Skip to content

Commit 89402cc

Browse files
DennisDyalloclaude
DennisDyallo
and
claude
committed
Merge branch 'main' into develop
Brings PR #427 (static CRT linking, CMake fixes) and 1.15.2 release bookkeeping into develop. Resolved conflict in build-nativeshims.yml by keeping both the CRT verification step (from main) and the updated upload-artifact v7.0.0 (from develop). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2 parents eecf29f + 0bcb6de commit 89402cc

5 files changed

Lines changed: 118 additions & 38 deletions

File tree

‎.github/workflows/build-nativeshims.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,24 @@ jobs:
6060
} else {
6161
& ./build-windows.ps1
6262
}
63+
- name: Verify no VC++ Redistributable dependency
64+
shell: cmd
65+
run: |
66+
call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
67+
cd Yubico.NativeShims
68+
set FAILED=0
69+
for %%a in (win-x64 win-x86 win-arm64) do (
70+
echo Checking %%a\Yubico.NativeShims.dll for CRT dependencies...
71+
dumpbin /imports %%a\Yubico.NativeShims.dll | findstr /i "VCRUNTIME api-ms-win-crt" && (
72+
echo FAIL: %%a\Yubico.NativeShims.dll has VC++ Redistributable dependency
73+
set FAILED=1
74+
) || (
75+
echo PASS: %%a\Yubico.NativeShims.dll has no CRT dependencies
76+
)
77+
)
78+
if %FAILED%==1 exit /b 1
79+
echo All Windows builds verified: no VC++ Redistributable required
80+
exit /b 0
6381
- uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
6482
with:
6583
name: win-x64

‎Yubico.NativeShims/CMakeLists.txt‎

Lines changed: 74 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,30 @@
1-
cmake_minimum_required(VERSION 3.13)
1+
cmake_minimum_required(VERSION 3.15)
22

3-
# Set default version if not provided via command line
3+
#
4+
# Project version
5+
#
46
if(NOT DEFINED PROJECT_VERSION)
57
set(PROJECT_VERSION "1.14.0")
68
endif()
7-
8-
# Set VCPKG manifest version to match project version
99
set(VCPKG_MANIFEST_VERSION ${PROJECT_VERSION})
1010

1111
project(Yubico.NativeShims VERSION ${PROJECT_VERSION})
1212
include(CheckCCompilerFlag)
1313

14+
# =============================================================================
15+
# Platform configuration
16+
#
17+
# Each platform sets:
18+
# PLATFORM_* — boolean flag for conditional logic later
19+
# BACKEND — which smart card API to use (winscard/pcsc/macscard)
20+
# exports file — controls which symbols are visible in the shared library
21+
# hardening — platform-appropriate security compiler/linker flags
22+
# =============================================================================
23+
1424
if (APPLE OR UNIX)
25+
26+
# --- macOS / Linux: platform identity and symbol exports ---
27+
1528
if (APPLE)
1629
set(PLATFORM_MACOS true)
1730
set(BACKEND "macscard")
@@ -20,23 +33,31 @@ if (APPLE OR UNIX)
2033
find_package(PkgConfig REQUIRED)
2134
set(PLATFORM_LINUX true)
2235
set(BACKEND "pcsc")
36+
# RELRO + NOW = full read-only relocations (exploit mitigation)
2337
add_link_options("-Wl,-z,relro,-z,now,--version-script=${CMAKE_CURRENT_SOURCE_DIR}/exports.gnu")
2438
endif()
39+
40+
# --- macOS / Linux: security hardening (GCC/Clang) ---
41+
2542
if (CMAKE_C_COMPILER_ID STREQUAL "Clang" OR
2643
CMAKE_C_COMPILER_ID STREQUAL "AppleClang" OR
2744
CMAKE_C_COMPILER_ID STREQUAL "GNU")
2845

