diff options
Diffstat (limited to 'dev-libs/openssl')
-rw-r--r-- | dev-libs/openssl/Manifest | 31 | ||||
-rw-r--r-- | dev-libs/openssl/files/openssl-1.1.0k-fix-test_fuzz.patch | 19 | ||||
-rw-r--r-- | dev-libs/openssl/files/openssl-1.1.1b-CVE-2019-1543.patch | 66 | ||||
-rw-r--r-- | dev-libs/openssl/files/openssl-1.1.1b-ec-curves-patch.patch | 207 | ||||
-rw-r--r-- | dev-libs/openssl/openssl-1.0.2s-r1.ebuild (renamed from dev-libs/openssl/openssl-1.0.2s.ebuild) | 61 | ||||
-rw-r--r-- | dev-libs/openssl/openssl-1.0.2s-r200.ebuild | 248 | ||||
-rw-r--r-- | dev-libs/openssl/openssl-1.1.0j-r1.ebuild | 299 | ||||
-rw-r--r-- | dev-libs/openssl/openssl-1.1.0k-r1.ebuild (renamed from dev-libs/openssl/openssl-1.1.1b-r2.ebuild) | 125 | ||||
-rw-r--r-- | dev-libs/openssl/openssl-1.1.0k.ebuild | 298 | ||||
-rw-r--r-- | dev-libs/openssl/openssl-1.1.1c-r1.ebuild (renamed from dev-libs/openssl/openssl-1.1.1c.ebuild) | 92 |
10 files changed, 169 insertions, 1277 deletions
diff --git a/dev-libs/openssl/Manifest b/dev-libs/openssl/Manifest index a0fe883ad4a6..e813bc72a4c0 100644 --- a/dev-libs/openssl/Manifest +++ b/dev-libs/openssl/Manifest @@ -2,8 +2,7 @@ AUX gentoo.config-1.0.2 5158 BLAKE2B bc8b8c0558f84bcbd7c55e4b974458041aa5f31f82c AUX openssl-1.0.2a-x32-asm.patch 1561 BLAKE2B ee5e5b91e4babacff71edf36cce80fbcb2b8dbb9a7ea63a816d3a5de544fbffd8b4216d7a95bd44e718c7a83dd8b8b5ad85caed4205eab5de566b0b7e5054fc1 SHA512 fbb23393e68776e9d34953f85ba3cbb285421d50f06bd297b485c7cffc8d89ca8caff6783f21038ae668b5c75056c89dc652217ac8609b5328e2c28e70ac294c AUX openssl-1.0.2p-hobble-ecc.patch 10875 BLAKE2B fc8240a074f8cc354c5ae584b76b3fc895170e026767d2d99d8bd5e5028614c861dd2b3c7b955c223883062f9a057ee302ae0deecfbbed00ddc53ae8a4d50919 SHA512 29f64bacac4f61071db6caf9d92131633d2dff56d899171888cc4c8432790930ff0912cea90ad03ca59b13ca0357f812d2f0a3f42567e2bd72c260f49b2b59aa AUX openssl-1.1.0j-parallel_install_fix.patch 515 BLAKE2B a1bcffce4dc9e0566e21e753cf1a18ee6eac92aca5880c50b33966d8ecb391f7430e1db6ea5a30ee4e3a9d77fb9e5542e864508b01c325011e368165e079a96c SHA512 0badd29ec8cffd95b2b69a4b8f8eecfc9ea0c00a812b298a650ee353e3965147fd2da1f9058d2d51744838f38168257b89aaf317287c55a7b76f16a69c781828 -AUX openssl-1.1.1b-CVE-2019-1543.patch 2826 BLAKE2B 7e1d67a5f87e70f32d2b9032ec2c4422a172420d88a8c9337fd8d883876729efce4630d2ed342ac54bfd49b0ace685eb730940e9534801e3643742571da76dd4 SHA512 f11c7b8e938dca3528eee36ddb64421072e1fdd6d5dfc40452f36e2db954b3e9ae888416bb26dc73068a14c94404eb66352e37a988f04ecc08600554eab16c99 -AUX openssl-1.1.1b-ec-curves-patch.patch 6841 BLAKE2B f62865ec0cdf246b2b145466b775dbba086ddc4e7066358956e8a5de8a3070634ef2186ff84df2a277d92eea2c3e78ba34a96119db21617e559f3ce77c131727 SHA512 1eb6419b7db282d37b2c84f4425952db833677c67728ac6070b64c08cb5fcac4b32a1fa880d8a6bb2151fbe5afc7920d6ccbb9b8bd43a610e907c5cfafb74f94 +AUX openssl-1.1.0k-fix-test_fuzz.patch 485 BLAKE2B 4dc2ef2b2c1935c8143c939ed6b7168fb070edced8ae47732f1ae9fdabe19887f846d75c15cea33680a54058c9a99f981a3c6a35fc84c3a6c360b4d2b920bc04 SHA512 68590479f096f3da920a5d293f27babd541ce1946944d5540f78d8341b59eeda92fe24743f7351b565e06421d7a2da77e331ebe1e5168023f6602aaa7376a038 DIST openssl-1.0.2-patches-1.5.tar.xz 12404 BLAKE2B 6c1b8c28f339f539b2ab8643379502a24cf62bffde00041dce54d5dd9e8d2620b181362ee5464b0ab32ba4948e209697bfabadbea2944a409a1009100d298f24 SHA512 5725e2d9d1ee8cc074bcef3bed61c71bdab2ff1c114362110c3fb8da11ad5bc8f2ff28e90a293f5f3a5cf96ecda54dffdb7ab3fb3f8b23ef6472250dc3037659 DIST openssl-1.0.2r.tar.gz 5348369 BLAKE2B 9f9c2d2fe6eaf9acacab29b394a318f30c38e831a5f9c193b2da660f9d04acbf407d8b752274783765416c0f5ba557c24ee293ad7fb7d727771db289e6acc901 SHA512 6eb2211f3ad56d7573ac26f388338592c37e5faaf5e2d44c0fa9062c12186e56a324f135d1c956a89b55fcce047e6428bec2756658d103e7275e08b46f741235 DIST openssl-1.0.2r_ec_curve.c 17254 BLAKE2B d40d8d6e770443f07abe70e2c4ddda6aec1cc8e37dc1f226a3fdd9ed5d228f09c6d372e8956b1948b55ee1d57d1429493e7288d0f54d9466a37fec805c85aacb SHA512 8e92fb100bcf4bd918c82b9a6cbd75a55abe1a2c08230a007e441c51577f974f8cc336e9ac8a672b32641480428ca8cead5380da1fe81bacb088145a1b754a15 @@ -13,30 +12,12 @@ DIST openssl-1.0.2s.tar.gz 5349149 BLAKE2B 46c72dcceb5b473b129be0a895f3d6c25a24e DIST openssl-1.0.2s_ec_curve.c 17254 BLAKE2B d40d8d6e770443f07abe70e2c4ddda6aec1cc8e37dc1f226a3fdd9ed5d228f09c6d372e8956b1948b55ee1d57d1429493e7288d0f54d9466a37fec805c85aacb SHA512 8e92fb100bcf4bd918c82b9a6cbd75a55abe1a2c08230a007e441c51577f974f8cc336e9ac8a672b32641480428ca8cead5380da1fe81bacb088145a1b754a15 DIST openssl-1.0.2s_ectest.c 30735 BLAKE2B 95333a27f1cf0a4305a3cee7f6d46b9d4673582ca9acfcf5ba2a0d9d317ab6219cd0d2ff0ba3a55a317c8f5819342f05cc17ba80ec2c92b2b4cab9a3552382e1 SHA512 f2e4d34327b490bc8371f0845c69df3f9fc51ea16f0ea0de0411a0c1fa9d49bb2b6fafc363eb3b3cd919dc7c24e4a0d075c6ff878c01d70dae918f2540874c19 DIST openssl-1.0.2s_hobble-openssl 1302 BLAKE2B 647caa6a0f4c53a2e77baa3b8e5961eaef3bb0ff38e7d5475eab8deef3439f7fe49028ec9ed0406f3453870b62cac67c496b3a048ee4c9ff4c6866d520235960 SHA512 3d757a4708e74a03dd5cb9b8114dfe442ed9520739a6eca693be4c4265771696f1449ea06d1c9bcfc6e94fc9b0dd0c10e153f1c3b0334831c0550b36cd63326e -DIST openssl-1.1.0-build_d2ede125556ac99aa0faa7744c703af3f559094e.patch 3001 BLAKE2B 8f0ac4be6409b4ec50bec171697da2aebe2688e8ae06bd0dfac8b0c74661d38ebeb0a12bde0ef941b213eee9b85965262213b140636060285dcfb02a3bd14961 SHA512 ec6710e9669ac19e4c6f1286c89a383e7d276a773a2740037f98a8f2dbf18305614e7d30d9ed530923a0e7d10a3776fea2ca77229adc25df13ecad55589a3673 -DIST openssl-1.1.0-ec-curves_d2ede125556ac99aa0faa7744c703af3f559094e.patch 5311 BLAKE2B e9ec985adf6f13eb04412158a05da7cbe10be7d64bce73b899152ea379336ece7b7069089ef46993ac301ef850fd46fd0352898e249b2ea9fff5baf20896e5b5 SHA512 c38c4b05195f2b323a07efd8d17335ba2a168a16a59d7941da36568081f1c043da8d2216b7084b0617963635ded9bafeee736ecddbfa251cf0a02e4cba64cdc8 -DIST openssl-1.1.0j.tar.gz 5411919 BLAKE2B 0fbd936f38d30b64bea717a67cd59704c5ce44ee19f377a820f89ba66b9e0a7509cf39e0fb00c104ae6440a6bd811e388239b458ffe685d8601235bab2afb2f1 SHA512 e7d30951ebb3cbcb6d59e3eb40f64f5a84634b7f5c380a588d378973f1c415395e3ab71a9aaff6478a89ec6efcc88f17f1882c99c25dcd18165f1435a51e5768 -DIST openssl-1.1.0j_d2ede125556ac99aa0faa7744c703af3f559094e_ec_curve.c 18401 BLAKE2B f969071ac1b5d0e43b50d54e50b5c4d9201fc8b94458902e9849f14841b5505a2e43ed57a8c13255f042a211af9ee904776c155c36da838a8ad22e1052b02bc1 SHA512 a1c2bb3c3e3d342bddc8c952985e87fc4bad2e8142d5d760b18f346c44c20f00db61c4856f3dcf879b2098e0c036330762915f65d80a1a2cba717d2caeb95457 -DIST openssl-1.1.0j_d2ede125556ac99aa0faa7744c703af3f559094e_ectest.c 30688 BLAKE2B 6673ef0fd139af82d830794179b19b9e06be25fac4a13b8bdfa5fd5dad25f594ce8eab118aab9ec2aab25001e1de127c03f8e1a04f4f3ef4c464b7fb1811ed4a SHA512 240fc72916caf4a8b0af774ce307abfe9a93a762eba6fae760cec79d619fe3db0d6919fc92a8951cb031f73958237700b45f590aa7f9f2890762cccda1f1e74b -DIST openssl-1.1.0j_d2ede125556ac99aa0faa7744c703af3f559094e_hobble-openssl 1117 BLAKE2B c3a1477e63331e83cf1cbe58e9ef131ec500a311e22d3da55034800ca353c387b2e202575acf3badb00b236ff91d4bac1bb131a33930939646d26bec27be6e04 SHA512 fa9cc70afa11a7a292548b4bddbba8159824a364ce5c279b483768e6ae2aa4b5491d9bf2cc734819f30a11c8ee0d91bcb991c4a7ab357296aeb4c04feac74826 +DIST openssl-1.1.0k-bindist-1.0.tar.xz 11716 BLAKE2B c491ba0899c44dbcc63f85b255548c439c965a20a04ac2a6324a4122c4691b7c95ec18e62be6d708a7ea62ea197d32e5091987cb5043969878f89e5bc26243d4 SHA512 1d5bc9d7b24cf55d32d996e2421d43a1218b605720293f00d07814afb481387856f0dc000ad3c3e4cba2361055668cfe79a945be44ab85a249555f37e683a909 DIST openssl-1.1.0k.tar.gz 5287321 BLAKE2B fce40a399f5a08d5fe183dfcaab11b211d982885fb9888b25fa41bdd9919ecd203fca6f573363cfb42c9a0776ae69ea50b0f144227a3f28ca0dbadf878d396bc SHA512 65f41a240a97d79504c0e1391fde8ac8692f0993437cdc35e4bc964ecc36e5ef75a62499c4c6cb4ce63f892135e06dba2d3594c8869d935554296fa3c6ccd822 -DIST openssl-1.1.0k_d2ede125556ac99aa0faa7744c703af3f559094e_ec_curve.c 18401 BLAKE2B f969071ac1b5d0e43b50d54e50b5c4d9201fc8b94458902e9849f14841b5505a2e43ed57a8c13255f042a211af9ee904776c155c36da838a8ad22e1052b02bc1 SHA512 a1c2bb3c3e3d342bddc8c952985e87fc4bad2e8142d5d760b18f346c44c20f00db61c4856f3dcf879b2098e0c036330762915f65d80a1a2cba717d2caeb95457 -DIST openssl-1.1.0k_d2ede125556ac99aa0faa7744c703af3f559094e_ectest.c 30688 BLAKE2B 6673ef0fd139af82d830794179b19b9e06be25fac4a13b8bdfa5fd5dad25f594ce8eab118aab9ec2aab25001e1de127c03f8e1a04f4f3ef4c464b7fb1811ed4a SHA512 240fc72916caf4a8b0af774ce307abfe9a93a762eba6fae760cec79d619fe3db0d6919fc92a8951cb031f73958237700b45f590aa7f9f2890762cccda1f1e74b -DIST openssl-1.1.0k_d2ede125556ac99aa0faa7744c703af3f559094e_hobble-openssl 1117 BLAKE2B c3a1477e63331e83cf1cbe58e9ef131ec500a311e22d3da55034800ca353c387b2e202575acf3badb00b236ff91d4bac1bb131a33930939646d26bec27be6e04 SHA512 fa9cc70afa11a7a292548b4bddbba8159824a364ce5c279b483768e6ae2aa4b5491d9bf2cc734819f30a11c8ee0d91bcb991c4a7ab357296aeb4c04feac74826 -DIST openssl-1.1.1-ec-curves.patch 7265 BLAKE2B 04725d226c430132cf54afbfaa30a82f8f8bbfd3608823d1d0cd42c3c13f417e90762759da3134d7b0c4373e531925db337b681340f2f284cb2f16a4caef22e3 SHA512 de4d0f1635740c57217836a476c420141c0d34a5f90cbf7957aed7a80e7ac9ca036de2d8448e6bf4c122999e308730575899f61cea6e51ab6825dd04890d75a1 -DIST openssl-1.1.1b.tar.gz 8213737 BLAKE2B 7ad9da9548052e2a033a684038f97c420cfffd57994604bcb3fa12640796c8c0aea3d24fb05648ee4940fbec40b81462e81c353da5a41a2575c0585d9718eae8 SHA512 b54025fbb4fe264466f3b0d762aad4be45bd23cd48bdb26d901d4c41a40bfd776177e02230995ab181a695435039dbad313f4b9a563239a70807a2e19ecf045d -DIST openssl-1.1.1b_ec_curve.c 17938 BLAKE2B d5cbde40dcd8608087aed6ffa9feb040ffadecf0c46b7f3978cc468a9503f0a5ad0a426ea6f8db56f49a64474a508bebdf946e01ebf09adc727675f3b180bcdc SHA512 ec470f6514cb9a4f680b8cbbe02e2bbe71639b288f3429d976726047901d9c50377dfb2737f32429da2fb0e52fd67878a86debb54520e307ee196d97b5c66415 -DIST openssl-1.1.1b_ectest.c 35091 BLAKE2B a9602255ab529751c2af2419206ce113f03f93b7b776691ea2ec550f26ddbecd241844bb81dc86988fdbb1c0a587318f82ce4faecba1a6142a19cf08d40fb2c5 SHA512 7813d9b6b7ab62119a7f2dd5431c17c5839f4c320ac7071b0714c9b8528bda5fda779dbb263328dca6ee8446e9fa09c663da659c9a82832a65cf53d1cd8a4cef -DIST openssl-1.1.1b_hobble-openssl 1117 BLAKE2B c3a1477e63331e83cf1cbe58e9ef131ec500a311e22d3da55034800ca353c387b2e202575acf3badb00b236ff91d4bac1bb131a33930939646d26bec27be6e04 SHA512 fa9cc70afa11a7a292548b4bddbba8159824a364ce5c279b483768e6ae2aa4b5491d9bf2cc734819f30a11c8ee0d91bcb991c4a7ab357296aeb4c04feac74826 +DIST openssl-1.1.1c-bindist-1.0.tar.xz 11964 BLAKE2B 8c5190846d13984589a150089d329bb3ecc613788b9462c6f6a1833a040e21cb9bf940140449f09fd797c0e396b0aea073237be374bd16097795b8974c3e7ce5 SHA512 249c6d8c455130b98e3be635f12f323e0cc349f1770648bad591e5de15483917185a473c162ed871a2fa05b47056931e6f12e5fdd9cecee7e6d1c246b862923b DIST openssl-1.1.1c.tar.gz 8864262 BLAKE2B bd157b244bedcefb8e646a743732945119b267236789ac69c38856570318aca09299bdaaea3f20294863b633e6fd4dfe124820597185b3b7461cfdf094daadb0 SHA512 8e2c5cc11c120efbb7d7850980cb6eaa782d29b4996b3f3378d37613c1679f852d7cc08a90d62e78fcec3439f06bdbee70064579a8c2adaffd91532a97f646ff -DIST openssl-1.1.1c_ec_curve.c 17938 BLAKE2B d5cbde40dcd8608087aed6ffa9feb040ffadecf0c46b7f3978cc468a9503f0a5ad0a426ea6f8db56f49a64474a508bebdf946e01ebf09adc727675f3b180bcdc SHA512 ec470f6514cb9a4f680b8cbbe02e2bbe71639b288f3429d976726047901d9c50377dfb2737f32429da2fb0e52fd67878a86debb54520e307ee196d97b5c66415 -DIST openssl-1.1.1c_ectest.c 35091 BLAKE2B a9602255ab529751c2af2419206ce113f03f93b7b776691ea2ec550f26ddbecd241844bb81dc86988fdbb1c0a587318f82ce4faecba1a6142a19cf08d40fb2c5 SHA512 7813d9b6b7ab62119a7f2dd5431c17c5839f4c320ac7071b0714c9b8528bda5fda779dbb263328dca6ee8446e9fa09c663da659c9a82832a65cf53d1cd8a4cef -DIST openssl-1.1.1c_hobble-openssl 1117 BLAKE2B c3a1477e63331e83cf1cbe58e9ef131ec500a311e22d3da55034800ca353c387b2e202575acf3badb00b236ff91d4bac1bb131a33930939646d26bec27be6e04 SHA512 fa9cc70afa11a7a292548b4bddbba8159824a364ce5c279b483768e6ae2aa4b5491d9bf2cc734819f30a11c8ee0d91bcb991c4a7ab357296aeb4c04feac74826 EBUILD openssl-1.0.2r.ebuild 10261 BLAKE2B d69c02146d892718a81ea97c6d946cdbef7fbefdfdbccc1590b961d1514d0c21e5b3f9d52a07465d0848cba20b9d5773092680e95dafb2233232b607582f9834 SHA512 8e5c8ecf64b9684047106fc07d9529f64f34782129975e1dff7777104dd18de66800a75f2cc30dea3d2079e2387843fa742fc470319f53c1bf6574798ddd8630 -EBUILD openssl-1.0.2s-r200.ebuild 7981 BLAKE2B b8b41046e8754f64427bd1da2557d654939e8b16f5be96be731e56c26c23a338807641858712ddc589001e5f7cd20c167dfb6e459b1c1086c7cdfb9d3bc253b1 SHA512 530f96ce8e8543cad92138abc6695b0546819d9eaff26d08ebcbf9fd6b1075e777f395af174087016530bd4ed29f067fbb1c6bbd7647354cb87f6ec600811728 -EBUILD openssl-1.0.2s.ebuild 10274 BLAKE2B 449fe8da38c842deb7d1bd36cadb4f5090b7b969c33ed65279d3aaf6ce8f9082457ead493d203e0497d589834fddd80b20474d1b70af633596bdca334d58099c SHA512 cd1afc4d90d76aea584040334fe354bbe830090259343c82639ca5cd767b450e4f92745b4e7e18e85035f5af14bc9ee29c9f92dbb6a7281f40c42772aed10c8d -EBUILD openssl-1.1.0j-r1.ebuild 10046 BLAKE2B 13160922f67effce50f1d73e7233c9d2b2373c1dcc2a63a33f92614395620c2dae18c9694c6398cb4cd247ed044c310f6472bd5bf9becef2ae54a81b7529d634 SHA512 6bfc16c20ca75c4c150c5e2899c15ff67e0e11b1f9450b55344f69d56474d7e8f50220f8e808d4160331aa3ae1ca0b0548e4e230ce93454f7e82032b289b3b81 -EBUILD openssl-1.1.0k.ebuild 9998 BLAKE2B 6a7f3c750f34cf1e7d202d739cca5bef55cbb1851ac3ef2ae333c0cbdd82b49e00a8d2f79fc4ae52c1b2f3321a38fa735cf54847174735d574e7b4adb055c84d SHA512 ddceb95296e5906cb999c5652cf1f64edb5de7f3093c1eb36d16385882ec759fafeb768937d9c3449c1483f9f61b21c9633feb3aa78ae5181dcf793d846b103d -EBUILD openssl-1.1.1b-r2.ebuild 9593 BLAKE2B 9fc53267f4c5059ea12338a666d8bed60462a23461b79ba3e7e4fbc65d50e2cf9fa4923af8827d67b8fd37ecf8ae7b3f0a332aa12db3b4d9bc9a5acf2beb309c SHA512 fe9b503331830c33fae862fa19e384aa5db198525bbc96ffaa46d4bd807e198d2ae8209345707392a4e5e0e209506b87257e1fafd4e694c6bfc385f2d7675a9a -EBUILD openssl-1.1.1c.ebuild 9525 BLAKE2B ffe3df0bc527dbaedf30e2026f8c976ab2f2d5012e9b5897276288f05165a70c4ff91b5bf5e17762d9dfbfc2bf6d1d6a94268c75790da0f6c6feeb39ea652e9f SHA512 b5539566f093d5c21a3607ef8722c554936a17f65d1035c72530d0d0b2a9d10776b4c7ecd4666f3acc6b700dfdde19551c1e052c694b1ccd7c571bacd943f27a +EBUILD openssl-1.0.2s-r1.ebuild 10613 BLAKE2B f31ebad1aaef7aa81317c681315456874501e00f6f39f6c20e319a4365f4ec34d1c183a70d904dbe106aeb5f4503444cd63ead7cb73974c8fc5571ddba4fe0a3 SHA512 b53254e4b78fbcd48ab4d7cf3b43c5997e31a7487078e8534a18fc03af168f958793e5abd55db3b6a2ffc7baa397b461b588d2299f2a1192deaa5c0aafdeb6ac +EBUILD openssl-1.1.0k-r1.ebuild 9463 BLAKE2B d04ca8cad9e3a763c606b88b66309a11c3f3d1b27af1870dadb258521f110e5d7e6b5482554ee3a00c5a92343542b411ebb084de338d751bd04ccd3afc69a9b4 SHA512 4be3b7b467ca52a35de64d7ec53bb414f67fa30953001a66503336ca32635e8d9d7682a1f15d60e627903bad8d5603c29398b418e263b638c58ff1ec0da42bfd +EBUILD openssl-1.1.1c-r1.ebuild 9297 BLAKE2B 114347e74c4224d73956c4d9e333776da681690779a9e542422a9c15ac8bf624469ad337b3cbbde159b35474631de95a423f2ccdf20d3a2370d086b89fa24b10 SHA512 eb7bfe2b301769fc1e3118bf449c85f8af455c1e0252c3b574b426b4986ee1631581bbbd915c13f75ce9f1e1704f6ced048a0485dae69ba1aafb31f3aa455b65 MISC metadata.xml 1273 BLAKE2B 8eb61c2bfd56f428fa4c262972c0b140662a68c95fdf5e3101624b307985f83dc6d757fc13565e467c99188de93d90ec2db6de3719e22495da67155cbaa91aa9 SHA512 3ffb56f8bc35d71c2c67b4cb97d350825260f9d78c97f4ba9462c2b08b8ef65d7f684139e99bb2f7f32698d3cb62404567b36ce849e7dc4e7f7c5b6367c723a7 diff --git a/dev-libs/openssl/files/openssl-1.1.0k-fix-test_fuzz.patch b/dev-libs/openssl/files/openssl-1.1.0k-fix-test_fuzz.patch new file mode 100644 index 000000000000..2c4cc31257ca --- /dev/null +++ b/dev-libs/openssl/files/openssl-1.1.0k-fix-test_fuzz.patch @@ -0,0 +1,19 @@ +Test fuzz was forgotten when + + Perl: Use our own globbing wrapper rather than File::Glob::glob + +was backported to openssl-1.1.0 branch. + +Link: https://github.com/openssl/openssl/commit/b81cfa07ada850fd287d0a0c82ba280907f18ce7 + +--- a/test/recipes/90-test_fuzz.t ++++ b/test/recipes/90-test_fuzz.t +@@ -9,7 +9,7 @@ + use strict; + use warnings; + +-use if $^O ne "VMS", 'File::Glob' => qw/glob/; ++use OpenSSL::Glob; + use OpenSSL::Test qw/:DEFAULT srctop_file/; + use OpenSSL::Test::Utils; + diff --git a/dev-libs/openssl/files/openssl-1.1.1b-CVE-2019-1543.patch b/dev-libs/openssl/files/openssl-1.1.1b-CVE-2019-1543.patch deleted file mode 100644 index 4d478c484c90..000000000000 --- a/dev-libs/openssl/files/openssl-1.1.1b-CVE-2019-1543.patch +++ /dev/null @@ -1,66 +0,0 @@ -From f426625b6ae9a7831010750490a5f0ad689c5ba3 Mon Sep 17 00:00:00 2001 -From: Matt Caswell <matt@openssl.org> -Date: Tue, 5 Mar 2019 14:39:15 +0000 -Subject: [PATCH] Prevent over long nonces in ChaCha20-Poly1305 - -ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for -every encryption operation. RFC 7539 specifies that the nonce value (IV) -should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and -front pads the nonce with 0 bytes if it is less than 12 bytes. However it -also incorrectly allows a nonce to be set of up to 16 bytes. In this case -only the last 12 bytes are significant and any additional leading bytes are -ignored. - -It is a requirement of using this cipher that nonce values are unique. -Messages encrypted using a reused nonce value are susceptible to serious -confidentiality and integrity attacks. If an application changes the -default nonce length to be longer than 12 bytes and then makes a change to -the leading bytes of the nonce expecting the new value to be a new unique -nonce then such an application could inadvertently encrypt messages with a -reused nonce. - -Additionally the ignored bytes in a long nonce are not covered by the -integrity guarantee of this cipher. Any application that relies on the -integrity of these ignored leading bytes of a long nonce may be further -affected. - -Any OpenSSL internal use of this cipher, including in SSL/TLS, is safe -because no such use sets such a long nonce value. However user -applications that use this cipher directly and set a non-default nonce -length to be longer than 12 bytes may be vulnerable. - -CVE-2019-1543 - -Fixes #8345 - -Reviewed-by: Paul Dale <paul.dale@oracle.com> -Reviewed-by: Richard Levitte <levitte@openssl.org> -(Merged from https://github.com/openssl/openssl/pull/8406) - -(cherry picked from commit 2a3d0ee9d59156c48973592331404471aca886d6) ---- - crypto/evp/e_chacha20_poly1305.