9 files changed, 129 insertions, 89 deletions
diff --git a/app-crypt/Manifest.gz b/app-crypt/Manifest.gz
index bfbc5d69acc5..0da35ef8e061 100644
--- a/app-crypt/Manifest.gz
+++ b/app-crypt/Manifest.gz
diff --git a/app-crypt/tpm2-tss-engine/Manifest b/app-crypt/tpm2-tss-engine/Manifest
index 617723eb5ead..2c1f8c521d55 100644
--- a/app-crypt/tpm2-tss-engine/Manifest
+++ b/app-crypt/tpm2-tss-engine/Manifest
@@ -1,5 +1,3 @@
-AUX tpm2-tss-engine-1.1.0-tests-Allow-compilation-under-musl.patch 1025 BLAKE2B 4f957dc6a7ceafe53dcf68ded61e2d75d9c09f4b8c056ab92857662e42223b83d99595d7d5c4f89547d3001427a27370d45597349be5261ebd35f30dd105a498 SHA512 6505fa8eba5ead5b75b48d6b4bd1bbf65ac5060fb1d5b77a2b3eec14420fb80d4a712ebb01c7485fc8dd36c5c9a1e9f0b1bd3d9867338858fa63a0070abfec10
-DIST tpm2-tss-engine-1.1.0.tar.gz 394448 BLAKE2B 0502907dc9ce872f31be3b980f975a02af2e3e4b369d188afa5327bd4475d93dbf43769dc7ddc11e8cbda8d1fde09f28a9aef9145e859a90225cd397f62c7a2c SHA512 5d2e08178be54350e8672245023d601a0d9d520f8c49e977af49d7c59b91d033c14b4a347b71e042fe7c5ff12af9fcc43b69fd1dc83a9f0db12d47d43e1107f4
-EBUILD tpm2-tss-engine-1.1.0-r1.ebuild 873 BLAKE2B a08a6ac9fb15bb90576eba365aa80e3c23b67df12a6186a84df4f949e2dfb7995d928ffeddfc66367f93fa62b9da9e0898f617f263aaab16e6caed237f912086 SHA512 828b2b3317317f049a00bd073c257db6b39d3aae9d902a6fc6e8206615b18a6f78e3ad26a1f93bd564ac209d2a9defea80dce849c648e6da550af9557516a823
-EBUILD tpm2-tss-engine-1.1.0-r2.ebuild 995 BLAKE2B 637e5639800057b2f132781774944431bb6bbfcf6c66ad64c08dccfa6a8c1b2a720055788db69a45907e1e1760133d82fa82b83c960ee49053aa07b5a8ef7c48 SHA512 d357f6ce46b93ef9d7d3546dec2d128ff91d5a5aa288c5f69ed18b4e436e618771005610e9d8448c9be4333148495e9101492d9725e1ac01d88f78188ce03caa
+DIST tpm2-tss-engine-1.2.0.tar.gz 410605 BLAKE2B f6b88238ed780315cf23dc9caac4639220e76e8daeeb35a0e9bf2f23efb1b45497dd24f43f97d0f4018440b33e2e80de4f321254b9e58708d04a15a3bd922aae SHA512 cd0f1c3b5251ab2f21159099cdb9c0b1cc68d7ad334d4c5245bba9c07274ecea7c86a531afc9ce6250635a9d0929a5147f461cc3760b15cd6ad099342af87ad0
+EBUILD tpm2-tss-engine-1.2.0.ebuild 912 BLAKE2B 166e641ff7298fdc284dffbcd84293c5be7a8f4232321faa5d6bfe7105216bbc57b3f55ef923efffec9f101da7c4a9ef95acf55aaa8fb7ab3568e001c130b028 SHA512 01f494ce396b6407449034b5e2855bda27692719da4336106a8406eaf11272be968072c08a29079d77ef088cc5c849e2cfb95df509644d8fe0a91eafd005f0a2
 MISC metadata.xml 498 BLAKE2B 00c3e4cdaaf71d33864bfdca3585e9874a6d984aa6d825e8ed2dcc00afa022c5908b37da3e391238f4c7519408d4dcaafff40ceee644312e568627c44bfdecec SHA512 459f2c5d0a6051a81cf5f3c17f65248fe8e1681db2032ccebc2a1c0de6ea427c45bb317ffd374bb141f5f06bc16305e61bc591df9d943821fe1ac0f31e4f5323
diff --git a/app-crypt/tpm2-tss-engine/files/tpm2-tss-engine-1.1.0-tests-Allow-compilation-under-musl.patch b/app-crypt/tpm2-tss-engine/files/tpm2-tss-engine-1.1.0-tests-Allow-compilation-under-musl.patch
deleted file mode 100644
index b8114b4c25c0..000000000000
--- a/app-crypt/tpm2-tss-engine/files/tpm2-tss-engine-1.1.0-tests-Allow-compilation-under-musl.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-https://bugs.gentoo.org/833531
---- a/configure.ac
-+++ b/configure.ac
-@@ -174,6 +174,8 @@ AC_ARG_WITH([device],
-             [with_device_set=no])
- AM_CONDITIONAL([TESTDEVICE],[test "x$with_device_set" = xyes])
- 
-+AC_CHECK_FUNC([backtrace_symbols_fd],[AC_DEFINE([HAVE_EXECINFO],[1], ['Define to 1 if you have the <execinfo.h> header file.'])])
