On Fri, Jan 26, 2024 at 03:18:57AM -0500, Nikolaos Chatzikonstantinou wrote:
> On Thu, Jan 25, 2024 at 1:15 PM Daniel Kiper <dkiper@net-space.pl> wrote:
> >
> > Adding Vladimir who knows GRUB history better than I...
> >
> > On Wed, Jan 24, 2024 at 01:23:55AM -0500, Nikolaos Chatzikonstantinou wrote:
> >
> > [...]
> >
> > > My apologies for the repeated messages, but I came up with just one
> > > more question that I'm curious about. To summarize my questions:
> > >
> > > 1. Where is the libgcrypt bundle from grub from? I think my
> > > investigation has led me around version 1.7.0 of libgcrypt, but if I
> > > can get a precise commit or version, that would be useful.
> > >
> > > ... and now to my new question:
> >
> > Vladimir, could you help with that?
> >
> > > 2. What is the reason libgcrypt is bundled as opposed to a regular dependency?
> >
> > I am not entirely sure I understand the question. Could you elaborate?
>
> By bundling, I mean that someone copied libgcrypt files into the GRUB project.
>
> To elaborate further, regular programs (not like GRUB which is a
> bootloader) can link statically or dynamically to libraries; but also,
> there's a third option, to dump the source code of a library directly
> into the source tree of the project. To my understanding this third
> option (which is not really a third linker option as it is not related
> to the linker) is chosen when the project needs to include its own
> patch set to the library. I am curious if GRUB has patched libgcrypt
> for some reason, and is that why libgcrypt is bundled with GRUB?
I think Vladimir could tell us more here...
Anyway, I think we should avoid patching libgcrypt, or any given library
merged with GRUB source, as much as possible.
This was my goal as well. Almost all the changes are difficult to avoid. But at least they are automated in most cases. See import_gcry script. I'm not on my computer now. I hope to find a time to have a look until the end of next week.