From e1e7339fdd1d683facc7b33725e00fe1cf26d789 Mon Sep 17 00:00:00 2001 From: Sayan Chowdhury Date: Fri, 26 Feb 2021 09:41:18 +0000 Subject: [PATCH 1/2] dev-libs/openssl: Sync with Gentoo upstream Gentoo ref: c0914ae91cb25cbe8c143e2ce3de514cfd8294eb Signed-off-by: Sayan Chowdhury --- .../coreos-overlay/dev-libs/openssl/Manifest | 8 +++-- .../openssl/files/gentoo.config-1.0.2 | 3 +- .../dev-libs/openssl/files/openssl.conf | 3 -- ...sl-1.1.1g.ebuild => openssl-1.1.1j.ebuild} | 35 +++++++++---------- 4 files changed, 25 insertions(+), 24 deletions(-) delete mode 100644 sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/files/openssl.conf rename sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/{openssl-1.1.1g.ebuild => openssl-1.1.1j.ebuild} (93%) diff --git a/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/Manifest b/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/Manifest index 860cf1106d..0463b52873 100644 --- a/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/Manifest +++ b/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/Manifest @@ -1,2 +1,6 @@ -DIST openssl-1.1.1e-bindist-1.0.tar.xz 16948 BLAKE2B 78e034f1d263cbf5e57c92393f72acd07e86e39a5511a8852bad151371430954e07d787fd82cca55b373d1579bb22b9d29c9d677104ed68291a9d2dffe3ffbbb SHA512 0dbfb378b8f2724db82915e17fd4e43977e3e45030db25cdb9241c0ab842e41ef3d597ef71c4db5103635752dc2059ea6022597511a440f55fb56a5a52d3ccea -DIST openssl-1.1.1g.tar.gz 9801502 BLAKE2B 5e3dd4725ff89b959a5436d64b521317c6ffeb377418cc24c6d1927fab923423cb5f5fce2f9c2cdee597041c7be156d09668a5fd13dc6ff06d235a83db94cf19 SHA512 01e3d0b1bceeed8fb066f542ef5480862001556e0f612e017442330bbd7e5faee228b2de3513d7fc347446b7f217e27de1003dc9d7214d5833b97593f3ec25ab +DIST openssl-1.0.2-patches-1.5.tar.xz 12404 BLAKE2B 6c1b8c28f339f539b2ab8643379502a24cf62bffde00041dce54d5dd9e8d2620b181362ee5464b0ab32ba4948e209697bfabadbea2944a409a1009100d298f24 SHA512 5725e2d9d1ee8cc074bcef3bed61c71bdab2ff1c114362110c3fb8da11ad5bc8f2ff28e90a293f5f3a5cf96ecda54dffdb7ab3fb3f8b23ef6472250dc3037659 +DIST openssl-1.0.2t-bindist-1.0.tar.xz 13872 BLAKE2B b2aade96a6e0ca6209a39e205b1c838de945903fcf959c62cc29ddcd1a0cb360fc5db234df86860a6a4c096f5ecc237611e4c2946b986a5500c24ba93c208ef4 SHA512 a48a7efb9b973b865bcc5009d450b428ed6b4b95e4cefe70c51056e47392c8a7bec58215168d8b07712419dc74646c2bd2fd23bcfbba2031376e292249a6b1b6 +DIST openssl-1.0.2u.tar.gz 5355412 BLAKE2B b2ff2a10e5851af5aca4093422a9a072c794e87b997263826c1c35910c040f695fac63decac5856cb49399ed03d410f97701d9fd4e1ebfbcacd8f3a74ce8bf57 SHA512 c455bb309e20e2c2d47fdc5619c734d107d5c8c38c1409903ce979acc120b0d5fa0312917c0aa0d630e402d092a703d4249643f36078e8528a3cafc9dac6ab32 +DIST openssl-1.1.1i-bindist-1.0.tar.xz 18124 BLAKE2B bcbce700676d1d61498ac98281b7ad06f9970d91afa6bfb2c259ab7462b2554be79a1c06759bc7aaeca9948c2f5276bac2c4f42dbc6822669f863444b9913ccd SHA512 1dbb81bcb4cf7e634bb363c7e2bb2590a1fe3fcb6c3b5e377cac3c5241abd116c2a89c516be8e5fd1799ab64375a58052a4df944eeadc87b0b7785da710906d8 +DIST openssl-1.1.1i.tar.gz 9808346 BLAKE2B ca98bab08e1874134da113dd0bda0583c133c7dce5b739f9601641ed2cf97894e5e13d901f0db9367aa5d7b78c552ac598aa0a3c2a3f0a438daae044e29f58d6 SHA512 fe12e0ab9e1688f24dd862ac633d0ab703b499c0f34b53c3560aa0d3879d81d647aa0678ed517dda5efb2711f669fcb1a1e0e24f6eac2efc2cf4eae6b62014d8 +DIST openssl-1.1.1j.tar.gz 9823161 BLAKE2B e5699abeca83acd82546e74a0645f2a765d51f22226f8c537d92285eb0b11e12b0a9476cbd3cb6a594e9840433d713be39884fb4dcd5c3968b36ad4f582ed23a SHA512 51e44995663b5258b0018bdc1e2b0e7e8e0cce111138ca1f80514456af920fce4e409a411ce117c0f3eb9190ac3e47c53a43f39b06acd35b7494e2bec4a607d5 diff --git a/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/files/gentoo.config-1.0.2 b/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/files/gentoo.config-1.0.2 index 4e88dbabf1..68d7d0ac1f 100644 --- a/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/files/gentoo.config-1.0.2 +++ b/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/files/gentoo.config-1.0.2 @@ -1,5 +1,5 @@ #!/usr/bin/env bash -# Copyright 1999-2018 Gentoo Foundation +# Copyright 1999-2020 Gentoo Authors # Distributed under the terms of the GNU General Public License v2 # # Openssl doesn't play along nicely with cross-compiling @@ -104,6 +104,7 @@ linux) powerpc64*) machine=ppc64;; powerpc*le*) machine="generic32 -DL_ENDIAN";; powerpc*) machine=ppc;; + riscv32*) machine="generic32 -DL_ENDIAN";; riscv64*) machine="generic64 -DL_ENDIAN";; # sh64*) machine=elf;; sh*b*) machine="generic32 -DB_ENDIAN";; diff --git a/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/files/openssl.conf b/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/files/openssl.conf deleted file mode 100644 index ce86101ce7..0000000000 --- a/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/files/openssl.conf +++ /dev/null @@ -1,3 +0,0 @@ -d /etc/ssl - - - - - -d /etc/ssl/private 0700 - - - - -L /etc/ssl/openssl.cnf - - - - ../../usr/share/ssl/openssl.cnf diff --git a/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/openssl-1.1.1g.ebuild b/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/openssl-1.1.1j.ebuild similarity index 93% rename from sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/openssl-1.1.1g.ebuild rename to sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/openssl-1.1.1j.ebuild index 15370319b0..2763945ae1 100644 --- a/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/openssl-1.1.1g.ebuild +++ b/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/openssl-1.1.1j.ebuild @@ -1,12 +1,9 @@ -# Difference to upstream from ./update_ebuilds: -# - Ported changes from 7b591fb2e0ec7a0f9fe43218f9196d825b5f9653 -# -# Copyright 1999-2020 Gentoo Authors +# Copyright 1999-2021 Gentoo Authors # Distributed under the terms of the GNU General Public License v2 EAPI="7" -inherit flag-o-matic toolchain-funcs multilib multilib-minimal systemd +inherit flag-o-matic toolchain-funcs multilib multilib-minimal MY_P=${P/_/-} @@ -17,7 +14,7 @@ MY_P=${P/_/-} # - ec_curve.c (SOURCE12) -- MODIFIED # - ectest.c (SOURCE13) # - openssl-1.1.1-ec-curves.patch (PATCH37) -- MODIFIED -BINDIST_PATCH_SET="openssl-1.1.1e-bindist-1.0.tar.xz" +BINDIST_PATCH_SET="openssl-1.1.1i-bindist-1.0.tar.xz" DESCRIPTION="full-strength general purpose cryptography library (including SSL and TLS)" HOMEPAGE="https://www.openssl.org/" @@ -32,7 +29,7 @@ SLOT="0/1.1" # .so version of libssl/libcrypto [[ "${PV}" = *_pre* ]] || \ KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv s390 sparc x86 ~x86-linux" IUSE="+asm bindist elibc_musl rfc3779 sctp cpu_flags_x86_sse2 sslv3 static-libs test tls-heartbeat vanilla zlib" -RESTRICT=" +RESTRICT="!bindist? ( bindist ) !test? ( test )" RDEPEND=">=app-misc/c_rehash-1.7-r1 @@ -50,6 +47,7 @@ PDEPEND="app-misc/ca-certificates" PATCHES=( "${FILESDIR}"/${PN}-1.1.0j-parallel_install_fix.patch #671602 + "${FILESDIR}"/${PN}-1.1.1i-riscv32.patch ) S="${WORKDIR}/${MY_P}" @@ -212,6 +210,7 @@ multilib_src_configure() { enable-camellia \ enable-ec \ $(use_ssl !bindist ec2m) \ + $(use_ssl !bindist sm2) \ enable-srp \ $(use elibc_musl && echo "no-async") \ ${ec_nistp_64_gcc_128} \ @@ -287,6 +286,9 @@ multilib_src_install_all() { # twice; once with shared lib support enabled and once without. use static-libs || rm -f "${ED}"/usr/lib*/lib*.a + # create the certs directory + keepdir ${SSL_CNF_DIR}/certs + # Namespace openssl programs to prevent conflicts with other man pages cd "${ED}"/usr/share/man || die local m d s @@ -313,15 +315,12 @@ multilib_src_install_all() { dodir /etc/sandbox.d #254521 echo 'SANDBOX_PREDICT="/dev/crypto"' > "${ED}"/etc/sandbox.d/10openssl - # Don't keep the sample CA files and their ilk in /etc. - rm -r "${ED}"${SSL_CNF_DIR} - - # Save the default openssl.cnf in /usr and link it into place. - dodir /usr/share/ssl - insinto /usr/share/ssl - doins "${S}"/apps/openssl.cnf - systemd_dotmpfilesd "${FILESDIR}"/openssl.conf - - # Package the tmpfiles.d setup for SDK bootstrapping. - systemd-tmpfiles --create --root="${ED}" "${FILESDIR}"/openssl.conf + diropts -m0700 + keepdir ${SSL_CNF_DIR}/private +} + +pkg_postinst() { + ebegin "Running 'c_rehash ${EROOT}${SSL_CNF_DIR}/certs/' to rebuild hashes #333069" + c_rehash "${EROOT}${SSL_CNF_DIR}/certs" >/dev/null + eend $? } From 26b27b7ac5c20e0d623a6ac6d85a88837acb4ab1 Mon Sep 17 00:00:00 2001 From: Sayan Chowdhury Date: Fri, 26 Feb 2021 09:41:18 +0000 Subject: [PATCH 2/2] dev-libs/openssl: Apply Flatcar changes - Drop binddist from RESTRICT variable - Drop pkg_postinst - Create /etc/ssl with tmpfiles (and package it for the SDK). Signed-off-by: Sayan Chowdhury --- .../dev-libs/openssl/files/openssl.conf | 3 +++ .../dev-libs/openssl/openssl-1.1.1j.ebuild | 25 +++++++++---------- .../profiles/coreos/base/package.unmask | 2 +- 3 files changed, 16 insertions(+), 14 deletions(-) create mode 100644 sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/files/openssl.conf diff --git a/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/files/openssl.conf b/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/files/openssl.conf new file mode 