entropy error for users running this on Synology NAS with pre-3.17 kernels

[drguiom]

this might be a long shot but I can no longer use the package on Synology:

git push fails during unpack-objects with Fatal glibc error: cannot get entropy for arc4random

I am on Synology DSM 7.1.1-42962 Update 9, kernel 3.10.108, which predates the getrandom() syscall (added in Linux 3.17).

It would seem that glibc now calls getrandom() unconditionally and aborts on failure rather than falling back to /dev/urandom the way older glibc did.

Is there a potential fix that would be backward compatible?

[kkimurak]

I have no actual Synology device so cannot test it, but it seems to be possible to change the behavior of git to generate random number by modifying or passing option to meson.build file for git itself.

Line 1570

csprng_backend = get_option('csprng_backend')

Line 1672-1697

# Backends are ordered to reflect our preference for more secure and faster
# ones over the ones that are less so.
if csprng_backend in ['auto', 'arc4random'] and compiler.has_header_symbol('stdlib.h', 'arc4random_buf', required: csprng_backend == 'arc4random')
  libgit_c_args += '-DHAVE_ARC4RANDOM'
  csprng_backend = 'arc4random'
elif csprng_backend in ['auto', 'arc4random_bsd'] and compiler.has_header_symbol('bsd/stdlib.h', 'arc4random_buf', required: csprng_backend == 'arc4random_bsd')
  libgit_c_args += '-DHAVE_ARC4RANDOM_BSD'
  csprng_backend = 'arc4random_bsd'
elif csprng_backend in ['auto', 'getrandom'] and compiler.has_header_symbol('sys/random.h', 'getrandom', required: csprng_backend == 'getrandom')
  libgit_c_args += '-DHAVE_GETRANDOM'
  csprng_backend = 'getrandom'
elif csprng_backend in ['auto', 'getentropy'] and compiler.has_header_symbol('unistd.h', 'getentropy', required: csprng_backend == 'getentropy')
  libgit_c_args += '-DHAVE_GETENTROPY'
  csprng_backend = 'getentropy'
elif csprng_backend in ['auto', 'rtlgenrandom'] and compiler.has_header_symbol('ntsecapi.h', 'RtlGenRandom', prefix: '#include <windows.h>', required: csprng_backend == 'rtlgenrandom')
  libgit_c_args += '-DHAVE_RTLGENRANDOM'
  csprng_backend = 'rtlgenrandom'
elif csprng_backend in ['auto', 'openssl'] and openssl.found()
  libgit_c_args += '-DHAVE_OPENSSL_CSPRNG'
  csprng_backend = 'openssl'
elif csprng_backend in ['auto', 'urandom']
  csprng_backend = 'urandom'
else
  error('Unsupported CSPRNG backend: ' + csprng_backend)
endif

In meson_options.txt the default value is set to auto.

sameersbn/gitlab uses git from gitaly (run make git in gitaly repository dir) by default.
I think we can build git executable which does not use getrandom() if we can apply a patch to gitaly or git itself.

WIP idea: write a patch to add option after meson setup in gitaly's Makefile
like below (example to force urandom, for gitaly v19.2.0):

diff --git a/Makefile b/Makefile
index 68d4ca81f..4c35b6b4e 100644
--- a/Makefile
+++ b/Makefile
@@ -679,7 +679,7 @@ ${DEPENDENCY_DIR}: | ${BUILD_DIR}
 
 ${DEPENDENCY_DIR}/git-distribution/build/git: ${DEPENDENCY_DIR}/git-distribution/meson.build
 	${Q}rm -rf "${DEPENDENCY_DIR}/git-distribution/build"
-	${Q}meson setup "${DEPENDENCY_DIR}/git-distribution" "${DEPENDENCY_DIR}/git-distribution/build" ${GIT_MESON_BUILD_OPTIONS}
+	${Q}meson setup "${DEPENDENCY_DIR}/git-distribution" "${DEPENDENCY_DIR}/git-distribution/build" ${GIT_MESON_BUILD_OPTIONS} -Dcsprng_backend=urandom
 	${Q}meson compile -C "${DEPENDENCY_DIR}/git-distribution/build"
 	${Q}touch $@

Then, save the patch above in sameersbn/docker-gitlab/assets/build/patches/gitaly/add_git_csprng_backend_option and add apply process in sameersbn/docker-gitlab/assets/build/install.sh:

diff --git a/assets/build/install.sh b/assets/build/install.sh
index 840ea87a..31c1c979 100755
--- a/assets/build/install.sh
+++ b/assets/build/install.sh
@@ -168,6 +168,10 @@ rm -rf ${GITLAB_GITALY_INSTALL_DIR}/ruby/vendor/bundle/ruby/**/cache
 chown -R ${GITLAB_USER}: ${GITLAB_GITALY_INSTALL_DIR}
 
 # install git bundled with gitaly.
+find "${GITLAB_BUILD_DIR}/patches/gitaly" -name "*.patch" | while read -r patch_file; do
+  echo "Applying patch ${patch_file}"
+  patch -p1 -i "${patch_file}"
+done
 make -C ${GITLAB_GITALY_BUILD_DIR} git GIT_PREFIX=/usr/local
 
 # clean up

At least build succeed. See kkimurak/docker-gitlab@5998498

WIP note 2: this method is extremely difficult to maintain. The Gitaly Makefile targeted by the patch is updated frequently, causing the patch to stop working quickly.

[drguiom]

many thanks for looking into this, its appreciated