Configure: do not check for an absolute prefix in cross-builds #16445
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
openssl-machine
added
hold: cla required
t8m
reviewed
Aug 27, 2021
Configure
Outdated
| @@ -937,7 +937,8 @@ while (@argvcopy) | |||
| { | |||
| $config{prefix}=$1; | |||
| die "Directory given with --prefix MUST be absolute\n" | |||
| unless file_name_is_absolute($config{prefix}); | |||
| unless $user{CROSS_COMPILE} || | |||
There was a problem hiding this comment.
I think the check needs to be moved down after all the options are parsed. And $config should be used instead of $user.
t8m
approved these changes
Aug 30, 2021
There was a problem hiding this comment.
The change seems OK to me now. However it is no longer acceptable with CLA: trivial. Could you please submit a regular CLA? https://www.openssl.org/policies/cla.html
t8m
added
approval: review pending
|
@t8m is correct in that although this is a simple change, it steps outside the project comfort zone for legally trivial (a different measurement). |
Perhaps you could change the commit's e-mail address to use this old one? |
openssl-machine
removed
the
hold: cla required
The check is always made according to the host platform's rules, which may not be true for true when the target platform is different, e.g. when cross-building for Windows on a Linux machine. So skip this check when used together with the `--cross-compile-prefix=` option. CLA: trivial Fixes #9520
vszakats
added a commit
to curl/curl-for-win
that referenced
this pull request
Dec 3, 2021
Instead of using OpenSSL as a default backend, schannel builds will tap on the OS's TLS/SSL capabilities, meaning the exact feature set will depend on OS version (and possibly OS configuration settings). This should generally not pose a problem when running on a fairly recent (officially supported) Windows release (meaning Windows 10 or equivalent server version). The expected advantage of these builds is significantly smaller on-disk and in-memory footprint, faster and simpler builds, and all the upsides of avoiding a complex 3rd party library such an OpenSSL with its vulnerabilities and attack surface. One specific vulnerability that this will universally fix is CVE-2019-12572 which to this day is not fixed in OpenSSL, and in fact OpenSSL denies this has anything to do with OpenSSL itself, so there is little chance this will ever get addressed. This branch also allows to go back to the curl-for-win promise of not using any local patches, by dropping a necessary OpenSSL patch to be able to mitigate said CVE somewhat better. Another decisive moment was OpenSSL's recently laid out plans that made it unlikely that this, or other pending TLS/SSL/QUIC-related bits will get the expected attention in the foreseeable future. Ref: https://blog.mirch.io/2019/06/10/cve-2019-12572-pia-windows-privilege-escalation-malicious-openssl-engine/ Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12572 Ref: openssl/openssl#17151 Ref: openssl/openssl#16445 Ref: openssl/openssl#9520
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.