Diff openssl-1.0.2u with a openssl-1.1.0l

/usr/portage/dev-libs/openssl/openssl-1.1.0l.ebuild 2020-03-26 18:41:00.000000000 +0300
5 5

  
6 6
inherit flag-o-matic toolchain-funcs multilib multilib-minimal
7 7

  
8
# openssl-1.0.2-patches-1.6 contain additional CVE patches
9
# which got fixed with this release.
10
# Please use 1.7 version number when rolling a new tarball!
11
PATCH_SET="openssl-1.0.2-patches-1.5"
12

  
13 8
MY_P=${P/_/-}
14 9

  
15
# This patch set is based on the following files from Fedora 25,
16
# see https://src.fedoraproject.org/rpms/openssl/blob/25/f/openssl.spec
10
# This patch set is based on the following files from Fedora 28,
11
# see https://src.fedoraproject.org/rpms/openssl/blob/f28/f/openssl.spec
17 12
# for more details:
18 13
# - hobble-openssl (SOURCE1)
19 14
# - ec_curve.c (SOURCE12) -- MODIFIED
20 15
# - ectest.c (SOURCE13)
21
# - openssl-1.1.1-ec-curves.patch (PATCH37) -- MODIFIED
22
BINDIST_PATCH_SET="openssl-1.0.2t-bindist-1.0.tar.xz"
16
# - openssl-1.1.0-ec-curves.patch (PATCH37) -- MODIFIED
17
BINDIST_PATCH_SET="openssl-1.1.0l-bindist-1.0.tar.xz"
23 18

  
24 19
DESCRIPTION="full-strength general purpose cryptography library (including SSL and TLS)"
25 20
HOMEPAGE="https://www.openssl.org/"
......
27 22
	bindist? (
28 23
		mirror://gentoo/${BINDIST_PATCH_SET}
29 24
		https://dev.gentoo.org/~whissi/dist/openssl/${BINDIST_PATCH_SET}
30
	)
31
	!vanilla? (
32
		mirror://gentoo/${PATCH_SET}.tar.xz
33
		https://dev.gentoo.org/~chutzpah/dist/${PN}/${PATCH_SET}.tar.xz
34
		https://dev.gentoo.org/~whissi/dist/${PN}/${PATCH_SET}.tar.xz
35
		https://dev.gentoo.org/~polynomial-c/dist/${PATCH_SET}.tar.xz
36 25
	)"
37 26

  
38 27
LICENSE="openssl"
39
SLOT="0"
40
KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv s390 sparc x86 ~x86-linux"
41
IUSE="+asm bindist gmp kerberos rfc3779 sctp cpu_flags_x86_sse2 sslv2 +sslv3 static-libs test +tls-heartbeat vanilla zlib"
28
SLOT="0/1.1" # .so version of libssl/libcrypto
29
KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x86-linux"
30
IUSE="+asm bindist elibc_musl rfc3779 sctp cpu_flags_x86_sse2 sslv3 static-libs test tls-heartbeat vanilla zlib"
42 31
RESTRICT="!bindist? ( bindist )
43 32
	!test? ( test )"
44 33

  
45 34
RDEPEND=">=app-misc/c_rehash-1.7-r1
46
	gmp? ( >=dev-libs/gmp-5.1.3-r1[static-libs(+)?,${MULTILIB_USEDEP}] )
47
	kerberos? ( >=app-crypt/mit-krb5-1.11.4[${MULTILIB_USEDEP}] )
48 35
	zlib? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] )"
49 36
DEPEND="${RDEPEND}"
50 37
BDEPEND="
......
56 43
	)"
57 44
PDEPEND="app-misc/ca-certificates"
58 45

  
46
PATCHES=(
47
	"${FILESDIR}"/${PN}-1.0.2a-x32-asm.patch #542618
48
	"${FILESDIR}"/${PN}-1.1.0j-parallel_install_fix.patch #671602
49
	"${FILESDIR}"/${PN}-1.1.0k-fix-test_fuzz.patch
50
)
51

  
59 52
S="${WORKDIR}/${MY_P}"
60 53

  
61 54
MULTILIB_WRAPPED_HEADERS=(
......
68 61
		bash "${WORKDIR}"/hobble-openssl || die
69 62

  
70 63
		cp -f "${WORKDIR}"/bindist-patches/ec_curve.c "${S}"/crypto/ec/ || die
71
		cp -f "${WORKDIR}"/bindist-patches/ectest.c "${S}"/crypto/ec/ || die
64
		cp -f "${WORKDIR}"/bindist-patches/ectest.c "${S}"/test/ || die
72 65

  
73 66
		eapply "${WORKDIR}"/bindist-patches/ec-curves.patch
74 67

  
68
		local known_failing_test
69
		for known_failing_test in \
70
			30-test_evp_extra.t \
71
			80-test_ssl_new.t \
72
		; do
73
			ebegin "Disabling test '${known_failing_test}' which is known to fail with USE=bindist"
74
			rm test/recipes/${known_failing_test} || die
75
			eend $?
76
		done
77

  
75 78
		# Also see the configure parts below:
76 79
		# enable-ec \
77 80
		# $(use_ssl !bindist ec2m) \
78
		# $(use_ssl !bindist srp) \
79 81
	fi
80 82

  
81 83
	# keep this in sync with app-misc/c_rehash
......
86 88
	rm -f Makefile
87 89

  
88 90
	if ! use vanilla ; then
89
		eapply "${WORKDIR}"/patch/*.patch
91
		if [[ $(declare -p PATCHES 2>/dev/null) == "declare -a"* ]] ; then
92
			[[ ${#PATCHES[@]} -gt 0 ]] && eapply "${PATCHES[@]}"
93
		fi
94

  
95
		use bindist || eapply "${FILESDIR}"/${PN}-1.1.0l-fix-no-ec2m-in-ec_curve.c.patch
90 96
	fi
91 97

  
92
	eapply_user
98
	eapply_user #332661
93 99

  
94
	# disable fips in the build
95 100
	# make sure the man pages are suffixed #302165
96 101
	# don't bother building man pages if they're disabled
102
	# Make DOCDIR Gentoo compliant
97 103
	sed -i \
98
		-e '/DIRS/s: fips : :g' \
99 104
		-e '/^MANSUFFIX/s:=.*:=ssl:' \
100 105
		-e '/^MAKEDEPPROG/s:=.*:=$(CC):' \
101 106
		-e $(has noman FEATURES \
102 107
			&& echo '/^install:/s:install_docs::' \
103 108
			|| echo '/^MANDIR=/s:=.*:='${EPREFIX}'/usr/share/man:') \
104
		Makefile.org \
109
		-e "/^DOCDIR/s@\$(BASENAME)@&-${PVR}@" \
110
		Configurations/unix-Makefile.tmpl \
105 111
		|| die
106
	# show the actual commands in the log
107
	sed -i '/^SET_X/s:=.*:=set -x:' Makefile.shared
108 112

  
109
	# since we're forcing $(CC) as makedep anyway, just fix
110
	# the conditional as always-on
111
	# helps clang (#417795), and versioned gcc (#499818)
112
	# this breaks build with 1.0.2p, not sure if it is needed anymore
113
	#sed -i 's/expr.*MAKEDEPEND.*;/true;/' util/domd || die
113
	# show the actual commands in the log
114
	sed -i '/^SET_X/s@=.*@=set -x@' Makefile.shared || die
114 115

  
115 116
	# quiet out unknown driver argument warnings since openssl
116 117
	# doesn't have well-split CFLAGS and we're making it even worse
......
125 126
	append-flags $(test-flags-CC -Wa,--noexecstack)
126 127
	append-cppflags -DOPENSSL_NO_BUF_FREELISTS
127 128

  
128
	sed -i '1s,^:$,#!'${EPREFIX}'/usr/bin/perl,' Configure #141906
129
	# Prefixify Configure shebang (#141906)
130
	sed \
131
		-e "1s,/usr/bin/env,${EPREFIX}&," \
132
		-i Configure || die
133
	# Remove test target when FEATURES=test isn't set
134
	if ! use test ; then
135
		sed \
136
			-e '/^$config{dirs}/s@ "test",@@' \
137
			-i Configure || die
138
	fi
129 139
	# The config script does stupid stuff to prompt the user.  Kill it.
130 140
	sed -i '/stty -icanon min 0 time 50; read waste/d' config || die
131 141
	./config --test-sanity || die "I AM NOT SANE"
......
163 173
	#	fi
164 174
	#fi
165 175

  
166
	# https://github.com/openssl/openssl/issues/2286
167
	if use ia64 ; then
168
		replace-flags -g3 -g2
169
		replace-flags -ggdb3 -ggdb2
170
	fi
171

  
172 176
	local sslout=$(./gentoo.config)
173 177
	einfo "Use configuration ${sslout:-(openssl knows best)}"
174 178
	local config="Configure"
175 179
	[[ -z ${sslout} ]] && config="config"
176 180

  
177
	# Fedora hobbled-EC needs 'no-ec2m', 'no-srp'
181
	# Fedora hobbled-EC needs 'no-ec2m'
182
	# 'srp' was restricted until early 2017 as well.
183
	# "disable-deprecated" option breaks too many consumers.
184
	# Don't set it without thorough revdeps testing.
178 185
	# Make sure user flags don't get added *yet* to avoid duplicated
179 186
	# flags.
180 187
	CFLAGS= LDFLAGS= echoit \
......
184 191
		enable-camellia \
185 192
		enable-ec \
186 193
		$(use_ssl !bindist ec2m) \
187
		$(use_ssl !bindist srp) \
194
		enable-srp \
195
		$(use elibc_musl && echo "no-async") \
188 196
		${ec_nistp_64_gcc_128} \
189 197
		enable-idea \
190 198
		enable-mdc2 \
191 199
		enable-rc5 \
192
		enable-tlsext \
200
		$(use_ssl sslv3 ssl3) \
201
		$(use_ssl sslv3 ssl3-method) \
193 202
		$(use_ssl asm) \
194
		$(use_ssl gmp gmp -lgmp) \
195
		$(use_ssl kerberos krb5 --with-krb5-flavor=${krb5}) \
196 203
		$(use_ssl rfc3779) \
197 204
		$(use_ssl sctp) \
198
		$(use_ssl sslv2 ssl2) \
199
		$(use_ssl sslv3 ssl3) \
200 205
		$(use_ssl tls-heartbeat heartbeats) \
201 206
		$(use_ssl zlib) \
202 207
		--prefix="${EPREFIX}"/usr \
......
206 211
		|| die
207 212

  
208 213
	# Clean out hardcoded flags that openssl uses
209
	local DEFAULT_CFLAGS=$(grep ^CFLAG= Makefile | LC_ALL=C sed \
210
		-e 's:^CFLAG=::' \
214
	local DEFAULT_CFLAGS=$(grep ^CFLAGS= Makefile | LC_ALL=C sed \
215
		-e 's:^CFLAGS=::' \
211 216
		-e 's:\(^\| \)-fomit-frame-pointer::g' \
212 217
		-e 's:\(^\| \)-O[^ ]*::g' \
213 218
		-e 's:\(^\| \)-march=[^ ]*::g' \
......
221 226

  
222 227
	# Now insert clean default flags with user flags
223 228
	sed -i \
224
		-e "/^CFLAG/s|=.*|=${DEFAULT_CFLAGS} ${CFLAGS}|" \
229
		-e "/^CFLAGS=/s|=.*|=${DEFAULT_CFLAGS} ${CFLAGS}|" \
225 230
		-e "/^LDFLAGS=/s|=[[:space:]]*$|=${LDFLAGS}|" \
226 231
		Makefile || die
227 232
}
......
229 234
multilib_src_compile() {
230 235
	# depend is needed to use $confopts; it also doesn't matter
231 236
	# that it's -j1 as the code itself serializes subdirs
232
	emake -j1 V=1 depend
237
	emake -j1 depend
233 238
	emake all
234
	# rehash is needed to prep the certs/ dir; do this
235
	# separately to avoid parallel build issues.
236
	emake rehash
237 239
}
238 240

  
239 241
multilib_src_test() {
......
247 249
		mkdir "${ED}"/usr || die
248 250
	fi
249 251

  
250
	emake INSTALL_PREFIX="${D}" install
252
	emake DESTDIR="${D}" install
251 253
}
252 254

  
253 255
multilib_src_install_all() {
......
255 257
	# we provide a shell version via app-misc/c_rehash
256 258
	rm "${ED}"/usr/bin/c_rehash || die
257 259

  
258
	local -a DOCS=( CHANGES* FAQ NEWS README doc/*.txt doc/c-indentation.el )
259
	einstalldocs
260

  
261
	use rfc3779 && dodoc engines/ccgost/README.gost
260
	dodoc CHANGES* FAQ NEWS README doc/*.txt doc/${PN}-c-indent.el
262 261

  
263 262
	# This is crappy in that the static archives are still built even
264 263
	# when USE=static-libs.  But this is due to a failing in the openssl
......
268 267
	use static-libs || rm -f "${ED}"/usr/lib*/lib*.a
269 268

  
270 269
	# create the certs directory
271
	dodir ${SSL_CNF_DIR}/certs
272
	cp -RP certs/* "${ED}"${SSL_CNF_DIR}/certs/ || die
273
	rm -r "${ED}"${SSL_CNF_DIR}/certs/{demo,expired}
270
	keepdir ${SSL_CNF_DIR}/certs
274 271

  
275 272
	# Namespace openssl programs to prevent conflicts with other man pages
276
	cd "${ED}"/usr/share/man
273
	cd "${ED}"/usr/share/man || die
277 274
	local m d s
278 275
	for m in $(find . -type f | xargs grep -L '#include') ; do
279 276
		d=${m%/*} ; d=${d#./} ; m=${m##*/}
......
288 285
		for s in $(find -L ${d} -type l) ; do
289 286
			s=${s##*/}
290 287
			rm -f ${d}/${s}
288
			# We don't want to "|| die" here
291 289
			ln -s ssl-${m} ${d}/ssl-${s}
292 290
			ln -s ssl-${s} ${d}/openssl-${s}
293 291
		done
Thank you!