source: postlfs/security/gnutls.xml@ 9b43114

11.0 11.1 11.2 lazarus plabs/python-mods qt5new trunk upgradedb xry111/intltool xry111/soup3 xry111/test-20220226
Last change on this file since 9b43114 was 9b43114, checked in by Xi Ruoyao <xry111@…>, 21 months ago

update to gnutls-3.7.1

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@24360 af4574ff-66df-0310-9fd7-8a98e5e911e0

  • Property mode set to 100644
File size: 12.8 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY gnutls-download-http "&gnupg-http;/gnutls/v3.7/gnutls-&gnutls-version;.tar.xz">
8 <!ENTITY gnutls-download-ftp "&gnupg-ftp;/gnutls/v3.7/gnutls-&gnutls-version;.tar.xz">
9 <!ENTITY gnutls-download-ftp " ">
10 <!ENTITY gnutls-md5sum "278e1f50d79cd13727733adbf01fde8f">
11 <!ENTITY gnutls-size "5.8 MB">
12 <!ENTITY gnutls-buildsize "163 MB (add 112 MB for tests)">
13 <!ENTITY gnutls-time "0.9 SBU (using parallelism=4; add 7.7 SBU for tests)">
14]>
15
16<sect1 id="gnutls" xreflabel="GnuTLS-&gnutls-version;">
17 <?dbhtml filename="gnutls.html"?>
18
19 <sect1info>
20 <othername>$LastChangedBy$</othername>
21 <date>$Date$</date>
22 </sect1info>
23
24 <title>GnuTLS-&gnutls-version;</title>
25
26 <indexterm zone="gnutls">
27 <primary sortas="a-GnuTLS">GnuTLS</primary>
28 </indexterm>
29
30 <sect2 role="package">
31 <title>Introduction to GnuTLS</title>
32
33 <para>
34 The <application>GnuTLS</application> package contains libraries and
35 userspace tools which provide a secure layer over a reliable transport
36 layer. Currently the <application>GnuTLS</application> library implements
37 the proposed standards by the IETF's TLS working group. Quoting from the
38 TLS protocol specification:
39 </para>
40
41 <para>
42 <quote>The TLS protocol provides communications privacy over the
43 Internet. The protocol allows client/server applications to communicate in
44 a way that is designed to prevent eavesdropping, tampering, or message
45 forgery.</quote>
46 </para>
47
48 <para>
49 <application>GnuTLS</application> provides support for TLS 1.3, TLS 1.2, TLS 1.1,
50 TLS 1.0, and SSL 3.0 protocols, TLS extensions, including server name and max
51 record size. Additionally, the library supports authentication using the
52 SRP protocol, X.509 certificates and OpenPGP keys, along with support for
53 the TLS Pre-Shared-Keys (PSK) extension, the Inner Application (TLS/IA)
54 extension and X.509 and OpenPGP certificate handling.
55 </para>
56
57 &lfs101_checked;
58
59 <bridgehead renderas="sect3">Package Information</bridgehead>
60 <itemizedlist spacing="compact">
61 <listitem>
62 <para>
63 Download (HTTP): <ulink url="&gnutls-download-http;"/>
64 </para>
65 </listitem>
66 <listitem>
67 <para>
68 Download (FTP): <ulink url="&gnutls-download-ftp;"/>
69 </para>
70 </listitem>
71 <listitem>
72 <para>
73 Download MD5 sum: &gnutls-md5sum;
74 </para>
75 </listitem>
76 <listitem>
77 <para>
78 Download size: &gnutls-size;
79 </para>
80 </listitem>
81 <listitem>
82 <para>
83 Estimated disk space required: &gnutls-buildsize;
84 </para>
85 </listitem>
86 <listitem>
87 <para>
88 Estimated build time: &gnutls-time;
89 </para>
90 </listitem>
91 </itemizedlist>
92
93 <bridgehead renderas="sect3">GnuTLS Dependencies</bridgehead>
94
95 <bridgehead renderas="sect4">Required</bridgehead>
96 <para role="required">
97 <xref linkend="nettle"/>
98 </para>
99
100 <bridgehead renderas="sect4">Recommended</bridgehead>
101 <para role="recommended">
102 <xref linkend="make-ca"/>,
103 <xref linkend="libunistring"/>,
104 <xref linkend="libtasn1"/>, and
105 <xref linkend="p11-kit"/>
106 </para>
107
108 <bridgehead renderas="sect4">Optional</bridgehead>
109 <para role="optional">
110 <xref linkend="doxygen"/>,
111 <xref linkend="gtk-doc"/>,
112 <xref linkend="guile"/>,
113 <xref linkend="libidn"/> or
114 <xref linkend="libidn2"/>,
115 <xref linkend="libseccomp"/>,
116 <xref linkend="net-tools"/> (used during the test suite),
117 <xref linkend="texlive"/> or <xref linkend="tl-installer"/>,
118 <xref linkend="unbound"/> (to build the DANE library),
119 <xref linkend="valgrind"/> (used during the test suite),
120 <ulink url="&gnu-http;/autogen/">autogen</ulink>,
121 <ulink url="https://cmocka.org/">cmocka</ulink> and
122 <ulink url="http://ftp.debian.org/debian/pool/main/d/datefudge/">datefudge</ulink> (used during the test suite if the DANE library is built), and
123 <ulink url="&sourceforge-dl;/trousers/">Trousers</ulink> (Trusted Platform Module support)
124 </para>
125
126 <note><para>
127 Note that if you do not install <xref linkend="libtasn1"/>, an older
128 version shipped in the <application>GnuTLS</application> tarball will be
129 used instead.
