Re: [Qemu-devel] [PATCH v4] buildsys: Move crypto cflags/libs to per object variables

["Daniel P. Berrange" <berrange@redhat.com>]

On Fri, Sep 08, 2017 at 07:23:52PM +0800, Fam Zheng wrote:
> On Fri, 09/08 12:00, Daniel P. Berrange wrote:
> > On Fri, Sep 08, 2017 at 06:58:53PM +0800, Fam Zheng wrote:
> > > If you don't like introducing {nettle,gcrypt,gnutls}.mo for now, we can probably
> > > defer it to the time when crypto subsystem is modularized.
> > 
> > I don't anticipate the crypot subsystem ever being modularized - it is
> > really core functionality used across all other subsystems (block layer,
> > chardev, ui, migration, and more)
> 
> I get your point that crypto is a fundamental thing, "optionally secure" is not
> what I meant.  But moduarization still has the advantage of offering more
> flexibility to end users, potentially. Crypto backends could be shipped as
> qemu-crypto-{nettle,gcrypt,gnutls} packages, and depending on which are
> installed and which are not, the core crypto code in QEMU can pick the suitable
> implementation at runtime, based on a hardcoded priority or even an option.

There's no choice between gnutls vs the other two - it is always a case of
building gnutls *and* either nettle or gcrypt. We pick nettle or gcrypt based
on which is used by gnutls, to minimise number of different crypto libraries
we load. So dynamically picking them at runtime makese no sense.

> To be "secure by default", qemu-crypto-nettle could be a hard requirement of
> qemu core package.
> 
> Is it worth the effort?

I don't really think that is useful. You should think of the crypto stuff
as being part of the 'libqemuutil.la' library - the only reason it is not
linked into that is because we wanted to avoid adds deps on the userspace
emulators - everything else we build wants it present. 

Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|