* [Buildroot] [PATCH v2 1/2] package: openscap: fix build failure when crypto backend is not gcrypt
2026-09-07 13:47 [Buildroot] [PATCH v2 0/2] package/openscap: fix and test build failure related to crypto Alexis Lothoré via buildroot
@ 2026-09-07 13:47 ` Alexis Lothoré via buildroot
2026-09-07 13:47 ` [Buildroot] [PATCH v2 2/2] support/testing: add tests for openscap Alexis Lothoré via buildroot
1 sibling, 0 replies; 3+ messages in thread
From: Alexis Lothoré via buildroot @ 2026-09-07 13:47 UTC (permalink / raw)
To: buildroot; +Cc: Thomas Petazzoni, Alexis Lothoré
When enabling the openscap package and the libnss library _but not_
libgcrypt, the build can fail on the following error:
../src/libopenscap.so.33.1.3: undefined reference to `crapi_init'
The issue is due to the fact that the corresponding Makefile
systematically forces -DWITH_CRYPTO=gcrypt: openscap CMake
instrumentation then searches only this backend, fails to find it,
assumes that no crypto backend is available, and so does not include the
crapi_object in the final link step.
Commit 7c85f3adf4a8 ("package/openscap: new package") took into account
the fact that openscap isn't currently able to build if no crypto backend
is provided (see [0]), and so made sure to force libgcrypt inclusion if
libnss is not included. Since then, two fixes ([1] and [2]) have been
integrated upstream to allow building openscap with any backend.
Do not systematically enforce libgcrypt anymore through WITH_CRYPTO:
rather than testing nss presence, and falling back to libgcrypt, allow
both to be absent, and so relax the libgcrypt dependency to make it
optional as well. Bring the two upstream patches allowing openscap build
without any crypto backend. Those patches can be dropped once openscap
v1.4.5 is released.
[0] https://github.com/OpenSCAP/openscap/issues/2310
[1] https://github.com/OpenSCAP/openscap/commit/d12d820a9493b0a0ee1ad4b0aeaa87da28aa0080
[2] https://github.com/OpenSCAP/openscap/commit/5b858d1786c025cbd50dfc284b252c3ee6dd99dc
Fixes: https://autobuild.buildroot.org/results/4c905c1b0ee384149c3d85e8f2ebf0af3a12c2ad/
Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
---
.../0001-Fix-build-without-crypto-support.patch | 57 ++++++++++++++++++++++
...gcrypt-cmake-variables-if-gcrypt-is-not-f.patch | 50 +++++++++++++++++++
package/openscap/Config.in | 5 --
package/openscap/openscap.mk | 9 ++--
4 files changed, 110 insertions(+), 11 deletions(-)
diff --git a/package/openscap/0001-Fix-build-without-crypto-support.patch b/package/openscap/0001-Fix-build-without-crypto-support.patch
new file mode 100644
index 000000000000..97da60f032a3
--- /dev/null
+++ b/package/openscap/0001-Fix-build-without-crypto-support.patch
@@ -0,0 +1,57 @@
+From d12d820a9493b0a0ee1ad4b0aeaa87da28aa0080 Mon Sep 17 00:00:00 2001
+From: Eljees <yurytumanov.r@yandex.ru>
+Date: Mon, 27 Jul 2026 06:57:38 +0300
+Subject: [PATCH] Fix build without crypto support
+
