From 17dbd1e500dc715ba1c67770d4bdbb43a5a34d83 Mon Sep 17 00:00:00 2001 From: Thomas Devoogdt Date: Tue, 25 Aug 2026 11:34:06 +0200 Subject: [PATCH] package/expat: fix no high quality entropy warning on Linux <3.17 or glibc <2.25 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit In some situations (old Linux <3.17 or glibc <2.25), expat fail at compilation time with the error: xmlparse.c:150:4: error: #error You do not have support for any sources of high quality entropy enabled. For end user security, that is probably not what you want. Your options include: * Linux >=3.17 + glibc >=2.25 (getrandom): HAVE_GETRANDOM, * Linux >=3.17 + glibc (including <2.25) (syscall SYS_getrandom): HAVE_SYSCALL_GETRANDOM, * BSD / macOS >=10.7 / glibc >=2.36 (arc4random_buf): HAVE_ARC4RANDOM_BUF, * BSD / macOS (including <10.7) / glibc >=2.36 (arc4random): HAVE_ARC4RANDOM, * BSD / macOS >=10.12 / glibc >=2.25 (getentropy): HAVE_GETENTROPY, * Linux (including <3.17) / BSD / macOS (including <10.7) / Solaris >=8 (/dev/urandom): XML_DEV_URANDOM, * Windows >=Vista (rand_s): _WIN32. If you insist on not using any of these, bypass this error by defining XML_POOR_ENTROPY and be vulnerable to hash flooding; you have been warned. If you have reasons to patch this detection code away or need changes to the build system, please open a bug. Thank you! This is caused by the upstream commit [1] "Autotools: Stop using /dev/urandom by default", first included in expat 2.8.2. The Buildroot expat package was bumped to that version in commit [2]. But since all Linux systems have /dev/urandom, we can just enable it by default. Note: this commit does not globally switch the entropy source to /dev/urandom. It is rather enabling it in the list of available sources. On more recent Linux systems (linux >= 3.17, glibc >= 2.25), other sources will be chosen. The entropy source preference order amongst the enabled sources is defined in [3]. This commit also changes the _CONF_OPTS to multiline layout to fit within the 80 characters. [1] https://github.com/libexpat/libexpat/commit/d30eca113a44562137d59835cf2255ea32d11ba6 [2] https://gitlab.com/buildroot.org/buildroot/-/commit/6b1f6f7a480765b3d6ca07691095035a8b899eaf [3] https://github.com/libexpat/libexpat/blob/R_2_8_3/expat/lib/xmlparse.c#L1115-L1142 Signed-off-by: Thomas Devoogdt [Julien: add extra info in the commit log] Signed-off-by: Julien Olivain (cherry picked from commit c22fc74f2b4e5b6082203ecd839d530058e0106d) Signed-off-by: Raphaël Mélotte --- package/expat/expat.mk | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/package/expat/expat.mk b/package/expat/expat.mk index 7645edfd52..a82be75a4d 100644 --- a/package/expat/expat.mk +++ b/package/expat/expat.mk @@ -14,8 +14,16 @@ EXPAT_CPE_ID_VENDOR = libexpat_project EXPAT_CPE_ID_PRODUCT = libexpat EXPAT_CONF_OPTS = \ - --without-docbook --without-examples --without-tests --without-xmlwf -HOST_EXPAT_CONF_OPTS = --without-docbook --without-examples --without-tests + --with-dev-urandom \ + --without-docbook \ + --without-examples \ + --without-tests \ + --without-xmlwf + +HOST_EXPAT_CONF_OPTS = \ + --without-docbook \ + --without-examples \ + --without-tests $(eval $(autotools-package)) $(eval $(host-autotools-package))