Skip to content

Commit 94fc83b

Browse files
tiennoutiennou
committed
cmake: Modulize our TLS & hash detection
The interactions between `USE_HTTPS` and `SHA1_BACKEND` have been streamlined. Previously we would have accepted not quite working configurations (like, `-DUSE_HTTPS=OFF -DSHA1_BACKEND=OpenSSL`) and, as the OpenSSL detection only ran with `USE_HTTPS`, the link would fail. The detection was moved to a new `USE_SHA1`, modeled after `USE_HTTPS`, which takes the values "CollisionDetection/Backend/Generic", to better match how the "hashing backend" is selected, the default (ON) being "CollisionDetection". Note that, as `SHA1_BACKEND` is still used internally, you might need to check what customization you're using it for.
1 parent 231ccbe commit 94fc83b

File tree

7 files changed

+204
-173
lines changed

7 files changed

+204
-173
lines changed

‎CMakeLists.txt‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -52,11 +52,9 @@ OPTION(TAGS "Generate tags" OFF)
5252
OPTION(PROFILE "Generate profiling information" OFF)
5353
OPTION(ENABLE_TRACE "Enables tracing support" OFF)
5454
OPTION(LIBGIT2_FILENAME "Name of the produced binary" OFF)
55-
56-
SET(SHA1_BACKEND "CollisionDetection" CACHE STRING
57-
"Backend to use for SHA1. One of Generic, OpenSSL, Win32, CommonCrypto, mbedTLS, CollisionDetection.")
5855
OPTION(USE_SSH "Link with libssh2 to enable SSH support" ON)
5956
OPTION(USE_HTTPS "Enable HTTPS support. Can be set to a specific backend" ON)
57+
OPTION(USE_SHA1 "Enable SHA1. Can be set to CollisionDetection(ON)/HTTPS/Generic" ON)
6058
OPTION(USE_GSSAPI "Link with libgssapi for SPNEGO auth" OFF)
6159
OPTION(USE_STANDALONE_FUZZERS "Enable standalone fuzzers (compatible with gcc)" OFF)
6260
OPTION(VALGRIND "Configure build for valgrind" OFF)

‎azure-pipelines.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ jobs:
2929
imageName: 'libgit2/trusty-amd64:latest'
3030
environmentVariables: |
3131
CC=gcc
32-
CMAKE_OPTIONS=-DUSE_HTTPS=mbedTLS -DSHA1_BACKEND=mbedTLS -DDEPRECATE_HARD=ON
32+
CMAKE_OPTIONS=-DUSE_HTTPS=mbedTLS -DUSE_SHA1=HTTPS -DDEPRECATE_HARD=ON
3333
LEAK_CHECK=valgrind
3434
3535
- job: linux_amd64_trusty_clang_openssl
@@ -55,7 +55,7 @@ jobs:
5555
imageName: 'libgit2/trusty-amd64:latest'
5656
environmentVariables: |
5757
CC=clang
58-
CMAKE_OPTIONS=-DUSE_HTTPS=mbedTLS -DSHA1_BACKEND=mbedTLS -DREGEX_BACKEND=pcre -DDEPRECATE_HARD=ON
58+
CMAKE_OPTIONS=-DUSE_HTTPS=mbedTLS -DUSE_SHA1=HTTPS -DREGEX_BACKEND=pcre -DDEPRECATE_HARD=ON
5959
LEAK_CHECK=valgrind
6060
6161
- job: macos

‎azure-pipelines/nightly.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ jobs:
2626
imageName: 'libgit2/trusty-amd64:latest'
2727
environmentVariables: |
2828
CC=gcc
29-
CMAKE_OPTIONS=-DUSE_HTTPS=mbedTLS -DSHA1_BACKEND=mbedTLS -DDEPRECATE_HARD=ON
29+
CMAKE_OPTIONS=-DUSE_HTTPS=mbedTLS -DUSE_SHA1=HTTPS -DDEPRECATE_HARD=ON
3030
LEAK_CHECK=valgrind
3131
RUN_INVASIVE_TESTS=true
3232
@@ -54,7 +54,7 @@ jobs:
5454
imageName: 'libgit2/trusty-amd64:latest'
5555
environmentVariables: |
5656
CC=clang
57-
CMAKE_OPTIONS=-DUSE_HTTPS=mbedTLS -DSHA1_BACKEND=mbedTLS -DREGEX_BACKEND=pcre -DDEPRECATE_HARD=ON
57+
CMAKE_OPTIONS=-DUSE_HTTPS=mbedTLS -DUSE_SHA1=HTTPS -DREGEX_BACKEND=pcre -DDEPRECATE_HARD=ON
5858
LEAK_CHECK=valgrind
5959
RUN_INVASIVE_TESTS=true
6060