-+
- # Integration test with simulator
- AS_IF([test "x$enable_integration" = xyes && test "x$with_device_set" = xno],
-       [integration_args=""
---- a/test/error_tpm2-tss-engine-common.c
-+++ b/test/error_tpm2-tss-engine-common.c
-@@ -7,7 +7,9 @@
- #include "tpm2-tss-engine.h"
- #include "tpm2-tss-engine-common.h"
- 
-+#ifdef HAVE_EXECINFO
- #include <execinfo.h>
-+#endif
- #include <stdio.h>
- #include <unistd.h>
- #include <setjmp.h>
-@@ -17,8 +19,10 @@ TSS2_RC
- __wrap_Esys_Initialize()
- {
-     printf("Esys_Initialize called\n");
-+#ifdef HAVE_EXECINFO
-     void* b[128];
-     backtrace_symbols_fd(b, backtrace(b, sizeof(b)/sizeof(b[0])), STDOUT_FILENO);
-+#endif
-     return -1;
- }
-     
diff --git a/app-crypt/tpm2-tss-engine/tpm2-tss-engine-1.1.0-r1.ebuild b/app-crypt/tpm2-tss-engine/tpm2-tss-engine-1.1.0-r1.ebuild
deleted file mode 100644
index a737e7269f55..000000000000
--- a/app-crypt/tpm2-tss-engine/tpm2-tss-engine-1.1.0-r1.ebuild
+++ /dev/null
@@ -1,42 +0,0 @@
-# Copyright 1999-2022 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit autotools bash-completion-r1
-
-DESCRIPTION="OpenSSL Engine for TPM2 devices"
-HOMEPAGE="https://github.com/tpm2-software/tpm2-tss-engine"
-SRC_URI="https://github.com/tpm2-software/${PN}/releases/download/v${PV}/${P}.tar.gz"
-
-LICENSE="BSD"
-SLOT="0"
-KEYWORDS="~amd64"
-IUSE="test"
-RESTRICT="!test? ( test )"
-
-RDEPEND="app-crypt/tpm2-tss:=
-	dev-libs/openssl:0="
-DEPEND="${RDEPEND}
-	test? ( dev-util/cmocka )"
-BDEPEND="sys-devel/autoconf-archive
-	virtual/pkgconfig"
-
-src_prepare() {
-	default
-	eautoreconf
-}
-
-src_configure() {
-	econf \
-		$(use_enable test unit) \
-		--disable-defaultflags \
-		--disable-static \
-		--with-completionsdir="$(get_bashcompdir)"
-}
-
-src_install () {
-	default
-	find "${ED}" -name '*.la' -delete || die
-	dobashcomp bash-completion/*
-}
diff --git a/app-crypt/tpm2-tss-engine/tpm2-tss-engine-1.1.0-r2.ebuild b/app-crypt/tpm2-tss-engine/tpm2-tss-engine-1.2.0.ebuild
index c320b9d81d6f..790eff2f51b6 100644
--- a/app-crypt/tpm2-tss-engine/tpm2-tss-engine-1.1.0-r2.ebuild
+++ b/app-crypt/tpm2-tss-engine/tpm2-tss-engine-1.2.0.ebuild
@@ -1,13 +1,13 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=7
+EAPI=8
 
 inherit autotools bash-completion-r1
 
 DESCRIPTION="OpenSSL Engine for TPM2 devices"
 HOMEPAGE="https://github.com/tpm2-software/tpm2-tss-engine"
-SRC_URI="https://github.com/tpm2-software/${PN}/releases/download/v${PV}/${P}.tar.gz"
+SRC_URI="https://github.com/tpm2-software/${PN}/releases/download/${PV}/${P}.tar.gz"
 
 LICENSE="BSD"
 SLOT="0/${PV}"
@@ -23,10 +23,6 @@ DEPEND="${RDEPEND}
 BDEPEND="sys-devel/autoconf-archive
 	virtual/pkgconfig"
 
-PATCHES=(
-	"${FILESDIR}/${PN}-1.1.0-tests-Allow-compilation-under-musl.patch"
-	)
-
 src_prepare() {
 	default
 	eautoreconf
