# [PATCH v8 0/3] Begin replacing OpenSSL with CommonCrypto 8 messages from 2013-05-19 to 2013-05-21. Participants: Eric Sunshine, Junio C Hamano, Torsten Bögershausen, Jonathan Nieder, David Aguilar. Thread: https://gitlist.dev/t/33867 ## Eric Sunshine, 2013-05-19 10:23 Subject: [PATCH v8 0/3] Begin replacing OpenSSL with CommonCrypto Message-ID: <1368959016-23146-1-git-send-email-sunshine@sunshineco.com> URL: https://gitlist.dev/e/1368959016-23146-1-git-send-email-sunshine%40sunshineco.com ``` This is a re-roll of David Aguilar's patch series [1] which eliminates some of the OpenSSL deprecation warnings on Mac OS X. Changes since v7: - Avoid double-negation (#ifndef NO_APPLE_COMMON_CRYPTO) - Don't break imap-send.c for platforms other than Apple [1]: http://thread.gmane.org/gmane.comp.version-control.git/224744 David Aguilar (3): Makefile: add support for Apple CommonCrypto facility cache.h: eliminate SHA-1 deprecation warnings on Mac OS X imap-send: eliminate HMAC deprecation warnings on Mac OS X Makefile | 14 ++++++++++++++ imap-send.c | 10 ++++++++++ 2 files changed, 24 insertions(+) -- 1.8.2.3 ``` ## Eric Sunshine, 2013-05-19 10:23 Subject: [PATCH v8 1/3] Makefile: add support for Apple CommonCrypto facility Message-ID: <1368959016-23146-2-git-send-email-sunshine@sunshineco.com> URL: https://gitlist.dev/e/1368959016-23146-2-git-send-email-sunshine%40sunshineco.com In-Reply-To: <1368959016-23146-1-git-send-email-sunshine@sunshineco.com> ``` From: David Aguilar As of Mac OS X 10.7, Apple deprecated all OpenSSL functions due to OpenSSL ABI instability, thus leading to build warnings. As a replacement, Apple encourages developers to migrate to its own (stable) CommonCrypto facility. Introduce boilerplate which controls whether Apple's CommonCrypto facility is employed (enabled by default). Also add a NO_APPLE_COMMON_CRYPTO build flag with which the user can opt out to use OpenSSL instead. [es: extracted CommonCrypto-related Makefile boilerplate into separate introductory patch] Signed-off-by: David Aguilar Signed-off-by: Eric Sunshine --- Makefile | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/Makefile b/Makefile index f698c1a..cd24c94 100644 --- a/Makefile +++ b/Makefile @@ -137,6 +137,10 @@ all:: # specify your own (or DarwinPort's) include directories and # library directories by defining CFLAGS and LDFLAGS appropriately. # +# Define NO_APPLE_COMMON_CRYPTO if you are building on Darwin/Mac OS X +# and do not want to use Apple's CommonCrypto library. This allows you +# to provide your own OpenSSL library, for example from MacPorts. +# # Define BLK_SHA1 environment variable to make use of the bundled # optimized C SHA1 routine. # @@ -1054,6 +1058,10 @@ ifeq ($(uname_S),Darwin) BASIC_LDFLAGS += -L/opt/local/lib endif endif + ifndef NO_APPLE_COMMON_CRYPTO + APPLE_COMMON_CRYPTO = YesPlease + COMPAT_CFLAGS += -DAPPLE_COMMON_CRYPTO + endif NO_REGEX = YesPlease PTHREAD_LIBS = endif -- 1.8.2.3 ``` ## Eric Sunshine, 2013-05-19 10:23 Subject: [PATCH v8 2/3] cache.h: eliminate SHA-1 deprecation warnings on Mac OS X Message-ID: <1368959016-23146-3-git-send-email-sunshine@sunshineco.com> URL: https://gitlist.dev/e/1368959016-23146-3-git-send-email-sunshine%40sunshineco.com In-Reply-To: <1368959016-23146-1-git-send-email-sunshine@sunshineco.com> ``` From: David Aguilar As of Mac OS X 10.7, Apple deprecated all OpenSSL functions due