GnuTLS の概要
The GnuTLS package contains
libraries and userspace tools which provide a secure layer over a
reliable transport layer. Currently the GnuTLS library implements the proposed
standards by the IETF's TLS working group. Quoting from the
TLS 1.3 protocol
specification :
「 TLS allows client/server
applications to communicate over the Internet in a way that is
designed to prevent eavesdropping, tampering, and message
forgery. 」
GnuTLS provides support for TLS
1.3, TLS 1.2, TLS 1.1, TLS 1.0, and (optionally) SSL 3.0 protocols.
It also supports TLS extensions, including server name and max
record size. Additionally, the library supports authentication
using the SRP protocol, X.509 certificates, and OpenPGP keys, along
with support for the TLS Pre-Shared-Keys (PSK) extension, the Inner
Application (TLS/IA) extension, and X.509 and OpenPGP certificate
handling.
![[注記]](../images/note.png)
注記
LFS や依存パッケージが本ブックに示す最新安定バージョンでなかった場合には、BLFS
開発版においては、パッケージのビルドや処理実行が適切に行われないことがあります。
パッケージ情報
GnuTLS の依存パッケージ
必須
Nettle-3.9.1
Recommended
make-ca-1.13, libunistring-1.1, libtasn1-4.19.0, and p11-kit-0.25.3
任意
Brotli-1.1.0, Doxygen-1.9.8,
GTK-Doc-1.33.2, libidn-1.41 or
libidn2-2.3.4, libseccomp-2.5.5, Net-tools-2.10 (used during the test suite),
texlive-20230313 or install-tl-unx, Unbound-1.19.0
(to build the DANE library), Valgrind-3.22.0 (used during the test suite),
autogen, cmocka and datefudge
(used during the test suite if the DANE library is built), and
Trousers (Trusted
Platform Module support)
GnuTLS のインストール
以下のコマンドを実行して GnuTLS をビルドします。
./configure --prefix=/usr \
--docdir=/usr/share/doc/gnutls-3.8.2 \
--with-default-trust-store-pkcs11="pkcs11:" &&
make
ビルド結果をテストする場合は make
check を実行します。
root ユーザーになって以下を実行します。
make install
コマンド説明
--with-default-trust-store-pkcs11="pkcs11:":
This switch tells gnutls to use the PKCS #11 trust store as the
default trust. Omit this switch if p11-kit-0.25.3 is not
installed.
--with-default-trust-store-file=/etc/pki/tls/certs/ca-bundle.crt:
This switch tells configure where to find the
legacy CA certificate bundle and to use it instead of PKCS #11
module by default. Use this if p11-kit-0.25.3 is not installed.
--enable-gtk-doc: GTK-Doc をインストール済で API ドキュメントを再構築する場合に指定します。
--enable-openssl-compatibility: Use
this switch if you wish to build the OpenSSL compatibility library.
--without-p11-kit: use this switch if
you have not installed p11-kit.
--with-included-unistring: uses the
bundled version of libunistring, instead of the system one. Use
this switch if you have not installed libunistring-1.1.