source: postlfs/security/gnutls.xml@ dbe04ed

10.0 10.1 11.0 11.1 11.2 9.0 9.1 lazarus plabs/python-mods qt5new trunk upgradedb xry111/intltool xry111/soup3 xry111/test-20220226
Last change on this file since dbe04ed was dbe04ed, checked in by Xi Ruoyao <xry111@…>, 4 years ago

Update to gnutls-3.6.8 (#12107)

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@21658 af4574ff-66df-0310-9fd7-8a98e5e911e0

  • Property mode set to 100644
File size: 12.8 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY gnutls-download-http "&gnupg-http;/gnutls/v3.6/gnutls-&gnutls-version;.tar.xz">
8 <!ENTITY gnutls-download-ftp "&gnupg-ftp;/gnutls/v3.6/gnutls-&gnutls-version;.tar.xz">
9 <!ENTITY gnutls-download-ftp " ">
10 <!ENTITY gnutls-md5sum "9dcf0aa45d1a42e1b3ca5d39ec7c61a8">
11 <!ENTITY gnutls-size "5.5 MB">
12 <!ENTITY gnutls-buildsize "86 MB (add 80 MB for tests)">
13 <!ENTITY gnutls-time "0.6 SBU (using parallelism=4; add 7.7 SBU for tests)">
14]>
15
16<sect1 id="gnutls" xreflabel="GnuTLS-&gnutls-version;">
17 <?dbhtml filename="gnutls.html"?>
18
19 <sect1info>
20 <othername>$LastChangedBy$</othername>
21 <date>$Date$</date>
22 </sect1info>
23
24 <title>GnuTLS-&gnutls-version;</title>
25
26 <indexterm zone="gnutls">
27 <primary sortas="a-GnuTLS">GnuTLS</primary>
28 </indexterm>
29
30 <sect2 role="package">
31 <title>Introduction to GnuTLS</title>
32
33 <para>
34 The <application>GnuTLS</application> package contains libraries and
35 userspace tools which provide a secure layer over a reliable transport
36 layer. Currently the <application>GnuTLS</application> library implements
37 the proposed standards by the IETF's TLS working group. Quoting from the
38 TLS protocol specification:
39 </para>
40
41 <para>
42 <quote>The TLS protocol provides communications privacy over the
43 Internet. The protocol allows client/server applications to communicate in
44 a way that is designed to prevent eavesdropping, tampering, or message
45 forgery.</quote>
46 </para>
47
48 <para>
49 <application>GnuTLS</application> provides support for TLS 1.3, TLS 1.2, TLS 1.1,
50 TLS 1.0, and SSL 3.0 protocols, TLS extensions, including server name and max
51 record size. Additionally, the library supports authentication using the
52 SRP protocol, X.509 certificates and OpenPGP keys, along with support for
53 the TLS Pre-Shared-Keys (PSK) extension, the Inner Application (TLS/IA)
54 extension and X.509 and OpenPGP certificate handling.
55 </para>
56
57 &lfs84_checked;
58
59 <bridgehead renderas="sect3">Package Information</bridgehead>
60 <itemizedlist spacing="compact">
61 <listitem>
62 <para>
63 Download (HTTP): <ulink url="&gnutls-download-http;"/>
64 </para>
65 </listitem>
66 <listitem>
67 <para>
68 Download (FTP): <ulink url="&gnutls-download-ftp;"/>
69 </para>
70 </listitem>
71 <listitem>
72 <para>
73 Download MD5 sum: &gnutls-md5sum;
74 </para>
75 </listitem>
76 <listitem>
77 <para>
78 Download size: &gnutls-size;
79 </para>
80 </listitem>
81 <listitem>
82 <para>
83 Estimated disk space required: &gnutls-buildsize;
84 </para>
85 </listitem>
86 <listitem>
87 <para>
88 Estimated build time: &gnutls-time;
89 </para>
90 </listitem>
91 </itemizedlist>
92
93 <bridgehead renderas="sect3">GnuTLS Dependencies</bridgehead>
94
95 <bridgehead renderas="sect4">Required</bridgehead>
96 <para role="required">
97 <xref linkend="nettle"/>
98 </para>
99
100 <bridgehead renderas="sect4">Recommended</bridgehead>
101 <para role="recommended">
102 <xref linkend="make-ca"/>,
103 <xref linkend="libunistring"/>,
104 <xref linkend="libtasn1"/>, and
105 <xref linkend="p11-kit"/>
106 </para>
107
108 <bridgehead renderas="sect4">Optional</bridgehead>
109 <para role="optional">
110 <xref linkend="doxygen"/>,
111 <xref linkend="gtk-doc"/>,
112 <xref linkend="guile"/>,
113 <xref linkend="libidn"/> or
114 <xref linkend="libidn2"/>
115 <xref linkend="net-tools"/> (used during the test suite),
116 <xref linkend="texlive"/> or <xref linkend="tl-installer"/>,
117 <xref linkend="unbound"/> (to build the DANE library),
118 <xref linkend="valgrind"/> (used during the test suite),
119 <ulink url="&gnu-http;/autogen/">autogen</ulink>,
120 <ulink url="https://cmocka.org/">cmocka</ulink> and
121 <ulink url="http://ftp.debian.org/debian/pool/main/d/datefudge/">datefudge</ulink> (used during the test suite if the DANE library is built), and
122 <ulink url="&sourceforge-dl;/trousers/">Trousers</ulink> (Trusted Platform Module support)
123 </para>
124
125 <note><para>
126 Note that if you do not install <xref linkend="libtasn1"/>, an older
127 version shipped in the <application>GnuTLS</application> tarball will be
128 used instead.