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/crypto/evp/e_chacha20_poly1305.c b/crypto/evp/e_chacha20_poly1305.c -index c1917bb86a6..d3e2c622a1b 100644 ---- a/crypto/evp/e_chacha20_poly1305.c -+++ b/crypto/evp/e_chacha20_poly1305.c -@@ -30,6 +30,8 @@ typedef struct { - - #define data(ctx) ((EVP_CHACHA_KEY *)(ctx)->cipher_data) - -+#define CHACHA20_POLY1305_MAX_IVLEN 12 -+ - static int chacha_init_key(EVP_CIPHER_CTX *ctx, - const unsigned char user_key[CHACHA_KEY_SIZE], - const unsigned char iv[CHACHA_CTR_SIZE], int enc) -@@ -533,7 +535,7 @@ static int chacha20_poly1305_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg, - return 1; - - case EVP_CTRL_AEAD_SET_IVLEN: -- if (arg <= 0 || arg > CHACHA_CTR_SIZE) -+ if (arg <= 0 || arg > CHACHA20_POLY1305_MAX_IVLEN) - return 0; - actx->nonce_len = arg; - return 1; diff --git a/dev-libs/openssl/files/openssl-1.1.1b-ec-curves-patch.patch b/dev-libs/openssl/files/openssl-1.1.1b-ec-curves-patch.patch deleted file mode 100644 index c1f53c838230..000000000000 --- a/dev-libs/openssl/files/openssl-1.1.1b-ec-curves-patch.patch +++ /dev/null @@ -1,207 +0,0 @@ -Based on openssl-1.1.1-ec-curves.patch. - -Updated for OpenSSL change b6d41ff73392df5af9c931c902ae4cd75c5b61ea. - ---- a/apps/speed.c -+++ b/apps/speed.c -@@ -489,82 +489,28 @@ static const OPT_PAIR rsa_choices[] = { - static double rsa_results[RSA_NUM][2]; /* 2 ops: sign then verify */ - #endif /* OPENSSL_NO_RSA */ - --#define R_EC_P160 0 --#define R_EC_P192 1 --#define R_EC_P224 2 --#define R_EC_P256 3 --#define R_EC_P384 4 --#define R_EC_P521 5 --#define R_EC_K163 6 --#define R_EC_K233 7 --#define R_EC_K283 8 --#define R_EC_K409 9 --#define R_EC_K571 10 --#define R_EC_B163 11 --#define R_EC_B233 12 --#define R_EC_B283 13 --#define R_EC_B409 14 --#define R_EC_B571 15 --#define R_EC_BRP256R1 16 --#define R_EC_BRP256T1 17 --#define R_EC_BRP384R1 18 --#define R_EC_BRP384T1 19 --#define R_EC_BRP512R1 20 --#define R_EC_BRP512T1 21 --#define R_EC_X25519 22 --#define R_EC_X448 23 -+#define R_EC_P224 0 -+#define R_EC_P256 1 -+#define R_EC_P384 2 -+#define R_EC_P521 3 -+#define R_EC_X25519 4 -+#define R_EC_X448 5 - #ifndef OPENSSL_NO_EC - static OPT_PAIR ecdsa_choices[] = { -- {"ecdsap160", R_EC_P160}, -- {"ecdsap192", R_EC_P192}, - {"ecdsap224", R_EC_P224}, - {"ecdsap256", R_EC_P256}, - {"ecdsap384", R_EC_P384}, - {"ecdsap521", R_EC_P521}, -- {"ecdsak163", R_EC_K163}, -- {"ecdsak233", R_EC_K233}, -- {"ecdsak283", R_EC_K283}, -- {"ecdsak409", R_EC_K409}, -- {"ecdsak571", R_EC_K571}, -- {"ecdsab163", R_EC_B163}, -- {"ecdsab233", R_EC_B233}, -- {"ecdsab283", R_EC_B283}, -- {"ecdsab409", R_EC_B409}, -- {"ecdsab571", R_EC_B571}, -- {"ecdsabrp256r1", R_EC_BRP256R1}, -- {"ecdsabrp256t1", R_EC_BRP256T1}, -- {"ecdsabrp384r1", R_EC_BRP384R1}, -- {"ecdsabrp384t1", R_EC_BRP384T1}, -- {"ecdsabrp512r1", R_EC_BRP512R1}, -- {"ecdsabrp512t1", R_EC_BRP512T1} - }; - # define ECDSA_NUM OSSL_NELEM(ecdsa_choices) - - static double ecdsa_results[ECDSA_NUM][2]; /* 2 ops: sign then verify */ - - static const OPT_PAIR ecdh_choices[] = { -- {"ecdhp160", R_EC_P160}, -- {"ecdhp192", R_EC_P192}, - {"ecdhp224", R_EC_P224}, - {"ecdhp256", R_EC_P256}, - {"ecdhp384", R_EC_P384}, - {"ecdhp521", R_EC_P521}, -- {"ecdhk163", R_EC_K163}, -- {"ecdhk233", R_EC_K233}, -- {"ecdhk283", R_EC_K283}, -- {"ecdhk409", R_EC_K409}, -- {"ecdhk571", R_EC_K571}, -- {"ecdhb163", R_EC_B163}, -- {"ecdhb233", R_EC_B233}, -- {"ecdhb283", R_EC_B283}, -- {"ecdhb409", R_EC_B409}, -- {"ecdhb571", R_EC_B571}, -- {"ecdhbrp256r1", R_EC_BRP256R1}, -- {"ecdhbrp256t1", R_EC_BRP256T1}, -- {"ecdhbrp384r1", R_EC_BRP384R1}, -- {"ecdhbrp384t1", R_EC_BRP384T1}, -- {"ecdhbrp512r1", R_EC_BRP512R1}, -- {"ecdhbrp512t1", R_EC_BRP512T1}, - {"ecdhx25519", R_EC_X25519}, - {"ecdhx448", R_EC_X448} - }; -@@ -1495,29 +1441,10 @@ int speed_main(int argc, char **argv) - unsigned int bits; - } test_curves[] = { - /* Prime Curves */ -- {"secp160r1", NID_secp160r1, 160}, -- {"nistp192", NID_X9_62_prime192v1, 192}, - {"nistp224", NID_secp224r1, 224}, - {"nistp256", NID_X9_62_prime256v1, 256}, - {"nistp384", NID_secp384r1, 384}, - {"nistp521", NID_secp521r1, 521}, -- /* Binary Curves */ -- {"nistk163", NID_sect163k1, 163}, -- {"nistk233", NID_sect233k1, 233}, -- {"nistk283", NID_sect283k1, 283}, -- {"nistk409", NID_sect409k1, 409}, -- {"nistk571", NID_sect571k1, 571}, -- {"nistb163", NID_sect163r2, 163}, -- {"nistb233", NID_sect233r1, 233}, -- {"nistb283", NID_sect283r1, 283}, -- {"nistb409", NID_sect409r1, 409}, -- {"nistb571", NID_sect571r1, 571}, -- {"brainpoolP256r1", NID_brainpoolP256r1, 256}, -- {"brainpoolP256t1", NID_brainpoolP256t1, 256}, -- {"brainpoolP384r1", NID_brainpoolP384r1, 384}, -- {"brainpoolP384t1", NID_brainpoolP384t1, 384}, -- {"brainpoolP512r1", NID_brainpoolP512r1, 512}, -- {"brainpoolP512t1", NID_brainpoolP512t1, 512}, - /* Other and ECDH only ones */ - {"X25519", NID_X25519, 253}, - {"X448", NID_X448, 448} -@@ -2017,9 +1944,9 @@ int speed_main(int argc, char **argv) - # endif - - # ifndef OPENSSL_NO_EC -- ecdsa_c[R_EC_P160][0] = count / 1000; -- ecdsa_c[R_EC_P160][1] = count / 1000 / 2; -- for (i = R_EC_P192; i <= R_EC_P521; i++) { -+ ecdsa_c[R_EC_P224][0] = count / 1000; -+ ecdsa_c[R_EC_P224][1] = count / 1000 / 2; -+ for (i = R_EC_P256; i <= R_EC_P521; i++) { - ecdsa_c[i][0] = ecdsa_c[i - 1][0] / 2; - ecdsa_c[i][1] = ecdsa_c[i - 1][1] / 2; - if (ecdsa_doit[i] <= 1 && ecdsa_c[i][0] == 0) -@@ -2031,6 +1958,7 @@ int speed_main(int argc, char **argv) - } - } - } -+#if 0 - ecdsa_c[R_EC_K163][0] = count / 1000; - ecdsa_c[R_EC_K163][1] = count / 1000 / 2; - for (i = R_EC_K233; i <= R_EC_K571; i++) { -@@ -2059,9 +1987,9 @@ int speed_main(int argc, char **argv) - } - } - } -- -- ecdh_c[R_EC_P160][0] = count / 1000; -- for (i = R_EC_P192; i <= R_EC_P521; i++) { -+#endif -+ ecdh_c[R_EC_P224][0] = count / 1000; -+ for (i = R_EC_P256; i <= R_EC_P521; i++) { - ecdh_c[i][0] = ecdh_c[i - 1][0] / 2; - if (ecdh_doit[i] <= 1 && ecdh_c[i][0] == 0) - ecdh_doit[i] = 0; -@@ -2071,6 +1999,7 @@ int speed_main(int argc, char **argv) - } - } - } -+#if 0 - ecdh_c[R_EC_K163][0] = count / 1000; - for (i = R_EC_K233; i <= R_EC_K571; i++) { - ecdh_c[i][0] = ecdh_c[i - 1][0] / 2; -@@ -2116,6 +2045,7 @@ int speed_main(int argc, char **argv) - } - } - } -+#endif - /* default iteration count for the last two EC Curves */ - ecdh_c[R_EC_X25519][0] = count / 1800; - ecdh_c[R_EC_X448][0] = count / 7200; ---- a/crypto/ec/ecp_smpl.c -+++ b/crypto/ec/ecp_smpl.c -@@ -145,6 +145,11 @@ int ec_GFp_simple_group_set_curve(EC_GROUP *group, - return 0; - } - -+ if (BN_num_bits(p) < 224) { -+ ECerr(EC_F_EC_GFP_SIMPLE_GROUP_SET_CURVE, EC_R_UNSUPPORTED_FIELD); -+ return 0; -+ } -+ - if (ctx == NULL) { - ctx = new_ctx = BN_CTX_new(); - if (ctx == NULL) ---- a/test/ecdsatest.c -+++ b/test/ecdsatest.c -@@ -176,6 +176,7 @@ static int x9_62_tests(void) - if (!change_rand()) - goto x962_err; - -+#if 0 - if (!TEST_true(x9_62_test_internal(NID_X9_62_prime192v1, - "3342403536405981729393488334694600415596881826869351677613", - "5735822328888155254683894997897571951568553642892029982342"))) -@@ -186,6 +187,7 @@ static int x9_62_tests(void) - "3238135532097973577080787768312505059318910517550078427819" - "78505179448783"))) - goto x962_err; -+#endif - - # ifndef OPENSSL_NO_EC2M - if (!TEST_true(x9_62_test_internal(NID_X9_62_c2tnb191v1, diff --git a/dev-libs/openssl/openssl-1.0.2s.ebuild b/dev-libs/openssl/openssl-1.0.2s-r1.ebuild index 57280189ad1b..b4902db7e537 100644 --- a/dev-libs/openssl/openssl-1.0.2s.ebuild +++ b/dev-libs/openssl/openssl-1.0.2s-r1.ebuild @@ -1,9 +1,9 @@ # Copyright 1999-2019 Gentoo Authors # Distributed under the terms of the GNU General Public License v2 -EAPI="6" +EAPI="7" -inherit eutils flag-o-matic toolchain-funcs multilib multilib-minimal +inherit flag-o-matic toolchain-funcs multilib multilib-minimal # openssl-1.0.2-patches-1.6 contain additional CVE patches # which got fixed with this release. @@ -28,9 +28,10 @@ RESTRICT="!bindist? ( bindist )" RDEPEND=">=app-misc/c_rehash-1.7-r1 gmp? ( >=dev-libs/gmp-5.1.3-r1[static-libs(+)?,${MULTILIB_USEDEP}] ) - zlib? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] ) - kerberos? ( >=app-crypt/mit-krb5-1.11.4[${MULTILIB_USEDEP}] )" -DEPEND="${RDEPEND} + kerberos? ( >=app-crypt/mit-krb5-1.11.4[${MULTILIB_USEDEP}] ) + zlib? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] )" +DEPEND="${RDEPEND}" +BDEPEND=" >=dev-lang/perl-5 sctp? ( >=net-misc/lksctp-tools-1.0.12 ) test? ( @@ -95,7 +96,9 @@ src_prepare() { rm -f Makefile if ! use vanilla ; then - eapply "${WORKDIR}"/patch/*.patch + if [[ $(declare -p PATCHES 2>/dev/null) == "declare -a"* ]] ; then + [[ ${#PATCHES[@]} -gt 0 ]] && eapply "${PATCHES[@]}" + fi fi eapply_user @@ -109,7 +112,7 @@ src_prepare() { -e '/^MAKEDEPPROG/s:=.*:=$(CC):' \ -e $(has noman FEATURES \ && echo '/^install:/s:install_docs::' \ - || echo '/^MANDIR=/s:=.*:='${EPREFIX%/}'/usr/share/man:') \ + || echo '/^MANDIR=/s:=.