Forward JSH_FEATURES to cross builds, drop unsupported hardened targets, fix static ssh/vault linking
ober
aaa05bd6217846f30c7ce10dbc694c0ef8cd1fc9
--- a/Makefile +++ b/Makefile @@ -32,7 +32,7 @@ JERBOA_NATIVE_RS_DIR ?= $(VENDOR)/jerboa-native-rs JERBOA_NATIVE_HOST_LIB ?= $(JERBOA_NATIVE_RS_DIR)/target/release/libjerboa_native$(SO_EXT) JSH_NATIVE_NO_SQLITE_FEATURES ?= tls crypto JERBOA_NATIVE_HOST_FEATURES ?= $(JSH_NATIVE_NO_SQLITE_FEATURES) -JSH_CROSS_FEATURES ?= coreutils +JSH_CROSS_FEATURES ?= $(if $(JSH_FEATURES),$(JSH_FEATURES),coreutils) # jsh evaluates Jerboa source at runtime via ,use. Jerbuild's deterministic # FASL metadata strip removes import information needed by that runtime path. JSH_JERBUILD_DETERMINISTIC_IDS ?= 0 @@ -105,8 +105,8 @@ PODMAN ?= podman jsh-macos-minimal configure features features-all features-minimal show-features \ check-freebsd-amd64-host jsh-freebsd jsh-freebsd-base jsh-freebsd-full freebsd freebsd-amd64 freebsd-arm64 jsh-freebsd-amd64 jsh-freebsd-arm64 \ jsh-freebsd-minimal \ - linux linux-amd64 linux-arm64 linux-amd64-hardened linux-arm64-hardened \ - jsh-linux-amd64 jsh-linux-arm64 jsh-linux-amd64-hardened jsh-linux-arm64-hardened \ + linux linux-amd64 linux-arm64 \ + jsh-linux-amd64 jsh-linux-arm64 \ linux-amd64-refresh-yubikey linux-arm64-refresh-yubikey test-linux test-linux-amd64 jsh-linux-native \ rust-musl-target-amd64 rust-musl-target-arm64 chez-cross-amd64 chez-cross-arm64 \ rust-coreutils-linux-amd64 rust-coreutils-linux-arm64 jerboa-native-linux-amd64 jerboa-native-linux-arm64 \ @@ -539,7 +539,7 @@ yubikey-native-linux-arm64: rust-musl-target-arm64 --release --target aarch64-unknown-linux-musl --no-default-features @test -f $(XC_YUBIKEY_NATIVE_MUSL_ARM64_LIB) -linux-amd64: stage-jsqlite vendor-deps-linux jerboa gen-embed chez-cross-amd64 rust-coreutils-linux-amd64 jerboa-native-linux-amd64 vendor-staged-libs yubikey-native-linux-amd64 +linux-amd64: stage-jsqlite ffi-shim-symbols.list vendor-deps-linux jerboa gen-embed chez-cross-amd64 rust-coreutils-linux-amd64 jerboa-native-linux-amd64 vendor-staged-libs yubikey-native-linux-amd64 @echo "=== Wiping stale per-arch compiled artifacts (.so/.wpo/boot) ===" @$(XC_WIPE) @features="$(JSH_CROSS_FEATURES)"; \ @@ -549,7 +549,7 @@ linux-amd64: stage-jsqlite vendor-deps-linux jerboa gen-embed chez-cross-amd64 r @ls -lh jsh-linux-amd64 @file jsh-linux-amd64 -linux-arm64: stage-jsqlite vendor-deps-linux jerboa gen-embed chez-cross-arm64 rust-coreutils-linux-arm64 jerboa-native-linux-arm64 vendor-staged-libs yubikey-native-linux-arm64 +linux-arm64: stage-jsqlite ffi-shim-symbols.list vendor-deps-linux jerboa gen-embed chez-cross-arm64 rust-coreutils-linux-arm64 jerboa-native-linux-arm64 vendor-staged-libs yubikey-native-linux-arm64 @echo "=== Wiping stale per-arch compiled artifacts (.so/.wpo/boot) ===" @$(XC_WIPE) @features="$(JSH_CROSS_FEATURES)"; \ @@ -571,17 +571,6 @@ linux: linux-amd64 jsh-linux-amd64: linux-amd64 jsh-linux-arm64: linux-arm64 -linux-amd64-hardened: - @echo "ERROR: hardened Linux builds require the newer obersh cross driver with OUTPUT_NAME/JSH_EMBED_OBFUSCATE support." >&2 - @exit 1 - -linux-arm64-hardened: - @echo "ERROR: hardened Linux builds require the newer obersh cross driver with OUTPUT_NAME/JSH_EMBED_OBFUSCATE support." >&2 - @exit 1 - -jsh-linux-amd64-hardened: linux-amd64-hardened -jsh-linux-arm64-hardened: linux-arm64-hardened - linux-amd64-refresh-yubikey: @$(MAKE) linux-amd64 VENDOR_REFRESH=jerboa-yubikey @@ -976,8 +965,6 @@ help: @echo " make macos Alias for jsh-macos" @echo " make linux-amd64 Cross: linux/amd64 static ELF" @echo " make linux-arm64 Cross: linux/arm64 static ELF" - @echo " make linux-amd64-hardened Present for obersh compatibility; unsupported here" - @echo " make linux-arm64-hardened Present for obersh compatibility; unsupported here" @echo " make linux Alias for linux-amd64" @echo " make jsh-linux-amd64 Alias for linux-amd64" @echo " make jsh-linux-arm64 Alias for linux-arm64" --- a/build-jsh-cross.ss +++ b/build-jsh-cross.ss @@ -937,9 +937,9 @@ "jerboa_ssh_tcp_set_nodelay")) (define vault-fuse-symbols - '("jerboa_fuse_secmem_alloc" "jerboa_fuse_secmem_free" - "jerboa_fuse_secmem_zero" "jerboa_fuse_secmem_copy_in" - "jerboa_fuse_secmem_copy_out" "jerboa_fuse_getpid" + '("jerboa_fuse_secmem_alloc" "jerboa_fuse_secmem_free_checked" + "jerboa_fuse_secmem_zero_checked" "jerboa_fuse_secmem_copy_in_checked" + "jerboa_fuse_secmem_copy_out_checked" "jerboa_fuse_getpid" "jerboa_fuse_getppid_of" "jerboa_fuse_open_device" "jerboa_fuse_get_errno" "jerboa_fuse_block_signal" "jerboa_fuse_unblock_signal" "jerboa_fuse_mount" @@ -1228,7 +1228,7 @@ (define vault-link-flag (if vault-enabled? - (format " -DLINUX ~a" fuse-mount-src) + (format " -DLINUX -DJERBOA_FUSE_NO_OPENSSL ~a" fuse-mount-src) "")) (define link-cmd --- a/tools/apply-vendor-overrides.sh +++ b/tools/apply-vendor-overrides.sh @@ -44,6 +44,15 @@ apply_ssh() { "${crypto}" fi + # jerboa_ssh_constant_time_compare() lives outside the big OpenSSL guard + # above (it's used regardless of transport crypto backend) but its body + # unconditionally called CRYPTO_memcmp. Give it a portable fallback for + # builds where OpenSSL isn't linked (static/cross musl targets). + if [ -f "${crypto}" ] && ! grep -q 'CHEZ_SSH_NO_OPENSSL: portable constant-time compare' "${crypto}"; then + perl -0pi -e 's/(int jerboa_ssh_constant_time_compare\(const uint8_t \*a, const uint8_t \*b, int len\) \{\n if \(len < 0\) return -1;\n) return CRYPTO_memcmp\(a, b, \(size_t\)len\);\n(\})/$1#ifndef CHEZ_SSH_NO_OPENSSL\n return CRYPTO_memcmp(a, b, (size_t)len);\n#else\n \/* CHEZ_SSH_NO_OPENSSL: portable constant-time compare *\/\n volatile unsigned char diff = 0;\n for (int i = 0; i < len; i++) diff |= (unsigned char)(a[i] ^ b[i]);\n return diff;\n#endif\n$2/s' \ + "${crypto}" + fi + local kex="${dir}/src/jerboa-ssh/kex.ss" if [ -f "${kex}" ]; then perl -0pi -e 's/\(def CIPHER-ALGORITHMS '\''\([^)]*\)\)/(def CIPHER-ALGORITHMS '\''("aes256-ctr"))/s' \