Gentoo Archives: gentoo-commits

From: Joonas Niilola <juippis@g.o>
To: gentoo-commits@l.g.o
Subject: [gentoo-commits] repo/gentoo:master commit in: dev-libs/nss/
Date: Sat, 02 Apr 2022 05:30:54
Message-Id: 1648877443.e0d5c3a907c56c8ab278f57a6261e8ea875f15e7.juippis@gentoo
1 commit: e0d5c3a907c56c8ab278f57a6261e8ea875f15e7
2 Author: Joonas Niilola <juippis <AT> gentoo <DOT> org>
3 AuthorDate: Sat Apr 2 05:29:01 2022 +0000
4 Commit: Joonas Niilola <juippis <AT> gentoo <DOT> org>
5 CommitDate: Sat Apr 2 05:30:43 2022 +0000
6 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e0d5c3a9
7
8 dev-libs/nss: add 3.68.3
9
10 Bug: https://bugs.gentoo.org/836386
11 Signed-off-by: Joonas Niilola <juippis <AT> gentoo.org>
12
13 dev-libs/nss/Manifest | 1 +
14 dev-libs/nss/nss-3.68.3.ebuild | 362 +++++++++++++++++++++++++++++++++++++++++
15 2 files changed, 363 insertions(+)
16
17 diff --git a/dev-libs/nss/Manifest b/dev-libs/nss/Manifest
18 index ea35913314bd..5b3b71381276 100644
19 --- a/dev-libs/nss/Manifest
20 +++ b/dev-libs/nss/Manifest
21 @@ -1,4 +1,5 @@
22 DIST nss-3.68.2.tar.gz 82406396 BLAKE2B 0542278f63770e9d4f3ce51516d7786680f2a869907ec91b2c4160f9fcad60703dd0e2a77bae91306349ff56908af0020e9479815e2b15392da7b14b27f8c7bc SHA512 31fe62f9e6f1695546bf8b087ae35ac2d3f39fde6be6ab3fcbc81ef66cf6290fc34b799e3809fcba4e913d0e305c476ee8ee1f22d0f957ec6978025920bdb9de
23 +DIST nss-3.68.3.tar.gz 82406947 BLAKE2B 92461f20294a9dce8c8a7eead9d06a4159e66afeb2d42a3313983fc5606a5f97321e038b9c25a7c7a361506910aee027ec91efd3096efdbf62096556d40896de SHA512 70fa8ab48d45249c04424979640583e8bc867432b7e3f26c1602db49a13861dd070f081ed82660bb7451f835dc859b5788ae12a67f9ddab1f6bd1a7afb1174d2
24 DIST nss-3.76.1.tar.gz 84626067 BLAKE2B 5112b208f3b9528a34b1d8e3e669db067ecb79719ad16793b8cd556a02910cc29f899f2a57e959c50048c5d2b94eb3b9855208dd3c20646a719c971561f6ea4c SHA512 80d32a97501cbc05312caa5cec54fe6dd8708f01e6d15693e36a40d70433be7a35565fcc5fadfc324c998ee9093b10b2f7a89643882f06a850eda4ffd3b19c54
25 DIST nss-3.77.tar.gz 84592839 BLAKE2B a63770f550b062549901afdcc5dc2a11c4648cef6875b023895da01ef53d6afc8c618291de96ac0af3a2c2cd7aa7986f93b4f10102a3c5aca1aa1447c148c393 SHA512 bd62eeb8f90ecd2d3999fd78fea6652736c02a6530f29e98d0cad0707f3b901b30409132eb6a6d53b9f5c05c6b464615a946a2a3e255553c793e44d0ed93179e
26 DIST nss-cacert-class1-class3-r2.patch 21925 BLAKE2B 7627ff9a09f084c19d72d0490676865e3cab3ca7c920ae1ce4bea2db664f37fd0aa84fcda919809a516891ab2a62e2e7a43a9d6ada4c231adfe4c216525fac7d SHA512 1ce6ff9ab310aaca9005eafb461338b291df8523cc7044e096cd75774ce746c26eed19ec6bb2643c6c67f94650f2f309463492d80a90568f38ce2557f8ada2f4
27
28 diff --git a/dev-libs/nss/nss-3.68.3.ebuild b/dev-libs/nss/nss-3.68.3.ebuild
29 new file mode 100644
30 index 000000000000..21aa71ffc8c2
31 --- /dev/null
32 +++ b/dev-libs/nss/nss-3.68.3.ebuild
33 @@ -0,0 +1,362 @@
34 +# Copyright 1999-2022 Gentoo Authors
35 +# Distributed under the terms of the GNU General Public License v2
36 +
37 +EAPI=7
38 +
39 +inherit flag-o-matic multilib toolchain-funcs multilib-minimal
40 +
41 +NSPR_VER="4.32"
42 +RTM_NAME="NSS_${PV//./_}_RTM"
43 +
44 +DESCRIPTION="Mozilla's Network Security Services library that implements PKI support"
45 +HOMEPAGE="https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS"
46 +SRC_URI="https://archive.mozilla.org/pub/security/nss/releases/${RTM_NAME}/src/${P}.tar.gz
47 + cacert? ( https://dev.gentoo.org/~whissi/dist/ca-certificates/nss-cacert-class1-class3-r2.patch )"
48 +
49 +LICENSE="|| ( MPL-2.0 GPL-2 LGPL-2.1 )"
50 +SLOT="0"
51 +KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~x64-solaris ~x86-solaris"
52 +IUSE="cacert utils cpu_flags_ppc_altivec cpu_flags_ppc_vsx"
53 +# pkg-config called by nss-config -> virtual/pkgconfig in RDEPEND
54 +RDEPEND="
55 + >=dev-libs/nspr-${NSPR_VER}[${MULTILIB_USEDEP}]
56 + >=dev-db/sqlite-3.8.2[${MULTILIB_USEDEP}]
57 + >=sys-libs/zlib-1.2.8-r1[${MULTILIB_USEDEP}]
58 + virtual/pkgconfig
59 +"
60 +DEPEND="${RDEPEND}"
61 +BDEPEND="dev-lang/perl"
62 +
63 +RESTRICT="test"
64 +
65 +S="${WORKDIR}/${P}/${PN}"
66 +
67 +MULTILIB_CHOST_TOOLS=(
68 + /usr/bin/nss-config
69 +)
70 +
71 +PATCHES=(
72 + # Custom changes for gentoo
73 + "${FILESDIR}/${PN}-3.53-gentoo-fixups.patch"
74 + "${FILESDIR}/${PN}-3.21-gentoo-fixup-warnings.patch"
75 + "${FILESDIR}/${PN}-3.23-hppa-byte_order.patch"
76 + "${FILESDIR}/nss-3.68-ld-fix.patch"
77 +)
78 +
79 +src_prepare() {
80 + default
81 +
82 + if use cacert ; then
83 + eapply -p2 "${DISTDIR}"/nss-cacert-class1-class3-r2.patch
84 + fi
85 +
86 + pushd coreconf >/dev/null || die
87 + # hack nspr paths
88 + echo 'INCLUDES += -I$(DIST)/include/dbm' \
89 + >> headers.mk || die "failed to append include"
90 +
91 + # modify install path
92 + sed -e '/CORE_DEPTH/s:SOURCE_PREFIX.*$:SOURCE_PREFIX = $(CORE_DEPTH)/dist:' \
93 + -i source.mk || die
94 +
95 + # Respect LDFLAGS
96 + sed -i -e 's/\$(MKSHLIB) -o/\$(MKSHLIB) \$(LDFLAGS) -o/g' rules.mk
97 + popd >/dev/null || die
98 +
99 + # Fix pkgconfig file for Prefix
100 + sed -i -e "/^PREFIX =/s:= /usr:= ${EPREFIX}/usr:" \
101 + config/Makefile || die
102 +
103 + # use host shlibsign if need be #436216
104 + if tc-is-cross-compiler ; then
105 + sed -i \
106 + -e 's:"${2}"/shlibsign:shlibsign:' \
107 + cmd/shlibsign/sign.sh || die
108 + fi
109 +
110 + # dirty hack
111 + sed -i -e "/CRYPTOLIB/s:\$(SOFTOKEN_LIB_DIR):../freebl/\$(OBJDIR):" \
112 + lib/ssl/config.mk || die
113 + sed -i -e "/CRYPTOLIB/s:\$(SOFTOKEN_LIB_DIR):../../lib/freebl/\$(OBJDIR):" \
114 + cmd/platlibs.mk || die
115 +
116 + multilib_copy_sources
117 +
118 + strip-flags
119 +}
120 +
121 +multilib_src_configure() {
122 + # Ensure we stay multilib aware
123 + sed -i -e "/@libdir@/ s:lib64:$(get_libdir):" config/Makefile || die
124 +}
125 +
126 +nssarch() {
127 + # Most of the arches are the same as $ARCH
128 + local t=${1:-${CHOST}}
129 + case ${t} in
130 + *86*-pc-solaris2*) echo "i86pc" ;;
131 + aarch64*) echo "aarch64" ;;
132 + hppa*) echo "parisc" ;;
133 + i?86*) echo "i686" ;;
134 + x86_64*) echo "x86_64" ;;
135 + *) tc-arch ${t} ;;
136 + esac
137 +}
138 +
139 +nssbits() {
140 + local cc cppflags="${1}CPPFLAGS" cflags="${1}CFLAGS"
141 + if [[ ${1} == BUILD_ ]]; then
142 + cc=$(tc-getBUILD_CC)
143 + else
144 + cc=$(tc-getCC)
145 + fi
146 + echo > "${T}"/test.c || die
147 + ${cc} ${!cppflags} ${!cflags} -c "${T}"/test.c -o "${T}/${1}test.o" || die
148 + case $(file "${T}/${1}test.o") in
149 + *32-bit*x86-64*) echo USE_X32=1;;
150 + *64-bit*|*ppc64*|*x86_64*) echo USE_64=1;;
151 + *32-bit*|*ppc*|*i386*) ;;
152 + *) die "Failed to detect whether ${cc} builds 64bits or 32bits, disable distcc if you're using it, please";;
153 + esac
154 +}
155 +
156 +multilib_src_compile() {
157 + # use ABI to determine bit'ness, or fallback if unset
158 + local buildbits mybits
159 + case "${ABI}" in
160 + n32) mybits="USE_N32=1";;
161 + x32) mybits="USE_X32=1";;
162 + s390x|*64) mybits="USE_64=1";;
163 + ${DEFAULT_ABI})
164 + einfo "Running compilation test to determine bit'ness"
165 + mybits=$(nssbits)
166 + ;;
167 + esac
168 + # bitness of host may differ from target
169 + if tc-is-cross-compiler; then
170 + buildbits=$(nssbits BUILD_)
171 + fi
172 +
173 + local makeargs=(
174 + CC="$(tc-getCC)"
175 + CCC="$(tc-getCXX)"
176 + AR="$(tc-getAR) rc \$@"
177 + RANLIB="$(tc-getRANLIB)"
178 + OPTIMIZER=
179 + ${mybits}
180 + )
181 +
182 + # Take care of nspr settings #436216
183 + local myCPPFLAGS="${CPPFLAGS} $($(tc-getPKG_CONFIG) nspr --cflags)"
184 + unset NSPR_INCLUDE_DIR
185 +
186 + export NSS_ALLOW_SSLKEYLOGFILE=1
187 + export NSS_ENABLE_WERROR=0 #567158
188 + export BUILD_OPT=1
189 + export NSS_USE_SYSTEM_SQLITE=1
190 + export NSDISTMODE=copy
191 + export FREEBL_NO_DEPEND=1
192 + export FREEBL_LOWHASH=1
193 + export NSS_SEED_ONLY_DEV_URANDOM=1
194 + export USE_SYSTEM_ZLIB=1
195 + export ZLIB_LIBS=-lz
196 + export ASFLAGS=""
197 + # Fix build failure on arm64
198 + export NS_USE_GCC=1
199 + # Detect compiler type and set proper environment value
200 + if tc-is-gcc; then
201 + export CC_IS_GCC=1
202 + elif tc-is-clang; then
203 + export CC_IS_CLANG=1
204 + fi
205 +
206 + # explicitly disable altivec/vsx if not requested
207 + # https://bugs.gentoo.org/789114
208 + case ${ARCH} in
209 + ppc*)
210 + use cpu_flags_ppc_altivec || export NSS_DISABLE_ALTIVEC=1
211 + use cpu_flags_ppc_vsx || export NSS_DISABLE_CRYPTO_VSX=1
212 + ;;
213 + esac
214 +
215 + local d
216 +
217 + # Build the host tools first.
218 + LDFLAGS="${BUILD_LDFLAGS}" \
219 + XCFLAGS="${BUILD_CFLAGS}" \
220 + NSPR_LIB_DIR="${T}/fakedir" \
221 + emake -j1 -C coreconf \
222 + CC="$(tc-getBUILD_CC)" \
223 + ${buildbits-${mybits}}
224 + makeargs+=( NSINSTALL="${PWD}/$(find -type f -name nsinstall)" )
225 +
226 + # Then build the target tools.
227 + for d in . lib/dbm ; do
228 + CPPFLAGS="${myCPPFLAGS}" \
229 + XCFLAGS="${CFLAGS} ${CPPFLAGS}" \
230 + NSPR_LIB_DIR="${T}/fakedir" \
231 + emake -j1 "${makeargs[@]}" -C ${d} OS_TEST="$(nssarch)"
232 + done
233 +}
234 +
235 +# Altering these 3 libraries breaks the CHK verification.
236 +# All of the following cause it to break:
237 +# - stripping
238 +# - prelink
239 +# - ELF signing
240 +# http://www.mozilla.org/projects/security/pki/nss/tech-notes/tn6.html
241 +# Either we have to NOT strip them, or we have to forcibly resign after
242 +# stripping.
243 +#local_libdir="$(get_libdir)"
244 +#export STRIP_MASK="
245 +# */${local_libdir}/libfreebl3.so*
246 +# */${local_libdir}/libnssdbm3.so*
247 +# */${local_libdir}/libsoftokn3.so*"
248 +
249 +export NSS_CHK_SIGN_LIBS="freebl3 nssdbm3 softokn3"
250 +
251 +generate_chk() {
252 + local shlibsign="$1"
253 + local libdir="$2"
254 + einfo "Resigning core NSS libraries for FIPS validation"
255 + shift 2
256 + local i
257 + for i in ${NSS_CHK_SIGN_LIBS} ; do
258 + local libname=lib${i}.so
259 + local chkname=lib${i}.chk
260 + "${shlibsign}" \
261 + -i "${libdir}"/${libname} \
262 + -o "${libdir}"/${chkname}.tmp \
263 + && mv -f \
264 + "${libdir}"/${chkname}.tmp \
265 + "${libdir}"/${chkname} \
266 + || die "Failed to sign ${libname}"
267 + done
268 +}
269 +
270 +cleanup_chk() {
271 + local libdir="$1"
272 + shift 1
273 + local i
274 + for i in ${NSS_CHK_SIGN_LIBS} ; do
275 + local libfname="${libdir}/lib${i}.so"
276 + # If the major version has changed, then we have old chk files.
277 + [ ! -f "${libfname}" -a -f "${libfname}.chk" ] \
278 + && rm -f "${libfname}.chk"
279 + done
280 +}
281 +
282 +multilib_src_install() {
283 + pushd dist >/dev/null || die
284 +
285 + dodir /usr/$(get_libdir)
286 + cp -L */lib/*$(get_libname) "${ED}"/usr/$(get_libdir) || die "copying shared libs failed"
287 + local i
288 + for i in crmf freebl nssb nssckfw ; do
289 + cp -L */lib/lib${i}.a "${ED}"/usr/$(get_libdir) || die "copying libs failed"
290 + done
291 +
292 + # Install nss-config and pkgconfig file
293 + dodir /usr/bin
294 + cp -L */bin/nss-config "${ED}"/usr/bin || die
295 + dodir /usr/$(get_libdir)/pkgconfig
296 + cp -L */lib/pkgconfig/nss.pc "${ED}"/usr/$(get_libdir)/pkgconfig || die
297 +
298 + # create an nss-softokn.pc from nss.pc for libfreebl and some private headers
299 + # bug 517266
300 + sed -e 's#Libs:#Libs: -lfreebl#' \
301 + -e 's#Cflags:#Cflags: -I${includedir}/private#' \
302 + */lib/pkgconfig/nss.pc >"${ED}"/usr/$(get_libdir)/pkgconfig/nss-softokn.pc \
303 + || die "could not create nss-softokn.pc"
304 +
305 + # all the include files
306 + insinto /usr/include/nss
307 + doins public/nss/*.{h,api}
308 + insinto /usr/include/nss/private
309 + doins private/nss/{blapi,alghmac,cmac}.h
310 +
311 + popd >/dev/null || die
312 +
313 + local f nssutils
314 + # Always enabled because we need it for chk generation.
315 + nssutils=( shlibsign )
316 +
317 + if multilib_is_native_abi ; then
318 + if use utils; then
319 + # The tests we do not need to install.
320 + #nssutils_test="bltest crmftest dbtest dertimetest
321 + #fipstest remtest sdrtest"
322 + # checkcert utils has been removed in nss-3.22:
323 + # https://bugzilla.mozilla.org/show_bug.cgi?id=1187545
324 + # https://hg.mozilla.org/projects/nss/rev/df1729d37870
325 + # certcgi has been removed in nss-3.36:
326 + # https://bugzilla.mozilla.org/show_bug.cgi?id=1426602
327 + nssutils+=(
328 + addbuiltin
329 + atob
330 + baddbdir
331 + btoa
332 + certutil
333 + cmsutil
334 + conflict
335 + crlutil
336 + derdump
337 + digest
338 + makepqg
339 + mangle
340 + modutil
341 + multinit
342 + nonspr10
343 + ocspclnt
344 + oidcalc
345 + p7content
346 + p7env
347 + p7sign
348 + p7verify
349 + pk11mode
350 + pk12util
351 + pp
352 + rsaperf
353 + selfserv
354 + signtool
355 + signver
356 + ssltap
357 + strsclnt
358 + symkeyutil
359 + tstclnt
360 + vfychain
361 + vfyserv
362 + )
363 + # install man-pages for utils (bug #516810)
364 + doman doc/nroff/*.1
365 + fi
366 + pushd dist/*/bin >/dev/null || die
367 + for f in ${nssutils[@]}; do
368 + dobin ${f}
369 + done
370 + popd >/dev/null || die
371 + fi
372 +}
373 +
374 +pkg_postinst() {
375 + multilib_pkg_postinst() {
376 + # We must re-sign the libraries AFTER they are stripped.
377 + local shlibsign="${EROOT}/usr/bin/shlibsign"
378 + # See if we can execute it (cross-compiling & such). #436216
379 + "${shlibsign}" -h >&/dev/null
380 + if [[ $? -gt 1 ]] ; then
381 + shlibsign="shlibsign"
382 + fi
383 + generate_chk "${shlibsign}" "${EROOT}"/usr/$(get_libdir)
384 + }
385 +
386 + multilib_foreach_abi multilib_pkg_postinst
387 +}
388 +
389 +pkg_postrm() {
390 + multilib_pkg_postrm() {
391 + cleanup_chk "${EROOT}"/usr/$(get_libdir)
392 + }
393 +
394 + multilib_foreach_abi multilib_pkg_postrm
395 +}