mirror of
https://github.com/flatcar/scripts.git
synced 2025-08-10 22:46:58 +02:00
dev-libs/openssl: Sync with Gentoo
It's from Gentoo commit 25a3482b60d25142e6f7607a868722004dbcdec0.
This commit is contained in:
Flatcar Buildbot
Krzesimir Nowak
parent
6302e81072
commit
a2e8a13f12
@ -3,20 +3,12 @@ DIST openssl-1.0.2t-bindist-1.0.tar.xz 13872 BLAKE2B b2aade96a6e0ca6209a39e205b1
|
||||
DIST openssl-1.0.2u.tar.gz 5355412 BLAKE2B b2ff2a10e5851af5aca4093422a9a072c794e87b997263826c1c35910c040f695fac63decac5856cb49399ed03d410f97701d9fd4e1ebfbcacd8f3a74ce8bf57 SHA512 c455bb309e20e2c2d47fdc5619c734d107d5c8c38c1409903ce979acc120b0d5fa0312917c0aa0d630e402d092a703d4249643f36078e8528a3cafc9dac6ab32
|
||||
DIST openssl-1.1.1w.tar.gz 9893384 BLAKE2B 2fdba6ca0188928ab2f74e606136afca66cfa0467170fa6298ef160b64ac6fdcad1e81e5dd14013ce0e9921d0f7417edec531cd0beaf1196fec704c2c6d48395 SHA512 b4c625fe56a4e690b57b6a011a225ad0cb3af54bd8fb67af77b5eceac55cc7191291d96a660c5b568a08a2fbf62b4612818e7cca1bb95b2b6b4fc649b0552b6d
|
||||
DIST openssl-1.1.1w.tar.gz.asc 833 BLAKE2B d990be69ed913509d52b78e7473668429d4485adb29ef03e4612dd0cadbac4f04c7289d8e5baf6f397bcedeaac9f802f18fc719964d882ae0514ed1ca16ae277 SHA512 0f3d7aa48b1cabf8dd43e8108aeed10a4dffb4f5a244d4da9c86ea358b0c8b90c46da561d21e01c567c2f5035d824ed82ec104aad1776b7f33a1be85990e98ef
|
||||
DIST openssl-3.0.15.tar.gz 15318633 BLAKE2B f2900d0894b97e86c709079ca4336d5dc508d69e91d3a4de4420c8d9344cb54dada6ea2cdd408166e53db0c652b06654e670701166b67a0a40578676e1cea535 SHA512 acd80f2f7924d90c1416946a5c61eff461926ad60f4821bb6b08845ea18f8452fd5e88a2c2c5bd0d7590a792cb8341a3f3be042fd0a5b6c9c1b84a497c347bbf
|
||||
DIST openssl-3.0.15.tar.gz.asc 833 BLAKE2B 43088d6ae9e95aec8cfa08c0d338d76c2299ee89a1719a39c497b25c83a4c0c2d155fa00a62b47e15a7f2889680197741390c850d62a84ec5ce27ed1bbddcd28 SHA512 8b9471074130fd26b511820a1c2586792fd0105421515734c213ae18de27b5b026261e64d4cb8f5e7b568d1f4193484ebe0e99eda9d99df72474310a568ca3bf
|
||||
DIST openssl-3.0.16.tar.gz 15334967 BLAKE2B a1bcaf17c92beca6ff7f39857788120648904ef1dd25ffa2e43bd5477810e8c18751929d5ed270e7f429c569c5b5fdf069f1280646d8b4d1e879f15dfa03f7d9 SHA512 5eea2b0c60d870549fc2b8755f1220a57f870d95fbc8d5cc5abb9589f212d10945f355c3e88ff48540a7ee1c4db774b936023ca33d7c799ea82d91eef9c1c16d
|
||||
DIST openssl-3.0.16.tar.gz.asc 833 BLAKE2B 5f288f4b1e3a85181a73f288c7cb2d2e6e54e09b3ba032a6074c207f1f53d2920f4cdbbc9143a60063b3426eaa0279af4b1ed59b6b909047051ce73caff03584 SHA512 8b9688ecf84cb61b2718fc898eb748a8eb1ad9125f4742b09552d81bce098753dcbc36cdee9a30adbe4127de30938d955a7af12f8619338bcf2e2e748c8e8c86
|
||||
DIST openssl-3.1.7.tar.gz 15684836 BLAKE2B 1332f4b2454b6c9bf3ff2099aa343d6202bec98c6e44fba6377d5bb8efd9bf337df3a95549d874a2908f376056f6f333e6f65cbec7e27377d1ab8cbefddaa241 SHA512 bb4743c1a95148901d2d2bc51460c14cea3387c7dda9323524adbdb11334562f72aa3a873913c51ea1ffce606e675e22a74f78b3119b6a956da3f75c942cd0e2
|
||||
DIST openssl-3.1.7.tar.gz.asc 833 BLAKE2B 17220aa3274a5eda3df8c04f60f87a48fcf5c773167e746bf3f9feb6cc3c03b024a2e83b1c93122b6baa073b12417e2910230f270287be7b7f2c5300814b7fda SHA512 89b6f4b913aac8b2519aac586ba0c70a3df331eb70ea79c2aa45355bfd9430ba1af3c8ea0d31b171f55036a8cc332207787cabf58da871f400d666a5ae09ce2a
|
||||
DIST openssl-3.1.8.tar.gz 15706439 BLAKE2B 05d8ac054bc46ac6196470bd388ef8be2d2dd62c14bb22fff668ab8e8914bb8d89eb78119ba49839a364ca4c3683186299a9bfbf6a03d83a8630b54e668e5977 SHA512 faf066b207184a67387d4659b68de0bb89c4ec847b835998c8cc57ee4a8759f3fc3b7fe2db85f394bf8c54720ce044447168e0fa2fda6f0901c4d9a1697d9a6e
|
||||
DIST openssl-3.1.8.tar.gz.asc 833 BLAKE2B b9f1f439ff373d4b3706cfd9d2518d84aca1744ae50a31c50cb7fd4aa9de1d4139fc314390353377391a99b3d6c9ea66b0160d7fed15bdf4c9a255e94654eb80 SHA512 0737d62b6971f311936908d7cf3eb6c01e1ae314709bc80cfdbe885d17c64337fd2378a1e93c932f870681efc992a8d0656625580e30cc9e3d397aa4ebb7c7e6
|
||||
DIST openssl-3.2.3.tar.gz 17762604 BLAKE2B 1445336aa92d0fd9df266ad570fe2bf5701279e462dd3fccd4cf662f328bfee923dc6c72c42c1921fd38bce43e1c60cacdec3f1c2963fe0ffda6a0e8e34ac6e4 SHA512 9e9f06ab630914e32e64bfb945dfa375ea3595b3db4eb8ef68288a58909baf753b34998439907c22ff2b8561cfd3f3f6b7fbf22981479e66a98c2e92fda172a2
|
||||
DIST openssl-3.2.3.tar.gz.asc 833 BLAKE2B 5a7289ed40534a058b9eb7686ce444b9d453a2973ab7ebda01c99f7245f6ba19197123f8bb3b16940d4bfbc5e313babc0249f280e55911190b47da3a47ed1e6a SHA512 e727adb88f84c48082ef0cae963bf999cce11619f7322014cc7f36c16e8375a60542f518c1b86319208cf8da33044e942b3d65208bc59fd4a5f522ab78ff1c23
|
||||
DIST openssl-3.2.4.tar.gz 17782746 BLAKE2B 079a0eb15b960a8ec89a2b2ccfa1f5e216dac325cb0857e168119fb240b6cdd78ecf723802a53d1e62e0a534be60e5459f561de764d1987e38eab466e555f994 SHA512 24712cb722ed8daff51db9deec4db982256cccd1a537d3a8690a94a6fd41815fd85cab95e551212938f28a61ed658d285b07734f7b88d8a0b18a318602d424f2
|
||||
DIST openssl-3.2.4.tar.gz.asc 833 BLAKE2B 27c55522889843a14133535d47ad1fc7b2eba7a6f7fd0f78a8be8f36492ff53932b1a50131e90a37c3c22ba60b188b9dff98717756c4a20f361b22d069482399 SHA512 a381b24bd47a2e00657a29af02aa890b22186de70ba3ac3776ff5d4fb40579e9fd8356aacb6ce230d40adb6765e906b8d9bda54f98cc8887e98069f9bfd10140
|
||||
DIST openssl-3.3.2.tar.gz 18076531 BLAKE2B cc53d45418673bc2a406d6697b8bd17ff6c726463c4ccc87bb2fa5a6592d0d178dc8cfeb2fbb980ea354a5dc2c86f31c48453427c6937896c7221273e623c9b5 SHA512 5ae47bf1aed2740a33ba5df7dc7345a6738aa6bfa3c9c4de5e51742485e24b25192988d7a2c1b8201ef70056ad8abd0ca78b3d55abe24c0b0373d83b47ed9b74
|
||||
DIST openssl-3.3.2.tar.gz.asc 833 BLAKE2B c318e2dcef085b83ced77048dc136d9bc8438d49a7985f3c6ebd4ffd0e5e290ece47e8fd1074c6cc056e87b2bae2101dd58b8d70dbc0eb99aa134d776125439c SHA512 981f8438bbd541b97e745aca1bb77cde68900ce4b5ffefc9eccc2f18c675292203f6b4c7bffefde2256a442b7310d8438279b52fb21aac65921e9a529bc00067
|
||||
DIST openssl-3.3.3.tar.gz 18102481 BLAKE2B c2033e357963e339faaf3b35b18c660da48616a6228e802a3ef1c4a6a51a570db42970d973868c4d57afcd3953403c9ff047317cac49a865af628abde99c2ade SHA512 4f53d963c258305f0e926d2e56fc73359c3d62adb25bfce06889eef3278652d073b9e2a4100a884c0d8ee90cb924ba258a5de4e7be6d2c7c49765167e95430d7
|
||||
DIST openssl-3.3.3.tar.gz.asc 833 BLAKE2B dbb8436f7e8e015eca740ccddcbfc159884089c7540e47d03d65efcc607a28d29889f7eaf53412e50362d201941df3061e7877b6216215d4cab04bdb149d23a7 SHA512 2fde16310fc0a2985ea9df5b8485c17391a589297679687634b833b453e9c5d04ddb3b8b4f117259af9b13813ca0ea9ee6cec2d854dfc7e1add3dbb78962ccd0
|
||||
DIST openssl-3.4.1.tar.gz 18346056 BLAKE2B 328a2a4f0536b15ffe6421afc99bdb5dcdf3d29f44437fdd80bbf4089f5f2658ca10907e033eda2e04c6b862e49b150ea59d8ab1807d14a3dcf64e10c32e78af SHA512 1de6307c587686711f05d1e96731c43526fa3af51e4cd94c06c880954b67f6eb4c7db3177f0ea5937d41bc1f8cadcf5bce75025b5c1a46a469376960f1001c5f
|
||||
|
||||
@ -1,287 +0,0 @@
|
||||
# Copyright 1999-2025 Gentoo Authors
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
EAPI=8
|
||||
|
||||
VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssl.org.asc
|
||||
inherit edo flag-o-matic linux-info toolchain-funcs
|
||||
inherit multilib multilib-minimal multiprocessing preserve-libs verify-sig
|
||||
|
||||
DESCRIPTION="Robust, full-featured Open Source Toolkit for the Transport Layer Security (TLS)"
|
||||
HOMEPAGE="https://openssl-library.org/"
|
||||
|
||||
MY_P=${P/_/-}
|
||||
|
||||
if [[ ${PV} == 9999 ]] ; then
|
||||
EGIT_REPO_URI="https://github.com/openssl/openssl.git"
|
||||
|
||||
inherit git-r3
|
||||
else
|
||||
SRC_URI="
|
||||
https://github.com/openssl/openssl/releases/download/${P}/${P}.tar.gz
|
||||
verify-sig? (
|
||||
https://github.com/openssl/openssl/releases/download/${P}/${P}.tar.gz.asc
|
||||
)
|
||||
"
|
||||
KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
|
||||
fi
|
||||
|
||||
S="${WORKDIR}"/${MY_P}
|
||||
|
||||
LICENSE="Apache-2.0"
|
||||
SLOT="0/3" # .so version of libssl/libcrypto
|
||||
IUSE="+asm cpu_flags_x86_sse2 fips ktls rfc3779 sctp static-libs test tls-compression vanilla verify-sig weak-ssl-ciphers"
|
||||
RESTRICT="!test? ( test )"
|
||||
|
||||
COMMON_DEPEND="
|
||||
tls-compression? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] )
|
||||
"
|
||||
BDEPEND="
|
||||
>=dev-lang/perl-5
|
||||
sctp? ( >=net-misc/lksctp-tools-1.0.12 )
|
||||
test? (
|
||||
sys-apps/diffutils
|
||||
app-alternatives/bc
|
||||
sys-process/procps
|
||||
)
|
||||
verify-sig? ( >=sec-keys/openpgp-keys-openssl-20240920 )
|
||||
"
|
||||
|
||||
DEPEND="${COMMON_DEPEND}"
|
||||
RDEPEND="${COMMON_DEPEND}"
|
||||
PDEPEND="app-misc/ca-certificates"
|
||||
|
||||
MULTILIB_WRAPPED_HEADERS=(
|
||||
/usr/include/openssl/configuration.h
|
||||
)
|
||||
|
||||
PATCHES=(
|
||||
"${FILESDIR}"/${P}-CVE-2024-9143.patch
|
||||
)
|
||||
|
||||
pkg_setup() {
|
||||
if use ktls ; then
|
||||
if kernel_is -lt 4 18 ; then
|
||||
ewarn "Kernel implementation of TLS (USE=ktls) requires kernel >=4.18!"
