mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-25 19:40:35 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/expat: fix no high quality entropy warning on Linux <3.17 or glibc <2.25

Browse Source 
In some situations (old Linux <3.17 or glibc <2.25), expat fail at
compilation time with the error:

xmlparse.c:150:4: error: #error You do not have support for any sources of high quality entropy enabled.
For end user security, that is probably not what you want. Your options include:
  * Linux >=3.17 + glibc >=2.25 (getrandom): HAVE_GETRANDOM,
  * Linux >=3.17 + glibc (including <2.25) (syscall SYS_getrandom): HAVE_SYSCALL_GETRANDOM,
  * BSD / macOS >=10.7 / glibc >=2.36 (arc4random_buf): HAVE_ARC4RANDOM_BUF,
  * BSD / macOS (including <10.7) / glibc >=2.36 (arc4random): HAVE_ARC4RANDOM,
  * BSD / macOS >=10.12 / glibc >=2.25 (getentropy): HAVE_GETENTROPY,
  * Linux (including <3.17) / BSD / macOS (including <10.7) / Solaris >=8 (/dev/urandom): XML_DEV_URANDOM,
  * Windows >=Vista (rand_s): _WIN32.
If you insist on not using any of these, bypass this error by defining XML_POOR_ENTROPY and be vulnerable to hash flooding;
you have been warned. If you have reasons to patch this detection code away or need changes to the build system, please open a bug. Thank you!

This is caused by the upstream commit [1] "Autotools: Stop using
/dev/urandom by default", first included in expat 2.8.2. The
Buildroot expat package was bumped to that version in commit [2].

But since all Linux systems have /dev/urandom, we can just enable
it by default.

Note: this commit does not globally switch the entropy source to
/dev/urandom. It is rather enabling it in the list of available
sources. On more recent Linux systems (linux >= 3.17, glibc >= 2.25),
other sources will be chosen. The entropy source preference order
amongst the enabled sources is defined in [3].

This commit also changes the _CONF_OPTS to multiline layout to fit
within the 80 characters.

[1] d30eca113a
[2] 6b1f6f7a48
[3] https://github.com/libexpat/libexpat/blob/R_2_8_3/expat/lib/xmlparse.c#L1115-L1142

Signed-off-by: Thomas Devoogdt <thomas.devoogdt@barco.com>
[Julien: add extra info in the commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c22fc74f2b)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
This commit is contained in:
Thomas Devoogdt
2026-08-25 11:34:06 +02:00
committed by Raphaël Mélotte
parent 0fcfc773cc
commit 17dbd1e500
1 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
package/expat/expat.mk
View File

@@ -14,8 +14,16 @@ EXPAT_CPE_ID_VENDOR = libexpat_project
EXPAT_CPE_ID_PRODUCT = libexpat
EXPAT_CONF_OPTS = \
--without-docbook --without-examples --without-tests --without-xmlwf
HOST_EXPAT_CONF_OPTS = --without-docbook --without-examples --without-tests
--with-dev-urandom \
--without-docbook \
--without-examples \
--without-tests \
--without-xmlwf
HOST_EXPAT_CONF_OPTS = \
--without-docbook \
--without-examples \
--without-tests
$(eval $(autotools-package))
$(eval $(host-autotools-package))