1 |
|
# Copyright 1999-2021 Gentoo Authors
|
|
1 |
# Copyright 1999-2023 Gentoo Authors
|
2 |
2 |
# Distributed under the terms of the GNU General Public License v2
|
3 |
3 |
|
4 |
|
EAPI="7"
|
|
4 |
EAPI=8
|
5 |
5 |
|
6 |
|
inherit flag-o-matic toolchain-funcs multilib-minimal
|
7 |
|
|
8 |
|
# openssl-1.0.2-patches-1.6 contain additional CVE patches
|
9 |
|
# which got fixed with this release.
|
10 |
|
# Please use 1.7 version number when rolling a new tarball!
|
11 |
|
PATCH_SET="openssl-1.0.2-patches-1.5"
|
|
6 |
VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/openssl.org.asc
|
|
7 |
inherit edo flag-o-matic toolchain-funcs multilib-minimal verify-sig
|
12 |
8 |
|
13 |
9 |
MY_P=openssl-${PV/_/-}
|
14 |
|
|
15 |
|
# This patch set is based on the following files from Fedora 25,
|
16 |
|
# see https://src.fedoraproject.org/rpms/openssl/blob/25/f/openssl.spec
|
17 |
|
# for more details:
|
18 |
|
# - hobble-openssl (SOURCE1)
|
19 |
|
# - ec_curve.c (SOURCE12) -- MODIFIED
|
20 |
|
# - ectest.c (SOURCE13)
|
21 |
|
# - openssl-1.1.1-ec-curves.patch (PATCH37) -- MODIFIED
|
22 |
|
BINDIST_PATCH_SET="openssl-1.0.2t-bindist-1.0.tar.xz"
|
23 |
|
|
24 |
|
DESCRIPTION="full-strength general purpose cryptography library (including SSL and TLS)"
|
|
10 |
DESCRIPTION="Full-strength general purpose cryptography library (including SSL and TLS)"
|
25 |
11 |
HOMEPAGE="https://www.openssl.org/"
|
26 |
12 |
SRC_URI="mirror://openssl/source/${MY_P}.tar.gz
|
27 |
|
bindist? (
|
28 |
|
mirror://gentoo/${BINDIST_PATCH_SET}
|
29 |
|
https://dev.gentoo.org/~whissi/dist/openssl/${BINDIST_PATCH_SET}
|
30 |
|
)
|
31 |
|
!vanilla? (
|
32 |
|
mirror://gentoo/${PATCH_SET}.tar.xz
|
33 |
|
https://dev.gentoo.org/~chutzpah/dist/openssl/${PATCH_SET}.tar.xz
|
34 |
|
https://dev.gentoo.org/~whissi/dist/openssl/${PATCH_SET}.tar.xz
|
35 |
|
https://dev.gentoo.org/~polynomial-c/dist/${PATCH_SET}.tar.xz
|
36 |
|
)
|
37 |
|
https://dev.gentoo.org/~whissi/dist/openssl/openssl-compat-1.0.2u-versioned-symbols.patch.gz"
|
|
13 |
verify-sig? ( mirror://openssl/source/${MY_P}.tar.gz.asc )"
|
|
14 |
S="${WORKDIR}/${MY_P}"
|
38 |
15 |
|
39 |
16 |
LICENSE="openssl"
|
40 |
|
SLOT="1.0.0"
|
41 |
|
KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~x86-linux"
|
42 |
|
IUSE="+asm bindist gmp kerberos rfc3779 sctp cpu_flags_x86_sse2 sslv2 +sslv3 static-libs test +tls-heartbeat vanilla tls-compression"
|
43 |
|
|
44 |
|
RESTRICT="!bindist? ( bindist )
|
45 |
|
test"
|
|
17 |
SLOT="$(ver_cut 1-3)"
|
|
18 |
if [[ ${PV} != *_pre* ]] ; then
|
|
19 |
KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
|
|
20 |
fi
|
|
21 |