|
||||
else
|
||||
CONFIG_CHECK="~TLS ~TLS_DEVICE"
|
||||
ERROR_TLS="You will be unable to offload TLS to kernel because CONFIG_TLS is not set!"
|
||||
ERROR_TLS_DEVICE="You will be unable to offload TLS to kernel because CONFIG_TLS_DEVICE is not set!"
|
||||
use test && CONFIG_CHECK+=" ~CRYPTO_USER_API_SKCIPHER"
|
||||
|
||||
linux-info_pkg_setup
|
||||
fi
|
||||
fi
|
||||
|
||||
[[ ${MERGE_TYPE} == binary ]] && return
|
||||
|
||||
# must check in pkg_setup; sysctl doesn't work with userpriv!
|
||||
if use test && use sctp ; then
|
||||
# test_ssl_new will fail with "Ensure SCTP AUTH chunks are enabled in kernel"
|
||||
# if sctp.auth_enable is not enabled.
|
||||
local sctp_auth_status=$(sysctl -n net.sctp.auth_enable 2>/dev/null)
|
||||
if [[ -z "${sctp_auth_status}" ]] || [[ ${sctp_auth_status} != 1 ]] ; then
|
||||
die "FEATURES=test with USE=sctp requires net.sctp.auth_enable=1!"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
src_prepare() {
|
||||
# Make sure we only ever touch Makefile.org and avoid patching a file
|
||||
# that gets blown away anyways by the Configure script in src_configure
|
||||
rm -f Makefile || die
|
||||
|
||||
if ! use vanilla ; then
|
||||
PATCHES+=(
|
||||
# Add patches which are Gentoo-specific customisations here
|
||||
)
|
||||
fi
|
||||
|
||||
default
|
||||
|
||||
if use test && use sctp && has network-sandbox ${FEATURES} ; then
|
||||
einfo "Disabling test '80-test_ssl_new.t' which is known to fail with FEATURES=network-sandbox ..."
|
||||
rm test/recipes/80-test_ssl_new.t || die
|
||||
fi
|
||||
|
||||
# Test fails depending on kernel configuration, bug #699134
|
||||
rm test/recipes/30-test_afalg.t || die
|
||||
}
|
||||
|
||||
src_configure() {
|
||||
# Keep this in sync with app-misc/c_rehash
|
||||
SSL_CNF_DIR="/etc/ssl"
|
||||
|
||||
# Quiet out unknown driver argument warnings since openssl
|
||||
# doesn't have well-split CFLAGS and we're making it even worse
|
||||
# and 'make depend' uses -Werror for added fun (bug #417795 again)
|
||||
tc-is-clang && append-flags -Qunused-arguments
|
||||
|
||||
# We really, really need to build OpenSSL w/ strict aliasing disabled.
|
||||
# It's filled with violations and it *will* result in miscompiled
|
||||
# code. This has been in the ebuild for > 10 years but even in 2022,
|
||||
# it's still relevant:
|
||||
# - https://github.com/llvm/llvm-project/issues/55255
|
||||
# - https://github.com/openssl/openssl/issues/12247
|
||||
# - https://github.com/openssl/openssl/issues/18225
|
||||
# - https://github.com/openssl/openssl/issues/18663#issuecomment-1181478057
|
||||
# Don't remove the no strict aliasing bits below!
|
||||
filter-flags -fstrict-aliasing
|
||||
append-flags -fno-strict-aliasing
|
||||
# The OpenSSL developers don't test with LTO right now, it leads to various
|
||||
# warnings/errors (which may or may not be false positives), it's considered
|
||||
# unsupported, and it's not tested in CI: https://github.com/openssl/openssl/issues/18663.
|
||||
filter-lto
|
||||
|
||||
append-flags $(test-flags-CC -Wa,--noexecstack)
|
||||
|
||||
# bug #895308
|
||||
append-atomic-flags
|
||||
# Configure doesn't respect LIBS
|
||||
export LDLIBS="${LIBS}"
|
||||
|
||||
# bug #197996
|
||||
unset APPS
|
||||
# bug #312551
|
||||
unset SCRIPTS
|
||||
# bug #311473
|
||||
unset CROSS_COMPILE
|
||||
|
||||
tc-export AR CC CXX RANLIB RC
|
||||
|
||||
multilib-minimal_src_configure
|
||||
}
|
||||
|
||||
multilib_src_configure() {
|
||||
use_ssl() { usex $1 "enable-${2:-$1}" "no-${2:-$1}" " ${*:3}" ; }
|
||||
|
||||
local krb5=$(has_version app-crypt/mit-krb5 && echo "MIT" || echo "Heimdal")
|
||||
|
||||
# See if our toolchain supports __uint128_t. If so, it's 64bit
|
||||
# friendly and can use the nicely optimized code paths, bug #460790.
|
||||
#local ec_nistp_64_gcc_128
|
||||
#
|
||||
# Disable it for now though (bug #469976)
|
||||
# Do NOT re-enable without substantial discussion first!
|
||||
#
|
||||
#echo "__uint128_t i;" > "${T}"/128.c
|
||||
#if ${CC} ${CFLAGS} -c "${T}"/128.c -o /dev/null >&/dev/null ; then
|
||||
# ec_nistp_64_gcc_128="enable-ec_nistp_64_gcc_128"
|
||||
#fi
|
||||
|
||||
local sslout=$(bash "${FILESDIR}/gentoo.config-1.0.4")
|
||||
einfo "Using configuration: ${sslout:-(openssl knows best)}"
|
||||
|
||||
# https://github.com/openssl/openssl/blob/master/INSTALL.md#enable-and-disable-features
|
||||
local myeconfargs=(
|
||||
${sslout}
|
||||
|
||||
$(use cpu_flags_x86_sse2 || echo "no-sse2")
|
||||
enable-camellia
|
||||
enable-ec
|
||||
enable-ec2m
|
||||
enable-sm2
|
||||
enable-srp
|
||||
$(use elibc_musl && echo "no-async")
|
||||
enable-idea
|
||||
enable-mdc2
|
||||
enable-rc5
|
||||
$(use fips && echo "enable-fips")
|
||||
$(use_ssl asm)
|
||||
$(use_ssl ktls)
|
||||
$(use_ssl rfc3779)
|
||||
$(use_ssl sctp)
|
||||
$(use test || echo "no-tests")
|
||||
$(use_ssl tls-compression zlib)
|
||||
$(use_ssl weak-ssl-ciphers)
|
||||
|
||||
--prefix="${EPREFIX}"/usr
|
||||
--openssldir="${EPREFIX}"${SSL_CNF_DIR}
|
||||
--libdir=$(get_libdir)
|
||||
|
||||
shared
|
||||
threads
|
||||
)
|
||||
|
||||
edo perl "${S}/Configure" "${myeconfargs[@]}"
|
||||
}
|
||||
|
||||
multilib_src_compile() {
|
||||
emake build_sw
|
||||
|
||||
if multilib_is_native_abi; then
|
||||
emake build_docs
|
||||
fi
|
||||
}
|
||||
|
||||
multilib_src_test() {
|
||||
# VFP = show subtests verbosely and show failed tests verbosely
|
||||
# Normal V=1 would show everything verbosely but this slows things down.
|
||||
emake HARNESS_JOBS="$(makeopts_jobs)" -Onone VFP=1 test
|
||||
}
|
||||
|
||||
multilib_src_install() {
|
||||
# Only -j1 is supported for the install targets:
|
||||
# https://github.com/openssl/openssl/issues/21999#issuecomment-1771150305
|
||||
emake DESTDIR="${D}" -j1 install_sw
|
||||
if use fips; then
|
||||
emake DESTDIR="${D}" -j1 install_fips
|
||||
# Regen this in pkg_preinst, bug 900625
|
||||
rm "${ED}${SSL_CNF_DIR}"/fipsmodule.cnf || die
|
||||
fi
|
||||
|
||||
if multilib_is_native_abi; then
|
||||
emake DESTDIR="${D}" -j1 install_ssldirs
|
||||
emake DESTDIR="${D}" DOCDIR='$(INSTALLTOP)'/share/doc/${PF} -j1 install_docs
|
||||
fi
|
||||
|
||||
# This is crappy in that the static archives are still built even
|
||||
# when USE=static-libs. But this is due to a failing in the openssl
|
||||
# build system: the static archives are built as PIC all the time.
|
||||
# Only way around this would be to manually configure+compile openssl
|
||||
# twice; once with shared lib support enabled and once without.
|
||||
if ! use static-libs ; then
|
||||
rm "${ED}"/usr/$(get_libdir)/lib{crypto,ssl}.a || die
|
||||
fi
|
||||
}
|
||||
|
||||
multilib_src_install_all() {
|
||||
# openssl installs perl version of c_rehash by default, but
|
||||
# we provide a shell version via app-misc/c_rehash
|
||||
rm "${ED}"/usr/bin/c_rehash || die
|
||||
|
||||
dodoc {AUTHORS,CHANGES,NEWS,README,README-PROVIDERS}.md doc/*.txt doc/${PN}-c-indent.el
|
||||
|
||||
# Create the certs directory
|
||||
keepdir ${SSL_CNF_DIR}/certs
|
||||
|
||||
# bug #254521
|
||||
dodir /etc/sandbox.d
|
||||
echo 'SANDBOX_PREDICT="/dev/crypto"' > "${ED}"/etc/sandbox.d/10openssl
|
||||
|
||||
diropts -m0700
|
||||
keepdir ${SSL_CNF_DIR}/private
|
||||
}
|
||||
|
||||
pkg_preinst() {
|
||||
if use fips; then
|
||||
# Regen fipsmodule.cnf, bug 900625
|
||||
ebegin "Running openssl fipsinstall"
|
||||
"${ED}/usr/bin/openssl" fipsinstall -quiet \
|
||||
-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
|
||||
-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so"
|
||||
eend $?
