source: postlfs/security/gnutls.xml@ ae0944a3

10.1 11.0 ken/refactor-virt lazarus qt5new trunk xry111/git-date xry111/git-date-for-trunk xry111/git-date-test
Last change on this file since ae0944a3 was ae0944a3, checked in by Douglas R. Reno <renodr@…>, 10 months ago

Update to xorg-server-1.20.10 (Security Update)
Update to systemd-247
Update to nano-5.4
Update to libtirpc-1.3.1
Update to GnuTLS-3.7.0
Adapt xf86-input-wacom to udev changes

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@23955 af4574ff-66df-0310-9fd7-8a98e5e911e0

  • Property mode set to 100644
File size: 13.0 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY gnutls-download-http "&gnupg-http;/gnutls/v3.7/gnutls-&gnutls-version;.tar.xz">
8 <!ENTITY gnutls-download-ftp "&gnupg-ftp;/gnutls/v3.7/gnutls-&gnutls-version;.tar.xz">
9 <!ENTITY gnutls-download-ftp " ">
10 <!ENTITY gnutls-md5sum "1123a7bcc2fafd703e5a811bc1beb179">
11 <!ENTITY gnutls-size "5.8 MB">
12 <!ENTITY gnutls-buildsize "163 MB (add 112 MB for tests)">
13 <!ENTITY gnutls-time "0.9 SBU (using parallelism=4; add 7.7 SBU for tests)">
14]>
15
16<sect1 id="gnutls" xreflabel="GnuTLS-&gnutls-version;">
17 <?dbhtml filename="gnutls.html"?>
18
19 <sect1info>
20 <othername>$LastChangedBy$</othername>
21 <date>$Date$</date>
22 </sect1info>
23
24 <title>GnuTLS-&gnutls-version;</title>
25
26 <indexterm zone="gnutls">
27 <primary sortas="a-GnuTLS">GnuTLS</primary>
28 </indexterm>
29
30 <sect2 role="package">
31 <title>Introduction to GnuTLS</title>
32
33 <para>
34 The <application>GnuTLS</application> package contains libraries and
35 userspace tools which provide a secure layer over a reliable transport
36 layer. Currently the <application>GnuTLS</application> library implements
37 the proposed standards by the IETF's TLS working group. Quoting from the
38 TLS protocol specification:
39 </para>
40
41 <para>
42 <quote>The TLS protocol provides communications privacy over the
43 Internet. The protocol allows client/server applications to communicate in
44 a way that is designed to prevent eavesdropping, tampering, or message
45 forgery.</quote>
46 </para>
47
48 <para>
49 <application>GnuTLS</application> provides support for TLS 1.3, TLS 1.2, TLS 1.1,
50 TLS 1.0, and SSL 3.0 protocols, TLS extensions, including server name and max
51 record size. Additionally, the library supports authentication using the
52 SRP protocol, X.509 certificates and OpenPGP keys, along with support for
53 the TLS Pre-Shared-Keys (PSK) extension, the Inner Application (TLS/IA)
54 extension and X.509 and OpenPGP certificate handling.
55 </para>
56
57 &lfs10_checked;
58
59 <bridgehead renderas="sect3">Package Information</bridgehead>
60 <itemizedlist spacing="compact">
61 <listitem>
62 <para>
63 Download (HTTP): <ulink url="&gnutls-download-http;"/>
64 </para>
65 </listitem>
66 <listitem>
67 <para>
68 Download (FTP): <ulink url="&gnutls-download-ftp;"/>
69 </para>
70 </listitem>
71 <listitem>
72 <para>
73 Download MD5 sum: &gnutls-md5sum;
74 </para>
75 </listitem>
76 <listitem>
77 <para>
78 Download size: &gnutls-size;
79 </para>
80 </listitem>
81 <listitem>
82 <para>
83 Estimated disk space required: &gnutls-buildsize;
84 </para>
85 </listitem>
86 <listitem>
87 <para>
88 Estimated build time: &gnutls-time;
89 </para>
90 </listitem>
91 </itemizedlist>
92
93 <bridgehead renderas="sect3">GnuTLS Dependencies</bridgehead>
94
95 <bridgehead renderas="sect4">Required</bridgehead>
96 <para role="required">
97 <xref linkend="nettle"/>
98 </para>
99
100 <bridgehead renderas="sect4">Recommended</bridgehead>
101 <para role="recommended">
102 <xref linkend="make-ca"/>,
103 <xref linkend="libunistring"/>,
104 <xref linkend="libtasn1"/>, and
105 <xref linkend="p11-kit"/>
106 </para>
107
108 <bridgehead renderas="sect4">Optional</bridgehead>
109 <para role="optional">
110 <xref linkend="doxygen"/>,
111 <xref linkend="gtk-doc"/>,
112 <xref linkend="guile"/>,
113 <xref linkend="libidn"/> or
114 <xref linkend="libidn2"/>,
115 <xref linkend="libseccomp"/>,
116 <xref linkend="net-tools"/> (used during the test suite),
117 <xref linkend="texlive"/> or <xref linkend="tl-installer"/>,
118 <xref linkend="unbound"/> (to build the DANE library),
119 <xref linkend="valgrind"/> (used during the test suite),
120 <ulink url="&gnu-http;/autogen/">autogen</ulink>,
121 <ulink url="https://cmocka.org/">cmocka</ulink> and
122 <ulink url="http://ftp.debian.org/debian/pool/main/d/datefudge/">datefudge</ulink> (used during the test suite if the DANE library is built), and
123 <ulink url="&sourceforge-dl;/trousers/">Trousers</ulink> (Trusted Platform Module support)
124 </para>
125
126 <note><para>
127 Note that if you do not install <xref linkend="libtasn1"/>, an older
128 version shipped in the <application>GnuTLS</application> tarball will be
129 used instead.
