Diff openssl-compat-1.0.2u-r2 with a openssl-compat-1.1.1u

/usr/portage/dev-libs/openssl-compat/openssl-compat-1.1.1u.ebuild 2023-10-09 14:52:29.752368357 +0300
1
# Copyright 1999-2021 Gentoo Authors
1
# Copyright 1999-2023 Gentoo Authors
2 2
# Distributed under the terms of the GNU General Public License v2
3 3

  
4
EAPI="7"
4
EAPI=8
5 5

  
6
inherit flag-o-matic toolchain-funcs multilib-minimal
7

  
8
# openssl-1.0.2-patches-1.6 contain additional CVE patches
9
# which got fixed with this release.
10
# Please use 1.7 version number when rolling a new tarball!
11
PATCH_SET="openssl-1.0.2-patches-1.5"
6
VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/openssl.org.asc
7
inherit edo flag-o-matic toolchain-funcs multilib-minimal verify-sig
12 8

  
13 9
MY_P=openssl-${PV/_/-}
14

  
15
# This patch set is based on the following files from Fedora 25,
16
# see https://src.fedoraproject.org/rpms/openssl/blob/25/f/openssl.spec
17
# for more details:
18
# - hobble-openssl (SOURCE1)
19
# - ec_curve.c (SOURCE12) -- MODIFIED
20
# - ectest.c (SOURCE13)
21
# - openssl-1.1.1-ec-curves.patch (PATCH37) -- MODIFIED
22
BINDIST_PATCH_SET="openssl-1.0.2t-bindist-1.0.tar.xz"
23

  
24
DESCRIPTION="full-strength general purpose cryptography library (including SSL and TLS)"
10
DESCRIPTION="Full-strength general purpose cryptography library (including SSL and TLS)"
25 11
HOMEPAGE="https://www.openssl.org/"
26 12
SRC_URI="mirror://openssl/source/${MY_P}.tar.gz
27
	bindist? (
28
		mirror://gentoo/${BINDIST_PATCH_SET}
29
		https://dev.gentoo.org/~whissi/dist/openssl/${BINDIST_PATCH_SET}
30
	)
31
	!vanilla? (
32
		mirror://gentoo/${PATCH_SET}.tar.xz
33
		https://dev.gentoo.org/~chutzpah/dist/openssl/${PATCH_SET}.tar.xz
34
		https://dev.gentoo.org/~whissi/dist/openssl/${PATCH_SET}.tar.xz
35
		https://dev.gentoo.org/~polynomial-c/dist/${PATCH_SET}.tar.xz
36
	)
37
	https://dev.gentoo.org/~whissi/dist/openssl/openssl-compat-1.0.2u-versioned-symbols.patch.gz"
13
	verify-sig? ( mirror://openssl/source/${MY_P}.tar.gz.asc )"
14
S="${WORKDIR}/${MY_P}"
38 15

  
39 16
LICENSE="openssl"
40
SLOT="1.0.0"
41
KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~x86-linux"
42
IUSE="+asm bindist gmp kerberos rfc3779 sctp cpu_flags_x86_sse2 sslv2 +sslv3 static-libs test +tls-heartbeat vanilla tls-compression"
43

  
44
RESTRICT="!bindist? ( bindist )
45
	test"
17
SLOT="$(ver_cut 1-3)"
18
if [[ ${PV} != *_pre* ]] ; then
19
	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
20
fi
21
IUSE="+asm rfc3779 sctp cpu_flags_x86_sse2 sslv3 static-libs test tls-compression tls-heartbeat vanilla verify-sig weak-ssl-ciphers"
22
RESTRICT="!test? ( test )"
46 23

