[Buildroot] [PATCH v2 0/2] package/openscap: fix and test build failure related to crypto

[Buildroot] [PATCH v2 0/2] package/openscap: fix and test build failure related to crypto

[Alexis Lothoré via buildroot]

Hello,
this is v2 of a small series aiming to fix an openscap build failure
occuring when no crypto backend is selected (this can currently happen
on master if openscap AND static libs are selected). The initial
revision is a few months old; the upstream openscap project has fixed
the root issue since then (being able to build openscap without any
crypto backend), so the new patch is quite different from the original.
The series now also exposes some small tests to exercize the different
ways of building openscap.

Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
---
Changes in v2:
- go further and allow openscap to build without any crypto backend
- add tests for openscap with different crypto backends
- Link to v1: https://patch.msgid.link/20260616-fix_openscap-v1-1-e02d43887309@bootlin.com

To: buildroot@buildroot.org
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Cc: Alexis Lothoré <alexis.lothore@bootlin.com>

---
Alexis Lothoré (2):
      package: openscap: fix build failure when crypto backend is not gcrypt
      support/testing: add tests for openscap

 .../0001-Fix-build-without-crypto-support.patch    | 57 ++++++++++++++++++++
 ...gcrypt-cmake-variables-if-gcrypt-is-not-f.patch | 50 +++++++++++++++++
 package/openscap/Config.in                         |  5 --
 package/openscap/openscap.mk                       |  9 ++--
 support/testing/tests/package/test_openscap.py     | 63 ++++++++++++++++++++++
 .../rootfs-overlay/root/benchmark.xml              |  5 ++
 6 files changed, 178 insertions(+), 11 deletions(-)
---
base-commit: 87e95b9877ffd29ce9a02399b8a008266a1f5971
change-id: 20260616-fix_openscap-410e397f7257

Best regards,
--  
Alexis Lothoré <alexis.lothore@bootlin.com>

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [PATCH v2 1/2] package: openscap: fix build failure when crypto backend is not gcrypt

[Alexis Lothoré via buildroot]

When enabling the openscap package and the libnss library _but not_
libgcrypt, the build can fail on the following error:

  ../src/libopenscap.so.33.1.3: undefined reference to `crapi_init'

The issue is due to the fact that the corresponding Makefile
systematically forces -DWITH_CRYPTO=gcrypt: openscap CMake
instrumentation then searches only this backend, fails to find it,
assumes that no crypto backend is available, and so does not include the
crapi_object in the final link step.

Commit 7c85f3adf4a8 ("package/openscap: new package") took into account
the fact that openscap isn't currently able to build if no crypto backend
is provided (see [0]), and so made sure to force libgcrypt inclusion if
libnss is not included. Since then, two fixes ([1] and [2]) have been
integrated upstream to allow building openscap with any backend.

Do not systematically enforce libgcrypt anymore through WITH_CRYPTO:
rather than testing nss presence, and falling back to libgcrypt, allow
both to be absent, and so relax the libgcrypt dependency to make it
optional as well. Bring the two upstream patches allowing openscap build
without any crypto backend.  Those patches can be dropped once openscap
v1.4.5 is released.

[0] https://github.com/OpenSCAP/openscap/issues/2310
[1] https://github.com/OpenSCAP/openscap/commit/d12d820a9493b0a0ee1ad4b0aeaa87da28aa0080
[2] https://github.com/OpenSCAP/openscap/commit/5b858d1786c025cbd50dfc284b252c3ee6dd99dc

Fixes: https://autobuild.buildroot.org/results/4c905c1b0ee384149c3d85e8f2ebf0af3a12c2ad/
Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
---
 .../0001-Fix-build-without-crypto-support.patch    | 57 ++++++++++++++++++++++
 ...gcrypt-cmake-variables-if-gcrypt-is-not-f.patch | 50 +++++++++++++++++++
 package/openscap/Config.in                         |  5 --
 package/openscap/openscap.mk                       |  9 ++--
 4 files changed, 110 insertions(+), 11 deletions(-)

diff --git a/package/openscap/0001-Fix-build-without-crypto-support.patch b/package/openscap/0001-Fix-build-without-crypto-support.patch
new file mode 100644
index 000000000000..97da60f032a3
--- /dev/null
+++ b/package/openscap/0001-Fix-build-without-crypto-support.patch
@@ -0,0 +1,57 @@
+From d12d820a9493b0a0ee1ad4b0aeaa87da28aa0080 Mon Sep 17 00:00:00 2001
+From: Eljees <yurytumanov.r@yandex.ru>
+Date: Mon, 27 Jul 2026 06:57:38 +0300
+Subject: [PATCH] Fix build without crypto support
+
+Upstream: https://github.com/OpenSCAP/openscap/commit/d12d820a9493b0a0ee1ad4b0aeaa87da28aa0080
+Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
+---
+ src/CMakeLists.txt                   | 2 +-
+ src/OVAL/probes/CMakeLists.txt       | 2 +-
+ src/OVAL/probes/crapi/CMakeLists.txt | 7 ++++++-
+ 3 files changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
+index 5d59bf3f036f..f31ce8040e0a 100644
+--- a/src/CMakeLists.txt
++++ b/src/CMakeLists.txt
+@@ -59,7 +59,7 @@ if (ENABLE_PROBES)
+ 		)
+ 	endif()
+ endif()
+-if (HAVE_MMAN_H AND (GCRYPT_FOUND OR NSS_FOUND))
++if (HAVE_MMAN_H)
+ 	list(APPEND OBJECTS_TO_LINK_AGAINST
+ 		$<TARGET_OBJECTS:crapi_object>
+ 	)
+diff --git a/src/OVAL/probes/CMakeLists.txt b/src/OVAL/probes/CMakeLists.txt
+index e505908f5842..25e3ca56a0c3 100644
+--- a/src/OVAL/probes/CMakeLists.txt
++++ b/src/OVAL/probes/CMakeLists.txt
+@@ -1,7 +1,7 @@
+ add_subdirectory("SEAP")
+ add_subdirectory("probe")
+ 
+-if (HAVE_MMAN_H AND CRYPTO_FOUND)
++if (HAVE_MMAN_H)
+ 	add_subdirectory("crapi")
+ endif()
+ 
+diff --git a/src/OVAL/probes/crapi/CMakeLists.txt b/src/OVAL/probes/crapi/CMakeLists.txt
+index 1f3e5a963bbf..3fb6f123c8d6 100644
+--- a/src/OVAL/probes/crapi/CMakeLists.txt
++++ b/src/OVAL/probes/crapi/CMakeLists.txt
+@@ -1,4 +1,9 @@
+-file(GLOB_RECURSE CRAPI_SOURCES "*.c")
++if (CRYPTO_FOUND)
++	file(GLOB_RECURSE CRAPI_SOURCES "*.c")
++else()
++	# crapi_init has a no-op implementation for builds without a digest backend.
++	set(CRAPI_SOURCES "crapi.c")
++endif()
+ file(GLOB_RECURSE CRAPI_HEADERS "*.h")
+ 
+ add_library(crapi_object OBJECT ${CRAPI_SOURCES} ${CRAPI_HEADERS})
+-- 
+2.55.0
+
diff --git a/package/openscap/0002-Do-not-use-gcrypt-cmake-variables-if-gcrypt-is-not-f.patch b/package/openscap/0002-Do-not-use-gcrypt-cmake-variables-if-gcrypt-is-not-f.patch
new file mode 100644
index 000000000000..d4d3bd2d1653
--- /dev/null
+++ b/package/openscap/0002-Do-not-use-gcrypt-cmake-variables-if-gcrypt-is-not-f.patch
@@ -0,0 +1,50 @@
+From 5b858d1786c025cbd50dfc284b252c3ee6dd99dc Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Alexis=20Lothor=C3=A9?= <alexis.lothore@bootlin.com>
+Date: Tue, 18 Aug 2026 09:38:05 +0200
+Subject: [PATCH] Do not use gcrypt cmake variables if gcrypt is not found
