ae5568
diff -up openssl-1.0.0-beta5/README.warning openssl-1.0.0-beta5/README
ae5568
--- openssl-1.0.0-beta5/README.warning	2010-01-20 16:00:47.000000000 +0100
ae5568
+++ openssl-1.0.0-beta5/README	2010-01-21 09:06:11.000000000 +0100
ae5568
@@ -5,6 +5,35 @@
1d20b5
  Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
1d20b5
  All rights reserved.
1d20b5
 
1d20b5
+ WARNING
1d20b5
+ -------
1d20b5
+
1d20b5
+ This version of OpenSSL is built in a way that supports operation in
1d20b5
+ the so called FIPS mode. Note though that the library as we build it
1d20b5
+ is not FIPS validated and the FIPS mode is present for testing purposes
1d20b5
+ only.
1d20b5
+ 
1d20b5
+ This version also contains a few differences from the upstream code
1d20b5
+ some of which are:
ae5568
+   * There are added changes forward ported from the upstream OpenSSL
ae5568
+     0.9.8 FIPS branch however the FIPS integrity verification check
ae5568
+     is implemented differently from the upstream FIPS validated OpenSSL
ae5568
+     module. It verifies HMAC-SHA256 checksum of the whole shared
ae5568
+     libraries. For this reason the changes are ported to files in the
ae5568
+     crypto directory and not in a separate fips subdirectory. Also
ae5568
+     note that the FIPS integrity verification check requires unmodified
ae5568
+     libcrypto and libssl shared library files which means that it will
ae5568
+     fail if these files are modified for example by prelink.
1d20b5
+   * The module respects the kernel FIPS flag /proc/sys/crypto/fips and
1d20b5
+     tries to initialize the FIPS mode if it is set to 1 aborting if the
1d20b5
+     FIPS mode could not be initialized. It is also possible to force the
1d20b5
+     OpenSSL library to FIPS mode especially for debugging purposes by
1d20b5
+     setting the environment variable OPENSSL_FORCE_FIPS_MODE.
1d20b5
+   * If the environment variable OPENSSL_NO_DEFAULT_ZLIB is set the module
1d20b5
+     will not automatically load the built in compression method ZLIB
1d20b5
+     when initialized. Applications can still explicitely ask for ZLIB
1d20b5
+     compression method.
1d20b5
+
1d20b5
  DESCRIPTION
1d20b5
  -----------
1d20b5