summaryrefslogtreecommitdiff
path: root/net-libs/gnutls
diff options
context:
space:
mode:
Diffstat (limited to 'net-libs/gnutls')
-rw-r--r--net-libs/gnutls/Manifest2
-rw-r--r--net-libs/gnutls/files/gnutls-3.8.5-fix-rsaes-pkcs1-systemd-wide-config.patch261
-rw-r--r--net-libs/gnutls/gnutls-3.8.5-r1.ebuild155
3 files changed, 418 insertions, 0 deletions
diff --git a/net-libs/gnutls/Manifest b/net-libs/gnutls/Manifest
index 47998de6a0d6..03f7caa38ad2 100644
--- a/net-libs/gnutls/Manifest
+++ b/net-libs/gnutls/Manifest
@@ -1,3 +1,4 @@
+AUX gnutls-3.8.5-fix-rsaes-pkcs1-systemd-wide-config.patch 7361 BLAKE2B ca74ef7ca3070f2b44b6958547595acaac0c3aa783a6a67897ad9536f32f27838df6538bbe2fa5cb6430279c81373dd9bec9c7828db5d88492f8f24b679be045 SHA512 0319255a2427b993a6191b42cb034876909c6ff3cf5132cda60bc4bdff6f3fb1db191c6394beb9457d0abd99e375505c2c572f74a2ca263996eaedc7e186d318
DIST gnutls-3.7.8.tar.xz 6029220 BLAKE2B 0a21e63c7cb0ba4eeff23593c7282e0b4d704fa2d2a1cd5289998fd04b58ea36fc343f872225ad05478e278b1cdebbcd0fd376459abcb58547f8fa1488485530 SHA512 4199bcf7c9e3aab2f52266aadceefc563dfe2d938d0ea1f3ec3be95d66f4a8c8e5494d3a800c03dd02ad386dec1738bd63e1fe0d8b394a2ccfc7d6c6a0cc9359
DIST gnutls-3.7.8.tar.xz.sig 1250 BLAKE2B 66c6a335c3b2290a4e44ffa6ae715ad71d2bcd7df485c1d2d9490985d9dcd445768d6eb021ad3a61614431183c6652254c63ebd8abd0f0a03d3164a6193b6192 SHA512 cecf9843e8683a278d065b663dc98ac2b5fcad1905ee25333038c93c2289b518c974629367e77e66552ac1c9d122d551616edba35cb0c4204202ec676f1a2db7
DIST gnutls-3.7.9.tar.xz 6377212 BLAKE2B c8263381132b0c96f23a580823cfaf57112056876e5f2cc21aec4eeddec641b0c01fa02ff9493ea686f49fd917190b06f89379eb448a510cf4d50fe3a0742851 SHA512 56ccbab5f214f9e3cf10a43dd90dedc1e10a38d08b8359a4305dc05c59ddb4a1d3680b282077b6446605c31675a4261cd0579c2c0d976e0b2ced02e6dba224c1
@@ -12,5 +13,6 @@ EBUILD gnutls-3.7.8.ebuild 4510 BLAKE2B 071712c5a26ac5208b8c3b76e8e30cd697bfe46c
EBUILD gnutls-3.7.9.ebuild 4518 BLAKE2B 1677d20875850c62130350dcbc92b61f51c6aa5de64d16179944caad10616859f082c11bf327d57f836b7cc24e3803821b61e2df4fc2c17862d35a26a033aaeb SHA512 e30ea13f425d0a6eba30b1235e3a6240e9f0481df318c7f0b6699088bb8c98c07e146a891c8ccd8efe0cc0b8f70a8456d84e62f8db118ad8ae380e679769259b
EBUILD gnutls-3.8.0.ebuild 4569 BLAKE2B 4b3dbdec9ab063ef44ec516c91b3777028d627e89260885a033756be8e0edcecd7c0e0c4f27f9ea8c2e2cf929b6f729c62bc265b64a8ed9ed7785bfe442ba274 SHA512 81d3331058c8dc1a121d2b618462ad07797b5b3f118842e6fb634b1d7bef27d1a8657ca04319b16b709989987b91cd4de8e582516840abfd3c74bd60f357e0cb
EBUILD gnutls-3.8.3.ebuild 4683 BLAKE2B b19f9797b93c00e98106ece1395fcb0625ae071fbcdc31efc539f081c2770f5e61e0288bbddeb5e2b41fbfaddbe4b27ca7e68048def487d5397e80a8af52cd96 SHA512 f533871504131a7bb76fac115460b01a564c52ae72c9ed0fbe1b4a2e1388e7512f8144891adfeea4853ed55a13137d05ed7fef8516c8933a790847ac320319ab
