From ad6182343997a405079870a2fe91c4e0c6b94595 Mon Sep 17 00:00:00 2001 From: V3n3RiX Date: Wed, 25 Sep 2019 19:33:39 +0100 Subject: gentoo resync : 25.09.2019 --- dev-libs/openssl/Manifest | 6 +- dev-libs/openssl/openssl-1.0.2s-r1.ebuild | 320 ------------------------------ dev-libs/openssl/openssl-1.0.2s-r2.ebuild | 318 +++++++++++++++++++++++++++++ dev-libs/openssl/openssl-1.0.2t-r1.ebuild | 307 ++++++++++++++++++++++++++++ dev-libs/openssl/openssl-1.0.2t.ebuild | 309 ----------------------------- 5 files changed, 628 insertions(+), 632 deletions(-) delete mode 100644 dev-libs/openssl/openssl-1.0.2s-r1.ebuild create mode 100644 dev-libs/openssl/openssl-1.0.2s-r2.ebuild create mode 100644 dev-libs/openssl/openssl-1.0.2t-r1.ebuild delete mode 100644 dev-libs/openssl/openssl-1.0.2t.ebuild (limited to 'dev-libs/openssl') diff --git a/dev-libs/openssl/Manifest b/dev-libs/openssl/Manifest index efc9205e2ca3..6cf42876ccfe 100644 --- a/dev-libs/openssl/Manifest +++ b/dev-libs/openssl/Manifest @@ -17,15 +17,15 @@ DIST openssl-1.0.2t-bindist-1.0.tar.xz 13872 BLAKE2B b2aade96a6e0ca6209a39e205b1 DIST openssl-1.0.2t.tar.gz 5355422 BLAKE2B dcbc883151ff6c5b60f5849d8789c2e76a384cb3d5eb5f08a6109776d0edf134580dc33fa8b946ae2344542560f04ecef17f218406952dd8d31e4200c4882022 SHA512 0b88868933f42fab87e8b22449435a1091cc6e75f986aad6c173e01ad123161fcae8c226759073701bc65c9f2f0b6ce6a63a61203008ed873cfb6e484f32bc71 DIST openssl-1.1.0k-bindist-1.0.tar.xz 11716 BLAKE2B c491ba0899c44dbcc63f85b255548c439c965a20a04ac2a6324a4122c4691b7c95ec18e62be6d708a7ea62ea197d32e5091987cb5043969878f89e5bc26243d4 SHA512 1d5bc9d7b24cf55d32d996e2421d43a1218b605720293f00d07814afb481387856f0dc000ad3c3e4cba2361055668cfe79a945be44ab85a249555f37e683a909 DIST openssl-1.1.0k.tar.gz 5287321 BLAKE2B fce40a399f5a08d5fe183dfcaab11b211d982885fb9888b25fa41bdd9919ecd203fca6f573363cfb42c9a0776ae69ea50b0f144227a3f28ca0dbadf878d396bc SHA512 65f41a240a97d79504c0e1391fde8ac8692f0993437cdc35e4bc964ecc36e5ef75a62499c4c6cb4ce63f892135e06dba2d3594c8869d935554296fa3c6ccd822 -DIST openssl-1.1.0l-bindist-1.0.tar.xz 13168 BLAKE2B 1fbd1f7bdba08f14e21485175232283c2309687021a526b4a132b676d7f9429577f8f14e180fb4f59ef24bc9c06873a6936e64559a901803a3f1d21453177b50 SHA512 f664a6876a2a9c7467bbc6a436593eb21cc6be51e08408657f34b67fa69cd6bece3cc65f60220d7e41f36b359b5299adf49a59ede7f8f738d6a31e29d2a49714 +DIST openssl-1.1.0l-bindist-1.0.tar.xz 13184 BLAKE2B c09e023458faff17b10d6f20c28462c0851757a20d59b4b751220ab307324d5778252df112ad74fd319407cc75fdd1cd507d48058dd0234dc8c03020c882ed42 SHA512 39720ecee3ec6080c1416f2fb7c9246b89ee55b21be2baabad51eb6823dbe1559450b1ae92fa61ac1cf5ba04ac8c02438aa469bc65eae6905cf1ea486f270793 DIST openssl-1.1.0l.tar.gz 5294857 BLAKE2B 0e4f30f9e8a22414325bd780dc4e875e962487fbe72967f0392ace959955429192541881a98d097d7bb75ed7238b1817b0c3c2c4da04421512bd538f2b07cdd7 SHA512 81b74149f40ea7d9f7e235820a4f977844653ad1e2b302e65e712c12193f47542fe7e3385fd1e25e3dd074e4e6d04199836cbc492656f5a7692edab5e234f4ad DIST openssl-1.1.1c-bindist-1.0.tar.xz 11964 BLAKE2B 8c5190846d13984589a150089d329bb3ecc613788b9462c6f6a1833a040e21cb9bf940140449f09fd797c0e396b0aea073237be374bd16097795b8974c3e7ce5 SHA512 249c6d8c455130b98e3be635f12f323e0cc349f1770648bad591e5de15483917185a473c162ed871a2fa05b47056931e6f12e5fdd9cecee7e6d1c246b862923b DIST openssl-1.1.1c.tar.gz 8864262 BLAKE2B bd157b244bedcefb8e646a743732945119b267236789ac69c38856570318aca09299bdaaea3f20294863b633e6fd4dfe124820597185b3b7461cfdf094daadb0 SHA512 8e2c5cc11c120efbb7d7850980cb6eaa782d29b4996b3f3378d37613c1679f852d7cc08a90d62e78fcec3439f06bdbee70064579a8c2adaffd91532a97f646ff DIST openssl-1.1.1d-bindist-1.0.tar.xz 13180 BLAKE2B 680bd7400d3dd3930067ee7efa9718b74b30afa9be2397ad80f88031920806b6603b6469beede02b6e7a742abf5f82ebdd7c9b8e69c1ffe223e4860dc9581128 SHA512 9e4296326852010d5cebc204d1a34a34198d8d65460bc91a2bd37c80be892a5ae519513e4b0109e6b51b6faab0e171ef6cdae868868c158711558d147083c06f DIST openssl-1.1.1d.tar.gz 8845861 BLAKE2B d3155f07b487ebd8dd4fe25396c874f9af18b5cfd7e622298d29c4f2c8ce14ad4534609d321314a4bcd0d44414e1306190340daaacd3c8fca061c04498446244 SHA512 2bc9f528c27fe644308eb7603c992bac8740e9f0c3601a130af30c9ffebbf7e0f5c28b76a00bbb478bad40fbe89b4223a58d604001e1713da71ff4b7fe6a08a7 EBUILD openssl-1.0.2r.ebuild 10261 BLAKE2B d69c02146d892718a81ea97c6d946cdbef7fbefdfdbccc1590b961d1514d0c21e5b3f9d52a07465d0848cba20b9d5773092680e95dafb2233232b607582f9834 SHA512 8e5c8ecf64b9684047106fc07d9529f64f34782129975e1dff7777104dd18de66800a75f2cc30dea3d2079e2387843fa742fc470319f53c1bf6574798ddd8630 -EBUILD openssl-1.0.2s-r1.ebuild 10613 BLAKE2B f31ebad1aaef7aa81317c681315456874501e00f6f39f6c20e319a4365f4ec34d1c183a70d904dbe106aeb5f4503444cd63ead7cb73974c8fc5571ddba4fe0a3 SHA512 b53254e4b78fbcd48ab4d7cf3b43c5997e31a7487078e8534a18fc03af168f958793e5abd55db3b6a2ffc7baa397b461b588d2299f2a1192deaa5c0aafdeb6ac -EBUILD openssl-1.0.2t.ebuild 9969 BLAKE2B 5f71b08dcd411401b6e8c0e0be45f3329b6b1be53c4c8594b0b9ae011a5b1e14af50be8b125dc163c8f4774863398554dd43765a315099636d46267ec2cbba13 SHA512 f6056ebc7499818d706f545e49efa252b827788259540f4580398975c92e749ba889d38c2d75a106ce66e3ae5efa9d9bff69f37b2656392f1c757719b9898a79 +EBUILD openssl-1.0.2s-r2.ebuild 10519 BLAKE2B 6856119b931ab897e828101294eb4f62fe89422f71aad8e86fe399abfbd3ab6b2c1c06d02b2f3e79a742d00e0941abe17a19f957dc82eab73ec3c7dd4de72745 SHA512 fb6b8a378291108f8093e0f60b9e2b24a3fc6833f1ec581f3c6dd7b04dda880547be23c1cc9801ff9cd6407ee90fbe71a243ae01a9e2738592240c06af34f35b +EBUILD openssl-1.0.2t-r1.ebuild 9872 BLAKE2B 90c7e6c26b520208e35b8037ba89642bae7714aae464bfcb76f053f261a664d03ffa98bbe86dce4cfadc9c871ddaec8bf4d143f0115d1ecca36dbf295d7d0e37 SHA512 4ae5b6aa61507a4a39eef0db5e240ff931830eca593da5eb328d1d6f0268111f2e14fc2bd6149fc63e2b44af8cc3145c4243aedab6d14d03977007837e9c60b9 EBUILD openssl-1.1.0k-r1.ebuild 9463 BLAKE2B d04ca8cad9e3a763c606b88b66309a11c3f3d1b27af1870dadb258521f110e5d7e6b5482554ee3a00c5a92343542b411ebb084de338d751bd04ccd3afc69a9b4 SHA512 4be3b7b467ca52a35de64d7ec53bb414f67fa30953001a66503336ca32635e8d9d7682a1f15d60e627903bad8d5603c29398b418e263b638c58ff1ec0da42bfd EBUILD openssl-1.1.0l.ebuild 