IUSE="+asm rfc3779 sctp cpu_flags_x86_sse2 sslv3 static-libs test tls-compression tls-heartbeat vanilla verify-sig weak-ssl-ciphers"
|
|
22 |
RESTRICT="!test? ( test )"
|
46 |
23 |
|
47 |
|
RDEPEND="gmp? ( >=dev-libs/gmp-5.1.3-r1[static-libs(+)?,${MULTILIB_USEDEP}] )
|
48 |
|
kerberos? ( >=app-crypt/mit-krb5-1.11.4[${MULTILIB_USEDEP}] )
|
|
24 |
RDEPEND="
|
|
25 |
!=dev-libs/openssl-1.1.1*:0
|
49 |
26 |
tls-compression? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] )
|
50 |
|
!=dev-libs/openssl-1.0.2*:0
|
51 |
|
!dev-libs/openssl:1.0.0"
|
|
27 |
"
|
52 |
28 |
DEPEND="${RDEPEND}"
|
53 |
29 |
BDEPEND="
|
54 |
30 |
>=dev-lang/perl-5
|
... | ... | |
56 |
32 |
test? (
|
57 |
33 |
sys-apps/diffutils
|
58 |
34 |
sys-devel/bc
|
59 |
|
)"
|
|
35 |
kernel_linux? ( sys-process/procps )
|
|
36 |
)
|
|
37 |
verify-sig? ( >=sec-keys/openpgp-keys-openssl-20230207 )"
|
60 |
38 |
|
61 |
39 |
# Do not install any docs
|
62 |
40 |
DOCS=()
|
63 |
41 |
|
64 |
|
S="${WORKDIR}/${MY_P}"
|
65 |
|
|
66 |
|
MULTILIB_WRAPPED_HEADERS=(
|
67 |
|
usr/include/openssl/opensslconf.h
|
|
42 |
PATCHES=(
|
|
43 |
# General patches which are suitable to always apply
|
|
44 |
# If they're Gentoo specific, add to USE=-vanilla logic in src_prepare!
|
|
45 |
"${FILESDIR}"/${PN/-compat}-1.1.0j-parallel_install_fix.patch # bug #671602
|
|
46 |
"${FILESDIR}"/${PN/-compat}-1.1.1i-riscv32.patch
|
68 |
47 |
)
|
69 |
48 |
|
70 |
|
src_prepare() {
|
71 |
|
mv "${WORKDIR}"/openssl-compat-1.0.2u-versioned-symbols.patch "${WORKDIR}"/patch || die
|
72 |
|
|
73 |
|
if use bindist; then
|
74 |
|
mv "${WORKDIR}"/bindist-patches/hobble-openssl "${WORKDIR}" || die
|
75 |
|
bash "${WORKDIR}"/hobble-openssl || die
|
76 |
|
|
77 |
|
cp -f "${WORKDIR}"/bindist-patches/ec_curve.c "${S}"/crypto/ec/ || die
|
78 |
|
cp -f "${WORKDIR}"/bindist-patches/ectest.c "${S}"/crypto/ec/ || die
|
79 |
|
|
80 |
|
eapply "${WORKDIR}"/bindist-patches/ec-curves.patch
|
|
49 |
pkg_setup() {
|
|
50 |
[[ ${MERGE_TYPE} == binary ]] && return
|
81 |
51 |
|
82 |
|
# Also see the configure parts below:
|
83 |
|
# enable-ec \
|
84 |
|
# $(use_ssl !bindist ec2m) \
|
85 |
|
# $(use_ssl !bindist srp) \
|
|
52 |
# must check in pkg_setup; sysctl doesn't work with userpriv!
|
|
53 |
if use test && use sctp; then
|
|
54 |
# test_ssl_new will fail with "Ensure SCTP AUTH chunks are enabled in kernel"
|
|
55 |
# if sctp.auth_enable is not enabled.
|
|
56 |
local sctp_auth_status=$(sysctl -n net.sctp.auth_enable 2>/dev/null)
|
|
57 |
if [[ -z "${sctp_auth_status}" ]] || [[ ${sctp_auth_status} != 1 ]]; then
|
|
58 |
die "FEATURES=test with USE=sctp requires net.sctp.auth_enable=1!"
