app-crypt/mit-krb5: move from portage-stable

To add a custom patch, move mit-krb5 from portage-stable to
coreos-overlay, and update it to 1.18.2-r4.

sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/Manifest

@@ -0,0 +1 @@
+DIST krb5-1.18.2.tar.gz 8713927 BLAKE2B f0eb34e67adcb86f347c59ec6ef74970a57530cc56336a84909f852cd6135079ea89828e77c906a272f54e0faf6a4a0497f2b648446eb9d048d1c51e4ec513af SHA512 7cbb1b28e677fea3e0794e93951f3caaa2c49bb1175dd187951e72a466cc69d96c3b833d838000fe911c1a437d96a558e550f27c53a8b332fb9dfc7cbb7ec44c

sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/files/CVE-2020-28196.patch

@@ -0,0 +1,71 @@
+diff --git a/src/lib/krb5/asn.1/asn1_encode.c b/src/lib/krb5/asn.1/asn1_encode.c
+index a160cf4fe8..cd6b879f77 100644
+--- a/lib/krb5/asn.1/asn1_encode.c
++++ b/lib/krb5/asn.1/asn1_encode.c
+@@ -356,7 +356,7 @@ make_tag(asn1buf *buf, const taginfo *t, size_t len)
+ static krb5_error_code
+ get_tag(const uint8_t *asn1, size_t len, taginfo *tag_out,
+         const uint8_t **contents_out, size_t *clen_out,
+-        const uint8_t **remainder_out, size_t *rlen_out)
++        const uint8_t **remainder_out, size_t *rlen_out, int recursion)
+ {
+     krb5_error_code ret;
+     uint8_t o;
+@@ -394,9 +394,11 @@ get_tag(const uint8_t *asn1, size_t len, taginfo *tag_out,
+         /* Indefinite form (should not be present in DER, but we accept it). */
+         if (tag_out->construction != CONSTRUCTED)
+             return ASN1_MISMATCH_INDEF;
++        if (recursion >= 32)
++            return ASN1_OVERFLOW;
+         p = asn1;
+         while (!(len >= 2 && p[0] == 0 && p[1] == 0)) {
+-            ret = get_tag(p, len, &t, &c, &clen, &p, &len);
++            ret = get_tag(p, len, &t, &c, &clen, &p, &len, recursion + 1);
+             if (ret)
+                 return ret;
+         }
+@@ -613,7 +615,7 @@ split_der(asn1buf *buf, uint8_t *const *der, size_t len, taginfo *tag_out)
+     const uint8_t *contents, *remainder;
+     size_t clen, rlen;
+ 
+-    ret = get_tag(*der, len, tag_out, &contents, &clen, &remainder, &rlen);
++    ret = get_tag(*der, len, tag_out, &contents, &clen, &remainder, &rlen, 0);
+     if (ret)
+         return ret;
+     if (rlen != 0)
+@@ -1199,7 +1201,7 @@ decode_atype(const taginfo *t, const uint8_t *asn1, size_t len,
+         const uint8_t *rem;
+         size_t rlen;
+         if (!tag->implicit) {
+-            ret = get_tag(asn1, len, &inner_tag, &asn1, &len, &rem, &rlen);
++            ret = get_tag(asn1, len, &inner_tag, &asn1, &len, &rem, &rlen, 0);
+             if (ret)
+                 return ret;
+             /* Note: we don't check rlen (it should be 0). */
+@@ -1420,7 +1422,7 @@ decode_sequence(const uint8_t *asn1, size_t len, const struct seq_info *seq,
+     for (i = 0; i < seq->n_fields; i++) {
+         if (len == 0)
+             break;
+-        ret = get_tag(asn1, len, &t, &contents, &clen, &asn1, &len);
++        ret = get_tag(asn1, len, &t, &contents, &clen, &asn1, &len, 0);
+         if (ret)
+             goto error;
+         /*
+@@ -1478,7 +1480,7 @@ decode_sequence_of(const uint8_t *asn1, size_t len,
+     *seq_out = NULL;
+     *count_out = 0;
+     while (len > 0) {
+-        ret = get_tag(asn1, len, &t, &contents, &clen, &asn1, &len);
++        ret = get_tag(asn1, len, &t, &contents, &clen, &asn1, &len, 0);
+         if (ret)
+             goto error;
+         if (!check_atype_tag(elemtype, &t)) {
+@@ -1584,7 +1586,7 @@ k5_asn1_full_decode(const krb5_data *code, const struct atype_info *a,
+ 
+     *retrep = NULL;
+     ret = get_tag((uint8_t *)code->data, code->length, &t, &contents,
+-                  &clen, &remainder, &rlen);
++                  &clen, &remainder, &rlen, 0);
+     if (ret)
+         return ret;
+     /* rlen should be 0, but we don't check it (and due to padding in

sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/files/kpropd.xinetd

@@ -0,0 +1,11 @@
+service tell
+{
+	disable		= yes
+	socket_type	= stream
+	user		= root
+	wait		= no
+	server		= /usr/sbin/kpropd
+	only_from	= 0.0.0.0
+	log_on_success	= PID HOST EXIT DURATION
+	log_on_failure	= HOST
+}

sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/files/mit-krb5-1.12_warn_cflags.patch