129 </para></note>
130
131 <para condition="html" role="usernotes">User Notes:
132 <ulink url="&blfs-wiki;/gnutls"/>
133 </para>
134 </sect2>
135
136 <sect2 role="installation">
137 <title>Installation of GnuTLS</title>
138
139 <para>
140 Install <application>GnuTLS</application> by running the
141 following commands:
142 </para>
143
144<screen><userinput>./configure --prefix=/usr \
145 --docdir=/usr/share/doc/gnutls-&gnutls-version; \
146 --disable-guile \
147 --with-default-trust-store-pkcs11="pkcs11:" &amp;&amp;
148make</userinput></screen>
149
150 <para>
151 To test the results, issue: <command>make check</command>. If a prior
152 version of <application>GnuTLS</application> (or the same version but
153 without all of the recommended dependencies) has been installed, some
154 tests may fail. If <filename>/usr/lib/libgnutls.so</filename> and the
155 target of that symlink are moved or renamed so that they cannot be found,
156 all tests should pass and the install procedure will restore
157 <filename>libgnutls.so</filename> and the versioned library it points to.
158 </para>
159
160 <para>
161 Now, as the <systemitem class="username">root</systemitem>
162 user:
163 </para>
164
165<screen role="root"><userinput>make install</userinput></screen>
166
167 <para>
168 If you passed <option>--enable-gtk-doc</option> to the
169 <command>configure</command> script, the API will automatically be
170 installed. Otherwise, if desired, you can still install the API
171 documentation to the <filename
172 class="directory">/usr/share/gtk-doc/html/gnutls</filename> directory
173 using the following command as the <systemitem
174 class="username">root</systemitem> user:
175 </para>
176
177<screen role="root"><userinput>make -C doc/reference install-data-local</userinput></screen>
178
179 </sect2>
180
181 <sect2 role="commands">
182 <title>Command Explanations</title>
183
184 <para>
185 <parameter>--with-default-trust-store-pkcs11="pkcs11:"</parameter>: This
186 switch tells gnutls to use the PKCS #11 trust store as the default trust.
187 Omit this switch if <xref linkend="p11-kit"/> is not installed.
188 </para>
189
190 <para>
191 <parameter>--disable-guile</parameter>: This switch disables GUILE support,
192 since GnuTLS does not support Guile-2.2.x yet.
193 </para>
194
195 <para>
196 <option>--with-default-trust-store-file=/etc/pki/tls/certs/ca-bundle.crt</option>:
197 This switch tells <command>configure</command> where to find the
198 legacy CA certificate bundle and to use it instead of PKCS #11 module
199 by default. Use this if <xref linkend="p11-kit"/> is not installed.
200 </para>
201
202 <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
203 href="../../xincludes/gtk-doc-rebuild.xml"/>
204
205 <para>
206 <option>--enable-openssl-compatibility</option>:
207 Use this switch if you wish to build the OpenSSL compatibility library.
208 </para>
209
210 <para>
211 <option>--without-p11-kit</option>: use this switch if you have not
212 installed <application>p11-kit</application>.
213 </para>
214
215 <para>
216 <option>--with-included-unistring</option>: uses the bundled version of
217 libunistring, instead of the system one. Use this switch if you have not
218 installed <xref linkend="libunistring"/>.