diff --git a/app-crypt/tpm2-tss/Manifest b/app-crypt/tpm2-tss/Manifest
index 06dd0dad2eb3..f2ef148c18d0 100644
--- a/app-crypt/tpm2-tss/Manifest
+++ b/app-crypt/tpm2-tss/Manifest
@@ -2,8 +2,11 @@ AUX tpm2-tss-3.2.0-Dont-run-systemd-sysusers-in-Makefile.patch 2556 BLAKE2B ea87
 AUX tpm2-tss-3.2.0-slibtool.patch 3603 BLAKE2B f0a0047b316396dfa5800702b793bf5247d62be75704be42968b7719a87a25200b6870e14f87ccb45876b53600052b6716386493ddcbead87857093188608621 SHA512 8c20df4be8857dfcf030770e74f27dc14c31f4a5b6eb1a90c9dca6f0dd01987a7983478c0dfe9774669b9f8fc9ddace66d5d51f991582ba3689bcdcea64a1b86
 AUX tpm2-tss-3.2.0-test-fix-usage-of-FILE-in-unit-test-fapi-io.patch 4895 BLAKE2B cb6e4d4544bb78e4fb768b4943dc0ebd381e2a480528d824634f486343955ea29370a731f5bbec222f653a3194615b4cbf13749fa089b58e2ded29e6bcaf06b8 SHA512 1fae2396bcf7bf1af55d4a8e6aa522e8a86344252a3b642c16f84158a3e3eb98dd2d0e2e41c2f13fa25af9452dd1a252bed4af91896aa2efa23029aa0ed1bf2f
 AUX tpm2-tss-3.2.1-Dont-run-systemd-sysusers-in-Makefile.patch 2651 BLAKE2B a14f328ff6942ad76ec16e818730073b2086bcf97542d966ee252cf36e417932ef45c1780f69436af5f032c7b11095e6645bd0a1cf9ab56a93fccdd4bb88ca75 SHA512 434ffe40495bc5adca0eea2a58ae8ef1fc7ff145cc7e096cdd436e96eee420f6f671e9bf5be7254918810773ae2f6a91d04b6039e5cb6cc472b12066ffe5bc49
+AUX tpm2-tss-4.0.0-Dont-install-files-into-run.patch 880 BLAKE2B 8ae9b55e853dcd117730eebc274252ea7afc4e3e415eafb21d3994690687cc9daa796a97536597da8cbfc4f54567cbb678fe61ba4eb4fdc1dee6d851d472efa3 SHA512 811dd1d2597557cf9fd08d7231cd5f48a8dd9dc76adf33bc4a0ee978dc8973fc5309bdc7386cbd9878b78dba1b4a8ecf9c2e2f856c887b141a423f0d94e3244e
 DIST tpm2-tss-3.2.0.tar.gz 1629211 BLAKE2B a89aa4d89a50bdfb5a9652874d30e2138747bd022049f2be2d0b56e296329d0c41254033ec3a062dbd64fde54a62e952f54446c551e5788231827cd53fae045a SHA512 cabb411f074dfa94919ba914849aac77a0ac2f50622e28a1406cf575369148774748e0e2b7a7c566ec83561a96d4b883bac5a3b1763f4cf48668a0c5d68c0a23
 DIST tpm2-tss-3.2.1.tar.gz 1638566 BLAKE2B bdf5eeca1e7269a639cefd8b4a38e16c5b7c08518411a22718dcd14bc9fe3b621eee77cdd98f9ece0f6d9a52319bce5e0a502ff9a6e4ba6716341bd01f5967a9 SHA512 dbe5e29349d78621fcd608d9c75fa58f5e6462264b9654ca85af9f9faafebe1107d9f735a1b6ad4956a089b0dd96cbda3f46364cabd846f9fb29a419b074c78f
+DIST tpm2-tss-4.0.0.tar.gz 1787084 BLAKE2B 9b9d466eab77ae71ec916c911f9e1321013fe49594e103610fcb03492a2f20e811a2faddc2237519b710a1931226d5664581cd671d2318319a92e16bcb5ccfb4 SHA512 1058aa74e2358bfb60a17b85291dc642d40b49bb076453810c5b2b0c37c72671c319d783c879f719ccbe7aaeb5f464e0144c6ee12d28242b477be5d579cb3f9c
 EBUILD tpm2-tss-3.2.0-r4.ebuild 2770 BLAKE2B 72a9aeab39843fa5f59a73c1cd52148ec74d785222474a576f369c78c95be2d76fbc10e8eb8715f3314f5cc3504a09fbd8be26f59867435616af537979254009 SHA512 6dbf11de1a9615d1b19183a84df5fbd113c59cc6df1c82e642461f637bf6334a00e15d5fb28d039473fc594167248ca087e1f2203d8340a4a32c92b1d4e63813
