Merge pull request #315 from flatcar-linux/dongsu/gnutls-3.7.3

net-libs/gnutls: update to 3.7.3
This commit is contained in:
Dongsu Park 2022-03-30 15:53:35 +02:00 committed by GitHub
commit 15e35c7e20
9 changed files with 241 additions and 57 deletions

View File

@ -0,0 +1 @@
- gnutls ([CVE-2021-4209](https://nvd.nist.gov/vuln/detail/CVE-2021-4209), [GNUTLS-SA-2022-01-17](https://gitlab.com/gnutls/gnutls/-/issues/1277))

View File

@ -0,0 +1 @@
- gnutls ([3.7.3](https://gitlab.com/gnutls/gnutls/-/merge_requests/1517))

View File

@ -1,2 +1,4 @@
DIST gnutls-3.6.15.tar.xz 6081656 BLAKE2B 6c52419037e41e817087a2577a6b73969cf065453ecf88e2f87152f544a177e4ad0ef825ae9dab243312e0223a953ab28e532bd2dbf96cb9498618415bc7f654 SHA512 f757d1532198f44bcad7b73856ce6a05bab43f6fb77fcc81c59607f146202f73023d0796d3e1e7471709cf792c8ee7d436e19407e0601bc0bda2f21512b3b01c
DIST gnutls-3.7.1.tar.xz 6038388 BLAKE2B 1d55eb441827c7148d63bcad37bf7bc62d539ee9bc7e14c2fe5ec1d0bdcadd75e2cbc98ba104523b24c8dfd9526b4595475a818d206971cc012fac509cd33a6f SHA512 0fe801f03676c3bd970387f94578c8be7ba6030904989e7d21dffdc726209bab44c8096fbcb6d51fed2de239537bd00df2338ee9c8d984a1c386826b91062a95
DIST gnutls-3.7.2.tar.xz 6091508 BLAKE2B f408ff65f2e08cf294b449dfac64a272a8ba40e987618960f57ee36c167a25974711ab8d11bdbd6335fbf18ac902a79b5c6b40bb6a37f4ee07549832d0611df2 SHA512 5d01d561a05379da71e4847e30ba13c2abe09f7a5c4359fd539d8bd19abad0ce87120f82ee7b6264e787bd3edbc5ae16beffa892983cbc3d59f11a1811c10329
DIST gnutls-3.7.3.tar.xz 6119292 BLAKE2B 811e6fbb62fbd35fa63e66cfcbfc3bf899cea5cece1d2a68bc650f507df0f7be9f59c707c90fa19b7ef5a52455a663da49682704e0884af06075c566afbfc0bf SHA512 3ace744affe23e284342658d6d2d2de49dd50065489cbc8be18fc7d38187253e5268ca54027ce5cd517056c249ac039a7481e4548cec04325de37ae85617d077
DIST gnutls-3.7.4.tar.xz 6131772 BLAKE2B 1c44528952275f48e4e458558c4e03c5b90dfb267482d6815f6c836f9530abb486a23ae5ea70ba2db7e272eee8e2066b259374f02a9bb9e714487466fd5994c9 SHA512 38b488ca1223d9aa8fc25756df08db6f29aaf76fb5816fdeaa14bd89fb431a2e1c495fefc64094f726337d5b89e198146ec7dc22e9a1bca6841a9d881b0d99e6
DIST gnutls-3.7.4.tar.xz.sig 685 BLAKE2B ad485450abb916a229984f8f0d74fe7c46a0a87627f9d739f8121dccf36f4ca454007178f2a4e9bd5fffa2813363481bf80eaeee40f86e1b9c23b1f25dff7b4c SHA512 74b8badd67e215313583bd25c7b639207860af45d6f5cbcb81f1aaf46dacf0992b6d06876979594688e13dac5b8b27ba39935626374b4ddaa3e48118bbc2e7de