|
|
59 |
fi
|
86 |
60 |
fi
|
|
61 |
}
|
|
62 |
|
|
63 |
src_prepare() {
|
|
64 |
# Allow openssl to be cross-compiled
|
|
65 |
cp "${FILESDIR}"/gentoo.config-1.0.4 gentoo.config || die
|
|
66 |
chmod a+rx gentoo.config || die
|
87 |
67 |
|
88 |
|
# keep this in sync with app-misc/c_rehash
|
|
68 |
# Keep this in sync with app-misc/c_rehash
|
89 |
69 |
SSL_CNF_DIR="/etc/ssl"
|
90 |
70 |
|
91 |
71 |
# Make sure we only ever touch Makefile.org and avoid patching a file
|
... | ... | |
93 |
73 |
rm -f Makefile
|
94 |
74 |
|
95 |
75 |
if ! use vanilla ; then
|
96 |
|
eapply "${WORKDIR}"/patch/*.patch
|
|
76 |
PATCHES+=(
|
|
77 |
# Add patches which are Gentoo-specific customisations here
|
|
78 |
)
|
97 |
79 |
fi
|
98 |
80 |
|
99 |
|
eapply_user
|
|
81 |
default
|
100 |
82 |
|
101 |
|
# disable fips in the build
|
102 |
|
# make sure the man pages are suffixed #302165
|
103 |
|
# don't bother building man pages if they're disabled
|
104 |
|
sed -i \
|
105 |
|
-e '/DIRS/s: fips : :g' \
|
106 |
|
-e '/^MANSUFFIX/s:=.*:=ssl:' \
|
107 |
|
-e '/^MAKEDEPPROG/s:=.*:=$(CC):' \
|
108 |
|
-e $(has noman FEATURES \
|
109 |
|
&& echo '/^install:/s:install_docs::' \
|
110 |
|
|| echo '/^MANDIR=/s:=.*:='${EPREFIX}'/usr/share/man:') \
|
111 |
|
Makefile.org \
|
112 |
|
|| die
|
113 |
|
# show the actual commands in the log
|
114 |
|
sed -i '/^SET_X/s:=.*:=set -x:' Makefile.shared
|
115 |
|
|
116 |
|
# since we're forcing $(CC) as makedep anyway, just fix
|
117 |
|
# the conditional as always-on
|
118 |
|
# helps clang (#417795), and versioned gcc (#499818)
|
119 |
|
# this breaks build with 1.0.2p, not sure if it is needed anymore
|
120 |
|
#sed -i 's/expr.*MAKEDEPEND.*;/true;/' util/domd || die
|
|
83 |
if use test && use sctp && has network-sandbox ${FEATURES}; then
|
|
84 |
einfo "Disabling test '80-test_ssl_new.t' which is known to fail with FEATURES=network-sandbox ..."
