Gentoo Archives: gentoo-commits

From: Thomas Deutschmann <whissi@g.o>
To: gentoo-commits@l.g.o
Subject: [gentoo-commits] repo/gentoo:master commit in: www-servers/nginx/
Date: Wed, 22 Sep 2021 12:16:39
Message-Id: 1632312989.813f668e15273cb55f50e59bf93689f1df3dd889.whissi@gentoo
1 commit: 813f668e15273cb55f50e59bf93689f1df3dd889
2 Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
3 AuthorDate: Wed Sep 22 11:14:16 2021 +0000
4 Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
5 CommitDate: Wed Sep 22 12:16:29 2021 +0000
6 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=813f668e
7
8 www-servers/nginx: bump to v1.21.3
9
10 Package-Manager: Portage-3.0.23, Repoman-3.0.3
11 Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org>
12
13 www-servers/nginx/Manifest | 1 +
14 www-servers/nginx/nginx-1.21.3.ebuild | 1087 +++++++++++++++++++++++++++++++++
15 2 files changed, 1088 insertions(+)
16
17 diff --git a/www-servers/nginx/Manifest b/www-servers/nginx/Manifest
18 index 9b8bdb324ba..3ba4d199313 100644
19 --- a/www-servers/nginx/Manifest
20 +++ b/www-servers/nginx/Manifest
21 @@ -3,6 +3,7 @@ DIST nginx-1.20.1.tar.gz 1061461 BLAKE2B ed359db6486fd2152e0246663b8d8f4fc698059
22 DIST nginx-1.21.0.tar.gz 1063682 BLAKE2B 3c29a8832e879677ff6df198aa420bbe546322a9d8b000827fdfbeb7e3519374cafd5a75910880f5ae07e78f0096952498c8515be788cf62916e3470d93c66d1 SHA512 1f0c790e5ba104278ef5fc357e60ba2fddd2d8abda1363e26b418324b050f0e9f4901ce23949adede699e9f1340e8480ad8a6c811b7420a74c8f5c101be8a7ad
23 DIST nginx-1.21.1.tar.gz 1064925 BLAKE2B ff5dfb4a07d0dd3c8dd10e2545659cc25e15db71109c39ddb315f2949b0ec033ffa6df226f9f882e605bbac0b19a57f85eade41060c3317c9f07231ef496dcea SHA512 4fee94e9981abf4506cc3a24053828e81c763e98a3704b1cc54944cf09b49269a04495aca154b2dc6e065551d60f3f9f219659e93056b67952ecf8d07f9fcd98
24 DIST nginx-1.21.2.tar.gz 1066678 BLAKE2B 7af3a6f4cfc84c98058cb5ef3e0991b4f3cc2d8d9ca3b84111c30eac158253ac7f444e5b6ac9fd3a296f03a6c906e8a411b02c54e8df199f67a9ee0acce683d4 SHA512 5fa9c8f3a1bd9366b30de2bdbbd5baef47381e6d8672341ed601116baeb077ea1b596716ca06ec03d8a2773a437b78acd408084e49ba239f74de915f1b7fb8a5
25 +DIST nginx-1.21.3.tar.gz 1066609 BLAKE2B 424e9525f8f27dad6a49e7ec7c76160331ce98015d1023c71e9c60146aef7d330c780dc69bf2db01da0bedce3acecb156b3e108c24d2683ffee2954396ff440e SHA512 173d6d5c1471df1f5fbcf43fab19699ac509faee44a6c603f5e96ba59ac58774bbd84be5b45f5922a12b4037e4b32f875ce71c28e3e6adb70f306a2d25b40736
26 DIST nginx-auth-ldap-42d195d7a7575ebab1c369ad3fc5d78dc2c2669c.tar.gz 18457 BLAKE2B 22225ca9e5299b20ab5a93a001cac48e446bd86b3a24ac49e716bc975b128890bdb4b0dbbf5730fbaaeadfd958160093c7a6af798dd0e6de27062f149a760333 SHA512 ec59637fda5acac053e815cb1d04b545fc6b765e5ec63d8c2c9c301abad87afaa2698145acac08e9e14c91e1423ebff7aff0cca2b940b19ccccbf4cf53973269
27 DIST nginx_http_sticky_module_ng-1.2.6-10-g08a395c66e42.tar.bz2 124047 BLAKE2B d37ef9a15c91abe3c6258e420d1f99fa452f9d9966a0e13102174973314a3bac5413957a5fe632a9dcb1163b3be5df8116e05cc053ee061e19319ec25f341570 SHA512 6c1bfdcf89884b2855d51ae7da0f6e53a4ca3629e1aaf58433b70c07dcb2af797ba6e87d9b3eb4fe2fb6d4d697e862f2b4c2f8d8b3fdaea201740c97ec936529
28 DIST ngx_brotli-1.0.0rc.tar.gz 16207 BLAKE2B 450d0ea693bd98d4a1b615f2cdcaad41ccd28266f6d80beec7fe77fe750ab8c5d1bb55aabe15161b9b6d819d2b4d99a7774f2706f2f6fd084b52a7c7dddbc00c SHA512 05a880d5e48ac83be84498ed41fb4750211b827a9d7541acfd6ef494e5205a6e853d5594bfec3ab4ae668ea3f803e4f4b0ba550c76811971c8e266e42663c56d
29
30 diff --git a/www-servers/nginx/nginx-1.21.3.ebuild b/www-servers/nginx/nginx-1.21.3.ebuild
31 new file mode 100644
32 index 00000000000..bdebfbba028
33 --- /dev/null
34 +++ b/www-servers/nginx/nginx-1.21.3.ebuild
35 @@ -0,0 +1,1087 @@
36 +# Copyright 1999-2021 Gentoo Authors
37 +# Distributed under the terms of the GNU General Public License v2
38 +
39 +EAPI=7
40 +
41 +# Maintainer notes:
42 +# - http_rewrite-independent pcre-support makes sense for matching locations without an actual rewrite
43 +# - any http-module activates the main http-functionality and overrides USE=-http
44 +# - keep the following requirements in mind before adding external modules:
45 +# * alive upstream
46 +# * sane packaging
47 +# * builds cleanly
48 +# * does not need a patch for nginx core
49 +# - TODO: test the google-perftools module (included in vanilla tarball)
50 +
51 +# prevent perl-module from adding automagic perl DEPENDs
52 +GENTOO_DEPEND_ON_PERL="no"
53 +
54 +# devel_kit (https://github.com/simpl/ngx_devel_kit, BSD license)
55 +DEVEL_KIT_MODULE_PV="0.3.1"
56 +DEVEL_KIT_MODULE_P="ngx_devel_kit-${DEVEL_KIT_MODULE_PV}"
57 +DEVEL_KIT_MODULE_URI="https://github.com/simpl/ngx_devel_kit/archive/v${DEVEL_KIT_MODULE_PV}.tar.gz"
58 +DEVEL_KIT_MODULE_WD="${WORKDIR}/ngx_devel_kit-${DEVEL_KIT_MODULE_PV}"
59 +
60 +# ngx_brotli (https://github.com/google/ngx_brotli, BSD-2)
61 +HTTP_BROTLI_MODULE_PV="1.0.0rc"
62 +HTTP_BROTLI_MODULE_P="ngx_brotli-${HTTP_BROTLI_MODULE_PV}"
63 +HTTP_BROTLI_MODULE_URI="https://github.com/google/ngx_brotli/archive/v${HTTP_BROTLI_MODULE_PV}.tar.gz"
64 +HTTP_BROTLI_MODULE_WD="${WORKDIR}/ngx_brotli-${HTTP_BROTLI_MODULE_PV}"
65 +
66 +# http_uploadprogress (https://github.com/masterzen/nginx-upload-progress-module, BSD-2 license)
67 +HTTP_UPLOAD_PROGRESS_MODULE_PV="0.9.2"
68 +HTTP_UPLOAD_PROGRESS_MODULE_P="ngx_http_upload_progress-${HTTP_UPLOAD_PROGRESS_MODULE_PV}-r1"
69 +HTTP_UPLOAD_PROGRESS_MODULE_URI="https://github.com/masterzen/nginx-upload-progress-module/archive/v${HTTP_UPLOAD_PROGRESS_MODULE_PV}.tar.gz"
70 +HTTP_UPLOAD_PROGRESS_MODULE_WD="${WORKDIR}/nginx-upload-progress-module-${HTTP_UPLOAD_PROGRESS_MODULE_PV}"
71 +
72 +# http_headers_more (https://github.com/agentzh/headers-more-nginx-module, BSD license)
73 +HTTP_HEADERS_MORE_MODULE_PV="0.33"
74 +HTTP_HEADERS_MORE_MODULE_P="ngx_http_headers_more-${HTTP_HEADERS_MORE_MODULE_PV}"
75 +HTTP_HEADERS_MORE_MODULE_URI="https://github.com/agentzh/headers-more-nginx-module/archive/v${HTTP_HEADERS_MORE_MODULE_PV}.tar.gz"
76 +HTTP_HEADERS_MORE_MODULE_WD="${WORKDIR}/headers-more-nginx-module-${HTTP_HEADERS_MORE_MODULE_PV}"
77 +
78 +# http_cache_purge (http://labs.frickle.com/nginx_ngx_cache_purge/, https://github.com/FRiCKLE/ngx_cache_purge, BSD-2 license)
79 +HTTP_CACHE_PURGE_MODULE_PV="2.3"
80 +HTTP_CACHE_PURGE_MODULE_P="ngx_http_cache_purge-${HTTP_CACHE_PURGE_MODULE_PV}"
81 +HTTP_CACHE_PURGE_MODULE_URI="http://labs.frickle.com/files/ngx_cache_purge-${HTTP_CACHE_PURGE_MODULE_PV}.tar.gz"
82 +HTTP_CACHE_PURGE_MODULE_WD="${WORKDIR}/ngx_cache_purge-${HTTP_CACHE_PURGE_MODULE_PV}"
83 +
84 +# http_slowfs_cache (http://labs.frickle.com/nginx_ngx_slowfs_cache/, BSD-2 license)
85 +HTTP_SLOWFS_CACHE_MODULE_PV="1.10"
86 +HTTP_SLOWFS_CACHE_MODULE_P="ngx_http_slowfs_cache-${HTTP_SLOWFS_CACHE_MODULE_PV}"
87 +HTTP_SLOWFS_CACHE_MODULE_URI="http://labs.frickle.com/files/ngx_slowfs_cache-${HTTP_SLOWFS_CACHE_MODULE_PV}.tar.gz"
88 +HTTP_SLOWFS_CACHE_MODULE_WD="${WORKDIR}/ngx_slowfs_cache-${HTTP_SLOWFS_CACHE_MODULE_PV}"
89 +
90 +# http_fancyindex (https://github.com/aperezdc/ngx-fancyindex, BSD license)
91 +HTTP_FANCYINDEX_MODULE_PV="0.4.4"
92 +HTTP_FANCYINDEX_MODULE_P="ngx_http_fancyindex-${HTTP_FANCYINDEX_MODULE_PV}"
93 +HTTP_FANCYINDEX_MODULE_URI="https://github.com/aperezdc/ngx-fancyindex/archive/v${HTTP_FANCYINDEX_MODULE_PV}.tar.gz"
94 +HTTP_FANCYINDEX_MODULE_WD="${WORKDIR}/ngx-fancyindex-${HTTP_FANCYINDEX_MODULE_PV}"
95 +
96 +# http_lua (https://github.com/openresty/lua-nginx-module, BSD license)
97 +HTTP_LUA_MODULE_PV="0.10.15"
98 +HTTP_LUA_MODULE_P="ngx_http_lua-${HTTP_LUA_MODULE_PV}"
99 +HTTP_LUA_MODULE_URI="https://github.com/openresty/lua-nginx-module/archive/v${HTTP_LUA_MODULE_PV}.tar.gz"
100 +HTTP_LUA_MODULE_WD="${WORKDIR}/lua-nginx-module-${HTTP_LUA_MODULE_PV}"
101 +LUA_COMPAT=( luajit )
102 +
103 +# http_auth_pam (https://github.com/stogh/ngx_http_auth_pam_module/, http://web.iti.upv.es/~sto/nginx/, BSD-2 license)
104 +HTTP_AUTH_PAM_MODULE_PV="1.5.2"
105 +HTTP_AUTH_PAM_MODULE_P="ngx_http_auth_pam-${HTTP_AUTH_PAM_MODULE_PV}"
106 +HTTP_AUTH_PAM_MODULE_URI="https://github.com/stogh/ngx_http_auth_pam_module/archive/v${HTTP_AUTH_PAM_MODULE_PV}.tar.gz"
107 +HTTP_AUTH_PAM_MODULE_WD="${WORKDIR}/ngx_http_auth_pam_module-${HTTP_AUTH_PAM_MODULE_PV}"
108 +
109 +# http_upstream_check (https://github.com/yaoweibin/nginx_upstream_check_module, BSD license)
110 +HTTP_UPSTREAM_CHECK_MODULE_PV="9aecf15ec379fe98f62355c57b60c0bc83296f04"
111 +HTTP_UPSTREAM_CHECK_MODULE_P="ngx_http_upstream_check-${HTTP_UPSTREAM_CHECK_MODULE_PV}"
112 +HTTP_UPSTREAM_CHECK_MODULE_URI="https://github.com/yaoweibin/nginx_upstream_check_module/archive/${HTTP_UPSTREAM_CHECK_MODULE_PV}.tar.gz"
113 +HTTP_UPSTREAM_CHECK_MODULE_WD="${WORKDIR}/nginx_upstream_check_module-${HTTP_UPSTREAM_CHECK_MODULE_PV}"
114 +
115 +# http_metrics (https://github.com/zenops/ngx_metrics, BSD license)
116 +HTTP_METRICS_MODULE_PV="0.1.1"
117 +HTTP_METRICS_MODULE_P="ngx_metrics-${HTTP_METRICS_MODULE_PV}"
118 +HTTP_METRICS_MODULE_URI="https://github.com/madvertise/ngx_metrics/archive/v${HTTP_METRICS_MODULE_PV}.tar.gz"
119 +HTTP_METRICS_MODULE_WD="${WORKDIR}/ngx_metrics-${HTTP_METRICS_MODULE_PV}"
120 +
121 +# http_vhost_traffic_status (https://github.com/vozlt/nginx-module-vts, BSD license)
122 +HTTP_VHOST_TRAFFIC_STATUS_MODULE_PV="46d85558e344dfe2b078ce757fd36c69a1ec2dd3"
123 +HTTP_VHOST_TRAFFIC_STATUS_MODULE_P="ngx_http_vhost_traffic_status-${HTTP_VHOST_TRAFFIC_STATUS_MODULE_PV}"
124 +HTTP_VHOST_TRAFFIC_STATUS_MODULE_URI="https://github.com/vozlt/nginx-module-vts/archive/${HTTP_VHOST_TRAFFIC_STATUS_MODULE_PV}.tar.gz"
125 +HTTP_VHOST_TRAFFIC_STATUS_MODULE_WD="${WORKDIR}/nginx-module-vts-${HTTP_VHOST_TRAFFIC_STATUS_MODULE_PV}"
126 +
127 +# naxsi-core (https://github.com/nbs-system/naxsi, GPLv2+)
128 +HTTP_NAXSI_MODULE_PV="0.56"
129 +HTTP_NAXSI_MODULE_P="ngx_http_naxsi-${HTTP_NAXSI_MODULE_PV}"
130 +HTTP_NAXSI_MODULE_URI="https://github.com/nbs-system/naxsi/archive/${HTTP_NAXSI_MODULE_PV}.tar.gz"
131 +HTTP_NAXSI_MODULE_WD="${WORKDIR}/naxsi-${HTTP_NAXSI_MODULE_PV}/naxsi_src"
132 +
133 +# nginx-rtmp-module (https://github.com/arut/nginx-rtmp-module, BSD license)
134 +RTMP_MODULE_PV="1.2.1"
135 +RTMP_MODULE_P="ngx_rtmp-${RTMP_MODULE_PV}"
136 +RTMP_MODULE_URI="https://github.com/arut/nginx-rtmp-module/archive/v${RTMP_MODULE_PV}.tar.gz"
137 +RTMP_MODULE_WD="${WORKDIR}/nginx-rtmp-module-${RTMP_MODULE_PV}"
138 +
139 +# nginx-dav-ext-module (https://github.com/arut/nginx-dav-ext-module, BSD license)
140 +HTTP_DAV_EXT_MODULE_PV="3.0.0"
141 +HTTP_DAV_EXT_MODULE_P="ngx_http_dav_ext-${HTTP_DAV_EXT_MODULE_PV}"
142 +HTTP_DAV_EXT_MODULE_URI="https://github.com/arut/nginx-dav-ext-module/archive/v${HTTP_DAV_EXT_MODULE_PV}.tar.gz"
143 +HTTP_DAV_EXT_MODULE_WD="${WORKDIR}/nginx-dav-ext-module-${HTTP_DAV_EXT_MODULE_PV}"
144 +
145 +# echo-nginx-module (https://github.com/openresty/echo-nginx-module, BSD license)
146 +HTTP_ECHO_MODULE_PV="0.62"
147 +HTTP_ECHO_MODULE_P="ngx_http_echo-${HTTP_ECHO_MODULE_PV}"
148 +HTTP_ECHO_MODULE_URI="https://github.com/openresty/echo-nginx-module/archive/v${HTTP_ECHO_MODULE_PV}.tar.gz"
149 +HTTP_ECHO_MODULE_WD="${WORKDIR}/echo-nginx-module-${HTTP_ECHO_MODULE_PV}"
150 +
151 +# mod_security for nginx (https://modsecurity.org/, Apache-2.0)
152 +# keep the MODULE_P here consistent with upstream to avoid tarball duplication
153 +HTTP_SECURITY_MODULE_PV="2.9.3"
154 +HTTP_SECURITY_MODULE_P="modsecurity-${HTTP_SECURITY_MODULE_PV}"
155 +HTTP_SECURITY_MODULE_URI="https://www.modsecurity.org/tarball/${HTTP_SECURITY_MODULE_PV}/${HTTP_SECURITY_MODULE_P}.tar.gz"
156 +HTTP_SECURITY_MODULE_WD="${WORKDIR}/${HTTP_SECURITY_MODULE_P}"
157 +
158 +# push-stream-module (http://www.nginxpushstream.com, https://github.com/wandenberg/nginx-push-stream-module, GPL-3)
159 +HTTP_PUSH_STREAM_MODULE_PV="0.5.4"
160 +HTTP_PUSH_STREAM_MODULE_P="ngx_http_push_stream-${HTTP_PUSH_STREAM_MODULE_PV}"
161 +HTTP_PUSH_STREAM_MODULE_URI="https://github.com/wandenberg/nginx-push-stream-module/archive/${HTTP_PUSH_STREAM_MODULE_PV}.tar.gz"
162 +HTTP_PUSH_STREAM_MODULE_WD="${WORKDIR}/nginx-push-stream-module-${HTTP_PUSH_STREAM_MODULE_PV}"
163 +
164 +# sticky-module (https://bitbucket.org/nginx-goodies/nginx-sticky-module-ng, BSD-2)
165 +HTTP_STICKY_MODULE_PV="1.2.6-10-g08a395c66e42"
166 +HTTP_STICKY_MODULE_P="nginx_http_sticky_module_ng-${HTTP_STICKY_MODULE_PV}"
167 +HTTP_STICKY_MODULE_URI="https://bitbucket.org/nginx-goodies/nginx-sticky-module-ng/get/${HTTP_STICKY_MODULE_PV}.tar.bz2"
168 +HTTP_STICKY_MODULE_WD="${WORKDIR}/nginx-goodies-nginx-sticky-module-ng-08a395c66e42"
169 +
170 +# mogilefs-module (https://github.com/vkholodkov/nginx-mogilefs-module, BSD-2)
171 +HTTP_MOGILEFS_MODULE_PV="1.0.4"
172 +HTTP_MOGILEFS_MODULE_P="ngx_mogilefs_module-${HTTP_MOGILEFS_MODULE_PV}"
173 +HTTP_MOGILEFS_MODULE_URI="https://github.com/vkholodkov/nginx-mogilefs-module/archive/${HTTP_MOGILEFS_MODULE_PV}.tar.gz"
174 +HTTP_MOGILEFS_MODULE_WD="${WORKDIR}/nginx_mogilefs_module-${HTTP_MOGILEFS_MODULE_PV}"
175 +
176 +# memc-module (https://github.com/openresty/memc-nginx-module, BSD-2)
177 +HTTP_MEMC_MODULE_PV="0.19"
178 +HTTP_MEMC_MODULE_P="ngx_memc_module-${HTTP_MEMC_MODULE_PV}"
179 +HTTP_MEMC_MODULE_URI="https://github.com/openresty/memc-nginx-module/archive/v${HTTP_MEMC_MODULE_PV}.tar.gz"
180 +HTTP_MEMC_MODULE_WD="${WORKDIR}/memc-nginx-module-${HTTP_MEMC_MODULE_PV}"
181 +
182 +# nginx-ldap-auth-module (https://github.com/kvspb/nginx-auth-ldap, BSD-2)
183 +HTTP_LDAP_MODULE_PV="42d195d7a7575ebab1c369ad3fc5d78dc2c2669c"
184 +HTTP_LDAP_MODULE_P="nginx-auth-ldap-${HTTP_LDAP_MODULE_PV}"
185 +HTTP_LDAP_MODULE_URI="https://github.com/kvspb/nginx-auth-ldap/archive/${HTTP_LDAP_MODULE_PV}.tar.gz"
186 +HTTP_LDAP_MODULE_WD="${WORKDIR}/nginx-auth-ldap-${HTTP_LDAP_MODULE_PV}"
187 +
188 +# geoip2 (https://github.com/leev/ngx_http_geoip2_module, BSD-2)
189 +GEOIP2_MODULE_PV="3.3"
190 +GEOIP2_MODULE_P="ngx_http_geoip2_module-${GEOIP2_MODULE_PV}"
191 +GEOIP2_MODULE_URI="https://github.com/leev/ngx_http_geoip2_module/archive/${GEOIP2_MODULE_PV}.tar.gz"
192 +GEOIP2_MODULE_WD="${WORKDIR}/ngx_http_geoip2_module-${GEOIP2_MODULE_PV}"
193 +
194 +# njs-module (https://github.com/nginx/njs, as-is)
195 +NJS_MODULE_PV="0.6.2"
196 +NJS_MODULE_P="njs-${NJS_MODULE_PV}"
197 +NJS_MODULE_URI="https://github.com/nginx/njs/archive/${NJS_MODULE_PV}.tar.gz"
198 +NJS_MODULE_WD="${WORKDIR}/njs-${NJS_MODULE_PV}"
199 +
200 +# We handle deps below ourselves
201 +SSL_DEPS_SKIP=1
202 +AUTOTOOLS_AUTO_DEPEND="no"
203 +
204 +inherit autotools lua-single ssl-cert toolchain-funcs perl-module flag-o-matic user systemd multilib pax-utils
205 +
206 +DESCRIPTION="Robust, small and high performance http and reverse proxy server"
207 +HOMEPAGE="https://nginx.org"
208 +SRC_URI="https://nginx.org/download/${P}.tar.gz
209 + ${DEVEL_KIT_MODULE_URI} -> ${DEVEL_KIT_MODULE_P}.tar.gz
210 + nginx_modules_http_auth_ldap? ( ${HTTP_LDAP_MODULE_URI} -> ${HTTP_LDAP_MODULE_P}.tar.gz )
211 + nginx_modules_http_auth_pam? ( ${HTTP_AUTH_PAM_MODULE_URI} -> ${HTTP_AUTH_PAM_MODULE_P}.tar.gz )
212 + nginx_modules_http_brotli? ( ${HTTP_BROTLI_MODULE_URI} -> ${HTTP_BROTLI_MODULE_P}.tar.gz )
213 + nginx_modules_http_cache_purge? ( ${HTTP_CACHE_PURGE_MODULE_URI} -> ${HTTP_CACHE_PURGE_MODULE_P}.tar.gz )
214 + nginx_modules_http_dav_ext? ( ${HTTP_DAV_EXT_MODULE_URI} -> ${HTTP_DAV_EXT_MODULE_P}.tar.gz )
215 + nginx_modules_http_echo? ( ${HTTP_ECHO_MODULE_URI} -> ${HTTP_ECHO_MODULE_P}.tar.gz )
216 + nginx_modules_http_fancyindex? ( ${HTTP_FANCYINDEX_MODULE_URI} -> ${HTTP_FANCYINDEX_MODULE_P}.tar.gz )
217 + nginx_modules_http_geoip2? ( ${GEOIP2_MODULE_URI} -> ${GEOIP2_MODULE_P}.tar.gz )
218 + nginx_modules_http_headers_more? ( ${HTTP_HEADERS_MORE_MODULE_URI} -> ${HTTP_HEADERS_MORE_MODULE_P}.tar.gz )
219 + nginx_modules_http_javascript? ( ${NJS_MODULE_URI} -> ${NJS_MODULE_P}.tar.gz )
220 + nginx_modules_http_lua? ( ${HTTP_LUA_MODULE_URI} -> ${HTTP_LUA_MODULE_P}.tar.gz )
221 + nginx_modules_http_memc? ( ${HTTP_MEMC_MODULE_URI} -> ${HTTP_MEMC_MODULE_P}.tar.gz )
222 + nginx_modules_http_metrics? ( ${HTTP_METRICS_MODULE_URI} -> ${HTTP_METRICS_MODULE_P}.tar.gz )
223 + nginx_modules_http_mogilefs? ( ${HTTP_MOGILEFS_MODULE_URI} -> ${HTTP_MOGILEFS_MODULE_P}.tar.gz )
224 + nginx_modules_http_naxsi? ( ${HTTP_NAXSI_MODULE_URI} -> ${HTTP_NAXSI_MODULE_P}.tar.gz )
225 + nginx_modules_http_push_stream? ( ${HTTP_PUSH_STREAM_MODULE_URI} -> ${HTTP_PUSH_STREAM_MODULE_P}.tar.gz )
226 + nginx_modules_http_security? ( ${HTTP_SECURITY_MODULE_URI} -> ${HTTP_SECURITY_MODULE_P}.tar.gz )
227 + nginx_modules_http_slowfs_cache? ( ${HTTP_SLOWFS_CACHE_MODULE_URI} -> ${HTTP_SLOWFS_CACHE_MODULE_P}.tar.gz )
228 + nginx_modules_http_sticky? ( ${HTTP_STICKY_MODULE_URI} -> ${HTTP_STICKY_MODULE_P}.tar.bz2 )
229 + nginx_modules_http_upload_progress? ( ${HTTP_UPLOAD_PROGRESS_MODULE_URI} -> ${HTTP_UPLOAD_PROGRESS_MODULE_P}.tar.gz )
230 + nginx_modules_http_upstream_check? ( ${HTTP_UPSTREAM_CHECK_MODULE_URI} -> ${HTTP_UPSTREAM_CHECK_MODULE_P}.tar.gz )
231 + nginx_modules_http_vhost_traffic_status? ( ${HTTP_VHOST_TRAFFIC_STATUS_MODULE_URI} -> ${HTTP_VHOST_TRAFFIC_STATUS_MODULE_P}.tar.gz )
232 + nginx_modules_stream_geoip2? ( ${GEOIP2_MODULE_URI} -> ${GEOIP2_MODULE_P}.tar.gz )
233 + nginx_modules_stream_javascript? ( ${NJS_MODULE_URI} -> ${NJS_MODULE_P}.tar.gz )
234 + rtmp? ( ${RTMP_MODULE_URI} -> ${RTMP_MODULE_P}.tar.gz )"
235 +
236 +LICENSE="BSD-2 BSD SSLeay MIT GPL-2 GPL-2+
237 + nginx_modules_http_security? ( Apache-2.0 )
238 + nginx_modules_http_push_stream? ( GPL-3 )"
239 +
240 +SLOT="mainline"
241 +KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~riscv ~x86 ~amd64-linux ~x86-linux"
242 +
243 +# Package doesn't provide a real test suite
244 +RESTRICT="test"
245 +
246 +NGINX_MODULES_STD="access auth_basic autoindex browser charset empty_gif
247 + fastcgi geo grpc gzip limit_req limit_conn map memcached mirror
248 + proxy referer rewrite scgi ssi split_clients upstream_hash
249 + upstream_ip_hash upstream_keepalive upstream_least_conn
250 + upstream_zone userid uwsgi"
251 +NGINX_MODULES_OPT="addition auth_request dav degradation flv geoip gunzip
252 + gzip_static image_filter mp4 perl random_index realip secure_link
253 + slice stub_status sub xslt"
254 +NGINX_MODULES_STREAM_STD="access geo limit_conn map return split_clients
255 + upstream_hash upstream_least_conn upstream_zone"
256 +NGINX_MODULES_STREAM_OPT="geoip realip ssl_preread"
257 +NGINX_MODULES_MAIL="imap pop3 smtp"
258 +NGINX_MODULES_3RD="
259 + http_auth_ldap
260 + http_auth_pam
261 + http_brotli
262 + http_cache_purge
263 + http_dav_ext
264 + http_echo
265 + http_fancyindex
266 + http_geoip2
267 + http_headers_more
268 + http_javascript
269 + http_lua
270 + http_memc
271 + http_metrics
272 + http_mogilefs
273 + http_naxsi
274 + http_push_stream
275 + http_security
276 + http_slowfs_cache
277 + http_sticky
278 + http_upload_progress
279 + http_upstream_check
280 + http_vhost_traffic_status
281 + stream_geoip2
282 + stream_javascript
283 +"
284 +
285 +IUSE="aio debug +http +http2 +http-cache +ipv6 libatomic +pcre
286 + pcre-jit rtmp selinux ssl threads userland_GNU vim-syntax"
287 +
288 +for mod in $NGINX_MODULES_STD; do
289 + IUSE="${IUSE} +nginx_modules_http_${mod}"
290 +done
291 +
292 +for mod in $NGINX_MODULES_OPT; do
293 + IUSE="${IUSE} nginx_modules_http_${mod}"
294 +done
295 +
296 +for mod in $NGINX_MODULES_STREAM_STD; do
297 + IUSE="${IUSE} nginx_modules_stream_${mod}"
298 +done
299 +
300 +for mod in $NGINX_MODULES_STREAM_OPT; do
301 + IUSE="${IUSE} nginx_modules_stream_${mod}"
302 +done
303 +
304 +for mod in $NGINX_MODULES_MAIL; do
305 + IUSE="${IUSE} nginx_modules_mail_${mod}"
306 +done
307 +
308 +for mod in $NGINX_MODULES_3RD; do
309 + IUSE="${IUSE} nginx_modules_${mod}"
310 +done
311 +
312 +# Add so we can warn users updating about config changes
313 +# @TODO: jbergstroem: remove on next release series
314 +IUSE="${IUSE} nginx_modules_http_spdy"
315 +
316 +CDEPEND="
317 + virtual/libcrypt:=
318 + pcre? ( dev-libs/libpcre:= )
319 + pcre-jit? ( dev-libs/libpcre:=[jit] )
320 + ssl? (
321 + dev-libs/openssl:0=
322 + )
323 + http2? (
324 + >=dev-libs/openssl-1.0.1c:0=
325 + )
326 + http-cache? (
327 + userland_GNU? (
328 + dev-libs/openssl:0=
329 + )
330 + )
331 + nginx_modules_http_brotli? ( app-arch/brotli:= )
332 + nginx_modules_http_geoip? ( dev-libs/geoip )
333 + nginx_modules_http_geoip2? ( dev-libs/libmaxminddb:= )
334 + nginx_modules_http_gunzip? ( sys-libs/zlib )
335 + nginx_modules_http_gzip? ( sys-libs/zlib )
336 + nginx_modules_http_gzip_static? ( sys-libs/zlib )
337 + nginx_modules_http_image_filter? ( media-libs/gd:=[jpeg,png] )
338 + nginx_modules_http_perl? ( >=dev-lang/perl-5.8:= )
339 + nginx_modules_http_rewrite? ( dev-libs/libpcre:= )
340 + nginx_modules_http_secure_link? (
341 + userland_GNU? (
342 + dev-libs/openssl:0=
343 + )
344 + )
345 + nginx_modules_http_xslt? ( dev-libs/libxml2:= dev-libs/libxslt )
346 + nginx_modules_http_lua? ( ${LUA_DEPS} )
347 + nginx_modules_http_auth_pam? ( sys-libs/pam )
348 + nginx_modules_http_metrics? ( dev-libs/yajl:= )
349 + nginx_modules_http_dav_ext? ( dev-libs/libxml2 )
350 + nginx_modules_http_security? (
351 + dev-libs/apr:=
352 + dev-libs/apr-util:=
353 + dev-libs/libxml2:=
354 + net-misc/curl
355 + www-servers/apache
356 + )
357 + nginx_modules_http_auth_ldap? ( net-nds/openldap[ssl?] )
358 + nginx_modules_stream_geoip? ( dev-libs/geoip )
359 + nginx_modules_stream_geoip2? ( dev-libs/libmaxminddb:= )"
360 +RDEPEND="${CDEPEND}
361 + selinux? ( sec-policy/selinux-nginx )
362 + !www-servers/nginx:0"
363 +DEPEND="${CDEPEND}
364 + arm? ( dev-libs/libatomic_ops )
365 + libatomic? ( dev-libs/libatomic_ops )"
366 +BDEPEND="nginx_modules_http_brotli? ( virtual/pkgconfig )
367 + nginx_modules_http_security? ( ${AUTOTOOLS_DEPEND} )"
368 +PDEPEND="vim-syntax? ( app-vim/nginx-syntax )"
369 +
370 +REQUIRED_USE="pcre-jit? ( pcre )
371 + nginx_modules_http_fancyindex? ( nginx_modules_http_addition )
372 + nginx_modules_http_grpc? ( http2 )
373 + nginx_modules_http_lua? (
374 + ${LUA_REQUIRED_USE}
375 + nginx_modules_http_rewrite
376 + )
377 + nginx_modules_http_naxsi? ( pcre )
378 + nginx_modules_http_dav_ext? ( nginx_modules_http_dav nginx_modules_http_xslt )
379 + nginx_modules_http_metrics? ( nginx_modules_http_stub_status )
380 + nginx_modules_http_security? ( pcre )
381 + nginx_modules_http_push_stream? ( ssl )"
382 +
383 +pkg_setup() {
384 + NGINX_HOME="/var/lib/nginx"
385 + NGINX_HOME_TMP="${NGINX_HOME}/tmp"
386 +
387 + ebegin "Creating nginx user and group"
388 + enewgroup ${PN}
389 + enewuser ${PN} -1 -1 "${NGINX_HOME}" ${PN}
390 + eend $?
391 +
392 + if use libatomic; then
393 + ewarn "GCC 4.1+ features built-in atomic operations."
394 + ewarn "Using libatomic_ops is only needed if using"
395 + ewarn "a different compiler or a GCC prior to 4.1"
396 + fi
397 +
398 + if [[ -n $NGINX_ADD_MODULES ]]; then
399 + ewarn "You are building custom modules via \$NGINX_ADD_MODULES!"
400 + ewarn "This nginx installation is not supported!"
401 + ewarn "Make sure you can reproduce the bug without those modules"
402 + ewarn "_before_ reporting bugs."
403 + fi
404 +
405 + if use !http; then
406 + ewarn "To actually disable all http-functionality you also have to disable"
407 + ewarn "all nginx http modules."
408 + fi
409 +
410 + if use nginx_modules_http_mogilefs && use threads; then
411 + eerror "mogilefs won't compile with threads support."
412 + eerror "Please disable either flag and try again."
413 + die "Can't compile mogilefs with threads support"
414 + fi
415 +
416 + use nginx_modules_http_lua && lua-single_pkg_setup
417 +}
418 +
419 +src_prepare() {
420 + eapply "${FILESDIR}/${PN}-1.4.1-fix-perl-install-path.patch"
421 + eapply "${FILESDIR}/${PN}-httpoxy-mitigation-r1.patch"
422 +
423 + if use nginx_modules_http_brotli; then
424 + cd "${HTTP_BROTLI_MODULE_WD}" || die
425 + eapply "${FILESDIR}"/http_brotli-detect-brotli-r3.patch
426 + cd "${S}" || die
427 + fi
428 +
429 + if use nginx_modules_http_upstream_check; then
430 + eapply -p0 "${FILESDIR}"/http_upstream_check-nginx-1.11.5+.patch
431 + fi
432 +
433 + if use nginx_modules_http_cache_purge; then
434 + cd "${HTTP_CACHE_PURGE_MODULE_WD}" || die
435 + eapply "${FILESDIR}"/http_cache_purge-1.11.6+.patch
436 + cd "${S}" || die
437 + fi
438 +
439 + if use nginx_modules_http_security; then
440 + cd "${HTTP_SECURITY_MODULE_WD}" || die
441 +
442 + eautoreconf
443 +
444 + if use nginx_modules_http_lua; then
445 + sed -i \
446 + -e "s|^\(LUA_PKGNAMES\)=.*|\1=\"${ELUA}\"|" \
447 + configure || die
448 + fi
449 +
450 + cd "${S}" || die
451 + fi
452 +
453 + if use nginx_modules_http_upload_progress; then
454 + cd "${HTTP_UPLOAD_PROGRESS_MODULE_WD}" || die
455 + eapply "${FILESDIR}"/http_uploadprogress-issue_50-r1.patch
456 + cd "${S}" || die
457 + fi
458 +
459 + find auto/ -type f -print0 | xargs -0 sed -i 's:\&\& make:\&\& \\$(MAKE):' || die
460 + # We have config protection, don't rename etc files
461 + sed -i 's:.default::' auto/install || die
462 + # remove useless files
463 + sed -i -e '/koi-/d' -e '/win-/d' auto/install || die
464 +
465 + # don't install to /etc/nginx/ if not in use
466 + local module
467 + for module in fastcgi scgi uwsgi ; do
468 + if ! use nginx_modules_http_${module}; then
469 + sed -i -e "/${module}/d" auto/install || die
470 + fi
471 + done
472 +
473 + eapply_user
474 +}
475 +
476 +src_configure() {
477 + # mod_security needs to generate nginx/modsecurity/config before including it
478 + if use nginx_modules_http_security; then
479 + cd "${HTTP_SECURITY_MODULE_WD}" || die
480 +
481 + ./configure \
482 + --enable-standalone-module \
483 + --disable-mlogc \
484 + --with-ssdeep=no \
485 + $(use_enable pcre-jit) \
486 + $(use_with nginx_modules_http_lua lua) || die "configure failed for mod_security"
487 +
488 + cd "${S}" || die
489 + fi
490 +
491 + local myconf=() http_enabled= mail_enabled= stream_enabled=
492 +
493 + use aio && myconf+=( --with-file-aio )
494 + use debug && myconf+=( --with-debug )
495 + use http2 && myconf+=( --with-http_v2_module )
496 + use libatomic && myconf+=( --with-libatomic )
497 + use pcre && myconf+=( --with-pcre )
498 + use pcre-jit && myconf+=( --with-pcre-jit )
499 + use threads && myconf+=( --with-threads )
500 +
501 + # HTTP modules
502 + for mod in $NGINX_MODULES_STD; do
503 + if use nginx_modules_http_${mod}; then
504 + http_enabled=1
505 + else
506 + myconf+=( --without-http_${mod}_module )
507 + fi
508 + done
509 +
510 + for mod in $NGINX_MODULES_OPT; do
511 + if use nginx_modules_http_${mod}; then
512 + http_enabled=1
513 + myconf+=( --with-http_${mod}_module )
514 + fi
515 + done
516 +
517 + if use nginx_modules_http_fastcgi; then
518 + myconf+=( --with-http_realip_module )
519 + fi
520 +
521 + # third-party modules
522 + if use nginx_modules_http_upload_progress; then
523 + http_enabled=1
524 + myconf+=( --add-module=${HTTP_UPLOAD_PROGRESS_MODULE_WD} )
525 + fi
526 +
527 + if use nginx_modules_http_headers_more; then
528 + http_enabled=1
529 + myconf+=( --add-module=${HTTP_HEADERS_MORE_MODULE_WD} )
530 + fi
531 +
532 + if use nginx_modules_http_cache_purge; then
533 + http_enabled=1
534 + myconf+=( --add-module=${HTTP_CACHE_PURGE_MODULE_WD} )
535 + fi
536 +
537 + if use nginx_modules_http_slowfs_cache; then
538 + http_enabled=1
539 + myconf+=( --add-module=${HTTP_SLOWFS_CACHE_MODULE_WD} )
540 + fi
541 +
542 + if use nginx_modules_http_fancyindex; then
543 + http_enabled=1
544 + myconf+=( --add-module=${HTTP_FANCYINDEX_MODULE_WD} )
545 + fi
546 +
547 + if use nginx_modules_http_lua; then
548 + http_enabled=1
549 + export LUAJIT_LIB=$(dirname $(lua_get_shared_lib))
550 + export LUAJIT_INC=$(lua_get_include_dir)
551 + myconf+=( --add-module=${DEVEL_KIT_MODULE_WD} )
552 + myconf+=( --add-module=${HTTP_LUA_MODULE_WD} )
553 + fi
554 +
555 + if use nginx_modules_http_auth_pam; then
556 + http_enabled=1
557 + myconf+=( --add-module=${HTTP_AUTH_PAM_MODULE_WD} )
558 + fi
559 +
560 + if use nginx_modules_http_upstream_check; then
561 + http_enabled=1
562 + myconf+=( --add-module=${HTTP_UPSTREAM_CHECK_MODULE_WD} )
563 + fi
564 +
565 + if use nginx_modules_http_metrics; then
566 + http_enabled=1
567 + myconf+=( --add-module=${HTTP_METRICS_MODULE_WD} )
568 + fi
569 +
570 + if use nginx_modules_http_naxsi ; then
571 + http_enabled=1
572 + myconf+=( --add-module=${HTTP_NAXSI_MODULE_WD} )
573 + fi
574 +
575 + if use rtmp ; then
576 + http_enabled=1
577 + myconf+=( --add-module=${RTMP_MODULE_WD} )
578 + fi
579 +
580 + if use nginx_modules_http_dav_ext ; then
581 + http_enabled=1
582 + myconf+=( --add-module=${HTTP_DAV_EXT_MODULE_WD} )
583 + fi
584 +
585 + if use nginx_modules_http_echo ; then
586 + http_enabled=1
587 + myconf+=( --add-module=${HTTP_ECHO_MODULE_WD} )
588 + fi
589 +
590 + if use nginx_modules_http_security ; then
591 + http_enabled=1
592 + myconf+=( --add-module=${HTTP_SECURITY_MODULE_WD}/nginx/modsecurity )
593 + fi
594 +
595 + if use nginx_modules_http_push_stream ; then
596 + http_enabled=1
597 + myconf+=( --add-module=${HTTP_PUSH_STREAM_MODULE_WD} )
598 + fi
599 +
600 + if use nginx_modules_http_sticky ; then
601 + http_enabled=1
602 + myconf+=( --add-module=${HTTP_STICKY_MODULE_WD} )
603 + fi
604 +
605 + if use nginx_modules_http_mogilefs ; then
606 + http_enabled=1
607 + myconf+=( --add-module=${HTTP_MOGILEFS_MODULE_WD} )
608 + fi
609 +
610 + if use nginx_modules_http_memc ; then
611 + http_enabled=1
612 + myconf+=( --add-module=${HTTP_MEMC_MODULE_WD} )
613 + fi
614 +
615 + if use nginx_modules_http_auth_ldap; then
616 + http_enabled=1
617 + myconf+=( --add-module=${HTTP_LDAP_MODULE_WD} )
618 + fi
619 +
620 + if use nginx_modules_http_vhost_traffic_status; then
621 + http_enabled=1
622 + myconf+=( --add-module=${HTTP_VHOST_TRAFFIC_STATUS_MODULE_WD} )
623 + fi
624 +
625 + if use nginx_modules_http_geoip2 || use nginx_modules_stream_geoip2; then
626 + myconf+=( --add-module=${GEOIP2_MODULE_WD} )
627 + fi
628 +
629 + if use nginx_modules_http_javascript || use nginx_modules_stream_javascript; then
630 + myconf+=( --add-module="${NJS_MODULE_WD}/nginx" )
631 + fi
632 +
633 + if use nginx_modules_http_brotli; then
634 + http_enabled=1
635 + myconf+=( --add-module=${HTTP_BROTLI_MODULE_WD} )
636 + fi
637 +
638 + if use http || use http-cache || use http2 || use nginx_modules_http_javascript; then
639 + http_enabled=1
640 + fi
641 +
642 + if [ $http_enabled ]; then
643 + use http-cache || myconf+=( --without-http-cache )
644 + use ssl && myconf+=( --with-http_ssl_module )
645 + else
646 + myconf+=( --without-http --without-http-cache )
647 + fi
648 +
649 + # Stream modules
650 + for mod in $NGINX_MODULES_STREAM_STD; do