to OpenSSL ABI instability, thus leading to build diagnostics such as: warning: 'SHA1_Init' is deprecated (declared at /usr/include/openssl/sha.h:121) Silence the warnings by using Apple's CommonCrypto SHA-1 replacement functions for SHA1_Init(), SHA1_Update(), and SHA1_Final(). COMMON_DIGEST_FOR_OPENSSL is defined to instruct to provide compatibility macros associating OpenSSL SHA-1 functions with their CommonCrypto counterparts. [es: reworded commit message] Signed-off-by: David Aguilar Signed-off-by: Eric Sunshine --- Makefile | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/Makefile b/Makefile index cd24c94..5e7cadf 100644 --- a/Makefile +++ b/Makefile @@ -1397,10 +1397,16 @@ ifdef PPC_SHA1 LIB_OBJS += ppc/sha1.o ppc/sha1ppc.o LIB_H += ppc/sha1.h else +ifdef APPLE_COMMON_CRYPTO + COMPAT_CFLAGS += -DCOMMON_DIGEST_FOR_OPENSSL + SHA1_HEADER = +else SHA1_HEADER = EXTLIBS += $(LIB_4_CRYPTO) endif endif +endif + ifdef NO_PERL_MAKEMAKER export NO_PERL_MAKEMAKER endif -- 1.8.2.3 ``` ## Eric Sunshine, 2013-05-19 10:23 Subject: [PATCH v8 3/3] imap-send: eliminate HMAC deprecation warnings on Mac OS X Message-ID: <1368959016-23146-4-git-send-email-sunshine@sunshineco.com> URL: https://gitlist.dev/e/1368959016-23146-4-git-send-email-sunshine%40sunshineco.com In-Reply-To: <1368959016-23146-1-git-send-email-sunshine@sunshineco.com> ``` From: David Aguilar As of Mac OS X 10.7, Apple deprecated all OpenSSL functions due to OpenSSL ABI instability. Silence the warnings by using Apple's CommonCrypto HMAC replacement functions. [es: reworded commit message; check APPLE_COMMON_CRYPTO instead of abusing COMMON_DIGEST_FOR_OPENSSL] Signed-off-by: David Aguilar Signed-off-by: Eric Sunshine --- Junio Hamano writes: > Doesn't this mean people on platforms that do not care what Apple > does have to define NO_APPLE_COMMON_CRYPTO? It certainly does break other platforms. Thanks for catching. > How about stopping this double-negation and do it more like this? Double-negation begone. imap-send.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/imap-send.c b/imap-send.c index d9bcfb4..8ea180f 100644 --- a/imap-send.c +++ b/imap-send.c @@ -29,8 +29,18 @@ #ifdef NO_OPENSSL typedef void *SSL; #else +#ifdef APPLE_COMMON_CRYPTO +#include +#define HMAC_CTX CCHmacContext +#define HMAC_Init(hmac, key, len, algo) CCHmacInit(hmac, algo, key, len) +#define HMAC_Update CCHmacUpdate +#define HMAC_Final(hmac, hash, ptr) CCHmacFinal(hmac, hash) +#define HMAC_CTX_cleanup +#define EVP_md5() kCCHmacAlgMD5 +#else #include #include +#endif #include #endif -- 1.8.2.3 ``` ## Junio C Hamano, 2013-05-20 22:52 Subject: Re: [PATCH v8 0/3] Begin replacing OpenSSL with CommonCrypto Message-ID: <7vfvxhs1pz.fsf@alter.siamese.dyndns.org> URL: https://gitlist.dev/e/7vfvxhs1pz.fsf%40alter.siamese.dyndns.org In-Reply-To: <1368959016-23146-1-git-send-email-sunshine@sunshineco.com> ``` Thanks, will replace da/darwin with this round. ``` ## Torsten Bögershausen, 2013-05-21 19:19 Subject: Re: [PATCH v8 0/3] Begin replacing OpenSSL with CommonCrypto Message-ID: <519BC8B0.5050100@web.de> URL: https://gitlist.dev/e/519BC8B0.5050100%40web.de In-Reply-To: <7vfvxhs1pz.fsf@alter.siamese.dyndns.org> ``` On 2013-05-21 00.52, Junio C Hamano wrote: > Thanks, will replace da/darwin with this round. (May be late response, not sure if this is the right email thread. I eventually managed to compile