9601 BLAKE2B 37990d15c063ffbf5922bd3a4a195e5dd359bc8ccffe940376a80b3d2e5af694030e7bdf841e574f2d24f62f11d6427dfb2b926cb0f45f8387e51d4606907d45 SHA512 0eab2bde4858c9f74c4ae799ed2cd7bebd4e47edb6cff52e5b9487703287fa424e99f973d48b0a01d67b80fedfa7d03ddeb5be702877fc87da2b91bc18d53122 EBUILD openssl-1.1.1c-r1.ebuild 9297 BLAKE2B 114347e74c4224d73956c4d9e333776da681690779a9e542422a9c15ac8bf624469ad337b3cbbde159b35474631de95a423f2ccdf20d3a2370d086b89fa24b10 SHA512 eb7bfe2b301769fc1e3118bf449c85f8af455c1e0252c3b574b426b4986ee1631581bbbd915c13f75ce9f1e1704f6ced048a0485dae69ba1aafb31f3aa455b65 diff --git a/dev-libs/openssl/openssl-1.0.2s-r1.ebuild b/dev-libs/openssl/openssl-1.0.2s-r1.ebuild deleted file mode 100644 index b4902db7e537..000000000000 --- a/dev-libs/openssl/openssl-1.0.2s-r1.ebuild +++ /dev/null @@ -1,320 +0,0 @@ -# Copyright 1999-2019 Gentoo Authors -# Distributed under the terms of the GNU General Public License v2 - -EAPI="7" - -inherit flag-o-matic toolchain-funcs multilib multilib-minimal - -# openssl-1.0.2-patches-1.6 contain additional CVE patches -# which got fixed with this release. -# Please use 1.7 version number when rolling a new tarball! -PATCH_SET="openssl-1.0.2-patches-1.5" -MY_P=${P/_/-} -DESCRIPTION="full-strength general purpose cryptography library (including SSL and TLS)" -HOMEPAGE="https://www.openssl.org/" -SRC_URI="mirror://openssl/source/${MY_P}.tar.gz - !vanilla? ( - mirror://gentoo/${PATCH_SET}.tar.xz - https://dev.gentoo.org/~chutzpah/dist/${PN}/${PATCH_SET}.tar.xz - https://dev.gentoo.org/~whissi/dist/${PN}/${PATCH_SET}.tar.xz - https://dev.gentoo.org/~polynomial-c/dist/${PATCH_SET}.tar.xz - )" - -LICENSE="openssl" -SLOT="0" -KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~x86-fbsd ~x86-linux" -IUSE="+asm bindist gmp kerberos rfc3779 sctp cpu_flags_x86_sse2 sslv2 +sslv3 static-libs test +tls-heartbeat vanilla zlib" -RESTRICT="!bindist? ( bindist )" - -RDEPEND=">=app-misc/c_rehash-1.7-r1 - gmp? ( >=dev-libs/gmp-5.1.3-r1[static-libs(+)?,${MULTILIB_USEDEP}] ) - kerberos? ( >=app-crypt/mit-krb5-1.11.4[${MULTILIB_USEDEP}] ) - zlib? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] )" -DEPEND="${RDEPEND}" -BDEPEND=" - >=dev-lang/perl-5 - sctp? ( >=net-misc/lksctp-tools-1.0.12 ) - test? ( - sys-apps/diffutils - sys-devel/bc - )" -PDEPEND="app-misc/ca-certificates" - -# This does not copy the entire Fedora patchset, but JUST the parts that -# are needed to make it safe to use EC with RESTRICT=bindist. -# See openssl.spec for the matching numbering of SourceNNN, PatchNNN -SOURCE1=hobble-openssl -SOURCE12=ec_curve.c -SOURCE13=ectest.c -# These are ported instead -#PATCH1=openssl-1.1.0-build.patch # Fixes EVP testcase for EC -#PATCH37=openssl-1.1.0-ec-curves.patch -FEDORA_GIT_BASE='https://src.fedoraproject.org/cgit/rpms/openssl.git/plain/' -FEDORA_GIT_BRANCH='f25' -FEDORA_SRC_URI=() -FEDORA_SOURCE=( $SOURCE1 $SOURCE12 $SOURCE13 ) -FEDORA_PATCH=( $PATCH1 $PATCH37 ) -for i in "${FEDORA_SOURCE[@]}" ; do - FEDORA_SRC_URI+=( "${FEDORA_GIT_BASE}/${i}?h=${FEDORA_GIT_BRANCH} -> ${P}_${i}" ) -done -for i in "${FEDORA_PATCH[@]}" ; do # Already have a version prefix - FEDORA_SRC_URI+=( "${FEDORA_GIT_BASE}/${i}?h=${FEDORA_GIT_BRANCH} -> ${i}" ) -done -SRC_URI+=" bindist? ( ${FEDORA_SRC_URI[@]} )" - -S="${WORKDIR}/${MY_P}" - -MULTILIB_WRAPPED_HEADERS=( - usr/include/openssl/opensslconf.h -) - -src_prepare() { - if use bindist; then - # This just removes the prefix, and puts it into WORKDIR like the RPM. - for i in "${FEDORA_SOURCE[@]}" ; do - cp -f "${DISTDIR}"/"${P}_${i}" "${WORKDIR}"/"${i}" || die - done - # .spec %prep - bash "${WORKDIR}"/"${SOURCE1}" || die - cp -f "${WORKDIR}"/"${SOURCE12}" "${S}"/crypto/ec/ || die - cp -f "${WORKDIR}"/"${SOURCE13}" "${S}"/crypto/ec/ || die # Moves to test/ in OpenSSL-1.1 - for i in "${FEDORA_PATCH[@]}" ; do - eapply "${DISTDIR}"/"${i}" - done - eapply "${FILESDIR}"/openssl-1.0.2p-hobble-ecc.patch - # Also see the configure parts below: - # enable-ec \ - # $(use_ssl !bindist ec2m) \ - # $(use_ssl !bindist srp) \ - fi - - # keep this in sync with app-misc/c_rehash - SSL_CNF_DIR="/etc/ssl" - - # Make sure we only ever touch Makefile.org and avoid patching a file - # that gets blown away anyways by the Configure script in src_configure - rm -f Makefile - - if ! use vanilla ; then - if [[ $(declare -p PATCHES 2>/dev/null) == "declare -a"* ]] ; then - [[ ${#PATCHES[@]} -gt 0 ]] && eapply "${PATCHES[@]}" - fi - fi - - eapply_user - - # disable fips in the build - # make sure the man pages are suffixed #302165 - # don't bother building man pages if they're disabled - sed -i \ - -e '/DIRS/s: fips : :g' \ - -e '/^MANSUFFIX/s:=.*:=ssl:' \ - -e '/^MAKEDEPPROG/s:=.*:=$(CC):' \ - -e $(has noman FEATURES \ - && echo '/^install:/s:install_docs::' \ - || echo '/^MANDIR=/s:=.*:='${EPREFIX}'/usr/share/man:') \ - Makefile.org \ - || die - # show the actual commands in the log - sed -i '/^SET_X/s:=.*:=set -x:' Makefile.shared - - # since we're forcing $(CC) as makedep anyway, just fix - # the conditional as always-on - # helps clang (#417795), and versioned gcc (#499818) - # this breaks build with 1.0.2p, not sure if it is needed anymore - #sed -i 's/expr.*MAKEDEPEND.*;/true;/' util/domd || die - - # quiet out unknown driver argument warnings since openssl - # doesn't have well-split CFLAGS and we're making it even worse - # and 'make depend' uses -Werror for added fun (#417795 again) - [[ ${CC} == *clang* ]] && append-flags -Qunused-arguments - - # allow openssl to be cross-compiled - cp "${FILESDIR}"/gentoo.config-1.0.2 gentoo.config || die - chmod a+rx gentoo.config || die - - append-flags -fno-strict-aliasing - append-flags $(test-flags-CC -Wa,--noexecstack) - append-cppflags -DOPENSSL_NO_BUF_FREELISTS - - sed -i '1s,^:$,#!'${EPREFIX}'/usr/bin/perl,' Configure #141906 - # The config script does stupid stuff to prompt the user. Kill it. - sed -i '/stty -icanon min 0 time 50; read waste/d' config || die - ./config --test-sanity || die "I AM NOT SANE" - - multilib_copy_sources -} - -multilib_src_configure() { - unset APPS #197996 - unset SCRIPTS #312551 - unset CROSS_COMPILE #311473 - - tc-export CC AR RANLIB RC - - # Clean out patent-or-otherwise-encumbered code - # Camellia: Royalty Free https://en.wikipedia.org/wiki/Camellia_(cipher) - # IDEA: Expired https://en.wikipedia.org/wiki/International_Data_Encryption_Algorithm - # EC: ????????? ??