diff --git a/package/openscap/0001-Fix-build-without-crypto-support.patch b/package/openscap/0001-Fix-build-without-crypto-support.patch new file mode 100644 index 0000000000..97da60f032 --- /dev/null +++ b/package/openscap/0001-Fix-build-without-crypto-support.patch @@ -0,0 +1,57 @@ +From d12d820a9493b0a0ee1ad4b0aeaa87da28aa0080 Mon Sep 17 00:00:00 2001 +From: Eljees +Date: Mon, 27 Jul 2026 06:57:38 +0300 +Subject: [PATCH] Fix build without crypto support + +Upstream: https://github.com/OpenSCAP/openscap/commit/d12d820a9493b0a0ee1ad4b0aeaa87da28aa0080 +Signed-off-by: Alexis Lothoré +--- + src/CMakeLists.txt | 2 +- + src/OVAL/probes/CMakeLists.txt | 2 +- + src/OVAL/probes/crapi/CMakeLists.txt | 7 ++++++- + 3 files changed, 8 insertions(+), 3 deletions(-) + +diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt +index 5d59bf3f036f..f31ce8040e0a 100644 +--- a/src/CMakeLists.txt ++++ b/src/CMakeLists.txt +@@ -59,7 +59,7 @@ if (ENABLE_PROBES) + ) + endif() + endif() +-if (HAVE_MMAN_H AND (GCRYPT_FOUND OR NSS_FOUND)) ++if (HAVE_MMAN_H) + list(APPEND OBJECTS_TO_LINK_AGAINST + $ + ) +diff --git a/src/OVAL/probes/CMakeLists.txt b/src/OVAL/probes/CMakeLists.txt +index e505908f5842..25e3ca56a0c3 100644 +--- a/src/OVAL/probes/CMakeLists.txt ++++ b/src/OVAL/probes/CMakeLists.txt +@@ -1,7 +1,7 @@ + add_subdirectory("SEAP") + add_subdirectory("probe") + +-if (HAVE_MMAN_H AND CRYPTO_FOUND) ++if (HAVE_MMAN_H) + add_subdirectory("crapi") + endif() + +diff --git a/src/OVAL/probes/crapi/CMakeLists.txt b/src/OVAL/probes/crapi/CMakeLists.txt +index 1f3e5a963bbf..3fb6f123c8d6 100644 +--- a/src/OVAL/probes/crapi/CMakeLists.txt ++++ b/src/OVAL/probes/crapi/CMakeLists.txt +@@ -1,4 +1,9 @@ +-file(GLOB_RECURSE CRAPI_SOURCES "*.c") ++if (CRYPTO_FOUND) ++ file(GLOB_RECURSE CRAPI_SOURCES "*.c") ++else() ++ # crapi_init has a no-op implementation for builds without a digest backend. ++ set(CRAPI_SOURCES "crapi.c") ++endif() + file(GLOB_RECURSE CRAPI_HEADERS "*.h") + + add_library(crapi_object OBJECT ${CRAPI_SOURCES} ${CRAPI_HEADERS}) +-- +2.55.0 + diff --git a/package/openscap/0002-Do-not-use-gcrypt-cmake-variables-if-gcrypt-is-not-f.patch b/package/openscap/0002-Do-not-use-gcrypt-cmake-variables-if-gcrypt-is-not-f.patch new file mode 100644 index 0000000000..d4d3bd2d16 --- /dev/null +++ b/package/openscap/0002-Do-not-use-gcrypt-cmake-variables-if-gcrypt-is-not-f.patch @@ -0,0 +1,50 @@ +From 5b858d1786c025cbd50dfc284b252c3ee6dd99dc Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Alexis=20Lothor=C3=A9?= +Date: Tue, 18 Aug 2026 09:38:05 +0200 +Subject: [PATCH] Do not use gcrypt cmake variables if gcrypt is not found +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Commit d12d820a9493 ("Fix build without crypto support") enabled +building the crapi library without a crypto backend, but left the +target_include_directories and target_compile_definitions calls +unguarded. When no crypto library is available, the GCrypt find module +leaves GCRYPT_INCLUDE_DIRS unset, so CMake fails at the generate step +with: + + CMake Error: The following variables are used in this project, but + they are set to NOTFOUND: GCRYPT_INCLUDE_DIR + +The test command provided at this time made the build successful because +it provided -DCMAKE_DISABLE_FIND_PACKAGE_GCrypt=TRUE, but if no crypto +backend is provided, it does not make sense to provide those cmake +configuration options preventing dependency search manually. + +Guard both calls with a CRYPTO_FOUND check so they are only applied when +an actual digest backend is present, even without providing +-DCMAKE_DISABLE_FIND_PACKAGE_foo + +Upstream: https://github.com/OpenSCAP/openscap/commit/5b858d1786c025cbd50dfc284b252c3ee6dd99dc +Signed-off-by: Alexis Lothoré +--- + src/OVAL/probes/crapi/CMakeLists.txt | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/src/OVAL/probes/crapi/CMakeLists.txt b/src/OVAL/probes/crapi/CMakeLists.txt +index 3fb6f123c8d6..88cb916b6d96 100644 +--- a/src/OVAL/probes/crapi/CMakeLists.txt ++++ b/src/OVAL/probes/crapi/CMakeLists.txt +@@ -8,5 +8,7 @@ file(GLOB_RECURSE CRAPI_HEADERS "*.h") + + add_library(crapi_object OBJECT ${CRAPI_SOURCES} ${CRAPI_HEADERS}) + set_oscap_generic_properties(crapi_object) +-target_include_directories(crapi_object PUBLIC ${NSS_INCLUDE_DIRS} ${GCRYPT_INCLUDE_DIRS}) +-target_compile_definitions(crapi_object PUBLIC ${GCRYPT_DEFINITIONS}) ++if (CRYPTO_FOUND) ++ target_include_directories(crapi_object PUBLIC ${NSS_INCLUDE_DIRS} ${GCRYPT_INCLUDE_DIRS}) ++ target_compile_definitions(crapi_object PUBLIC ${GCRYPT_DEFINITIONS}) ++endif() +-- +2.55.0 + diff --git a/package/openscap/Config.in b/package/openscap/Config.in index b6deae0a5f..2d932140a7 100644 --- a/package/openscap/Config.in +++ b/package/openscap/Config.in @@ -1,14 +1,10 @@ config BR2_PACKAGE_OPENSCAP bool "openscap" - depends on BR2_PACKAGE_LIBGPG_ERROR_ARCH_SUPPORTS # libgcrypt depends on !BR2_STATIC_LIBS # dlfcn.h depends on BR2_TOOLCHAIN_HAS_THREADS_NPTL depends on BR2_TOOLCHAIN_GCC_AT_LEAST_7 # libxmlsec1 depends on BR2_TOOLCHAIN_HAS_ATOMIC # libxmlsec1 select BR2_PACKAGE_LIBCURL - # In theory should build without crypto, but in practice it - # doesn't: https://github.com/OpenSCAP/openscap/issues/2310 - select BR2_PACKAGE_LIBGCRYPT if !BR2_PACKAGE_LIBNSS select BR2_PACKAGE_LIBXML2 select BR2_PACKAGE_LIBXSLT select BR2_PACKAGE_LIBXMLSEC1 @@ -22,7 +18,6 @@ config BR2_PACKAGE_OPENSCAP https://github.com/OpenSCAP/openscap comment "openscap needs a toolchain w/ dynamic library, NPTL, gcc >= 7" - depends on BR2_PACKAGE_LIBGPG_ERROR_ARCH_SUPPORTS depends on BR2_TOOLCHAIN_HAS_ATOMIC depends on BR2_STATIC_LIBS || !BR2_TOOLCHAIN_HAS_THREADS_NPTL || \ !BR2_TOOLCHAIN_GCC_AT_LEAST_7 diff --git a/package/openscap/openscap.mk b/package/openscap/openscap.mk index 7da38df345..6fbe097718 100644 --- a/package/openscap/openscap.mk +++ b/package/openscap/openscap.mk @@ -22,7 +22,6 @@ OPENSCAP_DEPENDENCIES = \ HOST_OPENSCAP_DEPENDENCIES = \ host-pkgconf \ host-libcurl \ - host-libgcrypt \ host-libxml2 \ host-libxmlsec1 \ host-libxslt \ @@ -36,7 +35,6 @@ OPENSCAP_CONF_OPTS = \ -DENABLE_OSCAP_UTIL_VM=OFF \ -DENABLE_PROBES_WINDOWS=OFF \ -DENABLE_TESTS=OFF \ - -DWITH_CRYPTO=gcrypt \ -DENABLE_PYTHON3=OFF HOST_OPENSCAP_CONF_OPTS = \ @@ -47,7 +45,6 @@ HOST_OPENSCAP_CONF_OPTS = \ -DENABLE_OSCAP_UTIL_VM=OFF \ -DENABLE_PROBES_WINDOWS=OFF \ -DENABLE_TESTS=OFF \ - -DWITH_CRYPTO=gcrypt \ -DENABLE_PYTHON3=OFF ifeq ($(BR2_PACKAGE_ACL),y) @@ -60,10 +57,10 @@ endif ifeq ($(BR2_PACKAGE_LIBGCRYPT),y) OPENSCAP_DEPENDENCIES += libgcrypt -endif - -ifeq ($(BR2_PACKAGE_LIBNSS),y) +OPENSCAP_CONF_OPTS += -DWITH_CRYPTO=gcrypt +else ifeq ($(BR2_PACKAGE_LIBNSS),y) OPENSCAP_DEPENDENCIES += libnss +OPENSCAP_CONF_OPTS += -DWITH_CRYPTO=nss endif ifneq ($(BR2_TOOLCHAIN_USES_GLIBC),y)