View File

@ -1,26 +0,0 @@
https://bugs.gentoo.org/649396
https://bugs.gentoo.org/711104
--- a/tests/dtls-client-with-seccomp.c
+++ b/tests/dtls-client-with-seccomp.c
@@ -27,7 +27,7 @@
#include <stdio.h>
#include <stdlib.h>
-#if defined(_WIN32) || !defined(HAVE_LIBSECCOMP)
+#if 1
int main()
{
--- a/tests/dtls-with-seccomp.c
+++ b/tests/dtls-with-seccomp.c
@@ -27,7 +27,7 @@
#include <stdio.h>
#include <stdlib.h>
-#if defined(_WIN32) || !defined(HAVE_LIBSECCOMP)
+#if 1
int main()
{

View File

@ -0,0 +1,63 @@
https://gitlab.com/gnutls/gnutls/-/merge_requests/1557
From: Sam James <sam@gentoo.org>
Date: Fri, 18 Mar 2022 05:40:28 +0000
Subject: [PATCH 1/2] configure.ac: fix brotli/zstd configure argument name
The old `./configure` arguments for brotli and zstd respectively
were inconsistent with the `./configure --help` output.
Old: --without-libbrotli --without-libzstd (also --with-*)
New: --without-brotli --without-zstd (also --with-*)
Fixes: https://gitlab.com/gnutls/gnutls/-/issues/1342
Signed-off-by: Sam James <sam@gentoo.org>
--- a/configure.ac
+++ b/configure.ac
@@ -1010,7 +1010,7 @@ if test x$ac_zlib != xno; then
fi
AC_SUBST(LIBZ_PC)
-AC_ARG_WITH(libbrotli,
+AC_ARG_WITH(brotli,
AS_HELP_STRING([--without-brotli], [disable brotli compression support]),
ac_brotli=$withval, ac_brotli=yes)
AC_MSG_CHECKING([whether to include brotli compression support])
@@ -1033,7 +1033,7 @@ else
fi
AM_CONDITIONAL(HAVE_LIBBROTLI, test "$with_libbrotlienc" != "no" && test "$with_libbrotlidec" != "no")
-AC_ARG_WITH(libzstd,
+AC_ARG_WITH(zstd,
AS_HELP_STRING([--without-zstd], [disable zstd compression support]),
ac_zstd=$withval, ac_zstd=yes)
AC_MSG_CHECKING([whether to include zstd compression support])
GitLab
From: Sam James <sam@gentoo.org>
Date: Fri, 18 Mar 2022 05:51:29 +0000
Subject: [PATCH 2/2] configure.ac: fix zstd detection
Fixes typo in zstd detection.
None of the used autoconf macros will define `has_zstd_h` so
configure will (AFAICT) always fail to find zstd, even if it succeeded
via pkg-config moments before.
Drop it and rely solely on pkg-config as that's the only search
we're actually doing.
Fixes: https://gitlab.com/gnutls/gnutls/-/issues/1343
Signed-off-by: Sam James <sam@gentoo.org>
--- a/configure.ac
+++ b/configure.ac
@@ -1040,7 +1040,7 @@ AC_MSG_CHECKING([whether to include zstd compression support])
if test x$ac_zstd != xno; then
AC_MSG_RESULT(yes)
PKG_CHECK_MODULES(LIBZSTD, [libzstd >= 1.3.0], [with_libzstd=yes], [with_libzstd=no])
- if test "${with_libzstd}" = "yes" && test "${has_zstd_h}" = "yes"; then
+ if test "${with_libzstd}" = "yes"; then
AC_DEFINE([HAVE_LIBZSTD], 1, [Define if ZSTD compression is enabled.])
if test "x$GNUTLS_REQUIRES_PRIVATE" = "x"; then
GNUTLS_REQUIRES_PRIVATE="Requires.private: libzstd"
GitLab

View File

@ -22,7 +22,7 @@ RESTRICT="!test? ( test )"
# use system libopts
RDEPEND=">=dev-libs/libtasn1-4.9:=[${MULTILIB_USEDEP}]
dev-libs/libunistring:=[${MULTILIB_USEDEP}]
>=dev-libs/nettle-3.4.1:=[gmp,${MULTILIB_USEDEP}]
>=dev-libs/nettle-3.6:=[gmp,${MULTILIB_USEDEP}]
>=dev-libs/gmp-5.1.3-r1:=[${MULTILIB_USEDEP}]
tools? ( sys-devel/autogen:= )
dane? ( >=net-dns/unbound-1.4.20:=[${MULTILIB_USEDEP}] )
@ -42,7 +42,7 @@ BDEPEND=">=virtual/pkgconfig-0-r1
test-full? (
app-crypt/dieharder
>=app-misc/datefudge-1.22
dev-libs/softhsm:2[-bindist]
dev-libs/softhsm:2[-bindist(-)]
net-dialup/ppp
net-misc/socat
)"
@ -54,8 +54,6 @@ DOCS=(
HTML_DOCS=()
PATCHES=( "${FILESDIR}"/${PN}-3.6.15-skip-dtls-seccomp-tests.patch )
pkg_setup() {
# bug#520818
export TZ=UTC

View File

@ -1,4 +1,4 @@
# Copyright 1999-2021 Gentoo Authors
# Copyright 1999-2022 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2
EAPI=7
@ -11,20 +11,16 @@ SRC_URI="mirror://gnupg/gnutls/v$(ver_cut 1-2)/${P}.tar.xz"
LICENSE="GPL-3 LGPL-2.1+"
SLOT="0/30" # libgnutls.so number
KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
KEYWORDS="~alpha amd64 arm ~arm64 hppa ~ia64 ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
IUSE="+cxx dane doc examples guile +idn nls +openssl pkcs11 seccomp sslv2 sslv3 static-libs test test-full +tls-heartbeat tools valgrind"
REQUIRED_USE="
test-full? ( cxx dane doc examples guile idn nls openssl pkcs11 seccomp tls-heartbeat tools )"
REQUIRED_USE="test-full? ( cxx dane doc examples guile idn nls openssl pkcs11 seccomp tls-heartbeat tools )"
RESTRICT="!test? ( test )"
# NOTICE: sys-devel/autogen is required at runtime as we
# use system libopts
RDEPEND=">=dev-libs/libtasn1-4.9:=[${MULTILIB_USEDEP}]
dev-libs/libunistring:=[${MULTILIB_USEDEP}]
>=dev-libs/nettle-3.6:=[gmp,${MULTILIB_USEDEP}]
>=dev-libs/gmp-5.1.3-r1:=[${MULTILIB_USEDEP}]
tools? ( sys-devel/autogen:= )
dane? ( >=net-dns/unbound-1.4.20:=[${MULTILIB_USEDEP}] )
guile? ( >=dev-scheme/guile-2:=[networking] )
nls? ( >=virtual/libintl-0-r1:=[${MULTILIB_USEDEP}] )
@ -37,25 +33,21 @@ DEPEND="${RDEPEND}
BDEPEND=">=virtual/pkgconfig-0-r1
doc? ( dev-util/gtk-doc )
nls? ( sys-devel/gettext )
tools? ( sys-devel/autogen )
valgrind? ( dev-util/valgrind )
test-full? (
app-crypt/dieharder
>=app-misc/datefudge-1.22
dev-libs/softhsm:2[-bindist]
dev-libs/softhsm:2[-bindist(-)]
net-dialup/ppp
net-misc/socat
)"
DOCS=(
README.md
doc/certtool.cfg
)
DOCS=( README.md doc/certtool.cfg )
HTML_DOCS=()
pkg_setup() {
# bug#520818
# bug #520818
export TZ=UTC
use doc && HTML_DOCS+=(
@ -66,12 +58,6 @@ pkg_setup() {
src_prepare() {
default
# force regeneration of autogen-ed files
local file
for file in $(grep -l AutoGen-ed src/*.c) ; do
rm src/$(basename ${file} .c).{c,h} || die
done
# don't try to use system certificate store on macOS, it is
# confusingly ignoring our ca-certificates and more importantly
# fails to compile in certain configurations
@ -87,9 +73,12 @@ multilib_src_configure() {
local libconf=()
# TPM needs to be tested before being enabled
libconf+=( --without-tpm )
libconf+=(
--without-tpm
--without-tpm2
)
# hardware-accell is disabled on OSX because the asm files force
# hardware-accel is disabled on OSX because the asm files force
# GNU-stack (as doesn't support that) and when that's removed ld
# complains about duplicate symbols
[[ ${CHOST} == *-darwin* ]] && libconf+=( --disable-hardware-acceleration )
@ -118,8 +107,8 @@ multilib_src_configure() {
$(use_with idn)
$(use_with pkcs11 p11-kit)
--disable-rpath
--with-default-trust-store-file="${EPREFIX}/etc/ssl/certs/ca-certificates.crt"
--with-unbound-root-key-file="${EPREFIX}/etc/dnssec/root-anchors.txt"
--with-default-trust-store-file="${EPREFIX}"/etc/ssl/certs/ca-certificates.crt
--with-unbound-root-key-file="${EPREFIX}"/etc/dnssec/root-anchors.txt
--without-included-libtasn1
$("${S}/configure" --help | grep -o -- '--without-.*-prefix')
)

