diff --git a/sdk_container/src/third_party/portage-stable/changelog/security/2022-03-29-gnutls-3.7.3.md b/sdk_container/src/third_party/portage-stable/changelog/security/2022-03-29-gnutls-3.7.3.md new file mode 100644 index 0000000000..f23fffdf5a --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/changelog/security/2022-03-29-gnutls-3.7.3.md @@ -0,0 +1 @@ +- gnutls ([CVE-2021-4209](https://nvd.nist.gov/vuln/detail/CVE-2021-4209), [GNUTLS-SA-2022-01-17](https://gitlab.com/gnutls/gnutls/-/issues/1277)) diff --git a/sdk_container/src/third_party/portage-stable/changelog/updates/2022-03-29-gnutls-3.7.3.md b/sdk_container/src/third_party/portage-stable/changelog/updates/2022-03-29-gnutls-3.7.3.md new file mode 100644 index 0000000000..3557e2cf5f --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/changelog/updates/2022-03-29-gnutls-3.7.3.md @@ -0,0 +1 @@ +- gnutls ([3.7.3](https://gitlab.com/gnutls/gnutls/-/merge_requests/1517)) diff --git a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/Manifest b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/Manifest index 1ab16ed845..c966044906 100644 --- a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/Manifest +++ b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/Manifest @@ -1,2 +1,4 @@ -DIST gnutls-3.6.15.tar.xz 6081656 BLAKE2B 6c52419037e41e817087a2577a6b73969cf065453ecf88e2f87152f544a177e4ad0ef825ae9dab243312e0223a953ab28e532bd2dbf96cb9498618415bc7f654 SHA512 f757d1532198f44bcad7b73856ce6a05bab43f6fb77fcc81c59607f146202f73023d0796d3e1e7471709cf792c8ee7d436e19407e0601bc0bda2f21512b3b01c -DIST gnutls-3.7.1.tar.xz 6038388 BLAKE2B 1d55eb441827c7148d63bcad37bf7bc62d539ee9bc7e14c2fe5ec1d0bdcadd75e2cbc98ba104523b24c8dfd9526b4595475a818d206971cc012fac509cd33a6f SHA512 0fe801f03676c3bd970387f94578c8be7ba6030904989e7d21dffdc726209bab44c8096fbcb6d51fed2de239537bd00df2338ee9c8d984a1c386826b91062a95 +DIST gnutls-3.7.2.tar.xz 6091508 BLAKE2B f408ff65f2e08cf294b449dfac64a272a8ba40e987618960f57ee36c167a25974711ab8d11bdbd6335fbf18ac902a79b5c6b40bb6a37f4ee07549832d0611df2 SHA512 5d01d561a05379da71e4847e30ba13c2abe09f7a5c4359fd539d8bd19abad0ce87120f82ee7b6264e787bd3edbc5ae16beffa892983cbc3d59f11a1811c10329 +DIST gnutls-3.7.3.tar.xz 6119292 BLAKE2B 811e6fbb62fbd35fa63e66cfcbfc3bf899cea5cece1d2a68bc650f507df0f7be9f59c707c90fa19b7ef5a52455a663da49682704e0884af06075c566afbfc0bf SHA512 3ace744affe23e284342658d6d2d2de49dd50065489cbc8be18fc7d38187253e5268ca54027ce5cd517056c249ac039a7481e4548cec04325de37ae85617d077 +DIST gnutls-3.7.4.tar.xz 6131772 BLAKE2B 1c44528952275f48e4e458558c4e03c5b90dfb267482d6815f6c836f9530abb486a23ae5ea70ba2db7e272eee8e2066b259374f02a9bb9e714487466fd5994c9 SHA512 38b488ca1223d9aa8fc25756df08db6f29aaf76fb5816fdeaa14bd89fb431a2e1c495fefc64094f726337d5b89e198146ec7dc22e9a1bca6841a9d881b0d99e6 +DIST gnutls-3.7.4.tar.xz.sig 685 BLAKE2B ad485450abb916a229984f8f0d74fe7c46a0a87627f9d739f8121dccf36f4ca454007178f2a4e9bd5fffa2813363481bf80eaeee40f86e1b9c23b1f25dff7b4c SHA512 74b8badd67e215313583bd25c7b639207860af45d6f5cbcb81f1aaf46dacf0992b6d06876979594688e13dac5b8b27ba39935626374b4ddaa3e48118bbc2e7de diff --git a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/files/gnutls-3.6.15-skip-dtls-seccomp-tests.patch b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/files/gnutls-3.6.15-skip-dtls-seccomp-tests.patch deleted file mode 100644 index dad6cec8d3..0000000000 --- a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/files/gnutls-3.6.15-skip-dtls-seccomp-tests.patch +++ /dev/null @@ -1,26 +0,0 @@ -https://bugs.gentoo.org/649396 -https://bugs.gentoo.org/711104 - ---- a/tests/dtls-client-with-seccomp.c -+++ b/tests/dtls-client-with-seccomp.c -@@ -27,7 +27,7 @@ - #include - #include - --#if defined(_WIN32) || !defined(HAVE_LIBSECCOMP) -+#if 1 - - int main() - { ---- a/tests/dtls-with-seccomp.c -+++ b/tests/dtls-with-seccomp.c -@@ -27,7 +27,7 @@ - #include - #include - --#if defined(_WIN32) || !defined(HAVE_LIBSECCOMP) -+#if 1 - - int main() - { - diff --git a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/files/gnutls-3.7.4-configure-compression.patch b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/files/gnutls-3.7.4-configure-compression.patch new file mode 100644 index 0000000000..edd688d9b5 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/files/gnutls-3.7.4-configure-compression.patch @@ -0,0 +1,63 @@ +https://gitlab.com/gnutls/gnutls/-/merge_requests/1557 + +From: Sam James +Date: Fri, 18 Mar 2022 05:40:28 +0000 +Subject: [PATCH 1/2] configure.ac: fix brotli/zstd configure argument name + +The old `./configure` arguments for brotli and zstd respectively +were inconsistent with the `./configure --help` output. + +Old: --without-libbrotli --without-libzstd (also --with-*) +New: --without-brotli --without-zstd (also --with-*) + +Fixes: https://gitlab.com/gnutls/gnutls/-/issues/1342 +Signed-off-by: Sam James +--- a/configure.ac ++++ b/configure.ac +@@ -1010,7 +1010,7 @@ if test x$ac_zlib != xno; then + fi + AC_SUBST(LIBZ_PC) + +-AC_ARG_WITH(libbrotli, ++AC_ARG_WITH(brotli, + AS_HELP_STRING([--without-brotli], [disable brotli compression support]), + ac_brotli=$withval, ac_brotli=yes) + AC_MSG_CHECKING([whether to include brotli compression support]) +@@ -1033,7 +1033,7 @@ else + fi + AM_CONDITIONAL(HAVE_LIBBROTLI, test "$with_libbrotlienc" != "no" && test "$with_libbrotlidec" != "no") + +-AC_ARG_WITH(libzstd, ++AC_ARG_WITH(zstd, + AS_HELP_STRING([--without-zstd], [disable zstd compression support]), + ac_zstd=$withval, ac_zstd=yes) + AC_MSG_CHECKING([whether to include zstd compression support]) +GitLab + +From: Sam James +Date: Fri, 18 Mar 2022 05:51:29 +0000 +Subject: [PATCH 2/2] configure.ac: fix zstd detection + +Fixes typo in zstd detection. + +None of the used autoconf macros will define `has_zstd_h` so +configure will (AFAICT) always fail to find zstd, even if it succeeded +via pkg-config moments before. + +Drop it and rely solely on pkg-config as that's the only search +we're actually doing. + +Fixes: https://gitlab.com/gnutls/gnutls/-/issues/1343 +Signed-off-by: Sam James +--- a/configure.ac ++++ b/configure.ac +@@ -1040,7 +1040,7 @@ AC_MSG_CHECKING([whether to include zstd compression support]) + if test x$ac_zstd != xno; then + AC_MSG_RESULT(yes) + PKG_CHECK_MODULES(LIBZSTD, [libzstd >= 1.3.0], [with_libzstd=yes], [with_libzstd=no]) +- if test "${with_libzstd}" = "yes" && test "${has_zstd_h}" = "yes"; then ++ if test "${with_libzstd}" = "yes"; then + AC_DEFINE([HAVE_LIBZSTD], 1, [Define if ZSTD compression is enabled.]) + if test "x$GNUTLS_REQUIRES_PRIVATE" = "x"; then + GNUTLS_REQUIRES_PRIVATE="Requires.private: libzstd" +GitLab diff --git a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.6.15.