Merge pull request #322 from flatcar-linux/dongsu/libarchive-3.6.1

app-arch/libarchive: update to 3.6.1
2025-08-16 09:26:58 +02:00 · 2022-04-14 17:00:59 +02:00 · 2022-04-14 17:00:59 +02:00 · cfa27b286f
commit cfa27b286f
parent 0e9397c108 c734e9c3da
6 changed files with 165 additions and 15 deletions
--- a/sdk_container/src/third_party/portage-stable/app-arch/libarchive/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/Manifest
@ -1,2 +1,6 @@
 DIST libarchive-3.5.3.tar.gz 7038767 BLAKE2B a9f8b44c42efadb29cba2597c201bf9064d69632db92dad07df3f1bc9667257d8578c2ae7fae65ffc53e075466e3d326e4fe77d18d3f06656a4a255324a81fba SHA512 889879e869f7391e3b85b5e3c2bbad3c1a5e50ec7b62c0be8f2817e2dfa8410e6eb409a3c4dce2675b9e7134bae3f129475e331bc3d15d637b91412c7eb026a2
+DIST libarchive-3.5.3.tar.gz.asc 833 BLAKE2B 2a2af61d25201feef727d05554b3b1553779afeb155d1d68a3e2b64e71eca6ca06cd6d9c77cc98c2d40c0d654c7de535d9901e55f527cb74dc8933a402207553 SHA512 1a6c930e62961ee97d2983ad7f7aded61dd65668737cc7fc42b3f2f32a699931fe74c1b7abe4686e061e7b39500a67adea929f390a8dcb2037d0d58f3b30441d
 DIST libarchive-3.6.0.tar.gz 8570393 BLAKE2B 57a8e1681485a489dc9d3823cc8c9b0d68e7d84510a3eff0b6adc268825bb9aa6179d8a810b249c3f72e3674e1df6e5ba2ed0043196458bedc3c1d880c5d4a0b SHA512 700579c5dd15b61333cc4dbf01ebfbd26d6e8c20d5cbe6525683634418fec5c87a5a1e28a81cc59ad7c94218682e406aa3b55d81036bd9fa31d83d989c6d764c
+DIST libarchive-3.6.0.tar.gz.asc 833 BLAKE2B 0b3600e998ccf3e3862523116db071f5c43165a422f292053d7be14a67a294b4b9ed76a939156ad0f494443d9a6a6dde46e73c1107d50c7e150030c7627d8851 SHA512 2450a3463ec1b4b2c590139ea2b6f0db0afbd8ff7939da5d90c5adfb3d27618ca36b03596b707211de82341ca157acaf510fc51ee26d6901d46e15341406acd2
+DIST libarchive-3.6.1.tar.gz 7431598 BLAKE2B 1f060edb3d7579e406db1e757af8193d6b23c56a07dd7392cacfc37d6634de1a732a4845a38e4c7a539a634475e54f202689c4a46f1c27655e91211783a6364f SHA512 58f7ac0c52116f73326a07dec10ff232be33b318862078785dc39f1fb2f8773b5194eabfa14764bb51ce6a5a1aa8820526e7f4c76087a6f4fcbe7789a22275b4
+DIST libarchive-3.6.1.tar.gz.asc 833 BLAKE2B 6b8ebcfbffdc51b693ba51d1c24bc89b9f8da81257535427ccae7791f7849197685e450b62fdb0972c4313244bf89b659662f678c68e73467bd256873b1ca83c SHA512 4120b21113a21c0afce16be72ac3bd41e744e99c713a2cf005d128c4b2382e9dcac638d4615771b9deceee0e1c99806499aaea35227fd4e435d15e672b4d6624
--- a/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.5.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.5.3.ebuild
@ -2,16 +2,20 @@
 # Distributed under the terms of the GNU General Public License v2

 EAPI=8
-inherit multilib-minimal toolchain-funcs
+inherit multilib-minimal toolchain-funcs verify-sig

 DESCRIPTION="Multi-format archive and compression library"
 HOMEPAGE="https://www.libarchive.org/"
-SRC_URI="https://www.libarchive.org/downloads/${P}.tar.gz"
+SRC_URI="
+	https://www.libarchive.org/downloads/${P}.tar.gz
+	verify-sig? ( https://www.libarchive.org/downloads/${P}.tar.gz.asc )
+"

 LICENSE="BSD BSD-2 BSD-4 public-domain"
 SLOT="0/13"
 KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 IUSE="acl blake2 +bzip2 +e2fsprogs expat +iconv lz4 +lzma lzo nettle static-libs xattr zstd"
+VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/libarchive.org.asc

 RDEPEND="
 	sys-libs/zlib[${MULTILIB_USEDEP}]
@ -29,12 +33,17 @@ RDEPEND="
 	lzma? ( >=app-arch/xz-utils-5.2.5-r1[${MULTILIB_USEDEP}] )
 	lzo? ( >=dev-libs/lzo-2[${MULTILIB_USEDEP}] )
 	nettle? ( dev-libs/nettle:0=[${MULTILIB_USEDEP}] )
-	zstd? ( app-arch/zstd[${MULTILIB_USEDEP}] )"
+	zstd? ( app-arch/zstd[${MULTILIB_USEDEP}] )
+"
 DEPEND="${RDEPEND}
 	kernel_linux? (
 		virtual/os-headers
 		e2fsprogs? ( sys-fs/e2fsprogs )
-	)"
+	)
+"
+BDEPEND="
+	verify-sig? ( sec-keys/openpgp-keys-libarchive )
+"

 multilib_src_configure() {
 	export ac_cv_header_ext2fs_ext2_fs_h=$(usex e2fsprogs) #354923
@ -60,9 +69,9 @@ multilib_src_configure() {
 	)
 	if multilib_is_native_abi ; then
 		myconf+=(
-			--enable-bsdcat=$(tc-is-static-only && echo static || echo shared)
-			--enable-bsdcpio=$(tc-is-static-only && echo static || echo shared)
-			--enable-bsdtar=$(tc-is-static-only && echo static || echo shared)
+			--enable-bsdcat="$(tc-is-static-only && echo static || echo shared)"
+			--enable-bsdcpio="$(tc-is-static-only && echo static || echo shared)"
+			--enable-bsdtar="$(tc-is-static-only && echo static || echo shared)"
 		)
 	else
 		myconf+=(
--- a/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.6.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.6.0.ebuild
@ -2,16 +2,20 @@
 # Distributed under the terms of the GNU General Public License v2

 EAPI=8
-inherit multilib-minimal toolchain-funcs
+inherit multilib-minimal toolchain-funcs verify-sig

 DESCRIPTION="Multi-format archive and compression library"
 HOMEPAGE="https://www.libarchive.org/"
-SRC_URI="https://www.libarchive.org/downloads/${P}.tar.gz"
+SRC_URI="
+	https://www.libarchive.org/downloads/${P}.tar.gz
+	verify-sig? ( https://www.libarchive.org/downloads/${P}.tar.gz.asc )
+"

 LICENSE="BSD BSD-2 BSD-4 public-domain"
 SLOT="0/13"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 IUSE="acl blake2 +bzip2 +e2fsprogs expat +iconv lz4 +lzma lzo nettle static-libs xattr zstd"
+VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/libarchive.org.asc

 RDEPEND="
 	sys-libs/zlib[${MULTILIB_USEDEP}]
@ -29,12 +33,17 @@ RDEPEND="
 	lzma? ( >=app-arch/xz-utils-5.2.5-r1[${MULTILIB_USEDEP}] )
 	lzo? ( >=dev-libs/lzo-2[${MULTILIB_USEDEP}] )
 	nettle? ( dev-libs/nettle:0=[${MULTILIB_USEDEP}] )
-	zstd? ( app-arch/zstd[${MULTILIB_USEDEP}] )"
+	zstd? ( app-arch/zstd[${MULTILIB_USEDEP}] )
+"
 DEPEND="${RDEPEND}
 	kernel_linux? (
 		virtual/os-headers
 		e2fsprogs? ( sys-fs/e2fsprogs )
-	)"
+	)
+"
+BDEPEND="
+	verify-sig? ( sec-keys/openpgp-keys-libarchive )
+"

 multilib_src_configure() {
 	export ac_cv_header_ext2fs_ext2_fs_h=$(usex e2fsprogs) #354923
@ -60,9 +69,9 @@ multilib_src_configure() {
 	)
 	if multilib_is_native_abi ; then
 		myconf+=(
-			--enable-bsdcat=$(tc-is-static-only && echo static || echo shared)
-			--enable-bsdcpio=$(tc-is-static-only && echo static || echo shared)
-			--enable-bsdtar=$(tc-is-static-only && echo static || echo shared)
+			--enable-bsdcat="$(tc-is-static-only && echo static || echo shared)"
+			--enable-bsdcpio="$(tc-is-static-only && echo static || echo shared)"
+			--enable-bsdtar="$(tc-is-static-only && echo static || echo shared)"
 		)
 	else
 		myconf+=(
--- a/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.6.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.6.1.ebuild
@ -0,0 +1,126 @@
+# Copyright 1999-2022 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit multilib-minimal toolchain-funcs verify-sig
+
+DESCRIPTION="Multi-format archive and compression library"
+HOMEPAGE="https://www.libarchive.org/"
+SRC_URI="
+	https://www.libarchive.de/downloads/${P}.tar.gz
+	verify-sig? ( https://www.libarchive.de/downloads/${P}.tar.gz.asc )
+"
+
+LICENSE="BSD BSD-2 BSD-4 public-domain"
+SLOT="0/13"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+IUSE="acl blake2 +bzip2 +e2fsprogs expat +iconv lz4 +lzma lzo nettle static-libs xattr zstd"
+VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/libarchive.org.asc
+
+RDEPEND="
+	sys-libs/zlib[${MULTILIB_USEDEP}]
+	acl? ( virtual/acl[${MULTILIB_USEDEP}] )
+	blake2? ( app-crypt/libb2[${MULTILIB_USEDEP}] )
+	bzip2? ( app-arch/bzip2[${MULTILIB_USEDEP}] )
+	expat? ( dev-libs/expat[${MULTILIB_USEDEP}] )
+	!expat? ( dev-libs/libxml2[${MULTILIB_USEDEP}] )
+	iconv? ( virtual/libiconv[${MULTILIB_USEDEP}] )
+	kernel_linux? (
+		xattr? ( sys-apps/attr[${MULTILIB_USEDEP}] )
+	)
+	dev-libs/openssl:0=[${MULTILIB_USEDEP}]
+	lz4? ( >=app-arch/lz4-0_p131:0=[${MULTILIB_USEDEP}] )
+	lzma? ( >=app-arch/xz-utils-5.2.5-r1[${MULTILIB_USEDEP}] )
+	lzo? ( >=dev-libs/lzo-2[${MULTILIB_USEDEP}] )
+	nettle? ( dev-libs/nettle:0=[${MULTILIB_USEDEP}] )
+	zstd? ( app-arch/zstd[${MULTILIB_USEDEP}] )
+"
+DEPEND="${RDEPEND}
+	kernel_linux? (
+		virtual/os-headers
+		e2fsprogs? ( sys-fs/e2fsprogs )
+	)
+"
+BDEPEND="
+	verify-sig? ( sec-keys/openpgp-keys-libarchive )
+"
+
+multilib_src_configure() {
+	export ac_cv_header_ext2fs_ext2_fs_h=$(usex e2fsprogs) #354923
+
+	local myconf=(
+		$(use_enable acl)
+		$(use_enable static-libs static)
+		$(use_enable xattr)
+		$(use_with blake2 libb2)
+		$(use_with bzip2 bz2lib)
+		$(use_with expat)
+		$(use_with !expat xml2)
+		$(use_with iconv)
+		$(use_with lz4)
+		$(use_with lzma)
+		$(use_with lzo lzo2)
+		$(use_with nettle)
+		--with-zlib
+		$(use_with zstd)
+
+		# Windows-specific
+		--without-cng
+	)
+	if multilib_is_native_abi ; then
+		myconf+=(
+			--enable-bsdcat="$(tc-is-static-only && echo static || echo shared)"
+			--enable-bsdcpio="$(tc-is-static-only && echo static || echo shared)"
+			--enable-bsdtar="$(tc-is-static-only && echo static || echo shared)"
+		)
+	else
+		myconf+=(
+			--disable-bsdcat
+			--disable-bsdcpio
+			--disable-bsdtar
+		)
+	fi
+
+	ECONF_SOURCE="${S}" econf "${myconf[@]}"
+}
+
+multilib_src_compile() {
+	if multilib_is_native_abi ; then
+		emake
+	else
+		emake libarchive.la
+	fi
+}
+
+src_test() {
+	mkdir -p "${T}"/bin || die
+	# tests fail when lbzip2[symlink] is used in place of ref bunzip2
+	ln -s "${BROOT}/bin/bunzip2" "${T}"/bin || die
+	local -x PATH=${T}/bin:${PATH}
+	multilib-minimal_src_test
+}
+
+multilib_src_test() {
+	# sandbox is breaking long symlink behavior
+	local -x SANDBOX_ON=0
+	local -x LD_PRELOAD=
+	# some locales trigger different output that breaks tests
+	local -x LC_ALL=C
+	emake check
+}
+
+multilib_src_install() {
+	if multilib_is_native_abi ; then
+		emake DESTDIR="${D}" install
+	else
+		local install_targets=(
+			install-includeHEADERS
+			install-libLTLIBRARIES
+			install-pkgconfigDATA
+		)
+		emake DESTDIR="${D}" "${install_targets[@]}"
+	fi
+
+	# Libs.private: should be used from libarchive.pc instead
+	find "${ED}" -type f -name "*.la" -delete || die
+}
--- a/sdk_container/src/third_party/portage-stable/changelog/security/2022-04-12-libarchive-3.6.1.md
+++ b/sdk_container/src/third_party/portage-stable/changelog/security/2022-04-12-libarchive-3.6.1.md
@ -0,0 +1 @@
+- libarchive ([CVE-2022-26280](https://nvd.nist.gov/vuln/detail/CVE-2022-26280))
--- a/sdk_container/src/third_party/portage-stable/changelog/updates/2022-04-12-libarchive-3.6.1.md
+++ b/sdk_container/src/third_party/portage-stable/changelog/updates/2022-04-12-libarchive-3.6.1.md
@ -0,0 +1 @@
+- libarchive [3.6.1](https://github.com/libarchive/libarchive/releases/tag/v3.6.1)
				`@ -0,0 +1 @@`
				`- libarchive ([CVE-2022-26280](https://nvd.nist.gov/vuln/detail/CVE-2022-26280))`
				`@ -0,0 +1 @@`
				`- libarchive [3.6.1](https://github.com/libarchive/libarchive/releases/tag/v3.6.1)`