@@ -0,0 +1,11 @@
+gentoo bug #498794
+--- src/aclocal.m4	2014-01-16 00:44:15.000000000 +0000
++++ src/aclocal.m4	2014-03-26 10:20:54.000000000 +0000
+@@ -501,6 +501,7 @@
+   fi
+   if test "x$krb5_ac_warn_cflags_set" = xset ; then
+     AC_MSG_NOTICE(not adding extra gcc warning flags because WARN_CFLAGS was set)
++    WARN_CFLAGS=""
+   else
+     AC_MSG_NOTICE(adding extra warning flags for gcc)
+     WARN_CFLAGS="$WARN_CFLAGS $extra_gcc_warn_opts -Wmissing-prototypes"

sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/files/mit-krb5-1.18.2-autoconf-2.70.patch

@@ -0,0 +1,35 @@
+https://bugs.gentoo.org/778167
+
+From f78edbe30816f049e1360cb6e203fabfdf7b98df Mon Sep 17 00:00:00 2001
+From: Sergei Trofimovich <slyfox@gentoo.org>
+Date: Fri, 6 Nov 2020 08:14:57 +0000
+Subject: [PATCH] Fix compatibility with upcoming autoconf 2.70
+
+Mainline autoconf generates no shell code for AC_CONFIG_AUX_DIR().
+Call it unconditionally to avoid a syntax error.
+
+[ghudson@mit.edu: rewrote commit message]
+
+ticket: 8960 (new)
+tags: pullup
+target_version: 1.18-next
+target_version: 1.17-next
+---
+ src/aclocal.m4 | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+--- src/aclocal.m4
++++ src/aclocal.m4
+@@ -13,11 +13,7 @@ fi
+ ac_topdir=$srcdir/$ac_reltopdir
+ ac_config_fragdir=$ac_reltopdir/config
+ # echo "Looking for $srcdir/$ac_config_fragdir"
+-if test -d "$srcdir/$ac_config_fragdir"; then
+-  AC_CONFIG_AUX_DIR(K5_TOPDIR/config)
+-else
+-  AC_MSG_ERROR([can not find config/ directory in $ac_reltopdir])
+-fi
++AC_CONFIG_AUX_DIR(K5_TOPDIR/config)
+ ])dnl
+ dnl
+ dnl Version info.

sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/files/mit-krb5-1.18.2-krb5-config.patch

@@ -0,0 +1,15 @@
+--- a/build-tools/krb5-config.in
++++ b/build-tools/krb5-config.in
+@@ -208,12 +208,6 @@
+ 
+ 
+ if test -n "$do_libs"; then
+-    # Assumes /usr/lib is the standard library directory everywhere...
+-    if test "$libdir" = /usr/lib; then
+-	libdirarg=
+-    else
+-	libdirarg="-L$libdir"
+-    fi
+     # Ugly gross hack for our build tree
+     lib_flags=`echo $CC_LINK | sed -e 's/\$(CC)//' \
+ 	    -e 's/\$(PURE)//' \

sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/files/mit-krb5-config_LDFLAGS-r1.patch

@@ -0,0 +1,12 @@
+Bug #448778
+--- a/build-tools/krb5-config.in	2012-12-18 02:47:04.000000000 +0000
++++ b/build-tools/krb5-config.in	2012-12-28 07:13:16.582693363 +0000
+@@ -217,7 +217,7 @@
+ 	    -e 's#\$(PROG_RPATH)#'$libdir'#' \
+ 	    -e 's#\$(PROG_LIBPATH)#'$libdirarg'#' \
+ 	    -e 's#\$(RPATH_FLAG)#'"$RPATH_FLAG"'#' \
+-	    -e 's#\$(LDFLAGS)#'"$LDFLAGS"'#' \
++	    -e 's#\$(LDFLAGS)##' \
+ 	    -e 's#\$(PTHREAD_CFLAGS)#'"$PTHREAD_CFLAGS"'#' \
+ 	    -e 's#\$(CFLAGS)##'`
+ 

sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/files/mit-krb5_dont_create_run.patch

@@ -0,0 +1,10 @@
+--- src/Makefile.in	2019-12-12 10:15:51.674552983 +0300
++++ src/Makefile.in	2019-12-12 10:16:33.205543490 +0300
+@@ -71,7 +71,6 @@
+ 		$(KRB5_AD_MODULE_DIR) \
+ 		$(KRB5_LIBKRB5_MODULE_DIR) $(KRB5_TLS_MODULE_DIR) \
+ 		@localstatedir@ @localstatedir@/krb5kdc \
+-		@runstatedir@ @runstatedir@/krb5kdc \
+ 		$(KRB5_INCSUBDIRS) $(datadir) $(EXAMPLEDIR) \
+ 		$(PKGCONFIG_DIR)
+ 

sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/files/mit-krb5_dont_create_rundir.patch

@@ -0,0 +1,10 @@
+--- src/Makefile.in	2019-12-12 10:15:51.674552983 +0300
++++ src/Makefile.in	2019-12-12 10:16:33.205543490 +0300
+@@ -71,7 +71,6 @@
+ 		$(KRB5_AD_MODULE_DIR) \
+ 		$(KRB5_LIBKRB5_MODULE_DIR) $(KRB5_TLS_MODULE_DIR) \
+ 		$(localstatedir) $(localstatedir)/krb5kdc \
+-		$(runstatedir) $(runstatedir)/krb5kdc \
+ 		$(KRB5_INCSUBDIRS) $(datadir) $(EXAMPLEDIR) \
+ 		$(PKGCONFIG_DIR)
+ 

sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/files/mit-krb5kadmind.confd

@@ -0,0 +1,2 @@
+# Define startup options for Kerberos administration server
+KADMIND_OPTS=""

sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/files/mit-krb5kadmind.initd-r2

@@ -0,0 +1,25 @@
+#!/sbin/openrc-run
+
+#---------------------------------------------------------------------------
+# This script starts/stops the MIT Kerberos 5 Admin daemon
+#---------------------------------------------------------------------------
+
+daemon="MIT Kerberos 5 Admin daemon"
+exec="/usr/sbin/kadmind"
+
+depend() {
+	need mit-krb5kdc
+	use net
+}
+
+start() {
+	ebegin "Starting $daemon"
+	start-stop-daemon --start --quiet --exec ${exec} -- ${KADMIND_OPTS} 1>&2
+	eend $? "Error starting $daemon"
+}
+
+stop() {
+	ebegin "Stopping $daemon"
+	start-stop-daemon --stop --quiet --exec ${exec} 1>&2
+	eend $? "Error stopping $daemon"
+}

sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/files/mit-krb5kadmind.service

@@ -0,0 +1,8 @@
+[Unit]
+Description=Kerberos 5 administration server
+
+[Service]
+ExecStart=/usr/sbin/kadmind -nofork
+
+[Install]
+WantedBy=multi-user.target

sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/files/mit-krb5kdc.confd

@@ -0,0 +1,2 @@
+# Define startup options for Kerberos KDC
+KDC_OPTS=""

sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/files/mit-krb5kdc.initd-r2

@@ -0,0 +1,24 @@
+#!/sbin/openrc-run
+
+#---------------------------------------------------------------------------
+# This script starts/stops the MIT Kerberos 5 KDC
+#---------------------------------------------------------------------------
+
+daemon="MIT Kerberos 5 KDC"
+exec="/usr/sbin/krb5kdc"
+
+depend() {
+	use net
+}
+
+start() {
+	ebegin "Starting $daemon"
+	start-stop-daemon --start --quiet --exec ${exec} -- ${KDC_OPTS} 1>&2
+	eend $? "Error starting $daemon"
+}
+
+stop() {
+	ebegin "Stopping $daemon"
+	start-stop-daemon --stop --quiet --exec ${exec} 1>&2
+	eend $? "Error stopping $daemon"
+}

sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/files/mit-krb5kdc.service

@@ -0,0 +1,9 @@
+[Unit]
+Description=Kerberos 5 KDC
+
+[Service]
+ExecStart=/usr/sbin/krb5kdc -n
+Restart=always
+
+[Install]
+WantedBy=multi-user.target

sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/files/mit-krb5kpropd.confd

@@ -0,0 +1,2 @@
+# Define startup options for Kerberos incremental propagation server
+KPROPD_OPTS=""

sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/files/mit-krb5kpropd.initd-r2

