Re: [Buildroot] [PATCH 3/4] package/openscap: add openscap package

From: Thomas Petazzoni via buildroot <buildroot@buildroot.org>
To: "Alexis Lothoré" <alexis.lothore@bootlin.com>
Cc: <tim.hammer@nav-timing.safrangroup.com>,
	<nicolas.carrier@nav-timing.safrangroup.com>,
	<buildroot@buildroot.org>
Subject: Re: [Buildroot] [PATCH 3/4] package/openscap: add openscap package
Date: Thu, 31 Jul 2025 14:48:52 +0200	[thread overview]
Message-ID: <20250731144852.25bb9e9e@windsurf> (raw)
In-Reply-To: <DBQ8SCGP37TS.2V8HRWA7RWPTW@bootlin.com>

On Thu, 31 Jul 2025 14:34:01 +0200
Alexis Lothoré <alexis.lothore@bootlin.com> wrote:

> it looks like gcrypt/nss is not mandatory. But if I try to configure and
> run a build in an environment without libgcrypt, I got same late linkage
> error, about some missing crapi_init (no, I am not making this function's
> name up...) being missing. It appears that there are code paths
> preprocessed conditionnaly on either libgcrypt or nss presence, without any
> fallback if none is found. I am not sure if I am facing some optional
> dependencies that are not "optional enough" in the code base, or some hard
> dpendencies that are not sufficiently enforced in the cmake files. But in
> the project current state, the software does not build without libgcrypt.
> 
> If I take a further look at the dev doc
> (https://github.com/OpenSCAP/openscap/blob/main/docs/developer/developer.adoc),
> it seems to hint that libgcrypt is actually needed in any case.

That's fine, we don't expect you to fix all upstream issues :)

However, my concern was not so much about gcrypt being needed, but the
fact that you need openssl *and* libgcrypt. Are both truly needed?

> I'll remove the WITH_CRYPTO=gcrypt though, as it is the default value in
> CMakeLists.txt.

Well, you can keep it explicit, I think it's a good idea.

> 
> > - You're setting ENABLE_PYTHON3=ON, but your target package does not
> >   depend on host-python3 nor python3 in terms of build dependency.
> >   Could you clarify what this ENABLE_PYTHON3 option does?  
> 
> That's an omission on my side. This ENABLE_PYTHON3 allows building some
> bindings (to write some python automation tools based on openscap ?) if the
> interpreter is found. I'll remove it.

Then ENABLE_PYTHON3=OFF is probably better. Generally speaking the more
options are explicitly set, the better.

> > No explicit option to enable/disable ACL support?  
> 
> Unfortunately no, this is searched unconditionally:

OK!

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot