[gentoo-commits] repo/gentoo:master commit in: sys-libs/glibc/

[Andreas Hüttel]

commit:     d93339d7f5bfe90901a8c6921d1c221b54c8302a
Author:     Andreas K. Hüttel <dilfridge <AT> gentoo <DOT> org>
AuthorDate: Fri Oct 27 23:30:07 2017 +0000
Commit:     Andreas Hüttel <dilfridge <AT> gentoo <DOT> org>
CommitDate: Fri Oct 27 23:30:19 2017 +0000
URL:        https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d93339d7

sys-libs/glibc: Revision bump to 2.25 patchlevel 12, unkeyworded so far

Resolves CVE-2017-15670, CVE-2017-15804, CVE-2016-6261

Bug: https://bugs.gentoo.org/634920
Bug: https://bugs.gentoo.org/635010
Bug: https://bugs.gentoo.org/635118
Package-Manager: Portage-2.3.13, Repoman-2.3.4

 sys-libs/glibc/Manifest             |   1 +
 sys-libs/glibc/glibc-2.25-r9.ebuild | 154 ++++++++++++++++++++++++++++++++++++
 2 files changed, 155 insertions(+)

diff --git a/sys-libs/glibc/Manifest b/sys-libs/glibc/Manifest
index 88147f03cd5..d47efc91130 100644
--- a/sys-libs/glibc/Manifest
+++ b/sys-libs/glibc/Manifest
@@ -17,6 +17,7 @@ DIST glibc-2.23.tar.xz 13455260 SHA256 94efeb00e4603c8546209cefb3e1a50a5315c86fa
 DIST glibc-2.24-patches-10.tar.bz2 73586 SHA256 d479033b63ff796fea56fb1bde390c442021acd856994b15c983b4a89e46fbbe SHA512 fc9191a85da53a2515bbaab228648936682e04267284049468e0c82284f618ab2907b9247baca701e16edc50640199ff6d8e2a6a93ccbd5a9d3b0eb73cc484ca WHIRLPOOL 7afe94307900a70de2f5e028d8ec9e0f4b06b661ec6493217e51a13d750f891e10b45c0f66d86fa83c16cc3ce539bb257039b33bc3e363469cd03502d956d75e
 DIST glibc-2.24.tar.xz 13554048 SHA256 99d4a3e8efd144d71488e478f62587578c0f4e1fa0b4eed47ee3d4975ebeb5d3 SHA512 a4cb28a2c51a0cc029ed69da7cba11931a615ba897235590b4f7fad2eaabec9042f8250eaac2a5860997437a69ab13304f10a634000e52c0336b5593b7969adb WHIRLPOOL be82b47fc73f7e780e8e73a5f58b313d8e861d5ea8c4320f95ef0d8c1e125ff011d61dcfc0380be0e83868bd8c3299de1ea662da7fc8d709050e89b2c126e3eb
 DIST glibc-2.25-patches-11.tar.bz2 64221 SHA256 38c76c844238a7bbaecc85b359e67af6a98a1614f3196f25d85f83dec4358e99 SHA512 cbbbca9653f55f0cb3b73c38c979cb439c87b172819f3e999d2b435d59cd2bef2c89f11a398300c53f447ad433ee87f47a0f3e890c78f8694705c788455325dd WHIRLPOOL e61203ac129d7283f3beda1421e1365da58c229bcb6b6a1f8b71755d9ea0e2bfb64b8be69ab7698861a593d4b98ab6163d574f3c215fba0a0d9e6a1b15d2eed5
+DIST glibc-2.25-patches-12.tar.bz2 65396 SHA256 60a8901ceab4066661285cdbf7559d3a1f66bf468c5c1a5ecdde7f8ead282d3e SHA512 6af8c304ba70b42dfda294873d9a138d6c98e7a46496e305b2cac99a085d1ad3d00315162d1e1458e651de95e158bd35be74406a3f44fde13182e30baa663fcb WHIRLPOOL 96684d379d65ca6e4da7d397d4b803e0b0516080223de86080d6bbf3cae6a17b9fc8922d6fc2071b3116f35136378d85eb6671c7d9f7cf0f2135b66d1573bb90
 DIST glibc-2.25.tar.xz 13873900 SHA256 067bd9bb3390e79aa45911537d13c3721f1d9d3769931a30c2681bfee66f23a0 SHA512 5b7a2418d5b8a1b6a907c6c7fb6477ee2a473151cb45e03d0d4cdd9a33497c90b1ee39e2e7e885e2b25743dcd3747336ef114b4a73eb001da1fd79f29e0f9a6e WHIRLPOOL dc2fafaa4a0e5581268338453838a03ed0c5e7a2af844e8fb7086ab8d3ae48efbdbe6f25db1d089ae669cd2f8b0412f690d965506753d86f8525da2df59b7953
 DIST glibc-2.26-patches-2.tar.bz2 68040 SHA256 c40f03059d389fd8b22b54f83c0a669c44a38ee84cc359cb86d8f6dbdd1b957f SHA512 2b54d6e33b29d5ee5e4d4b64f299bf15e22ece5ce6555dafe43fd97ec8a2d9ef0645075ff24dc593ec6f89e02caf40c25a72af93ecd11113fba77268ccf486e2 WHIRLPOOL 59c54cdd2e3e64091dd206ad6b5ff467eff6c0d7f8ef5ab11504a4e6cfe958f762b9de2fbe8b6004a9e19963520a84a493ccf03908a78ea0a452dbc28e0df1e5
 DIST glibc-2.26.tar.xz 14682748 SHA256 e54e0a934cd2bc94429be79da5e9385898d2306b9eaf3c92d5a77af96190f6bd SHA512 6ed368523bc55f00976f96c5177f114e3f714b27273d7bffc252812c8b98fb81970403c1f5b5f0a61da678811532fb446530745492d2b49bfefc0d5bd71ce8c0 WHIRLPOOL 9091c3bccc9b590de6b9595aa391ba01091f0c301bd9199d7c48fbeaeeb013ec9c683c68b65b59c5a69e3905b7f842cca1b0a410431967ecb3a1229b8535486f