View File

@ -0,0 +1,153 @@
# Copyright 1999-2022 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2
EAPI=7
VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/gnutls.asc
inherit autotools multilib-minimal verify-sig
DESCRIPTION="A secure communications library implementing the SSL, TLS and DTLS protocols"
HOMEPAGE="https://www.gnutls.org/"
SRC_URI="mirror://gnupg/gnutls/v$(ver_cut 1-2)/${P}.tar.xz"
SRC_URI+=" verify-sig? ( mirror://gnupg/gnutls/v$(ver_cut 1-2)/${P}.tar.xz.sig )"
LICENSE="GPL-3 LGPL-2.1+"
SLOT="0/30" # libgnutls.so number
# Drop keywords while figuring out what to do (if anything) about USE=cxx ABI break
# https://gitlab.com/gnutls/gnutls/-/commit/f746f7d4be0070395834bef8e7f7b6f9c8d3158b
#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
IUSE="brotli +cxx dane doc examples guile +idn nls +openssl pkcs11 seccomp sslv2 sslv3 static-libs test test-full +tls-heartbeat tools valgrind zlib zstd"
REQUIRED_USE="test-full? ( cxx dane doc examples guile idn nls openssl pkcs11 seccomp tls-heartbeat tools )"
RESTRICT="!test? ( test )"
RDEPEND=">=dev-libs/libtasn1-4.9:=[${MULTILIB_USEDEP}]
dev-libs/libunistring:=[${MULTILIB_USEDEP}]
>=dev-libs/nettle-3.6:=[gmp,${MULTILIB_USEDEP}]
>=dev-libs/gmp-5.1.3-r1:=[${MULTILIB_USEDEP}]
brotli? ( >=app-arch/brotli-1.0.0:=[${MULTILIB_USEDEP}] )
dane? ( >=net-dns/unbound-1.4.20:=[${MULTILIB_USEDEP}] )
guile? ( >=dev-scheme/guile-2:=[networking] )
nls? ( >=virtual/libintl-0-r1:=[${MULTILIB_USEDEP}] )
pkcs11? ( >=app-crypt/p11-kit-0.23.1[${MULTILIB_USEDEP}] )
idn? ( >=net-dns/libidn2-0.16-r1:=[${MULTILIB_USEDEP}] )
zlib? ( sys-libs/zlib[${MULTILIB_USEDEP}] )
zstd? ( >=app-arch/zstd-1.3.0:=[${MULTILIB_USEDEP}] )"
DEPEND="${RDEPEND}
test? (
seccomp? ( sys-libs/libseccomp )
)"
BDEPEND="
dev-util/gtk-doc-am
>=virtual/pkgconfig-0-r1
doc? ( dev-util/gtk-doc )
nls? ( sys-devel/gettext )
valgrind? ( dev-util/valgrind )
test-full? (
app-crypt/dieharder
>=app-misc/datefudge-1.22
dev-libs/softhsm:2[-bindist(-)]
net-dialup/ppp
net-misc/socat
)
verify-sig? ( >=sec-keys/openpgp-keys-gnutls-20220320 )"
DOCS=( README.md doc/certtool.cfg )
HTML_DOCS=()
PATCHES=(
"${FILESDIR}"/${P}-configure-compression.patch
)
pkg_setup() {
# bug #520818
export TZ=UTC
use doc && HTML_DOCS+=(
doc/gnutls.html
)
}
src_prepare() {
default
# don't try to use system certificate store on macOS, it is
# confusingly ignoring our ca-certificates and more importantly
# fails to compile in certain configurations
sed -i -e 's/__APPLE__/__NO_APPLE__/' lib/system/certs.c || die
# Use sane .so versioning on FreeBSD.
#elibtoolize
