Remove support for libdecaf.

Fixes #12953

.github/actions/spell-check/allow.txt

@@ -651,7 +651,6 @@ DEBFULLNAME
 debhelper
 debtest
 DEBUGLOG
-decafsigners
 decltype
 deconfigure
 deconfigured
@@ -1810,7 +1809,6 @@ llu
 LMDBQ
 lnc
 lnow
-loaderdecaf
 loadersodium
 loadfile
 loadmodule

.github/workflows/build-and-test-all.yml

@@ -31,7 +31,6 @@ env:
   COVERAGE: ${{ github.repository == 'PowerDNS/pdns' && 'yes' || 'no' }}
   LLVM_PROFILE_FILE: "/tmp/code-%p.profraw"
   OPTIMIZATIONS: yes
-  DECAF_SUPPORT: yes
 
 jobs:
   get-runner-container-image:

.github/workflows/codeql-analysis.yml

@@ -52,7 +52,6 @@ jobs:
       # for clang-tidy only, not compilation
       CLANG_VERSION: '14'
       REPO_HOME: ${{ github.workspace }}
-      DECAF_SUPPORT: no
 
     outputs:
       clang-tidy-annotations-auth: ${{ steps.clang-tidy-annotations-auth.outputs.failed }}

configure.ac

@@ -88,7 +88,6 @@ AC_CHECK_HEADERS(
 AC_CHECK_HEADERS([sys/random.h])
 
 PDNS_WITH_LIBSODIUM
-PDNS_WITH_LIBDECAF
 PDNS_CHECK_LIBCRYPTO([
 ],[
    AC_MSG_ERROR([OpenSSL/libcrypto not found])
@@ -417,11 +416,11 @@ AS_IF([test "x$libcrypto_ecdsa" = "xyes"],
   [AC_MSG_NOTICE([OpenSSL ecdsa: yes])],
   [AC_MSG_NOTICE([OpenSSL ecdsa: no])]
 )
-AS_IF([test "x$LIBSODIUM_LIBS" != "x" || test "x$LIBDECAF_LIBS" != "x" || test "x$libcrypto_ed25519" = "xyes"],
+AS_IF([test "x$LIBSODIUM_LIBS" != "x" || test "x$libcrypto_ed25519" = "xyes"],
   [AC_MSG_NOTICE([ed25519: yes])],
   [AC_MSG_NOTICE([ed25519: no])]
 )
-AS_IF([test "x$LIBDECAF_LIBS" != "x" || test "x$libcrypto_ed448" = "xyes"],
+AS_IF([test "x$libcrypto_ed448" = "xyes"],
   [AC_MSG_NOTICE([ed448: yes])],
   [AC_MSG_NOTICE([ed448: no])]
 )

docs/appendices/compiling.rst

@@ -64,12 +64,6 @@ ed25519 support with libsodium
 The PowerDNS Authoritative Server can link with `libsodium <https://download.libsodium.org/doc/>`_ to support ed25519 (DNSSEC algorithm 15).
 To detect libsodium, use the ``--with-libsodium`` configure option.
 
-ed25519 and ed448 support with libdecaf
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-
-`libdecaf <https://sourceforge.net/projects/ed448goldilocks/>`_ is a library that allows the PowerDNS Authoritative Server to support ed25519 and Ed448 (DNSSEC algorithms 15 and 16).
-To detect libdecaf, use the ``--with-libdecaf`` configure option.
-
 systemd notify support
 ^^^^^^^^^^^^^^^^^^^^^^
 

meson.build

@@ -42,7 +42,6 @@ subdir('meson' / 'net-libs')                # Network Libraries
 subdir('meson' / 'tm-gmtoff')               # Check for tm_gmtoff field in struct tm
 subdir('meson' / 'mmap')                    # Check for mmap
 subdir('meson' / 'libsodium')               # Libsodium-based signers
-subdir('meson' / 'libdecaf')                # Libdecaf-based signers
 subdir('meson' / 'libcrypto')               # OpenSSL-based signers
 subdir('meson' / 'libssl')                  # OpenSSL libssl
 subdir('meson' / 'gnutls')                  # GnuTLS
@@ -128,7 +127,6 @@ deps = [
   dep_lua_records,
   dep_netlibs,
   dep_libsodium,
-  dep_libdecaf,
   dep_libcrypto,
   dep_libssl,
   dep_gnutls,
@@ -440,17 +438,6 @@ if dep_libsodium.found()
   )
 endif
 
