Add description in X509_STORE manipulation

[oweals/openssl.git] / INSTALL

diff --git a/INSTALL b/INSTALL
index 7fe55d428f2fc46ed9a0d6e8ab47d200ab688be1..1f03f25c13f9558cc62c9a5f572cb74c4a5a450b 100644 (file)
--- a/INSTALL
+++ b/INSTALL
@@ -98,6 +98,9 @@
     $ nmake test
     $ nmake install
 
     $ nmake test
     $ nmake install
 

+ Note that in order to perform the install step above you need to have
+ appropriate permissions to write to the installation directory.
+

  If any of these steps fails, see section Installation in Detail below.
 
  This will build and install OpenSSL in the default location, which is:
  If any of these steps fails, see section Installation in Detail below.
 
  This will build and install OpenSSL in the default location, which is:


@@ -107,6 +110,12 @@
            OpenSSL version number with underscores instead of periods.
   Windows: C:\Program Files\OpenSSL or C:\Program Files (x86)\OpenSSL
 
            OpenSSL version number with underscores instead of periods.
   Windows: C:\Program Files\OpenSSL or C:\Program Files (x86)\OpenSSL
 

+ The installation directory should be appropriately protected to ensure
+ unprivileged users cannot make changes to OpenSSL binaries or files, or install
+ engines. If you already have a pre-installed version of OpenSSL as part of
+ your Operating System it is recommended that you do not overwrite the system
+ version and instead install to somewhere else.
+

  If you want to install it anywhere else, run config like this:
 
   On Unix:
  If you want to install it anywhere else, run config like this:
 
   On Unix:


@@ -229,7 +238,7 @@
                                source exists.
                    getrandom:  Use the L<getrandom(2)> or equivalent system
                                call.
                                source exists.
                    getrandom:  Use the L<getrandom(2)> or equivalent system
                                call.

-                   devrandom:  Use the the first device from the DEVRANDOM list
+                   devrandom:  Use the first device from the DEVRANDOM list

                                which can be opened to read random bytes. The
                                DEVRANDOM preprocessor constant expands to
                                "/dev/urandom","/dev/random","/dev/srandom" on
                                which can be opened to read random bytes. The
                                DEVRANDOM preprocessor constant expands to
                                "/dev/urandom","/dev/random","/dev/srandom" on


@@ -287,6 +296,19 @@
                    Typically OpenSSL will automatically load a system config
                    file which configures default ssl options.
 
                    Typically OpenSSL will automatically load a system config
                    file which configures default ssl options.
 

+  enable-buildtest-c++
+                   While testing, generate C++ buildtest files that
+                   simply check that the public OpenSSL header files
+                   are usable standalone with C++.
+
+                   Enabling this option demands extra care.  For any
+                   compiler flag given directly as configuration
+                   option, you must ensure that it's valid for both
+                   the C and the C++ compiler.  If not, the C++ build
+                   test will most likely break.  As an alternative,
+                   you can use the language specific variables, CFLAGS
+                   and CXXFLAGS.
+

   no-capieng
                    Don't build the CAPI engine. This option will be forced if
                    on a platform that does not support CAPI.
   no-capieng
                    Don't build the CAPI engine. This option will be forced if
                    on a platform that does not support CAPI.


@@ -331,9 +353,6 @@
                    on BSD implementations, in which case it can be disabled with
                    no-devcryptoeng.
 
                    on BSD implementations, in which case it can be disabled with
                    no-devcryptoeng.
 

-  no-dso
-                   Don't build support for loading Dynamic Shared Objects.
-

   no-dynamic-engine
                    Don't build the dynamically loaded engines. This only has an
                    effect in a "shared" build
   no-dynamic-engine
                    Don't build the dynamically loaded engines. This only has an
                    effect in a "shared" build


@@ -665,6 +684,11 @@
                         CC=gcc CROSS_COMPILE=x86_64-w64-mingw32- \
                         ./config -DCOOKIE
 
                         CC=gcc CROSS_COMPILE=x86_64-w64-mingw32- \
                         ./config -DCOOKIE
 

+                   If CC is set, it is advisable to also set CXX to ensure
+                   both C and C++ compilers are in the same "family".  This
+                   becomes relevant with 'enable-external-tests' and
+                   'enable-buildtest-c++'.
+

   reconf
   reconfigure
                    Reconfigure from earlier data.  This fetches the previous
   reconf
   reconfigure
                    Reconfigure from earlier data.  This fetches the previous


@@ -893,8 +917,11 @@
        $ mms install                                    ! OpenVMS
        $ nmake install                                  # Windows
 
        $ mms install                                    ! OpenVMS
        $ nmake install                                  # Windows
 

-     This will install all the software components in this directory
-     tree under PREFIX (the directory given with --prefix or its
+     Note that in order to perform the install step above you need to have
+     appropriate permissions to write to the installation directory.
+
+     The above commands will install all the software components in this
+     directory tree under PREFIX (the directory given with --prefix or its

      default):
 
        Unix:
      default):
 
        Unix:


@@ -950,6 +977,12 @@
                         for private key files.
          misc           Various scripts.
 
                         for private key files.
          misc           Various scripts.
 

+     The installation directory should be appropriately protected to ensure
+     unprivileged users cannot make changes to OpenSSL binaries or files, or
+     install engines. If you already have a pre-installed version of OpenSSL as
+     part of your Operating System it is recommended that you do not overwrite
+     the system version and instead install to somewhere else.
+

      Package builders who want to configure the library for standard
      locations, but have the package installed somewhere else so that
      it can easily be packaged, can use
      Package builders who want to configure the library for standard
      locations, but have the package installed somewhere else so that
      it can easily be packaged, can use