‎cmake/Modules/SelectHTTPSBackend.cmake‎

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
# Select the backend to use
2+
3+
# We try to find any packages our backends might use
4+
FIND_PACKAGE(OpenSSL)
5+
FIND_PACKAGE(mbedTLS)
6+
IF (CMAKE_SYSTEM_NAME MATCHES "Darwin")
7+
FIND_PACKAGE(Security)
8+
FIND_PACKAGE(CoreFoundation)
9+
ENDIF()
10+
11+
# Auto-select TLS backend
12+
IF (USE_HTTPS STREQUAL ON)
13+
message(ON)
14+
IF (SECURITY_FOUND)
15+
IF (SECURITY_HAS_SSLCREATECONTEXT)
16+
SET(HTTPS_BACKEND "SecureTransport")
17+
ELSE()
18+
MESSAGE("-- Security framework is too old, falling back to OpenSSL")
19+
SET(HTTPS_BACKEND "OpenSSL")
20+
ENDIF()
21+
ELSEIF (WINHTTP)
22+
SET(HTTPS_BACKEND "WinHTTP")
23+
ELSEIF(OPENSSL_FOUND)
24+
SET(HTTPS_BACKEND "OpenSSL")
25+
ELSEIF(MBEDTLS_FOUND)
26+
SET(HTTPS_BACKEND "mbedTLS")
27+
ELSE()
28+
MESSAGE(FATAL_ERROR "Unable to autodetect a usable HTTPS backend."
29+
"Please pass the backend name explicitly (-DUSE_HTTPS=backend)")
30+
ENDIF()
31+
ELSEIF(USE_HTTPS)
32+
message(expl)
33+
# HTTPS backend was explicitly set
34+
SET(HTTPS_BACKEND ${USE_HTTPS})
35+
ELSE()
36+
SET(HTTPS_BACKEND NO)
37+
ENDIF()
38+
39+
IF(HTTPS_BACKEND)
40+
# Check that we can find what's required for the selected backend
41+
IF (HTTPS_BACKEND STREQUAL "SecureTransport")
42+
IF (NOT COREFOUNDATION_FOUND)
43+
MESSAGE(FATAL_ERROR "Cannot use SecureTransport backend, CoreFoundation.framework not found")
44+
ENDIF()
45+
IF (NOT SECURITY_FOUND)
46+
MESSAGE(FATAL_ERROR "Cannot use SecureTransport backend, Security.framework not found")
47+
ENDIF()
48+
IF (NOT SECURITY_HAS_SSLCREATECONTEXT)
49+
MESSAGE(FATAL_ERROR "Cannot use SecureTransport backend, SSLCreateContext not supported")
50+
ENDIF()
51+
52+
SET(GIT_SECURE_TRANSPORT 1)
53+
LIST(APPEND LIBGIT2_SYSTEM_INCLUDES ${SECURITY_INCLUDE_DIR})
54+
LIST(APPEND LIBGIT2_LIBS ${COREFOUNDATION_LIBRARIES} ${SECURITY_LIBRARIES})
55+
LIST(APPEND LIBGIT2_PC_LIBS ${COREFOUNDATION_LDFLAGS} ${SECURITY_LDFLAGS})
56+
ELSEIF (HTTPS_BACKEND STREQUAL "OpenSSL")
57+
IF (NOT OPENSSL_FOUND)
58+
MESSAGE(FATAL_ERROR "Asked for OpenSSL TLS backend, but it wasn't found")
59+
ENDIF()
60+
61+
SET(GIT_OPENSSL 1)
62+
LIST(APPEND LIBGIT2_SYSTEM_INCLUDES ${OPENSSL_INCLUDE_DIR})
63+
LIST(APPEND LIBGIT2_LIBS ${OPENSSL_LIBRARIES})
64+
LIST(APPEND LIBGIT2_PC_LIBS ${OPENSSL_LDFLAGS})
65+