219 </para>
220
221 </sect2>
222
223 <sect2 role="content">
224 <title>Contents</title>
225
226 <segmentedlist>
227 <segtitle>Installed Programs</segtitle>
228 <segtitle>Installed Libraries</segtitle>
229 <segtitle>Installed Directories</segtitle>
230
231 <seglistitem>
232 <seg>
233 certtool, danetool, gnutls-cli, gnutls-cli-debug,
234 gnutls-serv, ocsptool, p11tool, psktool, and srptool
235 </seg>
236 <seg>
237 libgnutls.so, libgnutls-dane.so, libgnutlsxx.so,
238 libgnutls-openssl.so (optional), and
239 /usr/lib/guile/2.2/guile-gnutls-v-2.so
240 </seg>
241 <seg>
242 /usr/{include,share/gtk-doc/html,share/guile/site/2.2}/gnutls
243 </seg>
244 </seglistitem>
245 </segmentedlist>
246
247 <variablelist>
248 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
249 <?dbfo list-presentation="list"?>
250 <?dbhtml list-presentation="table"?>
251
252 <varlistentry id="certtool">
253 <term><command>certtool</command></term>
254 <listitem>
255 <para>
256 is used to generate X.509 certificates, certificate requests,
257 and private keys.
258 </para>
259 <indexterm zone="gnutls certtool">
260 <primary sortas="b-certtool">certtool</primary>
261 </indexterm>
262 </listitem>
263 </varlistentry>
264
265 <varlistentry id="danetool">
266 <term><command>danetool</command></term>
267 <listitem>
268 <para>
269 is a tool used to generate and check DNS resource records
270 for the DANE protocol.
271 </para>
272 <indexterm zone="gnutls danetool">
273 <primary sortas="b-danetool">danetool</primary>
274 </indexterm>
275 </listitem>
276 </varlistentry>
277
278 <varlistentry id="gnutls-cli">
279 <term><command>gnutls-cli</command></term>
280 <listitem>
281 <para>
282 is a simple client program to set up a TLS connection to some
283 other computer.
284 </para>
285 <indexterm zone="gnutls gnutls-cli">
286 <primary sortas="b-gnutls-cli">gnutls-cli</primary>
287 </indexterm>
288 </listitem>
289 </varlistentry>
290
291 <varlistentry id="gnutls-cli-debug">
292 <term><command>gnutls-cli-debug</command></term>
293 <listitem>
294 <para>
295 is a simple client program to set up a TLS connection to some
296 other computer and produces very verbose progress results.
297 </para>
298 <indexterm zone="gnutls gnutls-cli-debug">
299 <primary sortas="b-gnutls-cli-debug">gnutls-cli-debug</primary>
300 </indexterm>
301 </listitem>
302 </varlistentry>
303
304 <varlistentry id="gnutls-serv">
305 <term><command>gnutls-serv</command></term>
306 <listitem>
307 <para>
308 is a simple server program that listens to incoming TLS
309 connections.
310 </para>
311 <indexterm zone="gnutls gnutls-serv">
312 <primary sortas="b-gnutls-serv">gnutls-serv</primary>
313 </indexterm>
314 </listitem>
315 </varlistentry>
316
317 <varlistentry id="ocsptool">
318 <term><command>ocsptool</command></term>
319 <listitem>
320 <para>
321 is a program that can parse and print information about OCSP
322 requests/responses, generate requests and verify responses.
323 </para>
324 <indexterm zone="gnutls ocsptool">
325 <primary sortas="b-ocsptool">ocsptool</primary>
326 </indexterm>
327 </listitem>
328 </varlistentry>
329
330 <varlistentry id="p11tool">
331 <term><command>p11tool</command></term>
332 <listitem>
333 <para>
334 is a program that allows handling data from PKCS #11 smart cards
335 and security modules.
336 </para>
337 <indexterm zone="gnutls p11tool">
338 <primary sortas="b-p11tool">p11tool</primary>
339 </indexterm>
340 </listitem>
341 </varlistentry>
342
343 <varlistentry id="psktool">
344 <term><command>psktool</command></term>
345 <listitem>
346 <para>
347 is a simple program that generates random keys for use with TLS-PSK.
348 </para>
349 <indexterm zone="gnutls psktool">
350 <primary sortas="b-psktool">psktool</primary>
351 </indexterm>
352 </listitem>
353 </varlistentry>
354
355 <varlistentry id="srptool">
356 <term><command>srptool</command></term>
357 <listitem>
358 <para>
359 is a simple program that emulates the programs in the Stanford
360 SRP (Secure Remote Password) libraries using GnuTLS.
361 </para>
362 <indexterm zone="gnutls srptool">
363 <primary sortas="b-srptool">srptool</primary>
364 </indexterm>
365 </listitem>
366 </varlistentry>
367
368 <varlistentry id="libgnutls">
369 <term><filename class="libraryfile">libgnutls.so</filename></term>
370 <listitem>
371 <para>
372 contains the core API functions and X.509 certificate API functions.
373 </para>
374 <indexterm zone="gnutls libgnutls">
375 <primary sortas="c-libgnutls">libgnutls.so</primary>
376 </indexterm>
377 </listitem>
378 </varlistentry>
379
380 </variablelist>
381
382 </sect2>
383
384</sect1>
Note: See TracBrowser for help on using the repository browser.