source: postlfs/security/gnutls.xml@ b278caaf

trunk
Last change on this file since b278caaf was b278caaf, checked in by Bruce Dubbs <bdubbs@…>, 8 weeks ago

PAckage updates
Update to:

cryptsetup-2.3.6
gnutls-3.7.2
nss-3.66
vsftpd-3.0.4

  • Property mode set to 100644
File size: 12.8 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY gnutls-download-http "&gnupg-http;/gnutls/v3.7/gnutls-&gnutls-version;.tar.xz">
8 <!ENTITY gnutls-download-ftp "&gnupg-ftp;/gnutls/v3.7/gnutls-&gnutls-version;.tar.xz">
9 <!ENTITY gnutls-download-ftp " ">
10 <!ENTITY gnutls-md5sum "95c32a1af583ecfcb280648874c0fbd9">
11 <!ENTITY gnutls-size "5.8 MB">
12 <!ENTITY gnutls-buildsize "139 MB (add 112 MB for tests)">
13 <!ENTITY gnutls-time "0.9 SBU (add 2.9 SBU for tests; both using parallelism=4)">
14]>
15
16<sect1 id="gnutls" xreflabel="GnuTLS-&gnutls-version;">
17 <?dbhtml filename="gnutls.html"?>
18
19 <sect1info>
20 <date>$Date$</date>
21 </sect1info>
22
23 <title>GnuTLS-&gnutls-version;</title>
24
25 <indexterm zone="gnutls">
26 <primary sortas="a-GnuTLS">GnuTLS</primary>
27 </indexterm>
28
29 <sect2 role="package">
30 <title>Introduction to GnuTLS</title>
31
32 <para>
33 The <application>GnuTLS</application> package contains libraries and
34 userspace tools which provide a secure layer over a reliable transport
35 layer. Currently the <application>GnuTLS</application> library implements
36 the proposed standards by the IETF's TLS working group. Quoting from the
37 TLS protocol specification:
38 </para>
39
40 <para>
41 <quote>The TLS protocol provides communications privacy over the
42 Internet. The protocol allows client/server applications to communicate in
43 a way that is designed to prevent eavesdropping, tampering, or message
44 forgery.</quote>
45 </para>
46
47 <para>
48 <application>GnuTLS</application> provides support for TLS 1.3, TLS 1.2, TLS 1.1,
49 TLS 1.0, and SSL 3.0 protocols, TLS extensions, including server name and max
50 record size. Additionally, the library supports authentication using the
51 SRP protocol, X.509 certificates and OpenPGP keys, along with support for
52 the TLS Pre-Shared-Keys (PSK) extension, the Inner Application (TLS/IA)
53 extension and X.509 and OpenPGP certificate handling.
54 </para>
55
56 &lfs101_checked;
57
58 <bridgehead renderas="sect3">Package Information</bridgehead>
59 <itemizedlist spacing="compact">
60 <listitem>
61 <para>
62 Download (HTTP): <ulink url="&gnutls-download-http;"/>
63 </para>
64 </listitem>
65 <listitem>
66 <para>
67 Download (FTP): <ulink url="&gnutls-download-ftp;"/>
68 </para>
69 </listitem>
70 <listitem>
71 <para>
72 Download MD5 sum: &gnutls-md5sum;
73 </para>
74 </listitem>
75 <listitem>
76 <para>
77 Download size: &gnutls-size;
78 </para>
79 </listitem>
80 <listitem>
81 <para>
82 Estimated disk space required: &gnutls-buildsize;
83 </para>
84 </listitem>
85 <listitem>
86 <para>
87 Estimated build time: &gnutls-time;
88 </para>
89 </listitem>
90 </itemizedlist>
91
92 <bridgehead renderas="sect3">GnuTLS Dependencies</bridgehead>
93
94 <bridgehead renderas="sect4">Required</bridgehead>
95 <para role="required">
96 <xref linkend="nettle"/>
97 </para>
98
99 <bridgehead renderas="sect4">Recommended</bridgehead>
100 <para role="recommended">
101 <xref linkend="make-ca"/>,
102 <xref linkend="libunistring"/>,
103 <xref linkend="libtasn1"/>, and
104 <xref linkend="p11-kit"/>
105 </para>
106
107 <bridgehead renderas="sect4">Optional</bridgehead>
108 <para role="optional">
109 <xref linkend="doxygen"/>,
110 <xref linkend="gtk-doc"/>,
111 <xref linkend="guile"/>,
112 <xref linkend="libidn"/> or
113 <xref linkend="libidn2"/>,
114 <xref linkend="libseccomp"/>,
115 <xref linkend="net-tools"/> (used during the test suite),
116 <xref linkend="texlive"/> or <xref linkend="tl-installer"/>,
117 <xref linkend="unbound"/> (to build the DANE library),
118 <xref linkend="valgrind"/> (used during the test suite),
119 <ulink url="&gnu-http;/autogen/">autogen</ulink>,
120 <ulink url="https://cmocka.org/">cmocka</ulink> and
121 <ulink url="https://ftp.debian.org/debian/pool/main/d/datefudge/">datefudge</ulink> (used during the test suite if the DANE library is built), and
122 <ulink url="&sourceforge-dl;/trousers/">Trousers</ulink> (Trusted Platform Module support)
123 </para>
124
125 <note><para>
126 Note that if you do not install <xref linkend="libtasn1"/>, an older
127 version shipped in the <application>GnuTLS</application> tarball will be
128 used instead.
