From f366204311b48320e5474178f4d853858f807f62 Mon Sep 17 00:00:00 2001 From: Florian Larysch Date: Sat, 31 May 2025 16:39:23 +0200 Subject: [PATCH] package/network-manager: switch default crypto provider to gnutls Currently, when both libnss and GnuTLS are present, NetworkManager will get linked to libnss. The NetworkManager project doesn't recommend one over the other officially and has supported both from day one back in 2007. Arguments which one to prefer can be made in either direction: Points in favor of libnss: - It's the default value in the NM build system, so it would be the preferred backend if both are available and we didn't supply any options to the build process - It's probably the more mature of the two, given that it's being used in Mozilla products Points in favor of GnuTLS: - While both backends seem feature-equivalent, the _nm_crypto_verify_pkcs8 function is stubbed out in the libnss code[1]. - Both Debian and Fedora explicitly select GnuTLS in their packages. At least in the case of Fedora it seems to have been a conscious choice[2]. Given what it's actually used for in the code base, the choice does not matter a lot. However, since it is marginally more feature-complete and seems to be preferred by other distributions, let's switch to GnuTLS. [1] https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/blob/36f8de25c487fe1570a19fe917c85ec065b0339e/src/libnm-crypto/nm-crypto-nss.c#L523-540 [2] https://src.fedoraproject.org/rpms/NetworkManager/c/29a9c41beafb5e549c10bfb50ee23ee47bdbc42f?branch=rawhide Signed-off-by: Florian Larysch Reviewed-by: Marcus Hoffmann Signed-off-by: Marcus Hoffmann --- package/network-manager/network-manager.mk | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/package/network-manager/network-manager.mk b/package/network-manager/network-manager.mk index faf162f6f3..76f4b09fbe 100644 --- a/package/network-manager/network-manager.mk +++ b/package/network-manager/network-manager.mk @@ -77,12 +77,12 @@ else NETWORK_MANAGER_CONF_OPTS += -Dconcheck=false endif -ifeq ($(BR2_PACKAGE_LIBNSS),y) -NETWORK_MANAGER_DEPENDENCIES += libnss -NETWORK_MANAGER_CONF_OPTS += -Dcrypto=nss -else ifeq ($(BR2_PACKAGE_GNUTLS),y) +ifeq ($(BR2_PACKAGE_GNUTLS),y) NETWORK_MANAGER_DEPENDENCIES += gnutls NETWORK_MANAGER_CONF_OPTS += -Dcrypto=gnutls +else ifeq ($(BR2_PACKAGE_LIBNSS),y) +NETWORK_MANAGER_DEPENDENCIES += libnss +NETWORK_MANAGER_CONF_OPTS += -Dcrypto=nss else NETWORK_MANAGER_CONF_OPTS += -Dcrypto=null endif