-libpdns_signers_decaf = dependency('', required: false)
-if dep_libdecaf.found()
-  libpdns_signers_decaf = declare_dependency(
-    link_whole: static_library(
-      'pdns-signers-decaf',
-      sources: files(src_dir / 'decafsigners.cc'),
-      dependencies: deps,
-    )
-  )
-endif
-
 libpdns_signers_pkcs11 = dependency('', required: false)
 if dep_pkcs11.found()
   libpdns_signers_pkcs11 = declare_dependency(
@@ -692,7 +679,6 @@ tools = {
       libpdns_ssqlite3,
       libpdns_gettime,
       libpdns_signers_openssl,
-      libpdns_signers_decaf,
       libpdns_signers_sodium,
     ],
     'manpages': ['pdns_server.1'],
@@ -705,7 +691,6 @@ tools = {
       dep_modules,
       libpdns_ssqlite3,
       libpdns_signers_openssl,
-      libpdns_signers_decaf,
       libpdns_signers_sodium,
     ],
     'manpages': ['pdnsutil.1'],
@@ -930,7 +915,6 @@ if get_option('unit-tests')
       'deps-extra': [
         libpdns_test,
         libpdns_signers_openssl,
-        libpdns_signers_decaf,
         libpdns_signers_sodium,
       ],
     },

meson_options.txt

@@ -5,7 +5,6 @@ option('hardening-experimental-scp', type: 'feature', value: 'disabled', descrip
 option('hardening-fortify-source', type: 'combo', choices: ['auto', 'disabled', '1', '2', '3'], value: '2', description: 'Source fortification level')
 option('rng-kiss', type: 'boolean', value: false, description: 'Use the unsafe KISS RNG')
 option('signers-libsodium', type: 'feature', value: 'auto', description: 'Enable libsodium-based signers')
-option('signers-libdecaf', type: 'feature', value: 'auto', description: 'Enable libdecaf-based signers')
 option('signers-libcrypto', type: 'feature', value: 'auto', description: 'Enable OpenSSL libcrypto-based signers)')
 option('signers-libcrypto-path', type: 'string', value: '', description: 'Custom path to find OpenSSL libcrypto')
 option('tls-libssl', type: 'feature', value: 'auto', description: 'OpenSSL-based TLS')

pdns/Makefile.am

@@ -45,10 +45,6 @@ if LIBSODIUM
 AM_CPPFLAGS +=$(LIBSODIUM_CFLAGS)
 endif
 
-if LIBDECAF
-AM_CPPFLAGS += $(LIBDECAF_CFLAGS)
-endif
-
 EXTRA_DIST = \
 	dnslabeltext.rl \
 	dnslabeltext.cc \
@@ -316,11 +312,6 @@ pdns_server_SOURCES += sodiumsigners.cc
 pdns_server_LDADD += $(LIBSODIUM_LIBS)
 endif
 
-if LIBDECAF
-pdns_server_SOURCES += decafsigners.cc
-pdns_server_LDADD += $(LIBDECAF_LIBS)
-endif
-
 if SQLITE3
 pdns_server_SOURCES += ssqlite3.cc ssqlite3.hh
 pdns_server_LDADD += $(SQLITE3_LIBS)
@@ -423,11 +414,6 @@ pdnsutil_SOURCES += sodiumsigners.cc
 pdnsutil_LDADD += $(LIBSODIUM_LIBS)
 endif
 
-if LIBDECAF
-pdnsutil_SOURCES += decafsigners.cc
-pdnsutil_LDADD += $(LIBDECAF_LIBS)
-endif
-
 if SQLITE3
 pdnsutil_SOURCES += ssqlite3.cc ssqlite3.hh
 pdnsutil_LDADD += $(SQLITE3_LIBS)
@@ -1482,11 +1468,6 @@ testrunner_LDADD += $(LIBSODIUM_LIBS)
 speedtest_LDADD += $(LIBSODIUM_LIBS)
 endif
 
-if LIBDECAF
-testrunner_SOURCES += decafsigners.cc
-testrunner_LDADD += $(LIBDECAF_LIBS)
-endif
-
 if HAVE_FREEBSD
 ixfrdist_SOURCES += kqueuemplexer.cc
 testrunner_SOURCES += kqueuemplexer.cc