@@ -2815,7 +2815,20 @@ AC_ARG_ENABLE([rng-bank],
28152815 dnl request and are right to keep failing on one. A default that walks
28162816 dnl into them turns an unrelated build into a configure error:
28172817 dnl --enable-cryptonly --disable-rng did exactly that.
2818+ dnl --enable-selftest is one such place. It does not set ENABLED_FIPS,
2819+ dnl so FIPS_CERTIFIABLE is "no" and this default used to land on yes --
2820+ dnl but a selftest build withholds the modern DRBG internals from
2821+ dnl random.h (struct DRBG_internal, enum wc_RngHealthState,
2822+ dnl wc_InitRngNonce_ex), which is exactly what rng_bank.c needs. The
2823+ dnl build then died in rng_bank.c and wolfcrypt/test/test.c.
2824+ dnl ENABLED_SELFTEST is not parsed until far later in this file, so test
2825+ dnl the raw autoconf variable: every --enable-* becomes an enable_* shell
2826+ dnl var during option parsing, before any AC_ARG_ENABLE body runs. An
2827+ dnl EXPLICIT --enable-rng-bank is unaffected and still reaches the
2828+ dnl AC_MSG_ERRORs below, which is the intent.
28182829 AS_IF([test "$FIPS_CERTIFIABLE" = "yes"], [ ENABLED_RNG_BANK=no ],
2830+ [test "x$enable_selftest" != "x" && \
2831+ test "x$enable_selftest" != "xno"], [ ENABLED_RNG_BANK=no ],
28192832 [test "$ENABLED_RNG" = "no"], [ ENABLED_RNG_BANK=no ],
28202833 [ ENABLED_RNG_BANK=yes ]) ]
28212834 )
0 commit comments