+Upstream: https://github.com/OpenSCAP/openscap/commit/d12d820a9493b0a0ee1ad4b0aeaa87da28aa0080
+Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
+---
+ src/CMakeLists.txt | 2 +-
+ src/OVAL/probes/CMakeLists.txt | 2 +-
+ src/OVAL/probes/crapi/CMakeLists.txt | 7 ++++++-
+ 3 files changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
+index 5d59bf3f036f..f31ce8040e0a 100644
+--- a/src/CMakeLists.txt
++++ b/src/CMakeLists.txt
+@@ -59,7 +59,7 @@ if (ENABLE_PROBES)
+ )
+ endif()
+ endif()
+-if (HAVE_MMAN_H AND (GCRYPT_FOUND OR NSS_FOUND))
++if (HAVE_MMAN_H)
+ list(APPEND OBJECTS_TO_LINK_AGAINST
+ $<TARGET_OBJECTS:crapi_object>
+ )
+diff --git a/src/OVAL/probes/CMakeLists.txt b/src/OVAL/probes/CMakeLists.txt
+index e505908f5842..25e3ca56a0c3 100644
+--- a/src/OVAL/probes/CMakeLists.txt
++++ b/src/OVAL/probes/CMakeLists.txt
+@@ -1,7 +1,7 @@
+ add_subdirectory("SEAP")
+ add_subdirectory("probe")
+
+-if (HAVE_MMAN_H AND CRYPTO_FOUND)
++if (HAVE_MMAN_H)
+ add_subdirectory("crapi")
+ endif()
+
+diff --git a/src/OVAL/probes/crapi/CMakeLists.txt b/src/OVAL/probes/crapi/CMakeLists.txt
+index 1f3e5a963bbf..3fb6f123c8d6 100644
+--- a/src/OVAL/probes/crapi/CMakeLists.txt
++++ b/src/OVAL/probes/crapi/CMakeLists.txt
+@@ -1,4 +1,9 @@
+-file(GLOB_RECURSE CRAPI_SOURCES "*.c")
++if (CRYPTO_FOUND)
++ file(GLOB_RECURSE CRAPI_SOURCES "*.c")
++else()
++ # crapi_init has a no-op implementation for builds without a digest backend.
++ set(CRAPI_SOURCES "crapi.c")
++endif()
+ file(GLOB_RECURSE CRAPI_HEADERS "*.h")
+
+ add_library(crapi_object OBJECT ${CRAPI_SOURCES} ${CRAPI_HEADERS})
+--
+2.55.0
+
diff --git a/package/openscap/0002-Do-not-use-gcrypt-cmake-variables-if-gcrypt-is-not-f.patch b/package/openscap/0002-Do-not-use-gcrypt-cmake-variables-if-gcrypt-is-not-f.patch
new file mode 100644
index 000000000000..d4d3bd2d1653
--- /dev/null
+++ b/package/openscap/0002-Do-not-use-gcrypt-cmake-variables-if-gcrypt-is-not-f.patch
@@ -0,0 +1,50 @@
+From 5b858d1786c025cbd50dfc284b252c3ee6dd99dc Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Alexis=20Lothor=C3=A9?= <alexis.lothore@bootlin.com>
+Date: Tue, 18 Aug 2026 09:38:05 +0200
+Subject: [PATCH] Do not use gcrypt cmake variables if gcrypt is not found
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Commit d12d820a9493 ("Fix build without crypto support") enabled
+building the crapi library without a crypto backend, but left the
+target_include_directories and target_compile_definitions calls
+unguarded. When no crypto library is available, the GCrypt find module
+leaves GCRYPT_INCLUDE_DIRS unset, so CMake fails at the generate step
+with:
+
+ CMake Error: The following variables are used in this project, but
+ they are set to NOTFOUND: GCRYPT_INCLUDE_DIR
+
+The test command provided at this time made the build successful because
+it provided -DCMAKE_DISABLE_FIND_PACKAGE_GCrypt=TRUE, but if no crypto
+backend is provided, it does not make sense to provide those cmake
+configuration options preventing dependency search manually.