|
||||
fi
|
||||
|
||||
preserve_old_lib /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
|
||||
/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
|
||||
}
|
||||
|
||||
pkg_postinst() {
|
||||
ebegin "Running 'openssl rehash ${EROOT}${SSL_CNF_DIR}/certs' to rebuild hashes (bug #333069)"
|
||||
openssl rehash "${EROOT}${SSL_CNF_DIR}/certs"
|
||||
eend $?
|
||||
|
||||
preserve_old_lib_notify /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
|
||||
/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
|
||||
}
|
||||
@ -27,7 +27,7 @@ else
|
||||
"
|
||||
|
||||
if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
|
||||
KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
|
||||
KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
|
||||
fi
|
||||
|
||||
BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-openssl-20240920 )"
|
||||
|
||||
@ -1,289 +0,0 @@
|
||||
# Copyright 1999-2025 Gentoo Authors
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
EAPI=8
|
||||
|
||||
VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssl.org.asc
|
||||
inherit edo flag-o-matic linux-info toolchain-funcs
|
||||
inherit multilib multilib-minimal multiprocessing preserve-libs verify-sig
|
||||
|
||||
DESCRIPTION="Robust, full-featured Open Source Toolkit for the Transport Layer Security (TLS)"
|
||||
HOMEPAGE="https://openssl-library.org/"
|
||||
|
||||
MY_P=${P/_/-}
|
||||
|
||||
if [[ ${PV} == 9999 ]] ; then
|
||||
EGIT_REPO_URI="https://github.com/openssl/openssl.git"
|
||||
|
||||
inherit git-r3
|
||||
else
|
||||
SRC_URI="
|
||||
https://github.com/openssl/openssl/releases/download/${P}/${P}.tar.gz
|
||||
verify-sig? (
|
||||
https://github.com/openssl/openssl/releases/download/${P}/${P}.tar.gz.asc
|
||||
)
|
||||
"
|
||||
|
||||
KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
|
||||
fi
|
||||
|
||||
S="${WORKDIR}"/${MY_P}
|
||||
|
||||
LICENSE="Apache-2.0"
|
||||
SLOT="0/$(ver_cut 1)" # .so version of libssl/libcrypto
|
||||
IUSE="+asm cpu_flags_x86_sse2 fips ktls rfc3779 sctp static-libs test tls-compression vanilla verify-sig weak-ssl-ciphers"
|
||||
RESTRICT="!test? ( test )"
|
||||
|
||||
COMMON_DEPEND="
|
||||
!<net-misc/openssh-9.2_p1-r3
|
||||
tls-compression? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] )
|
||||
"
|
||||
BDEPEND="
|
||||
>=dev-lang/perl-5
|
||||
sctp? ( >=net-misc/lksctp-tools-1.0.12 )
|
||||
test? (
|
||||
sys-apps/diffutils
|
||||
app-alternatives/bc
|
||||
sys-process/procps
|
||||
)
|
||||
verify-sig? ( >=sec-keys/openpgp-keys-openssl-20240920 )
|
||||
"
|
||||
|
||||
DEPEND="${COMMON_DEPEND}"
|
||||
RDEPEND="${COMMON_DEPEND}"
|
||||
PDEPEND="app-misc/ca-certificates"
|
||||
|
||||
MULTILIB_WRAPPED_HEADERS=(
|
||||
/usr/include/openssl/configuration.h
|
||||
)
|
||||
|
||||
PATCHES=(
|
||||
"${FILESDIR}"/${P}-CVE-2024-9143.patch
|
||||
)
|
||||
|
||||
pkg_setup() {
|
||||
if use ktls ; then
|
||||
if kernel_is -lt 4 18 ; then
|
||||
ewarn "Kernel implementation of TLS (USE=ktls) requires kernel >=4.18!"
|
||||
else
|
||||
CONFIG_CHECK="~TLS ~TLS_DEVICE"
|
||||
ERROR_TLS="You will be unable to offload TLS to kernel because CONFIG_TLS is not set!"
|
||||
ERROR_TLS_DEVICE="You will be unable to offload TLS to kernel because CONFIG_TLS_DEVICE is not set!"
|
||||
use test && CONFIG_CHECK+=" ~CRYPTO_USER_API_SKCIPHER"
|
||||
|
||||
linux-info_pkg_setup
|
||||
fi
|
||||
fi
|
||||
|
||||
[[ ${MERGE_TYPE} == binary ]] && return
|
||||
|
||||
# must check in pkg_setup; sysctl doesn't work with userpriv!
|
||||
if use test && use sctp ; then
|
||||
# test_ssl_new will fail with "Ensure SCTP AUTH chunks are enabled in kernel"
|
||||
# if sctp.auth_enable is not enabled.
|
||||
local sctp_auth_status=$(sysctl -n net.sctp.auth_enable 2>/dev/null)
|
||||
if [[ -z "${sctp_auth_status}" ]] || [[ ${sctp_auth_status} != 1 ]] ; then
|
||||
die "FEATURES=test with USE=sctp requires net.sctp.auth_enable=1!"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
src_prepare() {
|
||||
# Make sure we only ever touch Makefile.org and avoid patching a file
|
||||
# that gets blown away anyways by the Configure script in src_configure
|
||||
rm -f Makefile
|
||||
|
||||
if ! use vanilla ; then
|
||||
PATCHES+=(
|
||||
# Add patches which are Gentoo-specific customisations here
|
||||
)
|
||||
fi
|
||||
|
||||
default
|
||||
|
||||
if use test && use sctp && has network-sandbox ${FEATURES} ; then
|
||||
einfo "Disabling test '80-test_ssl_new.t' which is known to fail with FEATURES=network-sandbox ..."
|
||||
rm test/recipes/80-test_ssl_new.t || die
|
||||
fi
|
||||
|
||||
# Test fails depending on kernel configuration, bug #699134
|
||||
rm test/recipes/30-test_afalg.t || die
|
||||
}
|
||||
|
||||
src_configure() {
|
||||
# Keep this in sync with app-misc/c_rehash
|
||||
SSL_CNF_DIR="/etc/ssl"
|
||||
|
||||
# Quiet out unknown driver argument warnings since openssl
|
||||
# doesn't have well-split CFLAGS and we're making it even worse
|
||||
# and 'make depend' uses -Werror for added fun (bug #417795 again)
|
||||
tc-is-clang && append-flags -Qunused-arguments
|
||||
|
||||
# We really, really need to build OpenSSL w/ strict aliasing disabled.
|
||||
# It's filled with violations and it *will* result in miscompiled
|
||||
# code. This has been in the ebuild for > 10 years but even in 2022,
|
||||
# it's still relevant:
|
||||
# - https://github.com/llvm/llvm-project/issues/55255
|
||||
# - https://github.com/openssl/openssl/issues/12247
|
||||
# - https://github.com/openssl/openssl/issues/18225
|
||||
# - https://github.com/openssl/openssl/issues/18663#issuecomment-1181478057
|
||||
# Don't remove the no strict aliasing bits below!
|
||||
filter-flags -fstrict-aliasing
|
||||
append-flags -fno-strict-aliasing
|
||||
# The OpenSSL developers don't test with LTO right now, it leads to various
|
||||
# warnings/errors (which may or may not be false positives), it's considered
|
||||
# unsupported, and it's not tested in CI: https://github.com/openssl/openssl/issues/18663.
|
||||
filter-lto
|
||||
|
||||
append-flags $(test-flags-CC -Wa,--noexecstack)
|
||||
|
||||
# bug #895308
|
||||
append-atomic-flags
|
||||
# Configure doesn't respect LIBS
|
||||
export LDLIBS="${LIBS}"
|
||||
|
||||
# bug #197996
|
||||
unset APPS
|
||||
# bug #312551
|
||||
unset SCRIPTS
|
||||
# bug #311473
|
||||
unset CROSS_COMPILE
|
||||
|
||||
tc-export AR CC CXX RANLIB RC
|
||||
|
||||
multilib-minimal_src_configure
|
||||
}
|
||||
|
||||
multilib_src_configure() {
|
||||
use_ssl() { usex $1 "enable-${2:-$1}" "no-${2:-$1}" " ${*:3}" ; }
|
||||
|
||||
local krb5=$(has_version app-crypt/mit-krb5 && echo "MIT" || echo "Heimdal")
|
||||
|
||||
# See if our toolchain supports __uint128_t. If so, it's 64bit
|
||||
# friendly and can use the nicely optimized code paths, bug #460790.
|
||||
#local ec_nistp_64_gcc_128
|
||||
#
|
||||
# Disable it for now though (bug #469976)
|
||||
# Do NOT re-enable without substantial discussion first!
|
||||
#
|
||||
#echo "__uint128_t i;" > "${T}"/128.c
|
||||
#if ${CC} ${CFLAGS} -c "${T}"/128.c -o /dev/null >&/dev/null ; then
|
||||
# ec_nistp_64_gcc_128="enable-ec_nistp_64_gcc_128"
|
||||
#fi
|
||||
|
||||
local sslout=$(bash "${FILESDIR}/gentoo.config-1.0.4")
|
||||
einfo "Using configuration: ${sslout:-(openssl knows best)}"
|
||||
|
||||
# https://github.com/openssl/openssl/blob/master/INSTALL.md#enable-and-disable-features
|
||||
local myeconfargs=(
|
||||
${sslout}
|
||||
|
||||
$(use cpu_flags_x86_sse2 || echo "no-sse2")
|
||||
enable-camellia
|
||||
enable-ec
|
||||
enable-ec2m
|
||||
enable-sm2
|
||||
enable-srp
|
||||
$(use elibc_musl && echo "no-async")
|
||||
enable-idea
|
||||
enable-mdc2
|
||||
enable-rc5
|
||||
$(use fips && echo "enable-fips")
|
||||
$(use_ssl asm)
|
||||
$(use_ssl ktls)
|
||||
$(use_ssl rfc3779)
|
||||
$(use_ssl sctp)
|
||||
$(use test || echo "no-tests")
|
||||
$(use_ssl tls-compression zlib)
|
||||
$(use_ssl weak-ssl-ciphers)
|
||||
|
||||
--prefix="${EPREFIX}"/usr
|
||||
--openssldir="${EPREFIX}"${SSL_CNF_DIR}
|
||||
--libdir=$(get_libdir)
|
||||
|
||||
shared
|
||||
threads
|
||||
)
|
||||
|
||||
edo perl "${S}/Configure" "${myeconfargs[@]}"
|
||||
}
|
||||
|
||||
multilib_src_compile() {
|
||||
emake build_sw
|
||||
|
||||
if multilib_is_native_abi; then
|
||||
emake build_docs
|
||||
fi
|
||||
}
|
||||
|
||||
multilib_src_test() {
|
||||
# VFP = show subtests verbosely and show failed tests verbosely
|
||||
# Normal V=1 would show everything verbosely but this slows things down.
|
||||
emake HARNESS_JOBS="$(makeopts_jobs)" -Onone VFP=1 test
|
||||
}
|
||||
|
||||
multilib_src_install() {
|
||||
# Only -j1 is supported for the install targets:
|
||||
# https://github.com/openssl/openssl/issues/21999#issuecomment-1771150305
|
||||
emake DESTDIR="${D}" -j1 install_sw
|
||||
if use fips; then
|
||||
emake DESTDIR="${D}" -j1 install_fips
|
||||
# Regen this in pkg_preinst, bug 900625
|
||||
rm "${ED}${SSL_CNF_DIR}"/fipsmodule.cnf || die
|
||||
fi
|
||||
|
||||
if multilib_is_native_abi; then
|
||||
emake DESTDIR="${D}" -j1 install_ssldirs
|
||||
emake DESTDIR="${D}" DOCDIR='$(INSTALLTOP)'/share/doc/${PF} -j1 install_docs
|
||||
fi
|
||||
|
||||
# This is crappy in that the static archives are still built even
|
||||
# when USE=static-libs. But this is due to a failing in the openssl
|
||||
# build system: the static archives are built as PIC all the time.
|
||||
# Only way around this would be to manually configure+compile openssl
|
||||
# twice; once with shared lib support enabled and once without.
|
||||
if ! use static-libs ; then
|
||||
rm "${ED}"/usr/$(get_libdir)/lib{crypto,ssl}.a || die
|
||||
fi
|
||||
}
|
||||
|
||||
multilib_src_install_all() {
|
||||
# openssl installs perl version of c_rehash by default, but
|
||||
# we provide a shell version via app-misc/c_rehash
|
||||
rm "${ED}"/usr/bin/c_rehash || die
|
||||
|
||||
dodoc {AUTHORS,CHANGES,NEWS,README,README-PROVIDERS}.md doc/*.txt doc/${PN}-c-indent.el
|
||||
|
||||
# Create the certs directory
|
||||
keepdir ${SSL_CNF_DIR}/certs
|
||||
|
||||
# bug #254521
|
||||
dodir /etc/sandbox.d
|
||||
echo 'SANDBOX_PREDICT="/dev/crypto"' > "${ED}"/etc/sandbox.d/10openssl
|
||||
|
||||
diropts -m0700
|
||||
keepdir ${SSL_CNF_DIR}/private
|
||||
}
|
||||
|
||||
pkg_preinst() {
|
||||
if use fips; then
|
||||
# Regen fipsmodule.cnf, bug 900625
|
||||
ebegin "Running openssl fipsinstall"
|
||||
"${ED}/usr/bin/openssl" fipsinstall -quiet \
|
||||
-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
|
||||
-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so"
|
||||
eend $?
|
||||
fi
|
||||
|
||||
preserve_old_lib /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
|
||||
/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
|
||||
}
|
||||
|
||||
pkg_postinst() {
|
||||
ebegin "Running 'openssl rehash ${EROOT}${SSL_CNF_DIR}/certs' to rebuild hashes (bug #333069)"
|
||||
openssl rehash "${EROOT}${SSL_CNF_DIR}/certs"
|
||||
eend $?
|
||||
|
||||
preserve_old_lib_notify /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
|
||||
/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
|
||||
}
|
||||
@ -27,7 +27,7 @@ else
|
||||
"
|
||||
|
||||
if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
|
||||
KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
|
||||
KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
|
||||
fi
|
||||
|
||||
BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-openssl-20240920 )"
|
||||
|
||||
@ -1,306 +0,0 @@
|
||||
# Copyright 1999-2025 Gentoo Authors
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
EAPI=8
|
||||
|
||||
VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssl.org.asc
|
||||
inherit edo flag-o-matic linux-info toolchain-funcs
|
||||
inherit multilib multilib-minimal multiprocessing preserve-libs verify-sig
|
||||
|
||||
DESCRIPTION="Robust, full-featured Open Source Toolkit for the Transport Layer Security (TLS)"
|
||||
HOMEPAGE="https://openssl-library.org/"
|
||||
|
||||
MY_P=${P/_/-}
|
||||
|
||||
if [[ ${PV} == 9999 ]] ; then
|
||||
EGIT_REPO_URI="https://github.com/openssl/openssl.git"
|
||||
|
||||
inherit git-r3
|
||||
else
|
||||
SRC_URI="
|
||||
https://github.com/openssl/openssl/releases/download/${P}/${P}.tar.gz
|
||||
verify-sig? (
|
||||
https://github.com/openssl/openssl/releases/download/${P}/${P}.tar.gz.asc
|
||||
)
|
||||
"
|
||||
|
||||
if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
|
||||
KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
|
||||
fi
|
||||
fi
|
||||
|
||||
S="${WORKDIR}"/${MY_P}
|
||||
|
||||
LICENSE="Apache-2.0"
|
||||
SLOT="0/$(ver_cut 1)" # .so version of libssl/libcrypto
|
||||
IUSE="+asm cpu_flags_x86_sse2 fips ktls rfc3779 sctp static-libs test tls-compression vanilla verify-sig weak-ssl-ciphers"
|
||||
RESTRICT="!test? ( test )"
|
||||
|
||||
COMMON_DEPEND="
|
||||
!<net-misc/openssh-9.2_p1-r3
|
||||
tls-compression? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] )
|
||||
"
|
||||
BDEPEND="
|
||||
>=dev-lang/perl-5
|
||||
sctp? ( >=net-misc/lksctp-tools-1.0.12 )
|
||||
test? (
|
||||
sys-apps/diffutils
|
||||
app-alternatives/bc
|
||||
sys-process/procps
|
||||
)
|
||||
verify-sig? ( >=sec-keys/openpgp-keys-openssl-20240920 )
|
||||
"
|
||||
DEPEND="${COMMON_DEPEND}"
|
||||
RDEPEND="${COMMON_DEPEND}"
|
||||
PDEPEND="app-misc/ca-certificates"
|
||||
|
||||
MULTILIB_WRAPPED_HEADERS=(
|
||||
/usr/include/openssl/configuration.h
|
||||
)
|
||||
|
||||
PATCHES=(
|
||||
"${FILESDIR}"/${P}-CVE-2024-9143.patch
|
||||
)
|
||||
|
||||
pkg_setup() {
|
||||
if use ktls ; then
|
||||
if kernel_is -lt 4 18 ; then
|
||||
ewarn "Kernel implementation of TLS (USE=ktls) requires kernel >=4.18!"
|
||||
else
|
||||
CONFIG_CHECK="~TLS ~TLS_DEVICE"
|
||||
ERROR_TLS="You will be unable to offload TLS to kernel because CONFIG_TLS is not set!"
|
||||
ERROR_TLS_DEVICE="You will be unable to offload TLS to kernel because CONFIG_TLS_DEVICE is not set!"
|
||||
use test && CONFIG_CHECK+=" ~CRYPTO_USER_API_SKCIPHER"
|
||||
|
||||
linux-info_pkg_setup
|
||||
fi
|
||||
fi
|
||||
|
||||
[[ ${MERGE_TYPE} == binary ]] && return
|
||||
|
||||
# must check in pkg_setup; sysctl doesn't work with userpriv!
|
||||
if use test && use sctp ; then
|
||||
# test_ssl_new will fail with "Ensure SCTP AUTH chunks are enabled in kernel"
|
||||
# if sctp.auth_enable is not enabled.
|
||||
local sctp_auth_status=$(sysctl -n net.sctp.auth_enable 2>/dev/null)
|
||||
if [[ -z "${sctp_auth_status}" ]] || [[ ${sctp_auth_status} != 1 ]] ; then
|
||||
die "FEATURES=test with USE=sctp requires net.sctp.auth_enable=1!"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
src_unpack() {
|
||||
# Can delete this once test fix patch is dropped
|
||||
if use verify-sig ; then
|
||||
# Needed for downloaded patch (which is unsigned, which is fine)
|
||||
verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.gz{,.asc}
|
||||
fi
|
||||
|
||||
default
|
||||
}
|
||||
|
||||
src_prepare() {
|
||||
# Make sure we only ever touch Makefile.org and avoid patching a file
|
||||
# that gets blown away anyways by the Configure script in src_configure
|
||||
rm -f Makefile
|
||||
|
||||
if ! use vanilla ; then
|
||||
PATCHES+=(
|
||||
# Add patches which are Gentoo-specific customisations here
|
||||
)
|
||||
fi
|
||||
|
||||
default
|
||||
|
||||
if use test && use sctp && has network-sandbox ${FEATURES} ; then
|
||||
einfo "Disabling test '80-test_ssl_new.t' which is known to fail with FEATURES=network-sandbox ..."
|
||||
rm test/recipes/80-test_ssl_new.t || die
|
||||
fi
|
||||
|
||||
# Test fails depending on kernel configuration, bug #699134
|
||||
rm test/recipes/30-test_afalg.t || die
|
||||
}
|
||||
|
||||
src_configure() {
|
||||
# Keep this in sync with app-misc/c_rehash
|
||||
SSL_CNF_DIR="/etc/ssl"
|
||||
|
||||
# Quiet out unknown driver argument warnings since openssl
|
||||
# doesn't have well-split CFLAGS and we're making it even worse
|
||||
# and 'make depend' uses -Werror for added fun (bug #417795 again)
|
||||
tc-is-clang && append-flags -Qunused-arguments
|
||||
|
||||
# We really, really need to build OpenSSL w/ strict aliasing disabled.
|
||||
# It's filled with violations and it *will* result in miscompiled
|
||||
# code. This has been in the ebuild for > 10 years but even in 2022,
|
||||
# it's still relevant:
|
||||
# - https://github.com/llvm/llvm-project/issues/55255
|
||||
# - https://github.com/openssl/openssl/issues/12247
|
||||
# - https://github.com/openssl/openssl/issues/18225
|
||||
# - https://github.com/openssl/openssl/issues/18663#issuecomment-1181478057
|
||||
# Don't remove the no strict aliasing bits below!
|
||||
filter-flags -fstrict-aliasing
|
||||
append-flags -fno-strict-aliasing
|
||||
# The OpenSSL developers don't test with LTO right now, it leads to various
|
||||
# warnings/errors (which may or may not be false positives), it's considered
|
||||
# unsupported, and it's not tested in CI: https://github.com/openssl/openssl/issues/18663.
|
||||
filter-lto
|
||||
|
||||
append-flags $(test-flags-CC -Wa,--noexecstack)
|
||||
|
||||
# bug #895308 -- check inserts GNU ld-compatible arguments
|
||||
[[ ${CHOST} == *-darwin* ]] || append-atomic-flags
|
||||
# Configure doesn't respect LIBS
|
||||
export LDLIBS="${LIBS}"
|
||||
|
||||
# bug #197996
|
||||
unset APPS
|
||||
# bug #312551
|
||||
unset SCRIPTS
|
||||
# bug #311473
|
||||
unset CROSS_COMPILE
|
||||
|
||||
tc-export AR CC CXX RANLIB RC
|
||||
|
||||
multilib-minimal_src_configure
|
||||
}
|
||||
|
||||
multilib_src_configure() {
|
||||
use_ssl() { usex $1 "enable-${2:-$1}" "no-${2:-$1}" " ${*:3}" ; }
|
||||
|
||||
local krb5=$(has_version app-crypt/mit-krb5 && echo "MIT" || echo "Heimdal")
|
||||
|
||||
# See if our toolchain supports __uint128_t. If so, it's 64bit
|
||||
# friendly and can use the nicely optimized code paths, bug #460790.
|
||||
#local ec_nistp_64_gcc_128
|
||||
#
|
||||
# Disable it for now though (bug #469976)
|
||||
# Do NOT re-enable without substantial discussion first!
|
||||
#
|
||||
#echo "__uint128_t i;" > "${T}"/128.c
|
||||
#if ${CC} ${CFLAGS} -c "${T}"/128.c -o /dev/null >&/dev/null ; then
|
||||
# ec_nistp_64_gcc_128="enable-ec_nistp_64_gcc_128"
|
||||
#fi
|
||||
|
||||
local sslout=$(bash "${FILESDIR}/gentoo.config-1.0.4")
|
||||
einfo "Using configuration: ${sslout:-(openssl knows best)}"
|
||||
|
||||
# https://github.com/openssl/openssl/blob/master/INSTALL.md#enable-and-disable-features
|
||||
local myeconfargs=(
|
||||
${sslout}
|
||||
|
||||
$(use cpu_flags_x86_sse2 || echo "no-sse2")
|
||||
enable-camellia
|
||||
enable-ec
|
||||
enable-ec2m
|
||||
enable-sm2
|
||||
enable-srp
|
||||
$(use elibc_musl && echo "no-async")
|
||||
enable-idea
|
||||
enable-mdc2
|
||||
enable-rc5
|
||||
$(use fips && echo "enable-fips")
|
||||
$(use_ssl asm)
|
||||
$(use_ssl ktls)
|
||||
$(use_ssl rfc3779)
|
||||
$(use_ssl sctp)
|
||||
$(use test || echo "no-tests")
|
||||
$(use_ssl tls-compression zlib)
|
||||
$(use_ssl weak-ssl-ciphers)
|
||||
|
||||
--prefix="${EPREFIX}"/usr
|
||||
--openssldir="${EPREFIX}"${SSL_CNF_DIR}
|
||||
--libdir=$(get_libdir)
|
||||
|
||||
shared
|
||||
threads
|
||||
)
|
||||
|
||||
edo perl "${S}/Configure" "${myeconfargs[@]}"
