[PATCH] Makefile: use sha1collisiondetection by default on OSX and Darwin

When the sha1collisiondetection library was added and made the default in [1] the interaction with APPLE_COMMON_CRYPTO added in [2] and [3] seems to have been missed. On modern OSX and Darwin we are able to use Apple's CommonCrypto both for SHA-1, and as a generic (but partial) OpenSSL replacement.

This left OSX and Darwin without protection against the SHAttered attack when building Git in its default configuration.

Let's also use sha1collisiondetection on OSX, to do so we'll need to split up the "APPLE_COMMON_CRYPTO" flag into that flag and a new "APPLE_COMMON_CRYPTO_SHA1".

Let's also change the CI for "osx-clang" to test with the new APPLE_COMMON_CRYPTO_SHA1 knob ("osx-gcc" uses the new sha1collisiondetection default).

In practice this will spot issues like the one noted in [4], as testing with just two backends should be enough to spot unportable code. Ideally we'd have other CI jobs to test the various SHA-1 combinations, but for now we have better CI coverage than before.

1. e6b07da2780 (Makefile: make DC_SHA1 the default, 2017-03-17)
2. 4dcd7732db0 (Makefile: add support for Apple CommonCrypto facility, 2013-05-19)
3. 61067954ce1 (cache.h: eliminate SHA-1 deprecation warnings on Mac OS X, 2013-05-19)
4. 32205655dc7 (fsmonitor OSX: compile with DC_SHA1=YesPlease, 2022-10-19)

Signed-off-by: Ævar Arnfjörð Bjarmason <avarab@gmail.com>
---

The 1st hunk here depends on the "base" topic which prepares the docs for this small change: https://lore.kernel.org/git/cover-v3-0.9-00000000000-20221020T223946Z-avarab@gmail.com/

But otherwise this applies on "master".

Junio: I see in the meantime you've queued your own
https://lore.kernel.org/git/cover-v3-0.9-00000000000-20221020T223946Z-avarab@gmail.com/;
which is currently in "seen".

That patch will merge smoothly with this one, both textually and semantically, but if we have this it's all that's needed to flip the default and give us pretty much the same OSX CI coverage.

"Pretty much" because an unstated effect of your patch is to disable all use of the "Apple Common Crypto" library on "osx-clang", which includes (but is not limited to) giving us another SHA-1 backend.

Range-diff: 1: 392fabdb456 < -: ----------- fsmonitor OSX: compile with DC_SHA1=YesPlease 2: 7ae22276aa7 < -: ----------- Makefile: create and use sections for "define" flag listing 3: 78ef8636c57 < -: ----------- Makefile: really use and document sha1collisiondetection by default 4: f1fb9775b33 < -: ----------- Makefile: rephrase the discussion of *_SHA1 knobs -: ----------- > 1: 1f4e39be97b Makefile: use sha1collisiondetection by default on OSX and Darwin

 Makefile  | 10 ++++------
 ci/lib.sh |  3 +++
 2 files changed, 7 insertions(+), 6 deletions(-)