source: postlfs/security/gnutls.xml@ 531f138

10.0 10.1 11.0 11.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind lazarus perl-modules qt5new trunk upgradedb xry111/intltool xry111/test-20220226
Last change on this file since 531f138 was 531f138, checked in by Douglas R. Reno <renodr@…>, 5 years ago

Added libidn2 to the book

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@19249 af4574ff-66df-0310-9fd7-8a98e5e911e0

  • Property mode set to 100644
File size: 12.5 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY gnutls-download-http "&gnupg-http;/gnutls/v3.6/gnutls-&gnutls-version;.tar.xz">
8 <!ENTITY gnutls-download-ftp "&gnupg-ftp;/gnutls/v3.6/gnutls-&gnutls-version;.tar.xz">
9 <!ENTITY gnutls-md5sum "296f8d61333851b9326bd18484e6135e">
10 <!ENTITY gnutls-size "7.7 MB">
11 <!ENTITY gnutls-buildsize "186 MB (add 64 MB for tests)">
12 <!ENTITY gnutls-time "1.5 SBU (add 9.5 SBU for tests)">
13]>
14
15<sect1 id="gnutls" xreflabel="GnuTLS-&gnutls-version;">
16 <?dbhtml filename="gnutls.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 </sect1info>
22
23 <title>GnuTLS-&gnutls-version;</title>
24
25 <indexterm zone="gnutls">
26 <primary sortas="a-GnuTLS">GnuTLS</primary>
27 </indexterm>
28
29 <sect2 role="package">
30 <title>Introduction to GnuTLS</title>
31
32 <para>
33 The <application>GnuTLS</application> package contains libraries and
34 userspace tools which provide a secure layer over a reliable transport
35 layer. Currently the <application>GnuTLS</application> library implements
36 the proposed standards by the IETF's TLS working group. Quoting from the
37 TLS protocol specification:
38 </para>
39
40 <para>
41 <quote>The TLS protocol provides communications privacy over the
42 Internet. The protocol allows client/server applications to communicate in
43 a way that is designed to prevent eavesdropping, tampering, or message
44 forgery.</quote>
45 </para>
46
47 <para>
48 <application>GnuTLS</application> provides support for TLS 1.2, TLS 1.1,
49 TLS 1.0, and SSL 3.0 protocols, TLS extensions, including server name and max
50 record size. Additionally, the library supports authentication using the
51 SRP protocol, X.509 certificates and OpenPGP keys, along with support for
52 the TLS Pre-Shared-Keys (PSK) extension, the Inner Application (TLS/IA)
53 extension and X.509 and OpenPGP certificate handling.
54 </para>
55
56 &lfs81_checked;
57
58 <bridgehead renderas="sect3">Package Information</bridgehead>
59 <itemizedlist spacing="compact">
60 <listitem>
61 <para>
62 Download (HTTP): <ulink url="&gnutls-download-http;"/>
63 </para>
64 </listitem>
65 <listitem>
66 <para>
67 Download (FTP): <ulink url="&gnutls-download-ftp;"/>
68 </para>
69 </listitem>
70 <listitem>
71 <para>
72 Download MD5 sum: &gnutls-md5sum;
73 </para>
74 </listitem>
75 <listitem>
76 <para>
77 Download size: &gnutls-size;
78 </para>
79 </listitem>
80 <listitem>
81 <para>
82 Estimated disk space required: &gnutls-buildsize;
83 </para>
84 </listitem>
85 <listitem>
86 <para>
87 Estimated build time: &gnutls-time;
88 </para>
89 </listitem>
90 </itemizedlist>
91
92 <bridgehead renderas="sect3">GnuTLS Dependencies</bridgehead>
93
94 <bridgehead renderas="sect4">Required</bridgehead>
95 <para role="required">
96 <xref linkend="nettle"/>
97 </para>
98
99 <bridgehead renderas="sect4">Recommended</bridgehead>
100 <para role="recommended">
101 <xref linkend="cacerts"/>,
102 <xref linkend="libunistring"/>,
103 <xref linkend="libtasn1"/>, and
104 <xref linkend="p11-kit"/>
105 </para>
106
107 <bridgehead renderas="sect4">Optional</bridgehead>
108 <para role="optional">
109 <xref linkend="doxygen"/>,
110 <xref linkend="gtk-doc"/>,
111 <xref linkend="guile"/>,
112 <xref linkend="libidn"/> or
113 <xref linkend="libidn2"/>
114 <xref linkend="net-tools"/> (used during the test suite),
115 <xref linkend="texlive"/> or <xref linkend="tl-installer"/>,
116 <xref linkend="unbound"/> (to build the DANE library),
117 <xref linkend="valgrind"/> (used during the test suite),
118 <ulink url="&gnu-http;/autogen/">autogen</ulink>,
119 <ulink url="https://cmocka.org/">cmocka</ulink> and
120 <ulink url="http://ftp.debian.org/debian/pool/main/d/datefudge/">datefudge</ulink> (used during the test suite if the DANE library is built), and
121 <ulink url="&sourceforge-dl;/trousers/">Trousers</ulink> (Trusted Platform Module support)
122 </para>
123
124 <note><para>
125 Note that if you do not install <xref linkend="libtasn1"/>, an older
126 version shipped in the <application>GnuTLS</application> tarball will be
127 used instead.