|
||||
}
|
||||
|
||||
multilib_src_compile() {
|
||||
emake build_sw
|
||||
|
||||
if multilib_is_native_abi; then
|
||||
emake build_docs
|
||||
fi
|
||||
}
|
||||
|
||||
multilib_src_test() {
|
||||
# See https://github.com/openssl/openssl/blob/master/test/README.md for options.
|
||||
#
|
||||
# VFP = show subtests verbosely and show failed tests verbosely
|
||||
# Normal V=1 would show everything verbosely but this slows things down.
|
||||
#
|
||||
# -j1 here for https://github.com/openssl/openssl/issues/21999, but it
|
||||
# shouldn't matter as tests were already built earlier, and HARNESS_JOBS
|
||||
# controls running the tests.
|
||||
emake -Onone -j1 HARNESS_JOBS="$(makeopts_jobs)" VFP=1 test
|
||||
}
|
||||
|
||||
multilib_src_install() {
|
||||
# Only -j1 is supported for the install targets:
|
||||
# https://github.com/openssl/openssl/issues/21999#issuecomment-1771150305
|
||||
emake DESTDIR="${D}" -j1 install_sw
|
||||
if use fips; then
|
||||
emake DESTDIR="${D}" -j1 install_fips
|
||||
# Regen this in pkg_preinst, bug 900625
|
||||
rm "${ED}${SSL_CNF_DIR}"/fipsmodule.cnf || die
|
||||
fi
|
||||
|
||||
if multilib_is_native_abi; then
|
||||
emake DESTDIR="${D}" -j1 install_ssldirs
|
||||
emake DESTDIR="${D}" DOCDIR='$(INSTALLTOP)'/share/doc/${PF} -j1 install_docs
|
||||
fi
|
||||
|
||||
# This is crappy in that the static archives are still built even
|
||||
# when USE=static-libs. But this is due to a failing in the openssl
|
||||
# build system: the static archives are built as PIC all the time.
|
||||
# Only way around this would be to manually configure+compile openssl
|
||||
# twice; once with shared lib support enabled and once without.
|
||||
if ! use static-libs ; then
|
||||
rm "${ED}"/usr/$(get_libdir)/lib{crypto,ssl}.a || die
|
||||
fi
|
||||
}
|
||||
|
||||
multilib_src_install_all() {
|
||||
# openssl installs perl version of c_rehash by default, but
|
||||
# we provide a shell version via app-misc/c_rehash
|
||||
rm "${ED}"/usr/bin/c_rehash || die
|
||||
|
||||
dodoc {AUTHORS,CHANGES,NEWS,README,README-PROVIDERS}.md doc/*.txt doc/${PN}-c-indent.el
|
||||
|
||||
# Create the certs directory
|
||||
keepdir ${SSL_CNF_DIR}/certs
|
||||
|
||||
# bug #254521
|
||||
dodir /etc/sandbox.d
|
||||
echo 'SANDBOX_PREDICT="/dev/crypto"' > "${ED}"/etc/sandbox.d/10openssl
|
||||
|
||||
diropts -m0700
|
||||
keepdir ${SSL_CNF_DIR}/private
|
||||
}
|
||||
|
||||
pkg_preinst() {
|
||||
if use fips; then
|
||||
# Regen fipsmodule.cnf, bug 900625
|
||||
ebegin "Running openssl fipsinstall"
|
||||
"${ED}/usr/bin/openssl" fipsinstall -quiet \
|
||||
-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
|
||||
-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so"
|
||||
eend $?
|
||||
fi
|
||||
|
||||
preserve_old_lib /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
|
||||
/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
|
||||
}
|
||||
|
||||
pkg_postinst() {
|
||||
ebegin "Running 'openssl rehash ${EROOT}${SSL_CNF_DIR}/certs' to rebuild hashes (bug #333069)"
|
||||
openssl rehash "${EROOT}${SSL_CNF_DIR}/certs"
|
||||
eend $?
|
||||
|
||||
preserve_old_lib_notify /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
|
||||
/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
|
||||
}
|
||||
@ -27,7 +27,7 @@ else
|
||||
"
|
||||
|
||||
if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
|
||||
KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
|
||||
KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
|
||||
fi
|
||||
|
||||
BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-openssl-20240920 )"
|
||||
|
||||
@ -1,304 +0,0 @@
|
||||
# Copyright 1999-2025 Gentoo Authors
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
EAPI=8
|
||||
|
||||
VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssl.org.asc
|
||||
inherit edo flag-o-matic linux-info toolchain-funcs
|
||||
inherit multilib multilib-minimal multiprocessing preserve-libs verify-sig
|
||||
|
||||
DESCRIPTION="Robust, full-featured Open Source Toolkit for the Transport Layer Security (TLS)"
|
||||
HOMEPAGE="https://openssl-library.org/"
|
||||
|
||||
MY_P=${P/_/-}
|
||||
|
||||
if [[ ${PV} == 9999 ]] ; then
|
||||
EGIT_REPO_URI="https://github.com/openssl/openssl.git"
|
||||
|
||||
inherit git-r3
|
||||
else
|
||||
SRC_URI="
|
||||
https://github.com/openssl/openssl/releases/download/${P}/${P}.tar.gz
|
||||
verify-sig? (
|
||||
https://github.com/openssl/openssl/releases/download/${P}/${P}.tar.gz.asc
|
||||
)
|
||||
"
|
||||
|
||||
if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
|
||||
KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
|
||||
fi
|
||||
fi
|
||||
|
||||
S="${WORKDIR}"/${MY_P}
|
||||
|
||||
LICENSE="Apache-2.0"
|
||||
SLOT="0/$(ver_cut 1)" # .so version of libssl/libcrypto
|
||||
IUSE="+asm cpu_flags_x86_sse2 fips ktls +quic rfc3779 sctp static-libs test tls-compression vanilla verify-sig weak-ssl-ciphers"
|
||||
RESTRICT="!test? ( test )"
|
||||
|
||||
COMMON_DEPEND="
|
||||
!<net-misc/openssh-9.2_p1-r3
|
||||
tls-compression? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] )
|
||||
"
|
||||
BDEPEND="
|
||||
>=dev-lang/perl-5
|
||||
sctp? ( >=net-misc/lksctp-tools-1.0.12 )
|
||||
test? (
|
||||
sys-apps/diffutils
|
||||
app-alternatives/bc
|
||||
sys-process/procps
|
||||
)
|
||||
verify-sig? ( >=sec-keys/openpgp-keys-openssl-20240920 )
|
||||
"
|
||||
DEPEND="${COMMON_DEPEND}"
|
||||
RDEPEND="${COMMON_DEPEND}"
|
||||
PDEPEND="app-misc/ca-certificates"
|
||||
|
||||
MULTILIB_WRAPPED_HEADERS=(
|
||||
/usr/include/openssl/configuration.h
|
||||
)
|
||||
|
||||
PATCHES=(
|
||||
"${FILESDIR}"/${P}-CVE-2024-9143.patch
|
||||
)
|
||||
|
||||
pkg_setup() {
|
||||
if use ktls ; then
|
||||
if kernel_is -lt 4 18 ; then
|
||||
ewarn "Kernel implementation of TLS (USE=ktls) requires kernel >=4.18!"
|
||||
else
|
||||
CONFIG_CHECK="~TLS ~TLS_DEVICE"
|
||||
ERROR_TLS="You will be unable to offload TLS to kernel because CONFIG_TLS is not set!"
|
||||
ERROR_TLS_DEVICE="You will be unable to offload TLS to kernel because CONFIG_TLS_DEVICE is not set!"
|
||||
use test && CONFIG_CHECK+=" ~CRYPTO_USER_API_SKCIPHER"
|
||||
|
||||
linux-info_pkg_setup
|
||||
fi
|
||||
fi
|
||||
|
||||
[[ ${MERGE_TYPE} == binary ]] && return
|
||||
|
||||
# must check in pkg_setup; sysctl doesn't work with userpriv!
|
||||
if use test && use sctp ; then
|
||||
# test_ssl_new will fail with "Ensure SCTP AUTH chunks are enabled in kernel"
|
||||
# if sctp.auth_enable is not enabled.
|
||||
local sctp_auth_status=$(sysctl -n net.sctp.auth_enable 2>/dev/null)
|
||||
if [[ -z "${sctp_auth_status}" ]] || [[ ${sctp_auth_status} != 1 ]] ; then
|
||||
die "FEATURES=test with USE=sctp requires net.sctp.auth_enable=1!"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
src_unpack() {
|
||||
# Can delete this once test fix patch is dropped
|
||||
if use verify-sig ; then
|
||||
# Needed for downloaded patch (which is unsigned, which is fine)
|
||||
verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.gz{,.asc}
|
||||
fi
|
||||
|
||||
default
|
||||
}
|
||||
|
||||
src_prepare() {
|
||||
# Make sure we only ever touch Makefile.org and avoid patching a file
|
||||
# that gets blown away anyways by the Configure script in src_configure
|
||||
rm -f Makefile || die
|
||||
|
||||
if ! use vanilla ; then
|
||||
PATCHES+=(
|
||||
# Add patches which are Gentoo-specific customisations here
|
||||
)
|
||||
fi
|
||||
|
||||
default
|
||||
|
||||
if use test && use sctp && has network-sandbox ${FEATURES} ; then
|
||||
einfo "Disabling test '80-test_ssl_new.t' which is known to fail with FEATURES=network-sandbox ..."
|
||||
rm test/recipes/80-test_ssl_new.t || die
|
||||
fi
|
||||
|
||||
# Test fails depending on kernel configuration, bug #699134
|
||||
rm test/recipes/30-test_afalg.t || die
|
||||
}
|
||||
|
||||
src_configure() {
|
||||
# Keep this in sync with app-misc/c_rehash
|
||||
SSL_CNF_DIR="/etc/ssl"