diff --git a/sys-libs/glibc/glibc-2.25-r9.ebuild b/sys-libs/glibc/glibc-2.25-r9.ebuild
new file mode 100644
index 00000000000..89b790eb79c
--- /dev/null
+++ b/sys-libs/glibc/glibc-2.25-r9.ebuild
@@ -0,0 +1,154 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="5"
+
+inherit toolchain-glibc
+
+DESCRIPTION="GNU libc6 (also called glibc2) C library"
+HOMEPAGE="https://www.gnu.org/software/libc/libc.html"
+
+LICENSE="LGPL-2.1+ BSD HPND ISC inner-net rc PCRE"
+#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86"
+KEYWORDS=""
+RESTRICT="strip" # strip ourself #46186
+EMULTILIB_PKG="true"
+
+# Configuration variables
+RELEASE_VER=""
+case ${PV} in
+9999*)
+	EGIT_REPO_URIS="git://sourceware.org/git/glibc.git"
+	EGIT_SOURCEDIRS="${S}"
+	inherit git-2
+	;;
+*)
+	RELEASE_VER=${PV}
+	;;
+esac
+GCC_BOOTSTRAP_VER="4.7.3-r1"
+# patches live at https://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo/src/patchsets/glibc/
+PATCH_VER="12"                                  # Gentoo patchset
+: ${NPTL_KERN_VER:="2.6.32"}                   # min kernel version nptl requires
+
+GLIBC_PATCH_EXCLUDE+=" 0005_all_sys-types.h-drop-sys-sysmacros.h-include.patch"
+
+IUSE="audit caps debug gd hardened multilib nscd +rpc selinux systemtap profile suid vanilla crosscompile_opts_headers-only"
+
+# Here's how the cross-compile logic breaks down ...
+#  CTARGET - machine that will target the binaries
+#  CHOST   - machine that will host the binaries
+#  CBUILD  - machine that will build the binaries
+# If CTARGET != CHOST, it means you want a libc for cross-compiling.
+# If CHOST != CBUILD, it means you want to cross-compile the libc.
+#  CBUILD = CHOST = CTARGET    - native build/install
+#  CBUILD != (CHOST = CTARGET) - cross-compile a native build
+#  (CBUILD = CHOST) != CTARGET - libc for cross-compiler
+#  CBUILD != CHOST != CTARGET  - cross-compile a libc for a cross-compiler
+# For install paths:
+#  CHOST = CTARGET  - install into /
+#  CHOST != CTARGET - install into /usr/CTARGET/
+
+export CBUILD=${CBUILD:-${CHOST}}
+export CTARGET=${CTARGET:-${CHOST}}
+if [[ ${CTARGET} == ${CHOST} ]] ; then
+	if [[ ${CATEGORY} == cross-* ]] ; then
+		export CTARGET=${CATEGORY#cross-}
+	fi
+fi
+
+is_crosscompile() {
+	[[ ${CHOST} != ${CTARGET} ]]
+}
+
+# Why SLOT 2.2 you ask yourself while sippin your tea ?
+# Everyone knows 2.2 > 0, duh.
+SLOT="2.2"
+
+# General: We need a new-enough binutils/gcc to match upstream baseline.
+# arch: we need to make sure our binutils/gcc supports TLS.
+COMMON_DEPEND="
+	nscd? ( selinux? (
+		audit? ( sys-process/audit )
+		caps? ( sys-libs/libcap )
+	) )
+	suid? ( caps? ( sys-libs/libcap ) )
+	selinux? ( sys-libs/libselinux )
+	systemtap? ( dev-util/systemtap )
+"
+DEPEND="${COMMON_DEPEND}
+	>=app-misc/pax-utils-0.1.10
+	!<sys-apps/sandbox-1.6
+	!<sys-apps/portage-2.1.2"
+RDEPEND="${COMMON_DEPEND}
+	!sys-kernel/ps3-sources
+	sys-apps/gentoo-functions
+	!sys-libs/nss-db"
+
+if [[ ${CATEGORY} == cross-* ]] ; then
+	DEPEND+=" !crosscompile_opts_headers-only? (
+		>=${CATEGORY}/binutils-2.24
+		>=${CATEGORY}/gcc-4.7
+	)"
+	[[ ${CATEGORY} == *-linux* ]] && DEPEND+=" ${CATEGORY}/linux-headers"
+else
+	DEPEND+="
+		>=sys-devel/binutils-2.24
+		>=sys-devel/gcc-4.7
+		virtual/os-headers"
+	RDEPEND+=" vanilla? ( !sys-libs/timezone-data )"
+	PDEPEND+=" !vanilla? ( sys-libs/timezone-data )"
+fi
+
+upstream_uris() {
+	echo mirror://gnu/glibc/$1 ftp://sourceware.org/pub/glibc/{releases,snapshots}/$1 mirror://gentoo/$1
+}
+gentoo_uris() {
+	local devspace="HTTP~vapier/dist/URI HTTP~dilfridge/distfiles/URI HTTP~tamiko/distfiles/URI HTTP~slyfox/distfiles/URI"
+	devspace=${devspace//HTTP/https://dev.gentoo.org/}
+	echo mirror://gentoo/$1 ${devspace//URI/$1}
+}
+SRC_URI=$(
+	[[ -z ${EGIT_REPO_URIS} ]] && upstream_uris ${P}.tar.xz
+	[[ -n ${PATCH_VER}      ]] && gentoo_uris ${P}-patches-${PATCH_VER}.tar.bz2
+)
+SRC_URI+=" ${GCC_BOOTSTRAP_VER:+multilib? ( $(gentoo_uris gcc-${GCC_BOOTSTRAP_VER}-multilib-bootstrap.tar.bz2) )}"
+
+src_unpack() {
+	[[ -n ${GCC_BOOTSTRAP_VER} ]] && use multilib && unpack gcc-${GCC_BOOTSTRAP_VER}-multilib-bootstrap.tar.bz2
+
+	toolchain-glibc_src_unpack
+}
+
+src_prepare() {
+	toolchain-glibc_src_prepare
+
+	cd "${S}"
+
+	epatch "${FILESDIR}"/2.19/${PN}-2.19-ia64-gcc-4.8-reloc-hack.patch #503838
+
+	if use hardened ; then
+		# We don't enable these for non-hardened as the output is very terse --
+		# it only states that a crash happened.  The default upstream behavior
+		# includes backtraces and symbols.
+		einfo "Installing Hardened Gentoo SSP and FORTIFY_SOURCE handler"
+		cp "${FILESDIR}"/2.20/glibc-2.20-gentoo-stack_chk_fail.c debug/stack_chk_fail.c || die
+		cp "${FILESDIR}"/2.25/glibc-2.25-gentoo-chk_fail.c debug/chk_fail.c || die
+
+		if use debug ; then
+			# Allow SIGABRT to dump core on non-hardened systems, or when debug is requested.
+			sed -i \
+				-e '/^CFLAGS-backtrace.c/ iCPPFLAGS-stack_chk_fail.c = -DSSP_SMASH_DUMPS_CORE' \
+				-e '/^CFLAGS-backtrace.c/ iCPPFLAGS-chk_fail.c = -DSSP_SMASH_DUMPS_CORE' \
+				debug/Makefile || die
+		fi
+	fi
+
+	case $(gcc-fullversion) in
+	4.8.[0-3]|4.9.0)
+		eerror "You need to switch to a newer compiler; gcc-4.8.[0-3] and gcc-4.9.0 miscompile"
+		eerror "glibc.  See https://bugs.gentoo.org/547420 for details."
+		die "need to switch compilers #547420"
+		;;
+	esac
+}