130 </para></note>
131
132 <para condition="html" role="usernotes">User Notes:
133 <ulink url="&blfs-wiki;/gnutls"/>
134 </para>
135 </sect2>
136
137 <sect2 role="installation">
138 <title>Installation of GnuTLS</title>
139
140 <para>
141 Install <application>GnuTLS</application> by running the
142 following commands:
143 </para>
144
145<screen><userinput>./configure --prefix=/usr \
146 --docdir=/usr/share/doc/gnutls-&gnutls-version; \
147 --disable-guile \
148 --with-default-trust-store-pkcs11="pkcs11:" &amp;&amp;
149make</userinput></screen>
150
151 <para>
152 To test the results, issue: <command>make check</command>. If a prior
153 version of <application>GnuTLS</application> (or the same version but
154 without all of the recommended dependencies) has been installed, some
155 tests may fail. If <filename>/usr/lib/libgnutls.so</filename> and the
156 target of that symlink are moved or renamed so that they cannot be found,
157 all tests should pass and the install procedure will restore
158 <filename>libgnutls.so</filename> and the versioned library it points to.
159 </para>
160
161 <para>
162 Now, as the <systemitem class="username">root</systemitem>
163 user:
164 </para>
165
166<screen role="root"><userinput>make install</userinput></screen>
167
168 <para>
169 If you passed <option>--enable-gtk-doc</option> to the
170 <command>configure</command> script, the API will automatically be
171 installed. Otherwise, if desired, you can still install the API
172 documentation to the <filename
173 class="directory">/usr/share/gtk-doc/html/gnutls</filename> directory
174 using the following command as the <systemitem
175 class="username">root</systemitem> user:
176 </para>
177
178<screen role="root"><userinput>make -C doc/reference install-data-local</userinput></screen>
179
180 </sect2>
181
182 <sect2 role="commands">
183 <title>Command Explanations</title>
184
185 <para>
186 <parameter>--with-default-trust-store-pkcs11="pkcs11:"</parameter>: This
187 switch tells gnutls to use the PKCS #11 trust store as the default trust.
188 Omit this switch if <xref linkend="p11-kit"/> is not installed.
189 </para>
190
191 <para>
192 <parameter>--disable-guile</parameter>: This switch disables GUILE support,
193 since GnuTLS does not support Guile-2.2.x yet.
194 </para>
195
196 <para>
197 <option>--with-default-trust-store-file=/etc/pki/tls/certs/ca-bundle.crt</option>:
198 This switch tells <command>configure</command> where to find the
199 legacy CA certificate bundle and to use it instead of PKCS #11 module
200 by default. Use this if <xref linkend="p11-kit"/> is not installed.
201 </para>
202
203 <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
204 href="../../xincludes/gtk-doc-rebuild.xml"/>
205
206 <para>
207 <option>--enable-openssl-compatibility</option>:
208 Use this switch if you wish to build the OpenSSL compatibility library.
209 </para>
210
211 <para>
212 <option>--without-p11-kit</option>: use this switch if you have not
213 installed <application>p11-kit</application>.
214 </para>
215
216 <para>
217 <option>--with-included-unistring</option>: uses the bundled version of
218 libunistring, instead of the system one. Use this switch if you have not
219 installed <xref linkend="libunistring"/>.
