Skip to content

Hide symbols from transient dependencies #688

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
hvge opened this issue Mar 25, 2025 · 1 comment
Open

Hide symbols from transient dependencies #688

hvge opened this issue Mar 25, 2025 · 1 comment
Assignees

Comments

@hvge
Copy link
Member

hvge commented Mar 25, 2025

Task specification

Hide all symbols from transient dependencies currently provided by PowerAuthCore framework (or .so on Android). Symbols from the following libraries should not be exported in the final module:

  • libcrypto (OpenSSL)
  • libcc7
  • libPowerAuthCoreLib

The reason for this change is that this typically trigger a false positive alerts in some automatic vulnerability scans. For example, OpenSSL currently doesn't support option to turn off MD-5 in the build, so it typically trigger a "broken cryprography" warning, even if we don't use MD-5 at all.

Use -fvisibility=hidden in C compiler flags to do this for each library.

@hvge hvge self-assigned this Mar 25, 2025
@hvge
Copy link
Member Author

hvge commented Mar 25, 2025

Note that this ticket should be back ported to 1.9.x.

@hvge hvge changed the title Hide symbols from transient dependency Hide symbols from transient dependencies Mar 25, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant