Save static C shim build lessons
ober
6b95ed01b3cd9054bdb058f317992befc44644b3
--- a/data/anti-patterns.sexp +++ b/data/anti-patterns.sexp @@ -2710,4 +2710,26 @@ "Validate Target Proof Material Before Copying It") ("tools" "rg" "make target-evidence" "make platform-evidence" "make release-evidence" - "jerboa_security_scan"))) + "jerboa_security_scan")) + (("advice" + . + "Guard only the OpenSSL includes and crypto wrapper functions. Leave TCP/libc/string-copy helpers and other non-crypto exports visible, then compile both the normal build and the exact static path with the NO_OPENSSL macro enabled.") + ("avoid" + . + "Do not wrap an entire C shim file or all helpers in a NO_OPENSSL preprocessor guard just because OpenSSL includes/functions are unavailable in a static binary path.") + ("id" . "overbroad-no-openssl-c-guard") + ("kinds" "ffi" "debug-error" "script") + ("pattern" + . + "#ifndef .*NO_OPENSSL[\\s\\S]*static .*\\(\\*.*connect|copy_.*cstring|tcp_") + ("severity" . "high") + ("tags" "openssl" "c-shim" "static-binary" "ffi" + "vendoring") + ("title" + . + "Do Not Hide Non-Crypto C Shim Helpers Behind NO_OPENSSL") + ("tools" + "jerboa_security_scan" + "make build" + "git clean -xfd && make binary" + "cc -c -D*_NO_OPENSSL"))) --- a/data/cookbooks.sexp +++ b/data/cookbooks.sexp @@ -6472,4 +6472,15 @@ "Use this pattern in release-evidence targets that may be copied into public release packets. Exact proof markers should be repo-specific, but missing/incomplete required proof must fail closed and accepted proof files should be copied with a SHA-256 sidecar. The private-path scan should run after evidence generation and after any sanitizer so stale or newly copied artifacts are checked.") ("tags" "release-evidence" "privacy" "host-neutral" "target-proof" "security" "makefile") - ("title" . "Keep Release Evidence Host Neutral"))) + ("title" . "Keep Release Evidence Host Neutral")) + (("code" + . + "/* C shim source */\n#ifndef MY_SHIM_NO_OPENSSL\n#include <openssl/evp.h>\n#include <openssl/rand.h>\n#endif\n\n/* helpers needed by the static build stay outside the OpenSSL guard */\nstatic int retry_close(int fd) {\n int rc;\n do { rc = close(fd); } while (rc < 0 && errno == EINTR);\n return rc;\n}\n\n#ifndef MY_SHIM_NO_OPENSSL\nint my_shim_random_bytes(unsigned char *out, int len) {\n if ((!out && len > 0) || len < 0) return -1;\n if (len == 0) return 0;\n return RAND_bytes(out, len) == 1 ? 0 : -1;\n}\n#endif\n\n/* static binary staging */\n/* cc -c -O2 -fPIC -DMY_SHIM_NO_OPENSSL src/my_shim.c -o stage/my_shim.o */") ("id" . "static-c-shim-no-openssl-guard") ("imports") + ("notes" + . + "Use this when a static binary replaces crypto through another native archive or generated Scheme FFI layer, but still needs non-crypto helper symbols from the same C shim. Keep networking/TCP/libc helper functions outside the NO_OPENSSL guard. Verify both normal shared-library builds and the exact static compile with the macro enabled.") + ("tags" "static-binary" "c-shim" "openssl" "ffi" "jerbuild" + "vendoring") + ("title" + . + "Compile static C shims without OpenSSL crypto sections"))) --- a/data/error-fixes.sexp +++ b/data/error-fixes.sexp @@ -2526,4 +2526,18 @@ "When release-evidence copies a generated evidence directory, make the recipe run the evidence-producing target inside the same cleaned release-evidence invocation or make it an explicit prerequisite that always materializes the directory. Then remove the destination before copying and verify the copied status file.") ("id" . "release-evidence-copy-before-evidence-dir") ("pattern" . "cp: .*: No such file or directory") - ("type" . "build-script"))) + ("type" . "build-script")) + (("code_example" + . + "# C source\n#ifndef JERBOA_FUSE_NO_OPENSSL\n#include <openssl/evp.h>\n#include <openssl/rand.h>\n#endif\n\n#ifndef JERBOA_FUSE_NO_OPENSSL\n/* OpenSSL crypto wrappers only */\n#endif\n\n# staging compile\ncc -c -O2 -fPIC -DJERBOA_FUSE_NO_OPENSSL src/mount_helper.c -o stage/mount_helper.o") + ("explanation" + . + "macOS Homebrew OpenSSL headers are not in the default compiler search path. Static Jerboa staging may not want OpenSSL at all if vault/SSH crypto is supplied by a Rust/native archive, but non-crypto C shim helpers still need to compile.") + ("fix" + . + "For static binary staging that replaces crypto elsewhere, add a C-shim NO_OPENSSL mode: guard only OpenSSL includes and crypto wrapper functions, compile the shim with -D<SHIM>_NO_OPENSSL, and verify the normal shared-library build plus the exact static compile path.") + ("id" . "openssl-evp-missing-static-c-shim") + ("pattern" + . + "fatal error: 'openssl/evp\\.h' file not found") + ("type" . "c-shim-static-build")))