Configure RPM with --with-crypto=openssl flag

[Yash-Khatri]

Hi,

I want to use OpenSSL instead of the default NSS library for RPM itself.
I found that I can do this by adding --with-crypto=openssl while configuring and building the package manager myself.

please help me with the below questions.

• Is building RPM itself on my own and using it for building my own packages a recommended way for prod-related scenarios?
• What else I should take a look into in order to use OpenSSL as the crypto library?
• Is there a release already available which uses OpenSSL instead of default NSS?

Any help is appreciated.

[ffesti]

In general you should use the rpm version from the distribution you are building the packages for.
Fedora (and its derivatives) is using openssl for quite a while now. There may be more.

[pmatilai]

Also note that the OpenSSL license is tricky, see INSTALL.

[DemiMarie]

NSS is not even an option for recent versions of RPM.

[Yash-Khatri]

@ffesti @pmatilai @DemiMarie
Thanks for your replies.

My requirement is to build my packages using sha256 digest on rhel6 where the default algo is sha1.
Is this possible ,if yes how ?

[DemiMarie]

@Yash-Khatri It is not possible to do so directly, but I also wonder why you are using rhel6. It might be possible to use a newer rpmsign to add those digests, though.

[pmatilai]

Signing does not recalculate digests.

[DemiMarie]

Qubes OS’s rpmcanon tool does, though.