|
|
85 |
rm test/recipes/80-test_ssl_new.t || die
|
|
86 |
fi
|
121 |
87 |
|
122 |
|
# quiet out unknown driver argument warnings since openssl
|
|
88 |
# Quiet out unknown driver argument warnings since openssl
|
123 |
89 |
# doesn't have well-split CFLAGS and we're making it even worse
|
124 |
|
# and 'make depend' uses -Werror for added fun (#417795 again)
|
125 |
|
[[ ${CC} == *clang* ]] && append-flags -Qunused-arguments
|
126 |
|
|
127 |
|
# allow openssl to be cross-compiled
|
128 |
|
cp "${FILESDIR}"/gentoo.config-1.0.2 gentoo.config || die
|
129 |
|
chmod a+rx gentoo.config || die
|
|
90 |
# and 'make depend' uses -Werror for added fun (bug #417795 again)
|
|
91 |
tc-is-clang && append-flags -Qunused-arguments
|
130 |
92 |
|
|
93 |
# We really, really need to build OpenSSL w/ strict aliasing disabled.
|
|
94 |
# It's filled with violations and it *will* result in miscompiled
|
|
95 |
# code. This has been in the ebuild for > 10 years but even in 2022,
|
|
96 |
# it's still relevant:
|
|
97 |
# - https://github.com/llvm/llvm-project/issues/55255
|
|
98 |
# - https://github.com/openssl/openssl/issues/18225
|
|
99 |
# - https://github.com/openssl/openssl/issues/18663#issuecomment-1181478057
|
|
100 |
# Don't remove the no strict aliasing bits below!
|
|
101 |
filter-flags -fstrict-aliasing
|
131 |
102 |
append-flags -fno-strict-aliasing
|
132 |
|
append-flags $(test-flags-CC -Wa,--noexecstack)
|
|
103 |
|
133 |
104 |
append-cppflags -DOPENSSL_NO_BUF_FREELISTS
|
134 |
105 |
|
135 |
|
sed -i '1s,^:$,#!'${EPREFIX}'/usr/bin/perl,' Configure #141906
|
|
106 |
append-flags $(test-flags-CC -Wa,--noexecstack)
|
|
107 |
|
|
108 |
# Remove test target when FEATURES=test isn't set
|
|
109 |
if ! use test ; then
|
|
110 |
sed \
|
|
111 |
-e '/^$config{dirs}/s@ "test",@@' \
|
|
112 |
-i Configure || die
|
|
113 |
fi
|
|
114 |
|
|
115 |
if use prefix && [[ ${CHOST} == *-solaris* ]] ; then
|
|
116 |
# use GNU ld full option, not to confuse it on Solaris
|
|
117 |
sed -i \
|
|
118 |
-e 's/-Wl,-M,/-Wl,--version-script=/' \
|
|
119 |
-e 's/-Wl,-h,/-Wl,--soname=/' \
|
|
120 |
Configurations/10-main.conf || die
|
|
121 |
|
|
122 |
# fix building on Solaris 10
|
|
123 |
# https://github.com/openssl/openssl/issues/6333
|
|
124 |
sed -i \
|
|
125 |
-e 's/-lsocket -lnsl -ldl/-lsocket -lnsl -ldl -lrt/' \
|
|
126 |
Configurations/10-main.conf || die
|
|
127 |
fi
|
|
128 |
|
|
129 |
local sslout=$(./gentoo.config)
|
|
130 |
einfo "Using configuration: ${sslout:-(openssl knows best)}"
|
|
131 |
local config="perl Configure"
|
|
132 |
[[ -z ${sslout} ]] && config="sh config -v"
|
|
133 |
|
136 |
134 |
# The config script does stupid stuff to prompt the user. Kill it.
|
137 |
135 |
sed -i '/stty -icanon min 0 time 50; read waste/d' config || die
|
138 |
|
./config --test-sanity || die "I AM NOT SANE"
|
|
136 |
edo ${config} ${sslout} --test-sanity
|
139 |
137 |
|
140 |
138 |
multilib_copy_sources
|
141 |
139 |
}
|
142 |
140 |
|
143 |
141 |
multilib_src_configure() {
|
144 |
|
unset APPS #197996
|
145 |
|
unset SCRIPTS #312551
|
146 |
|
unset CROSS_COMPILE #311473
|
147 |
|
|
148 |
|
tc-export CC AR RANLIB RC
|
149 |
|
|
150 |
|
# Clean out patent-or-otherwise-encumbered code
|
151 |
|
# Camellia: Royalty Free https://en.wikipedia.org/wiki/Camellia_(cipher)
|
152 |
|
# IDEA: Expired https://en.wikipedia.org/wiki/International_Data_Encryption_Algorithm
|
153 |
|
# EC: ????????? ??/??/2015 https://en.wikipedia.org/wiki/Elliptic_Curve_Cryptography
|
154 |
|
# MDC2: Expired https://en.wikipedia.org/wiki/MDC-2
|
155 |
|
# RC5: Expired https://en.wikipedia.org/wiki/RC5
|
|
142 |
# bug #197996
|
|
143 |
unset APPS
|
|
144 |
# bug #312551
|
|
145 |
unset SCRIPTS
|
|
146 |
# bug #311473
|
|
147 |
unset CROSS_COMPILE
|
|
148 |
|
|
149 |
tc-export AR CC CXX RANLIB RC
|
156 |
150 |
|
157 |
151 |
use_ssl() { usex $1 "enable-${2:-$1}" "no-${2:-$1}" " ${*:3}" ; }
|
158 |
|
echoit() { echo "$@" ; "$@" ; }
|
159 |
152 |
|
160 |
153 |
local krb5=$(has_version app-crypt/mit-krb5 && echo "MIT" || echo "Heimdal")