+EBUILD gnutls-3.8.5-r1.ebuild 4831 BLAKE2B 318f57de485ee58e3b598c095d686fcef2918472c6c18b05349481631a3d35c19bf8b9be91ca825b6fcd9eb244bdc3435ce53361ae7c50718243ed2d9970bca5 SHA512 f4cc2ce252c8b13cc5759b2ba5c83599cd327ed7fbc50791fe14d2a7abb51c4fdbb3cd70c914c08761e734e255c44c889f60b451845db53cb6b6401c6066dd59
EBUILD gnutls-3.8.5.ebuild 4683 BLAKE2B dfd03e9f80c1c9142ba16145414d4c9204fc79a5d5b3e956a8042ac93f7aa12e1207ae031e6b3e4df17fe309367a96eb9b2fed94eecca8c8da90137cc2d39856 SHA512 8e2aad44f15ef216cc2a641bb955c878dcd7eea71209db38cf7df6381a1b9d1647b6e724a13d3fa2f997ac3d28ad111e2fb49548dcba832a3e3be0d2e46949d7
MISC metadata.xml 1141 BLAKE2B 70657c924a576930a14064d750074cce08bfe3f99970987aca13f9f1dc49024d8a99de54336b5e51f7cee4fa944045a323cf8384e0363189c4ee60962b185a42 SHA512 467370ffa9762eff75e73ffcb959c7bbe65528b33256c871b702be90c7b6f06e6b60a0a358c81dadba43388ec803a9dabe09a6f7cb3616ee3c65eaa6416140ee
diff --git a/net-libs/gnutls/files/gnutls-3.8.5-fix-rsaes-pkcs1-systemd-wide-config.patch b/net-libs/gnutls/files/gnutls-3.8.5-fix-rsaes-pkcs1-systemd-wide-config.patch
new file mode 100644
index 000000000000..6905f793ab4f
--- /dev/null
+++ b/net-libs/gnutls/files/gnutls-3.8.5-fix-rsaes-pkcs1-systemd-wide-config.patch
@@ -0,0 +1,261 @@
+https://bugs.gentoo.org/930752
+https://bugs.gentoo.org/930529
+https://gitlab.com/gnutls/gnutls/-/issues/1540
+https://gitlab.com/gnutls/gnutls/-/merge_requests/1830
+https://gitlab.com/gnutls/gnutls/-/commit/2d73d945c4b1dfcf8d2328c4d23187d62ffaab2d
+
+From 2d73d945c4b1dfcf8d2328c4d23187d62ffaab2d Mon Sep 17 00:00:00 2001
+From: Zoltan Fridrich <zfridric@redhat.com>
+Date: Wed, 10 Apr 2024 12:51:33 +0200
+Subject: [PATCH] Fix RSAES-PKCS1-v1_5 system-wide configuration
+
+Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
+--- a/lib/priority.c
++++ b/lib/priority.c
+@@ -1018,6 +1018,12 @@ struct cfg {
+ bool force_ext_master_secret_set;
+ };
+
++static inline void cfg_init(struct cfg *cfg)
++{
++ memset(cfg, 0, sizeof(*cfg));
++ cfg->allow_rsa_pkcs1_encrypt = true;
++}
++
+ static inline void cfg_deinit(struct cfg *cfg)
+ {
+ if (cfg->priority_strings) {
+@@ -1095,6 +1101,12 @@ struct ini_ctx {
+ size_t curves_size;
+ };
+
++static inline void ini_ctx_init(struct ini_ctx *ctx)
++{
++ memset(ctx, 0, sizeof(*ctx));
++ cfg_init(&ctx->cfg);
++}
++
+ static inline void ini_ctx_deinit(struct ini_ctx *ctx)
+ {
+ cfg_deinit(&ctx->cfg);
+@@ -1423,9 +1435,6 @@ static inline int cfg_apply(struct cfg *cfg, struct ini_ctx *ctx)
+ _gnutls_default_priority_string = cfg->default_priority_string;
+ }
+
+- /* enable RSA-PKCS1-V1_5 by default */
+- cfg->allow_rsa_pkcs1_encrypt = true;
+-
+ if (cfg->allowlisting) {
+ /* also updates `flags` of global `hash_algorithms[]` */