*:='${EPREFIX}'/usr/share/man:') \ Makefile.org \ || die # show the actual commands in the log @@ -134,7 +137,7 @@ src_prepare() { append-flags $(test-flags-CC -Wa,--noexecstack) append-cppflags -DOPENSSL_NO_BUF_FREELISTS - sed -i '1s,^:$,#!'${EPREFIX%/}'/usr/bin/perl,' Configure #141906 + sed -i '1s,^:$,#!'${EPREFIX}'/usr/bin/perl,' Configure #141906 # The config script does stupid stuff to prompt the user. Kill it. sed -i '/stty -icanon min 0 time 50; read waste/d' config || die ./config --test-sanity || die "I AM NOT SANE" @@ -184,7 +187,9 @@ multilib_src_configure() { [[ -z ${sslout} ]] && config="config" # Fedora hobbled-EC needs 'no-ec2m', 'no-srp' - echoit \ + # Make sure user flags don't get added *yet* to avoid duplicated + # flags. + CFLAGS= LDFLAGS= echoit \ ./${config} \ ${sslout} \ $(use cpu_flags_x86_sse2 || echo "no-sse2") \ @@ -206,24 +211,30 @@ multilib_src_configure() { $(use_ssl sslv3 ssl3) \ $(use_ssl tls-heartbeat heartbeats) \ $(use_ssl zlib) \ - --prefix="${EPREFIX%/}"/usr \ - --openssldir="${EPREFIX%/}"${SSL_CNF_DIR} \ + --prefix="${EPREFIX}"/usr \ + --openssldir="${EPREFIX}"${SSL_CNF_DIR} \ --libdir=$(get_libdir) \ shared threads \ || die # Clean out hardcoded flags that openssl uses - local CFLAG=$(grep ^CFLAG= Makefile | LC_ALL=C sed \ + local DEFAULT_CFLAGS=$(grep ^CFLAG= Makefile | LC_ALL=C sed \ -e 's:^CFLAG=::' \ - -e 's:-fomit-frame-pointer ::g' \ - -e 's:-O[0-9] ::g' \ - -e 's:-march=[-a-z0-9]* ::g' \ - -e 's:-mcpu=[-a-z0-9]* ::g' \ - -e 's:-m[a-z0-9]* ::g' \ + -e 's:\(^\| \)-fomit-frame-pointer::g' \ + -e 's:\(^\| \)-O[^ ]*::g' \ + -e 's:\(^\| \)-march=[^ ]*::g' \ + -e 's:\(^\| \)-mcpu=[^ ]*::g' \ + -e 's:\(^\| \)-m[^ ]*::g' \ + -e 's:^ *::' \ + -e 's: *$::' \ + -e 's: \+: :g' \ + -e 's:\\:\\\\:g' ) + + # Now insert clean default flags with user flags sed -i \ - -e "/^CFLAG/s|=.*|=${CFLAG} ${CFLAGS}|" \ - -e "/^SHARED_LDFLAGS=/s|$| ${LDFLAGS}|" \ + -e "/^CFLAG/s|=.*|=${DEFAULT_CFLAGS} ${CFLAGS}|" \ + -e "/^LDFLAGS=/s|=[[:space:]]*$|=${LDFLAGS}|" \ Makefile || die } @@ -243,18 +254,18 @@ multilib_src_test() { multilib_src_install() { # We need to create $ED/usr on our own to avoid a race condition #665130 - if [[ ! -d "${ED%/}/usr" ]]; then + if [[ ! -d "${ED}/usr" ]]; then # We can only create this directory once - mkdir "${ED%/}"/usr || die + mkdir "${ED}"/usr || die fi - emake INSTALL_PREFIX="${D%/}" install + emake INSTALL_PREFIX="${D}" install } multilib_src_install_all() { # openssl installs perl version of c_rehash by default, but # we provide a shell version via app-misc/c_rehash - rm "${ED%/}"/usr/bin/c_rehash || die + rm "${ED}"/usr/bin/c_rehash || die local -a DOCS=( CHANGES* FAQ NEWS README doc/*.txt doc/c-indentation.el ) einstalldocs @@ -303,7 +314,7 @@ multilib_src_install_all() { } pkg_postinst() { - ebegin "Running 'c_rehash ${EROOT%/}${SSL_CNF_DIR}/certs/' to rebuild hashes #333069" - c_rehash "${EROOT%/}${SSL_CNF_DIR}/certs" >/dev/null + ebegin "Running 'c_rehash ${EROOT}${SSL_CNF_DIR}/certs/' to rebuild hashes #333069" + c_rehash "${EROOT}${SSL_CNF_DIR}/certs" >/dev/null eend $? } diff --git a/dev-libs/openssl/openssl-1.0.2s-r200.ebuild b/dev-libs/openssl/openssl-1.0.2s-r200.ebuild deleted file mode 100644 index 44b9547d141e..000000000000 --- a/dev-libs/openssl/openssl-1.0.2s-r200.ebuild +++ /dev/null @@ -1,248 +0,0 @@ -# Copyright 1999-2019 Gentoo Authors -# Distributed under the terms of the GNU General Public License v2 - -EAPI="6" - -inherit eutils flag-o-matic toolchain-funcs multilib multilib-minimal - -# openssl-1.0.2-patches-1.6 contain additional CVE patches -# which got fixed with this release. -# Please use 1.7 version number when rolling a new tarball! -PATCH_SET="openssl-1.0.2-patches-1.5" -MY_P=${P/_/-} -DESCRIPTION="full-strength general purpose cryptography library (including SSL and TLS)" -HOMEPAGE="https://www.openssl.org/" -SRC_URI="mirror://openssl/source/${MY_P}.tar.gz - !vanilla? ( - mirror://gentoo/${PATCH_SET}.tar.xz - https://dev.gentoo.org/~chutzpah/dist/${PN}/${PATCH_SET}.tar.xz - https://dev.gentoo.org/~whissi/dist/${PN}/${PATCH_SET}.tar.xz - https://dev.gentoo.org/~polynomial-c/dist/${PATCH_SET}.tar.xz - )" - -LICENSE="openssl" -SLOT="1.0.0" -KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~x86-fbsd ~x86-linux" -IUSE="+asm bindist gmp kerberos rfc3779 sctp cpu_flags_x86_sse2 sslv2 +sslv3 static-libs test +tls-heartbeat vanilla zlib" -RESTRICT="!bindist? ( bindist )" - -RDEPEND=">=app-misc/c_rehash-1.7-r1 - gmp? ( >=dev-libs/gmp-5.1.3-r1[static-libs(+)?,${MULTILIB_USEDEP}] ) - zlib? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] ) - kerberos? ( >=app-crypt/mit-krb5-1.11.4[${MULTILIB_USEDEP}] ) - !=dev-libs/openssl-1.0.2*:0" -DEPEND="${RDEPEND} - >=dev-lang/perl-5 - sctp? ( >=net-misc/lksctp-tools-1.0.12 ) - test? ( - sys-apps/diffutils - sys-devel/bc - )" - -RESTRICT="test" - -# Do not install any docs -DOCS=() - -# This does not copy the entire Fedora patchset, but JUST the parts that -# are needed to make it safe to use EC with RESTRICT=bindist. -# See openssl.spec for the matching numbering of SourceNNN, PatchNNN -SOURCE1=hobble-openssl -SOURCE12=ec_curve.c -SOURCE13=ectest.c -# These are ported instead -#PATCH1=openssl-1.1.0-build.patch # Fixes EVP testcase for EC -#PATCH37=openssl-1.1.0-ec-curves.patch -FEDORA_GIT_BASE='https://src.fedoraproject.org/cgit/rpms/openssl.git/plain/' -FEDORA_GIT_BRANCH='f25' -FEDORA_SRC_URI=() -FEDORA_SOURCE=( $SOURCE1 $SOURCE12 $SOURCE13 ) -FEDORA_PATCH=( $PATCH1 $PATCH37 ) -for i in "${FEDORA_SOURCE[@]}" ; do - FEDORA_SRC_URI+=( "${FEDORA_GIT_BASE}/${i}?h=${FEDORA_GIT_BRANCH} -> ${P}_${i}" ) -done -for i in "${FEDORA_PATCH[@]}" ; do # Already have a version prefix - FEDORA_SRC_URI+=( "${FEDORA_GIT_BASE}/${i}?h=${FEDORA_GIT_BRANCH} -> ${i}" ) -done -SRC_URI+=" bindist? ( ${FEDORA_SRC_URI[@]} )" - -S="${WORKDIR}/${MY_P}" - -MULTILIB_WRAPPED_HEADERS=( - usr/include/openssl/opensslconf.h -) - -src_prepare() { - if use bindist; then - # This just removes the prefix, and puts it into WORKDIR like the RPM. - for i in "${FEDORA_SOURCE[@]}" ; do - cp -f "${DISTDIR}"/"${P}_${i}" "${WORKDIR}"/"${i}" || die - done - # .spec %prep - bash "${WORKDIR}"/"${SOURCE1}" || die - cp -f "${WORKDIR}"/"${SOURCE12}" "${S}"/crypto/ec/ || die - cp -f "${WORKDIR}"/"${SOURCE13}" "${S}"/crypto/ec/ || die # Moves to test/ in OpenSSL-1.1 - for i in "${FEDORA_PATCH[@]}" ; do - eapply "${DISTDIR}"/"${i}" - done - eapply "${FILESDIR}"/openssl-1.0.2p-hobble-ecc.patch - # Also see the configure parts below: - # enable-ec \ - # $(use_ssl !bindist ec2m) \ - # $(use_ssl !bindist srp) \ - fi - - # keep this in sync with app-misc/c_rehash - SSL_CNF_DIR="/etc/ssl" - - # Make sure we only ever touch Makefile.org and avoid patching a file - # that gets blown away anyways by the Configure script in src_configure - rm -f Makefile - - if ! use vanilla ; then - eapply "${WORKDIR}"/patch/*.patch - fi - - eapply_user - - # disable fips in the build - # make sure the man pages are suffixed #302165 - # don't bother building man pages if they're disabled - sed -i \ - -e '/DIRS/s: fips : :g' \ - -e '/^MANSUFFIX/s:=.*:=ssl:' \ - -e '/^MAKEDEPPROG/s:=.*:=$(CC):' \ - -e $(has noman FEATURES \ - && echo '/^install:/s:install_docs::' \ - || echo '/^MANDIR=/s:=.*:='${EPREFIX%/}'/usr/share/man:') \ - Makefile.org \ - || die - # show the actual commands in the log - sed -i '/^SET_X/s:=.*:=set -x:' Makefile.shared - - # since we're forcing $(CC) as makedep anyway, just fix - # the conditional as always-on - # helps clang (#417795), and versioned gcc (#499818) - # this breaks build with 1.0.2p, not sure if it is needed anymore - #sed -i 's/expr.*MAKEDEPEND.*;/true;/' util/domd || die - - # quiet out unknown driver argument warnings since openssl - # doesn't have well-split CFLAGS and we're making it even worse - # and 'make depend' uses -Werror for added fun (#417795 again) - [[ ${CC} == *clang* ]] && append-flags -Qunused-arguments - - # allow openssl to be cross-compiled - cp "${FILESDIR}"/gentoo.config-1.0.2 gentoo.config || die - chmod a+rx gentoo.config || die - - append-flags -fno-strict-aliasing - append-flags $(test-flags-CC -Wa,--noexecstack) - append-cppflags -DOPENSSL_NO_BUF_FREELISTS - - sed -i '1s,^:$,#!'${EPREFIX%/}'/usr/bin/perl,' Configure #141906 - # The config script does stupid stuff to prompt the user. Kill it. - sed -i '/stty -icanon min 0 time 50; read waste/d' config || die - ./config --test-sanity || die "I AM NOT SANE" - - multilib_copy_sources -} - -multilib_src_configure() { - unset APPS #197996 - unset SCRIPTS #312551 - unset CROSS_COMPILE #311473 - - tc-export CC AR RANLIB RC - - # Clean out patent-or-otherwise-encumbered code - # Camellia: Royalty Free https://en.wikipedia.org/wiki/Camellia_(cipher) - # IDEA: Expired https://en.wikipedia.org/wiki/International_Data_Encryption_Algorithm - # EC: ????????? ??/??