 <primary sortas="b-gnutls-cli">gnutls-cli</primary>
281 </indexterm>
282 </listitem>
283 </varlistentry>
284
285 <varlistentry id="gnutls-cli-debug">
286 <term><command>gnutls-cli-debug</command></term>
287 <listitem>
288 <para>
289 is a simple client program to set up a TLS connection to some
290 other computer and produces very verbose progress results.
291 </para>
292 <indexterm zone="gnutls gnutls-cli-debug">
293 <primary sortas="b-gnutls-cli-debug">gnutls-cli-debug</primary>
294 </indexterm>
295 </listitem>
296 </varlistentry>
297
298 <varlistentry id="gnutls-serv">
299 <term><command>gnutls-serv</command></term>
300 <listitem>
301 <para>
302 is a simple server program that listens to incoming TLS
303 connections.
304 </para>
305 <indexterm zone="gnutls gnutls-serv">
306 <primary sortas="b-gnutls-serv">gnutls-serv</primary>
307 </indexterm>
308 </listitem>
309 </varlistentry>
310
311 <varlistentry id="ocsptool">
312 <term><command>ocsptool</command></term>
313 <listitem>
314 <para>
315 is a program that can parse and print information about OCSP
316 requests/responses, generate requests and verify responses.
317 </para>
318 <indexterm zone="gnutls ocsptool">
319 <primary sortas="b-ocsptool">ocsptool</primary>
320 </indexterm>
321 </listitem>
322 </varlistentry>
323
324 <varlistentry id="p11tool">
325 <term><command>p11tool</command></term>
326 <listitem>
327 <para>
328 is a program that allows handling data from PKCS #11 smart cards
329 and security modules.
330 </para>
331 <indexterm zone="gnutls p11tool">
332 <primary sortas="b-p11tool">p11tool</primary>
333 </indexterm>
334 </listitem>
335 </varlistentry>
336
337 <varlistentry id="psktool">
338 <term><command>psktool</command></term>
339 <listitem>
340 <para>
341 is a simple program that generates random keys for use with TLS-PSK.
342 </para>
343 <indexterm zone="gnutls psktool">
344 <primary sortas="b-psktool">psktool</primary>
345 </indexterm>
346 </listitem>
347 </varlistentry>
348
349 <varlistentry id="srptool">
350 <term><command>srptool</command></term>
351 <listitem>
352 <para>
353 is a simple program that emulates the programs in the Stanford
354 SRP (Secure Remote Password) libraries using GnuTLS.
355 </para>
356 <indexterm zone="gnutls srptool">
357 <primary sortas="b-srptool">srptool</primary>
358 </indexterm>
359 </listitem>
360 </varlistentry>
361
362 <varlistentry id="libgnutls">
363 <term><filename class="libraryfile">libgnutls.so</filename></term>
364 <listitem>
365 <para>
366 contains the core API functions and X.509 certificate API functions.
367 </para>
368 <indexterm zone="gnutls libgnutls">
369 <primary sortas="c-libgnutls">libgnutls.so</primary>
370 </indexterm>
371 </listitem>
372 </varlistentry>
373
374 </variablelist>
375
376 </sect2>
377
378</sect1>
Note: See TracBrowser for help on using the repository browser.