130 </para></note>
131
132 <para condition="html" role="usernotes">User Notes:
133 <ulink url="&blfs-wiki;/gnutls"/>
134 </para>
135 </sect2>
136
137 <sect2 role="installation">
138 <title>Installation of GnuTLS</title>
139
140 <para>
141 Install <application>GnuTLS</application> by running the
142 following commands:
143 </para>
144
145<screen><userinput>./configure --prefix=/usr \
146 --docdir=/usr/share/doc/gnutls-&gnutls-version; \
147 --disable-guile \
148 --disable-rpath \
149 --with-default-trust-store-pkcs11="pkcs11:" &amp;&amp;
150make</userinput></screen>
151
152 <para>
153 To test the results, issue: <command>make check</command>.
154 </para>
155
156 <para>
157 Now, as the <systemitem class="username">root</systemitem>
158 user:
159 </para>
160
161<screen role="root"><userinput>make install</userinput></screen>
162
163 <para>
164 If you passed <option>--enable-gtk-doc</option> to the
165 <command>configure</command> script, the API will automatically be
166 installed. Otherwise, if desired, you can still install the API
167 documentation to the <filename
168 class="directory">/usr/share/gtk-doc/html/gnutls</filename> directory
169 using the following command as the <systemitem
170 class="username">root</systemitem> user:
171 </para>
172
173<screen role="root"><userinput>make -C doc/reference install-data-local</userinput></screen>
174
175 </sect2>
176
177 <sect2 role="commands">
178 <title>Command Explanations</title>
179
180 <para>
181 <parameter>--with-default-trust-store-pkcs11="pkcs11:"</parameter>: This
182 switch tells gnutls to use the PKCS #11 trust store as the default trust.
183 Omit this switch if <xref linkend="p11-kit"/> is not installed.
184 </para>
185
186 <para>
187 <parameter>--disable-guile</parameter>: This switch disables GUILE support,
188 since GnuTLS does not support Guile-2.2.x yet.
189 </para>
190
191 <para>
192 <parameter>--disable-rpath</parameter>: This switch prevents building
193 GnuTLS utilities and tests with hardcoded runtime library search path.
194 Hardcoded rpath is unneeded for BLFS, and it causes test failures if
195 an old version of GnuTLS is installed.
196 </para>
197
198 <para>
199 <option>--with-default-trust-store-file=/etc/pki/tls/certs/ca-bundle.crt</option>:
200 This switch tells <command>configure</command> where to find the
201 legacy CA certificate bundle and to use it instead of PKCS #11 module
202 by default. Use this if <xref linkend="p11-kit"/> is not installed.
203 </para>
204
205 <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
206 href="../../xincludes/gtk-doc-rebuild.xml"/>
207
208 <para>
209 <option>--enable-openssl-compatibility</option>:
210 Use this switch if you wish to build the OpenSSL compatibility library.
211 </para>
212
213 <para>
214 <option>--without-p11-kit</option>: use this switch if you have not
215 installed <application>p11-kit</application>.
216 </para>
217
218 <para>
219 <option>--with-included-unistring</option>: uses the bundled version of
220 libunistring, instead of the system one. Use this switch if you have not
221 installed <xref linkend="libunistring"/>.
