{"action":"created","issue":{"url":"https://api.github.com/repos/otrv4/libotr-ng/issues/102","repository_url":"https://api.github.com/repos/otrv4/libotr-ng","labels_url":"https://api.github.com/repos/otrv4/libotr-ng/issues/102/labels{/name}","comments_url":"https://api.github.com/repos/otrv4/libotr-ng/issues/102/comments","events_url":"https://api.github.com/repos/otrv4/libotr-ng/issues/102/events","html_url":"https://github.com/otrv4/libotr-ng/issues/102","id":312928863,"number":102,"title":"Missing symbols with libgcrypt 1.7.8","user":{"login":"juniorz","id":30809,"avatar_url":"https://avatars1.githubusercontent.com/u/30809?v=4","gravatar_id":"","url":"https://api.github.com/users/juniorz","html_url":"https://github.com/juniorz","followers_url":"https://api.github.com/users/juniorz/followers","following_url":"https://api.github.com/users/juniorz/following{/other_user}","gists_url":"https://api.github.com/users/juniorz/gists{/gist_id}","starred_url":"https://api.github.com/users/juniorz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/juniorz/subscriptions","organizations_url":"https://api.github.com/users/juniorz/orgs","repos_url":"https://api.github.com/users/juniorz/repos","events_url":"https://api.github.com/users/juniorz/events{/privacy}","received_events_url":"https://api.github.com/users/juniorz/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":9,"created_at":"2018-04-10T13:44:12Z","updated_at":"2018-04-11T14:32:10Z","closed_at":null,"author_association":"OWNER","body":"`make test` (and also `make coverage-check`) fail with the following error on libgcrypt 1.7.8\r\n\r\n```\r\nlibtool: link: gcc -I/usr/include/glib-2.0 -I/usr/lib/x86_64-linux-gnu/glib-2.0/include -I/usr/local/include -DOTRNG_TESTS -g -O0 -Wall -Werror -Wformat -Wno-format-extra-args -Wfatal-errors -Wbad-function-cast -Wdiv-by-zero -Wfloat-equal -Wnested-externs -Wpointer-arith -Wredundant-decls -Wlogical-op -Wformat-nonliteral -o test test-test.o ../test-auth.o ../test-client.o ../test-client_callbacks.o ../test-client_state.o ../test-dake.o ../test-data_message.o ../test-deserialize.o ../test-dh.o ../test-ed448.o ../test-fingerprint.o ../test-fragment.o ../test-instance_tag.o ../test-keys.o ../test-key_management.o ../test-list.o ../test-messaging.o ../test-mpi.o ../test-v3.o ../test-otrng.o ../test-serialize.o ../test-smp.o ../test-str.o ../test-tlv.o ../test-user_profile.o  -lglib-2.0 -L/usr/local/lib /usr/local/lib/libgoldilocks.so -lsodium -lotr\r\n/usr/bin/ld: test-test.o: undefined reference to symbol 'gcry_mpi_new@@GCRYPT_1.6'\r\n//lib/x86_64-linux-gnu/libgcrypt.so.20: error adding symbols: DSO missing from command line\r\ncollect2: error: ld returned 1 exit status\r\n```\r\n\r\nNote there is no `.o` files from libgcrypt added during the linking phase.\r\n\r\nThe output of `./configure` does not seem to find the installed version of libgcrypt (note there is no check for the minimum version 1.6.0 if the maximum version is not found):\r\n\r\n```\r\n...\r\nchecking for pkg-config... /usr/bin/pkg-config\r\nchecking pkg-config is at least version 0.9.0... yes\r\nchecking for GLIB... yes\r\nchecking for LIBGOLDILOCKS... yes\r\nchecking for LIBSODIUM... yes\r\nchecking for libotr CFLAGS... \r\nchecking for libotr LIBS...  -lotr\r\nchecking for libotr headers version 4.x >= 4.0.0... found.\r\nchecking for otrl_message_receiving in -lotr... yes\r\nchecking for libgcrypt-config... /usr/bin/libgcrypt-config\r\nchecking for LIBGCRYPT - version >= 1.8.0... no\r\nchecking for stdint.h... (cached) yes\r\nchecking for stdlib.h... (cached) yes\r\nchecking for string.h... (cached) yes\r\n...\r\n```\r\n\r\nAs a temporary fix, I have on my local machine the following diff, and everything is working as expected with libgcrypt 1.7.8:\r\n\r\n```\r\ndiff --git a/configure.ac b/configure.ac\r\nindex a8cba81..860164f 100644\r\n--- a/configure.ac\r\n+++ b/configure.ac\r\n@@ -59,12 +59,8 @@ PKG_CHECK_MODULES([GLIB], [glib-2.0 >= 2.18])\r\n PKG_CHECK_MODULES([LIBGOLDILOCKS], [libgoldilocks >= 0.0.1])\r\n PKG_CHECK_MODULES([LIBSODIUM], [libsodium >= 1.0.0])\r\n AM_PATH_LIBOTR(4.0.0,,AC_MSG_ERROR(libotr 4.x >= 4.0.0 is required.))\r\n-# TODO: this seems to be not correctly working on Darwin.\r\n-# We probably need the config script\r\n-AM_PATH_LIBGCRYPT(1:1.8.0,,\r\n-  [AC_DEFINE([HAVE_GCRYPT], [1], [Use GCRYPT])],\r\n-  [AM_PATH_LIBGCRYPT(1:1.6.0,, [AC_MSG_ERROR(libgcrypt 1.6.0 or newer is required.)])]