|
||||
|
||||
# Quiet out unknown driver argument warnings since openssl
|
||||
# doesn't have well-split CFLAGS and we're making it even worse
|
||||
# and 'make depend' uses -Werror for added fun (bug #417795 again)
|
||||
tc-is-clang && append-flags -Qunused-arguments
|
||||
|
||||
# We really, really need to build OpenSSL w/ strict aliasing disabled.
|
||||
# It's filled with violations and it *will* result in miscompiled
|
||||
# code. This has been in the ebuild for > 10 years but even in 2022,
|
||||
# it's still relevant:
|
||||
# - https://github.com/llvm/llvm-project/issues/55255
|
||||
# - https://github.com/openssl/openssl/issues/12247
|
||||
# - https://github.com/openssl/openssl/issues/18225
|
||||
# - https://github.com/openssl/openssl/issues/18663#issuecomment-1181478057
|
||||
# Don't remove the no strict aliasing bits below!
|
||||
filter-flags -fstrict-aliasing
|
||||
append-flags -fno-strict-aliasing
|
||||
# The OpenSSL developers don't test with LTO right now, it leads to various
|
||||
# warnings/errors (which may or may not be false positives), it's considered
|
||||
# unsupported, and it's not tested in CI: https://github.com/openssl/openssl/issues/18663.
|
||||
filter-lto
|
||||
|
||||
append-flags $(test-flags-CC -Wa,--noexecstack)
|
||||
|
||||
# bug #895308 -- check inserts GNU ld-compatible arguments
|
||||
[[ ${CHOST} == *-darwin* ]] || append-atomic-flags
|
||||
# Configure doesn't respect LIBS
|
||||
export LDLIBS="${LIBS}"
|
||||
|
||||
# bug #197996
|
||||
unset APPS
|
||||
# bug #312551
|
||||
unset SCRIPTS
|
||||
# bug #311473
|
||||
unset CROSS_COMPILE
|
||||
|
||||
tc-export AR CC CXX RANLIB RC
|
||||
|
||||
multilib-minimal_src_configure
|
||||
}
|
||||
|
||||
multilib_src_configure() {
|
||||
use_ssl() { usex $1 "enable-${2:-$1}" "no-${2:-$1}" " ${*:3}" ; }
|
||||
|
||||
local krb5=$(has_version app-crypt/mit-krb5 && echo "MIT" || echo "Heimdal")
|
||||
|
||||
# See if our toolchain supports __uint128_t. If so, it's 64bit
|
||||
# friendly and can use the nicely optimized code paths, bug #460790.
|
||||
#local ec_nistp_64_gcc_128
|
||||
#
|
||||
# Disable it for now though (bug #469976)
|
||||
# Do NOT re-enable without substantial discussion first!
|
||||
#
|
||||
#echo "__uint128_t i;" > "${T}"/128.c
|
||||
#if ${CC} ${CFLAGS} -c "${T}"/128.c -o /dev/null >&/dev/null ; then
|
||||
# ec_nistp_64_gcc_128="enable-ec_nistp_64_gcc_128"
|
||||
#fi
|
||||
|
||||
local sslout=$(bash "${FILESDIR}/gentoo.config-1.0.4")
|
||||
einfo "Using configuration: ${sslout:-(openssl knows best)}"
|
||||
|
||||
# https://github.com/openssl/openssl/blob/master/INSTALL.md#enable-and-disable-features
|
||||
local myeconfargs=(
|
||||
${sslout}
|
||||
|
||||
$(multilib_is_native_abi || echo "no-docs")
|
||||
$(use cpu_flags_x86_sse2 || echo "no-sse2")
|
||||
enable-camellia
|
||||
enable-ec
|
||||
enable-ec2m
|
||||
enable-sm2
|
||||
enable-srp
|
||||
$(use elibc_musl && echo "no-async")
|
||||
enable-idea
|
||||
enable-mdc2
|
||||
enable-rc5
|
||||
$(use fips && echo "enable-fips")
|
||||
$(use quic && echo "enable-quic")
|
||||
$(use_ssl asm)
|
||||
$(use_ssl ktls)
|
||||
$(use_ssl rfc3779)
|
||||
$(use_ssl sctp)
|
||||
$(use test || echo "no-tests")
|
||||
$(use_ssl tls-compression zlib)
|
||||
$(use_ssl weak-ssl-ciphers)
|
||||
|
||||
--prefix="${EPREFIX}"/usr
|
||||
--openssldir="${EPREFIX}"${SSL_CNF_DIR}
|
||||
--libdir=$(get_libdir)
|
||||
|
||||
shared
|
||||
threads
|
||||
)
|
||||
|
||||
edo perl "${S}/Configure" "${myeconfargs[@]}"
|
||||
}
|
||||
|
||||
multilib_src_compile() {
|
||||
emake build_sw
|
||||
}
|
||||
|
||||
multilib_src_test() {
|
||||
# See https://github.com/openssl/openssl/blob/master/test/README.md for options.
|
||||
#
|
||||
# VFP = show subtests verbosely and show failed tests verbosely
|
||||
# Normal V=1 would show everything verbosely but this slows things down.
|
||||
#
|
||||
# -j1 here for https://github.com/openssl/openssl/issues/21999, but it
|
||||
# shouldn't matter as tests were already built earlier, and HARNESS_JOBS
|
||||
# controls running the tests.
|
||||
emake -Onone -j1 HARNESS_JOBS="$(makeopts_jobs)" VFP=1 test
|
||||
}
|
||||
|
||||
multilib_src_install() {
|
||||
# Only -j1 is supported for the install targets:
|
||||
# https://github.com/openssl/openssl/issues/21999#issuecomment-1771150305
|
||||
emake DESTDIR="${D}" -j1 install_sw
|
||||
if use fips; then
|
||||
emake DESTDIR="${D}" -j1 install_fips
|
||||
# Regen this in pkg_preinst, bug 900625
|
||||
rm "${ED}${SSL_CNF_DIR}"/fipsmodule.cnf || die
|
||||
fi
|
||||
|
||||
if multilib_is_native_abi; then
|
||||
emake DESTDIR="${D}" -j1 install_ssldirs
|
||||
emake DESTDIR="${D}" DOCDIR='$(INSTALLTOP)'/share/doc/${PF} -j1 install_docs
|
||||
fi
|
||||
|
||||
# This is crappy in that the static archives are still built even
|
||||
# when USE=static-libs. But this is due to a failing in the openssl
|
||||
# build system: the static archives are built as PIC all the time.
|
||||
# Only way around this would be to manually configure+compile openssl
|
||||
# twice; once with shared lib support enabled and once without.
|
||||
if ! use static-libs ; then
|
||||
rm "${ED}"/usr/$(get_libdir)/lib{crypto,ssl}.a || die
|
||||
fi
|
||||
}
|
||||
|
||||
multilib_src_install_all() {
|
||||
# openssl installs perl version of c_rehash by default, but
|
||||
# we provide a shell version via app-misc/c_rehash
|
||||
rm "${ED}"/usr/bin/c_rehash || die
|
||||
|
||||
dodoc {AUTHORS,CHANGES,NEWS,README,README-PROVIDERS}.md doc/*.txt doc/${PN}-c-indent.el
|
||||
|
||||
# Create the certs directory
|
||||
keepdir ${SSL_CNF_DIR}/certs
|
||||
|
||||
# bug #254521
|
||||
dodir /etc/sandbox.d
|
||||
echo 'SANDBOX_PREDICT="/dev/crypto"' > "${ED}"/etc/sandbox.d/10openssl
|
||||
|
||||
diropts -m0700
|
||||
keepdir ${SSL_CNF_DIR}/private
|
||||
}
|
||||
|
||||
pkg_preinst() {
|
||||
if use fips; then
|
||||
# Regen fipsmodule.cnf, bug 900625
|
||||
ebegin "Running openssl fipsinstall"
|
||||
"${ED}/usr/bin/openssl" fipsinstall -quiet \
|
||||
-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
|
||||
-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so"
|
||||
eend $?
|
||||
fi
|
||||
|
||||
preserve_old_lib /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
|
||||
/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
|
||||
}
|
||||
|
||||
pkg_postinst() {
|
||||
ebegin "Running 'openssl rehash ${EROOT}${SSL_CNF_DIR}/certs' to rebuild hashes (bug #333069)"
|
||||
openssl rehash "${EROOT}${SSL_CNF_DIR}/certs"
|
||||
eend $?
|
||||
|
||||
preserve_old_lib_notify /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
|
||||
/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
|
||||
}
|
||||
@ -1,305 +0,0 @@
|
||||
# Copyright 1999-2025 Gentoo Authors
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
EAPI=8
|
||||
|
||||
VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssl.org.asc
|
||||
inherit edo flag-o-matic linux-info toolchain-funcs
|
||||
inherit multilib multilib-minimal multiprocessing preserve-libs verify-sig
|
||||
|
||||
DESCRIPTION="Robust, full-featured Open Source Toolkit for the Transport Layer Security (TLS)"
|
||||
HOMEPAGE="https://openssl-library.org/"
|
||||
|
||||
MY_P=${P/_/-}
|
||||
|
||||
if [[ ${PV} == 9999 ]] ; then
|
||||
EGIT_REPO_URI="https://github.com/openssl/openssl.git"
|
||||
|
||||
inherit git-r3
|
||||
else
|
||||
SRC_URI="
|
||||
https://github.com/openssl/openssl/releases/download/${P}/${P}.tar.gz
|
||||
verify-sig? (
|
||||
https://github.com/openssl/openssl/releases/download/${P}/${P}.tar.gz.asc
|
||||
)
|
||||
"
|
||||
|
||||
if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
|
||||
KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
|
||||
fi
|
||||
fi
|
||||
|
||||
S="${WORKDIR}"/${MY_P}
|
||||
|
||||
LICENSE="Apache-2.0"
|
||||
SLOT="0/$(ver_cut 1)" # .so version of libssl/libcrypto
|
||||
IUSE="+asm cpu_flags_x86_sse2 fips ktls +quic rfc3779 sctp static-libs test tls-compression vanilla verify-sig weak-ssl-ciphers"
|
||||
RESTRICT="!test? ( test )"
|
||||
|
||||
COMMON_DEPEND="
|
||||
!<net-misc/openssh-9.2_p1-r3
|
||||
tls-compression? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] )
|
||||
"
|
||||
BDEPEND="
|
||||
>=dev-lang/perl-5
|
||||
sctp? ( >=net-misc/lksctp-tools-1.0.12 )
|
||||
test? (
|
||||
sys-apps/diffutils
|
||||
app-alternatives/bc
|
||||
sys-process/procps
|
||||
)
|
||||
verify-sig? ( >=sec-keys/openpgp-keys-openssl-20240920 )
|
||||
"
|
||||
DEPEND="${COMMON_DEPEND}"
|
||||
RDEPEND="${COMMON_DEPEND}"
|
||||
PDEPEND="app-misc/ca-certificates"
|
||||
|
||||
MULTILIB_WRAPPED_HEADERS=(
|
||||
/usr/include/openssl/configuration.h
|
||||
)
|
||||
|
||||
PATCHES=(
|
||||
"${FILESDIR}"/${P}-CVE-2024-9143.patch
|
||||
"${FILESDIR}"/${PN}-3.3.2-silence-warning.patch
|
||||
)
|
||||
|
||||
pkg_setup() {
|
||||
if use ktls ; then
|
||||
if kernel_is -lt 4 18 ; then
|
||||
ewarn "Kernel implementation of TLS (USE=ktls) requires kernel >=4.18!"
|
||||
else
|
||||
CONFIG_CHECK="~TLS ~TLS_DEVICE"
|
||||
ERROR_TLS="You will be unable to offload TLS to kernel because CONFIG_TLS is not set!"
|
||||
ERROR_TLS_DEVICE="You will be unable to offload TLS to kernel because CONFIG_TLS_DEVICE is not set!"
|
||||
use test && CONFIG_CHECK+=" ~CRYPTO_USER_API_SKCIPHER"
|
||||
|
||||
linux-info_pkg_setup
|
||||
fi
|
||||
fi
|
||||
|
||||
[[ ${MERGE_TYPE} == binary ]] && return
|
||||
|
||||
# must check in pkg_setup; sysctl doesn't work with userpriv!
|
||||
if use test && use sctp ; then
|
||||
# test_ssl_new will fail with "Ensure SCTP AUTH chunks are enabled in kernel"
|
||||
# if sctp.auth_enable is not enabled.
|
||||
local sctp_auth_status=$(sysctl -n net.sctp.auth_enable 2>/dev/null)
|
||||
if [[ -z "${sctp_auth_status}" ]] || [[ ${sctp_auth_status} != 1 ]] ; then
|
||||
die "FEATURES=test with USE=sctp requires net.sctp.auth_enable=1!"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
src_unpack() {
|
||||
# Can delete this once test fix patch is dropped
|
||||
if use verify-sig ; then
|
||||
# Needed for downloaded patch (which is unsigned, which is fine)
|
||||
verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.gz{,.asc}
|
||||
fi
|
||||
|
||||
default
|
||||
}
|
||||
|
||||
src_prepare() {
|
||||
# Make sure we only ever touch Makefile.org and avoid patching a file
|
||||
# that gets blown away anyways by the Configure script in src_configure
|
||||
rm -f Makefile || die
|
||||
|
||||
if ! use vanilla ; then
|
||||
PATCHES+=(
|
||||
# Add patches which are Gentoo-specific customisations here
|
||||
)
|
||||
fi
|
||||
|
||||
default
|
||||
|
||||
if use test && use sctp && has network-sandbox ${FEATURES} ; then
|
||||
einfo "Disabling test '80-test_ssl_new.t' which is known to fail with FEATURES=network-sandbox ..."
