From 260a13d4726ce62bdc0ed3a7a13c34de3367f5e2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 2 Jul 2021 14:18:12 +0100 Subject: [PATCH] crypto: flip priority of backends to prefer gcrypt MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Originally we preferred to use nettle over gcrypt because gnutls already links to nettle and thus it minimizes the dependencies. In retrospect this was the wrong criteria to optimize for. Currently shipping versions of gcrypt have cipher impls that are massively faster than those in nettle and this is way more important. The nettle library is also not capable of enforcing FIPS compliance, since it considers that out of scope. It merely aims to provide general purpose impls of algorithms, and usage policy is left upto the layer above, such as GNUTLS. Reviewed-by: Eric Blake Signed-off-by: Daniel P. Berrangé --- meson.build | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/meson.build b/meson.build index 8f899e1e9b..c3a6096820 100644 --- a/meson.build +++ b/meson.build @@ -823,22 +823,13 @@ if not get_option('gnutls').auto() or have_system kwargs: static_kwargs) endif -# Nettle has priority over gcrypt +# Gcrypt has priority over nettle gcrypt = not_found nettle = not_found xts = 'none' if get_option('nettle').enabled() and get_option('gcrypt').enabled() error('Only one of gcrypt & nettle can be enabled') -elif (not get_option('nettle').auto() or have_system) and not get_option('gcrypt').enabled() - nettle = dependency('nettle', version: '>=3.4', - method: 'pkg-config', - required: get_option('nettle'), - kwargs: static_kwargs) - if nettle.found() and not cc.has_header('nettle/xts.h', dependencies: nettle) - xts = 'private' - endif -endif -if (not get_option('gcrypt').auto() or have_system) and not nettle.found() +elif (not get_option('gcrypt').auto() or have_system) and not get_option('nettle').enabled() gcrypt = dependency('libgcrypt', version: '>=1.8', method: 'config-tool', required: get_option('gcrypt'), @@ -852,6 +843,15 @@ if (not get_option('gcrypt').auto() or have_system) and not nettle.found() cc.find_library('gpg-error', required: true, kwargs: static_kwargs)]) endif endif +if (not get_option('nettle').auto() or have_system) and not gcrypt.found() + nettle = dependency('nettle', version: '>=3.4', + method: 'pkg-config', + required: get_option('nettle'), + kwargs: static_kwargs) + if nettle.found() and not cc.has_header('nettle/xts.h', dependencies: nettle) + xts = 'private' + endif +endif gtk = not_found gtkx11 = not_found