/2015 https://en.wikipedia.org/wiki/Elliptic_Curve_Cryptography - # MDC2: Expired https://en.wikipedia.org/wiki/MDC-2 - # RC5: Expired https://en.wikipedia.org/wiki/RC5 - - use_ssl() { usex $1 "enable-${2:-$1}" "no-${2:-$1}" " ${*:3}" ; } - echoit() { echo "$@" ; "$@" ; } - - local krb5=$(has_version app-crypt/mit-krb5 && echo "MIT" || echo "Heimdal") - - # See if our toolchain supports __uint128_t. If so, it's 64bit - # friendly and can use the nicely optimized code paths. #460790 - local ec_nistp_64_gcc_128 - # Disable it for now though #469976 - #if ! use bindist ; then - # echo "__uint128_t i;" > "${T}"/128.c - # if ${CC} ${CFLAGS} -c "${T}"/128.c -o /dev/null >&/dev/null ; then - # ec_nistp_64_gcc_128="enable-ec_nistp_64_gcc_128" - # fi - #fi - - # https://github.com/openssl/openssl/issues/2286 - if use ia64 ; then - replace-flags -g3 -g2 - replace-flags -ggdb3 -ggdb2 - fi - - local sslout=$(./gentoo.config) - einfo "Use configuration ${sslout:-(openssl knows best)}" - local config="Configure" - [[ -z ${sslout} ]] && config="config" - - # Fedora hobbled-EC needs 'no-ec2m', 'no-srp' - echoit \ - ./${config} \ - ${sslout} \ - $(use cpu_flags_x86_sse2 || echo "no-sse2") \ - enable-camellia \ - enable-ec \ - $(use_ssl !bindist ec2m) \ - $(use_ssl !bindist srp) \ - ${ec_nistp_64_gcc_128} \ - enable-idea \ - enable-mdc2 \ - enable-rc5 \ - enable-tlsext \ - $(use_ssl asm) \ - $(use_ssl gmp gmp -lgmp) \ - $(use_ssl kerberos krb5 --with-krb5-flavor=${krb5}) \ - $(use_ssl rfc3779) \ - $(use_ssl sctp) \ - $(use_ssl sslv2 ssl2) \ - $(use_ssl sslv3 ssl3) \ - $(use_ssl tls-heartbeat heartbeats) \ - $(use_ssl zlib) \ - --prefix="${EPREFIX%/}"/usr \ - --openssldir="${EPREFIX%/}"${SSL_CNF_DIR} \ - --libdir=$(get_libdir) \ - shared threads \ - || die - - # Clean out hardcoded flags that openssl uses - local CFLAG=$(grep ^CFLAG= Makefile | LC_ALL=C sed \ - -e 's:^CFLAG=::' \ - -e 's:-fomit-frame-pointer ::g' \ - -e 's:-O[0-9] ::g' \ - -e 's:-march=[-a-z0-9]* ::g' \ - -e 's:-mcpu=[-a-z0-9]* ::g' \ - -e 's:-m[a-z0-9]* ::g' \ - ) - sed -i \ - -e "/^CFLAG/s|=.*|=${CFLAG} ${CFLAGS}|" \ - -e "/^SHARED_LDFLAGS=/s|$| ${LDFLAGS}|" \ - Makefile || die -} - -multilib_src_compile() { - # depend is needed to use $confopts; it also doesn't matter - # that it's -j1 as the code itself serializes subdirs - emake -j1 V=1 depend - emake build_libs -} - -multilib_src_test() { - emake -j1 test -} - -multilib_src_install() { - dolib.so lib{crypto,ssl}.so.${SLOT} -} diff --git a/dev-libs/openssl/openssl-1.1.0j-r1.ebuild b/dev-libs/openssl/openssl-1.1.0j-r1.ebuild deleted file mode 100644 index 165f6d9a0500..000000000000 --- a/dev-libs/openssl/openssl-1.1.0j-r1.ebuild +++ /dev/null @@ -1,299 +0,0 @@ -# Copyright 1999-2019 Gentoo Authors -# Distributed under the terms of the GNU General Public License v2 - -EAPI="6" - -inherit flag-o-matic toolchain-funcs multilib multilib-minimal - -MY_P=${P/_/-} -DESCRIPTION="full-strength general purpose cryptography library (including SSL and TLS)" -HOMEPAGE="https://www.openssl.org/" -SRC_URI="mirror://openssl/source/${MY_P}.tar.gz" - -LICENSE="openssl" -SLOT="0/1.1" # .so version of libssl/libcrypto -KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~x86-fbsd ~x86-linux" -IUSE="+asm bindist elibc_musl rfc3779 sctp cpu_flags_x86_sse2 static-libs test tls-heartbeat vanilla zlib" -RESTRICT="!bindist? ( bindist )" - -RDEPEND=">=app-misc/c_rehash-1.7-r1 - zlib? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] )" -DEPEND="${RDEPEND} - >=dev-lang/perl-5 - sctp? ( >=net-misc/lksctp-tools-1.0.12 ) - test? ( - sys-apps/diffutils - sys-devel/bc - )" -PDEPEND="app-misc/ca-certificates" - -# This does not copy the entire Fedora patchset, but JUST the parts that -# are needed to make it safe to use EC with RESTRICT=bindist. -# See openssl.spec for the matching numbering of SourceNNN, PatchNNN -SOURCE1=hobble-openssl -SOURCE12=ec_curve.c -SOURCE13=ectest.c -PATCH1=openssl-1.1.0-build.patch # Fixes EVP testcase for EC -PATCH37=openssl-1.1.0-ec-curves.patch -FEDORA_GIT_BASE='https://src.fedoraproject.org/cgit/rpms/openssl.git/plain/' -FEDORA_GIT_BRANCH='f28' -FEDORA_GIT_COMMIT="d2ede125556ac99aa0faa7744c703af3f559094e" -FEDORA_SRC_URI=() -FEDORA_SOURCE=( $SOURCE1 $SOURCE12 $SOURCE13 ) -FEDORA_PATCH=( $PATCH1 $PATCH37 ) -for i in "${FEDORA_SOURCE[@]}" ; do - FEDORA_SRC_URI+=( "${FEDORA_GIT_BASE}/${i}?h=${FEDORA_GIT_BRANCH}&id=${FEDORA_GIT_COMMIT} -> ${P}_${FEDORA_GIT_COMMIT}_${i}" ) -done -for i in "${FEDORA_PATCH[@]}" ; do # Already have a version prefix - FEDORA_SRC_URI+=( "${FEDORA_GIT_BASE}/${i}?h=${FEDORA_GIT_BRANCH}&id=${FEDORA_GIT_COMMIT} -> ${i%.patch}_${FEDORA_GIT_COMMIT}.patch" ) -done -SRC_URI+=" bindist? ( ${FEDORA_SRC_URI[@]} )" - -S="${WORKDIR}/${MY_P}" - -MULTILIB_WRAPPED_HEADERS=( - usr/include/openssl/opensslconf.h -) - -PATCHES=( - "${FILESDIR}"/${PN}-1.0.2a-x32-asm.patch #542618 - "${FILESDIR}"/${PN}-1.1.0j-parallel_install_fix.patch #671602 - "${FILESDIR}"/${PN}-1.1.1b-CVE-2019-1543.patch -) - -src_prepare() { - if use bindist; then - # we need to patch the patch but we cannot patch in DISTDIR... - mkdir "${WORKDIR}"/fedora_patches || die - for i in "${FEDORA_PATCH[@]}" ; do - cp "${DISTDIR}"/"${i%.patch}_${FEDORA_GIT_COMMIT}.patch" "${WORKDIR}"/fedora_patches || die - done - - # now patch the path, due to OpenSSL change cb193560e0da17a41b40ce574a2349f1d4d59ed1 - sed -i -e 's#test/evptests.txt#test/recipes/30-test_evp_data/evppkey.txt#g' \ - "${WORKDIR}"/fedora_patches/openssl-1.1.0-build_d2ede125556ac99aa0faa7744c703af3f559094e.patch || \ - die - - # This just removes the prefix, and puts it into WORKDIR like the RPM. - for i in "${FEDORA_SOURCE[@]}" ; do - cp -f "${DISTDIR}"/"${P}_${FEDORA_GIT_COMMIT}_${i}" "${WORKDIR}"/"${i}" || die - done - # .spec %prep - bash "${WORKDIR}"/"${SOURCE1}" || die - cp -f "${WORKDIR}"/"${SOURCE12}" "${S}"/crypto/ec/ || die - cp -f "${WORKDIR}"/"${SOURCE13}" "${S}"/test/ || die - for i in "${FEDORA_PATCH[@]}" ; do - #eapply "${DISTDIR}"/"${i%.patch}_${FEDORA_GIT_COMMIT}.patch" - eapply "${WORKDIR}/fedora_patches/${i%.patch}_${FEDORA_GIT_COMMIT}.patch" - done - # Also see the configure parts below: - # enable-ec \ - # $(use_ssl !bindist ec2m) \ - - fi - # keep this in sync with app-misc/c_rehash - SSL_CNF_DIR="/etc/ssl" - - # Make sure we only ever touch Makefile.org and avoid patching a file - # that gets blown away anyways by the Configure script in src_configure - rm -f Makefile - - if ! use vanilla ; then - eapply "${PATCHES[@]}" - fi - - eapply_user #332661 - - # make sure the man pages are suffixed #302165 - # don't bother building man pages if they're disabled - # Make DOCDIR Gentoo compliant - sed -i \ - -e '/^MANSUFFIX/s:=.*:=ssl:' \ - -e '/^MAKEDEPPROG/s:=.*:=$(CC):' \ - -e $(has noman FEATURES \ - && echo '/^install:/s:install_docs::' \ - || echo '/^MANDIR=/s:=.*:='${EPREFIX}'/usr/share/man:') \ - -e "/^DOCDIR/s@\$(BASENAME)@&-${PVR}@" \ - Configurations/unix-Makefile.tmpl \ - || die - - # show the actual commands in the log - sed -i '/^SET_X/s@=.*@=set -x@' Makefile.shared || die - - # quiet out unknown driver argument warnings since openssl - # doesn't have well-split CFLAGS and we're making it even worse - # and 'make depend' uses -Werror for added fun (#417795 again) - [[ ${CC} == *clang* ]] && append-flags -Qunused-arguments - - # allow openssl to be cross-compiled - cp "${FILESDIR}"/gentoo.config-1.0.2 gentoo.config || die - chmod a+rx gentoo.config || die - - append-flags -fno-strict-aliasing - append-flags $(test-flags-CC -Wa,--noexecstack) - append-cppflags -DOPENSSL_NO_BUF_FREELISTS - - # Prefixify Configure shebang (#141906) - sed \ - -e "1s,/usr/bin/env,${EPREFIX}&," \ - -i Configure || die - # Remove test target when FEATURES=test isn't set - if ! use test ; then - sed \ - -e '/^$config{dirs}/s@ "test",@@' \ - -i Configure || die - fi - # The config script does stupid stuff to prompt the user. Kill it. - sed -i '/stty -icanon min 0 time 50; read waste/d' config || die - ./config --test-sanity || die "I AM NOT SANE" - - multilib_copy_sources -} - -multilib_src_configure() { - unset APPS #197996 - unset SCRIPTS #312551 - unset CROSS_COMPILE #311473 - - tc-export CC AR RANLIB RC - - # Clean out patent-or-otherwise-encumbered code - # Camellia: Royalty Free https://en.wikipedia.org/wiki/Camellia_(cipher) - # IDEA: Expired https://en.wikipedia.org/wiki/International_Data_Encryption_Algorithm - # EC: ????????? ??/??