/??/2015 https://en.wikipedia.org/wiki/Elliptic_Curve_Cryptography - # MDC2: Expired https://en.wikipedia.org/wiki/MDC-2 - # RC5: Expired https://en.wikipedia.org/wiki/RC5 - - use_ssl() { usex $1 "enable-${2:-$1}" "no-${2:-$1}" " ${*:3}" ; } - echoit() { echo "$@" ; "$@" ; } - - local krb5=$(has_version app-crypt/mit-krb5 && echo "MIT" || echo "Heimdal") - - # See if our toolchain supports __uint128_t. If so, it's 64bit - # friendly and can use the nicely optimized code paths. #460790 - local ec_nistp_64_gcc_128 - # Disable it for now though #469976 - #if ! use bindist ; then - # echo "__uint128_t i;" > "${T}"/128.c - # if ${CC} ${CFLAGS} -c "${T}"/128.c -o /dev/null >&/dev/null ; then - # ec_nistp_64_gcc_128="enable-ec_nistp_64_gcc_128" - # fi - #fi - - # https://github.com/openssl/openssl/issues/2286 - if use ia64 ; then - replace-flags -g3 -g2 - replace-flags -ggdb3 -ggdb2 - fi - - local sslout=$(./gentoo.config) - einfo "Use configuration ${sslout:-(openssl knows best)}" - local config="Configure" - [[ -z ${sslout} ]] && config="config" - - # Fedora hobbled-EC needs 'no-ec2m', 'no-srp' - # Make sure user flags don't get added *yet* to avoid duplicated - # flags. - CFLAGS= LDFLAGS= echoit \ - ./${config} \ - ${sslout} \ - $(use cpu_flags_x86_sse2 || echo "no-sse2") \ - enable-camellia \ - enable-ec \ - $(use_ssl !bindist ec2m) \ - $(use_ssl !bindist srp) \ - ${ec_nistp_64_gcc_128} \ - enable-idea \ - enable-mdc2 \ - enable-rc5 \ - enable-tlsext \ - $(use_ssl asm) \ - $(use_ssl gmp gmp -lgmp) \ - $(use_ssl kerberos krb5 --with-krb5-flavor=${krb5}) \ - $(use_ssl rfc3779) \ - $(use_ssl sctp) \ - $(use_ssl sslv2 ssl2) \ - $(use_ssl sslv3 ssl3) \ - $(use_ssl tls-heartbeat heartbeats) \ - $(use_ssl zlib) \ - --prefix="${EPREFIX}"/usr \ - --openssldir="${EPREFIX}"${SSL_CNF_DIR} \ - --libdir=$(get_libdir) \ - shared threads \ - || die - - # Clean out hardcoded flags that openssl uses - local DEFAULT_CFLAGS=$(grep ^CFLAG= Makefile | LC_ALL=C sed \ - -e 's:^CFLAG=::' \ - -e 's:\(^\| \)-fomit-frame-pointer::g' \ - -e 's:\(^\| \)-O[^ ]*::g' \ - -e 's:\(^\| \)-march=[^ ]*::g' \ - -e 's:\(^\| \)-mcpu=[^ ]*::g' \ - -e 's:\(^\| \)-m[^ ]*::g' \ - -e 's:^ *::' \ - -e 's: *$::' \ - -e 's: \+: :g' \ - -e 's:\\:\\\\:g' - ) - - # Now insert clean default flags with user flags - sed -i \ - -e "/^CFLAG/s|=.*|=${DEFAULT_CFLAGS} ${CFLAGS}|" \ - -e "/^LDFLAGS=/s|=[[:space:]]*$|=${LDFLAGS}|" \ - Makefile || die -} - -multilib_src_compile() { - # depend is needed to use $confopts; it also doesn't matter - # that it's -j1 as the code itself serializes subdirs - emake -j1 V=1 depend - emake all - # rehash is needed to prep the certs/ dir; do this - # separately to avoid parallel build issues. - emake rehash -} - -multilib_src_test() { - emake -j1 test -} - -multilib_src_install() { - # We need to create $ED/usr on our own to avoid a race condition #665130 - if [[ ! -d "${ED}/usr" ]]; then - # We can only create this directory once - mkdir "${ED}"/usr || die - fi - - emake INSTALL_PREFIX="${D}" install -} - -multilib_src_install_all() { - # openssl installs perl version of c_rehash by default, but - # we provide a shell version via app-misc/c_rehash - rm "${ED}"/usr/bin/c_rehash || die - - local -a DOCS=( CHANGES* FAQ NEWS README doc/*.txt doc/c-indentation.el ) - einstalldocs - - use rfc3779 && dodoc engines/ccgost/README.gost - - # This is crappy in that the static archives are still built even - # when USE=static-libs. But this is due to a failing in the openssl - # build system: the static archives are built as PIC all the time. - # Only way around this would be to manually configure+compile openssl - # twice; once with shared lib support enabled and once without. - use static-libs || rm -f "${ED}"/usr/lib*/lib*.a - - # create the certs directory - dodir ${SSL_CNF_DIR}/certs - cp -RP certs/* "${ED}"${SSL_CNF_DIR}/certs/ || die - rm -r "${ED}"${SSL_CNF_DIR}/certs/{demo,expired} - - # Namespace openssl programs to prevent conflicts with other man pages - cd "${ED}"/usr/share/man - local m d s - for m in $(find . -type f | xargs grep -L '#include') ; do - d=${m%/*} ; d=${d#./} ; m=${m##*/} - [[ ${m} == openssl.1* ]] && continue - [[ -n $(find -L ${d} -type l) ]] && die "erp, broken links already!" - mv ${d}/{,ssl-}${m} - # fix up references to renamed man pages - sed -i '/^[.]SH "SEE ALSO"/,/^[.]/s:\([^(, ]*(1)\):ssl-\1:g' ${d}/ssl-${m} - ln -s ssl-${m} ${d}/openssl-${m} - # locate any symlinks that point to this man page ... we assume - # that any broken links are due to the above renaming - for s in $(find -L ${d} -type l) ; do - s=${s##*/} - rm -f ${d}/${s} - ln -s ssl-${m} ${d}/ssl-${s} - ln -s ssl-${s} ${d}/openssl-${s} - done - done - [[ -n $(find -L ${d} -type l) ]] && die "broken manpage links found :(" - - dodir /etc/sandbox.d #254521 - echo 'SANDBOX_PREDICT="/dev/crypto"' > "${ED}"/etc/sandbox.d/10openssl - - diropts -m0700 - keepdir ${SSL_CNF_DIR}/private -} - -pkg_postinst() { - ebegin "Running 'c_rehash ${EROOT}${SSL_CNF_DIR}/certs/' to rebuild hashes #333069" - c_rehash "${EROOT}${SSL_CNF_DIR}/certs" >/dev/null - eend $? -} diff --git a/dev-libs/openssl/openssl-1.0.2s-r2.ebuild b/dev-libs/openssl/openssl-1.0.2s-r2.ebuild new file mode 100644 index 000000000000..fbf3c919b91d --- /dev/null +++ b/dev-libs/openssl/openssl-1.0.2s-r2.ebuild @@ -0,0 +1,318 @@ +# Copyright 1999-2019 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI="7" + +inherit flag-o-matic toolchain-funcs multilib multilib-minimal + +# openssl-1.0.2-patches-1.6 contain additional CVE patches +# which got fixed with this release. +# Please use 1.7 version number when rolling a new tarball! +PATCH_SET="openssl-1.0.2-patches-1.5" +MY_P=${P/_/-} +DESCRIPTION="full-strength general purpose cryptography library (including SSL and TLS)" +HOMEPAGE="https://www.openssl.org/" +SRC_URI="mirror://openssl/source/${MY_P}.tar.gz + !vanilla? ( + mirror://gentoo/${PATCH_SET}.tar.xz + https://dev.gentoo.org/~chutzpah/dist/${PN}/${PATCH_SET}.tar.xz + https://dev.gentoo.org/~whissi/dist/${PN}/${PATCH_SET}.tar.xz + https://dev.gentoo.org/~polynomial-c/dist/${PATCH_SET}.tar.xz + )" + +LICENSE="openssl" +SLOT="0" +KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~x86-fbsd ~x86-linux" +IUSE="+asm bindist gmp kerberos rfc3779 sctp cpu_flags_x86_sse2 sslv2 +sslv3 static-libs test +tls-heartbeat vanilla zlib" +RESTRICT="!bindist? ( bindist )" + +RDEPEND=">=app-misc/c_rehash-1.7-r1 + gmp? ( >=dev-libs/gmp-5.1.3-r1[static-libs(+)?,${MULTILIB_USEDEP}] ) + kerberos? ( >=app-crypt/mit-krb5-1.11.4[${MULTILIB_USEDEP}] ) + zlib? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] )" +DEPEND="${RDEPEND}" +BDEPEND=" + >=dev-lang/perl-5 + sctp? ( >=net-misc/lksctp-tools-1.0.12 ) + test? ( + sys-apps/diffutils + sys-devel/bc + )" +PDEPEND="app-misc/ca-certificates" + +# This does not copy the entire Fedora patchset, but JUST the parts that +# are needed to make it safe to use EC with RESTRICT=bindist. +# See openssl.spec for the matching numbering of SourceNNN, PatchNNN +SOURCE1=hobble-openssl +SOURCE12=ec_curve.c +SOURCE13=ectest.c +# These are ported instead +#PATCH1=openssl-1.1.0-build.patch # Fixes EVP testcase for EC +#PATCH37=openssl-1.1.0-ec-curves.patch +FEDORA_GIT_BASE='https://src.fedoraproject.org/cgit/rpms/openssl.git/plain/' +FEDORA_GIT_BRANCH='f25' +FEDORA_SRC_URI=() +FEDORA_SOURCE=( $SOURCE1 $SOURCE12 $SOURCE13 ) +FEDORA_PATCH=( $PATCH1 $PATCH37 ) +for i in "${FEDORA_SOURCE[@]}" ; do + FEDORA_SRC_URI+=( "${FEDORA_GIT_BASE}/${i}?h=${FEDORA_GIT_BRANCH} -> ${P}_${i}" ) +done +for i in "${FEDORA_PATCH[@]}" ; do # Already have a version prefix + FEDORA_SRC_URI+=( "${FEDORA_GIT_BASE}/${i}?h=${FEDORA_GIT_BRANCH} -> ${i}" ) +done +SRC_URI+=" bindist? ( ${FEDORA_SRC_URI[@]} )" + +S="${WORKDIR}/${MY_P}" + +MULTILIB_WRAPPED_HEADERS=( + usr/include/openssl/opensslconf.h +) + +src_prepare() { + if use bindist; then + # This just removes the prefix, and puts it into WORKDIR like the RPM. + for i in "${FEDORA_SOURCE[@]}" ; do + cp -f "${DISTDIR}"/"${P}_${i}" "${WORKDIR}"/"${i}" || die + done + # .spec %prep + bash "${WORKDIR}"/"${SOURCE1}" || die + cp -f "${WORKDIR}"/"${SOURCE12}" "${S}"/crypto/ec/ || die + cp -f "${WORKDIR}"/"${SOURCE13}" "${S}"/crypto/ec/ || die # Moves to test/ in OpenSSL-1.1 + for i in "${FEDORA_PATCH[@]}" ; do + eapply "${DISTDIR}"/"${i}" + done + eapply "${FILESDIR}"/openssl-1.0.2p-hobble-ecc.patch + # Also see the configure parts below: + # enable-ec \ + # $(use_ssl !bindist ec2m) \ + # $(use_ssl !bindist srp) \ + fi + + # keep this in sync with app-misc/c_rehash + SSL_CNF_DIR="/etc/ssl" + + # Make sure we only ever touch Makefile.org and avoid patching a file + # that gets blown away anyways by the Configure script in src_configure + rm -f Makefile + + if ! use vanilla ; then + eapply "${WORKDIR}"/patch/*.patch + fi + + eapply_user + + # disable fips in the build + # make sure the man pages are suffixed #302165 + # don't bother building man pages if they're disabled + sed -i \ + -e '/DIRS/s: fips : :g' \ + -e '/^MANSUFFIX/s:=.*:=ssl:' \ + -e '/^MAKEDEPPROG/s:=.*:=$(CC):' \ + -e $(has noman FEATURES \ + && echo '/^install:/s:install_docs::' \ + || echo '/^MANDIR=/s:=.*:='${EPREFIX}'/usr/share/man:') \ + Makefile.org \ + || die + # show the actual commands in the log + sed -i '/^SET_X/s:=.*:=set -x:' Makefile.shared + + # since we're forcing $(CC) as makedep anyway, just fix + # the conditional as always-on + # helps clang (#417795), and versioned gcc (#499818) + # this breaks build with 1.0.2p, not sure if it is needed anymore + #sed -i 's/expr.*MAKEDEPEND.*;/true;/' util/domd || die + + # quiet out unknown driver argument warnings since openssl + # doesn't have well-split CFLAGS and we're making it even worse + # and 'make depend' uses -Werror for added fun (#417795 again) + [[ ${CC} == *clang* ]] && append-flags -Qunused-arguments + + # allow openssl to be cross-compiled + cp "${FILESDIR}"/gentoo.config-1.0.2 gentoo.config || die + chmod a+rx gentoo.config || die + + append-flags -fno-strict-aliasing + append-flags $(test-flags-CC -Wa,--noexecstack) + append-cppflags -DOPENSSL_NO_BUF_FREELISTS + + sed -i '1s,^:$,#!'${EPREFIX}'/usr/bin/perl,' Configure #141906 + # The config script does stupid stuff to prompt the user. Kill it. + sed -i '/stty -icanon min 0 time 50; read waste/d' config || die + ./config --test-sanity || die "I AM NOT SANE" + + multilib_copy_sources +} + +multilib_src_configure() { + unset APPS #197996 + unset SCRIPTS #312551 + unset CROSS_COMPILE #311473 + + tc-export CC AR RANLIB RC + + # Clean out patent-or-otherwise-encumbered code + # Camellia: Royalty Free https://en.wikipedia.org/wiki/Camellia_(cipher) + # IDEA: Expired https://en.wikipedia.org/wiki/International_Data_Encryption_Algorithm + # EC: ????????? ??/??/2015 https://en.wikipedia.org/wiki/Elliptic_Curve_Cryptography + # MDC2: Expired https://en.wikipedia.org/wiki/MDC-2 + # RC5: Expired https://en.wikipedia.org/wiki/RC5 + + use_ssl() { usex $1 "enable-${2:-$1}" "no-${2:-$1}" " ${*:3}" ; } + echoit() { echo "$@" ; "$@" ; } + + local krb5=$(has_version app-crypt/mit-krb5 && echo "MIT" || echo "Heimdal") + + # See if our toolchain supports __uint128_t. If so, it's 64bit + # friendly and can use the nicely optimized code paths. #460790 + local ec_nistp_64_gcc_128 + # Disable it for now though #469976 + #if ! use bindist ; then + # echo "__uint128_t i;" > "${T}"/128.c + # if ${CC} ${CFLAGS} -c "${T}"/128.c -o /dev/null >&/dev/null ; then + # ec_nistp_64_gcc_128="enable-ec_nistp_64_gcc_128" + # fi + #fi + + # https://github.com/openssl/openssl/issues/2286 + if use ia64 ; then + replace-flags -g3 -g2 + replace-flags -ggdb3 -ggdb2 + fi + + local sslout=$(./gentoo.config) + einfo "Use configuration ${sslout:-(openssl knows best)}" + local config="Configure" + [[ -z ${sslout} ]] && config="config" + + # Fedora hobbled-EC needs 'no-ec2m', 'no-srp' + # Make sure user flags don't get added *yet* to avoid duplicated + # flags. + CFLAGS= LDFLAGS= echoit \ + ./${config} \ + ${sslout} \ + $(use cpu_flags_x86_sse2 || echo "no-sse2") \ + enable-camellia \ + enable-ec \ + $(use_ssl !bindist ec2m) \ + $(use_ssl !bindist srp) \ + ${ec_nistp_64_gcc_128} \ + enable-idea \ + enable-mdc2 \ + enable-rc5 \ + enable-tlsext \ + $(use_ssl asm) \ + $(use_ssl gmp gmp -lgmp) \ + $(use_ssl kerberos krb5 --with-krb5-flavor=${krb5}) \ + $(use_ssl rfc3779) \ + $(use_ssl sctp) \ + $(use_ssl sslv2 ssl2) \ + $(use_ssl sslv3 ssl3) \ + $(use_ssl tls-heartbeat heartbeats) \ + $(use_ssl zlib) \ + --prefix="${EPREFIX}"/usr \ + --openssldir="${EPREFIX}"${SSL_CNF_DIR} \ + --libdir=$(get_libdir) \ + shared threads \ + || die + + # Clean out hardcoded flags that openssl uses + local DEFAULT_CFLAGS=$(grep ^CFLAG= Makefile | LC_ALL=C sed \ + -e 's:^CFLAG=::' \ + -e 's:\(^\| \)-fomit-frame-pointer::g' \ + -e 's:\(^\| \)-O[^ ]*::g' \ + -e 's:\(^\| \)-march=[^ ]*::g' \ + -e 's:\(^\| \)-mcpu=[^ ]*::g' \ + -e 's:\(^\| \)-m[^ ]*::g' \ + -e 's:^ *::' \ + -e 's: *$::' \ + -e 's: \+: :g' \ + -e 's:\\:\\\\:g' + ) + + # Now insert clean default flags with user flags + sed -i \ + -e "/^CFLAG/s|=.*|=${DEFAULT_CFLAGS} ${CFLAGS}|" \ + -e "/^LDFLAGS=/s|=[[:space:]]*$|=${LDFLAGS}|" \ + Makefile || die +} + +multilib_src_compile() { + # depend is needed to use $confopts; it also doesn't matter + # that it's -j1 as the code itself serializes subdirs + emake -j1 V=1 depend + emake all + # rehash is needed to prep the certs/ dir; do this + # separately to avoid parallel build issues. + emake rehash +} + +multilib_src_test() { + emake -j1 test +} + +multilib_src_install() { + # We need to create $ED/usr on our own to avoid a race condition #665130 + if [[ ! -d "${ED}/usr" ]]; then + # We can only create this directory once + mkdir "${ED}"/usr || die + fi + + emake INSTALL_PREFIX="${D}" install +} + +multilib_src_install_all() { + # openssl installs perl version of c_rehash by default, but + # we provide a shell version via app-misc/c_rehash + rm "${ED}"/usr/bin/c_rehash || die + + local -a DOCS=( CHANGES* FAQ NEWS README doc/*.txt doc/c-indentation.el ) + einstalldocs + + use rfc3779 && dodoc engines/ccgost/README.gost + + # This is crappy in that the static archives are still built even + # when USE=static-libs. But this is due to a failing in the openssl + # build system: the static archives are built as PIC all the time. + # Only way around this would be to manually configure+compile openssl + # twice; once with shared lib support enabled and once without. + use static-libs || rm -f "${ED}"/usr/lib*/lib*.a + + # create the certs directory + dodir ${SSL_CNF_DIR}/certs + cp -RP certs/* "${ED}"${SSL_CNF_DIR}/certs/ || die + rm -r "${ED}"${SSL_CNF_DIR}/certs/{demo,expired} + + # Namespace openssl programs to prevent conflicts with other man pages + cd "${ED}"/usr/share/man + local m d s + for m in $(find . -type f | xargs grep -L '#include') ; do + d=${m%/*} ; d=${d#./} ; m=${m##*/} + [[ ${m} == openssl.1* ]] && continue + [[ -n $(find -L ${d} -type l) ]] && die "erp, broken links already!" + mv ${d}/{,ssl-}${m} + # fix up references to renamed man pages + sed -i '/^[.]SH "SEE ALSO"/,/^[.]/s:\([^(, ]*(1)\):ssl-\1:g' ${d}/ssl-${m} + ln -s ssl-${m} ${d}/openssl-${m} + # locate any symlinks that point to this man page ... we assume + # that any broken links are due to the above renaming + for s in $(find -L ${d} -type l) ; do + s=${s##*/} + rm -f ${d}/${s} + ln -s ssl-${m} ${d}/ssl-${s} + ln -s ssl-${s} ${d}/openssl-${s} + done + done + [[ -n $(find -L ${d} -type l) ]] && die "broken manpage links found :(" + + dodir /etc/sandbox.d #254521 + echo 'SANDBOX_PREDICT="/dev/crypto"' > "${ED}"/etc/sandbox.d/10openssl + + diropts -m0700 + keepdir ${SSL_CNF_DIR}/private +} + +pkg_postinst() { + ebegin "Running 'c_rehash ${EROOT}${SSL_CNF_DIR}/certs/' to rebuild hashes #333069" + c_rehash "${EROOT}${SSL_CNF_DIR}/certs" >/dev/null + eend $? +} diff --git a/dev-libs/openssl/openssl-1.0.2t-r1.ebuild b/dev-libs/openssl/openssl-1.0.2t-r1.ebuild new file mode 100644 index 000000000000..eb39171323f6 --- /dev/null +++ b/dev-libs/openssl/openssl-1.0.2t-r1.ebuild @@ -0,0 +1,307 @@ +# Copyright 1999-2019 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI="7" + +inherit flag-o-matic toolchain-funcs multilib multilib-minimal + +# openssl-1.0.2-patches-1.6 contain additional CVE patches +# which got fixed with this release. +# Please use 1.7 version number when rolling a new tarball! +PATCH_SET="openssl-1.0.2-patches-1.5" + +MY_P=${P/_/-} + +# This patch set is based on the following files from Fedora 25, +# see https://src.fedoraproject.org/rpms/openssl/blob/25/f/openssl.spec +# for more details: +# - hobble-openssl (SOURCE1) +# - ec_curve.c (SOURCE12) -- MODIFIED +# - ectest.c (SOURCE13) +# - openssl-1.1.1-ec-curves.patch (PATCH37) -- MODIFIED +BINDIST_PATCH_SET="openssl-1.0.2t-bindist-1.0.tar.xz" + +DESCRIPTION="full-strength general purpose cryptography library (including SSL and TLS)" +HOMEPAGE="https://www.openssl.org/" +SRC_URI="mirror://openssl/source/${MY_P}.tar.gz + bindist? ( + mirror://gentoo/${BINDIST_PATCH_SET} + https://dev.gentoo.org/~whissi/dist/openssl/${BINDIST_PATCH_SET} + ) + !vanilla? ( + mirror://gentoo/${PATCH_SET}.tar.xz + https://dev.gentoo.org/~chutzpah/dist/${PN}/${PATCH_SET}.tar.xz + https://dev.gentoo.org/~whissi/dist/${PN}/${PATCH_SET}.tar.xz + https://dev.gentoo.org/~polynomial-c/dist/${PATCH_SET}.tar.xz + )" + +LICENSE="openssl" +SLOT="0" +KEYWORDS="alpha amd64 arm arm64 hppa ia64 ~m68k ~mips ppc ppc64 ~riscv s390 ~sh sparc x86 ~amd64-fbsd ~x86-fbsd ~x86-linux" +IUSE="+asm bindist gmp kerberos rfc3779 sctp cpu_flags_x86_sse2 sslv2 +sslv3 static-libs test +tls-heartbeat vanilla zlib" +RESTRICT="!bindist? ( bindist )" + +RDEPEND=">=app-misc/c_rehash-1.7-r1 + gmp? ( >=dev-libs/gmp-5.1.3-r1[static-libs(+)?,${MULTILIB_USEDEP}] ) + kerberos? ( >=app-crypt/mit-krb5-1.11.4[${MULTILIB_USEDEP}] ) + zlib? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] )" +DEPEND="${RDEPEND}" +BDEPEND=" + >=dev-lang/perl-5 + sctp? ( >=net-misc/lksctp-tools-1.0.12 ) + test? ( + sys-apps/diffutils + sys-devel/bc + )" +PDEPEND="app-misc/ca-certificates" + +S="${WORKDIR}/${MY_P}" + +MULTILIB_WRAPPED_HEADERS=( + usr/include/openssl/opensslconf.h +) + +src_prepare() { + if use bindist; then + mv "${WORKDIR}"/bindist-patches/hobble-openssl "${WORKDIR}" || die + bash "${WORKDIR}"/hobble-openssl || die + + cp -f "${WORKDIR}"/bindist-patches/ec_curve.c "${S}"/crypto/ec/ || die + cp -f "${WORKDIR}"/bindist-patches/ectest.c "${S}"/crypto/ec/ || die + + eapply "${WORKDIR}"/bindist-patches/ec-curves.patch + + # Also see the configure parts below: + # enable-ec \ + # $(use_ssl !bindist ec2m) \ + # $(use_ssl !bindist srp) \ + fi + + # keep this in sync with app-misc/c_rehash + SSL_CNF_DIR="/etc/ssl" + + # Make sure we only ever touch Makefile.org and avoid patching a file + # that gets blown away anyways by the Configure script in src_configure + rm -f Makefile + + if ! use vanilla ; then + eapply "${WORKDIR}"/patch/*.patch + fi + + eapply_user + + # disable fips in the build + # make sure the man pages are suffixed #302165 + # don't bother building man pages if they're disabled + sed -i \ + -e '/DIRS/s: fips : :g' \ + -e '/^MANSUFFIX/s:=.*:=ssl:' \ + -e '/^MAKEDEPPROG/s:=.*:=$(CC):' \ + -e $(has noman FEATURES \ + && echo '/^install:/s:install_docs::' \ + || echo '/^MANDIR=/s:=.*:='${EPREFIX}'/usr/share/man:') \ + Makefile.org \ + || die + # show the actual commands in the log + sed -i '/^SET_X/s:=.*:=set -x:' Makefile.shared + + # since we're forcing $(CC) as makedep anyway, just fix + # the conditional as always-on + # helps clang (#417795), and versioned gcc (#499818) + # this breaks build with 1.0.2p, not sure if it is needed anymore + #sed -i 's/expr.*MAKEDEPEND.*;/true;/' util/domd || die + + # quiet out unknown driver argument warnings since openssl + # doesn't have well-split CFLAGS and we're making it even worse + # and 'make depend' uses -Werror for added fun (#417795 again) + [[ ${CC} == *clang* ]] && append-flags -Qunused-arguments + + # allow openssl to be cross-compiled + cp "${FILESDIR}"/gentoo.config-1.0.2 gentoo.config || die + chmod a+rx gentoo.config || die + + append-flags -fno-strict-aliasing + append-flags $(test-flags-CC -Wa,--noexecstack) + append-cppflags -DOPENSSL_NO_BUF_FREELISTS + + sed -i '1s,^:$,#!'${EPREFIX}'/usr/bin/perl,' Configure #141906 + # The config script does stupid stuff to prompt the user. Kill it. + sed -i '/stty -icanon min 0 time 50; read waste/d' config || die + ./config --test-sanity || die "I AM NOT SANE" + + multilib_copy_sources +} + +multilib_src_configure() { + unset APPS #197996 + unset SCRIPTS #312551 + unset CROSS_COMPILE #311473 + + tc-export CC AR RANLIB RC + + # Clean out patent-or-otherwise-encumbered code + # Camellia: Royalty Free https://en.wikipedia.org/wiki/Camellia_(cipher) + # IDEA: Expired https://en.wikipedia.org/wiki/International_Data_Encryption_Algorithm + # EC: ????????? ??/??/2015 https://en.wikipedia.org/wiki/Elliptic_Curve_Cryptography + # MDC2: Expired https://en.wikipedia.org/wiki/MDC-2 + # RC5: Expired https://en.wikipedia.org/wiki/RC5 + + use_ssl() { usex $1 "enable-${2:-$1}" "no-${2:-$1}" " ${*:3}" ; } + echoit() { echo "$@" ; "$@" ; } + + local krb5=$(has_version app-crypt/mit-krb5 && echo "MIT" || echo "Heimdal") + + # See if our toolchain supports __uint128_t. If so, it's 64bit + # friendly and can use the nicely optimized code paths. #460790 + local ec_nistp_64_gcc_128 + # Disable it for now though #469976 + #if ! use bindist ; then + # echo "__uint128_t i;" > "${T}"/128.c + # if ${CC} ${CFLAGS} -c "${T}"/128.c -o /dev/null >&/dev/null ; then + # ec_nistp_64_gcc_128="enable-ec_nistp_64_gcc_128" + # fi + #fi + + # https://github.com/openssl/openssl/issues/2286 + if use ia64 ; then + replace-flags -g3 -g2 + replace-flags -ggdb3 -ggdb2 + fi + + local sslout=$(./gentoo.config) + einfo "Use configuration ${sslout:-(openssl knows best)}" + local config="Configure" + [[ -z ${sslout} ]] && config="config" + + # Fedora hobbled-EC needs 'no-ec2m', 'no-srp' + # Make sure user flags don't get added *yet* to avoid duplicated + # flags. + CFLAGS= LDFLAGS= echoit \ + ./${config} \ + ${sslout} \ + $(use cpu_flags_x86_sse2 || echo "no-sse2") \ + enable-camellia \ + enable-ec \ + $(use_ssl !bindist ec2m) \ + $(use_ssl !bindist srp) \ + ${ec_nistp_64_gcc_128} \ + enable-idea \ + enable-mdc2 \ + enable-rc5 \ + enable-tlsext \ + $(use_ssl asm) \ + $(use_ssl gmp gmp -lgmp) \ + $(use_ssl kerberos krb5 --with-krb5-flavor=${krb5}) \ + $(use_ssl rfc3779) \ + $(use_ssl sctp) \ + $(use_ssl sslv2 ssl2) \ + $(use_ssl sslv3 ssl3) \ + $(use_ssl tls-heartbeat heartbeats) \ + $(use_ssl zlib) \ + --prefix="${EPREFIX}"/usr \ + --openssldir="${EPREFIX}"${SSL_CNF_DIR} \ + --libdir=$(get_libdir) \ + shared threads \ + || die + + # Clean out hardcoded flags that openssl uses + local DEFAULT_CFLAGS=$(grep ^CFLAG= Makefile | LC_ALL=C sed \ + -e 's:^CFLAG=::' \ + -e 's:\(^\| \)-fomit-frame-pointer::g' \ + -e 's:\(^\| \)-O[^ ]*::g' \ + -e 's:\(^\| \)-march=[^ ]*::g' \ + -e 's:\(^\| \)-mcpu=[^ ]*::g' \ + -e 's:\(^\| \)-m[^ ]*::g' \ + -e 's:^ *::' \ + -e 's: *$::' \ + -e 's: \+: :g' \ + -e 's:\\:\\\\:g' + ) + + # Now insert clean default flags with user flags + sed -i \ + -e "/^CFLAG/s|=.