@matheusbsbs / matheus-bagliano / commits / 35898ad24d

Makefile: use sha1collisiondetection by default on OSX and Darwin

When the sha1collisiondetection library was added and made the default in [1] the interaction with APPLE_COMMON_CRYPTO added in [2] and [3] seems to have been missed. On modern OSX and Darwin we are able to use Apple's CommonCrypto both for SHA-1, and as a generic (but partial) OpenSSL replacement. This left OSX and Darwin without protection against the SHAttered attack when building Git in its default configuration. Let's also use sha1collisiondetection on OSX, to do so we'll need to split up the "APPLE_COMMON_CRYPTO" flag into that flag and a new "APPLE_COMMON_CRYPTO_SHA1". Because of this we can stop conflating whether we want to use Apple's CommonCrypto at all, and whether we want to use it for SHA-1. This makes the CI recipe added in [4] simpler. 1. e6b07da2780 (Makefile: make DC_SHA1 the default, 2017-03-17) 2. 4dcd7732db0 (Makefile: add support for Apple CommonCrypto facility, 2013-05-19) 3. 61067954ce1 (cache.h: eliminate SHA-1 deprecation warnings on Mac OS X, 2013-05-19) 4. 1ad5c3df35a (ci: use DC_SHA1=YesPlease on osx-clang job for CI, 2022-10-20) Signed-off-by: Ævar Arnfjörð Bjarmason <avarab@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Ævar Arnfjörð Bjarmason committed Dec 15, 2022 at 09:43 UTC 35898ad24d83317135d7fdad601dc17375ac373e
2 files changed +5 -8
Makefile
+4 -6
@@ -511,10 +511,8 @@ include shared.mak
511 # Define BLK_SHA1 to make use of optimized C SHA-1 routines bundled
512 # with git (in the block-sha1/ directory).
513 #
514 -# Define NO_APPLE_COMMON_CRYPTO on OSX to opt-out of using the
515 -# "APPLE_COMMON_CRYPTO" backend for SHA-1, which is currently the
516 -# default on that OS. On macOS 01.4 (Tiger) or older,
517 -# NO_APPLE_COMMON_CRYPTO is defined by default.
514 +# Define APPLE_COMMON_CRYPTO_SHA1 to use Apple's CommonCrypto for
515 +# SHA-1.
516 #
517 # If don't enable any of the *_SHA1 settings in this section, Git will
518 # default to its built-in sha1collisiondetection library, which is a
@@ -1912,7 +1910,7 @@ ifdef NO_POSIX_GOODIES
1910 BASIC_CFLAGS += -DNO_POSIX_GOODIES
1911 endif
1912
1915 -ifdef APPLE_COMMON_CRYPTO
1913 +ifdef APPLE_COMMON_CRYPTO_SHA1
1914 # Apple CommonCrypto requires chunking
1915 SHA1_MAX_BLOCK_SIZE = 1024L*1024L*1024L
1916 endif
@@ -1929,7 +1927,7 @@ ifdef BLK_SHA1
1927 LIB_OBJS += block-sha1/sha1.o
1928 BASIC_CFLAGS += -DSHA1_BLK
1929 else
1932 -ifdef APPLE_COMMON_CRYPTO
1930 +ifdef APPLE_COMMON_CRYPTO_SHA1
1931 COMPAT_CFLAGS += -DCOMMON_DIGEST_FOR_OPENSSL
1932 BASIC_CFLAGS += -DSHA1_APPLE
1933 else
ci/lib.sh
+1 -2
@@ -258,8 +258,7 @@ macos-*)
258 MAKEFLAGS="$MAKEFLAGS PYTHON_PATH=$(which python3)"
259 else
260 MAKEFLAGS="$MAKEFLAGS PYTHON_PATH=$(which python2)"
261 - MAKEFLAGS="$MAKEFLAGS NO_APPLE_COMMON_CRYPTO=NoThanks"
262 - MAKEFLAGS="$MAKEFLAGS NO_OPENSSL=NoThanks"
261 + MAKEFLAGS="$MAKEFLAGS APPLE_COMMON_CRYPTO_SHA1=Yes"
262 fi
263 ;;
264 esac