diff --git a/.github/workflows/package-apisix-runtime-deb-ubuntu20.04.yml b/.github/workflows/package-apisix-runtime-deb-ubuntu20.04.yml index 161d2b43b..02bd2f1e9 100644 --- a/.github/workflows/package-apisix-runtime-deb-ubuntu20.04.yml +++ b/.github/workflows/package-apisix-runtime-deb-ubuntu20.04.yml @@ -43,7 +43,7 @@ jobs: docker exec ubuntu20.04Instance bash -c "wget -O - https://openresty.org/package/pubkey.gpg | apt-key add -" docker exec ubuntu20.04Instance bash -c 'echo "deb http://openresty.org/package/ubuntu $(lsb_release -sc) main" | tee /etc/apt/sources.list.d/openresty.list' docker exec ubuntu20.04Instance bash -c "DEBIAN_FRONTEND=noninteractive apt-get update" - docker exec ubuntu20.04Instance bash -c "DEBIAN_FRONTEND=noninteractive apt-get -y install openresty-openssl111 openresty-pcre openresty-zlib" + docker exec ubuntu20.04Instance bash -c "DEBIAN_FRONTEND=noninteractive apt-get -y install openresty-pcre openresty-zlib" - name: install deb in container run: | diff --git a/.github/workflows/package-apisix-runtime-rpm-el7.yml b/.github/workflows/package-apisix-runtime-rpm-el7.yml index 76482a6f0..e077e5a05 100644 --- a/.github/workflows/package-apisix-runtime-rpm-el7.yml +++ b/.github/workflows/package-apisix-runtime-rpm-el7.yml @@ -38,7 +38,7 @@ jobs: - name: install dependencies in container run: | docker exec centos7Instance bash -c "yum-config-manager --add-repo https://openresty.org/package/centos/openresty.repo" - docker exec centos7Instance bash -c "yum -y install openresty-openssl111 openresty-pcre openresty-zlib" + docker exec centos7Instance bash -c "yum -y install openresty-pcre openresty-zlib" - name: install rpm in container run: | diff --git a/.github/workflows/package-apisix-runtime-rpm-el8.yml b/.github/workflows/package-apisix-runtime-rpm-el8.yml index f4cc258c7..960b08a47 100644 --- a/.github/workflows/package-apisix-runtime-rpm-el8.yml +++ b/.github/workflows/package-apisix-runtime-rpm-el8.yml @@ -45,7 +45,7 @@ jobs: docker exec centos8Instance bash -c "dnf install -y yum-utils" docker exec centos8Instance bash -c "yum-config-manager --add-repo https://openresty.org/package/centos/openresty.repo" - docker exec centos8Instance bash -c "yum -y install openresty-openssl111 openresty-pcre openresty-zlib" + docker exec centos8Instance bash -c "yum -y install openresty-pcre openresty-zlib" - name: install rpm in container run: | diff --git a/.github/workflows/package-apisix-runtime-rpm-ubi.yml b/.github/workflows/package-apisix-runtime-rpm-ubi.yml index 4d48d5fc0..18280930d 100644 --- a/.github/workflows/package-apisix-runtime-rpm-ubi.yml +++ b/.github/workflows/package-apisix-runtime-rpm-ubi.yml @@ -37,7 +37,7 @@ jobs: run: | docker exec ubiInstance bash -c "dnf install -y yum-utils" docker exec ubiInstance bash -c "yum-config-manager --add-repo https://openresty.org/package/centos/openresty.repo" - docker exec ubiInstance bash -c "yum -y install openresty-openssl111 openresty-pcre openresty-zlib" + docker exec ubiInstance bash -c "yum -y install openresty-pcre openresty-zlib" - name: install rpm in container run: | diff --git a/build-apisix-runtime-debug-centos7.sh b/build-apisix-runtime-debug-centos7.sh index 0fa356702..3dbb053fa 100755 --- a/build-apisix-runtime-debug-centos7.sh +++ b/build-apisix-runtime-debug-centos7.sh @@ -4,9 +4,9 @@ set -x yum-config-manager --add-repo https://openresty.org/package/centos/openresty.repo yum -y install gcc gcc-c++ patch wget git make sudo -yum -y install openresty-openssl111-devel openresty-pcre-devel openresty-zlib-devel +yum -y install openresty-pcre-devel