46+
# Warnings — treat all as errors
2947
add_compile_options(-Wall -Wextra -Werror)
3048
add_compile_options(-Wformat -Wformat-nonliteral -Wformat-security)
31-
add_compile_options(-Wshadow)
32-
add_compile_options(-Wcast-qual)
33-
add_compile_options(-Wbad-function-cast)
49+
add_compile_options(-Wshadow -Wcast-qual -Wbad-function-cast)
3450
add_compile_options(-pedantic -pedantic-errors)
51+
52+
# Position-independent code (required for shared libraries)
3553
add_compile_options(-fpic)
36-
add_compile_options(-O2)
37-
add_compile_definitions (-D_FORTIFY_SOURCE=2)
3854
add_link_options(-fpic)
3955

56+
# Optimization and runtime hardening
57+
add_compile_options(-O2)
58+
add_compile_definitions(-D_FORTIFY_SOURCE=2) # Buffer overflow detection in libc calls
59+
60+
# Stack protection — prefer -all variant, fall back to basic
4061
check_c_compiler_flag("-fstack-protector-all" HAVE_STACK_PROTECTOR_ALL)
4162
if (HAVE_STACK_PROTECTOR_ALL)
4263
message(STATUS "-fstack-protector-all support detected")
@@ -55,31 +76,42 @@ if (APPLE OR UNIX)
5576
elseif()
5677
message(WARNING "No compatible compiler found for setting additional security compiler flags.")
5778
endif()
79+
5880
elseif(WIN32)
81+
82+
# --- Windows: platform identity ---
83+
5984
set(PLATFORM_WINDOWS true)
6085
set(BACKEND "winscard")
61-
add_link_options("/guard:cf" "/def:${CMAKE_CURRENT_SOURCE_DIR}/exports.msvc")
62-
add_compile_options("/GS" "/Gs")
63-
endif()
6486

87+
# Security hardening
88+
add_link_options("/guard:cf") # Control Flow Guard
89+
add_compile_options("/GS" "/Gs") # Buffer security check + stack probe
6590

66-
#
67-
# Library dependencies
68-
#
91+
# Symbol exports
92+
add_link_options("/def:${CMAKE_CURRENT_SOURCE_DIR}/exports.msvc")
93+
94+
# Static CRT to avoid VC++ Redistributable dependency (see #391)
95+
set(CMAKE_MSVC_RUNTIME_LIBRARY "MultiThreaded$<$<CONFIG:Debug>:Debug>")
96+
97+
endif()
98+
99+
# =============================================================================
100+
# Dependencies
101+
# =============================================================================
69102

70103
include(${CMAKE_SOURCE_DIR}/cmake/pcscd.cmake)
71104
find_pcscd()
72105
find_package(OpenSSL REQUIRED)
73106

74-
#
75-
# Build definition
76-
#
107+
# =============================================================================
108+
# Build target
109+
# =============================================================================
110+
77111
add_library(Yubico.NativeShims SHARED)
78112

79-
# Enable IPO/LTO (Link time optimization) if supported
80-
# Optional IPO. Do not use IPO if it's not supported by compiler.
113+
# Link-time optimization (cross-file inlining, dead code elimination)
81114
include(CheckIPOSupported)
82-
83115
check_ipo_supported(RESULT result OUTPUT output)
84116
if(result)
85117
message(INFO "IPO is enabled.")
@@ -88,7 +120,7 @@ else()
88120
message(WARNING "IPO is not supported: ${output}")
89121
endif()
90122

91-
# Pre-processor
123+
# Generate header from template (substitutes @VERSION@ etc.)
92124
configure_file(
93125
${CMAKE_CURRENT_SOURCE_DIR}/Yubico.NativeShims.h.in
94126
${CMAKE_CURRENT_SOURCE_DIR}/Yubico.NativeShims.h
@@ -101,33 +133,38 @@ target_include_directories(
101133
"${PROJECT_BINARY_DIR}"
102134
)
103135

104-
# Source
136+
# =============================================================================
137+
# Sources
138+
# =============================================================================
139+
105140
target_sources(
106141
Yubico.NativeShims
107142
PRIVATE
108-
pcsc.c
109-
ssl.bignum.c
110-
ssl.ecgroup.c
111-
ssl.ecpoint.c
112-
ssl.gcmevp.c
113-
ssl.cmac.c
143+
pcsc.c # Smart card (PC/SC) shim
144+
ssl.bignum.c # OpenSSL BIGNUM operations
145+
ssl.ecgroup.c # OpenSSL EC group operations
146+
ssl.ecpoint.c # OpenSSL EC point operations
147+
ssl.gcmevp.c # OpenSSL AES-GCM via EVP interface
148+
ssl.cmac.c # OpenSSL CMAC operations
114149
)
115150

