Link mbedTLS libraries in when SHA1_BACKEND == "mbedTLS"#4678
Conversation
staticfloat
force-pushed
the
sf/mbedtls_linkage
branch
from
f0b56b1 to
82849b9
Compare
Note that we do not use libssl for SHA-1 by default but instead use a vendored version of SHA-1 which can detect the SHAttered attack. While I guess this is fine for completeness, are you sure you want to use a library that cannot detect the attack? |
|
I should also clarify: we were using v0.27.1 + the changes from #4173 |
Ah, I did not notice this, as I was last using v0.26.0, which I do not believe did this by default. That's neat! I agree with you; we should be using the collision detection version by default. For code coverage purposes, I think the |
|
Yeah, it makes a lot of sense to put this into our existing mbedTLS builds. Thanks for your changes! |
4 participants
Over at Julia, we really enjoy the ability to build
libgit2againstmbedTLSand completely elide dependency onlibsslfor cryptographic operations. We noticed that with the release ofv0.27.1there were a few holes in the buildsystem formbedTLS:The shim routines for
sha1calculation do not actually get added to the list of files to be compiled.If
SHA1_BACKENDis set tombedTLS, butUSE_HTTPSis not set tombedTLS,libmbedtlsdoesn't get linked properly.I have taken the liberty of editing the travis build configuration to do more complete
mbedTLStesting.