[Bug 56363] OpenSSL security advisory - Heartbleed bug

[bu...@apache.org]

https://issues.apache.org/bugzilla/show_bug.cgi?id=56363

--- Comment #19 from Doug <dg...@opentext.com> ---
As a result of the latest OpenSSL vulnerability in 1.0.1g, I've been trying the
build described here. However, the resulting .dll is always 200-300 KB (the
build from April is ~1.5 MB), depending on which version of vc++ I use, and
Tomcat cannot use it. Would you be able to provide a build with the latest
OpenSSL 1.0.1h? Or more explicit instructions on completing the build on
Windows?

(In reply to Mladen Turk from comment #10)
> I'll update the BUILDING with windows section since everyone are so
> concerned of my health :)
> 
> It's very simple. The biggest problem is compiling apr and openssl. OpenSSL
> needs to be patched to allow /MD with static lib (something I tried to
> convince openssl developers for years without luck). We have the patch in
> the source dist. Then you have to put apr and openssl include and lib files
> to some directory 
> C:\foo\bar\include
> C:\foo\bar\lib
> 
> Then execute:
> nmake -f NMAKEMakefile WITH_APR=C:\foo\bar WITH_OPENSSL=C:\foo\bar
> APR_DECLARE_STATIC=1 [ENABLE_OCSP=1]
> 
> When building APR I also modify apr.hw and set  APR_HAVE_IPV6 to 1.
> 
> That's it. 10 minutes for all architectures on an average box.
> Note. Forget about IDE builds. They change the format of those .dsp, .vcproj
> whatever files with each version. Use nmake and command line. You'll need
> them to build openssl anyhow, so why not for all.

-- 
You are receiving this mail because:
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org