\r\n-)\r\n+\r\n+AM_PATH_LIBGCRYPT(1:1.6.0,, [AC_MSG_ERROR(libgcrypt 1.6.0 or newer is required.)])\r\n \r\n dnl Checks for header files.\r\n AC_CHECK_HEADERS([stdint.h stdlib.h string.h])\r\n```\r\n\r\n`./configure` can find the 1.7.8 version:\r\n\r\n```\r\nchecking for pkg-config... /usr/bin/pkg-config\r\nchecking pkg-config is at least version 0.9.0... yes\r\nchecking for GLIB... yes\r\nchecking for LIBGOLDILOCKS... yes\r\nchecking for LIBSODIUM... yes\r\nchecking for libotr CFLAGS... \r\nchecking for libotr LIBS...  -lotr\r\nchecking for libotr headers version 4.x >= 4.0.0... found.\r\nchecking for otrl_message_receiving in -lotr... yes\r\nchecking for libgcrypt-config... /usr/bin/libgcrypt-config\r\nchecking for LIBGCRYPT - version >= 1.6.0... yes (1.7.8)\r\nchecking LIBGCRYPT API version... okay\r\nchecking for stdint.h... (cached) yes\r\nchecking for stdlib.h... (cached) yes\r\nchecking for string.h... (cached) yes\r\n```\r\n\r\nAnd the linker is informed to use `-lgcrypt`\r\n\r\n```\r\nlibtool: link: gcc -I/usr/include/glib-2.0 -I/usr/lib/x86_64-linux-gnu/glib-2.0/include -I/usr/local/include -DOTRNG_TESTS -g -O0 -Wall -Werror -Wformat -Wno-format-extra-args -Wfatal-errors -Wbad-function-cast -Wdiv-by-zero -Wfloat-equal -Wnested-externs -Wpointer-arith -Wredundant-decls -Wlogical-op -Wformat-nonliteral -o test test-test.o ../test-auth.o ../test-client.o ../test-client_callbacks.o ../test-client_state.o ../test-dake.o ../test-data_message.o ../test-deserialize.o ../test-dh.o ../test-ed448.o ../test-fingerprint.o ../test-fragment.o ../test-instance_tag.o ../test-keys.o ../test-key_management.o ../test-list.o ../test-messaging.o ../test-mpi.o ../test-v3.o ../test-otrng.o ../test-serialize.o ../test-smp.o ../test-str.o ../test-tlv.o ../test-user_profile.o  -lglib-2.0 -L/usr/local/lib /usr/local/lib/libgoldilocks.so -lgcrypt -lsodium -lotr\r\n```\r\n\r\nOn the CI, we build libgcrypt 1.8.1 from source and the linker is informed about the appropriate `.o`:\r\n\r\n```\r\nlibtool: link: gcc -std=gnu99 -I/usr/include/glib-2.0 -I/usr/lib/x86_64-linux-gnu/glib-2.0/include -I/usr/local/include -I/usr/local/include -I/usr/local/include -DOTRNG_TESTS -g -O0 -Wall -Werror -Wformat -Wno-format-extra-args -Wfatal-errors -Wbad-function-cast -Wdiv-by-zero -Wfloat-equal -Wnested-externs -Wpointer-arith -Wredundant-decls -Wlogical-op -Wformat-nonliteral -o test test-test.o ../test-auth.o ../test-client.o ../test-client_callbacks.o ../test-client_state.o ../test-dake.o ../test-data_message.o ../test-deserialize.o ../test-dh.o ../test-ed448.o ../test-fingerprint.o ../test-fragment.o ../test-instance_tag.o ../test-keys.o ../test-key_management.o ../test-list.o ../test-messaging.o ../test-mpi.o ../test-v3.o ../test-otrng.o ../test-serialize.o ../test-smp.o ../test-str.o ../test-tlv.o ../test-user_profile.o  -lglib-2.0 -L/usr/local/lib /usr/local/lib/libgoldilocks.so /usr/local/lib/libsodium.so /usr/local/lib/libotr.so /usr/local/lib/libgcrypt.so /usr/local/lib/libgpg-error.so -pthread\r\n``\r\n"},"comment":{"url":"https://api.github.com/repos/otrv4/libotr-ng/issues/comments/380473825","html_url":"https://github.com/otrv4/libotr-ng/issues/102#issuecomment-380473825","issue_url":"https://api.github.com/repos/otrv4/libotr-ng/issues/102","id":380473825,"user":{"login":"olabini","id":6158,"avatar_url":"https://avatars0.githubusercontent.com/u/6158?v=4","gravatar_id":"","url":"https://api.github.com/users/olabini","html_url":"https://github.com/olabini","followers_url":"https://api.github.com/users/olabini/followers","following_url":"https://api.github.com/users/olabini/following{/other_user}","gists_url":"https://api.github.com/users/olabini/gists{/gist_id}","starred_url":"https://api.github.com/users/olabini/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/olabini/subscriptions","organizations_url":"https://api.github.com/users/olabini/orgs","repos_url":"https://api.github.com/users/olabini/repos","events_url":"https://api.github.com/users/olabini/events{/privacy}","received_events_url":"https://api.github.com/users/olabini/received_events","type":"User","site_admin":false},"created_at":"2018-04-11T14:32:10Z","updated_at":"2018-04-11T14:32:10Z","author_association":"CONTRIBUTOR","body":"I feel uncomfortable running the library with a vulnerable version. However, doing an exit() from a library is also EXTREMELY rude..."}}
{"actor":{"display_login":"olabini"}}