-
Notifications
You must be signed in to change notification settings - Fork 143
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Include embedded BoringSSL into libsoter.a #681
Merged
Merged
Commits on Jul 20, 2020
-
Include embedded BoringSSL into libsoter.a
Currently, when building Themis with embedded BoringSSL (the one from git submodule), the shared library is linked against the BoringSSL static library and it is embedded into the dylib. That way resulting Themis dylib does not depend on the system OpenSSL. Instead it uses the BoringSSL which we build and embed into it. However, right now Themis static library does not include embedded BoringSSL in it. The user is expected to find "libcrypto.a" and "libdecrepit.a" in BoringSSL build directory, distribute them along with "libthemis.a" and "libsoter.a", and include all four libraries when building the application. Why is this an issue? --------------------- This is not particularly convenient since BoringSSL libraries are buried in the BoringSSL build directory, not available in the usual Themis build directory. It is quite possible that developers will forget about them entirely. They are also not included into the packages we build. Furthermore, Soter is built with and expects that particular version of BoringSSL to be linked into the application. While BoringSSL generally does a good job at maintaining ABI compatibility, the user may accidentally link some OpenSSL from their system instead of BoringSSL that was built with Themis. This may break in a subtle way. How we resolve it ----------------- In order to avoid all those issues, let's embed BoringSSL into Soter static library, like we do with the shared library. That way the users will have to link only against "libthemis.a" and "libsoter.a". Note that this is actual only for the case when we are building Themis with embedded BoringSSL. That is, the BoringSSL we provide in submodule. We should not embed system OpenSSL, or any BoringSSL built and provided by the user. In that case the users are expected to take care of the cryptography provider library themselves. On portability -------------- Unfortunately, one does not simply merge static libraries. The usual "ar" tool cannot do that: if you mention *.o files and *.a files it will simply include *.a files into the archive as is and it will confuse the linker which unpacks only one layer of static libraries. The other traditional tool which is intended for this use case is "libtool". On macOS is has somewhat sane interface and is available on the default system installation. But on Linux systems the GNU libtool is typically used. It has... well... a little bit wacky interface and it is normally used with Autotools. The problem with Autotools is that Themis build system is not expected to bow to their idiosyncrasies. Furthermore, on all distros we support libtool is not available in the default installation. I do not really want to add a new dependency -- **especially** dependency on Autotools -- just for that one use case. So instead of that, here's an utility script which uses "ar" to merge multiple static libraries. It has issues of its own, but at least it's portable and should work on any UNIX-like system out of the box. On symbol conficts ------------------ As a final note, embedding BoringSSL into the static library has some consequences. Because of the way static linkage and static libraries work, this means that "libsoter.a" provides BoringSSL symbols which may conflict with and/or shadow other BoringSSL or OpenSSL symbols. This changeset does not do anything about it. Like before, this is the issue that the users have to solve themselves. Though, we can still do something about it later if we manage to use BoringSSL symbol prefixes.
Configuration menu - View commit details
-
Copy full SHA for 3d5c400 - Browse repository at this point
Copy the full SHA 3d5c400View commit details
Commits on Jul 21, 2020
-
Instead of the usual "#!/bin/bash" shebang, use "#!/usr/bin/env bash" so that the script is executed with whatever Bash is in PATH. This makes the script a bit more flexible.
Configuration menu - View commit details
-
Copy full SHA for 467d674 - Browse repository at this point
Copy the full SHA 467d674View commit details -
Avoid copying library for extraction
@shad has found a nice hack to convert a path into an absolute one. Use it to avoid copying libraries around for "ar" which can extract files only into the current directory. Co-authored-by: Dmytro Shapovalov <[email protected]>
Configuration menu - View commit details
-
Copy full SHA for 63c78bc - Browse repository at this point
Copy the full SHA 63c78bcView commit details -
Add "scripts" directory to libthemis-src
libthemis-src crate needs full source code of Themis as in performs builds. This includes all build dependencies, such as newly added script for merging static libraries. Add a symlink to the script directory to include it into libthemis-src distribution.
Configuration menu - View commit details
-
Copy full SHA for c241a4c - Browse repository at this point
Copy the full SHA c241a4cView commit details -
Avoid duplicate linkage of embedded BoringSSL
Since now we include BoringSSL into "libsoter.a" if needed, we don't have to mention in Soter dependencies for static linkage anymore. This is particularly important for WasmThemis.
Configuration menu - View commit details
-
Copy full SHA for 10a2e9f - Browse repository at this point
Copy the full SHA 10a2e9fView commit details
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.