116-
# Add Windows resource file for version info
117151
if(WIN32)
118152
target_sources(
119153
Yubico.NativeShims
120154
PRIVATE
121-
Yubico.NativeShims.rc
155+
Yubico.NativeShims.rc # Windows version info resource
122156
)
123157
endif()
124158

125-
# Linker
159+
# =============================================================================
160+
# Link libraries
161+
# =============================================================================
162+
126163
target_link_libraries(
127164
Yubico.NativeShims
128-
${PCSC_LIBRARIES}
129-
${PCSC_WIN_LIBS}
130-
${PCSC_MACOSX_LIBS}
131-
${PCSC_CUSTOM_LIBS}
132-
OpenSSL::Crypto
165+
${PCSC_LIBRARIES} # Linux: libpcsclite
166+
${PCSC_WIN_LIBS} # Windows: winscard.lib
167+
${PCSC_MACOSX_LIBS} # macOS: PCSC.framework
168+
${PCSC_CUSTOM_LIBS} # Cross-compilation overrides
169+
OpenSSL::Crypto # libcrypto (static via vcpkg on Windows)
133170
)

‎Yubico.NativeShims/readme.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,8 @@ Yubico.NativeShims is a cross-platform C library designed to bridge the gap in n
2020
- Install Visual Studio with C++ workload and ARM64 build tools.
2121
- Use "x64 Native tools command prompt" to navigate and run `./build-windows.ps1`.
2222

23+
> **Note:** The Windows build statically links the MSVC C runtime (`/MT`) so that the resulting DLL does not require the Visual C++ Redistributable to be installed on end-user systems.
24+
2325
### macOS Build
2426

2527
- Requires XCode

‎build/Versions.props‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ for external milestones.
3333
<!--
3434
Common version for both projects. Can be overridden by the below properties if needed
3535
-->
36-
<CommonVersion>1.15.1</CommonVersion>
36+
<CommonVersion>1.15.2</CommonVersion>
3737

3838
<!--
3939
Yubico.Core project

‎docs/users-manual/getting-started/whats-new.md‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,29 @@ Here you can find all of the updates and release notes for published versions of
1818

1919
## 1.15.x Releases
2020

21+
### 1.15.2
22+
23+
Release date: February 27th, 2026
24+
25+
Features:
26+
27+
- Added support for YubiHSM Logon with ECC P-256. This includes new `SessionKeysCommand` and `CredentialWithSecret` classes, `HostChallenge` command, and `GetPubKeyCommand` for ECC-based authentication workflows. ([#407](https://github.com/Yubico/Yubico.NET.SDK/pull/407))
28+
29+
Bug Fixes:
30+
31+
- Fixed an issue where ghost device entries remained in the `YubiKeyDeviceListener` cache after a FIDO reset operation. ([#418](https://github.com/Yubico/Yubico.NET.SDK/pull/418))
32+
- Fixed an issue where trailing NUL bytes in HID device paths could corrupt log output. The device path string is now properly trimmed to remove null characters. ([#416](https://github.com/Yubico/Yubico.NET.SDK/pull/416))
33+
34+
Documentation:
35+
36+
- The documentation on [PIV PIN and touch policies](xref:UsersManualPivAccessControl) has been updated with improved clarity, FIPS-specific details, and updated sample code. ([#411](https://github.com/Yubico/Yubico.NET.SDK/pull/411))
37+
38+
Dependencies:
39+
40+
- Several dependencies across the Yubico.Core and GitHub Actions workflows have been updated to newer versions. ([#419](https://github.com/Yubico/Yubico.NET.SDK/pull/419), [#420](https://github.com/Yubico/Yubico.NET.SDK/pull/420))
41+
42+
_________
43+
2144
### 1.15.1
2245

2346
Release date: January 28th, 2026

0 commit comments

Comments
 (0)