|
||||
rm test/recipes/80-test_ssl_new.t || die
|
||||
fi
|
||||
|
||||
# Test fails depending on kernel configuration, bug #699134
|
||||
rm test/recipes/30-test_afalg.t || die
|
||||
}
|
||||
|
||||
src_configure() {
|
||||
# Keep this in sync with app-misc/c_rehash
|
||||
SSL_CNF_DIR="/etc/ssl"
|
||||
|
||||
# Quiet out unknown driver argument warnings since openssl
|
||||
# doesn't have well-split CFLAGS and we're making it even worse
|
||||
# and 'make depend' uses -Werror for added fun (bug #417795 again)
|
||||
tc-is-clang && append-flags -Qunused-arguments
|
||||
|
||||
# We really, really need to build OpenSSL w/ strict aliasing disabled.
|
||||
# It's filled with violations and it *will* result in miscompiled
|
||||
# code. This has been in the ebuild for > 10 years but even in 2022,
|
||||
# it's still relevant:
|
||||
# - https://github.com/llvm/llvm-project/issues/55255
|
||||
# - https://github.com/openssl/openssl/issues/12247
|
||||
# - https://github.com/openssl/openssl/issues/18225
|
||||
# - https://github.com/openssl/openssl/issues/18663#issuecomment-1181478057
|
||||
# Don't remove the no strict aliasing bits below!
|
||||
filter-flags -fstrict-aliasing
|
||||
append-flags -fno-strict-aliasing
|
||||
# The OpenSSL developers don't test with LTO right now, it leads to various
|
||||
# warnings/errors (which may or may not be false positives), it's considered
|
||||
# unsupported, and it's not tested in CI: https://github.com/openssl/openssl/issues/18663.
|
||||
filter-lto
|
||||
|
||||
append-flags $(test-flags-CC -Wa,--noexecstack)
|
||||
|
||||
# bug #895308 -- check inserts GNU ld-compatible arguments
|
||||
[[ ${CHOST} == *-darwin* ]] || append-atomic-flags
|
||||
# Configure doesn't respect LIBS
|
||||
export LDLIBS="${LIBS}"
|
||||
|
||||
# bug #197996
|
||||
unset APPS
|
||||
# bug #312551
|
||||
unset SCRIPTS
|
||||
# bug #311473
|
||||
unset CROSS_COMPILE
|
||||
|
||||
tc-export AR CC CXX RANLIB RC
|
||||
|
||||
multilib-minimal_src_configure
|
||||
}
|
||||
|
||||
multilib_src_configure() {
|
||||
use_ssl() { usex $1 "enable-${2:-$1}" "no-${2:-$1}" " ${*:3}" ; }
|
||||
|
||||
local krb5=$(has_version app-crypt/mit-krb5 && echo "MIT" || echo "Heimdal")
|
||||
|
||||
# See if our toolchain supports __uint128_t. If so, it's 64bit
|
||||
# friendly and can use the nicely optimized code paths, bug #460790.
|
||||
#local ec_nistp_64_gcc_128
|
||||
#
|
||||
# Disable it for now though (bug #469976)
|
||||
# Do NOT re-enable without substantial discussion first!
|
||||
#
|
||||
#echo "__uint128_t i;" > "${T}"/128.c
|
||||
#if ${CC} ${CFLAGS} -c "${T}"/128.c -o /dev/null >&/dev/null ; then
|
||||
# ec_nistp_64_gcc_128="enable-ec_nistp_64_gcc_128"
|
||||
#fi
|
||||
|
||||
local sslout=$(bash "${FILESDIR}/gentoo.config-1.0.4")
|
||||
einfo "Using configuration: ${sslout:-(openssl knows best)}"
|
||||
|
||||
# https://github.com/openssl/openssl/blob/master/INSTALL.md#enable-and-disable-features
|
||||
local myeconfargs=(
|
||||
${sslout}
|
||||
|
||||
$(multilib_is_native_abi || echo "no-docs")
|
||||
$(use cpu_flags_x86_sse2 || echo "no-sse2")
|
||||
enable-camellia
|
||||
enable-ec
|
||||
enable-ec2m
|
||||
enable-sm2
|
||||
enable-srp
|
||||
$(use elibc_musl && echo "no-async")
|
||||
enable-idea
|
||||
enable-mdc2
|
||||
enable-rc5
|
||||
$(use fips && echo "enable-fips")
|
||||
$(use quic && echo "enable-quic")
|
||||
$(use_ssl asm)
|
||||
$(use_ssl ktls)
|
||||
$(use_ssl rfc3779)
|
||||
$(use_ssl sctp)
|
||||
$(use test || echo "no-tests")
|
||||
$(use_ssl tls-compression zlib)
|
||||
$(use_ssl weak-ssl-ciphers)
|
||||
|
||||
--prefix="${EPREFIX}"/usr
|
||||
--openssldir="${EPREFIX}"${SSL_CNF_DIR}
|
||||
--libdir=$(get_libdir)
|
||||
|
||||
shared
|
||||
threads
|
||||
)
|
||||
|
||||
edo perl "${S}/Configure" "${myeconfargs[@]}"
|
||||
}
|
||||
|
||||
multilib_src_compile() {
|
||||
emake build_sw
|
||||
}
|
||||
|
||||
multilib_src_test() {
|
||||
# See https://github.com/openssl/openssl/blob/master/test/README.md for options.
|
||||
#
|
||||
# VFP = show subtests verbosely and show failed tests verbosely
|
||||
# Normal V=1 would show everything verbosely but this slows things down.
|
||||
#
|
||||
# -j1 here for https://github.com/openssl/openssl/issues/21999, but it
|
||||
# shouldn't matter as tests were already built earlier, and HARNESS_JOBS
|
||||
# controls running the tests.
|
||||
emake -Onone -j1 HARNESS_JOBS="$(makeopts_jobs)" VFP=1 test
|
||||
}
|
||||
|
||||
multilib_src_install() {
|
||||
# Only -j1 is supported for the install targets:
|
||||
# https://github.com/openssl/openssl/issues/21999#issuecomment-1771150305
|
||||
emake DESTDIR="${D}" -j1 install_sw
|
||||
if use fips; then
|
||||
emake DESTDIR="${D}" -j1 install_fips
|
||||
# Regen this in pkg_preinst, bug 900625
|
||||
rm "${ED}${SSL_CNF_DIR}"/fipsmodule.cnf || die
|
||||
fi
|
||||
|
||||
if multilib_is_native_abi; then
|
||||
emake DESTDIR="${D}" -j1 install_ssldirs
|
||||
emake DESTDIR="${D}" DOCDIR='$(INSTALLTOP)'/share/doc/${PF} -j1 install_docs
|
||||
fi
|
||||
|
||||
# This is crappy in that the static archives are still built even
|
||||
# when USE=static-libs. But this is due to a failing in the openssl
|
||||
# build system: the static archives are built as PIC all the time.
|
||||
# Only way around this would be to manually configure+compile openssl
|
||||
# twice; once with shared lib support enabled and once without.
|
||||
if ! use static-libs ; then
|
||||
rm "${ED}"/usr/$(get_libdir)/lib{crypto,ssl}.a || die
|
||||
fi
|
||||
}
|
||||
|
||||
multilib_src_install_all() {
|
||||
# openssl installs perl version of c_rehash by default, but
|
||||
# we provide a shell version via app-misc/c_rehash
|
||||
rm "${ED}"/usr/bin/c_rehash || die
|
||||
|
||||
dodoc {AUTHORS,CHANGES,NEWS,README,README-PROVIDERS}.md doc/*.txt doc/${PN}-c-indent.el
|
||||
|
||||
# Create the certs directory
|
||||
keepdir ${SSL_CNF_DIR}/certs
|
||||
|
||||
# bug #254521
|
||||
dodir /etc/sandbox.d
|
||||
echo 'SANDBOX_PREDICT="/dev/crypto"' > "${ED}"/etc/sandbox.d/10openssl
|
||||
|
||||
diropts -m0700
|
||||
keepdir ${SSL_CNF_DIR}/private
|
||||
}
|
||||
|
||||
pkg_preinst() {
|
||||
if use fips; then
|
||||
# Regen fipsmodule.cnf, bug 900625
|
||||
ebegin "Running openssl fipsinstall"
|
||||
"${ED}/usr/bin/openssl" fipsinstall -quiet \
|
||||
-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
|
||||
-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so"
|
||||
eend $?
|
||||
fi
|
||||
|
||||
preserve_old_lib /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
|
||||
/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
|
||||
}
|
||||
|
||||
pkg_postinst() {
|
||||
ebegin "Running 'openssl rehash ${EROOT}${SSL_CNF_DIR}/certs' to rebuild hashes (bug #333069)"
|
||||
openssl rehash "${EROOT}${SSL_CNF_DIR}/certs"
|
||||
eend $?
|
||||
|
||||
preserve_old_lib_notify /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
|
||||
/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
|
||||
}
|
||||
@ -1,306 +0,0 @@
|
||||
# Copyright 1999-2025 Gentoo Authors
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
EAPI=8
|
||||
|
||||
VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssl.org.asc
|
||||
inherit edo flag-o-matic linux-info toolchain-funcs
|
||||
inherit multilib multilib-minimal multiprocessing preserve-libs verify-sig
|
||||
|
||||
DESCRIPTION="Robust, full-featured Open Source Toolkit for the Transport Layer Security (TLS)"
|
||||
HOMEPAGE="https://openssl-library.org/"
|
||||
|
||||
MY_P=${P/_/-}
|
||||
|
||||
if [[ ${PV} == 9999 ]] ; then
|
||||
EGIT_REPO_URI="https://github.com/openssl/openssl.git"
|
||||
|
||||
inherit git-r3
|
||||
else
|
||||
SRC_URI="
|
||||
https://github.com/openssl/openssl/releases/download/${P}/${P}.tar.gz
|
||||
verify-sig? (
|
||||
https://github.com/openssl/openssl/releases/download/${P}/${P}.tar.gz.asc
|
||||
)
|
||||
"
|
||||
|
||||
if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
|
||||
KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
|
||||
fi
|
||||
fi
|
||||
|
||||
S="${WORKDIR}"/${MY_P}
|
||||
|
||||
LICENSE="Apache-2.0"
|
||||
SLOT="0/$(ver_cut 1)" # .so version of libssl/libcrypto
|
||||
IUSE="+asm cpu_flags_x86_sse2 fips ktls +quic rfc3779 sctp static-libs test tls-compression vanilla verify-sig weak-ssl-ciphers"
|
||||
RESTRICT="!test? ( test )"
|
||||
|
||||
COMMON_DEPEND="
|
||||
!<net-misc/openssh-9.2_p1-r3
|
||||
tls-compression? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] )
|
||||
"
|
||||
BDEPEND="
|
||||
>=dev-lang/perl-5
|
||||
sctp? ( >=net-misc/lksctp-tools-1.0.12 )
|
||||
test? (
|
||||
sys-apps/diffutils
|
||||
app-alternatives/bc
|
||||
sys-process/procps
|
||||
)
|
||||
verify-sig? ( >=sec-keys/openpgp-keys-openssl-20240920 )
|
||||
"
|
||||
DEPEND="${COMMON_DEPEND}"
|
||||
RDEPEND="${COMMON_DEPEND}"
|
||||
PDEPEND="app-misc/ca-certificates"
|
||||
|
||||
MULTILIB_WRAPPED_HEADERS=(
|
||||
/usr/include/openssl/configuration.h
|
||||
)
|
||||
|
||||
PATCHES=(
|
||||
"${FILESDIR}"/${P}-CVE-2024-9143.patch
|
||||
"${FILESDIR}"/${PN}-3.3.2-silence-warning.patch
|
||||
"${FILESDIR}"/${P}-arm64-clobber.patch
|
||||
)
|
||||
|
||||
pkg_setup() {
|
||||
if use ktls ; then
|
||||
if kernel_is -lt 4 18 ; then
|
||||
ewarn "Kernel implementation of TLS (USE=ktls) requires kernel >=4.18!"
