gentoo resync : 29.12.2022

1 files changed, 46 insertions, 28 deletions

diff --git a/app-admin/sudo/sudo-9999.ebuild b/app-admin/sudo/sudo-9999.ebuild
index fd7eea23ad7c..afb8327d1680 100644
--- a/app-admin/sudo/sudo-9999.ebuild
+++ b/app-admin/sudo/sudo-9999.ebuild
@@ -1,7 +1,7 @@
 # Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=7
+EAPI=8
 
 inherit pam libtool tmpfiles toolchain-funcs
 
@@ -10,13 +10,12 @@ MY_P="${MY_P/beta/b}"
 
 DESCRIPTION="Allows users or groups to run commands as other users"
 HOMEPAGE="https://www.sudo.ws/"
-if [[ ${PV} == "9999" ]] ; then
+if [[ ${PV} == 9999 ]] ; then
 	inherit mercurial
 	EHG_REPO_URI="https://www.sudo.ws/repos/sudo"
 else
+	VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/sudo.ws.asc
 	inherit verify-sig
-	VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/sudo.ws.asc
-	BDEPEND+="verify-sig? ( sec-keys/openpgp-keys-sudo )"
 
 	uri_prefix=
 	case ${P} in
@@ -32,6 +31,8 @@ else
 	if [[ ${PV} != *_beta* ]] && [[ ${PV} != *_rc* ]] ; then
 		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~sparc-solaris"
 	fi
+
+	BDEPEND+="verify-sig? ( sec-keys/openpgp-keys-sudo )"
 fi
 
 # Basic license is ISC-style as-is, some files are released under
@@ -82,24 +83,27 @@ MAKEOPTS+=" SAMPLES="
 
 src_prepare() {
 	default
+
 	elibtoolize
 }
 
 set_secure_path() {
-	# first extract the default ROOTPATH from build env
-	SECURE_PATH=$(unset ROOTPATH; . "${EPREFIX}"/etc/profile.env;
-		echo "${ROOTPATH}")
-		case "${SECURE_PATH}" in
-			*/usr/sbin*) ;;
-			*) SECURE_PATH=$(unset PATH;
-				. "${EPREFIX}"/etc/profile.env; echo "${PATH}")
-				;;
-		esac
+	# First extract the default ROOTPATH from build env
+	SECURE_PATH=$(unset ROOTPATH; . "${EPREFIX}"/etc/profile.env; echo "${ROOTPATH}")
+
+	case "${SECURE_PATH}" in
+		*/usr/sbin*)
+			;;
+		*)
+			SECURE_PATH=$(unset PATH; . "${EPREFIX}"/etc/profile.env; echo "${PATH}")
+			;;
+	esac
+
 	if [[ -z ${SECURE_PATH} ]] ; then
 		ewarn "	Failed to detect SECURE_PATH, please report this"
 	fi
 
-	# then remove duplicate path entries
+	# Then remove duplicate path entries
 	cleanpath() {
 		local newpath thisp IFS=:
 		for thisp in $1 ; do
@@ -113,11 +117,13 @@ set_secure_path() {
 	}
 	cleanpath /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/bin${SECURE_PATH:+:${SECURE_PATH}}
 
-	# finally, strip gcc paths #136027
+	# Finally, strip gcc paths, bug #136027
 	rmpath() {
 		local e newpath thisp IFS=:
 		for thisp in ${SECURE_PATH} ; do
-			for e ; do [[ ${thisp} == ${e} ]] && continue 2 ; done
+			for e ; do
+				[[ ${thisp} == ${e} ]] && continue 2 ;
+			done
 			newpath+=:${thisp}
 		done
 		SECURE_PATH=${newpath#:}
@@ -127,15 +133,25 @@ set_secure_path() {
 
 src_configure() {
 	local SECURE_PATH
+
 	set_secure_path
-	tc-export PKG_CONFIG #767712
 
-	# audit: somebody got to explain me how I can test this before I
+	# bug #767712
+	tc-export PKG_CONFIG
+
+	# - audit: somebody got to explain me how I can test this before I
 	# enable it.. - Diego
-	# plugindir: autoconf code is crappy and does not delay evaluation
+	# - plugindir: autoconf code is crappy and does not delay evaluation
 	# until `make` time, so we have to use a full path here rather than
 	# basing off other values.
-	myeconfargs=(
+	local myeconfargs=(
+		# We set all of the relevant options by ourselves (patched
+		# into the toolchain) and setting these in the build system
+		# actually causes a downgrade when using e.g. -D_FORTIFY_SOURCE=3
+		# (it'll downgrade to =2). So, this has no functional effect on
+		# the hardening for users. It's safe.
+		--disable-hardening
+
 		# requires some python eclass
 		--disable-python
 		--enable-tmpfiles.d="${EPREFIX}"/usr/lib/tmpfiles.d
@@ -198,26 +214,28 @@ src_install() {
 		newins docs/schema.OpenLDAP sudo.schema
 	fi
 
-	if use pam; then
+	if use pam ; then
 		pamd_mimic system-auth sudo auth account session
 		pamd_mimic system-auth sudo-i auth account session
 	fi
 
 	keepdir /var/db/sudo/lectured
 	fperms 0700 /var/db/sudo/lectured
-	fperms 0711 /var/db/sudo #652958
+	# bug #652958
+	fperms 0711 /var/db/sudo
 
 	# Don't install into /run as that is a tmpfs most of the time
 	# (bug #504854)
 	rm -rf "${ED}"/run || die
 
-	find "${ED}" -type f -name "*.la" -delete || die #697812
+	# bug #697812
+	find "${ED}" -type f -name "*.la" -delete || die
 }
 
 pkg_postinst() {
 	tmpfiles_process sudo.conf
 
-	#652958
+	# bug #652958
 	local sudo_db="${EROOT}/var/db/sudo"
 	if [[ "$(stat -c %a "${sudo_db}")" -ne 711 ]] ; then
 		chmod 711 "${sudo_db}" || die
@@ -225,20 +243,20 @@ pkg_postinst() {
 
 	if use ldap ; then
 		ewarn
-		ewarn "sudo uses the /etc/ldap.conf.sudo file for ldap configuration."
+		ewarn "sudo uses the ${ROOT}/etc/ldap.conf.sudo file for ldap configuration."
 		ewarn
 		if grep -qs '^[[:space:]]*sudoers:' "${ROOT}"/etc/nsswitch.conf ; then
 			ewarn "In 1.7 series, LDAP is no more consulted, unless explicitly"
-			ewarn "configured in /etc/nsswitch.conf."
+			ewarn "configured in ${ROOT}/etc/nsswitch.conf."
 			ewarn
-			ewarn "To make use of LDAP, add this line to your /etc/nsswitch.conf:"
+			ewarn "To make use of LDAP, add this line to your ${ROOT}/etc/nsswitch.conf:"
 			ewarn "  sudoers: ldap files"
 			ewarn
 		fi
 	fi
 	if use prefix ; then
 		ewarn
-		ewarn "To use sudo, you need to change file ownership and permissions"
+		ewarn "To use sudo on Prefix, you need to change file ownership and permissions"
 		ewarn "with root privileges, as follows:"
 		ewarn
 		ewarn "  # chown root:root ${EPREFIX}/usr/bin/sudo"