openresty-zlib-devel -export openssl_prefix=/usr/local/openresty/openssl111 +export openssl_prefix=/usr/local/openresty/openssl3 export zlib_prefix=/usr/local/openresty/zlib export pcre_prefix=/usr/local/openresty/pcre diff --git a/build-apisix-runtime.sh b/build-apisix-runtime.sh index cbdfa2d33..04cd47880 100755 --- a/build-apisix-runtime.sh +++ b/build-apisix-runtime.sh @@ -4,6 +4,23 @@ set -x runtime_version=${runtime_version:-0.0.0} + +debug_args=${debug_args:-} +ENABLE_FIPS=${ENABLE_FIPS:-"false"} +OPENSSL_CONF_PATH=${OPENSSL_CONF_PATH:-$PWD/conf/openssl3/openssl.cnf} + + +OR_PREFIX=${OR_PREFIX:="/usr/local/openresty"} +OPENSSL_PREFIX=${OPENSSL_PREFIX:=$OR_PREFIX/openssl3} +zlib_prefix=${OR_PREFIX}/zlib +pcre_prefix=${OR_PREFIX}/pcre + +cc_opt=${cc_opt:-"-DNGX_LUA_ABORT_AT_PANIC -I$zlib_prefix/include -I$pcre_prefix/include -I$OPENSSL_PREFIX/include"} +ld_opt=${ld_opt:-"-L$zlib_prefix/lib -L$pcre_prefix/lib -L$OPENSSL_PREFIX/lib -Wl,-rpath,$zlib_prefix/lib:$pcre_prefix/lib:$OPENSSL_PREFIX/lib"} + + +# dependencies for building openresty +OPENSSL_VERSION=${OPENSSL_VERSION:-"3.2.0"} OPENRESTY_VERSION="1.21.4.2" ngx_multi_upstream_module_ver="1.1.1" mod_dubbo_ver="1.0.2" @@ -12,8 +29,41 @@ wasm_nginx_module_ver="0.6.5" lua_var_nginx_module_ver="v0.5.3" grpc_client_nginx_module_ver="v0.4.4" lua_resty_events_ver="0.2.0" -OR_PREFIX=${OR_PREFIX:="/usr/local/openresty"} -debug_args=${debug_args:-} + + +install_openssl_3(){ + local fips="" + if [ "$ENABLE_FIPS" == "true" ]; then + fips="enable-fips" + fi + # required for openssl 3.x config + cpanm IPC/Cmd.pm + wget --no-check-certificate https://www.openssl.org/source/openssl-${OPENSSL_VERSION}.tar.gz + tar xvf openssl-${OPENSSL_VERSION}.tar.gz + cd openssl-${OPENSSL_VERSION}/ + export LDFLAGS="-Wl,-rpath,$zlib_prefix/lib:$OPENSSL_PREFIX/lib" + ./config $fips \ + shared \ + zlib \ + enable-camellia enable-seed enable-rfc3779 \ + enable-cms enable-md2 enable-rc5 \ + enable-weak-ssl-ciphers \ + --prefix=$OPENSSL_PREFIX \ + --libdir=lib \ + --with-zlib-lib=$zlib_prefix/lib \ + --with-zlib-include=$zlib_prefix/include + make -j $(nproc) LD_LIBRARY_PATH= CC="gcc" + make install + if [ -f "$OPENSSL_CONF_PATH" ]; then + cp "$OPENSSL_CONF_PATH" "$OPENSSL_PREFIX"/ssl/openssl.cnf + fi + if [ "$ENABLE_FIPS" == "true" ]; then + $OPENSSL_PREFIX/bin/openssl fipsinstall -out $OPENSSL_PREFIX/ssl/fipsmodule.cnf -module $OPENSSL_PREFIX/lib/ossl-modules/fips.so + sed -i 's@# .include fipsmodule.cnf@.include '"$OPENSSL_PREFIX"'/ssl/fipsmodule.cnf@g; s/# \(fips = fips_sect\)/\1\nbase = base_sect\n\n[base_sect]\nactivate=1\n/g' $OPENSSL_PREFIX/ssl/openssl.cnf + fi + cd .. +} + if ([ $# -gt 0 ] && [ "$1" == "latest" ]) || [ "$version" == "latest" ]; then debug_args="--with-debug" @@ -24,6 +74,9 @@ repo=$(basename "$prev_workdir") workdir=$(mktemp -d) cd "$workdir" || exit 1 + +install_openssl_3 + wget --no-check-certificate https://openresty.org/download/openresty-${OPENRESTY_VERSION}.tar.gz tar -zxvpf openresty-${OPENRESTY_VERSION}.tar.gz > /dev/null @@ -95,8 +148,7 @@ cd wasm-nginx-module-${wasm_nginx_module_ver} || exit 1 ./install-wasmtime.sh cd .. -cc_opt=${cc_opt:-} -ld_opt=${ld_opt:-} + luajit_xcflags=${luajit_xcflags:="-DLUAJIT_NUMMODE=2 -DLUAJIT_ENABLE_LUA52COMPAT"} no_pool_patch=${no_pool_patch:-} # TODO: remove old NGX_HTTP_GRPC_CLI_ENGINE_PATH once we have released a new @@ -126,6 +178,7 @@ else mv lua-resty-limit-traffic-$limit_ver bundle/lua-resty-limit-traffic-$or_limit_ver fi + ./configure --prefix="$OR_PREFIX" \ --with-cc-opt="-DAPISIX_RUNTIME_VER=$runtime_version $grpc_engine_path $cc_opt" \ --with-ld-opt="-Wl,-rpath,$OR_PREFIX/wasmtime-c-api/lib $ld_opt" \ diff --git a/conf/openssl3/openssl.cnf b/conf/openssl3/openssl.cnf new file mode 100644 index 000000000..afe4ba985 --- /dev/null +++ b/conf/openssl3/openssl.cnf @@ -0,0 +1,397 @@ +# +# OpenSSL example configuration file. +# See doc/man5/config.pod for more info. +# +# This is mostly being used for generation of certificate requests, +# but may be used for auto loading of providers + +# Note that you can include other files from the main configuration +# file using the .include directive. +#.include filename + +# This definition stops the following lines choking if HOME isn't +# defined. +HOME = . + + # Use this in order to automatically load providers. +openssl_conf = openssl_init + +# Comment out the next line to ignore configuration errors +config_diagnostics = 1 + +# Extra OBJECT IDENTIFIER info: +# oid_file = $ENV::HOME/.oid +oid_section = new_oids + +# To use this configuration file with the "-extfile" option of the +# "openssl x509" utility, name here the section containing the +# X.509v3 extensions to use: +# extensions = +# (Alternatively, use a configuration file that has only +# X.509v3 extensions in its main [= default] section.) + +[ new_oids ] +# We can add new OIDs in here for use by 'ca', 'req' and 'ts'. +# Add a simple OID like this: +# testoid1=1.2.3.4 +# Or use config file substitution like this: +# testoid2=${testoid1}.5.6 + +# Policies used by the TSA examples. +tsa_policy1 = 1.2.3.4.1 +tsa_policy2 = 1.2.3.4.5.6 +tsa_policy3 = 1.2.3.4.5.7 + +# For FIPS +# Optionally include a file that is generated by the OpenSSL fipsinstall +# application. This file contains configuration data required by the OpenSSL +# fips provider. It contains a named section e.g. [fips_sect] which is +# referenced from the [provider_sect] below. +# Refer to the OpenSSL security policy for more information. +# .include fipsmodule.cnf + +[openssl_init] +providers = provider_sect +ssl_conf = ssl_sect + +# List of providers to load +[provider_sect] +default = default_sect +# The fips section name should match the section name inside the +# included fipsmodule.cnf. +# fips = fips_sect + +# If no providers are activated explicitly, the default one is activated implicitly. +# See man 7 OSSL_PROVIDER-default for more details. +# +# If you add a section explicitly activating any other provider(s), you most +# probably need to explicitly activate the default provider, otherwise it +# becomes unavailable in openssl. As a consequence applications depending on +# OpenSSL may not work correctly which could lead to significant system +# problems including inability to remotely access the system. +[default_sect] +# activate = 1 + + +#################################################################### +[ ca ] +default_ca = CA_default # The default ca section + +#################################################################### +[ CA_default ] + +dir = ./demoCA # Where everything is kept +certs = $dir/certs # Where the issued certs are kept +crl_dir = $dir/crl # Where the issued crl are kept +database = $dir/index.txt # database index file. +#unique_subject = no # Set to 'no' to allow creation of + # several certs with same subject. +new_certs_dir = $dir/newcerts # default place for new certs. + +certificate = $dir/cacert.pem # The CA certificate +serial = $dir/serial # The current serial number +crlnumber = $dir/crlnumber # the current crl number + # must be commented out to leave a V1 CRL +crl = $dir/crl.pem # The current CRL +private_key = $dir/private/cakey.pem# The