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Commit d12d820a9493 ("Fix build without crypto support") enabled
+building the crapi library without a crypto backend, but left the
+target_include_directories and target_compile_definitions calls
+unguarded. When no crypto library is available, the GCrypt find module
+leaves GCRYPT_INCLUDE_DIRS unset, so CMake fails at the generate step
+with:
+
+  CMake Error: The following variables are used in this project, but
+  they are set to NOTFOUND: GCRYPT_INCLUDE_DIR
+
+The test command provided at this time made the build successful because
+it provided -DCMAKE_DISABLE_FIND_PACKAGE_GCrypt=TRUE, but if no crypto
+backend is provided, it does not make sense to provide those cmake
+configuration options preventing dependency search manually.
+
+Guard both calls with a CRYPTO_FOUND check so they are only applied when
+an actual digest backend is present, even without providing
+-DCMAKE_DISABLE_FIND_PACKAGE_foo
+
+Upstream: https://github.com/OpenSCAP/openscap/commit/5b858d1786c025cbd50dfc284b252c3ee6dd99dc
+Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
+---
+ src/OVAL/probes/crapi/CMakeLists.txt | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/src/OVAL/probes/crapi/CMakeLists.txt b/src/OVAL/probes/crapi/CMakeLists.txt
+index 3fb6f123c8d6..88cb916b6d96 100644
+--- a/src/OVAL/probes/crapi/CMakeLists.txt
++++ b/src/OVAL/probes/crapi/CMakeLists.txt
+@@ -8,5 +8,7 @@ file(GLOB_RECURSE CRAPI_HEADERS "*.h")
+ 
+ add_library(crapi_object OBJECT ${CRAPI_SOURCES} ${CRAPI_HEADERS})
+ set_oscap_generic_properties(crapi_object)
+-target_include_directories(crapi_object PUBLIC ${NSS_INCLUDE_DIRS} ${GCRYPT_INCLUDE_DIRS})
+-target_compile_definitions(crapi_object PUBLIC ${GCRYPT_DEFINITIONS})
++if (CRYPTO_FOUND)
++	target_include_directories(crapi_object PUBLIC ${NSS_INCLUDE_DIRS} ${GCRYPT_INCLUDE_DIRS})
++	target_compile_definitions(crapi_object PUBLIC ${GCRYPT_DEFINITIONS})
++endif()
+-- 
+2.55.0
+
diff --git a/package/openscap/Config.in b/package/openscap/Config.in
index 01c628194cc6..45904622848b 100644
--- a/package/openscap/Config.in
+++ b/package/openscap/Config.in
@@ -1,12 +1,8 @@
 config BR2_PACKAGE_OPENSCAP
 	bool "openscap"
-	depends on BR2_PACKAGE_LIBGPG_ERROR_ARCH_SUPPORTS  # libgcrypt
 	depends on !BR2_STATIC_LIBS # dlfcn.h
 	depends on BR2_TOOLCHAIN_HAS_THREADS_NPTL
 	select BR2_PACKAGE_LIBCURL
-	# In theory should build without crypto, but in practice it
-	# doesn't: https://github.com/OpenSCAP/openscap/issues/2310
-	select BR2_PACKAGE_LIBGCRYPT if !BR2_PACKAGE_LIBNSS
 	select BR2_PACKAGE_LIBXML2
 	select BR2_PACKAGE_LIBXSLT
 	select BR2_PACKAGE_LIBXMLSEC1
@@ -20,5 +16,4 @@ config BR2_PACKAGE_OPENSCAP
 	  https://github.com/OpenSCAP/openscap
 