|
||||
else
|
||||
CONFIG_CHECK="~TLS ~TLS_DEVICE"
|
||||
ERROR_TLS="You will be unable to offload TLS to kernel because CONFIG_TLS is not set!"
|
||||
ERROR_TLS_DEVICE="You will be unable to offload TLS to kernel because CONFIG_TLS_DEVICE is not set!"
|
||||
use test && CONFIG_CHECK+=" ~CRYPTO_USER_API_SKCIPHER"
|
||||
|
||||
linux-info_pkg_setup
|
||||
fi
|
||||
fi
|
||||
|
||||
[[ ${MERGE_TYPE} == binary ]] && return
|
||||
|
||||
# must check in pkg_setup; sysctl doesn't work with userpriv!
|
||||
if use test && use sctp ; then
|
||||
# test_ssl_new will fail with "Ensure SCTP AUTH chunks are enabled in kernel"
|
||||
# if sctp.auth_enable is not enabled.
|
||||
local sctp_auth_status=$(sysctl -n net.sctp.auth_enable 2>/dev/null)
|
||||
if [[ -z "${sctp_auth_status}" ]] || [[ ${sctp_auth_status} != 1 ]] ; then
|
||||
die "FEATURES=test with USE=sctp requires net.sctp.auth_enable=1!"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
src_unpack() {
|
||||
# Can delete this once test fix patch is dropped
|
||||
if use verify-sig ; then
|
||||
# Needed for downloaded patch (which is unsigned, which is fine)
|
||||
verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.gz{,.asc}
|
||||
fi
|
||||
|
||||
default
|
||||
}
|
||||
|
||||
src_prepare() {
|
||||
# Make sure we only ever touch Makefile.org and avoid patching a file
|
||||
# that gets blown away anyways by the Configure script in src_configure
|
||||
rm -f Makefile || die
|
||||
|
||||
if ! use vanilla ; then
|
||||
PATCHES+=(
|
||||
# Add patches which are Gentoo-specific customisations here
|
||||
)
|
||||
fi
|
||||
|
||||
default
|
||||
|
||||
if use test && use sctp && has network-sandbox ${FEATURES} ; then
|
||||
einfo "Disabling test '80-test_ssl_new.t' which is known to fail with FEATURES=network-sandbox ..."
|
||||
rm test/recipes/80-test_ssl_new.t || die
|
||||
fi
|
||||
|
||||
# Test fails depending on kernel configuration, bug #699134
|
||||
rm test/recipes/30-test_afalg.t || die
|
||||
}
|
||||
|
||||
src_configure() {
|
||||
# Keep this in sync with app-misc/c_rehash
|
||||
SSL_CNF_DIR="/etc/ssl"
|
||||
|
||||
# Quiet out unknown driver argument warnings since openssl
|
||||
# doesn't have well-split CFLAGS and we're making it even worse
|
||||
# and 'make depend' uses -Werror for added fun (bug #417795 again)
|
||||
tc-is-clang && append-flags -Qunused-arguments
|
||||
|
||||
# We really, really need to build OpenSSL w/ strict aliasing disabled.
|
||||
# It's filled with violations and it *will* result in miscompiled
|
||||
# code. This has been in the ebuild for > 10 years but even in 2022,
|
||||
# it's still relevant:
|
||||
# - https://github.com/llvm/llvm-project/issues/55255
|
||||
# - https://github.com/openssl/openssl/issues/12247
|
||||
# - https://github.com/openssl/openssl/issues/18225
|
||||
# - https://github.com/openssl/openssl/issues/18663#issuecomment-1181478057
|
||||
# Don't remove the no strict aliasing bits below!
|
||||
filter-flags -fstrict-aliasing
|
||||
append-flags -fno-strict-aliasing
|
||||
# The OpenSSL developers don't test with LTO right now, it leads to various
|
||||
# warnings/errors (which may or may not be false positives), it's considered
|
||||
# unsupported, and it's not tested in CI: https://github.com/openssl/openssl/issues/18663.
|
||||
filter-lto
|
||||
|
||||
append-flags $(test-flags-CC -Wa,--noexecstack)
|
||||
|
||||
# bug #895308 -- check inserts GNU ld-compatible arguments
|
||||
[[ ${CHOST} == *-darwin* ]] || append-atomic-flags
|
||||
# Configure doesn't respect LIBS
|
||||
export LDLIBS="${LIBS}"
|
||||
|
||||
# bug #197996
|
||||
unset APPS
|
||||
# bug #312551
|
||||
unset SCRIPTS
|
||||
# bug #311473
|
||||
unset CROSS_COMPILE
|
||||
|
||||
tc-export AR CC CXX RANLIB RC
|
||||
|
||||
multilib-minimal_src_configure
|
||||
}
|
||||
|
||||
multilib_src_configure() {
|
||||
use_ssl() { usex $1 "enable-${2:-$1}" "no-${2:-$1}" " ${*:3}" ; }
|
||||
|
||||
local krb5=$(has_version app-crypt/mit-krb5 && echo "MIT" || echo "Heimdal")
|
||||
|
||||
# See if our toolchain supports __uint128_t. If so, it's 64bit
|
||||
# friendly and can use the nicely optimized code paths, bug #460790.
|
||||
#local ec_nistp_64_gcc_128
|
||||
#
|
||||
# Disable it for now though (bug #469976)
|
||||
# Do NOT re-enable without substantial discussion first!
|
||||
#
|
||||
#echo "__uint128_t i;" > "${T}"/128.c
|
||||
#if ${CC} ${CFLAGS} -c "${T}"/128.c -o /dev/null >&/dev/null ; then
|
||||
# ec_nistp_64_gcc_128="enable-ec_nistp_64_gcc_128"
|
||||
#fi
|
||||
|
||||
local sslout=$(bash "${FILESDIR}/gentoo.config-1.0.4")
|
||||
einfo "Using configuration: ${sslout:-(openssl knows best)}"
|
||||
|
||||
# https://github.com/openssl/openssl/blob/master/INSTALL.md#enable-and-disable-features
|
||||
local myeconfargs=(
|
||||
${sslout}
|
||||
|
||||
$(multilib_is_native_abi || echo "no-docs")
|
||||
$(use cpu_flags_x86_sse2 || echo "no-sse2")
|
||||
enable-camellia
|
||||
enable-ec
|
||||
enable-ec2m
|
||||
enable-sm2
|
||||
enable-srp
|
||||
$(use elibc_musl && echo "no-async")
|
||||
enable-idea
|
||||
enable-mdc2
|
||||
enable-rc5
|
||||
$(use fips && echo "enable-fips")
|
||||
$(use quic && echo "enable-quic")
|
||||
$(use_ssl asm)
|
||||
$(use_ssl ktls)
|
||||
$(use_ssl rfc3779)
|
||||
$(use_ssl sctp)
|
||||
$(use test || echo "no-tests")
|
||||
$(use_ssl tls-compression zlib)
|
||||
$(use_ssl weak-ssl-ciphers)
|
||||
|
||||
--prefix="${EPREFIX}"/usr
|
||||
--openssldir="${EPREFIX}"${SSL_CNF_DIR}
|
||||
--libdir=$(get_libdir)
|
||||
|
||||
shared
|
||||
threads
|
||||
)
|
||||
|
||||
edo perl "${S}/Configure" "${myeconfargs[@]}"
|
||||
}
|
||||
|
||||
multilib_src_compile() {
|
||||
emake build_sw
|
||||
}
|
||||
|
||||
multilib_src_test() {
|
||||
# See https://github.com/openssl/openssl/blob/master/test/README.md for options.
|
||||
#
|
||||
# VFP = show subtests verbosely and show failed tests verbosely
|
||||
# Normal V=1 would show everything verbosely but this slows things down.
|
||||
#
|
||||
# -j1 here for https://github.com/openssl/openssl/issues/21999, but it
|
||||
# shouldn't matter as tests were already built earlier, and HARNESS_JOBS
|
||||
# controls running the tests.
|
||||
emake -Onone -j1 HARNESS_JOBS="$(makeopts_jobs)" VFP=1 test
|
||||
}
|
||||
|
||||
multilib_src_install() {
|
||||
# Only -j1 is supported for the install targets:
|
||||
# https://github.com/openssl/openssl/issues/21999#issuecomment-1771150305
|
||||
emake DESTDIR="${D}" -j1 install_sw
|
||||
if use fips; then
|
||||
emake DESTDIR="${D}" -j1 install_fips
|
||||
# Regen this in pkg_preinst, bug 900625
|
||||
rm "${ED}${SSL_CNF_DIR}"/fipsmodule.cnf || die
|
||||
fi
|
||||
|
||||
if multilib_is_native_abi; then
|
||||
emake DESTDIR="${D}" -j1 install_ssldirs
|
||||
emake DESTDIR="${D}" DOCDIR='$(INSTALLTOP)'/share/doc/${PF} -j1 install_docs
|
||||
fi
|
||||
|
||||
# This is crappy in that the static archives are still built even
|
||||
# when USE=static-libs. But this is due to a failing in the openssl
|
||||
# build system: the static archives are built as PIC all the time.
|
||||
# Only way around this would be to manually configure+compile openssl
|
||||
# twice; once with shared lib support enabled and once without.
|
||||
if ! use static-libs ; then
|
||||
rm "${ED}"/usr/$(get_libdir)/lib{crypto,ssl}.a || die
|
||||
fi
|
||||
}
|
||||
|
||||
multilib_src_install_all() {
|
||||
# openssl installs perl version of c_rehash by default, but
|
||||
# we provide a shell version via app-misc/c_rehash
|
||||
rm "${ED}"/usr/bin/c_rehash || die
|
||||
|
||||
dodoc {AUTHORS,CHANGES,NEWS,README,README-PROVIDERS}.md doc/*.txt doc/${PN}-c-indent.el
|
||||
|
||||
# Create the certs directory
|
||||
keepdir ${SSL_CNF_DIR}/certs
|
||||
|
||||
# bug #254521
|
||||
dodir /etc/sandbox.d
|
||||
echo 'SANDBOX_PREDICT="/dev/crypto"' > "${ED}"/etc/sandbox.d/10openssl
|
||||
|
||||
diropts -m0700
|
||||
keepdir ${SSL_CNF_DIR}/private
|
||||
}
|
||||
|
||||
pkg_preinst() {
|
||||
if use fips; then
|
||||
# Regen fipsmodule.cnf, bug 900625
|
||||
ebegin "Running openssl fipsinstall"
|
||||
"${ED}/usr/bin/openssl" fipsinstall -quiet \
|
||||
-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
|
||||
-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so"
|
||||
eend $?
|
||||
fi
|
||||
|
||||
preserve_old_lib /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
|
||||
/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
|
||||
}
|
||||
|
||||
pkg_postinst() {
|
||||
ebegin "Running 'openssl rehash ${EROOT}${SSL_CNF_DIR}/certs' to rebuild hashes (bug #333069)"
|
||||
openssl rehash "${EROOT}${SSL_CNF_DIR}/certs"
|
||||
eend $?
|
||||
|
||||
preserve_old_lib_notify /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
|
||||
/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
|
||||
}
|
||||
@ -26,9 +26,9 @@ else
|
||||
)
|
||||
"
|
||||
|
||||
#if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
|
||||
# KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
|
||||
#fi
|
||||
if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
|
||||
KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
|
||||
fi
|
||||
|
||||
BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-openssl-20240920 )"
|
||||
fi
|
||||
|
||||
Loading…
Reference in New Issue
Block a user