libgcrypt 1.9.1 [URGENT SECURITY ISSUE]

[FiloSottile]

The patch was removed because it was applied upstream.

• Have you followed the guidelines for contributing?
• Have you checked that there aren't other open pull requests for the same formula update/change?
• Have you built your formula locally with brew install --build-from-source <formula>, where <formula> is the name of the formula you're submitting?
• Is your test running fine brew test <formula>, where <formula> is the name of the formula you're submitting?
• Does your build pass brew audit --strict <formula> (after doing brew install <formula>)?

---

Please merge ASAP. Version 1.9.0 has an exploitable heap overflow.

https://dev.gnupg.org/T5275

https://lists.gnupg.org/pipermail/gnupg-announce/2021q1/000455.html

The patch was removed because it was applied upstream.

[SeekingMeaning]

Compilation error with Intel CPUs:

keccak.c:907:23: error: use of undeclared identifier 'HWF_INTEL_FAST_SHLD'
  else if (features & HWF_INTEL_FAST_SHLD)
                      ^

[FiloSottile]

Looking into it. If I can't work it out I might just backport a patch for the security issue to 1.9.0, if that's acceptable. It's a small patch.

[FiloSottile]

Introduced by https://dev.gnupg.org/rC8d404a629167d67ed56e45de3e65d1e0b7cdeb24. Somehow HAVE_CPU_ARCH_X86 isn't set.

From configure.ac:

case "$mpi_cpu_arch" in
     x86)
        AC_DEFINE(HAVE_CPU_ARCH_X86, 1,   [Defined for the x86 platforms])
        GCRYPT_HWF_MODULES="libgcrypt_la-hwf-x86.lo"
        ;;

[dawidd6]

Try removing --disable-asm in configure.

Ref: macports/macports-ports@f75b194

[FiloSottile]

Yeah, $mpi_cpu_arch is not set for --disable-asm builds. --disable-asm builds look just broken on x86.

Dropping --disable-asm would be a big change. @SeekingMeaning's PR to rollback to 1.8.7 seems like the right call.

[FiloSottile]

The fix was actually pretty small, just reverted part of that upstream commit.

The current version should build, up to you if you want to fix forward or rollback.

Upstream report: https://dev.gnupg.org/T5277

[SMillerDev]

The current version should build, up to you if you want to fix forward or rollback.

If possible we should definitely fix forward.

[FiloSottile]

Pulled out an Intel MacBook to test the patch, and this PR installed successfully on my macOS 11.2. 🎉

[carlocab]

Yea, libgcrypt definitely built on all the CI nodes. I've looked. They're just testing recursive dependents now.

[BrewTestBot]

@dawidd6 has triggered a merge.

[SMillerDev]

Thanks @FiloSottile ! Without contributions like yours it'd be impossible to keep homebrew going with the high standards that users have come to expect from the project. You can feel good knowing that you've made the world a tiny bit better for homebrew users around the world! 👍 🎉