129 </para></note>
130
131 <para condition="html" role="usernotes">User Notes:
132 <ulink url="&blfs-wiki;/gnutls"/>
133 </para>
134 </sect2>
135
136 <sect2 role="installation">
137 <title>Installation of GnuTLS</title>
138
139 <para>
140 Install <application>GnuTLS</application> by running the
141 following commands:
142 </para>
143
144<screen><userinput>./configure --prefix=/usr \
145 --docdir=/usr/share/doc/gnutls-&gnutls-version; \
146 --disable-guile \
147 --disable-rpath \
148 --with-default-trust-store-pkcs11="pkcs11:" &amp;&amp;
149make</userinput></screen>
150
151 <para>
152 To test the results, issue: <command>make check</command>.
153 </para>
154
155 <para>
156 Now, as the <systemitem class="username">root</systemitem>
157 user:
158 </para>
159
160<screen role="root"><userinput>make install</userinput></screen>
161
162 <para>
163 If you passed <option>--enable-gtk-doc</option> to the
164 <command>configure</command> script, the API will automatically be
165 installed. Otherwise, if desired, you can still install the API
166 documentation to the <filename
167 class="directory">/usr/share/gtk-doc/html/gnutls</filename> directory
168 using the following command as the <systemitem
169 class="username">root</systemitem> user:
170 </para>
171
172<screen role="root"><userinput>make -C doc/reference install-data-local</userinput></screen>
173
174 </sect2>
175
176 <sect2 role="commands">
177 <title>Command Explanations</title>
178
179 <para>
180 <parameter>--with-default-trust-store-pkcs11="pkcs11:"</parameter>: This
181 switch tells gnutls to use the PKCS #11 trust store as the default trust.
182 Omit this switch if <xref linkend="p11-kit"/> is not installed.
183 </para>
184
185 <para>
186 <parameter>--disable-guile</parameter>: This switch disables GUILE support,
187 since GnuTLS does not support Guile-2.2.x yet.
188 </para>
189
190 <para>
191 <parameter>--disable-rpath</parameter>: This switch prevents building
192 GnuTLS utilities and tests with hardcoded runtime library search path.
193 Hardcoded rpath is unneeded for BLFS, and it causes test failures if
194 an old version of GnuTLS is installed.
195 </para>
196
197 <para>
198 <option>--with-default-trust-store-file=/etc/pki/tls/certs/ca-bundle.crt</option>:
199 This switch tells <command>configure</command> where to find the
200 legacy CA certificate bundle and to use it instead of PKCS #11 module
201 by default. Use this if <xref linkend="p11-kit"/> is not installed.
202 </para>
203
204 <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
205 href="../../xincludes/gtk-doc-rebuild.xml"/>
206
207 <para>
208 <option>--enable-openssl-compatibility</option>:
209 Use this switch if you wish to build the OpenSSL compatibility library.
210 </para>
211
212 <para>
213 <option>--without-p11-kit</option>: use this switch if you have not
214 installed <application>p11-kit</application>.
215 </para>
216
217 <para>
218 <option>--with-included-unistring</option>: uses the bundled version of
219 libunistring, instead of the system one. Use this switch if you have not
220 installed <xref linkend="libunistring"/>.