/2015 https://en.wikipedia.org/wiki/Elliptic_Curve_Cryptography - # MDC2: Expired https://en.wikipedia.org/wiki/MDC-2 - # RC5: Expired https://en.wikipedia.org/wiki/RC5 - - use_ssl() { usex $1 "enable-${2:-$1}" "no-${2:-$1}" " ${*:3}" ; } - echoit() { echo "$@" ; "$@" ; } - - local krb5=$(has_version app-crypt/mit-krb5 && echo "MIT" || echo "Heimdal") - - # See if our toolchain supports __uint128_t. If so, it's 64bit - # friendly and can use the nicely optimized code paths. #460790 - local ec_nistp_64_gcc_128 - # Disable it for now though #469976 - #if ! use bindist ; then - # echo "__uint128_t i;" > "${T}"/128.c - # if ${CC} ${CFLAGS} -c "${T}"/128.c -o /dev/null >&/dev/null ; then - # ec_nistp_64_gcc_128="enable-ec_nistp_64_gcc_128" - # fi - #fi - - local sslout=$(./gentoo.config) - einfo "Use configuration ${sslout:-(openssl knows best)}" - local config="Configure" - [[ -z ${sslout} ]] && config="config" - - # Fedora hobbled-EC needs 'no-ec2m' - # 'srp' was restricted until early 2017 as well. - # "disable-deprecated" option breaks too many consumers. - # Don't set it without thorough revdeps testing. - echoit \ - ./${config} \ - ${sslout} \ - $(use cpu_flags_x86_sse2 || echo "no-sse2") \ - enable-camellia \ - enable-ec \ - $(use_ssl !bindist ec2m) \ - enable-srp \ - $(use elibc_musl && echo "no-async") \ - ${ec_nistp_64_gcc_128} \ - enable-idea \ - enable-mdc2 \ - enable-rc5 \ - $(use_ssl asm) \ - $(use_ssl rfc3779) \ - $(use_ssl sctp) \ - $(use_ssl tls-heartbeat heartbeats) \ - $(use_ssl zlib) \ - --prefix="${EPREFIX}"/usr \ - --openssldir="${EPREFIX}"${SSL_CNF_DIR} \ - --libdir=$(get_libdir) \ - shared threads \ - || die - - # Clean out hardcoded flags that openssl uses - # Fix quoting for sed - local DEFAULT_CFLAGS=$(grep ^CFLAGS= Makefile | LC_ALL=C sed \ - -e 's:^CFLAGS=::' \ - -e 's:-fomit-frame-pointer ::g' \ - -e 's:-O[0-9] ::g' \ - -e 's:-march=[-a-z0-9]* ::g' \ - -e 's:-mcpu=[-a-z0-9]* ::g' \ - -e 's:-m[a-z0-9]* ::g' \ - -e 's:\\:\\\\:g' \ - ) - sed -i \ - -e "/^CFLAGS=/s|=.*|=${DEFAULT_CFLAGS} ${CFLAGS}|" \ - -e "/^LDFLAGS=/s|=[[:space:]]*$|=${LDFLAGS}|" \ - Makefile || die -} - -multilib_src_compile() { - # depend is needed to use $confopts; it also doesn't matter - # that it's -j1 as the code itself serializes subdirs - emake -j1 depend - emake all -} - -multilib_src_test() { - emake -j1 test -} - -multilib_src_install() { - emake DESTDIR="${D}" install -} - -multilib_src_install_all() { - # openssl installs perl version of c_rehash by default, but - # we provide a shell version via app-misc/c_rehash - rm "${ED%/}"/usr/bin/c_rehash || die - - dodoc CHANGES* FAQ NEWS README doc/*.txt doc/${PN}-c-indent.el - - # This is crappy in that the static archives are still built even - # when USE=static-libs. But this is due to a failing in the openssl - # build system: the static archives are built as PIC all the time. - # Only way around this would be to manually configure+compile openssl - # twice; once with shared lib support enabled and once without. - use static-libs || rm -f "${ED%/}"/usr/lib*/lib*.a - - # create the certs directory - keepdir ${SSL_CNF_DIR}/certs - - # Namespace openssl programs to prevent conflicts with other man pages - cd "${ED%/}"/usr/share/man || die - local m d s - for m in $(find . -type f | xargs grep -L '#include') ; do - d=${m%/*} ; d=${d#./} ; m=${m##*/} - [[ ${m} == openssl.1* ]] && continue - [[ -n $(find -L ${d} -type l) ]] && die "erp, broken links already!" - mv ${d}/{,ssl-}${m} - # fix up references to renamed man pages - sed -i '/^[.]SH "SEE ALSO"/,/^[.]/s:\([^(, ]*(1)\):ssl-\1:g' ${d}/ssl-${m} - ln -s ssl-${m} ${d}/openssl-${m} - # locate any symlinks that point to this man page ... we assume - # that any broken links are due to the above renaming - for s in $(find -L ${d} -type l) ; do - s=${s##*/} - rm -f ${d}/${s} - # We don't want to "|| die" here - ln -s ssl-${m} ${d}/ssl-${s} - ln -s ssl-${s} ${d}/openssl-${s} - done - done - [[ -n $(find -L ${d} -type l) ]] && die "broken manpage links found :(" - - dodir /etc/sandbox.d #254521 - echo 'SANDBOX_PREDICT="/dev/crypto"' > "${ED%/}"/etc/sandbox.d/10openssl - - diropts -m0700 - keepdir ${SSL_CNF_DIR}/private -} - -pkg_postinst() { - ebegin "Running 'c_rehash ${EROOT%/}${SSL_CNF_DIR}/certs/' to rebuild hashes #333069" - c_rehash "${EROOT%/}${SSL_CNF_DIR}/certs" >/dev/null - eend $? -} diff --git a/dev-libs/openssl/openssl-1.1.1b-r2.ebuild b/dev-libs/openssl/openssl-1.1.0k-r1.ebuild index 09f5e991cf94..7bcd5d03e7e3 100644 --- a/dev-libs/openssl/openssl-1.1.1b-r2.ebuild +++ b/dev-libs/openssl/openssl-1.1.0k-r1.ebuild @@ -1,25 +1,36 @@ # Copyright 1999-2019 Gentoo Authors # Distributed under the terms of the GNU General Public License v2 -EAPI="6" +EAPI="7" inherit flag-o-matic toolchain-funcs multilib multilib-minimal MY_P=${P/_/-} + +# This patch set is based on the following files from Fedora 31, +# see https://src.fedoraproject.org/rpms/openssl/blob/f28/f/openssl.spec +# for more details: +# - hobble-openssl (SOURCE1) +# - ec_curve.c (SOURCE12) +# - ectest.c (SOURCE13) +# - openssl-1.1.0-ec-curves.patch (PATCH37) -- MODIFIED +BINDIST_PATCH_SET="openssl-1.1.0k-bindist-1.0.tar.xz" + DESCRIPTION="full-strength general purpose cryptography library (including SSL and TLS)" HOMEPAGE="https://www.openssl.org/" -SRC_URI="mirror://openssl/source/${MY_P}.tar.gz" +SRC_URI="mirror://openssl/source/${MY_P}.tar.gz + bindist? ( https://dev.gentoo.org/~whissi/dist/openssl/${BINDIST_PATCH_SET} )" LICENSE="openssl" SLOT="0/1.1" # .so version of libssl/libcrypto -[[ "${PV}" = *_pre* ]] || \ KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~x86-fbsd ~x86-linux" IUSE="+asm bindist elibc_musl rfc3779 sctp cpu_flags_x86_sse2 sslv3 static-libs test tls-heartbeat vanilla zlib" RESTRICT="!bindist? ( bindist )" RDEPEND=">=app-misc/c_rehash-1.7-r1 zlib? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] )" -DEPEND="${RDEPEND} +DEPEND="${RDEPEND}" +BDEPEND=" >=dev-lang/perl-5 sctp? ( >=net-misc/lksctp-tools-1.0.12 ) test? ( @@ -29,30 +40,11 @@ DEPEND="${RDEPEND} PDEPEND="app-misc/ca-certificates" PATCHES=( + "${FILESDIR}"/${PN}-1.0.2a-x32-asm.patch #542618 "${FILESDIR}"/${PN}-1.1.0j-parallel_install_fix.patch #671602 - "${FILESDIR}"/${P}-CVE-2019-1543.patch + "${FILESDIR}"/${PN}-1.1.0k-fix-test_fuzz.patch ) -# This does not copy the entire Fedora patchset, but JUST the parts that -# are needed to make it safe to use EC with RESTRICT=bindist. -# See openssl.spec for the matching numbering of SourceNNN, PatchNNN -SOURCE1=hobble-openssl -SOURCE12=ec_curve.c -SOURCE13=ectest.c -PATCH37=openssl-1.1.1-ec-curves.patch -FEDORA_GIT_BASE='https://src.fedoraproject.org/cgit/rpms/openssl.git/plain/' -FEDORA_GIT_BRANCH='f29' -FEDORA_SRC_URI=() -FEDORA_SOURCE=( ${SOURCE1} ${SOURCE12} ${SOURCE13} ) -FEDORA_PATCH=( ${PATCH37} ) -for i in "${FEDORA_SOURCE[@]}" ; do - FEDORA_SRC_URI+=( "${FEDORA_GIT_BASE}/${i}?h=${FEDORA_GIT_BRANCH} -> ${P}_${i}" ) -done -for i in "${FEDORA_PATCH[@]}" ; do # Already have a version prefix - FEDORA_SRC_URI+=( "${FEDORA_GIT_BASE}/${i}?h=${FEDORA_GIT_BRANCH} -> ${i}" ) -done -SRC_URI+=" bindist? ( ${FEDORA_SRC_URI[@]} )" - S="${WORKDIR}/${MY_P}" MULTILIB_WRAPPED_HEADERS=( @@ -61,27 +53,27 @@ MULTILIB_WRAPPED_HEADERS=( src_prepare() { if use bindist; then - # This just removes the prefix, and puts it into WORKDIR like the RPM. - for i in "${FEDORA_SOURCE[@]}" ; do - cp -f "${DISTDIR}"/"${P}_${i}" "${WORKDIR}"/"${i}" || die + mv "${WORKDIR}"/bindist-patches/hobble-openssl "${WORKDIR}" || die + bash "${WORKDIR}"/hobble-openssl || die + + cp -f "${WORKDIR}"/bindist-patches/ec_curve.c "${S}"/crypto/ec/ || die + cp -f "${WORKDIR}"/bindist-patches/ectest.c "${S}"/test/ || die + + eapply "${WORKDIR}"/bindist-patches/ec-curves.patch + + local known_failing_test + for known_failing_test in \ + 30-test_evp_extra.t \ + 80-test_ssl_new.t \ + ; do + ebegin "Disabling test '${known_failing_test}' which is known to fail with USE=bindist" + rm test/recipes/${known_failing_test} || die + eend $? done - # .spec %prep - bash "${WORKDIR}"/"${SOURCE1}" || die - cp -f "${WORKDIR}"/"${SOURCE12}" "${S}"/crypto/ec/ || die - cp -f "${WORKDIR}"/"${SOURCE13}" "${S}"/test/ || die - for i in "${FEDORA_PATCH[@]}" ; do - if [[ "${i}" == "${PATCH37}" ]] ; then - # apply our own for OpenSSL 1.1.1b adjusted version of this patch - eapply "${FILESDIR}"/openssl-1.1.1b-ec-curves-patch.patch - else - eapply "${DISTDIR}"/"${i}" - fi - done # Also see the configure parts below: # enable-ec \ # $(use_ssl !bindist ec2m) \ - fi # keep this in sync with app-misc/c_rehash @@ -107,11 +99,14 @@ src_prepare() { -e '/^MAKEDEPPROG/s:=.*:=$(CC):' \ -e $(has noman FEATURES \ && echo '/^install:/s:install_docs::' \ - || echo '/^MANDIR=/s:=.*:='${EPREFIX%/}'/usr/share/man:') \ + || echo '/^MANDIR=/s:=.*:='${EPREFIX}'/usr/share/man:') \ -e "/^DOCDIR/s@\$(BASENAME)@&-${PVR}@" \ Configurations/unix-Makefile.tmpl \ || die + # show the actual commands in the log + sed -i '/^SET_X/s@=.*@=set -x@' Makefile.shared || die + # quiet out unknown driver argument warnings since openssl # doesn't have well-split CFLAGS and we're making it even worse # and 'make depend' uses -Werror for added fun (#417795 again) @@ -127,7 +122,7 @@ src_prepare() { # Prefixify Configure shebang (#141906) sed \ - -e "1s,/usr/bin/env,${EPREFIX%/}&," \ + -e "1s,/usr/bin/env,${EPREFIX}&," \ -i Configure || die # Remove test target when FEATURES=test isn't set if ! use test ; then @@ -181,7 +176,9 @@ multilib_src_configure() { # 'srp' was restricted until early 2017 as well. # "disable-deprecated" option breaks too many consumers. # Don't set it without thorough revdeps testing. - echoit \ + # Make sure user flags don't get added *yet* to avoid duplicated + # flags. + CFLAGS= LDFLAGS= echoit \ ./${config} \ ${sslout} \ $(use cpu_flags_x86_sse2 || echo "no-sse2") \ @@ -201,23 +198,27 @@ multilib_src_configure() { $(use_ssl sctp) \ $(use_ssl tls-heartbeat heartbeats) \ $(use_ssl zlib) \ - --prefix="${EPREFIX%/}"/usr \ - --openssldir="${EPREFIX%/}"${SSL_CNF_DIR} \ + --prefix="${EPREFIX}"/usr \ + --openssldir="${EPREFIX}"${SSL_CNF_DIR} \ --libdir=$(get_libdir) \ shared threads \ || die # Clean out hardcoded flags that openssl uses - # Fix quoting for sed local DEFAULT_CFLAGS=$(grep ^CFLAGS= Makefile | LC_ALL=C sed \ -e 's:^CFLAGS=::' \ - -e 's:-fomit-frame-pointer ::g' \ - -e 's:-O[0-9] ::g' \ - -e 's:-march=[-a-z0-9]* ::g' \ - -e 's:-mcpu=[-a-z0-9]* ::g' \ - -e 's:-m[a-z0-9]* ::g' \ - -e 's:\\:\\\\:g' \ + -e 's:\(^\| \)-fomit-frame-pointer::g' \ + -e 's:\(^\| \)-O[^ ]*::g' \ + -e 's:\(^\| \)-march=[^ ]*::g' \ + -e 's:\(^\| \)-mcpu=[^ ]*::g' \ + -e 's:\(^\| \)-m[^ ]*::g' \ + -e 's:^ *::' \ + -e 's: *$::' \ + -e 's: \+: :g' \ + -e 's:\\:\\\\:g' ) + + # Now insert clean default flags with user flags sed -i \ -e "/^CFLAGS=/s|=.