private key + +x509_extensions = usr_cert # The extensions to add to the cert + +# Comment out the following two lines for the "traditional" +# (and highly broken) format. +name_opt = ca_default # Subject Name options +cert_opt = ca_default # Certificate field options + +# Extension copying option: use with caution. +# copy_extensions = copy + +# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs +# so this is commented out by default to leave a V1 CRL. +# crlnumber must also be commented out to leave a V1 CRL. +# crl_extensions = crl_ext + +default_days = 365 # how long to certify for +default_crl_days= 30 # how long before next CRL +default_md = default # use public key default MD +preserve = no # keep passed DN ordering + +# A few difference way of specifying how similar the request should look +# For type CA, the listed attributes must be the same, and the optional +# and supplied fields are just that :-) +policy = policy_match + +# For the CA policy +[ policy_match ] +countryName = match +stateOrProvinceName = match +organizationName = match +organizationalUnitName = optional +commonName = supplied +emailAddress = optional + +# For the 'anything' policy +# At this point in time, you must list all acceptable 'object' +# types. +[ policy_anything ] +countryName = optional +stateOrProvinceName = optional +localityName = optional +organizationName = optional +organizationalUnitName = optional +commonName = supplied +emailAddress = optional + +#################################################################### +[ req ] +default_bits = 2048 +default_keyfile = privkey.pem +distinguished_name = req_distinguished_name +attributes = req_attributes +x509_extensions = v3_ca # The extensions to add to the self signed cert + +# Passwords for private keys if not present they will be prompted for +# input_password = secret +# output_password = secret + +# This sets a mask for permitted string types. There are several options. +# default: PrintableString, T61String, BMPString. +# pkix : PrintableString, BMPString (PKIX recommendation before 2004) +# utf8only: only UTF8Strings (PKIX recommendation after 2004). +# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings). +# MASK:XXXX a literal mask value. +# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings. +string_mask = utf8only + +# req_extensions = v3_req # The extensions to add to a certificate request + +[ req_distinguished_name ] +countryName = Country Name (2 letter code) +countryName_default = AU +countryName_min = 2 +countryName_max = 2 + +stateOrProvinceName = State or Province Name (full name) +stateOrProvinceName_default = Some-State + +localityName = Locality Name (eg, city) + +0.organizationName = Organization Name (eg, company) +0.organizationName_default = Internet Widgits Pty Ltd + +# we can do this but it is not needed normally :-) +#1.organizationName = Second Organization Name (eg, company) +#1.organizationName_default = World Wide Web Pty Ltd + +organizationalUnitName = Organizational Unit Name (eg, section) +#organizationalUnitName_default = + +commonName = Common Name (e.g. server FQDN or YOUR name) +commonName_max = 64 + +emailAddress = Email Address +emailAddress_max = 64 + +# SET-ex3 = SET extension number 3 + +[ req_attributes ] +challengePassword = A challenge password +challengePassword_min = 4 +challengePassword_max = 20 + +unstructuredName = An optional company name + +[ usr_cert ] + +# These extensions are added when 'ca' signs a request. + +# This goes against PKIX guidelines but some CAs do it and some software +# requires