221 </para>
222
223 </sect2>
224
225 <sect2 role="content">
226 <title>Contents</title>
227
228 <segmentedlist>
229 <segtitle>Installed Programs</segtitle>
230 <segtitle>Installed Libraries</segtitle>
231 <segtitle>Installed Directories</segtitle>
232
233 <seglistitem>
234 <seg>
235 certtool, danetool, gnutls-cli, gnutls-cli-debug,
236 gnutls-serv, ocsptool, p11tool, psktool, and srptool
237 </seg>
238 <seg>
239 libgnutls.so, libgnutls-dane.so, libgnutlsxx.so, and
240 libgnutls-openssl.so (optional)<!-- disabled , and
241 /usr/lib/guile/2.2/guile-gnutls-v-2.so -->
242 </seg>
243 <seg>
244 /usr/include/gnutls,
245 /usr/share/gtk-doc/html/gnutls, and
246<!-- disabled /usr/share/guile/2.2/gnutls -->
247 /usr/share/doc/gnutls-&gnutls-version;
248 </seg>
249 </seglistitem>
250 </segmentedlist>
251
252 <variablelist>
253 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
254 <?dbfo list-presentation="list"?>
255 <?dbhtml list-presentation="table"?>
256
257 <varlistentry id="certtool">
258 <term><command>certtool</command></term>
259 <listitem>
260 <para>
261 is used to generate X.509 certificates, certificate requests,
262 and private keys
263 </para>
264 <indexterm zone="gnutls certtool">
265 <primary sortas="b-certtool">certtool</primary>
266 </indexterm>
267 </listitem>
268 </varlistentry>
269
270 <varlistentry id="danetool">
271 <term><command>danetool</command></term>
272 <listitem>
273 <para>
274 is a tool used to generate and check DNS resource records
275 for the DANE protocol
276 </para>
277 <indexterm zone="gnutls danetool">
278 <primary sortas="b-danetool">danetool</primary>
279 </indexterm>
280 </listitem>
281 </varlistentry>
282
283 <varlistentry id="gnutls-cli">
284 <term><command>gnutls-cli</command></term>
285 <listitem>
286 <para>
287 is a simple client program to set up a TLS connection to some
288 other computer
289 </para>
290 <indexterm zone="gnutls gnutls-cli">
291 <primary sortas="b-gnutls-cli">gnutls-cli</primary>
292 </indexterm>
293 </listitem>
294 </varlistentry>
295
296 <varlistentry id="gnutls-cli-debug">
297 <term><command>gnutls-cli-debug</command></term>
298 <listitem>
299 <para>
300 is a simple client program to set up a TLS connection to some
301 other computer and produces very verbose progress results
302 </para>
303 <indexterm zone="gnutls gnutls-cli-debug">
304 <primary sortas="b-gnutls-cli-debug">gnutls-cli-debug</primary>
305 </indexterm>
306 </listitem>
307 </varlistentry>
308
309 <varlistentry id="gnutls-serv">
310 <term><command>gnutls-serv</command></term>
311 <listitem>
312 <para>
313 is a simple server program that listens to incoming TLS
314 connections
315 </para>
316 <indexterm zone="gnutls gnutls-serv">
317 <primary sortas="b-gnutls-serv">gnutls-serv</primary>
318 </indexterm>
319 </listitem>
320 </varlistentry>
321
322 <varlistentry id="ocsptool">
323 <term><command>ocsptool</command></term>
324 <listitem>
325 <para>
326 is a program that can parse and print information about OCSP
327 requests/responses, generate requests and verify responses
328 </para>
329 <indexterm zone="gnutls ocsptool">
330 <primary sortas="b-ocsptool">ocsptool</primary>
331 </indexterm>
332 </listitem>
333 </varlistentry>
334
335 <varlistentry id="p11tool">
336 <term><command>p11tool</command></term>
337 <listitem>
338 <para>
339 is a program that allows handling data from PKCS #11 smart cards
340 and security modules
341 </para>
342 <indexterm zone="gnutls p11tool">
343 <primary sortas="b-p11tool">p11tool</primary>
344 </indexterm>
345 </listitem>
346 </varlistentry>
347
348 <varlistentry id="psktool">
349 <term><command>psktool</command></term>
350 <listitem>
351 <para>
352 is a simple program that generates random keys for use with TLS-PSK
353 </para>
354 <indexterm zone="gnutls psktool">
355 <primary sortas="b-psktool">psktool</primary>
356 </indexterm>
357 </listitem>
358 </varlistentry>
359
360 <varlistentry id="srptool">
361 <term><command>srptool</command></term>
362 <listitem>
363 <para>
364 is a simple program that emulates the programs in the Stanford
365 SRP (Secure Remote Password) libraries using GnuTLS
366 </para>
367 <indexterm zone="gnutls srptool">
368 <primary sortas="b-srptool">srptool</primary>
369 </indexterm>
370 </listitem>
371 </varlistentry>
372
373 <varlistentry id="libgnutls">
374 <term><filename class="libraryfile">libgnutls.so</filename></term>
375 <listitem>
376 <para>
377 contains the core API functions and X.509 certificate API functions
378 </para>
379 <indexterm zone="gnutls libgnutls">
380 <primary sortas="c-libgnutls">libgnutls.so</primary>
381 </indexterm>
382 </listitem>
383 </varlistentry>
384
385 </variablelist>
386
387 </sect2>
388
389</sect1>
Note: See TracBrowser for help on using the repository browser.