 EBUILD tpm2-tss-3.2.1.ebuild 2239 BLAKE2B 977935a7d06de6eccfa56a2ca9b3ef9ec1c35e66f34e03f866a21cb4b8e88941f8c9e99ee05e9f4bc03d882c262e996b8a59e4a55a28fa48ce7fe070b352544d SHA512 5dae9dbe08390dbfe91c07abe0e5754e61098e41c819c57be66695244d22a3de6ef0599d4d12e3714a0a9d34051d524c3aa702613d3edecb40151432756231df
-MISC metadata.xml 747 BLAKE2B 0462c5942012c444e13bf094be03e0cc142b3b5e3e613570506f84be45bb3019876f3f44454b078668c7e3cbd4a60819cd2ea57c588cab34bfe82f76f222bcf8 SHA512 dab6f379190e40b0321597f0c5fa03ee5731eb77e91dc5d82d2f57c896cf40a074598ba1dedd1575e4e23e1fc5ed306f83cb50992fca6cc2bc1a1db822765a7a
+EBUILD tpm2-tss-4.0.0.ebuild 2319 BLAKE2B f5e3f54f8e99ca205d7c44697515c278da77fec5fe45d8338a6283c777e06f97ee5dd8dcbd1ad06abf5500e45c0a18be08043a74b5dc1b904a6c84340aa1050c SHA512 01f3084f04fb88d177f75e4a9fb6592c6288d1b6e1b06b6ea8fa2910c131522beb156325367cf375f4c53205e3e0554c94499bbb5142c820dcd80ba777c20bb1
+MISC metadata.xml 835 BLAKE2B 58fcbb63b8fd77dd42f081e060cec1fc5593d13ad9237bd644462fd839a1fea9936342d5339a3ec8d339106ca6074c73ac31e7546feb0f1c5f0f212b21831d8a SHA512 941bfce986619b387410d49fe046218a388243c257a3164293033f8ebb4e2d64d7ff06d35dd4ef770a9e9194035839d68dcf1f00edbe439272c2e9c01ecb3c6b
diff --git a/app-crypt/tpm2-tss/files/tpm2-tss-4.0.0-Dont-install-files-into-run.patch b/app-crypt/tpm2-tss/files/tpm2-tss-4.0.0-Dont-install-files-into-run.patch
new file mode 100644
index 000000000000..ca51ab7f9382
--- /dev/null
+++ b/app-crypt/tpm2-tss/files/tpm2-tss-4.0.0-Dont-install-files-into-run.patch
@@ -0,0 +1,26 @@
+diff --git a/Makefile.am b/Makefile.am
+index 2c81cfa9..2673995c 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -767,13 +767,11 @@ define set_tss_permissions
+ endef
+ 
+ define make_fapi_dirs
+-    ($(call make_tss_dir,$(DESTDIR)$(runstatedir)/tpm2-tss/eventlog/) || true) && \
+     ($(call make_tss_dir,$(DESTDIR)$(localstatedir)/lib/tpm2-tss/system/keystore/))
+ endef
+ 
+ define set_fapi_permissions
+     if test -z "${DESTDIR}"; then \ e
+-        ($(call set_tss_permissions,$(DESTDIR)$(runstatedir)/tpm2-tss)) && \
+         ($(call set_tss_permissions,$(DESTDIR)$(localstatedir)/lib/tpm2-tss)) \
+     fi
+ endef
+@@ -784,7 +782,6 @@ endef
+ 
+ define check_fapi_dirs
+     if test -z "${DESTDIR}"; then \
+-        ($(call check_dir,$(DESTDIR)$(runstatedir)/tpm2-tss/eventlog/)) && \
+         ($(call check_dir,$(DESTDIR)$(localstatedir)/lib/tpm2-tss/system/keystore/)) \
+     fi;
+ endef
diff --git a/app-crypt/tpm2-tss/metadata.xml b/app-crypt/tpm2-tss/metadata.xml
index 0a726fa2d171..ada5791c33d5 100644
--- a/app-crypt/tpm2-tss/metadata.xml
+++ b/app-crypt/tpm2-tss/metadata.xml
@@ -13,6 +13,7 @@
 		<flag name="fapi">Enable feature API (requires openssl as crypto backend)</flag>
 		<flag name="mbedtls">Use <pkg>net-libs/mbedtls</pkg> as crypto engine</flag>