|
161 |
154 |
|
162 |
155 |
# See if our toolchain supports __uint128_t. If so, it's 64bit
|
163 |
|
# friendly and can use the nicely optimized code paths. #460790
|
164 |
|
local ec_nistp_64_gcc_128
|
165 |
|
# Disable it for now though #469976
|
166 |
|
#if ! use bindist ; then
|
167 |
|
# echo "__uint128_t i;" > "${T}"/128.c
|
168 |
|
# if ${CC} ${CFLAGS} -c "${T}"/128.c -o /dev/null >&/dev/null ; then
|
169 |
|
# ec_nistp_64_gcc_128="enable-ec_nistp_64_gcc_128"
|
170 |
|
# fi
|
|
156 |
# friendly and can use the nicely optimized code paths, bug #460790.
|
|
157 |
#local ec_nistp_64_gcc_128
|
|
158 |
#
|
|
159 |
# Disable it for now though (bug #469976)
|
|
160 |
# Do NOT re-enable without substantial discussion first!
|
|
161 |
#
|
|
162 |
#echo "__uint128_t i;" > "${T}"/128.c
|
|
163 |
#if ${CC} ${CFLAGS} -c "${T}"/128.c -o /dev/null >&/dev/null ; then
|
|
164 |
# ec_nistp_64_gcc_128="enable-ec_nistp_64_gcc_128"
|
171 |
165 |
#fi
|
172 |
166 |
|
173 |
|
# https://github.com/openssl/openssl/issues/2286
|
174 |
|
if use ia64 ; then
|
175 |
|
replace-flags -g3 -g2
|
176 |
|
replace-flags -ggdb3 -ggdb2
|
177 |
|
fi
|
178 |
|
|
179 |
167 |
local sslout=$(./gentoo.config)
|
180 |
168 |
einfo "Use configuration ${sslout:-(openssl knows best)}"
|
181 |
|
local config="Configure"
|
182 |
|
[[ -z ${sslout} ]] && config="config"
|
|
169 |
local config="perl Configure"
|
|
170 |
[[ -z ${sslout} ]] && config="sh config -v"
|
183 |
171 |
|
184 |
|
# Fedora hobbled-EC needs 'no-ec2m', 'no-srp'
|
|
172 |
# "disable-deprecated" option breaks too many consumers.
|
|
173 |
# Don't set it without thorough revdeps testing.
|
185 |
174 |
# Make sure user flags don't get added *yet* to avoid duplicated
|
186 |
175 |
# flags.
|
187 |
|
CFLAGS= LDFLAGS= echoit \
|
188 |
|
./${config} \
|
189 |
|
${sslout} \
|
190 |
|
$(use cpu_flags_x86_sse2 || echo "no-sse2") \
|
191 |
|
enable-camellia \
|
192 |
|
enable-ec \
|
193 |
|
$(use_ssl !bindist ec2m) \
|
194 |
|
$(use_ssl !bindist srp) \
|
195 |
|
${ec_nistp_64_gcc_128} \
|
196 |
|
enable-idea \
|
197 |
|
enable-mdc2 \
|
198 |
|
enable-rc5 \
|
199 |
|
enable-tlsext \
|
200 |
|
$(use_ssl asm) \
|
201 |
|
$(use_ssl gmp gmp -lgmp) \
|
202 |
|
$(use_ssl kerberos krb5 --with-krb5-flavor=${krb5}) \
|
203 |
|
$(use_ssl rfc3779) \
|
204 |
|
$(use_ssl sctp) \
|
205 |
|
$(use_ssl sslv2 ssl2) \
|
206 |
|
$(use_ssl sslv3 ssl3) \
|
207 |
|
$(use_ssl tls-heartbeat heartbeats) \