  
47
RDEPEND="gmp? ( >=dev-libs/gmp-5.1.3-r1[static-libs(+)?,${MULTILIB_USEDEP}] )
48
	kerberos? ( >=app-crypt/mit-krb5-1.11.4[${MULTILIB_USEDEP}] )
24
RDEPEND="
25
	!=dev-libs/openssl-1.1.1*:0
49 26
	tls-compression? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] )
50
	!=dev-libs/openssl-1.0.2*:0
51
	!dev-libs/openssl:1.0.0"
27
"
52 28
DEPEND="${RDEPEND}"
53 29
BDEPEND="
54 30
	>=dev-lang/perl-5
......
56 32
	test? (
57 33
		sys-apps/diffutils
58 34
		sys-devel/bc
59
	)"
35
		kernel_linux? ( sys-process/procps )
36
	)
37
	verify-sig? ( >=sec-keys/openpgp-keys-openssl-20230207 )"
60 38

  
61 39
# Do not install any docs
62 40
DOCS=()
63 41

  
64
S="${WORKDIR}/${MY_P}"
65

  
66
MULTILIB_WRAPPED_HEADERS=(
67
	usr/include/openssl/opensslconf.h
42
PATCHES=(
43
	# General patches which are suitable to always apply
44
	# If they're Gentoo specific, add to USE=-vanilla logic in src_prepare!
45
	"${FILESDIR}"/${PN/-compat}-1.1.0j-parallel_install_fix.patch # bug #671602
46
	"${FILESDIR}"/${PN/-compat}-1.1.1i-riscv32.patch
68 47
)
69 48

  
70
src_prepare() {
71
	mv "${WORKDIR}"/openssl-compat-1.0.2u-versioned-symbols.patch "${WORKDIR}"/patch || die
72

  
73
	if use bindist; then
74
		mv "${WORKDIR}"/bindist-patches/hobble-openssl "${WORKDIR}" || die
75
		bash "${WORKDIR}"/hobble-openssl || die
76

  
77
		cp -f "${WORKDIR}"/bindist-patches/ec_curve.c "${S}"/crypto/ec/ || die
78
		cp -f "${WORKDIR}"/bindist-patches/ectest.c "${S}"/crypto/ec/ || die
79

  
80
		eapply "${WORKDIR}"/bindist-patches/ec-curves.patch
49
pkg_setup() {
50
	[[ ${MERGE_TYPE} == binary ]] && return
81 51

  
82
		# Also see the configure parts below:
83
		# enable-ec \
84
		# $(use_ssl !bindist ec2m) \
85
		# $(use_ssl !bindist srp) \
52
	# must check in pkg_setup; sysctl doesn't work with userpriv!
53
	if use test && use sctp; then
54
		# test_ssl_new will fail with "Ensure SCTP AUTH chunks are enabled in kernel"
55
		# if sctp.auth_enable is not enabled.
56
		local sctp_auth_status=$(sysctl -n net.sctp.auth_enable 2>/dev/null)
57
		if [[ -z "${sctp_auth_status}" ]] || [[ ${sctp_auth_status} != 1 ]]; then
58
			die "FEATURES=test with USE=sctp requires net.sctp.auth_enable=1!"
59
		fi
86 60
	fi
61
}
62

  
63
src_prepare() {
64
	# Allow openssl to be cross-compiled
65
	cp "${FILESDIR}"/gentoo.config-1.0.4 gentoo.config || die
66
	chmod a+rx gentoo.config || die
87 67

  
88
	# keep this in sync with app-misc/c_rehash
68
	# Keep this in sync with app-misc/c_rehash
89 69
	SSL_CNF_DIR="/etc/ssl"
90 70

  
91 71
	# Make sure we only ever touch Makefile.org and avoid patching a file
......
93 73
	rm -f Makefile
94 74

  
95 75
	if ! use vanilla ; then
96
		eapply "${WORKDIR}"/patch/*.patch
76
		PATCHES+=(
77
			# Add patches which are Gentoo-specific customisations here
78
		)
97 79
	fi
98 80

