From 5f0030fd1370c4d03dbb2e0d3086f5e618a33749 Mon Sep 17 00:00:00 2001 From: V3n3RiX Date: Sun, 28 Apr 2024 23:59:44 +0100 Subject: gentoo auto-resync : 28:04:2024 - 23:59:44 --- net-libs/gnutls/Manifest | 2 + ...3.8.5-fix-rsaes-pkcs1-systemd-wide-config.patch | 261 +++++++++++++++++++++ net-libs/gnutls/gnutls-3.8.5-r1.ebuild | 155 ++++++++++++ 3 files changed, 418 insertions(+) create mode 100644 net-libs/gnutls/files/gnutls-3.8.5-fix-rsaes-pkcs1-systemd-wide-config.patch create mode 100644 net-libs/gnutls/gnutls-3.8.5-r1.ebuild (limited to 'net-libs/gnutls') diff --git a/net-libs/gnutls/Manifest b/net-libs/gnutls/Manifest index 47998de6a0d6..03f7caa38ad2 100644 --- a/net-libs/gnutls/Manifest +++ b/net-libs/gnutls/Manifest @@ -1,3 +1,4 @@ +AUX gnutls-3.8.5-fix-rsaes-pkcs1-systemd-wide-config.patch 7361 BLAKE2B ca74ef7ca3070f2b44b6958547595acaac0c3aa783a6a67897ad9536f32f27838df6538bbe2fa5cb6430279c81373dd9bec9c7828db5d88492f8f24b679be045 SHA512 0319255a2427b993a6191b42cb034876909c6ff3cf5132cda60bc4bdff6f3fb1db191c6394beb9457d0abd99e375505c2c572f74a2ca263996eaedc7e186d318 DIST gnutls-3.7.8.tar.xz 6029220 BLAKE2B 0a21e63c7cb0ba4eeff23593c7282e0b4d704fa2d2a1cd5289998fd04b58ea36fc343f872225ad05478e278b1cdebbcd0fd376459abcb58547f8fa1488485530 SHA512 4199bcf7c9e3aab2f52266aadceefc563dfe2d938d0ea1f3ec3be95d66f4a8c8e5494d3a800c03dd02ad386dec1738bd63e1fe0d8b394a2ccfc7d6c6a0cc9359 DIST gnutls-3.7.8.tar.xz.sig 1250 BLAKE2B 66c6a335c3b2290a4e44ffa6ae715ad71d2bcd7df485c1d2d9490985d9dcd445768d6eb021ad3a61614431183c6652254c63ebd8abd0f0a03d3164a6193b6192 SHA512 cecf9843e8683a278d065b663dc98ac2b5fcad1905ee25333038c93c2289b518c974629367e77e66552ac1c9d122d551616edba35cb0c4204202ec676f1a2db7 DIST gnutls-3.7.9.tar.xz 6377212 BLAKE2B c8263381132b0c96f23a580823cfaf57112056876e5f2cc21aec4eeddec641b0c01fa02ff9493ea686f49fd917190b06f89379eb448a510cf4d50fe3a0742851 SHA512 56ccbab5f214f9e3cf10a43dd90dedc1e10a38d08b8359a4305dc05c59ddb4a1d3680b282077b6446605c31675a4261cd0579c2c0d976e0b2ced02e6dba224c1 @@ -12,5 +13,6 @@ EBUILD gnutls-3.7.8.ebuild 4510 BLAKE2B 071712c5a26ac5208b8c3b76e8e30cd697bfe46c EBUILD gnutls-3.7.9.ebuild 4518 BLAKE2B 1677d20875850c62130350dcbc92b61f51c6aa5de64d16179944caad10616859f082c11bf327d57f836b7cc24e3803821b61e2df4fc2c17862d35a26a033aaeb SHA512 e30ea13f425d0a6eba30b1235e3a6240e9f0481df318c7f0b6699088bb8c98c07e146a891c8ccd8efe0cc0b8f70a8456d84e62f8db118ad8ae380e679769259b EBUILD gnutls-3.8.0.ebuild 4569 BLAKE2B 4b3dbdec9ab063ef44ec516c91b3777028d627e89260885a033756be8e0edcecd7c0e0c4f27f9ea8c2e2cf929b6f729c62bc265b64a8ed9ed7785bfe442ba274 SHA512 81d3331058c8dc1a121d2b618462ad07797b5b3f118842e6fb634b1d7bef27d1a8657ca04319b16b709989987b91cd4de8e582516840abfd3c74bd60f357e0cb EBUILD gnutls-3.8.3.ebuild 4683 BLAKE2B