LIST(APPEND LIBGIT2_PC_REQUIRES "openssl")
66+
ELSEIF(HTTPS_BACKEND STREQUAL "mbedTLS")
67+
IF (NOT MBEDTLS_FOUND)
68+
MESSAGE(FATAL_ERROR "Asked for mbedTLS backend, but it wasn't found")
69+
ENDIF()
70+
71+
IF(NOT CERT_LOCATION)
72+
MESSAGE("Auto-detecting default certificates location")
73+
IF(CMAKE_SYSTEM_NAME MATCHES Darwin)
74+
# Check for an Homebrew installation
75+
SET(OPENSSL_CMD "/usr/local/opt/openssl/bin/openssl")
76+
ELSE()
77+
SET(OPENSSL_CMD "openssl")
78+
ENDIF()
79+
EXECUTE_PROCESS(COMMAND ${OPENSSL_CMD} version -d OUTPUT_VARIABLE OPENSSL_DIR OUTPUT_STRIP_TRAILING_WHITESPACE)
80+
IF(OPENSSL_DIR)
81+
STRING(REGEX REPLACE "^OPENSSLDIR: \"(.*)\"$" "\\1/" OPENSSL_DIR ${OPENSSL_DIR})
82+
83+
SET(OPENSSL_CA_LOCATIONS
84+
"ca-bundle.pem" # OpenSUSE Leap 42.1
85+
"cert.pem" # Ubuntu 14.04, FreeBSD
86+
"certs/ca-certificates.crt" # Ubuntu 16.04
87+
"certs/ca.pem" # Debian 7
88+
)
89+
FOREACH(SUFFIX IN LISTS OPENSSL_CA_LOCATIONS)
90+
SET(LOC "${OPENSSL_DIR}${SUFFIX}")
91+
IF(NOT CERT_LOCATION AND EXISTS "${OPENSSL_DIR}${SUFFIX}")
92+
SET(CERT_LOCATION ${LOC})
93+
ENDIF()
94+
ENDFOREACH()
95+
ELSE()
96+
MESSAGE("Unable to find OpenSSL executable. Please provide default certificate location via CERT_LOCATION")
97+
ENDIF()
98+
ENDIF()
99+
100+
IF(CERT_LOCATION)
101+
IF(NOT EXISTS ${CERT_LOCATION})
102+
MESSAGE(FATAL_ERROR "Cannot use CERT_LOCATION=${CERT_LOCATION} as it doesn't exist")
103+
ENDIF()
104+
ADD_FEATURE_INFO(CERT_LOCATION ON "using certificates from ${CERT_LOCATION}")
105+
ADD_DEFINITIONS(-DGIT_DEFAULT_CERT_LOCATION="${CERT_LOCATION}")
106+
ENDIF()
107+
108+
SET(GIT_MBEDTLS 1)
109+
LIST(APPEND LIBGIT2_SYSTEM_INCLUDES ${MBEDTLS_INCLUDE_DIR})
110+
LIST(APPEND LIBGIT2_LIBS ${MBEDTLS_LIBRARIES})
111+
# mbedTLS has no pkgconfig file, hence we can't require it
112+
# https://github.com/ARMmbed/mbedtls/issues/228
113+
# For now, pass its link flags as our own
114+
LIST(APPEND LIBGIT2_PC_LIBS ${MBEDTLS_LIBRARIES})
115+
ELSEIF (HTTPS_BACKEND STREQUAL "WinHTTP")
116+
# WinHTTP setup was handled in the WinHTTP-specific block above
117+
ELSE()
118+
MESSAGE(FATAL_ERROR "Asked for backend ${HTTPS_BACKEND} but it wasn't found")
119+
ENDIF()
120+
121+
SET(GIT_HTTPS 1)
122+
ADD_FEATURE_INFO(HTTPS GIT_HTTPS "using ${HTTPS_BACKEND}")
123+
ELSE()
124+
SET(GIT_HTTPS 0)
125+
ADD_FEATURE_INFO(HTTPS NO "")
126+
ENDIF()