100644 index 0000000000..ce86101ce7 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/files/openssl.conf @@ -0,0 +1,3 @@ +d /etc/ssl - - - - - +d /etc/ssl/private 0700 - - - - +L /etc/ssl/openssl.cnf - - - - ../../usr/share/ssl/openssl.cnf diff --git a/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/openssl-1.1.1j.ebuild b/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/openssl-1.1.1j.ebuild index 2763945ae1..441d5d75d2 100644 --- a/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/openssl-1.1.1j.ebuild +++ b/sdk_container/src/third_party/coreos-overlay/dev-libs/openssl/openssl-1.1.1j.ebuild @@ -3,7 +3,7 @@ EAPI="7" -inherit flag-o-matic toolchain-funcs multilib multilib-minimal +inherit flag-o-matic toolchain-funcs multilib multilib-minimal systemd MY_P=${P/_/-} @@ -29,7 +29,7 @@ SLOT="0/1.1" # .so version of libssl/libcrypto [[ "${PV}" = *_pre* ]] || \ KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv s390 sparc x86 ~x86-linux" IUSE="+asm bindist elibc_musl rfc3779 sctp cpu_flags_x86_sse2 sslv3 static-libs test tls-heartbeat vanilla zlib" -RESTRICT="!bindist? ( bindist ) +RESTRICT=" !test? ( test )" RDEPEND=">=app-misc/c_rehash-1.7-r1 @@ -47,7 +47,6 @@ PDEPEND="app-misc/ca-certificates" PATCHES=( "${FILESDIR}"/${PN}-1.1.0j-parallel_install_fix.patch #671602 - "${FILESDIR}"/${PN}-1.1.1i-riscv32.patch ) S="${WORKDIR}/${MY_P}" @@ -286,9 +285,6 @@ multilib_src_install_all() { # twice; once with shared lib support enabled and once without. use static-libs || rm -f "${ED}"/usr/lib*/lib*.a - # create the certs directory - keepdir ${SSL_CNF_DIR}/certs - # Namespace openssl programs to prevent conflicts with other man pages cd "${ED}"/usr/share/man || die local m d s @@ -315,12 +311,15 @@ multilib_src_install_all() { dodir /etc/sandbox.d #254521 echo 'SANDBOX_PREDICT="/dev/crypto"' > "${ED}"/etc/sandbox.d/10openssl - diropts -m0700 - keepdir ${SSL_CNF_DIR}/private -} + # Don't keep the sample CA files and their ilk in /etc. + rm -r "${ED}"${SSL_CNF_DIR} -pkg_postinst() { - ebegin "Running 'c_rehash ${EROOT}${SSL_CNF_DIR}/certs/' to rebuild hashes #333069" - c_rehash "${EROOT}${SSL_CNF_DIR}/certs" >/dev/null - eend $? + # Save the default openssl.cnf in /usr and link it into place. + dodir /usr/share/ssl + insinto /usr/share/ssl + doins "${S}"/apps/openssl.cnf + systemd_dotmpfilesd "${FILESDIR}"/openssl.conf + + # Package the tmpfiles.d setup for SDK bootstrapping. + systemd-tmpfiles --create --root="${ED}" "${FILESDIR}"/openssl.conf } diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.unmask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.unmask index dda882338a..5751784c07 100644 --- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.unmask +++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.unmask @@ -1,5 +1,5 @@ # Overwrite outdated portage-stable mask -=dev-libs/openssl-1.1.1g +=dev-libs/openssl-1.1.1j # Overwrite portage-stable mask - this package was removed in # gentoo. We still need it, since sys-libs/libsemanage still requires