mirror of
https://github.com/libgit2/libgit2.git
synced 2026-06-22 06:26:26 +00:00
7f7dfe71cc
Usage of the deprecated 'SHA256_*' OpenSSL API in a FIPS compliant environment results in OpenSSL's assertion failure with the following description: "OpenSSL internal error, assertion failed: Low level API call to digest SHA256 forbidden in FIPS mode!" This commit adds a possibility to use the OpenSSL's 'EVP_MD*' API instead of the deprecated 'SHA256_*' API, by extending the optional CMake flag 'USE_SHA256' with the new option called 'OpenSSL-FIPS'. The new option is used to choose a hashing backend used by libgit2 to calculate SHA256 hashes, in a similar way that currently existing options like 'OpenSSL', 'OpenSSL-Dynamic', 'mbedTLS' etc do. 'OpenSSL-FIPS' is a fully opt-in option which is purposely not interfering with the existing options, because, after running some benchmarks, it's been discovered that using the 'EVP_MD*' API causes hashing to be a bit slower in comparison to using the deprecated 'SHA256_*' API. Another change introduced in this commit is the enhancement of the Nightly workflow (nightly.yml) which will cause libgit2 to be automatically built with '-DUSE_SHA256="OpenSSL-FIPS"' CMake flag, on Linux, macOS and Windows.
107 lines
2.9 KiB
CMake
107 lines
2.9 KiB
CMake
# Select a hash backend
|
|
|
|
include(SanitizeBool)
|
|
|
|
# USE_SHA1=CollisionDetection(ON)/HTTPS/Generic/OFF
|
|
sanitizebool(USE_SHA1)
|
|
sanitizebool(USE_SHA256)
|
|
|
|
# sha1
|
|
|
|
if(USE_SHA1 STREQUAL ON)
|
|
SET(USE_SHA1 "CollisionDetection")
|
|
elseif(USE_SHA1 STREQUAL "HTTPS")
|
|
if(USE_HTTPS STREQUAL "SecureTransport")
|
|
set(USE_SHA1 "CommonCrypto")
|
|
elseif(USE_HTTPS STREQUAL "Schannel")
|
|
set(USE_SHA1 "Win32")
|
|
elseif(USE_HTTPS STREQUAL "WinHTTP")
|
|
set(USE_SHA1 "Win32")
|
|
elseif(USE_HTTPS)
|
|
set(USE_SHA1 ${USE_HTTPS})
|
|
else()
|
|
set(USE_SHA1 "CollisionDetection")
|
|
endif()
|
|
endif()
|
|
|
|
if(USE_SHA1 STREQUAL "CollisionDetection")
|
|
set(GIT_SHA1_COLLISIONDETECT 1)
|
|
elseif(USE_SHA1 STREQUAL "OpenSSL")
|
|
set(GIT_SHA1_OPENSSL 1)
|
|
elseif(USE_SHA1 STREQUAL "OpenSSL-Dynamic")
|
|
set(GIT_SHA1_OPENSSL 1)
|
|
set(GIT_SHA1_OPENSSL_DYNAMIC 1)
|
|
list(APPEND LIBGIT2_SYSTEM_LIBS dl)
|
|
elseif(USE_SHA1 STREQUAL "CommonCrypto")
|
|
set(GIT_SHA1_COMMON_CRYPTO 1)
|
|
elseif(USE_SHA1 STREQUAL "mbedTLS")
|
|
set(GIT_SHA1_MBEDTLS 1)
|
|
elseif(USE_SHA1 STREQUAL "Win32")
|
|
set(GIT_SHA1_WIN32 1)
|
|
else()
|
|
message(FATAL_ERROR "Asked for unknown SHA1 backend: ${USE_SHA1}")
|
|
endif()
|
|
|
|
# sha256
|
|
|
|
if(USE_SHA256 STREQUAL ON AND USE_HTTPS)
|
|
SET(USE_SHA256 "HTTPS")
|
|
elseif(USE_SHA256 STREQUAL ON)
|
|
SET(USE_SHA256 "Builtin")
|
|
endif()
|
|
|
|
if(USE_SHA256 STREQUAL "HTTPS")
|
|
if(USE_HTTPS STREQUAL "SecureTransport")
|
|
set(USE_SHA256 "CommonCrypto")
|
|
elseif(USE_HTTPS STREQUAL "Schannel")
|
|
set(USE_SHA256 "Win32")
|
|
elseif(USE_HTTPS STREQUAL "WinHTTP")
|
|
set(USE_SHA256 "Win32")
|
|
elseif(USE_HTTPS)
|
|
set(USE_SHA256 ${USE_HTTPS})
|
|
endif()
|
|
endif()
|
|
|
|
if(USE_SHA256 STREQUAL "Builtin")
|
|
set(GIT_SHA256_BUILTIN 1)
|
|
elseif(USE_SHA256 STREQUAL "OpenSSL")
|
|
set(GIT_SHA256_OPENSSL 1)
|
|
elseif(USE_SHA256 STREQUAL "OpenSSL-Dynamic")
|
|
set(GIT_SHA256_OPENSSL 1)
|
|
set(GIT_SHA256_OPENSSL_DYNAMIC 1)
|
|
list(APPEND LIBGIT2_SYSTEM_LIBS dl)
|
|
elseif(USE_SHA256 STREQUAL "OpenSSL-FIPS")
|
|
set(GIT_SHA256_OPENSSL_FIPS 1)
|
|
elseif(USE_SHA256 STREQUAL "CommonCrypto")
|
|
set(GIT_SHA256_COMMON_CRYPTO 1)
|
|
elseif(USE_SHA256 STREQUAL "mbedTLS")
|
|
set(GIT_SHA256_MBEDTLS 1)
|
|
elseif(USE_SHA256 STREQUAL "Win32")
|
|
set(GIT_SHA256_WIN32 1)
|
|
else()
|
|
message(FATAL_ERROR "Asked for unknown SHA256 backend: ${USE_SHA256}")
|
|
endif()
|
|
|
|
# add library requirements
|
|
if(USE_SHA1 STREQUAL "OpenSSL" OR USE_SHA256 STREQUAL "OpenSSL")
|
|
if(CMAKE_SYSTEM_NAME MATCHES "FreeBSD")
|
|
list(APPEND LIBGIT2_PC_LIBS "-lssl")
|
|
else()
|
|
list(APPEND LIBGIT2_PC_REQUIRES "openssl")
|
|
endif()
|
|
endif()
|
|
|
|
if(USE_SHA1 STREQUAL "mbedTLS" OR USE_SHA256 STREQUAL "mbedTLS")
|
|
list(APPEND LIBGIT2_SYSTEM_INCLUDES ${MBEDTLS_INCLUDE_DIR})
|
|
list(APPEND LIBGIT2_SYSTEM_LIBS ${MBEDTLS_LIBRARIES})
|
|
# mbedTLS has no pkgconfig file, hence we can't require it
|
|
# https://github.com/ARMmbed/mbedtls/issues/228
|
|
# For now, pass its link flags as our own
|
|
list(APPEND LIBGIT2_PC_LIBS ${MBEDTLS_LIBRARIES})
|
|
endif()
|
|
|
|
# notify feature enablement
|
|
|
|
add_feature_info(SHA1 ON "using ${USE_SHA1}")
|
|
add_feature_info(SHA256 ON "using ${USE_SHA256}")
|