+ ret = cfg_hashes_set_array(cfg, ctx->hashes, ctx->hashes_size);
+@@ -2217,22 +2226,73 @@ update_system_wide_priority_string(void)
+ return 0;
+ }
+
++/* Returns false on parse error, otherwise true.
++ * The system_wide_config must be locked for writing.
++ */
++static inline bool load_system_priority_file(void)
++{
++ int err;
++ FILE *fp;
++ struct ini_ctx ctx;
++
++ cfg_init(&system_wide_config);
++
++ fp = fopen(system_priority_file, "re");
++ if (fp == NULL) {
++ _gnutls_debug_log("cfg: unable to open: %s: %d\n",
++ system_priority_file, errno);
++ return true;
++ }
++
++ /* Parsing the configuration file needs to be done in 2 phases:
++ * first parsing the [global] section
++ * and then the other sections,
++ * because the [global] section modifies the parsing behavior.
++ */
++ ini_ctx_init(&ctx);
++ err = ini_parse_file(fp, global_ini_handler, &ctx);
++ if (!err) {
++ if (fseek(fp, 0L, SEEK_SET) < 0) {
++ _gnutls_debug_log("cfg: unable to rewind: %s\n",
++ system_priority_file);
++ if (fail_on_invalid_config)
++ exit(1);
++ }
++ err = ini_parse_file(fp, cfg_ini_handler, &ctx);
++ }
++ fclose(fp);
++ if (err) {
++ ini_ctx_deinit(&ctx);
++ _gnutls_debug_log("cfg: unable to parse: %s: %d\n",
++ system_priority_file, err);
++ return false;
++ }
++ cfg_apply(&system_wide_config, &ctx);
++ ini_ctx_deinit(&ctx);
++ return true;
++}
++
+ static int _gnutls_update_system_priorities(bool defer_system_wide)
+ {
+- int ret, err = 0;
++ int ret;
++ bool config_parse_error = false;
+ struct stat sb;
+- FILE *fp;
+ gnutls_buffer_st buf;
+- struct ini_ctx ctx;
+
+ ret = gnutls_rwlock_rdlock(&system_wide_config_rwlock);
+- if (ret < 0) {
++ if (ret < 0)
+ return gnutls_assert_val(ret);
+- }
+
+ if (stat(system_priority_file, &sb) < 0) {
+ _gnutls_debug_log("cfg: unable to access: %s: %d\n",
+ system_priority_file, errno);
++
++ (void)gnutls_rwlock_unlock(&system_wide_config_rwlock);
++ ret = gnutls_rwlock_wrlock(&system_wide_config_rwlock);
++ if (ret < 0)
++ goto out;
++ /* If system-wide config is unavailable, apply the defaults */
++ cfg_init(&system_wide_config);
+ goto out;
+ }
+
+@@ -2240,63 +2300,27 @@ static int _gnutls_update_system_priorities(bool defer_system_wide)
+ system_priority_last_mod == sb.st_mtime) {
+ _gnutls_debug_log("cfg: system priority %s has not changed\n",
+ system_priority_file);
+- if (system_wide_config.priority_string) {
++ if (system_wide_config.priority_string)
+ goto out; /* nothing to do */
+- }
+ }
+
+ (void)gnutls_rwlock_unlock(&system_wide_config_rwlock);
+
+ ret = gnutls_rwlock_wrlock(&system_wide_config_rwlock);
+- if (ret < 0) {
++ if (ret < 0)
+ return gnutls_assert_val(ret);
+- }
+
+ /* Another thread could have successfully re-read system-wide config,
+ * skip re-reading if the mtime it has used is exactly the same.