*|=${DEFAULT_CFLAGS} ${CFLAGS}|" \ -e "/^LDFLAGS=/s|=[[:space:]]*$|=${LDFLAGS}|" \ @@ -237,18 +238,18 @@ multilib_src_test() { multilib_src_install() { # We need to create $ED/usr on our own to avoid a race condition #665130 - if [[ ! -d "${ED%/}/usr" ]]; then + if [[ ! -d "${ED}/usr" ]]; then # We can only create this directory once - mkdir "${ED%/}"/usr || die + mkdir "${ED}"/usr || die fi - emake DESTDIR="${D%/}" install + emake DESTDIR="${D}" install } multilib_src_install_all() { # openssl installs perl version of c_rehash by default, but # we provide a shell version via app-misc/c_rehash - rm "${ED%/}"/usr/bin/c_rehash || die + rm "${ED}"/usr/bin/c_rehash || die dodoc CHANGES* FAQ NEWS README doc/*.txt doc/${PN}-c-indent.el @@ -257,13 +258,13 @@ multilib_src_install_all() { # build system: the static archives are built as PIC all the time. # Only way around this would be to manually configure+compile openssl # twice; once with shared lib support enabled and once without. - use static-libs || rm -f "${ED%/}"/usr/lib*/lib*.a + use static-libs || rm -f "${ED}"/usr/lib*/lib*.a # create the certs directory keepdir ${SSL_CNF_DIR}/certs # Namespace openssl programs to prevent conflicts with other man pages - cd "${ED%/}"/usr/share/man || die + cd "${ED}"/usr/share/man || die local m d s for m in $(find . -type f | xargs grep -L '#include') ; do d=${m%/*} ; d=${d#./} ; m=${m##*/} @@ -286,14 +287,14 @@ multilib_src_install_all() { [[ -n $(find -L ${d} -type l) ]] && die "broken manpage links found :(" dodir /etc/sandbox.d #254521 - echo 'SANDBOX_PREDICT="/dev/crypto"' > "${ED%/}"/etc/sandbox.d/10openssl + echo 'SANDBOX_PREDICT="/dev/crypto"' > "${ED}"/etc/sandbox.d/10openssl diropts -m0700 keepdir ${SSL_CNF_DIR}/private } pkg_postinst() { - ebegin "Running 'c_rehash ${EROOT%/}${SSL_CNF_DIR}/certs/' to rebuild hashes #333069" - c_rehash "${EROOT%/}${SSL_CNF_DIR}/certs" >/dev/null + ebegin "Running 'c_rehash ${EROOT}${SSL_CNF_DIR}/certs/' to rebuild hashes #333069" + c_rehash "${EROOT}${SSL_CNF_DIR}/certs" >/dev/null eend $? } diff --git a/dev-libs/openssl/openssl-1.1.0k.ebuild b/dev-libs/openssl/openssl-1.1.0k.ebuild deleted file mode 100644 index f5af55a9879c..000000000000 --- a/dev-libs/openssl/openssl-1.1.0k.ebuild +++ /dev/null @@ -1,298 +0,0 @@ -# Copyright 1999-2019 Gentoo Authors -# Distributed under the terms of the GNU General Public License v2 - -EAPI="6" - -inherit flag-o-matic toolchain-funcs multilib multilib-minimal - -MY_P=${P/_/-} -DESCRIPTION="full-strength general purpose cryptography library (including SSL and TLS)" -HOMEPAGE="https://www.openssl.org/" -SRC_URI="mirror://openssl/source/${MY_P}.tar.gz" - -LICENSE="openssl" -SLOT="0/1.1" # .so version of libssl/libcrypto -KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~x86-fbsd ~x86-linux" -IUSE="+asm bindist elibc_musl rfc3779 sctp cpu_flags_x86_sse2 static-libs test tls-heartbeat vanilla zlib" -RESTRICT="!bindist? ( bindist )" - -RDEPEND=">=app-misc/c_rehash-1.7-r1 - zlib? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] )" -DEPEND="${RDEPEND} - >=dev-lang/perl-5 - sctp? ( >=net-misc/lksctp-tools-1.0.12 ) - test? ( - sys-apps/diffutils - sys-devel/bc - )" -PDEPEND="app-misc/ca-certificates" - -# This does not copy the entire Fedora patchset, but JUST the parts that -# are needed to make it safe to use EC with RESTRICT=bindist. -# See openssl.spec for the matching numbering of SourceNNN, PatchNNN -SOURCE1=hobble-openssl -SOURCE12=ec_curve.c -SOURCE13=ectest.c -PATCH1=openssl-1.1.0-build.patch # Fixes EVP testcase for EC -PATCH37=openssl-1.1.0-ec-curves.patch -FEDORA_GIT_BASE='https://src.fedoraproject.org/cgit/rpms/openssl.git/plain/' -FEDORA_GIT_BRANCH='f28' -FEDORA_GIT_COMMIT="d2ede125556ac99aa0faa7744c703af3f559094e" -FEDORA_SRC_URI=() -FEDORA_SOURCE=( $SOURCE1 $SOURCE12 $SOURCE13 ) -FEDORA_PATCH=( $PATCH1 $PATCH37 ) -for i in "${FEDORA_SOURCE[@]}" ; do - FEDORA_SRC_URI+=( "${FEDORA_GIT_BASE}/${i}?h=${FEDORA_GIT_BRANCH}&id=${FEDORA_GIT_COMMIT} -> ${P}_${FEDORA_GIT_COMMIT}_${i}" ) -done -for i in "${FEDORA_PATCH[@]}" ; do # Already have a version prefix - FEDORA_SRC_URI+=( "${FEDORA_GIT_BASE}/${i}?h=${FEDORA_GIT_BRANCH}&id=${FEDORA_GIT_COMMIT} -> ${i%.patch}_${FEDORA_GIT_COMMIT}.patch" ) -done -SRC_URI+=" bindist? ( ${FEDORA_SRC_URI[@]} )" - -S="${WORKDIR}/${MY_P}" - -MULTILIB_WRAPPED_HEADERS=( - usr/include/openssl/opensslconf.h -) - -PATCHES=( - "${FILESDIR}"/${PN}-1.0.2a-x32-asm.patch #542618 - "${FILESDIR}"/${PN}-1.1.0j-parallel_install_fix.patch #671602 -) - -src_prepare() { - if use bindist; then - # we need to patch the patch but we cannot patch in DISTDIR... - mkdir "${WORKDIR}"/fedora_patches || die - for i in "${FEDORA_PATCH[@]}" ; do - cp "${DISTDIR}"/"${i%.patch}_${FEDORA_GIT_COMMIT}.patch" "${WORKDIR}"/fedora_patches || die - done - - # now patch the path, due to OpenSSL change cb193560e0da17a41b40ce574a2349f1d4d59ed1 - sed -i -e 's#test/evptests.txt#test/recipes/30-test_evp_data/evppkey.txt#g' \ - "${WORKDIR}"/fedora_patches/openssl-1.1.0-build_d2ede125556ac99aa0faa7744c703af3f559094e.patch || \ - die - - # This just removes the prefix, and puts it into WORKDIR like the RPM. - for i in "${FEDORA_SOURCE[@]}" ; do - cp -f "${DISTDIR}"/"${P}_${FEDORA_GIT_COMMIT}_${i}" "${WORKDIR}"/"${i}" || die - done - # .spec %prep - bash "${WORKDIR}"/"${SOURCE1}" || die - cp -f "${WORKDIR}"/"${SOURCE12}" "${S}"/crypto/ec/ || die - cp -f "${WORKDIR}"/"${SOURCE13}" "${S}"/test/ || die - for i in "${FEDORA_PATCH[@]}" ; do - #eapply "${DISTDIR}"/"${i%.patch}_${FEDORA_GIT_COMMIT}.patch" - eapply "${WORKDIR}/fedora_patches/${i%.patch}_${FEDORA_GIT_COMMIT}.patch" - done - # Also see the configure parts below: - # enable-ec \ - # $(use_ssl !bindist ec2m) \ - - fi - # keep this in sync with app-misc/c_rehash - SSL_CNF_DIR="/etc/ssl" - - # Make sure we only ever touch Makefile.org and avoid patching a file - # that gets blown away anyways by the Configure script in src_configure - rm -f Makefile - - if ! use vanilla ; then - eapply "${PATCHES[@]}" - fi - - eapply_user #332661 - - # make sure the man pages are suffixed #302165 - # don't bother building man pages if they're disabled - # Make DOCDIR Gentoo compliant - sed -i \ - -e '/^MANSUFFIX/s:=.*:=ssl:' \ - -e '/^MAKEDEPPROG/s:=.*:=$(CC):' \ - -e $(has noman FEATURES \ - && echo '/^install:/s:install_docs::' \ - || echo '/^MANDIR=/s:=.*:='${EPREFIX}'/usr/share/man:') \ - -e "/^DOCDIR/s@\$(BASENAME)@&-${PVR}@" \ - Configurations/unix-Makefile.tmpl \ - || die - - # show the actual commands in the log - sed -i '/^SET_X/s@=.*@=set -x@' Makefile.shared || die - - # quiet out unknown driver argument warnings since openssl - # doesn't have well-split CFLAGS and we're making it even worse - # and 'make depend' uses -Werror for added fun (#417795 again) - [[ ${CC} == *clang* ]] && append-flags -Qunused-arguments - - # allow openssl to be cross-compiled - cp "${FILESDIR}"/gentoo.config-1.0.2 gentoo.config || die - chmod a+rx gentoo.config || die - - append-flags -fno-strict-aliasing - append-flags $(test-flags-CC -Wa,--noexecstack) - append-cppflags -DOPENSSL_NO_BUF_FREELISTS - - # Prefixify Configure shebang (#141906) - sed \ - -e "1s,/usr/bin/env,${EPREFIX}&," \ - -i Configure || die - # Remove test target when FEATURES=test isn't set - if ! use test ; then - sed \ - -e '/^$config{dirs}/s@ "test",@@' \ - -i Configure || die - fi - # The config script does stupid stuff to prompt the user. Kill it. - sed -i '/stty -icanon min 0 time 50; read waste/d' config || die - ./config --test-sanity || die "I AM NOT SANE" - - multilib_copy_sources -} - -multilib_src_configure() { - unset APPS #197996 - unset SCRIPTS #312551 - unset CROSS_COMPILE #311473 - - tc-export CC AR RANLIB RC - - # Clean out patent-or-otherwise-encumbered code - # Camellia: Royalty Free https://en.wikipedia.org/wiki/Camellia_(cipher) - # IDEA: Expired https://en.wikipedia.org/wiki/International_Data_Encryption_Algorithm - # EC: ????????? ??/??