Problems creating openssl for Android

Question

I follow the link to create Android libraries for openssl:

http://wiki.openssl.org/index.php/Android

Here are my settings in Setenv-Android.sh:

_ANDROID_EABI="arm-linux-androideabi-4.6" _ANDROID_ARCH=arch-arm _ANDROID_API="android-16" 

The next step is to run the following command:

 $ . ./Setenv-Andrhoid.sh 

Here is the error I get:

 Error: FIPS_SIG does not specify incore module. Please edit this script. 

No mention is made of how to configure FIPS_SIG on a wiki. It looks like the script is looking for a file or directory named "incore". I looked at my $ ANDROID_NDK_ROOT. However, I do not have any "incore" file.

The following command I need to run is the following:

 $ ./config shared -no-ssl2 -no-ssl3 -no-comp -no-hw -no-engine \ --openssldir=/usr/local/ssl/$ANDROID_API 

Here, openssldir points to the absolute directory /usr/... ? I hope that the final header and lib files will fall into the $ANDROID_NDK_ROOT/platform/android-16/arch-arm directory.

Answer 1

 Here is the error I am getting: Error: FIPS_SIG does not specify incore module. Please edit this script. 

Oh, you're right. This has been fixed on the wiki.

I thought there was a comment in the script that it’s safe to ignore if ..., but there seems to be no comment on this either. Sigh....

The same script is used to create both FIPS Capable and non-FIPS versions of the OpenSSL library. Its safe to ignore the FIPS_SIG error unless you create the FIPS Capable library.

Since you are using OpenSSL and Android , it is safe to ignore. If you followed FIPS Library and Android , then it could not be ignored.

---

It looks like the script is looking for a file or directory named "incore".

For completeness, incore is a script that inserts an HMAC fingerprint into a program or shared object. The FIPS Object Module will use the built-in HMAC to verify integrity at startup. This is pretty useless in practice, since the key is well known;)

incore distributed using openssl-fips-2.0.7.tar.gz and friends. When you put incore somewhere (a directory tree or, for example, /usr/local/ssl/android-18/bin ), you set FIPS_SIG to the file name.

---

$. / config shared -no-ssl2 -no-ssl3 -no-comp -no-hw -no-engine --openssldir = / USR / local / SSL / $ ANDROID_API

This opens openssldir pointing to the absolute / usr / ... directory? I hope that the final header and lib files will fall into the $ ANDROID_NDK_ROOT / platform / android-16 / arch-arm directory.

--openssldir is the installation directory. You must set it to $ANDROID_NDK_ROOT/platform/android-16/arch-arm if you want the library to be installed.

A bit more information: by default, OpenSSL will install itself on /usr/local/ssl . When I create iOS, --openssldir=/usr/local/ssl/ios . When I create Android, --openssldir=/usr/local/ssl/android-18 (or android-14 , etc.).

For example, here's what my Mac book looks like:

 $ ls /usr/local/ssl/ android-14 darwin macosx-x64 android-18 ios macosx-x86