*|=${DEFAULT_CFLAGS} ${CFLAGS}|" \ + -e "/^LDFLAGS=/s|=[[:space:]]*$|=${LDFLAGS}|" \ + Makefile || die +} + +multilib_src_compile() { + # depend is needed to use $confopts; it also doesn't matter + # that it's -j1 as the code itself serializes subdirs + emake -j1 V=1 depend + emake all + # rehash is needed to prep the certs/ dir; do this + # separately to avoid parallel build issues. + emake rehash +} + +multilib_src_test() { + emake -j1 test +} + +multilib_src_install() { + # We need to create $ED/usr on our own to avoid a race condition #665130 + if [[ ! -d "${ED}/usr" ]]; then + # We can only create this directory once + mkdir "${ED}"/usr || die + fi + + emake INSTALL_PREFIX="${D}" install +} + +multilib_src_install_all() { + # openssl installs perl version of c_rehash by default, but + # we provide a shell version via app-misc/c_rehash + rm "${ED}"/usr/bin/c_rehash || die + + local -a DOCS=( CHANGES* FAQ NEWS README doc/*.txt doc/c-indentation.el ) + einstalldocs + + use rfc3779 && dodoc engines/ccgost/README.gost + + # This is crappy in that the static archives are still built even + # when USE=static-libs. But this is due to a failing in the openssl + # build system: the static archives are built as PIC all the time. + # Only way around this would be to manually configure+compile openssl + # twice; once with shared lib support enabled and once without. + use static-libs || rm -f "${ED}"/usr/lib*/lib*.a + + # create the certs directory + dodir ${SSL_CNF_DIR}/certs + cp -RP certs/* "${ED}"${SSL_CNF_DIR}/certs/ || die + rm -r "${ED}"${SSL_CNF_DIR}/certs/{demo,expired} + + # Namespace openssl programs to prevent conflicts with other man pages + cd "${ED}"/usr/share/man + local m d s + for m in $(find . -type f | xargs grep -L '#include') ; do + d=${m%/*} ; d=${d#./} ; m=${m##*/} + [[ ${m} == openssl.1* ]] && continue + [[ -n $(find -L ${d} -type l) ]] && die "erp, broken links already!" + mv ${d}/{,ssl-}${m} + # fix up references to renamed man pages + sed -i '/^[.]SH "SEE ALSO"/,/^[.]/s:\([^(, ]*(1)\):ssl-\1:g' ${d}/ssl-${m} + ln -s ssl-${m} ${d}/openssl-${m} + # locate any symlinks that point to this man page ... we assume + # that any broken links are due to the above renaming + for s in $(find -L ${d} -type l) ; do + s=${s##*/} + rm -f ${d}/${s} + ln -s ssl-${m} ${d}/ssl-${s} + ln -s ssl-${s} ${d}/openssl-${s} + done + done + [[ -n $(find -L ${d} -type l) ]] && die "broken manpage links found :(" + + dodir /etc/sandbox.d #254521 + echo 'SANDBOX_PREDICT="/dev/crypto"' > "${ED}"/etc/sandbox.d/10openssl + + diropts -m0700 + keepdir ${SSL_CNF_DIR}/private +} + +pkg_postinst() { + ebegin "Running 'c_rehash ${EROOT}${SSL_CNF_DIR}/certs/' to rebuild hashes #333069" + c_rehash "${EROOT}${SSL_CNF_DIR}/certs" >/dev/null + eend $? +} diff --git a/dev-libs/openssl/openssl-1.0.2t.ebuild b/dev-libs/openssl/openssl-1.0.2t.ebuild deleted file mode 100644 index a778b483edc4..000000000000 --- a/dev-libs/openssl/openssl-1.0.2t.ebuild +++ /dev/null @@ -1,309 +0,0 @@ -# Copyright 1999-2019 Gentoo Authors -# Distributed under the terms of the GNU General Public License v2 - -EAPI="7" - -inherit flag-o-matic toolchain-funcs multilib multilib-minimal - -# openssl-1.0.2-patches-1.6 contain additional CVE patches -# which got fixed with this release. -# Please use 1.7 version number when rolling a new tarball! -PATCH_SET="openssl-1.0.2-patches-1.5" - -MY_P=${P/_/-} - -# This patch set is based on the following files from Fedora 25, -# see https://src.fedoraproject.org/rpms/openssl/blob/25/f/openssl.spec -# for more details: -# - hobble-openssl (SOURCE1) -# - ec_curve.c (SOURCE12) -- MODIFIED -# - ectest.c (SOURCE13) -# - openssl-1.1.1-ec-curves.patch (PATCH37) -- MODIFIED -BINDIST_PATCH_SET="openssl-1.0.2t-bindist-1.0.tar.xz" - -DESCRIPTION="full-strength general purpose cryptography library (including SSL and TLS)" -HOMEPAGE="https://www.openssl.org/" -SRC_URI="mirror://openssl/source/${MY_P}.tar.gz - bindist? ( - mirror://gentoo/${BINDIST_PATCH_SET} - https://dev.gentoo.org/~whissi/dist/openssl/${BINDIST_PATCH_SET} - ) - !vanilla? ( - mirror://gentoo/${PATCH_SET}.tar.xz - https://dev.gentoo.org/~chutzpah/dist/${PN}/${PATCH_SET}.tar.xz - https://dev.gentoo.org/~whissi/dist/${PN}/${PATCH_SET}.tar.xz - https://dev.gentoo.org/~polynomial-c/dist/${PATCH_SET}.tar.xz - )" - -LICENSE="openssl" -SLOT="0" -KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sh sparc x86 ~amd64-fbsd ~x86-fbsd ~x86-linux" -IUSE="+asm bindist gmp kerberos rfc3779 sctp cpu_flags_x86_sse2 sslv2 +sslv3 static-libs test +tls-heartbeat vanilla zlib" -RESTRICT="!bindist? ( bindist )" - -RDEPEND=">=app-misc/c_rehash-1.7-r1 - gmp? ( >=dev-libs/gmp-5.1.3-r1[static-libs(+)?,${MULTILIB_USEDEP}] ) - kerberos? ( >=app-crypt/mit-krb5-1.11.4[${MULTILIB_USEDEP}] ) - zlib? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] )" -DEPEND="${RDEPEND}" -BDEPEND=" - >=dev-lang/perl-5 - sctp? ( >=net-misc/lksctp-tools-1.0.12 ) - test? ( - sys-apps/diffutils - sys-devel/bc - )" -PDEPEND="app-misc/ca-certificates" - -S="${WORKDIR}/${MY_P}" - -MULTILIB_WRAPPED_HEADERS=( - usr/include/openssl/opensslconf.h -) - -src_prepare() { - if use bindist; then - mv "${WORKDIR}"/bindist-patches/hobble-openssl "${WORKDIR}" || die - bash "${WORKDIR}"/hobble-openssl || die - - cp -f "${WORKDIR}"/bindist-patches/ec_curve.c "${S}"/crypto/ec/ || die - cp -f "${WORKDIR}"/bindist-patches/ectest.c "${S}"/crypto/ec/ || die - - eapply "${WORKDIR}"/bindist-patches/ec-curves.patch - - # Also see the configure parts below: - # enable-ec \ - # $(use_ssl !bindist ec2m) \ - # $(use_ssl !bindist srp) \ - fi - - # keep this in sync with app-misc/c_rehash - SSL_CNF_DIR="/etc/ssl" - - # Make sure we only ever touch Makefile.org and avoid patching a file - # that gets blown away anyways by the Configure script in src_configure - rm -f Makefile - - if ! use vanilla ; then - if [[ $(declare -p PATCHES 2>/dev/null) == "declare -a"* ]] ; then - [[ ${#PATCHES[@]} -gt 0 ]] && eapply "${PATCHES[@]}" - fi - fi - - eapply_user - - # disable fips in the build - # make sure the man pages are suffixed #302165 - # don't bother building man pages if they're disabled - sed -i \ - -e '/DIRS/s: fips : :g' \ - -e '/^MANSUFFIX/s:=.*:=ssl:' \ - -e '/^MAKEDEPPROG/s:=.*:=$(CC):' \ - -e $(has noman FEATURES \ - && echo '/^install:/s:install_docs::' \ - || echo '/^MANDIR=/s:=.*:='${EPREFIX}'/usr/share/man:') \ - Makefile.org \ - || die - # show the actual commands in the log - sed -i '/^SET_X/s:=.*:=set -x:' Makefile.shared - - # since we're forcing $(CC) as makedep anyway, just fix - # the conditional as always-on - # helps clang (#417795), and versioned gcc (#499818) - # this breaks build with 1.0.2p, not sure if it is needed anymore - #sed -i 's/expr.*MAKEDEPEND.