under 10.6, what we have on pu) One minor nit, or 2: imap-send.c: In function ‘cram’: imap-send.c:913: warning: statement with no effect This fixes it: diff --git a/imap-send.c b/imap-send.c index 8ea180f..11577c9 100644 --- a/imap-send.c +++ b/imap-send.c @@ -35,7 +35,7 @@ typedef void *SSL; #define HMAC_Init(hmac, key, len, algo) CCHmacInit(hmac, algo, key, len) #define HMAC_Update CCHmacUpdate #define HMAC_Final(hmac, hash, ptr) CCHmacFinal(hmac, hash) -#define HMAC_CTX_cleanup +#define HMAC_CTX_cleanup(c) #define EVP_md5() kCCHmacAlgMD5 #else #include (And I think there are more minor nits: #define HMAC_Final(hmac, hash, ptr) CCHmacFinal(hmac, hash) could be written as #define HMAC_Final(hmac, hash, ptr) CCHmacFinal((hmac), (hash)) (Use paranthese around each parameter) Similar change for HMAC_Init() /Torsten ``` ## Jonathan Nieder, 2013-05-21 19:36 Subject: Re: [PATCH v8 0/3] Begin replacing OpenSSL with CommonCrypto Message-ID: <20130521193616.GU3657@google.com> URL: https://gitlist.dev/e/20130521193616.GU3657%40google.com In-Reply-To: <519BC8B0.5050100@web.de> ``` Torsten Bögershausen wrote: > One minor nit, or 2: > imap-send.c: In function ‘cram’: > imap-send.c:913: warning: statement with no effect > > This fixes it: > > diff --git a/imap-send.c b/imap-send.c > index 8ea180f..11577c9 100644 > --- a/imap-send.c > +++ b/imap-send.c > @@ -35,7 +35,7 @@ typedef void *SSL; > #define HMAC_Init(hmac, key, len, algo) CCHmacInit(hmac, algo, key, len) > #define HMAC_Update CCHmacUpdate > #define HMAC_Final(hmac, hash, ptr) CCHmacFinal(hmac, hash) > -#define HMAC_CTX_cleanup > +#define HMAC_CTX_cleanup(c) > #define EVP_md5() kCCHmacAlgMD5 > #else > #include Good catch. Thanks. > (And I think there are more minor nits: > #define HMAC_Final(hmac, hash, ptr) CCHmacFinal(hmac, hash) > could be written as > #define HMAC_Final(hmac, hash, ptr) CCHmacFinal((hmac), (hash)) > (Use paranthese around each parameter) > Similar change for HMAC_Init() Not needed --- the comma operator has lower precedence than any other, and any expression containing commas would have to already be surrounded by parentheses to be an argument to this function-like macro. Jonathan ``` ## David Aguilar, 2013-05-21 22:39 Subject: Re: [PATCH v8 0/3] Begin replacing OpenSSL with CommonCrypto Message-ID: URL: https://gitlist.dev/e/CAJDDKr61R0aPFWT%3DvNz3nSvR-1azTG3Zox%3DwAO7rB_iCvxhdZg%40mail.gmail.com In-Reply-To: <519BC8B0.5050100@web.de> ``` On Tue, May 21, 2013 at 12:19 PM, Torsten Bögershausen wrote: > On 2013-05-21 00.52, Junio C Hamano wrote: >> Thanks, will replace da/darwin with this round. > (May be late response, not sure if this is the right email thread. > I eventually managed to compile under 10.6, what we have on pu) > > One minor nit, or 2: > imap-send.c: In function ‘cram’: > imap-send.c:913: warning: statement with no effect > > This fixes it: > > diff --git a/imap-send.c b/imap-send.c > index 8ea180f..11577c9 100644 > --- a/imap-send.c > +++ b/imap-send.c > @@ -35,7 +35,7 @@ typedef void *SSL; > #define HMAC_Init(hmac, key, len, algo) CCHmacInit(hmac, algo, key, len) > #define HMAC_Update CCHmacUpdate > #define HMAC_Final(hmac, hash, ptr) CCHmacFinal(hmac, hash) > -#define HMAC_CTX_cleanup > +#define HMAC_CTX_cleanup(c) > #define EVP_md5() kCCHmacAlgMD5 > #else > #include Thanks. This change compiles fine on Mountain Lion (10.8) as well. -- David ```