128 </para></note>
129
130 <para condition="html" role="usernotes">User Notes:
131 <ulink url="&blfs-wiki;/gnutls"/>
132 </para>
133 </sect2>
134
135 <sect2 role="installation">
136 <title>Installation of GnuTLS</title>
137
138 <para>
139 Install <application>GnuTLS</application> by running the
140 following commands:
141 </para>
142
143<screen><userinput>./configure --prefix=/usr \
144 --with-default-trust-store-pkcs11="pkcs11:" &amp;&amp;
145make</userinput></screen>
146
147 <para>
148 To test the results, issue: <command>make check</command>. If a prior
149 version of <application>GnuTLS</application> (or the same version but
150 without all of the recommended dependencies) has been installed, some
151 tests may fail. If <filename>/usr/lib/libgnutls.so</filename> and the
152 target of that symlink are moved or renamed so that they cannot be found,
153 all tests should pass and the install procedure will restore
154 <filename>libgnutls.so</filename> and the versioned library it points to.
155 </para>
156
157 <para>
158 Now, as the <systemitem class="username">root</systemitem>
159 user:
160 </para>
161
162<screen role="root"><userinput>make install</userinput></screen>
163
164 <para>
165 If you passed <option>--enable-gtk-doc</option> to the
166 <command>configure</command> script, the API will automatically be
167 installed. Otherwise, if desired, you can still install the API
168 documentation to the <filename
169 class="directory">/usr/share/gtk-doc/html/gnutls</filename> directory
170 using the following command as the <systemitem
171 class="username">root</systemitem> user:
172 </para>
173
174<screen role="root"><userinput>make -C doc/reference install-data-local</userinput></screen>
175
176 </sect2>
177
178 <sect2 role="commands">
179 <title>Command Explanations</title>
180
181 <para>
182 <parameter>--with-default-trust-store-pkcs11="pkcs11:"</parameter>: This
183 switch tells gnutls to use the PKCS #11 trust store as the default trust.
184 Omit this switch if <xref linkend="p11-kit"/> is not installed.
185 </para>
186
187 <para>
188 <option>--with-default-trust-store-file=/etc/ssl/ca-bundle.crt</option>:
189 This switch tells <command>configure</command> where to find the
190 legacy CA certificate bundle and to use it instead of PKCS #11 module
191 by default. Use this if <xref linkend="p11-kit"/> is not installed.
192 </para>
193
194 <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
195 href="../../xincludes/gtk-doc-rebuild.xml"/>
196
197 <para>
198 <option>--enable-openssl-compatibility</option>:
199 Use this switch if you wish to build the OpenSSL compatibility library.
200 </para>
201
202 <para>
203 <option>--without-p11-kit</option>: use this switch if you have not
204 installed <application>p11-kit</application>.
205 </para>
206
207 <para>
208 <option>--with-included-unistring</option>: uses the bundled version of
209 libunistring, instead of the system one. Use this switch if you have not
210 installed <xref linkend="libunistring"/>.
211 </para>
212
213 </sect2>
214
215 <sect2 role="content">
216 <title>Contents</title>
217
218 <segmentedlist>
219 <segtitle>Installed Programs</segtitle>
220 <segtitle>Installed Libraries</segtitle>
221 <segtitle>Installed Directories</segtitle>
222
223 <seglistitem>
224 <seg>
225 certtool, danetool, gnutls-cli, gnutls-cli-debug,
226 gnutls-serv, ocsptool, p11tool, psktool, and srptool
227 </seg>
228 <seg>
229 libgnutls.so, libgnutls-dane.so, libgnutlsxx.so,
230 libgnutls-openssl.so (optional), and
231 /usr/lib/guile/2.2/guile-gnutls-v-2.so
232 </seg>
233 <seg>
234 /usr/{include,share/gtk-doc/html,share/guile/site/2.2}/gnutls
235 </seg>
236 </seglistitem>
237 </segmentedlist>
238
239 <variablelist>
240 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
241 <?dbfo list-presentation="list"?>
242 <?dbhtml list-presentation="table"?>
243
244 <varlistentry id="certtool">
245 <term><command>certtool</command></term>
246 <listitem>
247 <para>
248 is used to generate X.509 certificates, certificate requests,
249 and private keys.