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.7.2.ebuild similarity index 96% rename from sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.6.15.ebuild rename to sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.7.2.ebuild index b5557dc3ff..5448b73bad 100644 --- a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.6.15.ebuild +++ b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.7.2.ebuild @@ -22,7 +22,7 @@ RESTRICT="!test? ( test )" # use system libopts RDEPEND=">=dev-libs/libtasn1-4.9:=[${MULTILIB_USEDEP}] dev-libs/libunistring:=[${MULTILIB_USEDEP}] - >=dev-libs/nettle-3.4.1:=[gmp,${MULTILIB_USEDEP}] + >=dev-libs/nettle-3.6:=[gmp,${MULTILIB_USEDEP}] >=dev-libs/gmp-5.1.3-r1:=[${MULTILIB_USEDEP}] tools? ( sys-devel/autogen:= ) dane? ( >=net-dns/unbound-1.4.20:=[${MULTILIB_USEDEP}] ) @@ -42,7 +42,7 @@ BDEPEND=">=virtual/pkgconfig-0-r1 test-full? ( app-crypt/dieharder >=app-misc/datefudge-1.22 - dev-libs/softhsm:2[-bindist] + dev-libs/softhsm:2[-bindist(-)] net-dialup/ppp net-misc/socat )" @@ -54,8 +54,6 @@ DOCS=( HTML_DOCS=() -PATCHES=( "${FILESDIR}"/${PN}-3.6.15-skip-dtls-seccomp-tests.patch ) - pkg_setup() { # bug#520818 export TZ=UTC diff --git a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.7.1.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.7.3-r1.ebuild similarity index 76% rename from sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.7.1.ebuild rename to sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.7.3-r1.ebuild index ece149c185..b8efb393ff 100644 --- a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.7.1.ebuild +++ b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.7.3-r1.ebuild @@ -1,4 +1,4 @@ -# Copyright 1999-2021 Gentoo Authors +# Copyright 1999-2022 Gentoo Authors # Distributed under the terms of the GNU General Public License v2 EAPI=7 @@ -11,20 +11,16 @@ SRC_URI="mirror://gnupg/gnutls/v$(ver_cut 1-2)/${P}.tar.xz" LICENSE="GPL-3 LGPL-2.1+" SLOT="0/30" # libgnutls.so number -KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris" +KEYWORDS="~alpha amd64 arm ~arm64 hppa ~ia64 ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris" IUSE="+cxx dane doc examples guile +idn nls +openssl pkcs11 seccomp sslv2 sslv3 static-libs test test-full +tls-heartbeat tools valgrind" -REQUIRED_USE=" - test-full? ( cxx dane doc examples guile idn nls openssl pkcs11 seccomp tls-heartbeat tools )" +REQUIRED_USE="test-full? ( cxx dane doc examples guile idn nls openssl pkcs11 seccomp tls-heartbeat tools )" RESTRICT="!test? ( test )" -# NOTICE: sys-devel/autogen is required at runtime as we -# use system libopts RDEPEND=">=dev-libs/libtasn1-4.9:=[${MULTILIB_USEDEP}] dev-libs/libunistring:=[${MULTILIB_USEDEP}] >=dev-libs/nettle-3.6:=[gmp,${MULTILIB_USEDEP}] >=dev-libs/gmp-5.1.3-r1:=[${MULTILIB_USEDEP}] - tools? ( sys-devel/autogen:= ) dane? ( >=net-dns/unbound-1.4.20:=[${MULTILIB_USEDEP}] ) guile? ( >=dev-scheme/guile-2:=[networking] ) nls? ( >=virtual/libintl-0-r1:=[${MULTILIB_USEDEP}] ) @@ -37,25 +33,21 @@ DEPEND="${RDEPEND} BDEPEND=">=virtual/pkgconfig-0-r1 doc? ( dev-util/gtk-doc ) nls? ( sys-devel/gettext ) - tools? ( sys-devel/autogen ) valgrind? ( dev-util/valgrind ) test-full? ( app-crypt/dieharder >=app-misc/datefudge-1.22 - dev-libs/softhsm:2[-bindist] + dev-libs/softhsm:2[-bindist(-)] net-dialup/ppp net-misc/socat )" -DOCS=( - README.md - doc/certtool.cfg -) +DOCS=( README.md doc/certtool.cfg ) HTML_DOCS=() pkg_setup() { - # bug#520818 + # bug #520818 export TZ=UTC use doc && HTML_DOCS+=( @@ -66,12 +58,6 @@ pkg_setup() { src_prepare() { default - # force regeneration of autogen-ed files - local file - for file in $(grep -l AutoGen-ed src/*.c) ; do - rm src/$(basename ${file} .c).{c,h} || die - done - # don't try to use system certificate store on macOS, it is # confusingly ignoring our ca-certificates and more importantly # fails to compile in certain configurations @@ -87,9 +73,12 @@ multilib_src_configure() { local libconf=() # TPM needs to be tested before being enabled - libconf+=( --without-tpm ) + libconf+=( + --without-tpm + --without-tpm2 + ) - # hardware-accell is disabled on OSX because the asm files force + # hardware-accel is disabled on OSX because the asm files force # GNU-stack (as doesn't support that) and when that's removed ld # complains about duplicate symbols [[ ${CHOST} == *-darwin* ]] && libconf+=( --disable-hardware-acceleration ) @@ -118,8 +107,8 @@ multilib_src_configure() { $(use_with idn) $(use_with pkcs11 p11-kit) --disable-rpath - --with-default-trust-store-file="${EPREFIX}/etc/ssl/certs/ca-certificates.crt" - --with-unbound-root-key-file="${EPREFIX}/etc/dnssec/root-anchors.txt" + --with-default-trust-store-file="${EPREFIX}"/etc/ssl/certs/ca-certificates.crt + --with-unbound-root-key-file="${EPREFIX}"/etc/dnssec/root-anchors.txt --without-included-libtasn1 $("${S}/configure" --help | grep -o -- '--without-.*-prefix') ) diff --git a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.7.4.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.7.4.ebuild new file mode 100644 index 0000000000..6eaf9997a9 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.7.4.ebuild @@ -0,0 +1,153 @@ +# Copyright 1999-2022 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=7 + +VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/gnutls.asc +inherit autotools multilib-minimal verify-sig + +DESCRIPTION="A secure communications library implementing the SSL, TLS and DTLS protocols" +HOMEPAGE="https://www.gnutls.org/" +SRC_URI="mirror://gnupg/gnutls/v$(ver_cut 1-2)/${P}.tar.xz" +SRC_URI+=" verify-sig? ( mirror://gnupg/gnutls/v$(ver_cut 1-2)/${P}.tar.xz.sig )" + +LICENSE="GPL-3 LGPL-2.1+" +SLOT="0/30" # libgnutls.so number +# Drop keywords while figuring out what to do (if anything) about USE=cxx ABI break +# https://gitlab.com/gnutls/gnutls/-/commit/f746f7d4be0070395834bef8e7f7b6f9c8d3158b +#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris" +IUSE="brotli +cxx dane doc examples guile +idn nls +openssl pkcs11 seccomp sslv2 sslv3 static-libs test test-full +tls-heartbeat tools valgrind zlib zstd" + +REQUIRED_USE="test-full? ( cxx dane doc examples guile idn nls openssl pkcs11 seccomp tls-heartbeat tools )" +RESTRICT="!test? ( test )" + +RDEPEND=">=dev-libs/libtasn1-4.9:=[${MULTILIB_USEDEP}] + dev-libs/libunistring:=[${MULTILIB_USEDEP}] + >=dev-libs/nettle-3.6:=[gmp,${MULTILIB_USEDEP}] + >=dev-libs/gmp-5.1.3-r1:=[${MULTILIB_USEDEP}] + brotli? ( >=app-arch/brotli-1.0.0:=[${MULTILIB_USEDEP}] ) + dane? ( >=net-dns/unbound-1.4.20:=[${MULTILIB_USEDEP}] ) + guile? ( >=dev-scheme/guile-2:=[networking] ) + nls? ( >=virtual/libintl-0-r1:=[${MULTILIB_USEDEP}] ) + pkcs11? ( >=app-crypt/p11-kit-0.23.1[${MULTILIB_USEDEP}] ) + idn? ( >=net-dns/libidn2-0.16-r1:=[${MULTILIB_USEDEP}] ) + zlib? ( sys-libs/zlib[${MULTILIB_USEDEP}] ) + zstd? ( >=app-arch/zstd-1.3.0:=[${MULTILIB_USEDEP}] )" +DEPEND="${RDEPEND} + test? ( + seccomp? ( sys-libs/libseccomp ) + )" +BDEPEND=" + dev-util/gtk-doc-am + >=virtual/pkgconfig-0-r1 + doc? ( dev-util/gtk-doc ) + nls? ( sys-devel/gettext ) + valgrind? ( dev-util/valgrind ) + test-full? ( + app-crypt/dieharder + >=app-misc/datefudge-1.22 + dev-libs/softhsm:2[-bindist(-)] + net-dialup/ppp + net-misc/socat + ) + verify-sig? ( >=sec-keys/openpgp-keys-gnutls-20220320 )" + +DOCS=( README.md doc/certtool.cfg ) + +HTML_DOCS=() + +PATCHES=( + "${FILESDIR}"/${P}-configure-compression.patch +) + +pkg_setup() { + # bug #520818 + export TZ=UTC + + use doc && HTML_DOCS+=( + doc/gnutls.html + ) +} + +src_prepare() { + default + + # don't try to use system certificate store on macOS, it is + # confusingly ignoring our ca-certificates and more importantly + # fails to compile in certain configurations + sed -i -e 's/__APPLE__/__NO_APPLE__/' lib/system/certs.c || die + + # Use sane .so versioning on FreeBSD. + #elibtoolize + + # Need eautoreconf for: + # 1) gtk-doc macro fix + # (once fixed, we can drop unconditional gtk-doc-am BDEPEND too) + # see https://gitlab.com/gnutls/gnutls/-/issues/1341 + # + # 2) configure fixes for brotli, zstd + # see https://gitlab.com/gnutls/gnutls/-/issues/1343 + eautoreconf +} + +multilib_src_configure() { + LINGUAS="${LINGUAS//en/en@boldquot en@quot}" + + local libconf=() + + # TPM needs to be tested before being enabled + # Note that this may add a libltdl dep when enabled. Check configure.ac. + libconf+=( + --without-tpm + --without-tpm2 + ) + + # hardware-accel is disabled on OSX because the asm files force + # GNU-stack (as doesn't support that) and when that's removed ld + # complains about duplicate symbols + [[ ${CHOST} == *-darwin* ]] && libconf+=( --disable-hardware-acceleration ) + + # Cygwin as does not understand these asm files at all + [[ ${CHOST} == *-cygwin* ]] && libconf+=( --disable-hardware-acceleration ) + + local myeconfargs=( + $(multilib_native_enable manpages) + $(multilib_native_use_enable doc gtk-doc) + $(multilib_native_use_enable doc) + $(multilib_native_use_enable guile) + $(multilib_native_use_enable seccomp seccomp-tests) + $(multilib_native_use_enable test tests) + $(multilib_native_use_enable test-full full-test-suite) + $(multilib_native_use_enable tools) + $(multilib_native_use_enable valgrind valgrind-tests) + $(use_enable cxx) + $(use_enable dane libdane) + $(use_enable nls) + $(use_enable openssl openssl-compatibility) + $(use_enable sslv2 ssl2-support) + $(use_enable sslv3 ssl3-support) + $(use_enable static-libs static) + $(use_enable tls-heartbeat heartbeat-support) + $(use_with brotli) + $(use_with idn) + $(use_with pkcs11 p11-kit) + $(use_with zlib) + $(use_with zstd) + --disable-rpath + --with-default-trust-store-file="${EPREFIX}"/etc/ssl/certs/ca-certificates.crt + --with-unbound-root-key-file="${EPREFIX}"/etc/dnssec/root-anchors.txt + --without-included-libtasn1 + $("${S}/configure" --help | grep -o -- '--without-.*-prefix') + ) + ECONF_SOURCE="${S}" econf "${libconf[@]}" "${myeconfargs[@]}" +} + +multilib_src_install_all() { + einstalldocs + find "${ED}" -type f -name '*.la' -delete || die + + if use examples; then + docinto examples + dodoc doc/examples/*.c + fi +} diff --git a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/metadata.xml b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/metadata.xml index 34baa89cc6..8f171c8ee7 100644 --- a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/metadata.xml +++ b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/metadata.xml @@ -1,10 +1,13 @@ - + base-system@gentoo.org + + Enable brotli decompression support via app-arch/brotli + Build libgnutls-dane, implementing DNS-based Authentication of Named Entities. Requires net-dns/unbound