pkgsrc-Bugs archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

pkg/48345: security/gnupg doesn't use the static-rnd option it thinks it does

>Number:         48345
>Category:       pkg
>Synopsis:       security/gnupg doesn't use the static-rnd option it thinks it 
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    pkg-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Oct 26 18:00:00 +0000 2013
>Originator:     Andreas Gustafsson
>Release:        NetBSD 5.2
System: NetBSD 5.2 NetBSD 5.2 (GENERIC) #0: Wed Nov 28 09:36:47 
UTC 2012
Architecture: i386
Machine: i386

When building security/gnupg, I noticed the following output
from the configure script:

  configure: WARNING: unrecognized options: --with-static-rnd

This is because security/gnupg/Makefile passes the option
--with-static-rnd=auto, but the configure script actually takes
an option called --enable-static-rnd, not --with-static-rnd.

In light of recent reports about certain U.S. agencies possibly
introducing delibrate weaknesses in the random number generation of
security software, having any discrepancy between the apparent and
actual behavior of gnupg's random number generation makes me

I think I would actually prefer to fix this by simply removing the
"--with-static-rnd=auto" from the Makefile rather than replacing it
with "--enable-static-rnd=auto", because the default behavior is to
use only /dev/random, which seems preferable to that of
"--with-static-rnd=auto", which involves silently falling back to
other, possibly less secure methods if opening /dev/random or
/dev/urandom fails.  But I will leave the final decision to the


cd /usr/pkgsrc/security/gnupg


My suggested fix:

Index: Makefile
RCS file: /cvsroot/pkgsrc/security/gnupg/Makefile,v
retrieving revision 1.121
diff -u -r1.121 Makefile
--- Makefile    5 Oct 2013 13:19:51 -0000       1.121
+++ Makefile    26 Oct 2013 17:47:46 -0000
@@ -19,7 +19,6 @@
 GNU_CONFIGURE=         yes
 USE_TOOLS+=            gmake msgfmt
-CONFIGURE_ARGS+=       --with-static-rnd=auto
 CONFIGURE_ARGS+=       --with-mailprog=/usr/sbin/sendmail
 TEST_TARGET=           check
 INFO_FILES=            yes

Home | Main Index | Thread Index | Old Index