 		<flag name="openssl">Use <pkg>dev-libs/openssl</pkg> as crypto engine</flag>
+		<flag name="policy">Enable policy library (requires openssl as crypto backend)</flag>
 	</use>
 	<upstream>
 		<remote-id type="github">tpm2-software/tpm2-tss</remote-id>
diff --git a/app-crypt/tpm2-tss/tpm2-tss-4.0.0.ebuild b/app-crypt/tpm2-tss/tpm2-tss-4.0.0.ebuild
new file mode 100644
index 000000000000..ba650e60ee44
--- /dev/null
+++ b/app-crypt/tpm2-tss/tpm2-tss-4.0.0.ebuild
@@ -0,0 +1,93 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools flag-o-matic linux-info multilib-minimal tmpfiles udev
+
+DESCRIPTION="TCG Trusted Platform Module 2.0 Software Stack"
+HOMEPAGE="https://github.com/tpm2-software/tpm2-tss"
+SRC_URI="https://github.com/tpm2-software/${PN}/releases/download/${PV}/${P}.tar.gz"
+
+LICENSE="BSD-2"
+SLOT="0/4"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc64 ~riscv ~x86"
+IUSE="doc +fapi +openssl mbedtls +policy static-libs test"
+
+RESTRICT="!test? ( test )"
+
+REQUIRED_USE="^^ ( mbedtls openssl )
+		fapi? ( openssl !mbedtls )
+		policy? ( openssl !mbedtls )"
+
+RDEPEND="acct-group/tss
+	acct-user/tss
+	fapi? ( dev-libs/json-c:=[${MULTILIB_USEDEP}]
+		>=net-misc/curl-7.80.0[${MULTILIB_USEDEP}] )
+	mbedtls? ( net-libs/mbedtls:=[${MULTILIB_USEDEP}] )
+	openssl? ( dev-libs/openssl:=[${MULTILIB_USEDEP}] )"
+
+DEPEND="${RDEPEND}
+	test? ( app-crypt/swtpm
+		dev-libs/uthash
+		dev-util/cmocka
+		fapi? ( >=net-misc/curl-7.80.0 ) )"
+BDEPEND="sys-apps/acl
+	virtual/pkgconfig
+	doc? ( app-doc/doxygen )"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-4.0.0-Dont-install-files-into-run.patch"
+	)
+
+pkg_setup() {
+	local CONFIG_CHECK=" \
+		~TCG_TPM
+	"
+	linux-info_pkg_setup
+	kernel_is ge 4 12 0 || ewarn "At least kernel 4.12.0 is required"
+}
+
+src_prepare() {
+	eautoreconf
+	default
+}
+
+multilib_src_configure() {
+	# tests fail with LTO enabbled. See bug 865275 and 865279
+	filter-lto
+
+	ECONF_SOURCE=${S} econf \
+		--localstatedir=/var \
+		$(multilib_native_use_enable doc doxygen-doc) \
+		$(use_enable fapi) \
+		$(use_enable policy) \
+		$(use_enable static-libs static) \
+		$(multilib_native_use_enable test unit) \
+		$(multilib_native_use_enable test integration) \
+		$(multilib_native_use_enable test self-generated-certificate) \
+		--disable-tcti-libtpms \
+		--disable-defaultflags \
+		--disable-weakcrypto \
+		--with-crypto="$(usex mbedtls mbed ossl)" \
+		--with-runstatedir=/run \
+		--with-udevrulesdir="$(get_udevdir)/rules.d" \
+		--with-udevrulesprefix=60- \
+		--without-sysusersdir \
+		--with-tmpfilesdir="/usr/lib/tmpfiles.d"
+}
+
+multilib_src_install() {
+	default
+	keepdir /var/lib/tpm2-tss/system/keystore
+	find "${ED}" -name '*.la' -delete || die
+}
+
+pkg_postinst() {
+	tmpfiles_process tpm2-tss-fapi.conf
+	udev_reload
+}
+
+pkg_postrm() {
+	udev_reload
+}