+ */
+- if (system_priority_file_loaded) {
++ if (system_priority_file_loaded)
+ system_priority_file_loaded =
+ (system_priority_last_mod == sb.st_mtime);
+- }
+
+ if (!system_priority_file_loaded) {
+- _name_val_array_clear(&system_wide_config.priority_strings);
+-
+- gnutls_free(system_wide_config.priority_string);
+- system_wide_config.priority_string = NULL;
+-
+- fp = fopen(system_priority_file, "re");
+- if (fp == NULL) {
+- _gnutls_debug_log("cfg: unable to open: %s: %d\n",
+- system_priority_file, errno);
++ config_parse_error = !load_system_priority_file();
++ if (config_parse_error)
+ goto out;
+- }
+- /* Parsing the configuration file needs to be done in 2 phases:
+- * first parsing the [global] section
+- * and then the other sections,
+- * because the [global] section modifies the parsing behavior.
+- */
+- memset(&ctx, 0, sizeof(ctx));
+- err = ini_parse_file(fp, global_ini_handler, &ctx);
+- if (!err) {
+- if (fseek(fp, 0L, SEEK_SET) < 0) {
+- _gnutls_debug_log("cfg: unable to rewind: %s\n",
+- system_priority_file);
+- if (fail_on_invalid_config)
+- exit(1);
+- }
+- err = ini_parse_file(fp, cfg_ini_handler, &ctx);
+- }
+- fclose(fp);
+- if (err) {
+- ini_ctx_deinit(&ctx);
+- _gnutls_debug_log("cfg: unable to parse: %s: %d\n",
+- system_priority_file, err);
+- goto out;
+- }
+- cfg_apply(&system_wide_config, &ctx);
+- ini_ctx_deinit(&ctx);
+ _gnutls_debug_log("cfg: loaded system config %s mtime %lld\n",
+ system_priority_file,
+ (unsigned long long)sb.st_mtime);
+@@ -2332,9 +2356,8 @@ static int _gnutls_update_system_priorities(bool defer_system_wide)
+ out:
+ (void)gnutls_rwlock_unlock(&system_wide_config_rwlock);
+
+- if (err && fail_on_invalid_config) {
++ if (config_parse_error && fail_on_invalid_config)
+ exit(1);
+- }
+
+ return ret;
+ }
+--- a/tests/system-override-allow-rsa-pkcs1-encrypt.sh
++++ b/tests/system-override-allow-rsa-pkcs1-encrypt.sh
+@@ -19,9 +19,8 @@
+ # You should have received a copy of the GNU Lesser General Public License
+ # along with this program. If not, see <https://www.gnu.org/licenses/>
+
+-: ${srcdir=.}
+-TEST=${srcdir}/rsaes-pkcs1-v1_5
+-CONF=${srcdir}/config.$$.tmp
++TEST=${builddir}/rsaes-pkcs1-v1_5
++CONF=config.$$.tmp
+ export GNUTLS_SYSTEM_PRIORITY_FILE=${CONF}
+ export GNUTLS_SYSTEM_PRIORITY_FAIL_ON_INVALID=1
+
+@@ -38,15 +37,33 @@ cat <<_EOF_ > ${CONF}
+ allow-rsa-pkcs1-encrypt = true
+ _EOF_
+
+-${TEST} && fail "RSAES-PKCS1-v1_5 expected to succeed"
++${TEST}
++if [ $? != 0 ]; then
++ echo "${TEST} expected to succeed"
++ exit 1
++fi
++echo "RSAES-PKCS1-v1_5 successfully enabled"
+
+ cat <<_EOF_ > ${CONF}
+ [overrides]
+ allow-rsa-pkcs1-encrypt = false
+ _EOF_
+
+-${TEST} || fail "RSAES-PKCS1-v1_5 expected to fail"
