LedgerHQ/ledger-secure-sdk

Can't build on macOS due to using the deprecated `explicit_bzero` function

Opened this issue · 2 comments

shamilsan commented

Description

When trying to build the library on macOS I get an error:

ledger-secure-sdk/src/os.c:331:5: error: call to undeclared function 'explicit_bzero'

There is no explicit_bzero function in macOS SDK's strings.h. There is only bzero function.

Your environment

  • OS and version: macOS 14.1.2 (23B2091)
  • branch that causes this issue: master

Proposed solution

explicit_bzero is not portable and is deprecated in favor of memset. There is the memset_explicit function in the C23 standard, but it has not been added to macOS SDK yet.

Maybe it's worth implementing a custom function for zeroing sensitive information.

void zeroize(void *buf, size_t len) {
    void *volatile const bufv = buf;
    memset(bufv, 0, len);
}
tdejoigny-ledger commented

Hello @shamilsan, you can use our docker image, it's easier to use and it's working on macOS.

shamilsan commented

Hello @shamilsan, you can use our docker image, it's easier to use and it's working on macOS.

Thank you for the suggestion, @tdejoigny-ledger
Yes, I can, but native compilation is simpler and faster for me. Anyway, it is better not to use obsolete functions as they can be removed in the future. And there's no significant barrier to support macOS too.