+
+Guard both calls with a CRYPTO_FOUND check so they are only applied when
+an actual digest backend is present, even without providing
+-DCMAKE_DISABLE_FIND_PACKAGE_foo
+
+Upstream: https://github.com/OpenSCAP/openscap/commit/5b858d1786c025cbd50dfc284b252c3ee6dd99dc
+Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
+---
+ src/OVAL/probes/crapi/CMakeLists.txt | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/src/OVAL/probes/crapi/CMakeLists.txt b/src/OVAL/probes/crapi/CMakeLists.txt
+index 3fb6f123c8d6..88cb916b6d96 100644
+--- a/src/OVAL/probes/crapi/CMakeLists.txt
++++ b/src/OVAL/probes/crapi/CMakeLists.txt
+@@ -8,5 +8,7 @@ file(GLOB_RECURSE CRAPI_HEADERS "*.h")
+
+ add_library(crapi_object OBJECT ${CRAPI_SOURCES} ${CRAPI_HEADERS})
+ set_oscap_generic_properties(crapi_object)
+-target_include_directories(crapi_object PUBLIC ${NSS_INCLUDE_DIRS} ${GCRYPT_INCLUDE_DIRS})
+-target_compile_definitions(crapi_object PUBLIC ${GCRYPT_DEFINITIONS})
++if (CRYPTO_FOUND)
++ target_include_directories(crapi_object PUBLIC ${NSS_INCLUDE_DIRS} ${GCRYPT_INCLUDE_DIRS})
++ target_compile_definitions(crapi_object PUBLIC ${GCRYPT_DEFINITIONS})
++endif()
+--
+2.55.0
+
diff --git a/package/openscap/Config.in b/package/openscap/Config.in
index 01c628194cc6..45904622848b 100644
--- a/package/openscap/Config.in
+++ b/package/openscap/Config.in
@@ -1,12 +1,8 @@
config BR2_PACKAGE_OPENSCAP
bool "openscap"
- depends on BR2_PACKAGE_LIBGPG_ERROR_ARCH_SUPPORTS # libgcrypt
depends on !BR2_STATIC_LIBS # dlfcn.h
depends on BR2_TOOLCHAIN_HAS_THREADS_NPTL
select BR2_PACKAGE_LIBCURL
- # In theory should build without crypto, but in practice it
- # doesn't: https://github.com/OpenSCAP/openscap/issues/2310
- select BR2_PACKAGE_LIBGCRYPT if !BR2_PACKAGE_LIBNSS
select BR2_PACKAGE_LIBXML2
select BR2_PACKAGE_LIBXSLT
select BR2_PACKAGE_LIBXMLSEC1
@@ -20,5 +16,4 @@ config BR2_PACKAGE_OPENSCAP
https://github.com/OpenSCAP/openscap
comment "openscap needs a toolchain w/ dynamic library, NPTL"
- depends on BR2_PACKAGE_LIBGPG_ERROR_ARCH_SUPPORTS
depends on BR2_STATIC_LIBS || !BR2_TOOLCHAIN_HAS_THREADS_NPTL
diff --git a/package/openscap/openscap.mk b/package/openscap/openscap.mk
index 7da38df345b4..6fbe09771863 100644
--- a/package/openscap/openscap.mk
+++ b/package/openscap/openscap.mk
@@ -22,7 +22,6 @@ OPENSCAP_DEPENDENCIES = \
HOST_OPENSCAP_DEPENDENCIES = \
host-pkgconf \
host-libcurl \
- host-libgcrypt \
host-libxml2 \
host-libxmlsec1 \
host-libxslt \
@@ -36,7 +35,6 @@ OPENSCAP_CONF_OPTS = \
-DENABLE_OSCAP_UTIL_VM=OFF \
-DENABLE_PROBES_WINDOWS=OFF \
-DENABLE_TESTS=OFF \
- -DWITH_CRYPTO=gcrypt \
-DENABLE_PYTHON3=OFF
HOST_OPENSCAP_CONF_OPTS = \
@@ -47,7 +45,6 @@ HOST_OPENSCAP_CONF_OPTS = \
-DENABLE_OSCAP_UTIL_VM=OFF \
-DENABLE_PROBES_WINDOWS=OFF \
-DENABLE_TESTS=OFF \
- -DWITH_CRYPTO=gcrypt \
-DENABLE_PYTHON3=OFF
ifeq ($(BR2_PACKAGE_ACL),y)
@@ -60,10 +57,10 @@ endif
ifeq ($(BR2_PACKAGE_LIBGCRYPT),y)
OPENSCAP_DEPENDENCIES += libgcrypt
-endif
-
-ifeq ($(BR2_PACKAGE_LIBNSS),y)
+OPENSCAP_CONF_OPTS += -DWITH_CRYPTO=gcrypt
+else ifeq ($(BR2_PACKAGE_LIBNSS),y)
OPENSCAP_DEPENDENCIES += libnss
+OPENSCAP_CONF_OPTS += -DWITH_CRYPTO=nss
endif
ifneq ($(BR2_TOOLCHAIN_USES_GLIBC),y)
--
2.55.0
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply related [flat|nested] 3+ messages in thread* [Buildroot] [PATCH v2 2/2] support/testing: add tests for openscap