 comment "openscap needs a toolchain w/ dynamic library, NPTL"
-	depends on BR2_PACKAGE_LIBGPG_ERROR_ARCH_SUPPORTS
 	depends on BR2_STATIC_LIBS || !BR2_TOOLCHAIN_HAS_THREADS_NPTL
diff --git a/package/openscap/openscap.mk b/package/openscap/openscap.mk
index 7da38df345b4..6fbe09771863 100644
--- a/package/openscap/openscap.mk
+++ b/package/openscap/openscap.mk
@@ -22,7 +22,6 @@ OPENSCAP_DEPENDENCIES = \
 HOST_OPENSCAP_DEPENDENCIES = \
 	host-pkgconf \
 	host-libcurl \
-	host-libgcrypt \
 	host-libxml2 \
 	host-libxmlsec1 \
 	host-libxslt \
@@ -36,7 +35,6 @@ OPENSCAP_CONF_OPTS = \
 	-DENABLE_OSCAP_UTIL_VM=OFF \
 	-DENABLE_PROBES_WINDOWS=OFF \
 	-DENABLE_TESTS=OFF \
-	-DWITH_CRYPTO=gcrypt \
 	-DENABLE_PYTHON3=OFF
 
 HOST_OPENSCAP_CONF_OPTS = \
@@ -47,7 +45,6 @@ HOST_OPENSCAP_CONF_OPTS = \
 	-DENABLE_OSCAP_UTIL_VM=OFF \
 	-DENABLE_PROBES_WINDOWS=OFF \
 	-DENABLE_TESTS=OFF \
-	-DWITH_CRYPTO=gcrypt \
 	-DENABLE_PYTHON3=OFF
 
 ifeq ($(BR2_PACKAGE_ACL),y)
@@ -60,10 +57,10 @@ endif
 
 ifeq ($(BR2_PACKAGE_LIBGCRYPT),y)
 OPENSCAP_DEPENDENCIES += libgcrypt
-endif
-
-ifeq ($(BR2_PACKAGE_LIBNSS),y)
+OPENSCAP_CONF_OPTS += -DWITH_CRYPTO=gcrypt
+else ifeq ($(BR2_PACKAGE_LIBNSS),y)
 OPENSCAP_DEPENDENCIES += libnss
+OPENSCAP_CONF_OPTS += -DWITH_CRYPTO=nss
 endif
 
 ifneq ($(BR2_TOOLCHAIN_USES_GLIBC),y)

-- 
2.55.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [PATCH v2 2/2] support/testing: add tests for openscap

[Alexis Lothoré via buildroot]

Add basic tests for openscap, ensuring that it builds and runs a minimal
command with different cryptographic backends:
- libgcrypt
- libnss
- no crypto backend

Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
---
 support/testing/tests/package/test_openscap.py     | 63 ++++++++++++++++++++++
 .../rootfs-overlay/root/benchmark.xml              |  5 ++
 2 files changed, 68 insertions(+)

diff --git a/support/testing/tests/package/test_openscap.py b/support/testing/tests/package/test_openscap.py
new file mode 100644
index 000000000000..08527d28aa4d
--- /dev/null
+++ b/support/testing/tests/package/test_openscap.py
@@ -0,0 +1,63 @@
+import os
+
+import infra.basetest
+
+
+class TestOpenSCAPBase(infra.basetest.BRTest):
+    config = """
+        BR2_arm=y
+        BR2_cortex_a8=y
+        BR2_ARM_EABIHF=y
+        BR2_TOOLCHAIN_EXTERNAL=y
+        BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
+        BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_ARMV7_EABIHF_GLIBC_STABLE=y
+        BR2_PACKAGE_OPENSCAP=y
+        BR2_ROOTFS_OVERLAY="{}"
+        BR2_TARGET_ROOTFS_CPIO=y
+        # BR2_TARGET_ROOTFS_TAR is not set
+        """.format(
+                infra.filepath("tests/package/test_openscap/rootfs-overlay"))
+
+    def test_run(self):
+        cpio_file = os.path.join(self.builddir, "images", "rootfs.cpio")
+        self.emulator.boot(
+            arch="armv7",
+            kernel="builtin",
+            options=["-m", "512M", "-initrd", cpio_file],
+        )
+        self.emulator.login()
+
+        out, ret = self.emulator.run("oscap --version")
+        self.assertEqual(ret, 0)
+
+        out, ret = self.emulator.run("oscap info /root/benchmark.xml")
+        self.assertEqual(ret, 0)
+        self.assertIn("Document type: XCCDF Checklist", "\n".join(out))
+
+
+class TestOpenSCAPGcrypt(TestOpenSCAPBase):
+    """Test openscap using the gcrypt crypto backend."""
+
+    config = (
+        TestOpenSCAPBase.config
+        + """
+        BR2_PACKAGE_LIBGCRYPT=y
+        """
+    )
+
+
+class TestOpenSCAPNss(TestOpenSCAPBase):
+    """Test openscap using the nss crypto backend."""
+
+    config = (
+        TestOpenSCAPBase.config
+        + """
+        BR2_PACKAGE_LIBNSS=y
+        """
+    )
+
+
+class TestOpenSCAPNoCrypto(TestOpenSCAPBase):
+    """Test openscap without any crypto backend."""
+
+    config = TestOpenSCAPBase.config
diff --git a/support/testing/tests/package/test_openscap/rootfs-overlay/root/benchmark.xml b/support/testing/tests/package/test_openscap/rootfs-overlay/root/benchmark.xml
new file mode 100644
index 000000000000..aac0f1e0fa9a
--- /dev/null
+++ b/support/testing/tests/package/test_openscap/rootfs-overlay/root/benchmark.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<xccdf:Benchmark xmlns:xccdf="http://checklists.nist.gov/xccdf/1.2" id="xccdf_org.buildroot.benchmark">
+  <xccdf:status>accepted</xccdf:status>
+  <xccdf:version>1.0</xccdf:version>
+</xccdf:Benchmark>

-- 
2.55.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot