app-crypt/mit-krb5: Sync with Gentoo

It's from Gentoo commit 02b17c9bb64e147affc4acecaa0ff4151b2329bf.

sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/Manifest

@@ -1,2 +1 @@
-DIST krb5-1.19.2.tar.gz 8741053 BLAKE2B 963722721201e75381c91a2af6e982f569a5b1602beb2d1ded83d35f6f914235a6ed91e5d54f56c97e94921a32ed27c49aded258327966ee13d39485208c38d8 SHA512 b90d6ed0e1e8a87eb5cb2c36d88b823a6a6caabf85e5d419adb8a930f7eea09a5f8491464e7e454cca7ba88be09d19415962fe0036ad2e31fc584f9fc0bbd470
+DIST krb5-1.20.1.tar.gz 8661660 BLAKE2B ead16f8b1aec8bba3776628b74257c9aec891770c1fa6d5c5e66275db5f078ca59c9944cd2b017453b777ce080f8e5a322f735fab77691479cfad7b881b92830 SHA512 6f57479f13f107cd84f30de5c758eb6b9fc59171329c13e5da6073b806755f8d163eb7bd84767ea861ad6458ea0c9eeb00ee044d3bcad01ef136e9888564b6a2
-DIST krb5-1.19.3.tar.gz 8741343 BLAKE2B 79e68237ee82affa85299060c509e303453c0fab965adc6b9ed305ab64a1f73bd51e65df1b3faadc60815cd506ffefaeed535765ca060d393a9141812f85b48a SHA512 18235440d6f7d8a72c5d7ca5cd8c6465e8adf091d85c483225c7b00d64b4688c1c7924cb800c2fc17e590b2709f1a9de48e6ec79f6debd11dcb7d6fa16c6f351

sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5-1.20-missing-time-include.patch

@@ -0,0 +1,20 @@
+https://github.com/krb5/krb5/commit/c3958cec43b598b25484b9805224c56f25f7a755
+https://bugs.gentoo.org/854561
+
+From: Greg Hudson <ghudson@mit.edu>
+Date: Tue, 29 Mar 2022 16:27:55 -0400
+Subject: [PATCH] Include time.h in kdb.h
+
+kdb.h uses time_t, and therefore must include <time.h> to ensure its
+definition.  Noticed when building t_sort_key_data.c on macOS.
+--- a/include/kdb.h
++++ b/include/kdb.h
+@@ -65,6 +65,7 @@
+ #ifndef KRB5_KDB5__
+ #define KRB5_KDB5__
+ 
++#include <time.h>
+ #include <krb5.h>
+ 
+ /* This version will be incremented when incompatible changes are made to the
+

sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5-1.20.1-autoconf-2.72.patch

@@ -0,0 +1,31 @@
+https://github.com/krb5/krb5/commit/d864d740d019fdf2c640460f2aa2760c7fa4d5e9
+
+From d864d740d019fdf2c640460f2aa2760c7fa4d5e9 Mon Sep 17 00:00:00 2001
+From: Julien Rische <jrische@redhat.com>
+Date: Thu, 17 Nov 2022 15:01:24 +0100
+Subject: [PATCH] Fix aclocal.m4 syntax error for autoconf 2.72
+
+An incorrect closure inside KRB5_AC_INET6 is innocuous with autoconf
+versions up to 2.71, but will cause an error at configure time with
+the forthcoming autoconf 2.72.
+
+[ghudson@mit.edu: added more context to commit message]
+
+ticket: 9077 (new)
+tags: pullup
+target_version: 1.20-next
+target_version: 1.19-next
+--- a/aclocal.m4
++++ b/aclocal.m4
+@@ -409,8 +409,8 @@ else
+       [[struct sockaddr_in6 in;
+         AF_INET6;
+         IN6_IS_ADDR_LINKLOCAL(&in.sin6_addr);]])],
+-    [krb5_cv_inet6=yes], [krb5_cv_inet6=no])])
+-fi
++    [krb5_cv_inet6=yes], [krb5_cv_inet6=no])
++fi])
+ AC_MSG_RESULT($krb5_cv_inet6)
+ if test "$krb5_cv_inet6" = no && test "$ac_cv_func_inet_ntop" = yes; then
+ AC_MSG_CHECKING(for IPv6 compile-time support with -DINET6)
+

sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5-CVE-2021-37750.patch

@@ -1,43 +0,0 @@
-From d775c95af7606a51bf79547a94fa52ddd1cb7f49 Mon Sep 17 00:00:00 2001
-From: Greg Hudson <ghudson@mit.edu>
-Date: Tue, 3 Aug 2021 01:15:27 -0400
-Subject: [PATCH] Fix KDC null deref on TGS inner body null server
-
-After the KDC decodes a FAST inner body, it does not check for a null
-server.  Prior to commit 39548a5b17bbda9eeb63625a201cfd19b9de1c5b this
-would typically result in an error from krb5_unparse_name(), but with
-the addition of get_local_tgt() it results in a null dereference.  Add
-a null check.
-
-Reported by Joseph Sutton of Catalyst.
-
-CVE-2021-37750:
-
-In MIT krb5 releases 1.14 and later, an authenticated attacker can
-cause a null dereference in the KDC by sending a FAST TGS request with
-no server field.
-
-ticket: 9008 (new)
-tags: pullup
-target_version: 1.19-next
-target_version: 1.18-next
----
- src/kdc/do_tgs_req.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c
-index 582e497cc9..32dc65fa8e 100644
---- a/kdc/do_tgs_req.c
-+++ b/kdc/do_tgs_req.c
-@@ -204,6 +204,11 @@ process_tgs_req(krb5_kdc_req *request, krb5_data *pkt,
-         status = "FIND_FAST";
-         goto cleanup;
-     }
-+    if (sprinc == NULL) {
-+        status = "NULL_SERVER";
-+        errcode = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
-+        goto cleanup;
-+    }
- 
-     errcode = get_local_tgt(kdc_context, &sprinc->realm, header_server,
-                             &local_tgt, &local_tgt_storage, &local_tgt_key);

sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/metadata.xml

@@ -12,11 +12,12 @@
     which depends on kerberos
   </flag>
   <flag name="keyutils">Enable for the keyring ccache using keyutils</flag>
-  <flag name="lmdb">Add support for using dev-db/lmdb for lookup tables</flag>
+  <flag name="lmdb">Add support for using <pkg>dev-db/lmdb</pkg> for lookup tables</flag>
   <flag name="pkinit">Enable pkinit support for the initial ticket</flag>
   <flag name="openldap">Enable support for ldap as a database backend</flag>
 </use>
 <upstream>
   <remote-id type="cpe">cpe:/a:mit:kerberos</remote-id>
+  <remote-id type="github">krb5/krb5</remote-id>
 </upstream>
 </pkgmetadata>

sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/mit-krb5-1.19.2-r4.ebuild

@@ -1,162 +0,0 @@
-# Copyright 1999-2022 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-PYTHON_COMPAT=( python3_{8..10} )
-inherit autotools flag-o-matic multilib-minimal python-any-r1 systemd toolchain-funcs
-
-MY_P="${P/mit-}"
-P_DIR=$(ver_cut 1-2)
-DESCRIPTION="MIT Kerberos V"
-HOMEPAGE="https://web.mit.edu/kerberos/www/"
-SRC_URI="https://web.mit.edu/kerberos/dist/krb5/${P_DIR}/${MY_P}.tar.gz"
-
-LICENSE="openafs-krb5-a BSD MIT OPENLDAP BSD-2 HPND BSD-4 ISC RSA CC-BY-SA-3.0 || ( BSD-2 GPL-2+ )"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~mips ~ppc ppc64 ~riscv ~s390 sparc x86"
-IUSE="cpu_flags_x86_aes doc +keyutils lmdb nls openldap +pkinit selinux +threads test xinetd"
-
-# some tests requires network access
-RESTRICT="test"
-
-DEPEND="
-	!!app-crypt/heimdal
-	>=sys-fs/e2fsprogs-1.46.4-r51[${MULTILIB_USEDEP}]
-	|| (
-		>=dev-libs/libverto-0.2.5[libev,${MULTILIB_USEDEP}]
-		>=dev-libs/libverto-0.2.5[libevent,${MULTILIB_USEDEP}]
-	)
-	keyutils? ( >=sys-apps/keyutils-1.5.8:=[${MULTILIB_USEDEP}] )
-	lmdb? ( dev-db/lmdb:= )
-	nls? ( sys-devel/gettext[${MULTILIB_USEDEP}] )
-	openldap? ( >=net-nds/openldap-2.4.38-r1:=[${MULTILIB_USEDEP}] )
-	pkinit? ( >=dev-libs/openssl-1.0.1h-r2:0=[${MULTILIB_USEDEP}] )
-	xinetd? ( sys-apps/xinetd )
-	"
-BDEPEND="
-	${PYTHON_DEPS}
-	virtual/yacc
-	cpu_flags_x86_aes? (
-		amd64? ( dev-lang/yasm )
-		x86? ( dev-lang/yasm )
-	)
-	doc? ( virtual/latex-base )
-	test? (
-		${PYTHON_DEPS}
-		dev-lang/tcl:0
-		dev-util/dejagnu
-		dev-util/cmocka
-	)"
-RDEPEND="${DEPEND}
-	selinux? ( sec-policy/selinux-kerberos )"
-
-S=${WORKDIR}/${MY_P}/src
-
-PATCHES=(
-	"${FILESDIR}/${PN}-1.12_warn_cflags.patch"
-	"${FILESDIR}/${PN}-config_LDFLAGS-r1.patch"
-	"${FILESDIR}/${PN}_dont_create_rundir.patch"
-	"${FILESDIR}/${PN}-1.18.2-krb5-config.patch"
-	"${FILESDIR}/${PN}-CVE-2021-37750.patch"
-)
-
-MULTILIB_CHOST_TOOLS=(
-	/usr/bin/krb5-config
-)
-
-src_prepare() {
-	default
-	# Make sure we always use the system copies.
-	rm -rf util/{et,ss,verto}
-	sed -i 's:^[[:space:]]*util/verto$::' configure.ac || die
-
-	eautoreconf
-}
-
-src_configure() {
-	# QA
-	append-flags -fno-strict-aliasing
-	append-flags -fno-strict-overflow
-
-	multilib-minimal_src_configure
-}
-
-multilib_src_configure() {
-	ECONF_SOURCE=${S} \
-	AR="$(tc-getAR)" \
-	WARN_CFLAGS="set" \
-	econf \
-		$(use_with openldap ldap) \
-		"$(multilib_native_use_with test tcl "${EPREFIX}/usr")" \
-		$(use_enable nls) \
-		$(use_enable pkinit) \
-		$(use_enable threads thread-support) \
-		$(use_with lmdb) \
-		$(use_with keyutils) \
-		--without-hesiod \
-		--enable-shared \
-		--with-system-et \
-		--with-system-ss \
-		--enable-dns-for-realm \
-		--enable-kdc-lookaside-cache \
-		--with-system-verto \
-		--disable-rpath
-}
-
-multilib_src_compile() {
-	emake -j1
-}
-
-multilib_src_test() {
-	multilib_is_native_abi && emake -j1 check
-}
-
-multilib_src_install() {
-	emake \
-		DESTDIR="${D}" \
-		EXAMPLEDIR="${EPREFIX}/usr/share/doc/${PF}/examples" \
-		install
-}
-
-multilib_src_install_all() {
-	# default database dir
-	keepdir /var/lib/krb5kdc
-
-	cd ..
-	dodoc README
-
-	if use doc; then
-		dodoc -r doc/html
-		docinto pdf
-		dodoc doc/pdf/*.pdf
-	fi
-
-	newinitd "${FILESDIR}"/mit-krb5kadmind.initd-r2 mit-krb5kadmind
-	newinitd "${FILESDIR}"/mit-krb5kdc.initd-r2 mit-krb5kdc
-	newinitd "${FILESDIR}"/mit-krb5kpropd.initd-r2 mit-krb5kpropd
-	newconfd "${FILESDIR}"/mit-krb5kadmind.confd mit-krb5kadmind
-	newconfd "${FILESDIR}"/mit-krb5kdc.confd mit-krb5kdc
-	newconfd "${FILESDIR}"/mit-krb5kpropd.confd mit-krb5kpropd
-
-	systemd_newunit "${FILESDIR}"/mit-krb5kadmind.service mit-krb5kadmind.service
-	systemd_newunit "${FILESDIR}"/mit-krb5kdc.service mit-krb5kdc.service
-	systemd_newunit "${FILESDIR}"/mit-krb5kpropd.service mit-krb5kpropd.service
-	systemd_newunit "${FILESDIR}"/mit-krb5kpropd_at.service "mit-krb5kpropd@.service"
-	systemd_newunit "${FILESDIR}"/mit-krb5kpropd.socket mit-krb5kpropd.socket
-
-	insinto /etc
-	newins "${ED}/usr/share/doc/${PF}/examples/krb5.conf" krb5.conf.example
-	insinto /var/lib/krb5kdc
-	newins "${ED}/usr/share/doc/${PF}/examples/kdc.conf" kdc.conf.example
-
-	if use openldap ; then
-		insinto /etc/openldap/schema
-		doins "${S}/plugins/kdb/ldap/libkdb_ldap/kerberos.schema"
-	fi
-
-	if use xinetd ; then
-		insinto /etc/xinetd.d
-		newins "${FILESDIR}/kpropd.xinetd" kpropd
-	fi
-}

sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/mit-krb5-1.20.1.ebuild

@@ -3,8 +3,8 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{8..10} )
+PYTHON_COMPAT=( python3_{8..11} )
-inherit autotools flag-o-matic multilib-minimal python-any-r1 systemd toolchain-funcs
+inherit autotools python-any-r1 systemd toolchain-funcs multilib-minimal
 
 MY_P="${P/mit-}"
 P_DIR=$(ver_cut 1-2)
@@ -14,11 +14,10 @@ SRC_URI="https://web.mit.edu/kerberos/dist/krb5/${P_DIR}/${MY_P}.tar.gz"
 
 LICENSE="openafs-krb5-a BSD MIT OPENLDAP BSD-2 HPND BSD-4 ISC RSA CC-BY-SA-3.0 || ( BSD-2 GPL-2+ )"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~mips ~ppc ppc64 ~riscv ~s390 sparc x86"
 IUSE="cpu_flags_x86_aes doc +keyutils lmdb nls openldap +pkinit selinux +threads test xinetd"
 
-# some tests requires network access
+RESTRICT="!test? ( test )"
-RESTRICT="test"
 
 DEPEND="
 	!!app-crypt/heimdal
@@ -36,18 +35,14 @@ DEPEND="
 	"
 BDEPEND="
 	${PYTHON_DEPS}
-	virtual/yacc
+	app-alternatives/yacc
 	cpu_flags_x86_aes? (
 		amd64? ( dev-lang/yasm )
 		x86? ( dev-lang/yasm )
 	)
 	doc? ( virtual/latex-base )
-	test? (
+	test? ( dev-util/cmocka )
-		${PYTHON_DEPS}
+	"
-		dev-lang/tcl:0
-		dev-util/dejagnu
-		dev-util/cmocka
-	)"
 RDEPEND="${DEPEND}
 	selinux? ( sec-policy/selinux-kerberos )"
 
@@ -58,6 +53,8 @@ PATCHES=(
 	"${FILESDIR}/${PN}-config_LDFLAGS-r1.patch"
 	"${FILESDIR}/${PN}_dont_create_rundir.patch"
 	"${FILESDIR}/${PN}-1.18.2-krb5-config.patch"
+	"${FILESDIR}/${PN}-1.20-missing-time-include.patch"
+	"${FILESDIR}/${PN}-1.20.1-autoconf-2.72.patch"
 )
 
 MULTILIB_CHOST_TOOLS=(
@@ -73,21 +70,12 @@ src_prepare() {
 	eautoreconf
 }
 
-src_configure() {
-	# QA
-	append-flags -fno-strict-aliasing
-	append-flags -fno-strict-overflow
-
-	multilib-minimal_src_configure
-}
-
 multilib_src_configure() {
 	ECONF_SOURCE=${S} \
 	AR="$(tc-getAR)" \
 	WARN_CFLAGS="set" \
 	econf \
 		$(use_with openldap ldap) \
-		"$(multilib_native_use_with test tcl "${EPREFIX}/usr")" \
 		$(use_enable nls) \
 		$(use_enable pkinit) \
 		$(use_enable threads thread-support) \