libgcrypt: introduce mini variant#25602
Conversation
|
I like the concept, but DES, MD5, and SHA1 are all obsolete. What led to your cipher/hash choices? |
|
I looked at what vpnc supports: https://github.com/streambinder/vpnc/blob/master/docs/about.md Possibly this is indeed a very specific set for my situation :) Maybe it would be possible to experiment with different selections and observe the resulting sizes. I'm not really sure what would be the best approach. |
May I know if you do have some numbers, so we can know how much is less? :) Thank you. |
You might laugh, but here are the differences :) On routers with tiny flash memory, this difference is enough to enable a few more small packages to be installed alongside :) :) |
da87dbe to
538da0a
Compare
|
A mini build will be nice. |
|
Yeah, but I think it is indeed a good idea to see which algorithms contribute the most and see if a good compromise can be found. Now it's indeed only the crappy ones that |
|
I've been doing various builds and looked what trying to reduce the size while still keeping more algorithms. A build including everything is 1307kB (for the shared object itself). By reducing the number of algorithms we can reach about 650kB. We could possible have three versions: mini, regular (excluding rarely used algorithms) and full A mini version could be built with: This adds about 10kB but includes quite a few more algorithms, the result is 659kB. The normal build might be: This results in 728kB, about 60kB larger. Or with the SHAs added: This results in 780kB, about 52kB extra (on top of the 60Kb). Here is a list of sizes based on what's included. Note that is this is quite a rough measurement: s2k,pkdf2 do not add anything rsa adds 20kB arcfour adds about 200 bytes crc adds about 12kB Especially serpent and camellia increase the size significantly. When I leave out serpent, camellia and gost28147. There are already significant savings of almost 300kB, the result being 1013kB. Maybe somebody could comment which algorithms are really must-haves and which ones could probably be dropped. This might also relate to which tools actually make user of libgcrypt on OpenWRT I guess. |
|
I went through all the other reverse dependencies of libgcrypt and checked which algorithms they actually use: So it appears a few algorithms aren't used by any package at all. And there is a subset that is used by almost all. The heavy users are gnupg2 and strongswan. What about creating a |
|
Building with @flyn-org does this set of algorithms make more sense? Curious what you think! |
|
That list looks okay. It does include some algorithms that should be considered obsolete, including arcfour, des, md5, and sha1. (I am unsure of the status of blowfish.) The technologies that depend on those algorithms do so because of old requirements; netatalk is an example of this. Obviously, aircrack-ng includes arcfour so it can crack networks that use RC4. It might be a good idea to audit all of our packages to avoid obsolete ciphers and hashes, but that would be a separate effort. Aside from that, the list seems reasonable if it is indeed based on the real needs of the other packages. I'd defer to some core developers as to whether this is a worthwhile goal. @BKPepe, what do you think? |
538da0a to
2060fe7
Compare
2060fe7 to
a352645
Compare
a352645 to
beed3af
Compare
Formality Check: Suggestions AvailableWe completed the verification flow. Please review the formatting overview logs below.
|
| endef | ||
|
|
||
| define Package/libgcrypt/description | ||
| $(call Package/libgcrypt/Default/description) |
There was a problem hiding this comment.
The template is defined as Package/libgcrypt/default/description (lowercase default, line 37), but this calls Package/libgcrypt/**Default**/description. Make variable names are case-sensitive, so $(call ...) here expands to nothing and the full package description loses its entire body text (only the two trailing lines below survive).
| $(call Package/libgcrypt/Default/description) | |
| $(call Package/libgcrypt/default/description) |
Generated by Claude Code
| endef | ||
|
|
||
| define Package/libgcrypt-mini/description | ||
| $(call Package/libgcrypt/Default/description) |
There was a problem hiding this comment.