‎cmake/Modules/SelectHashes.cmake‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
# Select a hash backend
2+
3+
# USE_SHA1=CollisionDetection(ON)/HTTPS/Generic/OFF
4+
5+
IF(USE_SHA1 STREQUAL ON OR USE_SHA1 STREQUAL "CollisionDetection")
6+
SET(SHA1_BACKEND "CollisionDetection")
7+
ELSEIF(USE_SHA1 STREQUAL "HTTPS")
8+
message("Checking HTTPS backend… ${HTTPS_BACKEND}")
9+
IF(HTTPS_BACKEND STREQUAL "SecureTransport")
10+
SET(SHA1_BACKEND "CommonCrypto")
11+
ELSEIF(HTTPS_BACKEND STREQUAL "WinHTTP")
12+
SET(SHA1_BACKEND "Win32")
13+
ELSEIF(HTTPS_BACKEND)
14+
SET(SHA1_BACKEND ${HTTPS_BACKEND})
15+
ELSE()
16+
ENDIF()
17+
IF(NOT HTTPS_BACKEND)
18+
SET(SHA1_BACKEND "CollisionDetection")
19+
ENDIF()
20+
message(STATUS "Using SHA1 backend ${SHA1_BACKEND}")
21+
ELSEIF(USE_SHA1 STREQUAL "Generic")
22+
SET(SHA1_BACKEND "Generic")
23+
# ELSEIF(NOT USE_SHA1)
24+
ELSE()
25+
MESSAGE(FATAL_ERROR "Invalid value for USE_SHA1: ${USE_SHA1}")
26+
ENDIF()
27+
28+
IF(SHA1_BACKEND STREQUAL "CollisionDetection")
29+
SET(GIT_SHA1_COLLISIONDETECT 1)
30+
ADD_DEFINITIONS(-DSHA1DC_NO_STANDARD_INCLUDES=1)
31+
ADD_DEFINITIONS(-DSHA1DC_CUSTOM_INCLUDE_SHA1_C=\"common.h\")
32+
ADD_DEFINITIONS(-DSHA1DC_CUSTOM_INCLUDE_UBC_CHECK_C=\"common.h\")
33+
FILE(GLOB SRC_SHA1 hash/hash_collisiondetect.c hash/sha1dc/*)
34+
ELSEIF(SHA1_BACKEND STREQUAL "OpenSSL")
35+
# OPENSSL_FOUND should already be set, we're checking HTTPS_BACKEND
36+
37+
SET(GIT_SHA1_OPENSSL 1)
38+
IF(CMAKE_SYSTEM_NAME MATCHES "FreeBSD")
39+
LIST(APPEND LIBGIT2_PC_LIBS "-lssl")
40+
ELSE()
41+
LIST(APPEND LIBGIT2_PC_REQUIRES "openssl")
42+
ENDIF()
43+
ELSEIF(SHA1_BACKEND STREQUAL "CommonCrypto")
44+
SET(GIT_SHA1_COMMON_CRYPTO 1)
45+
ELSEIF(SHA1_BACKEND STREQUAL "mbedTLS")
46+
SET(GIT_SHA1_MBEDTLS 1)
47+
FILE(GLOB SRC_SHA1 hash/hash_mbedtls.c)
48+
LIST(APPEND LIBGIT2_SYSTEM_INCLUDES ${MBEDTLS_INCLUDE_DIR})
49+
LIST(APPEND LIBGIT2_LIBS ${MBEDTLS_LIBRARIES})
50+
# mbedTLS has no pkgconfig file, hence we can't require it
51+
# https://github.com/ARMmbed/mbedtls/issues/228
52+
# For now, pass its link flags as our own
53+
LIST(APPEND LIBGIT2_PC_LIBS ${MBEDTLS_LIBRARIES})
54+
ELSEIF(SHA1_BACKEND STREQUAL "Win32")
55+
SET(GIT_SHA1_WIN32 1)
56+
FILE(GLOB SRC_SHA1 hash/hash_win32.c)
57+
ELSEIF(SHA1_BACKEND STREQUAL "Generic")
58+
FILE(GLOB SRC_SHA1 hash/hash_generic.c)
59+
# ELSEIF(NOT USE_SHA1)
60+
ELSE()
61+
MESSAGE(FATAL_ERROR "Asked for unknown SHA1 backend: ${SHA1_BACKEND}")
62+
ENDIF()
63+
64+
ADD_FEATURE_INFO(SHA ON "using ${SHA1_BACKEND}")

‎docs/changelog.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,13 @@ v0.28 + 1
1010
system http-parser implementation despite incompatibilities, you can
1111
specify `-DUSE_HTTP_PARSER=system` to CMake.
1212

13+
* The interactions between `USE_HTTPS` and `SHA1_BACKEND` have been
14+
streamlined. The detection was moved to a new `USE_SHA1`, modeled after
15+
`USE_HTTPS`, which takes the values "CollisionDetection/Backend/Generic", to
16+
better match how the "hashing backend" is selected, the default (ON) being
17+
"CollisionDetection". If you were using `SHA1_BACKEND` previously, you'll
18+
need to check the value you've used, or switch to the autodetection.
19+
1320
### Changes or improvements
1421

1522
* libgit2 can now correctly cope with URLs where the host contains a colon

0 commit comments

Comments
 (0)