*;/true;/' util/domd || die - - # quiet out unknown driver argument warnings since openssl - # doesn't have well-split CFLAGS and we're making it even worse - # and 'make depend' uses -Werror for added fun (#417795 again) - [[ ${CC} == *clang* ]] && append-flags -Qunused-arguments - - # allow openssl to be cross-compiled - cp "${FILESDIR}"/gentoo.config-1.0.2 gentoo.config || die - chmod a+rx gentoo.config || die - - append-flags -fno-strict-aliasing - append-flags $(test-flags-CC -Wa,--noexecstack) - append-cppflags -DOPENSSL_NO_BUF_FREELISTS - - sed -i '1s,^:$,#!'${EPREFIX}'/usr/bin/perl,' Configure #141906 - # The config script does stupid stuff to prompt the user. Kill it. - sed -i '/stty -icanon min 0 time 50; read waste/d' config || die - ./config --test-sanity || die "I AM NOT SANE" - - multilib_copy_sources -} - -multilib_src_configure() { - unset APPS #197996 - unset SCRIPTS #312551 - unset CROSS_COMPILE #311473 - - tc-export CC AR RANLIB RC - - # Clean out patent-or-otherwise-encumbered code - # Camellia: Royalty Free https://en.wikipedia.org/wiki/Camellia_(cipher) - # IDEA: Expired https://en.wikipedia.org/wiki/International_Data_Encryption_Algorithm - # EC: ????????? ??/??/2015 https://en.wikipedia.org/wiki/Elliptic_Curve_Cryptography - # MDC2: Expired https://en.wikipedia.org/wiki/MDC-2 - # RC5: Expired https://en.wikipedia.org/wiki/RC5 - - use_ssl() { usex $1 "enable-${2:-$1}" "no-${2:-$1}" " ${*:3}" ; } - echoit() { echo "$@" ; "$@" ; } - - local krb5=$(has_version app-crypt/mit-krb5 && echo "MIT" || echo "Heimdal") - - # See if our toolchain supports __uint128_t. If so, it's 64bit - # friendly and can use the nicely optimized code paths. #460790 - local ec_nistp_64_gcc_128 - # Disable it for now though #469976 - #if ! use bindist ; then - # echo "__uint128_t i;" > "${T}"/128.c - # if ${CC} ${CFLAGS} -c "${T}"/128.c -o /dev/null >&/dev/null ; then - # ec_nistp_64_gcc_128="enable-ec_nistp_64_gcc_128" - # fi - #fi - - # https://github.com/openssl/openssl/issues/2286 - if use ia64 ; then - replace-flags -g3 -g2 - replace-flags -ggdb3 -ggdb2 - fi - - local sslout=$(./gentoo.config) - einfo "Use configuration ${sslout:-(openssl knows best)}" - local config="Configure" - [[ -z ${sslout} ]] && config="config" - - # Fedora hobbled-EC needs 'no-ec2m', 'no-srp' - # Make sure user flags don't get added *yet* to avoid duplicated - # flags. - CFLAGS= LDFLAGS= echoit \ - ./${config} \ - ${sslout} \ - $(use cpu_flags_x86_sse2 || echo "no-sse2") \ - enable-camellia \ - enable-ec \ - $(use_ssl !bindist ec2m) \ - $(use_ssl !bindist srp) \ - ${ec_nistp_64_gcc_128} \ - enable-idea \ - enable-mdc2 \ - enable-rc5 \ - enable-tlsext \ - $(use_ssl asm) \ - $(use_ssl gmp gmp -lgmp) \ - $(use_ssl kerberos krb5 --with-krb5-flavor=${krb5}) \ - $(use_ssl rfc3779) \ - $(use_ssl sctp) \ - $(use_ssl sslv2 ssl2) \ - $(use_ssl sslv3 ssl3) \ - $(use_ssl tls-heartbeat heartbeats) \ - $(use_ssl zlib) \ - --prefix="${EPREFIX}"/usr \ - --openssldir="${EPREFIX}"${SSL_CNF_DIR} \ - --libdir=$(get_libdir) \ - shared threads \ - || die - - # Clean out hardcoded flags that openssl uses - local DEFAULT_CFLAGS=$(grep ^CFLAG= Makefile | LC_ALL=C sed \ - -e 's:^CFLAG=::' \ - -e 's:\(^\| \)-fomit-frame-pointer::g' \ - -e 's:\(^\| \)-O[^ ]*::g' \ - -e 's:\(^\| \)-march=[^ ]*::g' \ - -e 's:\(^\| \)-mcpu=[^ ]*::g' \ - -e 's:\(^\| \)-m[^ ]*::g' \ - -e 's:^ *::' \ - -e 's: *$::' \ - -e 's: \+: :g' \ - -e 's:\\:\\\\:g' - ) - - # Now insert clean default flags with user flags - sed -i \ - -e "/^CFLAG/s|=.*|=${DEFAULT_CFLAGS} ${CFLAGS}|" \ - -e "/^LDFLAGS=/s|=[[:space:]]*$|=${LDFLAGS}|" \ - Makefile || die -} - -multilib_src_compile() { - # depend is needed to use $confopts; it also doesn't matter - # that it's -j1 as the code itself serializes subdirs - emake -j1 V=1 depend - emake all - # rehash is needed to prep the certs/ dir; do this - # separately to avoid parallel build issues. - emake rehash -} - -multilib_src_test() { - emake -j1 test -} - -multilib_src_install() { - # We need to create $ED/usr on our own to avoid a race condition #665130 - if [[ ! -d "${ED}/usr" ]]; then - # We can only create this directory once - mkdir "${ED}"/usr || die - fi - - emake INSTALL_PREFIX="${D}" install -} - -multilib_src_install_all() { - # openssl installs perl version of c_rehash by default, but - # we provide a shell version via app-misc/c_rehash - rm "${ED}"/usr/bin/c_rehash || die - - local -a DOCS=( CHANGES* FAQ NEWS README doc/*.txt doc/c-indentation.el ) - einstalldocs - - use rfc3779 && dodoc engines/ccgost/README.gost - - # This is crappy in that the static archives are still built even - # when USE=static-libs. But this is due to a failing in the openssl - # build system: the static archives are built as PIC all the time. - # Only way around this would be to manually configure+compile openssl - # twice; once with shared lib support enabled and once without. - use static-libs || rm -f "${ED}"/usr/lib*/lib*.a - - # create the certs directory - dodir ${SSL_CNF_DIR}/certs - cp -RP certs/* "${ED}"${SSL_CNF_DIR}/certs/ || die - rm -r "${ED}"${SSL_CNF_DIR}/certs/{demo,expired} - - # Namespace openssl programs to prevent conflicts with other man pages - cd "${ED}"/usr/share/man - local m d s - for m in $(find . -type f | xargs grep -L '#include') ; do - d=${m%/*} ; d=${d#./} ; m=${m##*/} - [[ ${m} == openssl.1* ]] && continue - [[ -n $(find -L ${d} -type l) ]] && die "erp, broken links already!" - mv ${d}/{,ssl-}${m} - # fix up references to renamed man pages - sed -i '/^[.]SH "SEE ALSO"/,/^[.]/s:\([^(, ]*(1)\):ssl-\1:g' ${d}/ssl-${m} - ln -s ssl-${m} ${d}/openssl-${m} - # locate any symlinks that point to this man page ... we assume - # that any broken links are due to the above renaming - for s in $(find -L ${d} -type l) ; do - s=${s##*/} - rm -f ${d}/${s} - ln -s ssl-${m} ${d}/ssl-${s} - ln -s ssl-${s} ${d}/openssl-${s} - done - done - [[ -n $(find -L ${d} -type l) ]] && die "broken manpage links found :(" - - dodir /etc/sandbox.d #254521 - echo 'SANDBOX_PREDICT="/dev/crypto"' > "${ED}"/etc/sandbox.d/10openssl - - diropts -m0700 - keepdir ${SSL_CNF_DIR}/private -} - -pkg_postinst() { - ebegin "Running 'c_rehash ${EROOT}${SSL_CNF_DIR}/certs/' to rebuild hashes #333069" - c_rehash "${EROOT}${SSL_CNF_DIR}/certs" >/dev/null - eend $? -} -- cgit v1.2.3