b19f9797b93c00e98106ece1395fcb0625ae071fbcdc31efc539f081c2770f5e61e0288bbddeb5e2b41fbfaddbe4b27ca7e68048def487d5397e80a8af52cd96 SHA512 f533871504131a7bb76fac115460b01a564c52ae72c9ed0fbe1b4a2e1388e7512f8144891adfeea4853ed55a13137d05ed7fef8516c8933a790847ac320319ab +EBUILD gnutls-3.8.5-r1.ebuild 4831 BLAKE2B 318f57de485ee58e3b598c095d686fcef2918472c6c18b05349481631a3d35c19bf8b9be91ca825b6fcd9eb244bdc3435ce53361ae7c50718243ed2d9970bca5 SHA512 f4cc2ce252c8b13cc5759b2ba5c83599cd327ed7fbc50791fe14d2a7abb51c4fdbb3cd70c914c08761e734e255c44c889f60b451845db53cb6b6401c6066dd59 EBUILD gnutls-3.8.5.ebuild 4683 BLAKE2B dfd03e9f80c1c9142ba16145414d4c9204fc79a5d5b3e956a8042ac93f7aa12e1207ae031e6b3e4df17fe309367a96eb9b2fed94eecca8c8da90137cc2d39856 SHA512 8e2aad44f15ef216cc2a641bb955c878dcd7eea71209db38cf7df6381a1b9d1647b6e724a13d3fa2f997ac3d28ad111e2fb49548dcba832a3e3be0d2e46949d7 MISC metadata.xml 1141 BLAKE2B 70657c924a576930a14064d750074cce08bfe3f99970987aca13f9f1dc49024d8a99de54336b5e51f7cee4fa944045a323cf8384e0363189c4ee60962b185a42 SHA512 467370ffa9762eff75e73ffcb959c7bbe65528b33256c871b702be90c7b6f06e6b60a0a358c81dadba43388ec803a9dabe09a6f7cb3616ee3c65eaa6416140ee diff --git a/net-libs/gnutls/files/gnutls-3.8.5-fix-rsaes-pkcs1-systemd-wide-config.patch b/net-libs/gnutls/files/gnutls-3.8.5-fix-rsaes-pkcs1-systemd-wide-config.patch new file mode 100644 index 000000000000..6905f793ab4f --- /dev/null +++ b/net-libs/gnutls/files/gnutls-3.8.5-fix-rsaes-pkcs1-systemd-wide-config.patch @@ -0,0 +1,261 @@ +https://bugs.gentoo.org/930752 +https://bugs.gentoo.org/930529 +https://gitlab.com/gnutls/gnutls/-/issues/1540 +https://gitlab.com/gnutls/gnutls/-/merge_requests/1830 +https://gitlab.com/gnutls/gnutls/-/commit/2d73d945c4b1dfcf8d2328c4d23187d62ffaab2d + +From 2d73d945c4b1dfcf8d2328c4d23187d62ffaab2d Mon Sep 17 00:00:00 2001 +From: Zoltan Fridrich +Date: Wed, 10 Apr 2024 12:51:33 +0200 +Subject: [PATCH] Fix RSAES-PKCS1-v1_5 system-wide configuration + +Signed-off-by: Zoltan Fridrich +--- a/lib/priority.c ++++ b/lib/priority.c +@@ -1018,6 +1018,12 @@ struct cfg { + bool force_ext_master_secret_set; + }; + ++static inline void cfg_init(struct cfg *cfg) ++{ ++ memset(cfg, 0, sizeof(*cfg)); ++ cfg->allow_rsa_pkcs1_encrypt = true; ++} ++ + static inline void cfg_deinit(struct cfg *cfg) + { + if (cfg->priority_strings) { +@@ -1095,6 +1101,12 @@ struct ini_ctx { + size_t curves_size; + }; + ++static inline void ini_ctx_init(struct ini_ctx *ctx) ++{ ++ memset(ctx, 0, sizeof(*ctx)); ++ cfg_init(&ctx->cfg); ++} ++ + static inline void ini_ctx_deinit(struct ini_ctx *ctx) + { + cfg_deinit(&ctx->cfg); +@@ -1423,9 +1435,6 @@ static inline int cfg_apply(struct cfg *cfg, struct ini_ctx *ctx) + _gnutls_default_priority_string = cfg->default_priority_string; + } + +- /* enable