++${TEST}
++if [ $? = 0 ]; then
++ echo "${TEST} expected to fail"
++ exit 1
++fi
++echo "RSAES-PKCS1-v1_5 successfully disabled"
+
+ unset GNUTLS_SYSTEM_PRIORITY_FILE
+ unset GNUTLS_SYSTEM_PRIORITY_FAIL_ON_INVALID
++
++${TEST}
++if [ $? != 0 ]; then
++ echo "${TEST} expected to succeed by default"
++ exit 1
++fi
++echo "RSAES-PKCS1-v1_5 successfully enabled by default"
++
+ exit 0
+--
+GitLab
diff --git a/net-libs/gnutls/gnutls-3.8.5-r1.ebuild b/net-libs/gnutls/gnutls-3.8.5-r1.ebuild
new file mode 100644
index 000000000000..24fba955fe8e
--- /dev/null
+++ b/net-libs/gnutls/gnutls-3.8.5-r1.ebuild
@@ -0,0 +1,155 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gnutls.asc
+inherit libtool multilib-minimal verify-sig
+
+DESCRIPTION="A secure communications library implementing the SSL, TLS and DTLS protocols"
+HOMEPAGE="https://www.gnutls.org/"
+SRC_URI="mirror://gnupg/gnutls/v$(ver_cut 1-2)/${P}.tar.xz"
+SRC_URI+=" verify-sig? ( mirror://gnupg/gnutls/v$(ver_cut 1-2)/${P}.tar.xz.sig )"
+
+LICENSE="GPL-3 LGPL-2.1+"
+# As of 3.8.0, the C++ library is header-only, but we won't drop the subslot
+# component for it until libgnutls.so breaks ABI, to avoid pointless rebuilds.
+# Subslot format:
+# <libgnutls.so number>.<libgnutlsxx.so number>
+SLOT="0/30.30"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="brotli +cxx dane doc examples +idn nls +openssl pkcs11 seccomp sslv2 sslv3 static-libs test test-full +tls-heartbeat tools zlib zstd"
+REQUIRED_USE="test-full? ( cxx dane doc examples idn nls openssl pkcs11 seccomp tls-heartbeat tools )"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+ >=dev-libs/libtasn1-4.9:=[${MULTILIB_USEDEP}]
+ dev-libs/libunistring:=[${MULTILIB_USEDEP}]
+ >=dev-libs/nettle-3.6:=[gmp,${MULTILIB_USEDEP}]
+ >=dev-libs/gmp-5.1.3-r1:=[${MULTILIB_USEDEP}]
+ brotli? ( >=app-arch/brotli-1.0.0:=[${MULTILIB_USEDEP}] )
+ dane? ( >=net-dns/unbound-1.4.20:=[${MULTILIB_USEDEP}] )
+ nls? ( >=virtual/libintl-0-r1:=[${MULTILIB_USEDEP}] )
+ pkcs11? ( >=app-crypt/p11-kit-0.23.1[${MULTILIB_USEDEP}] )
+ idn? ( >=net-dns/libidn2-0.16-r1:=[${MULTILIB_USEDEP}] )
+ zlib? ( sys-libs/zlib[${MULTILIB_USEDEP}] )
+ zstd? ( >=app-arch/zstd-1.3.0:=[${MULTILIB_USEDEP}] )
+"
+DEPEND="
+ ${RDEPEND}
+ test? (
+ seccomp? ( sys-libs/libseccomp )
+ )
+"
+BDEPEND="
+ dev-build/gtk-doc-am
+ >=virtual/pkgconfig-0-r1
+ doc? ( dev-util/gtk-doc )
+ nls? ( sys-devel/gettext )
+ test-full? (
+ app-crypt/dieharder
+ || ( sys-libs/libfaketime >=app-misc/datefudge-1.22 )
+ dev-libs/softhsm:2[-bindist(-)]
+ net-dialup/ppp
+ net-misc/socat
+ )
+ verify-sig? ( >=sec-keys/openpgp-keys-gnutls-20240415 )
+"
+
+DOCS=( README.md doc/certtool.cfg )
+
+HTML_DOCS=()
+
+QA_CONFIG_IMPL_DECL_SKIP=(
+ # gnulib FPs
+ MIN
+ alignof
+ static_assert
+)
+
+PATCHES=(
+ # Should no longer be needed for the next release
+ # bug #930529
+ "${FILESDIR}"/${PN}-3.8.5-fix-rsaes-pkcs1-systemd-wide-config.patch
+)
+
+src_prepare() {
+ default
+
+ # bug #520818
+ export TZ=UTC
+
+ use doc && HTML_DOCS+=( doc/gnutls.html )
+
+ # don't try to use system certificate store on macOS, it is
+ # confusingly ignoring our ca-certificates and more importantly
+ # fails to compile in certain configurations
+ sed -i -e 's/__APPLE__/__NO_APPLE__/' lib/system/certs.c || die
+
+ # Use sane .so versioning on FreeBSD.
+ elibtoolize
+}
+
+multilib_src_configure() {
+ LINGUAS="${LINGUAS//en/en@boldquot en@quot}"
+
+ local libconf=()
+
+ # TPM needs to be tested before being enabled
+ # Note that this may add a libltdl dep when enabled. Check configure.ac.
+ libconf+=(
+ --without-tpm
+ --without-tpm2
+ )
+
+ # hardware-accel is disabled on OSX because the asm files force
+ # GNU-stack (as doesn't support that) and when that's removed ld
+ # complains about duplicate symbols
+ [[ ${CHOST} == *-darwin* ]] && libconf+=( --disable-hardware-acceleration )
+
+ # -fanalyzer substantially slows down the build and isn't useful for
+ # us. It's useful for upstream as it's static analysis, but it's not
+ # useful when just getting something built.
+ export gl_cv_warn_c__fanalyzer=no
+
+ local myeconfargs=(
+ --disable-valgrind-tests
+ $(multilib_native_enable manpages)
+ $(multilib_native_use_enable doc gtk-doc)
+ $(multilib_native_use_enable doc)
+ $(multilib_native_use_enable seccomp seccomp-tests)
+ $(multilib_native_use_enable test tests)
+ $(multilib_native_use_enable test-full full-test-suite)
+ $(multilib_native_use_enable tools)
+ $(use_enable cxx)
+ $(use_enable dane libdane)
+ $(use_enable nls)
+ $(use_enable openssl openssl-compatibility)
+ $(use_enable sslv2 ssl2-support)
+ $(use_enable sslv3 ssl3-support)
+ $(use_enable static-libs static)
+ $(use_enable tls-heartbeat heartbeat-support)
+ $(use_with brotli)
+ $(use_with idn)
+ $(use_with pkcs11 p11-kit)
+ $(use_with zlib)
+ $(use_with zstd)
+ --disable-rpath
+ --with-default-trust-store-file="${EPREFIX}"/etc/ssl/certs/ca-certificates.crt
+ --with-unbound-root-key-file="${EPREFIX}"/etc/dnssec/root-anchors.txt
+ --without-included-libtasn1
+ $("${S}/configure" --help | grep -o -- '--without-.*-prefix')
+ )
+
+ ECONF_SOURCE="${S}" econf "${libconf[@]}" "${myeconfargs[@]}"
+}
+
+multilib_src_install_all() {
+ einstalldocs
+ find "${ED}" -type f -name '*.la' -delete || die
+
+ if use examples; then
+ docinto examples
+ dodoc doc/examples/*.c
+ fi
+}
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-10 04:43:24 +0000