/2015 https://en.wikipedia.org/wiki/Elliptic_Curve_Cryptography - # MDC2: Expired https://en.wikipedia.org/wiki/MDC-2 - # RC5: Expired https://en.wikipedia.org/wiki/RC5 - - use_ssl() { usex $1 "enable-${2:-$1}" "no-${2:-$1}" " ${*:3}" ; } - echoit() { echo "$@" ; "$@" ; } - - local krb5=$(has_version app-crypt/mit-krb5 && echo "MIT" || echo "Heimdal") - - # See if our toolchain supports __uint128_t. If so, it's 64bit - # friendly and can use the nicely optimized code paths. #460790 - local ec_nistp_64_gcc_128 - # Disable it for now though #469976 - #if ! use bindist ; then - # echo "__uint128_t i;" > "${T}"/128.c - # if ${CC} ${CFLAGS} -c "${T}"/128.c -o /dev/null >&/dev/null ; then - # ec_nistp_64_gcc_128="enable-ec_nistp_64_gcc_128" - # fi - #fi - - local sslout=$(./gentoo.config) - einfo "Use configuration ${sslout:-(openssl knows best)}" - local config="Configure" - [[ -z ${sslout} ]] && config="config" - - # Fedora hobbled-EC needs 'no-ec2m' - # 'srp' was restricted until early 2017 as well. - # "disable-deprecated" option breaks too many consumers. - # Don't set it without thorough revdeps testing. - echoit \ - ./${config} \ - ${sslout} \ - $(use cpu_flags_x86_sse2 || echo "no-sse2") \ - enable-camellia \ - enable-ec \ - $(use_ssl !bindist ec2m) \ - enable-srp \ - $(use elibc_musl && echo "no-async") \ - ${ec_nistp_64_gcc_128} \ - enable-idea \ - enable-mdc2 \ - enable-rc5 \ - $(use_ssl asm) \ - $(use_ssl rfc3779) \ - $(use_ssl sctp) \ - $(use_ssl tls-heartbeat heartbeats) \ - $(use_ssl zlib) \ - --prefix="${EPREFIX}"/usr \ - --openssldir="${EPREFIX}"${SSL_CNF_DIR} \ - --libdir=$(get_libdir) \ - shared threads \ - || die - - # Clean out hardcoded flags that openssl uses - # Fix quoting for sed - local DEFAULT_CFLAGS=$(grep ^CFLAGS= Makefile | LC_ALL=C sed \ - -e 's:^CFLAGS=::' \ - -e 's:-fomit-frame-pointer ::g' \ - -e 's:-O[0-9] ::g' \ - -e 's:-march=[-a-z0-9]* ::g' \ - -e 's:-mcpu=[-a-z0-9]* ::g' \ - -e 's:-m[a-z0-9]* ::g' \ - -e 's:\\:\\\\:g' \ - ) - sed -i \ - -e "/^CFLAGS=/s|=.*|=${DEFAULT_CFLAGS} ${CFLAGS}|" \ - -e "/^LDFLAGS=/s|=[[:space:]]*$|=${LDFLAGS}|" \ - Makefile || die -} - -multilib_src_compile() { - # depend is needed to use $confopts; it also doesn't matter - # that it's -j1 as the code itself serializes subdirs - emake -j1 depend - emake all -} - -multilib_src_test() { - emake -j1 test -} - -multilib_src_install() { - emake DESTDIR="${D}" install -} - -multilib_src_install_all() { - # openssl installs perl version of c_rehash by default, but - # we provide a shell version via app-misc/c_rehash - rm "${ED%/}"/usr/bin/c_rehash || die - - dodoc CHANGES* FAQ NEWS README doc/*.txt doc/${PN}-c-indent.el - - # This is crappy in that the static archives are still built even - # when USE=static-libs. But this is due to a failing in the openssl - # build system: the static archives are built as PIC all the time. - # Only way around this would be to manually configure+compile openssl - # twice; once with shared lib support enabled and once without. - use static-libs || rm -f "${ED%/}"/usr/lib*/lib*.a - - # create the certs directory - keepdir ${SSL_CNF_DIR}/certs - - # Namespace openssl programs to prevent conflicts with other man pages - cd "${ED%/}"/usr/share/man || die - local m d s - for m in $(find . -type f | xargs grep -L '#include') ; do - d=${m%/*} ; d=${d#./} ; m=${m##*/} - [[ ${m} == openssl.1* ]] && continue - [[ -n $(find -L ${d} -type l) ]] && die "erp, broken links already!" - mv ${d}/{,ssl-}${m} - # fix up references to renamed man pages - sed -i '/^[.]SH "SEE ALSO"/,/^[.]/s:\([^(, ]*(1)\):ssl-\1:g' ${d}/ssl-${m} - ln -s ssl-${m} ${d}/openssl-${m} - # locate any symlinks that point to this man page ... we assume - # that any broken links are due to the above renaming - for s in $(find -L ${d} -type l) ; do - s=${s##*/} - rm -f ${d}/${s} - # We don't want to "|| die" here - ln -s ssl-${m} ${d}/ssl-${s} - ln -s ssl-${s} ${d}/openssl-${s} - done - done - [[ -n $(find -L ${d} -type l) ]] && die "broken manpage links found :(" - - dodir /etc/sandbox.d #254521 - echo 'SANDBOX_PREDICT="/dev/crypto"' > "${ED%/}"/etc/sandbox.d/10openssl - - diropts -m0700 - keepdir ${SSL_CNF_DIR}/private -} - -pkg_postinst() { - ebegin "Running 'c_rehash ${EROOT%/}${SSL_CNF_DIR}/certs/' to rebuild hashes #333069" - c_rehash "${EROOT%/}${SSL_CNF_DIR}/certs" >/dev/null - eend $? -} diff --git a/dev-libs/openssl/openssl-1.1.1c.ebuild b/dev-libs/openssl/openssl-1.1.1c-r1.ebuild index f4e635b13b6d..a3a0f2a2c06e 100644 --- a/dev-libs/openssl/openssl-1.1.1c.ebuild +++ b/dev-libs/openssl/openssl-1.1.1c-r1.ebuild @@ -1,14 +1,25 @@ # Copyright 1999-2019 Gentoo Authors # Distributed under the terms of the GNU General Public License v2 -EAPI=7 +EAPI="7" inherit flag-o-matic toolchain-funcs multilib multilib-minimal MY_P=${P/_/-} + +# This patch set is based on the following files from Fedora 31, +# see https://src.fedoraproject.org/rpms/openssl/blob/f31/f/openssl.spec +# for more details: +# - hobble-openssl (SOURCE1) +# - ec_curve.c (SOURCE12) +# - ectest.c (SOURCE13) +# - openssl-1.1.1-ec-curves.patch (PATCH37) -- MODIFIED +BINDIST_PATCH_SET="openssl-1.1.1c-bindist-1.0.tar.xz" + DESCRIPTION="full-strength general purpose cryptography library (including SSL and TLS)" HOMEPAGE="https://www.openssl.org/" -SRC_URI="mirror://openssl/source/${MY_P}.tar.gz" +SRC_URI="mirror://openssl/source/${MY_P}.tar.gz + bindist? ( https://dev.gentoo.org/~whissi/dist/openssl/${BINDIST_PATCH_SET} )" LICENSE="openssl" SLOT="0/1.1" # .so version of libssl/libcrypto @@ -19,7 +30,8 @@ RESTRICT="!bindist? ( bindist )" RDEPEND=">=app-misc/c_rehash-1.7-r1 zlib? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] )" -DEPEND="${RDEPEND} +DEPEND="${RDEPEND}" +BDEPEND=" >=dev-lang/perl-5 sctp? ( >=net-misc/lksctp-tools-1.0.12 ) test? ( @@ -32,26 +44,6 @@ PATCHES=( "${FILESDIR}"/${PN}-1.1.0j-parallel_install_fix.patch #671602 ) -# This does not copy the entire Fedora patchset, but JUST the parts that -# are needed to make it safe to use EC with RESTRICT=bindist. -# See openssl.spec for the matching numbering of SourceNNN, PatchNNN -SOURCE1=hobble-openssl -SOURCE12=ec_curve.c -SOURCE13=ectest.c -PATCH37=openssl-1.1.1-ec-curves.patch -FEDORA_GIT_BASE='https://src.fedoraproject.org/cgit/rpms/openssl.git/plain/' -FEDORA_GIT_BRANCH='f29' -FEDORA_SRC_URI=() -FEDORA_SOURCE=( ${SOURCE1} ${SOURCE12} ${SOURCE13} ) -FEDORA_PATCH=( ${PATCH37} ) -for i in "${FEDORA_SOURCE[@]}" ; do - FEDORA_SRC_URI+=( "${FEDORA_GIT_BASE}/${i}?h=${FEDORA_GIT_BRANCH} -> ${P}_${i}" ) -done -for i in "${FEDORA_PATCH[@]}" ; do # Already have a version prefix - FEDORA_SRC_URI+=( "${FEDORA_GIT_BASE}/${i}?h=${FEDORA_GIT_BRANCH} -> ${i}" ) -done -SRC_URI+=" bindist? ( ${FEDORA_SRC_URI[@]} )" - S="${WORKDIR}/${MY_P}" MULTILIB_WRAPPED_HEADERS=( @@ -60,27 +52,27 @@ MULTILIB_WRAPPED_HEADERS=( src_prepare() { if use bindist; then - # This just removes the prefix, and puts it into WORKDIR like the RPM. - for i in "${FEDORA_SOURCE[@]}" ; do - cp -f "${DISTDIR}"/"${P}_${i}" "${WORKDIR}"/"${i}" || die + mv "${WORKDIR}"/bindist-patches/hobble-openssl "${WORKDIR}" || die + bash "${WORKDIR}"/hobble-openssl || die + + cp -f "${WORKDIR}"/bindist-patches/ec_curve.c "${S}"/crypto/ec/ || die + cp -f "${WORKDIR}"/bindist-patches/ectest.c "${S}"/test/ || die + + eapply "${WORKDIR}"/bindist-patches/ec-curves.patch + + local known_failing_test + for known_failing_test in \ + 30-test_evp_extra.t \ + 80-test_ssl_new.t \ + ; do + ebegin "Disabling test '${known_failing_test}' which is known to fail with USE=bindist" + rm test/recipes/${known_failing_test} || die + eend $? done - # .spec %prep - bash "${WORKDIR}"/"${SOURCE1}" || die - cp -f "${WORKDIR}"/"${SOURCE12}" "${S}"/crypto/ec/ || die - cp -f "${WORKDIR}"/"${SOURCE13}" "${S}"/test/ || die - for i in "${FEDORA_PATCH[@]}" ; do - if [[ "${i}" == "${PATCH37}" ]] ; then - # apply our own for OpenSSL 1.1.1b adjusted version of this patch - eapply "${FILESDIR}"/openssl-1.1.1b-ec-curves-patch.patch - else - eapply "${DISTDIR}"/"${i}" - fi - done # Also see the configure parts below: # enable-ec \ # $(use_ssl !bindist ec2m) \ - fi # keep this in sync with app-misc/c_rehash @@ -180,7 +172,9 @@ multilib_src_configure() { # 'srp' was restricted until early 2017 as well. # "disable-deprecated" option breaks too many consumers. # Don't set it without thorough revdeps testing. - echoit \ + # Make sure user flags don't get added *yet* to avoid duplicated + # flags. + CFLAGS= LDFLAGS= echoit \ ./${config} \ ${sslout} \ $(use cpu_flags_x86_sse2 || echo "no-sse2") \ @@ -207,16 +201,20 @@ multilib_src_configure() { || die # Clean out hardcoded flags that openssl uses - # Fix quoting for sed local DEFAULT_CFLAGS=$(grep ^CFLAGS= Makefile | LC_ALL=C sed \ -e 's:^CFLAGS=::' \ - -e 's:-fomit-frame-pointer ::g' \ - -e 's:-O[0-9] ::g' \ - -e 's:-march=[-a-z0-9]* ::g' \ - -e 's:-mcpu=[-a-z0-9]* ::g' \ - -e 's:-m[a-z0-9]* ::g' \ - -e 's:\\:\\\\:g' \ + -e 's:\(^\| \)-fomit-frame-pointer::g' \ + -e 's:\(^\| \)-O[^ ]*::g' \ + -e 's:\(^\| \)-march=[^ ]*::g' \ + -e 's:\(^\| \)-mcpu=[^ ]*::g' \ + -e 's:\(^\| \)-m[^ ]*::g' \ + -e 's:^ *::' \ + -e 's: *$::' \ + -e 's: \+: :g' \ + -e 's:\\:\\\\:g' ) + + # Now insert clean default flags with user flags sed -i \ -e "/^CFLAGS=/s|=.*|=${DEFAULT_CFLAGS} ${CFLAGS}|" \ -e "/^LDFLAGS=/s|=[[:space:]]*$|=${LDFLAGS}|" \ |