> The end result is that I had to change the makefile to -q32 to get > it to work with the openssl-0.9.8j distribution, which smartly does > use 32_64 mode and will FAIL if I did not change the fips-1.2 makefile.
This violates the security policy and invalides the FIPS certification. You cannot change the makefile for building the FIPS canister. You have two possible solutions: 1) Build on a pure native 32-bit platform. This will ensure that the approved build process detects only 32-bit capability. 2) Build in a 32-bit sub-platform. This would mean creating your own substitute for whatever the build process uses to determine that it is on a 64-bit platform and instead tells it that you are on a 32-bit platform. You could, for example, have your own wrappers for things like 'uname', 'gcc' and so on. Some may argue that option 2 violates the spirit of the security policy. I don't feel competent to comment on that. I recommend building the FIPS canister always on a "least common denominator" machine and environment specifically engineered for this purpose. Start with a clean OS install, decide which patches/updates you want and install them. Install only the tools you specifically want in the exact versions you want. Build the FIPS canister and manually, on paper, record its SHA1 checksum. Then put it where you want it. DS ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [email protected]