  
99
	eapply_user
81
	default
100 82

  
101
	# disable fips in the build
102
	# make sure the man pages are suffixed #302165
103
	# don't bother building man pages if they're disabled
104
	sed -i \
105
		-e '/DIRS/s: fips : :g' \
106
		-e '/^MANSUFFIX/s:=.*:=ssl:' \
107
		-e '/^MAKEDEPPROG/s:=.*:=$(CC):' \
108
		-e $(has noman FEATURES \
109
			&& echo '/^install:/s:install_docs::' \
110
			|| echo '/^MANDIR=/s:=.*:='${EPREFIX}'/usr/share/man:') \
111
		Makefile.org \
112
		|| die
113
	# show the actual commands in the log
114
	sed -i '/^SET_X/s:=.*:=set -x:' Makefile.shared
115

  
116
	# since we're forcing $(CC) as makedep anyway, just fix
117
	# the conditional as always-on
118
	# helps clang (#417795), and versioned gcc (#499818)
119
	# this breaks build with 1.0.2p, not sure if it is needed anymore
120
	#sed -i 's/expr.*MAKEDEPEND.*;/true;/' util/domd || die
83
	if use test && use sctp && has network-sandbox ${FEATURES}; then
84
		einfo "Disabling test '80-test_ssl_new.t' which is known to fail with FEATURES=network-sandbox ..."
85
		rm test/recipes/80-test_ssl_new.t || die
86
	fi
121 87

  
122
	# quiet out unknown driver argument warnings since openssl
88
	# Quiet out unknown driver argument warnings since openssl
123 89
	# doesn't have well-split CFLAGS and we're making it even worse
124
	# and 'make depend' uses -Werror for added fun (#417795 again)
125
	[[ ${CC} == *clang* ]] && append-flags -Qunused-arguments
126

  
127
	# allow openssl to be cross-compiled
128
	cp "${FILESDIR}"/gentoo.config-1.0.2 gentoo.config || die
129
	chmod a+rx gentoo.config || die
90
	# and 'make depend' uses -Werror for added fun (bug #417795 again)
91
	tc-is-clang && append-flags -Qunused-arguments
130 92

  
93
	# We really, really need to build OpenSSL w/ strict aliasing disabled.
94
	# It's filled with violations and it *will* result in miscompiled
95
	# code. This has been in the ebuild for > 10 years but even in 2022,
96
	# it's still relevant:
97
	# - https://github.com/llvm/llvm-project/issues/55255
98
	# - https://github.com/openssl/openssl/issues/18225
99
	# - https://github.com/openssl/openssl/issues/18663#issuecomment-1181478057
100
	# Don't remove the no strict aliasing bits below!
101
	filter-flags -fstrict-aliasing
131 102
	append-flags -fno-strict-aliasing
132
	append-flags $(test-flags-CC -Wa,--noexecstack)
103

  
133 104
	append-cppflags -DOPENSSL_NO_BUF_FREELISTS
134 105

  
135
	sed -i '1s,^:$,#!'${EPREFIX}'/usr/bin/perl,' Configure #141906
106
	append-flags $(test-flags-CC -Wa,--noexecstack)
107

  
108
	# Remove test target when FEATURES=test isn't set
109
	if ! use test ; then
110
		sed \
111
			-e '/^$config{dirs}/s@ "test",@@' \
112
			-i Configure || die
113
	fi
114

  
115
	if use prefix && [[ ${CHOST} == *-solaris* ]] ; then
116
		# use GNU ld full option, not to confuse it on Solaris
117
		sed -i \
118
			-e 's/-Wl,-M,/-Wl,--version-script=/' \
119
			-e 's/-Wl,-h,/-Wl,--soname=/' \
120
			Configurations/10-main.conf || die
121

  
122
		# fix building on Solaris 10
123
		# https://github.com/openssl/openssl/issues/6333
124
		sed -i \
125
			-e 's/-lsocket -lnsl -ldl/-lsocket -lnsl -ldl -lrt/' \
126
			Configurations/10-main.conf || die
127
	fi
128

  
129
	local sslout=$(./gentoo.config)
130
	einfo "Using configuration: ${sslout:-(openssl knows best)}"
131
	local config="perl Configure"
132
	[[ -z ${sslout} ]] && config="sh config -v"
133