|
208 |
|
$(use_ssl tls-compression zlib) \
|
209 |
|
--prefix="${EPREFIX}"/usr \
|
210 |
|
--openssldir="${EPREFIX}"${SSL_CNF_DIR} \
|
211 |
|
--libdir=$(get_libdir) \
|
212 |
|
shared threads \
|
213 |
|
|| die
|
214 |
|
|
215 |
|
# Clean out hardcoded flags that openssl uses
|
216 |
|
local DEFAULT_CFLAGS=$(grep ^CFLAG= Makefile | LC_ALL=C sed \
|
217 |
|
-e 's:^CFLAG=::' \
|
218 |
|
-e 's:\(^\| \)-fomit-frame-pointer::g' \
|
219 |
|
-e 's:\(^\| \)-O[^ ]*::g' \
|
220 |
|
-e 's:\(^\| \)-march=[^ ]*::g' \
|
221 |
|
-e 's:\(^\| \)-mcpu=[^ ]*::g' \
|
222 |
|
-e 's:\(^\| \)-m[^ ]*::g' \
|
223 |
|
-e 's:^ *::' \
|
224 |
|
-e 's: *$::' \
|
225 |
|
-e 's: \+: :g' \
|
226 |
|
-e 's:\\:\\\\:g'
|
|
176 |
local myeconfargs=(
|
|
177 |
${sslout}
|
|
178 |
|
|
179 |
$(use cpu_flags_x86_sse2 || echo "no-sse2")
|
|
180 |
enable-camellia
|
|
181 |
enable-ec
|
|
182 |
enable-ec2m
|
|
183 |
enable-sm2
|
|
184 |
enable-srp
|
|
185 |
$(use elibc_musl && echo "no-async")
|
|
186 |
${ec_nistp_64_gcc_128}
|
|
187 |
enable-idea
|
|
188 |
enable-mdc2
|
|
189 |
enable-rc5
|
|
190 |
$(use_ssl sslv3 ssl3)
|
|
191 |
$(use_ssl sslv3 ssl3-method)
|
|
192 |
$(use_ssl asm)
|
|
193 |
$(use_ssl rfc3779)
|
|
194 |
$(use_ssl sctp)
|
|
195 |
$(use test || echo "no-tests")
|
|
196 |
$(use_ssl tls-compression zlib)
|
|
197 |
$(use_ssl tls-heartbeat heartbeats)
|
|
198 |
$(use_ssl weak-ssl-ciphers)
|
|
199 |
|
|
200 |
--prefix="${EPREFIX}"/usr
|
|
201 |
--openssldir="${EPREFIX}"${SSL_CNF_DIR}
|
|
202 |
--libdir=$(get_libdir)
|
|
203 |
|
|
204 |
shared
|
|
205 |
threads
|
227 |
206 |
)
|
228 |
207 |
|
229 |
|
# Now insert clean default flags with user flags
|
230 |
|
sed -i \
|
231 |
|
-e "/^CFLAG/s|=.*|=${DEFAULT_CFLAGS} ${CFLAGS}|" \
|
232 |
|
-e "/^LDFLAGS=/s|=[[:space:]]*$|=${LDFLAGS}|" \
|
233 |
|
Makefile || die
|
|
208 |
edo ${config} "${myeconfargs[@]}"
|
234 |
209 |
}
|
235 |
210 |
|
236 |
211 |
multilib_src_compile() {
|
237 |
|
# depend is needed to use $confopts; it also doesn't matter
|
238 |
|
# that it's -j1 as the code itself serializes subdirs
|
239 |
|
emake -j1 V=1 depend
|
240 |
|
emake build_libs
|
|
212 |
emake all
|
241 |
213 |
}
|
242 |
214 |
|
243 |
215 |
multilib_src_test() {
|
... | ... | |
245 |
217 |
}
|
246 |
218 |
|
247 |
219 |
multilib_src_install() {
|
248 |
|
dolib.so lib{crypto,ssl}.so.${SLOT}
|
|
220 |
dolib.so lib{crypto,ssl}.so.$(ver_cut 1-2 "${SLOT}")
|
249 |
221 |
}
|