From a99a3d844a8ba0b53e04f5bde47f83c0072bda36 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alexis=20Lothor=C3=A9?= Date: Sat, 14 Feb 2026 12:25:14 +0100 Subject: [PATCH] package/libxmlsec1: disable des support MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit libxmslec1 build fails on some configurations with the following build logs: CC libxmlsec1_openssl_la-kw_des.lo kw_des.c:75:8: error: unknown type name 'xmlSecKWDes3Klass'; did you mean 'xmlSecKWAesKlass'? 75 | static xmlSecKWDes3Klass xmlSecOpenSSLKWDes3ImplKlass = { | ^~~~~~~~~~~~~~~~~ | xmlSecKWAesKlass kw_des.c:77:5: error: initialization of 'int' from 'int (*)(struct _xmlSecTransform *, xmlSecByte *, size_t, size_t *)' {aka 'int (*)(struct _xmlSecTransform *, unsigned char *, long unsigned int, long unsigned int *)'} makes integer from pointer without a cast [-Wint-conversion] 77 | xmlSecOpenSSLKWDes3GenerateRandom, /* xmlSecKWDes3GenerateRandomMethod generateRandom; */ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ kw_des.c:77:5: note: (near initialization for 'xmlSecOpenSSLKWDes3ImplKlass') kw_des.c:77:5: error: initializer element is not computable at load time kw_des.c:77:5: note: (near initialization for 'xmlSecOpenSSLKWDes3ImplKlass') kw_des.c:78:5: error: excess elements in scalar initializer 78 | xmlSecOpenSSLKWDes3Sha1, /* xmlSecKWDes3Sha1Method sha1; */ | ^~~~~~~~~~~~~~~~~~~~~~~ kw_des.c:78:5: note: (near initialization for 'xmlSecOpenSSLKWDes3ImplKlass') kw_des.c:79:5: error: excess elements in scalar initializer 79 | xmlSecOpenSSLKWDes3BlockEncrypt, /* xmlSecKWDes3BlockEncryptMethod encrypt; */ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ kw_des.c:79:5: note: (near initialization for 'xmlSecOpenSSLKWDes3ImplKlass') kw_des.c:80:5: error: excess elements in scalar initializer 80 | xmlSecOpenSSLKWDes3BlockDecrypt, /* xmlSecKWDes3BlockDecryptMethod decrypt; */ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ [...] This build failure is due to those struct definitions being set conditionally in src/kw_aes_des.h behind a XMLSEC_NO_DES define, and this define ending up being 1 on some builds. We could assume that the makefiles in libxmlsec should just not try to build any DES related file when XMLSEC_NO_DES is set to 1 (and so, in this specific case, not try to build src/openssl/kw_des.c), but the autotools tooling in the project is not the one setting XMLSEC_NO_DES: there is a mismatch between detected features at configure time and build time. - at build time, the tooling just checks if user has passed `--enable-des=no`. If so, it sets XMLSEC_NO_DES, otherwise it assumes that DES support is available. - at build time, libxmlsec tries to build openssl backend. This backend checks OpenSSL features, especially whether OPENSSL_NO_DES is set (and if so, it enforces XMLSEC_NO_DES to 1 as well) - This OPENSSL_NO_DES comes from libopenssl configuration headers installed in sysroot. Its presence is driven by the `no-des` option passed at libopenssl configure time - This `no-des` flag is driven by buildroot option BR2_PACKAGE_LIBOPENSSL_ENABLE_DES There are multiple options to fix this package here: 1. fixing upstream package to make the features detection more robust (eg check openssl headers at configure time to ensure that DES is supported) 2. enforce XMLSEC_NO_DES if BR2_PACKAGE_LIBOPENSSL_ENABLE_DES is not set 3. systematically enforce XMLSEC_NO_DES=1 Now: - 1 may take time, and would then need a temporary patch to live in buildroot while the fix is accepted upstream and released - 2 works only for libopenssl, what if libressl is used ? - DES usage is discouraged anyway, as stated by configure logs: [...] checking for DES support... yes (use discouraged) [...] As the package has been introduced very recently, there's a very low chance to break any user use case by completely disabling DES support. Systematically disable DES support in libxmlsec1 to discourage usage and fix build failure when the corresponding SSL library does not expose DES support. Fixes: https://autobuild.buildroot.org/results/3e15f03dc0211c622125ebb69ff7230ce900029a/ Signed-off-by: Alexis Lothoré Signed-off-by: Julien Olivain --- package/libxmlsec1/libxmlsec1.mk | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/package/libxmlsec1/libxmlsec1.mk b/package/libxmlsec1/libxmlsec1.mk index d0d553c48c..29222bc16f 100644 --- a/package/libxmlsec1/libxmlsec1.mk +++ b/package/libxmlsec1/libxmlsec1.mk @@ -19,7 +19,8 @@ LIBXMLSEC1_CONF_OPTS = \ --with-openssl \ --without-gnutls \ --without-gcrypt \ - --without-nss + --without-nss \ + --disable-des HOST_LIBXMLSEC1_CONF_OPTS = \ --enable-crypto-dl=no \ @@ -27,7 +28,8 @@ HOST_LIBXMLSEC1_CONF_OPTS = \ --without-gnutls \ --without-gcrypt \ --without-nss \ - --without-libxslt + --without-libxslt \ + --disable-des ifeq ($(BR2_PACKAGE_LIBXSLT),y) LIBXMLSEC1_DEPENDENCIES += libxslt