  
136 134
	# The config script does stupid stuff to prompt the user.  Kill it.
137 135
	sed -i '/stty -icanon min 0 time 50; read waste/d' config || die
138
	./config --test-sanity || die "I AM NOT SANE"
136
	edo ${config} ${sslout} --test-sanity
139 137

  
140 138
	multilib_copy_sources
141 139
}
142 140

  
143 141
multilib_src_configure() {
144
	unset APPS #197996
145
	unset SCRIPTS #312551
146
	unset CROSS_COMPILE #311473
147

  
148
	tc-export CC AR RANLIB RC
149

  
150
	# Clean out patent-or-otherwise-encumbered code
151
	# Camellia: Royalty Free            https://en.wikipedia.org/wiki/Camellia_(cipher)
152
	# IDEA:     Expired                 https://en.wikipedia.org/wiki/International_Data_Encryption_Algorithm
153
	# EC:       ????????? ??/??/2015    https://en.wikipedia.org/wiki/Elliptic_Curve_Cryptography
154
	# MDC2:     Expired                 https://en.wikipedia.org/wiki/MDC-2
155
	# RC5:      Expired                 https://en.wikipedia.org/wiki/RC5
142
	# bug #197996
143
	unset APPS
144
	# bug #312551
145
	unset SCRIPTS
146
	# bug #311473
147
	unset CROSS_COMPILE
148

  
149
	tc-export AR CC CXX RANLIB RC
156 150

  
157 151
	use_ssl() { usex $1 "enable-${2:-$1}" "no-${2:-$1}" " ${*:3}" ; }
158
	echoit() { echo "$@" ; "$@" ; }
159 152

  
160 153
	local krb5=$(has_version app-crypt/mit-krb5 && echo "MIT" || echo "Heimdal")
161 154

  
162 155
	# See if our toolchain supports __uint128_t.  If so, it's 64bit
163
	# friendly and can use the nicely optimized code paths. #460790
164
	local ec_nistp_64_gcc_128
165
	# Disable it for now though #469976
166
	#if ! use bindist ; then
167
	#	echo "__uint128_t i;" > "${T}"/128.c
168
	#	if ${CC} ${CFLAGS} -c "${T}"/128.c -o /dev/null >&/dev/null ; then
169
	#		ec_nistp_64_gcc_128="enable-ec_nistp_64_gcc_128"
170
	#	fi
156
	# friendly and can use the nicely optimized code paths, bug #460790.
157
	#local ec_nistp_64_gcc_128
158
	#
159
	# Disable it for now though (bug #469976)
160
	# Do NOT re-enable without substantial discussion first!
161
	#
162
	#echo "__uint128_t i;" > "${T}"/128.c
163
	#if ${CC} ${CFLAGS} -c "${T}"/128.c -o /dev/null >&/dev/null ; then
164
	#	ec_nistp_64_gcc_128="enable-ec_nistp_64_gcc_128"
171 165
	#fi
172 166

  
173
	# https://github.com/openssl/openssl/issues/2286
174
	if use ia64 ; then
175
		replace-flags -g3 -g2
176
		replace-flags -ggdb3 -ggdb2
177
	fi
178

  
179 167
	local sslout=$(./gentoo.config)
180 168
	einfo "Use configuration ${sslout:-(openssl knows best)}"
181
	local config="Configure"
182
	[[ -z ${sslout} ]] && config="config"
169
	local config="perl Configure"
170
	[[ -z ${sslout} ]] && config="sh config -v"
183 171