@@ -0,0 +1,24 @@
+#!/sbin/openrc-run
+
+#---------------------------------------------------------------------------
+# This script starts/stops the MIT Kerberos 5 kpropd
+#---------------------------------------------------------------------------
+
+daemon="MIT Kerberos 5 kpropd"
+exec="/usr/sbin/kpropd"
+
+depend() {
+	use net mit-krb5kdc mit-krb5kadmind
+}
+
+start() {
+	ebegin "Starting $daemon"
+	start-stop-daemon --start --quiet --exec ${exec} -- ${KPROPD_OPTS} 1>&2
+	eend $? "Error starting $daemon"
+}
+
+stop() {
+	ebegin "Stopping $daemon"
+	start-stop-daemon --stop --quiet --exec ${exec} 1>&2
+	eend $? "Error stopping $daemon"
+}

sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/files/mit-krb5kpropd.service

@@ -0,0 +1,8 @@
+[Unit]
+Description=Kerberos 5 propagation server
+
+[Service]
+ExecStart=/usr/sbin/kpropd -S
+
+[Install]
+WantedBy=multi-user.target

sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/files/mit-krb5kpropd.socket

@@ -0,0 +1,9 @@
+[Unit]
+Description=Kerberos 5 propagation server
+
+[Socket]
+ListenStream=754
+Accept=yes
+
+[Install]
+WantedBy=sockets.target

sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/files/mit-krb5kpropd_at.service

@@ -0,0 +1,8 @@
+[Unit]
+Description=Kerberos 5 propagation server
+Conflicts=mit-krb5kpropd.service
+
+[Service]
+ExecStart=/usr/sbin/kpropd
+StandardInput=socket
+StandardError=syslog

sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/metadata.xml

@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+<maintainer type="project">
+  <email>kerberos@gentoo.org</email>
+  <name>Kerberos</name>
+</maintainer>
+<use>
+  <flag name="doc">
+    Creates and installs the API and implementation
+    documentation. This is only useful if you want to develop software
+    which depends on kerberos
+  </flag>
+  <flag name="keyutils">Enable for the keyring ccache using keyutils</flag>
+  <flag name="lmdb">Add support for using dev-db/lmdb for lookup tables</flag>
+  <flag name="pkinit">Enable pkinit support for the initial ticket</flag>
+  <flag name="openldap">Enable support for ldap as a database backend</flag>
+</use>
+<upstream>
+  <remote-id type="cpe">cpe:/a:mit:kerberos</remote-id>
+</upstream>
+</pkgmetadata>

sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/mit-krb5-1.18.2-r4.ebuild

@@ -0,0 +1,166 @@
+# Copyright 1999-2021 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+PYTHON_COMPAT=( python3_{7,8,9} )
+inherit autotools flag-o-matic multilib-minimal python-any-r1 systemd toolchain-funcs
+
+MY_P="${P/mit-}"
+P_DIR=$(ver_cut 1-2)
+DESCRIPTION="MIT Kerberos V"
+HOMEPAGE="https://web.mit.edu/kerberos/www/"
+SRC_URI="https://web.mit.edu/kerberos/dist/krb5/${P_DIR}/${MY_P}.tar.gz"
+
+LICENSE="openafs-krb5-a BSD MIT OPENLDAP BSD-2 HPND BSD-4 ISC RSA CC-BY-SA-3.0 || ( BSD-2 GPL-2+ )"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~mips ppc ppc64 ~s390 sparc x86"
+IUSE="cpu_flags_x86_aes doc +keyutils lmdb nls openldap +pkinit selinux +threads test xinetd"
+
+# Test suite requires network access
+RESTRICT="test"
+
+DEPEND="
+	!!app-crypt/heimdal
+	>=sys-libs/e2fsprogs-libs-1.42.9[${MULTILIB_USEDEP}]
+	|| (
+		>=dev-libs/libverto-0.2.5[libev,${MULTILIB_USEDEP}]
+		>=dev-libs/libverto-0.2.5[libevent,${MULTILIB_USEDEP}]
+	)
+	keyutils? ( >=sys-apps/keyutils-1.5.8:=[${MULTILIB_USEDEP}] )
+	lmdb? ( dev-db/lmdb )
+	nls? ( sys-devel/gettext[${MULTILIB_USEDEP}] )
+	openldap? ( >=net-nds/openldap-2.4.38-r1[${MULTILIB_USEDEP}] )
+	pkinit? (
+		>=dev-libs/openssl-1.0.1h-r2:0=[${MULTILIB_USEDEP}]
+	)
+	xinetd? ( sys-apps/xinetd )
+	"
+BDEPEND="
+	${PYTHON_DEPS}
+	virtual/yacc
+	cpu_flags_x86_aes? (
+		amd64? ( dev-lang/yasm )
+		x86? ( dev-lang/yasm )
+	)
+	doc? ( virtual/latex-base )
+	test? (
+		${PYTHON_DEPS}
+		dev-lang/tcl:0
+		dev-util/dejagnu
+		dev-util/cmocka
+	)"
+RDEPEND="${DEPEND}
+	selinux? ( sec-policy/selinux-kerberos )"
+
+S=${WORKDIR}/${MY_P}/src
+
+PATCHES=(
+	"${FILESDIR}/${PN}-1.12_warn_cflags.patch"
+	"${FILESDIR}/${PN}-config_LDFLAGS-r1.patch"
+	"${FILESDIR}/${PN}_dont_create_run.patch"
+	"${FILESDIR}/CVE-2020-28196.patch"
+	"${FILESDIR}/${PN}-1.18.2-krb5-config.patch"
+	"${FILESDIR}/${PN}-1.18.2-autoconf-2.70.patch"
+)
+
+MULTILIB_CHOST_TOOLS=(
+	/usr/bin/krb5-config
+)
+
+src_prepare() {
+	default
+	# Make sure we always use the system copies.
+	rm -rf util/{et,ss,verto}
+	sed -i 's:^[[:space:]]*util/verto$::' configure.ac || die
+
+	eautoreconf
+}
+
+src_configure() {
+	# QA
+	append-flags -fno-strict-aliasing
+	append-flags -fno-strict-overflow
+
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	ECONF_SOURCE=${S} \
+	WARN_CFLAGS="set" \
+	econf \
+		$(use_with openldap ldap) \
+		"$(multilib_native_use_with test tcl "${EPREFIX}/usr")" \
+		$(use_enable nls) \
+		$(use_enable pkinit) \
+		$(use_enable threads thread-support) \
+		$(use_with lmdb) \
+		$(use_with keyutils) \
+		--without-hesiod \
+		--enable-shared \
+		--with-system-et \
+		--with-system-ss \
+		--enable-dns-for-realm \
+		--enable-kdc-lookaside-cache \
+		--with-system-verto \
+		--disable-rpath \
+		\
+		AR="$(tc-getAR)"
+}
+
+multilib_src_compile() {
+	emake -j1
+}
+
+multilib_src_test() {
+	multilib_is_native_abi && emake -j1 check
+}
+
+multilib_src_install() {
+	emake \
+		DESTDIR="${D}" \
+		EXAMPLEDIR="${EPREFIX}/usr/share/doc/${PF}/examples" \
+		install
+}
+
+multilib_src_install_all() {
+	# default database dir
+	keepdir /var/lib/krb5kdc
+
+	cd ..
+	dodoc README
+
+	if use doc; then
+		dodoc -r doc/html
+		docinto pdf
+		dodoc doc/pdf/*.pdf
+	fi
+
+	newinitd "${FILESDIR}"/mit-krb5kadmind.initd-r2 mit-krb5kadmind
+	newinitd "${FILESDIR}"/mit-krb5kdc.initd-r2 mit-krb5kdc
+	newinitd "${FILESDIR}"/mit-krb5kpropd.initd-r2 mit-krb5kpropd
+	newconfd "${FILESDIR}"/mit-krb5kadmind.confd mit-krb5kadmind
+	newconfd "${FILESDIR}"/mit-krb5kdc.confd mit-krb5kdc
+	newconfd "${FILESDIR}"/mit-krb5kpropd.confd mit-krb5kpropd
+
+	systemd_newunit "${FILESDIR}"/mit-krb5kadmind.service mit-krb5kadmind.service
+	systemd_newunit "${FILESDIR}"/mit-krb5kdc.service mit-krb5kdc.service
+	systemd_newunit "${FILESDIR}"/mit-krb5kpropd.service mit-krb5kpropd.service
+	systemd_newunit "${FILESDIR}"/mit-krb5kpropd_at.service "mit-krb5kpropd@.service"
+	systemd_newunit "${FILESDIR}"/mit-krb5kpropd.socket mit-krb5kpropd.socket
+
+	insinto /etc
+	newins "${ED}/usr/share/doc/${PF}/examples/krb5.conf" krb5.conf.example
+	insinto /var/lib/krb5kdc
+	newins "${ED}/usr/share/doc/${PF}/examples/kdc.conf" kdc.conf.example
+
+	if use openldap ; then
+		insinto /etc/openldap/schema
+		doins "${S}/plugins/kdb/ldap/libkdb_ldap/kerberos.schema"
+	fi
+
+	if use xinetd ; then
+		insinto /etc/xinetd.d
+		newins "${FILESDIR}/kpropd.xinetd" kpropd
+	fi
+}