# Need eautoreconf for:
# 1) gtk-doc macro fix
# (once fixed, we can drop unconditional gtk-doc-am BDEPEND too)
# see https://gitlab.com/gnutls/gnutls/-/issues/1341
#
# 2) configure fixes for brotli, zstd
# see https://gitlab.com/gnutls/gnutls/-/issues/1343
eautoreconf
}
multilib_src_configure() {
LINGUAS="${LINGUAS//en/en@boldquot en@quot}"
local libconf=()
# TPM needs to be tested before being enabled
# Note that this may add a libltdl dep when enabled. Check configure.ac.
libconf+=(
--without-tpm
--without-tpm2
)
# hardware-accel is disabled on OSX because the asm files force
# GNU-stack (as doesn't support that) and when that's removed ld
# complains about duplicate symbols
[[ ${CHOST} == *-darwin* ]] && libconf+=( --disable-hardware-acceleration )
# Cygwin as does not understand these asm files at all
[[ ${CHOST} == *-cygwin* ]] && libconf+=( --disable-hardware-acceleration )
local myeconfargs=(
$(multilib_native_enable manpages)
$(multilib_native_use_enable doc gtk-doc)
$(multilib_native_use_enable doc)
$(multilib_native_use_enable guile)
$(multilib_native_use_enable seccomp seccomp-tests)
$(multilib_native_use_enable test tests)
$(multilib_native_use_enable test-full full-test-suite)
$(multilib_native_use_enable tools)
$(multilib_native_use_enable valgrind valgrind-tests)
$(use_enable cxx)
$(use_enable dane libdane)
$(use_enable nls)
$(use_enable openssl openssl-compatibility)
$(use_enable sslv2 ssl2-support)
$(use_enable sslv3 ssl3-support)
$(use_enable static-libs static)
$(use_enable tls-heartbeat heartbeat-support)
$(use_with brotli)
$(use_with idn)
$(use_with pkcs11 p11-kit)
$(use_with zlib)
$(use_with zstd)
--disable-rpath
--with-default-trust-store-file="${EPREFIX}"/etc/ssl/certs/ca-certificates.crt
--with-unbound-root-key-file="${EPREFIX}"/etc/dnssec/root-anchors.txt
--without-included-libtasn1
$("${S}/configure" --help | grep -o -- '--without-.*-prefix')
)
ECONF_SOURCE="${S}" econf "${libconf[@]}" "${myeconfargs[@]}"
}
multilib_src_install_all() {
einstalldocs
find "${ED}" -type f -name '*.la' -delete || die
if use examples; then
docinto examples
dodoc doc/examples/*.c
fi
}

View File

@ -1,10 +1,13 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
<pkgmetadata>
<maintainer type="project">
<email>base-system@gentoo.org</email>
</maintainer>
<use>
<flag name="brotli">
Enable brotli decompression support via <pkg>app-arch/brotli</pkg>
</flag>
<flag name="dane">
Build libgnutls-dane, implementing DNS-based Authentication of
Named Entities. Requires <pkg>net-dns/unbound</pkg>