222 </para>
223
224 </sect2>
225
226 <sect2 role="content">
227 <title>Contents</title>
228
229 <segmentedlist>
230 <segtitle>Installed Programs</segtitle>
231 <segtitle>Installed Libraries</segtitle>
232 <segtitle>Installed Directories</segtitle>
233
234 <seglistitem>
235 <seg>
236 certtool, danetool, gnutls-cli, gnutls-cli-debug,
237 gnutls-serv, ocsptool, p11tool, psktool, and srptool
238 </seg>
239 <seg>
240 libgnutls.so, libgnutls-dane.so, libgnutlsxx.so, and
241 libgnutls-openssl.so (optional)<!-- disabled , and
242 /usr/lib/guile/2.2/guile-gnutls-v-2.so -->
243 </seg>
244 <seg>
245 /usr/include/gnutls,
246 /usr/share/gtk-doc/html/gnutls, and
247<!-- disabled /usr/share/guile/2.2/gnutls -->
248 /usr/share/doc/gnutls-&gnutls-version;
249 </seg>
250 </seglistitem>
251 </segmentedlist>
252
253 <variablelist>
254 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
255 <?dbfo list-presentation="list"?>
256 <?dbhtml list-presentation="table"?>
257
258 <varlistentry id="certtool">
259 <term><command>certtool</command></term>
260 <listitem>
261 <para>
262 is used to generate X.509 certificates, certificate requests,
263 and private keys
264 </para>
265 <indexterm zone="gnutls certtool">
266 <primary sortas="b-certtool">certtool</primary>
267 </indexterm>
268 </listitem>
269 </varlistentry>
270
271 <varlistentry id="danetool">
272 <term><command>danetool</command></term>
273 <listitem>
274 <para>
275 is a tool used to generate and check DNS resource records
276 for the DANE protocol
277 </para>
278 <indexterm zone="gnutls danetool">
279 <primary sortas="b-danetool">danetool</primary>
280 </indexterm>
281 </listitem>
282 </varlistentry>
283
284 <varlistentry id="gnutls-cli">
285 <term><command>gnutls-cli</command></term>
286 <listitem>
287 <para>
288 is a simple client program to set up a TLS connection to some
289 other computer
290 </para>
291 <indexterm zone="gnutls gnutls-cli">
292 <primary sortas="b-gnutls-cli">gnutls-cli</primary>
293 </indexterm>
294 </listitem>
295 </varlistentry>
296
297 <varlistentry id="gnutls-cli-debug">
298 <term><command>gnutls-cli-debug</command></term>
299 <listitem>
300 <para>
301 is a simple client program to set up a TLS connection to some
302 other computer and produces very verbose progress results
303 </para>
304 <indexterm zone="gnutls gnutls-cli-debug">
305 <primary sortas="b-gnutls-cli-debug">gnutls-cli-debug</primary>
306 </indexterm>
307 </listitem>
308 </varlistentry>
309
310 <varlistentry id="gnutls-serv">
311 <term><command>gnutls-serv</command></term>
312 <listitem>
313 <para>
314 is a simple server program that listens to incoming TLS
315 connections
316 </para>
317 <indexterm zone="gnutls gnutls-serv">
318 <primary sortas="b-gnutls-serv">gnutls-serv</primary>
319 </indexterm>
320 </listitem>
321 </varlistentry>
322
323 <varlistentry id="ocsptool">
324 <term><command>ocsptool</command></term>
325 <listitem>
326 <para>
327 is a program that can parse and print information about OCSP
328 requests/responses, generate requests and verify responses
329 </para>
330 <indexterm zone="gnutls ocsptool">
331 <primary sortas="b-ocsptool">ocsptool</primary>
332 </indexterm>
333 </listitem>
334 </varlistentry>
335
336 <varlistentry id="p11tool">
337 <term><command>p11tool</command></term>
338 <listitem>
339 <para>
340 is a program that allows handling data from PKCS #11 smart cards
341 and security modules
342 </para>
343 <indexterm zone="gnutls p11tool">
344 <primary sortas="b-p11tool">p11tool</primary>
345 </indexterm>
346 </listitem>
347 </varlistentry>
348
349 <varlistentry id="psktool">
350 <term><command>psktool</command></term>
351 <listitem>
352 <para>
353 is a simple program that generates random keys for use with TLS-PSK
354 </para>
355 <indexterm zone="gnutls psktool">
356 <primary sortas="b-psktool">psktool</primary>
357 </indexterm>
358 </listitem>
359 </varlistentry>
360
361 <varlistentry id="srptool">
362 <term><command>srptool</command></term>
363 <listitem>
364 <para>
365 is a simple program that emulates the programs in the Stanford
366 SRP (Secure Remote Password) libraries using GnuTLS
367 </para>
368 <indexterm zone="gnutls srptool">
369 <primary sortas="b-srptool">srptool</primary>
370 </indexterm>
371 </listitem>
372 </varlistentry>
373
374 <varlistentry id="libgnutls">
375 <term><filename class="libraryfile">libgnutls.so</filename></term>
376 <listitem>
377 <para>
378 contains the core API functions and X.509 certificate API functions
379 </para>
380 <indexterm zone="gnutls libgnutls">
381 <primary sortas="c-libgnutls">libgnutls.so</primary>
382 </indexterm>
383 </listitem>
384 </varlistentry>
385
386 </variablelist>
387
388 </sect2>
389
390</sect1>
Note: See TracBrowser for help on using the repository browser.