220 </para>
221
222 </sect2>
223
224 <sect2 role="content">
225 <title>Contents</title>
226
227 <segmentedlist>
228 <segtitle>Installed Programs</segtitle>
229 <segtitle>Installed Libraries</segtitle>
230 <segtitle>Installed Directories</segtitle>
231
232 <seglistitem>
233 <seg>
234 certtool, danetool, gnutls-cli, gnutls-cli-debug,
235 gnutls-serv, ocsptool, p11tool, psktool, and srptool
236 </seg>
237 <seg>
238 libgnutls.so, libgnutls-dane.so, libgnutlsxx.so, and
239 libgnutls-openssl.so (optional)<!-- disabled , and
240 /usr/lib/guile/2.2/guile-gnutls-v-2.so -->
241 </seg>
242 <seg>
243 /usr/include/gnutls,
244 /usr/share/gtk-doc/html/gnutls, and
245<!-- disabled /usr/share/guile/2.2/gnutls -->
246 /usr/share/doc/gnutls-&gnutls-version;
247 </seg>
248 </seglistitem>
249 </segmentedlist>
250
251 <variablelist>
252 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
253 <?dbfo list-presentation="list"?>
254 <?dbhtml list-presentation="table"?>
255
256 <varlistentry id="certtool">
257 <term><command>certtool</command></term>
258 <listitem>
259 <para>
260 is used to generate X.509 certificates, certificate requests,
261 and private keys.
262 </para>
263 <indexterm zone="gnutls certtool">
264 <primary sortas="b-certtool">certtool</primary>
265 </indexterm>
266 </listitem>
267 </varlistentry>
268
269 <varlistentry id="danetool">
270 <term><command>danetool</command></term>
271 <listitem>
272 <para>
273 is a tool used to generate and check DNS resource records
274 for the DANE protocol.
275 </para>
276 <indexterm zone="gnutls danetool">
277 <primary sortas="b-danetool">danetool</primary>
278 </indexterm>
279 </listitem>
280 </varlistentry>
281
282 <varlistentry id="gnutls-cli">
283 <term><command>gnutls-cli</command></term>
284 <listitem>
285 <para>
286 is a simple client program to set up a TLS connection to some
287 other computer.
288 </para>
289 <indexterm zone="gnutls gnutls-cli">
290 <primary sortas="b-gnutls-cli">gnutls-cli</primary>
291 </indexterm>
292 </listitem>
293 </varlistentry>
294
295 <varlistentry id="gnutls-cli-debug">
296 <term><command>gnutls-cli-debug</command></term>
297 <listitem>
298 <para>
299 is a simple client program to set up a TLS connection to some
300 other computer and produces very verbose progress results.
301 </para>
302 <indexterm zone="gnutls gnutls-cli-debug">
303 <primary sortas="b-gnutls-cli-debug">gnutls-cli-debug</primary>
304 </indexterm>
305 </listitem>
306 </varlistentry>
307
308 <varlistentry id="gnutls-serv">
309 <term><command>gnutls-serv</command></term>
310 <listitem>
311 <para>
312 is a simple server program that listens to incoming TLS
313 connections.
314 </para>
315 <indexterm zone="gnutls gnutls-serv">
316 <primary sortas="b-gnutls-serv">gnutls-serv</primary>
317 </indexterm>
318 </listitem>
319 </varlistentry>
320
321 <varlistentry id="ocsptool">
322 <term><command>ocsptool</command></term>
323 <listitem>
324 <para>
325 is a program that can parse and print information about OCSP
326 requests/responses, generate requests and verify responses.
327 </para>
328 <indexterm zone="gnutls ocsptool">
329 <primary sortas="b-ocsptool">ocsptool</primary>
330 </indexterm>
331 </listitem>
332 </varlistentry>
333
334 <varlistentry id="p11tool">
335 <term><command>p11tool</command></term>
336 <listitem>
337 <para>
338 is a program that allows handling data from PKCS #11 smart cards
339 and security modules.
340 </para>
341 <indexterm zone="gnutls p11tool">
342 <primary sortas="b-p11tool">p11tool</primary>
343 </indexterm>
344 </listitem>
345 </varlistentry>
346
347 <varlistentry id="psktool">
348 <term><command>psktool</command></term>
349 <listitem>
350 <para>
351 is a simple program that generates random keys for use with TLS-PSK.
352 </para>
353 <indexterm zone="gnutls psktool">
354 <primary sortas="b-psktool">psktool</primary>
355 </indexterm>
356 </listitem>
357 </varlistentry>
358
359 <varlistentry id="srptool">
360 <term><command>srptool</command></term>
361 <listitem>
362 <para>
363 is a simple program that emulates the programs in the Stanford
364 SRP (Secure Remote Password) libraries using GnuTLS.
365 </para>
366 <indexterm zone="gnutls srptool">
367 <primary sortas="b-srptool">srptool</primary>
368 </indexterm>
369 </listitem>
370 </varlistentry>
371
372 <varlistentry id="libgnutls">
373 <term><filename class="libraryfile">libgnutls.so</filename></term>
374 <listitem>
375 <para>
376 contains the core API functions and X.509 certificate API functions.
377 </para>
378 <indexterm zone="gnutls libgnutls">
379 <primary sortas="c-libgnutls">libgnutls.so</primary>
380 </indexterm>
381 </listitem>
382 </varlistentry>
383
384 </variablelist>
385
386 </sect2>
387
388</sect1>
Note: See TracBrowser for help on using the repository browser.