RSA-PKCS1-V1_5 by default */ +- cfg->allow_rsa_pkcs1_encrypt = true; +- + if (cfg->allowlisting) { + /* also updates `flags` of global `hash_algorithms[]` */ + ret = cfg_hashes_set_array(cfg, ctx->hashes, ctx->hashes_size); +@@ -2217,22 +2226,73 @@ update_system_wide_priority_string(void) + return 0; + } + ++/* Returns false on parse error, otherwise true. ++ * The system_wide_config must be locked for writing. ++ */ ++static inline bool load_system_priority_file(void) ++{ ++ int err; ++ FILE *fp; ++ struct ini_ctx ctx; ++ ++ cfg_init(&system_wide_config); ++ ++ fp = fopen(system_priority_file, "re"); ++ if (fp == NULL) { ++ _gnutls_debug_log("cfg: unable to open: %s: %d\n", ++ system_priority_file, errno); ++ return true; ++ } ++ ++ /* Parsing the configuration file needs to be done in 2 phases: ++ * first parsing the [global] section ++ * and then the other sections, ++ * because the [global] section modifies the parsing behavior. ++ */ ++ ini_ctx_init(&ctx); ++ err = ini_parse_file(fp, global_ini_handler, &ctx); ++ if (!err) { ++ if (fseek(fp, 0L, SEEK_SET) < 0) { ++ _gnutls_debug_log("cfg: unable to rewind: %s\n", ++ system_priority_file); ++ if (fail_on_invalid_config) ++ exit(1); ++ } ++ err = ini_parse_file(fp, cfg_ini_handler, &ctx); ++ } ++ fclose(fp); ++ if (err) { ++ ini_ctx_deinit(&ctx); ++ _gnutls_debug_log("cfg: unable to parse: %s: %d\n", ++ system_priority_file, err); ++ return false; ++ } ++ cfg_apply(&system_wide_config, &ctx); ++ ini_ctx_deinit(&ctx); ++ return true; ++} ++ + static int _gnutls_update_system_priorities(bool defer_system_wide) + { +- int ret, err = 0; ++ int ret; ++ bool config_parse_error = false; + struct stat sb; +- FILE *fp; + gnutls_buffer_st buf; +- struct ini_ctx ctx; + + ret = gnutls_rwlock_rdlock(&system_wide_config_rwlock); +- if (ret < 0) { ++ if (ret < 0) + return gnutls_assert_val(ret); +- } + + if (stat(system_priority_file, &sb) < 0) { + _gnutls_debug_log("cfg: unable to access: %s: %d\n", + system_priority_file, errno); ++ ++ (void)gnutls_rwlock_unlock(&system_wide_config_rwlock); ++ ret = gnutls_rwlock_wrlock(&system_wide_config_rwlock); ++ if (ret < 0) ++ goto out; ++ /* If system-wide config is unavailable, apply the defaults */ ++ cfg_init(&system_wide_config); + goto out; + } + +@@ -2240,63 +2300,27 @@ static int _gnutls_update_system_priorities(bool defer_system_wide) + system_priority_last_mod == sb.st_mtime) { + _gnutls_debug_log("cfg: system priority %s has not changed\n", + system_priority_file); +- if (system_wide_config.priority_string) { ++ if (system_wide_config.priority_string) + goto out; /* nothing to do */ +- } + } + + (void)gnutls_rwlock_unlock(&system_wide_config_rwlock); + + ret = gnutls_rwlock_wrlock(&system_wide_config_rwlock); +- if (ret < 0) { ++ if (ret < 0) + return gnutls_assert_val(ret); +- } + + /* Another thread could have successfully re-read system-wide config, + * skip re-reading if the mtime it has used is exactly the same. + */ +- if (system_priority_file_loaded) { ++ if (system_priority_file_loaded) + system_priority_file_loaded = + (system_priority_last_mod == sb.st_mtime); +- } + + if (!system_priority_file_loaded) { +- _name_val_array_clear(&system_wide_config.priority_strings); +- +- gnutls_free(system_wide_config.priority_string); +- system_wide_config.priority_string = NULL; +- +- fp = fopen(system_priority_file, "re"); +- if (fp == NULL) { +- _gnutls_debug_log("cfg: unable to open: %s: %d\n", +- system_priority_file, errno); ++ config_parse_error = !load_system_priority_file(); ++ if (config_parse_error) + goto out; +- } +- /* Parsing the configuration file needs to be done in 2 phases: +- * first parsing the [global] section +- * and then the other sections, +- * because the [global] section modifies the parsing behavior. +- */ +- memset(&ctx, 0, sizeof(ctx)); +- err = ini_parse_file(fp, global_ini_handler, &ctx); +- if (!err) { +- if (fseek(fp, 0L, SEEK_SET) < 0) { +- _gnutls_debug_log("cfg: unable to rewind: %s\n", +- system_priority_file); +- if (fail_on_invalid_config) +- exit(1); +- } +- err = ini_parse_file(fp, cfg_ini_handler, &ctx); +- } +- fclose(fp); +- if (err) { +- ini_ctx_deinit(&ctx); +- _gnutls_debug_log("cfg: unable to parse: %s: %d\n", +- system_priority_file, err); +- goto out; +- } +- cfg_apply(&system_wide_config, &ctx); +- ini_ctx_deinit(&ctx); + _gnutls_debug_log("cfg: loaded system config %s mtime %lld\n", + system_priority_file, + (unsigned long long)sb.st_mtime); +@@ -2332,9 +2356,8 @@ static int _gnutls_update_system_priorities(bool defer_system_wide) + out: + (void)gnutls_rwlock_unlock(&system_wide_config_rwlock); + +- if (err && fail_on_invalid_config) { ++ if (config_parse_error && fail_on_invalid_config) + exit(1); +- } + + return ret; + } +--- a/tests/system-override-allow-rsa-pkcs1-encrypt.sh ++++ b/tests/system-override-allow-rsa-pkcs1-encrypt.sh +@@ -19,9 +19,8 @@ + # You should have received a copy of the GNU Lesser General Public License + # along with this program. If not, see + +-: ${srcdir=.} +-TEST=${srcdir}/rsaes-pkcs1-v1_5 +-CONF=${srcdir}/config.$$.tmp ++TEST=${builddir}/rsaes-pkcs1-v1_5 ++CONF=config.