this to avoid interpreting an end user certificate as a CA. + +basicConstraints=CA:FALSE + +# This is typical in keyUsage for a client certificate. +# keyUsage = nonRepudiation, digitalSignature, keyEncipherment + +# PKIX recommendations harmless if included in all certificates. +subjectKeyIdentifier=hash +authorityKeyIdentifier=keyid,issuer + +# This stuff is for subjectAltName and issuerAltname. +# Import the email address. +# subjectAltName=email:copy +# An alternative to produce certificates that aren't +# deprecated according to PKIX. +# subjectAltName=email:move + +# Copy subject details +# issuerAltName=issuer:copy + +# This is required for TSA certificates. +# extendedKeyUsage = critical,timeStamping + +[ v3_req ] + +# Extensions to add to a certificate request + +basicConstraints = CA:FALSE +keyUsage = nonRepudiation, digitalSignature, keyEncipherment + +[ v3_ca ] + + +# Extensions for a typical CA + + +# PKIX recommendation. + +subjectKeyIdentifier=hash + +authorityKeyIdentifier=keyid:always,issuer + +basicConstraints = critical,CA:true + +# Key usage: this is typical for a CA certificate. However since it will +# prevent it being used as an test self-signed certificate it is best +# left out by default. +# keyUsage = cRLSign, keyCertSign + +# Include email address in subject alt name: another PKIX recommendation +# subjectAltName=email:copy +# Copy issuer details +# issuerAltName=issuer:copy + +# DER hex encoding of an extension: beware experts only! +# obj=DER:02:03 +# Where 'obj' is a standard or added object +# You can even override a supported extension: +# basicConstraints= critical, DER:30:03:01:01:FF + +[ crl_ext ] + +# CRL extensions. +# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL. + +# issuerAltName=issuer:copy +authorityKeyIdentifier=keyid:always + +[ proxy_cert_ext ] +# These extensions should be added when creating a proxy certificate + +# This goes against PKIX guidelines but some CAs do it and some software +# requires this to avoid interpreting an end user certificate as a CA. + +basicConstraints=CA:FALSE + +# This is typical in keyUsage for a client certificate. +# keyUsage = nonRepudiation, digitalSignature, keyEncipherment + +# PKIX recommendations harmless if included in all certificates. +subjectKeyIdentifier=hash +authorityKeyIdentifier=keyid,issuer + +# This stuff is for subjectAltName and issuerAltname. +# Import the email address. +# subjectAltName=email:copy +# An alternative to produce certificates that aren't +# deprecated according to PKIX. +# subjectAltName=email:move + +# Copy subject details +# issuerAltName=issuer:copy + +# This really needs to be in place for it to be a proxy certificate. +proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo + +#################################################################### +[ tsa ] + +default_tsa = tsa_config1 # the default TSA section + +[ tsa_config1 ] + +# These are used by the TSA reply generation only. +dir = ./demoCA # TSA root directory +serial = $dir/tsaserial # The current serial number (mandatory) +crypto_device = builtin # OpenSSL engine to use for signing +signer_cert = $dir/tsacert.pem # The TSA signing certificate + # (optional) +certs = $dir/cacert.pem # Certificate chain to include in reply + # (optional) +signer_key = $dir/private/tsakey.pem # The TSA private key (optional) +signer_digest = sha256 # Signing digest to use. (Optional) +default_policy = tsa_policy1 # Policy if request did not specify it + # (optional) +other_policies = tsa_policy2, tsa_policy3 # acceptable policies (optional) +digests = sha1, sha256, sha384, sha512 # Acceptable message digests (mandatory) +accuracy = secs:1, millisecs:500, microsecs:100 # (optional) +clock_precision_digits = 0 # number of digits after dot. (optional) +ordering = yes # Is ordering defined for timestamps? + # (optional, default: no) +tsa_name = yes # Must the TSA name be included in the reply? + # (optional, default: no) +ess_cert_id_chain = no # Must the ESS cert id chain be included? + # (optional, default: no) +ess_cert_id_alg = sha1 # algorithm to compute certificate + # identifier (optional, default: sha1) + +[insta] # CMP using Insta Demo CA +# Message transfer +server = pki.certificate.fi:8700 +# proxy = # set this as far as needed, e.g., http://192.168.1.1:8080 +# tls_use = 0 +path = pkix/ + +# Server authentication +recipient = "/C=FI/O=Insta Demo/CN=Insta Demo CA" # or set srvcert or issuer +ignore_keyusage = 1 # potentially needed quirk +unprotected_errors = 1 # potentially needed quirk +extracertsout = insta.extracerts.pem + +# Client authentication +ref = 3078 # user identification +secret = pass:insta # can be used for both client and server side + +# Generic message options +cmd = ir # default operation, can be overridden on cmd line with, e.g., kur + +# Certificate enrollment +subject = "/CN=openssl-cmp-test" +newkey = insta.priv.pem +out_trusted = insta.ca.crt +certout = insta.cert.pem + +[pbm] # Password-based protection for Insta CA +# Server and client authentication +ref = $insta::ref # 3078 +secret = $insta::secret # pass:insta + +[signature] # Signature-based protection for Insta CA +# Server authentication +trusted = insta.ca.crt # does not include keyUsage digitalSignature + +# Client authentication +secret = # disable PBM +key = $insta::newkey # insta.priv.pem +cert = $insta::certout # insta.cert.pem + +[ir] +cmd = ir + +[cr] +cmd = cr + +[kur] +# Certificate update +cmd = kur +oldcert = $insta::certout # insta.cert.pem + +[rr] +# Certificate revocation +cmd = rr +oldcert = $insta::certout # insta.cert.pem + +[ssl_sect] +system_default = system_default_sect + +[system_default_sect] +CipherString = DEFAULT:@SECLEVEL=0 diff --git a/package-apisix-runtime.sh b/package-apisix-runtime.sh index 8c7fcc3ad..d11a8bff6 100755 --- a/package-apisix-runtime.sh +++ b/package-apisix-runtime.sh @@ -15,12 +15,10 @@ fi ARCH=${ARCH:-`(uname -m | tr '[:upper:]' '[:lower:]')`} openresty_zlib_version="1.2.12-1" -openresty_openssl111_version="1.1.1n-1" openresty_pcre_version="8.45-1" if [ "$PACKAGE_TYPE" == "deb" ]; then pkg_suffix="${codename}1" openresty_zlib_version="$openresty_zlib_version~$pkg_suffix" - openresty_openssl111_version="$openresty_openssl111_version~$pkg_suffix" openresty_pcre_version="$openresty_pcre_version~$pkg_suffix" fi @@ -31,10 +29,8 @@ fpm -f -s dir -t "$PACKAGE_TYPE" \ -v "$RUNTIME_VERSION" \ --iteration "$ITERATION" \ -x openresty/zlib \ - -x openresty/openssl111 \ -x openresty/pcre \ -d "openresty-zlib >= $openresty_zlib_version" \ - -d "openresty-openssl111 >= $openresty_openssl111_version" \ -d "openresty-pcre >= $openresty_pcre_version" \ --post-install post-install-apisix-runtime.sh \ --description "APISIX's OpenResty distribution." \ diff --git a/utils/build-common.sh b/utils/build-common.sh index 503bb454c..affeccbcc 100755 --- a/utils/build-common.sh +++ b/utils/build-common.sh @@ -29,7 +29,7 @@ build_apisix_base_rpm() { yum-config-manager --add-repo https://openresty.org/package/centos/openresty.repo yum -y install openresty-openssl111-devel openresty-pcre-devel openresty-zlib-devel - export_openresty_variables + export_apisix_base_openresty_variables ${BUILD_PATH}/build-apisix-base.sh } @@ -55,7 +55,7 @@ build_apisix_base_deb() { DEBIAN_FRONTEND=noninteractive apt-get update DEBIAN_FRONTEND=noninteractive apt-get install -y openresty-openssl111-dev openresty-pcre-dev openresty-zlib-dev - export_openresty_variables + export_apisix_base_openresty_variables # fix OR_PREFIX if [[ $build_latest == "latest" ]]; then unset OR_PREFIX @@ -64,33 +64,33 @@ build_apisix_base_deb() { } build_apisix_base_apk() { - export_openresty_variables + export_apisix_base_openresty_variables ${BUILD_PATH}/build-apisix-base.sh } build_apisix_runtime_rpm() { if [[ $(rpm --eval '%{centos_ver}') == "7" ]]; then yum -y install centos-release-scl - yum -y install devtoolset-9 patch wget git make sudo + yum -y install devtoolset-9 patch wget git make sudo cpanminus set +eu source scl_source enable devtoolset-9 set -eu elif [[ $(rpm --eval '%{centos_ver}') == "8" ]]; then - dnf install -y gcc-toolset-9-toolchain patch wget git make sudo + dnf install -y gcc-toolset-9-toolchain patch wget git make sudo cpanminus dnf install -y yum-utils set +eu source /opt/rh/gcc-toolset-9/enable set -eu else dnf install -y yum-utils - yum -y install --disablerepo=* --enablerepo=ubi-8-appstream-rpms --enablerepo=ubi-8-baseos-rpms gcc gcc-c++ patch wget git make sudo xz + yum -y install --disablerepo=* --enablerepo=ubi-8-appstream-rpms --enablerepo=ubi-8-baseos-rpms gcc gcc-c++ patch wget git make sudo xz cpanminus fi command -v gcc gcc --version yum-config-manager --add-repo https://openresty.org/package/centos/openresty.repo - yum -y install openresty-openssl111-devel openresty-pcre-devel openresty-zlib-devel + yum -y install openresty-pcre-devel openresty-zlib-devel export_openresty_variables ${BUILD_PATH}/build-apisix-runtime.sh @@ -102,8 +102,8 @@ build_apisix_runtime_deb() { arch_path="arm64/" fi DEBIAN_FRONTEND=noninteractive apt-get update --fix-missing - DEBIAN_FRONTEND=noninteractive apt-get install -y sudo git libreadline-dev lsb-release libssl-dev perl build-essential - DEBIAN_FRONTEND=noninteractive apt-get -y install --no-install-recommends wget gnupg ca-certificates + DEBIAN_FRONTEND=noninteractive apt-get install -y sudo git libreadline-dev lsb-release libssl-dev perl build-essential gcc g++ xz-utils curl cpanminus + DEBIAN_FRONTEND=noninteractive apt-get -y install --no-install-recommends wget gnupg ca-certificates wget -O - https://openresty.org/package/pubkey.gpg | apt-key add - if [[ $IMAGE_BASE == "ubuntu" ]]; then @@ -115,7 +115,7 @@ build_apisix_runtime_deb() { fi DEBIAN_FRONTEND=noninteractive apt-get update - DEBIAN_FRONTEND=noninteractive apt-get install -y openresty-openssl111-dev openresty-pcre-dev openresty-zlib-dev + DEBIAN_FRONTEND=noninteractive apt-get install -y openresty-pcre-dev openresty-zlib-dev export_openresty_variables # fix OR_PREFIX @@ -131,6 +131,16 @@ build_apisix_runtime_apk() { } export_openresty_variables() { + export openssl_prefix=/usr/local/openresty/openssl3 + export zlib_prefix=/usr/local/openresty/zlib + export pcre_prefix=/usr/local/openresty/pcre + export OR_PREFIX=/usr/local/openresty + + export cc_opt="-DNGX_LUA_ABORT_AT_PANIC -I${zlib_prefix}/include -I${pcre_prefix}/include -I${openssl_prefix}/include" + export ld_opt="-L${zlib_prefix}/lib -L${pcre_prefix}/lib -L${openssl_prefix}/lib -Wl,-rpath,${zlib_prefix}/lib:${pcre_prefix}/lib:${openssl_prefix}/lib" +} + +export_apisix_base_openresty_variables() { export openssl_prefix=/usr/local/openresty/openssl111 export zlib_prefix=/usr/local/openresty/zlib export pcre_prefix=/usr/local/openresty/pcre