  
184
	# Fedora hobbled-EC needs 'no-ec2m', 'no-srp'
172
	# "disable-deprecated" option breaks too many consumers.
173
	# Don't set it without thorough revdeps testing.
185 174
	# Make sure user flags don't get added *yet* to avoid duplicated
186 175
	# flags.
187
	CFLAGS= LDFLAGS= echoit \
188
	./${config} \
189
		${sslout} \
190
		$(use cpu_flags_x86_sse2 || echo "no-sse2") \
191
		enable-camellia \
192
		enable-ec \
193
		$(use_ssl !bindist ec2m) \
194
		$(use_ssl !bindist srp) \
195
		${ec_nistp_64_gcc_128} \
196
		enable-idea \
197
		enable-mdc2 \
198
		enable-rc5 \
199
		enable-tlsext \
200
		$(use_ssl asm) \
201
		$(use_ssl gmp gmp -lgmp) \
202
		$(use_ssl kerberos krb5 --with-krb5-flavor=${krb5}) \
203
		$(use_ssl rfc3779) \
204
		$(use_ssl sctp) \
205
		$(use_ssl sslv2 ssl2) \
206
		$(use_ssl sslv3 ssl3) \
207
		$(use_ssl tls-heartbeat heartbeats) \
208
		$(use_ssl tls-compression zlib) \
209
		--prefix="${EPREFIX}"/usr \
210
		--openssldir="${EPREFIX}"${SSL_CNF_DIR} \
211
		--libdir=$(get_libdir) \
212
		shared threads \
213
		|| die
214

  
215
	# Clean out hardcoded flags that openssl uses
216
	local DEFAULT_CFLAGS=$(grep ^CFLAG= Makefile | LC_ALL=C sed \
217
		-e 's:^CFLAG=::' \
218
		-e 's:\(^\| \)-fomit-frame-pointer::g' \
219
		-e 's:\(^\| \)-O[^ ]*::g' \
220
		-e 's:\(^\| \)-march=[^ ]*::g' \
221
		-e 's:\(^\| \)-mcpu=[^ ]*::g' \
222
		-e 's:\(^\| \)-m[^ ]*::g' \
223
		-e 's:^ *::' \
224
		-e 's: *$::' \
225
		-e 's: \+: :g' \
226
		-e 's:\\:\\\\:g'
176
	local myeconfargs=(
177
		${sslout}
178

  
179
		$(use cpu_flags_x86_sse2 || echo "no-sse2")
180
		enable-camellia
181
		enable-ec
182
		enable-ec2m
183
		enable-sm2
184
		enable-srp
185
		$(use elibc_musl && echo "no-async")
186
		${ec_nistp_64_gcc_128}
187
		enable-idea
188
		enable-mdc2
189
		enable-rc5
190
		$(use_ssl sslv3 ssl3)
191
		$(use_ssl sslv3 ssl3-method)
192
		$(use_ssl asm)
193
		$(use_ssl rfc3779)
194
		$(use_ssl sctp)
195
		$(use test || echo "no-tests")
196
		$(use_ssl tls-compression zlib)
197
		$(use_ssl tls-heartbeat heartbeats)
198
		$(use_ssl weak-ssl-ciphers)
199

  
200
		--prefix="${EPREFIX}"/usr
201
		--openssldir="${EPREFIX}"${SSL_CNF_DIR}
202
		--libdir=$(get_libdir)
203

  
204
		shared
205
		threads
227 206
	)
228 207

  
229
	# Now insert clean default flags with user flags
230
	sed -i \
231
		-e "/^CFLAG/s|=.*|=${DEFAULT_CFLAGS} ${CFLAGS}|" \
232
		-e "/^LDFLAGS=/s|=[[:space:]]*$|=${LDFLAGS}|" \
233
		Makefile || die
208
	edo ${config} "${myeconfargs[@]}"
234 209
}
235 210

  
236 211
multilib_src_compile() {
237
	# depend is needed to use $confopts; it also doesn't matter
238
	# that it's -j1 as the code itself serializes subdirs
239
	emake -j1 V=1 depend
240
	emake build_libs
212
	emake all
241 213
}
242 214

  
243 215
multilib_src_test() {
......
245 217
}
246 218

  
247 219
multilib_src_install() {
248
	dolib.so lib{crypto,ssl}.so.${SLOT}
220
	dolib.so lib{crypto,ssl}.so.$(ver_cut 1-2 "${SLOT}")
249 221
}
Thank you!