250 </para>
251 <indexterm zone="gnutls certtool">
252 <primary sortas="b-certtool">certtool</primary>
253 </indexterm>
254 </listitem>
255 </varlistentry>
256
257 <varlistentry id="danetool">
258 <term><command>danetool</command></term>
259 <listitem>
260 <para>
261 is a tool used to generate and check DNS resource records
262 for the DANE protocol.
263 </para>
264 <indexterm zone="gnutls danetool">
265 <primary sortas="b-danetool">danetool</primary>
266 </indexterm>
267 </listitem>
268 </varlistentry>
269
270 <varlistentry id="gnutls-cli">
271 <term><command>gnutls-cli</command></term>
272 <listitem>
273 <para>
274 is a simple client program to set up a TLS connection to some
275 other computer.
276 </para>
277 <indexterm zone="gnutls gnutls-cli">
278 <primary sortas="b-gnutls-cli">gnutls-cli</primary>
279 </indexterm>
280 </listitem>
281 </varlistentry>
282
283 <varlistentry id="gnutls-cli-debug">
284 <term><command>gnutls-cli-debug</command></term>
285 <listitem>
286 <para>
287 is a simple client program to set up a TLS connection to some
288 other computer and produces very verbose progress results.
289 </para>
290 <indexterm zone="gnutls gnutls-cli-debug">
291 <primary sortas="b-gnutls-cli-debug">gnutls-cli-debug</primary>
292 </indexterm>
293 </listitem>
294 </varlistentry>
295
296 <varlistentry id="gnutls-serv">
297 <term><command>gnutls-serv</command></term>
298 <listitem>
299 <para>
300 is a simple server program that listens to incoming TLS
301 connections.
302 </para>
303 <indexterm zone="gnutls gnutls-serv">
304 <primary sortas="b-gnutls-serv">gnutls-serv</primary>
305 </indexterm>
306 </listitem>
307 </varlistentry>
308
309 <varlistentry id="ocsptool">
310 <term><command>ocsptool</command></term>
311 <listitem>
312 <para>
313 is a program that can parse and print information about OCSP
314 requests/responses, generate requests and verify responses.
315 </para>
316 <indexterm zone="gnutls ocsptool">
317 <primary sortas="b-ocsptool">ocsptool</primary>
318 </indexterm>
319 </listitem>
320 </varlistentry>
321
322 <varlistentry id="p11tool">
323 <term><command>p11tool</command></term>
324 <listitem>
325 <para>
326 is a program that allows handling data from PKCS #11 smart cards
327 and security modules.
328 </para>
329 <indexterm zone="gnutls p11tool">
330 <primary sortas="b-p11tool">p11tool</primary>
331 </indexterm>
332 </listitem>
333 </varlistentry>
334
335 <varlistentry id="psktool">
336 <term><command>psktool</command></term>
337 <listitem>
338 <para>
339 is a simple program that generates random keys for use with TLS-PSK.
340 </para>
341 <indexterm zone="gnutls psktool">
342 <primary sortas="b-psktool">psktool</primary>
343 </indexterm>
344 </listitem>
345 </varlistentry>
346
347 <varlistentry id="srptool">
348 <term><command>srptool</command></term>
349 <listitem>
350 <para>
351 is a simple program that emulates the programs in the Stanford
352 SRP (Secure Remote Password) libraries using GnuTLS.
353 </para>
354 <indexterm zone="gnutls srptool">
355 <primary sortas="b-srptool">srptool</primary>
356 </indexterm>
357 </listitem>
358 </varlistentry>
359
360 <varlistentry id="libgnutls">
361 <term><filename class="libraryfile">libgnutls.so</filename></term>
362 <listitem>
363 <para>
364 contains the core API functions and X.509 certificate API functions.
365 </para>
366 <indexterm zone="gnutls libgnutls">
367 <primary sortas="c-libgnutls">libgnutls.so</primary>
368 </indexterm>
369 </listitem>
370 </varlistentry>
371
372 </variablelist>
373
374 </sect2>
375
376</sect1>
Note: See TracBrowser for help on using the repository browser.