Same case mismatch as above: the template is Package/libgcrypt/default/description (line 37), so Package/libgcrypt/**Default**/description expands to empty and the mini package description body is dropped.
| $(call Package/libgcrypt/Default/description) | |
| $(call Package/libgcrypt/default/description) |
Generated by Claude Code
| define Package/libgcrypt | ||
| $(call Package/libgcrypt/default) | ||
| PROVIDES+=libgcrypt-mini | ||
| endef | ||
|
|
||
| define Package/libgcrypt/description | ||
| $(call Package/libgcrypt/Default/description) | ||
| . | ||
| This package contains the full-featured libgcrypt. | ||
| endef | ||
|
|
||
| define Package/libgcrypt-mini |
There was a problem hiding this comment.
libgcrypt and libgcrypt-mini both PROVIDES libgcrypt and both install the same file (Package/libgcrypt-mini/install = $(Package/libgcrypt/install) copies /usr/lib/libgcrypt.so.*), yet neither declares CONFLICTS. Nothing prevents both from being selected/installed, which would collide on that file path.
Compare the canonical multi-variant library in openwrt/openwrt, package/libs/ustream-ssl/Makefile: each variant sets VARIANT, the variants CONFLICTS each other, and one carries DEFAULT_VARIANT:=1. Here the full package sets neither VARIANT nor DEFAULT_VARIANT, and no CONFLICTS is declared on either side. Consider adding CONFLICTS (and a DEFAULT_VARIANT) so the two cannot be co-installed and a default is well-defined.
Generated by Claude Code
bc50b9b to
f574936
Compare
|
I updated the commit to reflect the proposal from last year. I also updated the packages that only need the mini variant that I could determine. I could also make the regular variant the smaller one introduce a big or large variant instead. |
|
I again see the note to do indentation with two spaces on lines that have tabs. Please let it know if I should do something there. |
openwrt-ai
left a comment
There was a problem hiding this comment.
Commit checks
libgcrypt: introduce mini and full variants— the message states two new variants (mini and full) are introduced and that "the full variant contains everything", butlibgcrypt-fullis defined without aBuildPackagecall, afullconfigure branch, or an install recipe, so it is never built. Only the regular and mini variants are actually produced (see inline comment).
Generated by Claude Code
| --enable-ciphers='arcfour,blowfish,des,aes,chacha20,rsa,dsa' \ | ||
| --enable-pubkey-ciphers='ecc,cast5,twofish,serpent,seed,camellia,idea' \ |
There was a problem hiding this comment.
The two lists are swapped in the regular variant. rsa and dsa are public-key algorithms (they belong under --enable-pubkey-ciphers), while cast5, twofish, serpent, seed, camellia and idea are symmetric ciphers (they belong under --enable-ciphers). libgcrypt's configure validates each name against its category, so as written the regular build ends up without these algorithms — and configure may abort on the unsupported names. Since the regular variant is meant to be the superset used by packages that still depend on +libgcrypt (e.g. strongswan, gnupg2, which need camellia/serpent/twofish), this would break them. The mini block below has the categories right.
| --enable-ciphers='arcfour,blowfish,des,aes,chacha20,rsa,dsa' \ | |
| --enable-pubkey-ciphers='ecc,cast5,twofish,serpent,seed,camellia,idea' \ | |
| --enable-ciphers='arcfour,blowfish,cast5,des,aes,twofish,serpent,seed,camellia,idea,chacha20' \ | |
| --enable-pubkey-ciphers='ecc,rsa,dsa' \ |
Generated by Claude Code
There was a problem hiding this comment.
Whoops, that's indeed quite silly of me. Coding at night was a bad idea. I just pushed a new version with all the remarks addressed I think.
| Package/libgcrypt-mini/install = $(Package/libgcrypt/install) | ||
|
|
||
| $(eval $(call BuildPackage,libgcrypt)) | ||
| $(eval $(call BuildPackage,libgcrypt-mini)) |
There was a problem hiding this comment.
The full variant is never actually built or selectable. Package/libgcrypt-full and its description are defined (lines 61-67, 76-82) with VARIANT:=full, but there is no $(eval $(call BuildPackage,libgcrypt-full)) here, no ifeq ($(BUILD_VARIANT),full) configure branch above, and no Package/libgcrypt-full/install. As a result the commit message's claim that this "introduces two new variants ... mini and full" and that "the full variant contains everything" does not hold — only libgcrypt (regular) and libgcrypt-mini are produced. To ship it you'd need to add all three: a full configure branch (or intentionally none, to enable every algorithm), a Package/libgcrypt-full/install (e.g. Package/libgcrypt-full/install = $(Package/libgcrypt/install)), and the BuildPackage line.
