MD5 deprecation in CommonCrypto

[terwanerik]

What platform/OS are you using?

macOS 10.15 'Catalina'

Which version of the SDK?

1.7.206

What compiler are you using? what version?

AppleClang 11.0.0.11000033

What are your CMake arguments?

cmake -D BUILD_ONLY="s3" -D STATIC_LINKING=1 -D CMAKE_BUILD_TYPE=Release -G Xcode

CMake runs fine, building the project (make) fails.

Can you provide a TRACE level log? (sanitize any sensitive information)

'CC_MD5' is deprecated: first deprecated in macOS 10.15 - This function is cryptographically broken and should not be used in security contexts. Clients should migrate to SHA256 (or stronger).

'CC_MD5_Init' is deprecated: first deprecated in macOS 10.15 - This function is cryptographically broken and should not be used in security contexts. Clients should migrate to SHA256 (or stronger).

'CC_MD5_Update' is deprecated: first deprecated in macOS 10.15 - This function is cryptographically broken and should not be used in security contexts. Clients should migrate to SHA256 (or stronger).

'CC_MD5_Final' is deprecated: first deprecated in macOS 10.15 - This function is cryptographically broken and should not be used in security contexts. Clients should migrate to SHA256 (or stronger).

Building with OpenSSL instead of CommonCrypto

Building with OpenSSL works (using CMake flag -D ENABLE_OPENSSL_ENCRYPTION=1), would be nice to have this as an automatic fallback when >= macOS 10.5.

[KaibaLopez]

Hi @terwanerik, thanks for pointing this out.
*Edit: My bad, we do support it and will be taking a closer look at this. As always, we are open to contributions, so if you know of a way around this issue please make a PR.

[JonathanHenson]

The sdk does not use md5 as a cryptographic primitive. It’s used mainly for checksum validations on s3 objects. We don’t want to add an openssl dependency. The best approach is probably to suppress the warnings in the common crypto cpp files.

[terwanerik]

Yeah i'd reckoned that it's mainly used for checksums, too bad there is no way around it. On Catalina these aren't warnings, but build errors; e.g. the build fails.

Fair enough that MD5 is cryptographically broken, but to completely remove the functions is a bit much of Apple, considering that it's still a (mostly) valid, and widely used, checksum. Could have just informed the developer, instead of forcing other MD5 implementations.

Having OpenSSL as a dependency isn't optimal, the way around it is to use a custom MD5 implementation, because the rest of the CommonCrypto implementation is working perfectly. This, of course, comes with it's own downsides, and should be properly unit tested.

[JonathanHenson]

You can still use it in commoncrypto, we just need to disable the warnings.

[MajorMurphy]

I created a pull request to disable these deprecation errors.

[Sunil-P]

I tried building with compiler flag -DWARNINGS_AS_ERRORS=OFF but the compiler flag -WError was still set in all targets in the xcodeproj.
Manually removing the -Werror from cmake/compiler_settings.cmake seemed to work. Although I would still like to do build using flag off rather than change a file in the project.
Perhaps xcodebuild has an option ? Inside Xcode, I saw the Treat warnings as errors flag is set to unticked.
Anyhow removing that flag from cmake/compiler_settings.cmake worked !

[singku]

Please update the SDK to latest and try again.
7515c52