$$.tmp + export GNUTLS_SYSTEM_PRIORITY_FILE=${CONF} + export GNUTLS_SYSTEM_PRIORITY_FAIL_ON_INVALID=1 + +@@ -38,15 +37,33 @@ cat <<_EOF_ > ${CONF} + allow-rsa-pkcs1-encrypt = true + _EOF_ + +-${TEST} && fail "RSAES-PKCS1-v1_5 expected to succeed" ++${TEST} ++if [ $? != 0 ]; then ++ echo "${TEST} expected to succeed" ++ exit 1 ++fi ++echo "RSAES-PKCS1-v1_5 successfully enabled" + + cat <<_EOF_ > ${CONF} + [overrides] + allow-rsa-pkcs1-encrypt = false + _EOF_ + +-${TEST} || fail "RSAES-PKCS1-v1_5 expected to fail" ++${TEST} ++if [ $? = 0 ]; then ++ echo "${TEST} expected to fail" ++ exit 1 ++fi ++echo "RSAES-PKCS1-v1_5 successfully disabled" + + unset GNUTLS_SYSTEM_PRIORITY_FILE + unset GNUTLS_SYSTEM_PRIORITY_FAIL_ON_INVALID ++ ++${TEST} ++if [ $? != 0 ]; then ++ echo "${TEST} expected to succeed by default" ++ exit 1 ++fi ++echo "RSAES-PKCS1-v1_5 successfully enabled by default" ++ + exit 0 +-- +GitLab diff --git a/net-libs/gnutls/gnutls-3.8.5-r1.ebuild b/net-libs/gnutls/gnutls-3.8.5-r1.ebuild new file mode 100644 index 000000000000..24fba955fe8e --- /dev/null +++ b/net-libs/gnutls/gnutls-3.8.5-r1.ebuild @@ -0,0 +1,155 @@ +# Copyright 1999-2024 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=8 + +VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gnutls.asc +inherit libtool multilib-minimal verify-sig + +DESCRIPTION="A secure communications library implementing the SSL, TLS and DTLS protocols" +HOMEPAGE="https://www.gnutls.org/" +SRC_URI="mirror://gnupg/gnutls/v$(ver_cut 1-2)/${P}.tar.xz" +SRC_URI+=" verify-sig? ( mirror://gnupg/gnutls/v$(ver_cut 1-2)/${P}.tar.xz.sig )" + +LICENSE="GPL-3 LGPL-2.1+" +# As of 3.8.0, the C++ library is header-only, but we won't drop the subslot +# component for it until libgnutls.so breaks ABI, to avoid pointless rebuilds. +# Subslot format: +# . +SLOT="0/30.30" +KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris" +IUSE="brotli +cxx dane doc examples +idn nls +openssl pkcs11 seccomp sslv2 sslv3 static-libs test test-full +tls-heartbeat tools zlib zstd" +REQUIRED_USE="test-full? ( cxx dane doc examples idn nls openssl pkcs11 seccomp tls-heartbeat tools )" +RESTRICT="!test? ( test )" + +RDEPEND=" + >=dev-libs/libtasn1-4.9:=[${MULTILIB_USEDEP}] + dev-libs/libunistring:=[${MULTILIB_USEDEP}] + >=dev-libs/nettle-3.6:=[gmp,${MULTILIB_USEDEP}] + >=dev-libs/gmp-5.1.3-r1:=[${MULTILIB_USEDEP}] + brotli? ( >=app-arch/brotli-1.0.0:=[${MULTILIB_USEDEP}] ) + dane? ( >=net-dns/unbound-1.4.20:=[${MULTILIB_USEDEP}] ) + nls? ( >=virtual/libintl-0-r1:=[${MULTILIB_USEDEP}] ) + pkcs11? ( >=app-crypt/p11-kit-0.23.1[${MULTILIB_USEDEP}] ) + idn? ( >=net-dns/libidn2-0.16-r1:=[${MULTILIB_USEDEP}] ) + zlib? ( sys-libs/zlib[${MULTILIB_USEDEP}] ) + zstd? ( >=app-arch/zstd-1.3.0:=[${MULTILIB_USEDEP}] ) +" +DEPEND=" + ${RDEPEND} + test? ( + seccomp? ( sys-libs/libseccomp ) + ) +" +BDEPEND=" + dev-build/gtk-doc-am + >=virtual/pkgconfig-0-r1 + doc? ( dev-util/gtk-doc ) + nls? ( sys-devel/gettext ) + test-full? ( + app-crypt/dieharder + || ( sys-libs/libfaketime >=app-misc/datefudge-1.22 ) + dev-libs/softhsm:2[-bindist(-)] + net-dialup/ppp + net-misc/socat + ) + verify-sig? ( >=sec-keys/openpgp-keys-gnutls-20240415 ) +" + +DOCS=( README.md doc/certtool.cfg ) + +HTML_DOCS=() + +QA_CONFIG_IMPL_DECL_SKIP=( + # gnulib FPs + MIN + alignof + static_assert +) + +PATCHES=( + # Should no longer be needed for the next release + # bug #930529 + "${FILESDIR}"/${PN}-3.8.5-fix-rsaes-pkcs1-systemd-wide-config.patch +) + +src_prepare() { + default + + # bug #520818 + export TZ=UTC + + use doc && HTML_DOCS+=( doc/gnutls.html ) + + # don't try to use system certificate store on macOS, it is + # confusingly ignoring our ca-certificates and more importantly + # fails to compile in certain configurations + sed -i -e 's/__APPLE__/__NO_APPLE__/' lib/system/certs.c || die + + # Use sane .so versioning on FreeBSD. + elibtoolize +} + +multilib_src_configure() { + LINGUAS="${LINGUAS//en/en@boldquot en@quot}" + + local libconf=() + + # TPM needs to be tested before being enabled + # Note that this may add a libltdl dep when enabled. Check configure.ac. + libconf+=( + --without-tpm + --without-tpm2 + ) + + # hardware-accel is disabled on OSX because the asm files force + # GNU-stack (as doesn't support that) and when that's removed ld + # complains about duplicate symbols + [[ ${CHOST} == *-darwin* ]] && libconf+=( --disable-hardware-acceleration ) + + # -fanalyzer substantially slows down the build and isn't useful for + # us. It's useful for upstream as it's static analysis, but it's not + # useful when just getting something built. + export gl_cv_warn_c__fanalyzer=no + + local myeconfargs=( + --disable-valgrind-tests + $(multilib_native_enable manpages) + $(multilib_native_use_enable doc gtk-doc) + $(multilib_native_use_enable doc) + $(multilib_native_use_enable seccomp seccomp-tests) + $(multilib_native_use_enable test tests) + $(multilib_native_use_enable test-full full-test-suite) + $(multilib_native_use_enable tools) + $(use_enable cxx) + $(use_enable dane libdane) + $(use_enable nls) + $(use_enable openssl openssl-compatibility) + $(use_enable sslv2 ssl2-support) + $(use_enable sslv3 ssl3-support) + $(use_enable static-libs static) + $(use_enable tls-heartbeat heartbeat-support) + $(use_with brotli) + $(use_with idn) + $(use_with pkcs11 p11-kit) + $(use_with zlib) + $(use_with zstd) + --disable-rpath + --with-default-trust-store-file="${EPREFIX}"/etc/ssl/certs/ca-certificates.crt + --with-unbound-root-key-file="${EPREFIX}"/etc/dnssec/root-anchors.txt + --without-included-libtasn1 + $("${S}/configure" --help | grep -o -- '--without-.*-prefix') + ) + + ECONF_SOURCE="${S}" econf "${libconf[@]}" "${myeconfargs[@]}" +} + +multilib_src_install_all() { + einstalldocs + find "${ED}" -type f -name '*.la' -delete || die + + if use examples; then + docinto examples + dodoc doc/examples/*.c + fi +} -- cgit v1.2.3