Generated by Claude Code
| $(call Package/libgcrypt/default/description) | ||
| . | ||
| This package contains the regular libgcrypt build. | ||
| Algorithms not used by other OpenWrt packages are excluded. |
There was a problem hiding this comment.
This is what the failing FormalityCheck / OpenWrt Makefiles run is reporting: description lines must be indented with at least 2 spaces, but these (including the $(call ...) line) use 0-1 space. Indenting the block fixes it:
| $(call Package/libgcrypt/default/description) | |
| . | |
| This package contains the regular libgcrypt build. | |
| Algorithms not used by other OpenWrt packages are excluded. | |
| $(call Package/libgcrypt/default/description) | |
| . | |
| This package contains the regular libgcrypt build. | |
| Algorithms not used by other OpenWrt packages are excluded. |
Apply the same 2-space indentation to the Package/libgcrypt-full/description block (lines 77-81) and the Package/libgcrypt-mini/description block (lines 85-88), which the check flags for the same reason.
Generated by Claude Code
f574936 to
21d50e6
Compare
openwrt-ai
left a comment
There was a problem hiding this comment.
Commit checks
libgcrypt: introduce mini and full variants— the previous review's swapped cipher/pubkey lists, description indentation, and CONFLICTS/DEFAULT_VARIANT concerns are resolved. However, the message still states "the full variant contains everything," and while$(eval $(call BuildPackage,libgcrypt-full))was added,libgcrypt-fullhas no install section, so it is skipped at build time and nolibgcrypt-fullpackage is actually produced (see inline comment).
Generated by Claude Code
| $(CP) $(PKG_INSTALL_DIR)/usr/lib/libgcrypt.so.* $(1)/usr/lib/ | ||
| endef | ||
|
|
||
| Package/libgcrypt-mini/install = $(Package/libgcrypt/install) |
There was a problem hiding this comment.
The added BuildPackage,libgcrypt-full (line 134) still won't produce a package: unlike -mini on this line, Package/libgcrypt-full/install is never defined and there is no -overlay variant, so the build system treats the variant as having no install section. In include/package-pack.mk an undefined Package/$(1)/install leaves do_install unset and the package is skipped at compile time (WARNING: skipping libgcrypt-full -- package has no install section). Because libgcrypt-full also PROVIDES libgcrypt, this is worse than a no-op if it were ever selectable: it would satisfy the libgcrypt dependency while installing no library. Add an install recipe mirroring -mini:
| Package/libgcrypt-mini/install = $(Package/libgcrypt/install) | |
| Package/libgcrypt-full/install = $(Package/libgcrypt/install) | |
| Package/libgcrypt-mini/install = $(Package/libgcrypt/install) |
Generated by Claude Code
This introduces two new variants of libgcrypt. The full variant contains everything which is more than is actually used by any OpenWrt package. The regular variant is changed to only contain algorithms that are in use. The mini variant contains the most commonly used algorithms and is significantly smaller than the regular variant. Signed-off-by: Julius Schwartzenberg <julius.schwartzenberg@eclipso.eu>
21d50e6 to
3561226
Compare
Maintainer: @flyn-org
Compile tested: (mipsel_24kc_musl, TP-Link Archer C50v6, f10ee1e20966bdb86cb61a87338f953de1d86cc6)
Run tested: (mipsel_24kc_musl, TP-Link Archer C50v6, 24.10-rc2, tested a version compiled with the same flags still works with vpnc)
Description:
This allows building a smaller version of libgcrypt which takes up less disk space. This helps conserving space on devices with little flash while still providing a working libgcrypt.
Please let me know what you think of this PR! I intend to do more testing with the version built from this specific Makefile but my earlier tests shows that this works fine. Many thanks in advance for any feedback you might have!