2026-09-07 13:47 [Buildroot] [PATCH v2 0/2] package/openscap: fix and test build failure related to crypto Alexis Lothoré via buildroot
2026-09-07 13:47 ` [Buildroot] [PATCH v2 1/2] package: openscap: fix build failure when crypto backend is not gcrypt Alexis Lothoré via buildroot
@ 2026-09-07 13:47 ` Alexis Lothoré via buildroot
1 sibling, 0 replies; 3+ messages in thread
From: Alexis Lothoré via buildroot @ 2026-09-07 13:47 UTC (permalink / raw)
To: buildroot; +Cc: Thomas Petazzoni, Alexis Lothoré
Add basic tests for openscap, ensuring that it builds and runs a minimal
command with different cryptographic backends:
- libgcrypt
- libnss
- no crypto backend
Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
---
support/testing/tests/package/test_openscap.py | 63 ++++++++++++++++++++++
.../rootfs-overlay/root/benchmark.xml | 5 ++
2 files changed, 68 insertions(+)
diff --git a/support/testing/tests/package/test_openscap.py b/support/testing/tests/package/test_openscap.py
new file mode 100644
index 000000000000..08527d28aa4d
--- /dev/null
+++ b/support/testing/tests/package/test_openscap.py
@@ -0,0 +1,63 @@
+import os
+
+import infra.basetest
+
+
+class TestOpenSCAPBase(infra.basetest.BRTest):
+ config = """
+ BR2_arm=y
+ BR2_cortex_a8=y
+ BR2_ARM_EABIHF=y
+ BR2_TOOLCHAIN_EXTERNAL=y
+ BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
+ BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_ARMV7_EABIHF_GLIBC_STABLE=y
+ BR2_PACKAGE_OPENSCAP=y
+ BR2_ROOTFS_OVERLAY="{}"
+ BR2_TARGET_ROOTFS_CPIO=y
+ # BR2_TARGET_ROOTFS_TAR is not set
+ """.format(
+ infra.filepath("tests/package/test_openscap/rootfs-overlay"))
+
+ def test_run(self):
+ cpio_file = os.path.join(self.builddir, "images", "rootfs.cpio")
+ self.emulator.boot(
+ arch="armv7",
+ kernel="builtin",
+ options=["-m", "512M", "-initrd", cpio_file],
+ )
+ self.emulator.login()
+
+ out, ret = self.emulator.run("oscap --version")
+ self.assertEqual(ret, 0)
+
+ out, ret = self.emulator.run("oscap info /root/benchmark.xml")
+ self.assertEqual(ret, 0)
+ self.assertIn("Document type: XCCDF Checklist", "\n".join(out))
+
+
+class TestOpenSCAPGcrypt(TestOpenSCAPBase):
+ """Test openscap using the gcrypt crypto backend."""
+
+ config = (
+ TestOpenSCAPBase.config
+ + """
+ BR2_PACKAGE_LIBGCRYPT=y
+ """
+ )
+
+
+class TestOpenSCAPNss(TestOpenSCAPBase):
+ """Test openscap using the nss crypto backend."""
+
+ config = (
+ TestOpenSCAPBase.config
+ + """
+ BR2_PACKAGE_LIBNSS=y
+ """
+ )
+
+
+class TestOpenSCAPNoCrypto(TestOpenSCAPBase):
+ """Test openscap without any crypto backend."""
+
+ config = TestOpenSCAPBase.config
diff --git a/support/testing/tests/package/test_openscap/rootfs-overlay/root/benchmark.xml b/support/testing/tests/package/test_openscap/rootfs-overlay/root/benchmark.xml
new file mode 100644
index 000000000000..aac0f1e0fa9a
--- /dev/null
+++ b/support/testing/tests/package/test_openscap/rootfs-overlay/root/benchmark.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<xccdf:Benchmark xmlns:xccdf="http://checklists.nist.gov/xccdf/1.2" id="xccdf_org.buildroot.benchmark">
+ <xccdf:status>accepted</xccdf:status>
+ <xccdf:version>1.0</xccdf:version>
+</xccdf:Benchmark>
--
2.55.0
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply related [flat|nested] 3+ messages in thread