From 082c108e6e409d89a8a4d7b8008c06914db0b6b3 Mon Sep 17 00:00:00 2001 From: Gyorgy Sarvari Date: Mon, 6 Apr 2026 14:03:13 +0200 Subject: leancrypto: upgrade 1.7.0 -> 1.7.1 Contains fix for CVE-2026-34610 (which is however tracked without a version by NVD, so it is marked as patched explicitly) Changelog: - Offer a means to select the AES-C constant time / S-Box implementation via lc_init API - use the AES-C constant time implementation by default - it is about 3 times slower than the AES-C S-Box implementation, but more secure. As the leancrypto library is about secure by default, the CT implementation is just right. Furthermore, if a caller wants to have the faster AES-C S-Box, he can call lc_init(LC_INIT_AES_SBOX) at the beginning. - X.509: fix security issue (CVE-2026-34610) Signed-off-by: Gyorgy Sarvari Signed-off-by: Khem Raj --- .../recipes-crypto/leancrypto/leancrypto_1.7.0.bb | 56 --------------------- .../recipes-crypto/leancrypto/leancrypto_1.7.1.bb | 57 ++++++++++++++++++++++ 2 files changed, 57 insertions(+), 56 deletions(-) delete mode 100644 meta-oe/recipes-crypto/leancrypto/leancrypto_1.7.0.bb create mode 100644 meta-oe/recipes-crypto/leancrypto/leancrypto_1.7.1.bb diff --git a/meta-oe/recipes-crypto/leancrypto/leancrypto_1.7.0.bb b/meta-oe/recipes-crypto/leancrypto/leancrypto_1.7.0.bb deleted file mode 100644 index 7c9187ab94..0000000000 --- a/meta-oe/recipes-crypto/leancrypto/leancrypto_1.7.0.bb +++ /dev/null @@ -1,56 +0,0 @@ -SUMMARY = "Lean cryptographic library with PQC-resistant algorithms" -DESCRIPTION = "leancrypto is a cryptographic library that exclusively contains \ -PQC-resistant cryptographic algorithms. It is lean, has minimal dependencies, \ -supports stack-only operation and provides optimized implementations for \ -ML-KEM (Kyber), ML-DSA (Dilithium), SLH-DSA (Sphincs+) and many more" -HOMEPAGE = "https://leancrypto.org" -LICENSE = "BSD-3-Clause | GPL-2.0-only" -LIC_FILES_CHKSUM = " \ - file://LICENSE;md5=4cc9ea7ae2518fb4fb0bbd9d1a60cbf4 \ - file://LICENSE.bsd;md5=66a5cedaf62c4b2637025f049f9b826f \ - file://LICENSE.gplv2;md5=eb723b61539feef013de476e68b5c50a \ - " -SECTION = "libs" -SRC_URI = "git://github.com/smuellerDD/leancrypto.git;branch=master;protocol=https;tag=v${PV} \ - file://leancrypto-tests.sh \ - " -# SRCREV tagged v1.7.0 -SRCREV = "e60fba94e8cabf1661a1da488b78b84a4fba56e9" - -inherit pkgconfig meson - -EXTRA_OEMESON = "-Dstrip=false" -TARGET_LDFLAGS:append = " ${DEBUG_PREFIX_MAP}" - -PACKAGECONFIG ??= "secure-exec apps tests" -PACKAGECONFIG[apps] = "-Dapps=enabled,-Dapps=disabled" -PACKAGECONFIG[small-stack] = "-Dsmall_stack=enabled,-Dsmall_stack=disabled" -PACKAGECONFIG[no-asm] = "-Ddisable-asm=true,-Ddisable-asm=false" -PACKAGECONFIG[efi] = "-Defi=enabled,-Defi=disabled" -PACKAGECONFIG[secure-exec] = "-Dsecure_execution=enabled,-Dsecure_execution=disabled" -PACKAGECONFIG[tests] = "-Dtests=enabled,-Dtests=disabled" - -do_install:append () { - if ${@bb.utils.contains('PACKAGECONFIG', 'tests', 'true', 'false', d)}; then - install -d ${D}${libexecdir}/leancrypto/tests - for t in $(find ${B} -maxdepth 3 -type f -executable \( -name '*_tester*' -o -name '*_test' \)); do - basename=$(basename "$t") - install -m 0755 "$t" ${D}${libexecdir}/leancrypto/tests/leancrypto_${basename} - done - install -d ${D}${bindir} - install -m 0755 ${UNPACKDIR}/leancrypto-tests.sh ${D}${bindir}/leancrypto-tests - fi -} - -PACKAGES =+ "${PN}-tests ${PN}-apps" - -RDEPENDS:${PN}-apps += "${PN}" -FILES:${PN}-apps = "${bindir}/lc_* \ - ${libexecdir}/leancrypto \ - " -RDEPENDS:${PN}-tests += "${PN}" -FILES:${PN}-tests = "${bindir}/leancrypto-tests \ - ${libexecdir}/leancrypto/tests \ - " - -BBCLASSEXTEND = "native nativesdk" diff --git a/meta-oe/recipes-crypto/leancrypto/leancrypto_1.7.1.bb b/meta-oe/recipes-crypto/leancrypto/leancrypto_1.7.1.bb new file mode 100644 index 0000000000..9e7883ad3c --- /dev/null +++ b/meta-oe/recipes-crypto/leancrypto/leancrypto_1.7.1.bb @@ -0,0 +1,57 @@ +SUMMARY = "Lean cryptographic library with PQC-resistant algorithms" +DESCRIPTION = "leancrypto is a cryptographic library that exclusively contains \ +PQC-resistant cryptographic algorithms. It is lean, has minimal dependencies, \ +supports stack-only operation and provides optimized implementations for \ +ML-KEM (Kyber), ML-DSA (Dilithium), SLH-DSA (Sphincs+) and many more" +HOMEPAGE = "https://leancrypto.org" +LICENSE = "BSD-3-Clause | GPL-2.0-only" +LIC_FILES_CHKSUM = " \ + file://LICENSE;md5=4cc9ea7ae2518fb4fb0bbd9d1a60cbf4 \ + file://LICENSE.bsd;md5=66a5cedaf62c4b2637025f049f9b826f \ + file://LICENSE.gplv2;md5=eb723b61539feef013de476e68b5c50a \ + " +SECTION = "libs" +SRC_URI = "git://github.com/smuellerDD/leancrypto.git;branch=master;protocol=https;tag=v${PV} \ + file://leancrypto-tests.sh \ + " +SRCREV = "e7fa8c87a46c5787174c18fac385aa08eecdedd1" + +inherit pkgconfig meson + +CVE_STATUS[CVE-2026-34610] = "fixed-version: fixed since v1.7.1" + +EXTRA_OEMESON = "-Dstrip=false" +TARGET_LDFLAGS:append = " ${DEBUG_PREFIX_MAP}" + +PACKAGECONFIG ??= "secure-exec apps tests" +PACKAGECONFIG[apps] = "-Dapps=enabled,-Dapps=disabled" +PACKAGECONFIG[small-stack] = "-Dsmall_stack=enabled,-Dsmall_stack=disabled" +PACKAGECONFIG[no-asm] = "-Ddisable-asm=true,-Ddisable-asm=false" +PACKAGECONFIG[efi] = "-Defi=enabled,-Defi=disabled" +PACKAGECONFIG[secure-exec] = "-Dsecure_execution=enabled,-Dsecure_execution=disabled" +PACKAGECONFIG[tests] = "-Dtests=enabled,-Dtests=disabled" + +do_install:append () { + if ${@bb.utils.contains('PACKAGECONFIG', 'tests', 'true', 'false', d)}; then + install -d ${D}${libexecdir}/leancrypto/tests + for t in $(find ${B} -maxdepth 3 -type f -executable \( -name '*_tester*' -o -name '*_test' \)); do + basename=$(basename "$t") + install -m 0755 "$t" ${D}${libexecdir}/leancrypto/tests/leancrypto_${basename} + done + install -d ${D}${bindir} + install -m 0755 ${UNPACKDIR}/leancrypto-tests.sh ${D}${bindir}/leancrypto-tests + fi +} + +PACKAGES =+ "${PN}-tests ${PN}-apps" + +RDEPENDS:${PN}-apps += "${PN}" +FILES:${PN}-apps = "${bindir}/lc_* \ + ${libexecdir}/leancrypto \ + " +RDEPENDS:${PN}-tests += "${PN}" +FILES:${PN}-tests = "${bindir}/leancrypto-tests \ + ${libexecdir}/leancrypto/tests \ + " + +BBCLASSEXTEND = "native nativesdk" -- cgit v1.2.3-54-g00ecf