651 + if use nginx_modules_stream_${mod}; then
652 + stream_enabled=1
653 + else
654 + myconf+=( --without-stream_${mod}_module )
655 + fi
656 + done
657 +
658 + for mod in $NGINX_MODULES_STREAM_OPT; do
659 + if use nginx_modules_stream_${mod}; then
660 + stream_enabled=1
661 + myconf+=( --with-stream_${mod}_module )
662 + fi
663 + done
664 +
665 + if use nginx_modules_stream_geoip2 || use nginx_modules_stream_javascript; then
666 + stream_enabled=1
667 + fi
668 +
669 + if [ $stream_enabled ]; then
670 + myconf+=( --with-stream )
671 + use ssl && myconf+=( --with-stream_ssl_module )
672 + fi
673 +
674 + # MAIL modules
675 + for mod in $NGINX_MODULES_MAIL; do
676 + if use nginx_modules_mail_${mod}; then
677 + mail_enabled=1
678 + else
679 + myconf+=( --without-mail_${mod}_module )
680 + fi
681 + done
682 +
683 + if [ $mail_enabled ]; then
684 + myconf+=( --with-mail )
685 + use ssl && myconf+=( --with-mail_ssl_module )
686 + fi
687 +
688 + # custom modules
689 + for mod in $NGINX_ADD_MODULES; do
690 + myconf+=( --add-module=${mod} )
691 + done
692 +
693 + # https://bugs.gentoo.org/286772
694 + export LANG=C LC_ALL=C
695 + tc-export AR CC
696 +
697 + if ! use prefix; then
698 + myconf+=( --user=${PN} )
699 + myconf+=( --group=${PN} )
700 + fi
701 +
702 + local WITHOUT_IPV6=
703 + if ! use ipv6; then
704 + WITHOUT_IPV6=" -DNGX_HAVE_INET6=0"
705 + fi
706 +
707 + if [[ -n "${EXTRA_ECONF}" ]]; then
708 + myconf+=( ${EXTRA_ECONF} )
709 + ewarn "EXTRA_ECONF applied. Now you are on your own, good luck!"
710 + fi
711 +
712 + ./configure \
713 + --prefix="${EPREFIX}"/usr \
714 + --conf-path="${EPREFIX}"/etc/${PN}/${PN}.conf \
715 + --error-log-path="${EPREFIX}"/var/log/${PN}/error_log \
716 + --pid-path="${EPREFIX}"/run/${PN}.pid \
717 + --lock-path="${EPREFIX}"/run/lock/${PN}.lock \
718 + --with-cc-opt="-I${ESYSROOT}/usr/include${WITHOUT_IPV6}" \
719 + --with-ld-opt="-L${ESYSROOT}/usr/$(get_libdir)" \
720 + --http-log-path="${EPREFIX}"/var/log/${PN}/access_log \
721 + --http-client-body-temp-path="${EPREFIX}${NGINX_HOME_TMP}"/client \
722 + --http-proxy-temp-path="${EPREFIX}${NGINX_HOME_TMP}"/proxy \
723 + --http-fastcgi-temp-path="${EPREFIX}${NGINX_HOME_TMP}"/fastcgi \
724 + --http-scgi-temp-path="${EPREFIX}${NGINX_HOME_TMP}"/scgi \
725 + --http-uwsgi-temp-path="${EPREFIX}${NGINX_HOME_TMP}"/uwsgi \
726 + --with-compat \
727 + "${myconf[@]}" || die "configure failed"
728 +
729 + # A purely cosmetic change that makes nginx -V more readable. This can be
730 + # good if people outside the gentoo community would troubleshoot and
731 + # question the users setup.
732 + sed -i -e "s|${WORKDIR}|external_module|g" objs/ngx_auto_config.h || die
733 +}
734 +
735 +src_compile() {
736 + use nginx_modules_http_security && emake -C "${HTTP_SECURITY_MODULE_WD}"
737 +
738 + # https://bugs.gentoo.org/286772
739 + export LANG=C LC_ALL=C
740 + emake LINK="${CC} ${LDFLAGS}" OTHERLDFLAGS="${LDFLAGS}"
741 +}
742 +
743 +src_install() {
744 + emake DESTDIR="${D}" install
745 +
746 + cp "${FILESDIR}"/nginx.conf-r2 "${ED}"/etc/nginx/nginx.conf || die
747 +
748 + newinitd "${FILESDIR}"/nginx.initd-r4 nginx
749 + newconfd "${FILESDIR}"/nginx.confd nginx
750 +
751 + systemd_newunit "${FILESDIR}"/nginx.service-r1 nginx.service
752 +
753 + doman man/nginx.8
754 + dodoc CHANGES* README
755 +
756 + # just keepdir. do not copy the default htdocs files (bug #449136)
757 + keepdir /var/www/localhost
758 + rm -rf "${ED}"/usr/html || die
759 +
760 + # set up a list of directories to keep
761 + local keepdir_list="${NGINX_HOME_TMP}"/client
762 + local module
763 + for module in proxy fastcgi scgi uwsgi; do
764 + use nginx_modules_http_${module} && keepdir_list+=" ${NGINX_HOME_TMP}/${module}"
765 + done
766 +
767 + keepdir /var/log/nginx ${keepdir_list}
768 +
769 + # this solves a problem with SELinux where nginx doesn't see the directories
770 + # as root and tries to create them as nginx
771 + fperms 0750 "${NGINX_HOME_TMP}"
772 + fowners ${PN}:0 "${NGINX_HOME_TMP}"
773 +
774 + fperms 0700 ${keepdir_list}
775 + fowners ${PN}:${PN} ${keepdir_list}
776 +
777 + fperms 0710 /var/log/nginx
778 + fowners 0:${PN} /var/log/nginx
779 +
780 + # logrotate
781 + insinto /etc/logrotate.d
782 + newins "${FILESDIR}"/nginx.logrotate-r1 nginx
783 +
784 + # Don't create /run
785 + rm -rf "${ED}"/run || die
786 +
787 + if use lua_single_target_luajit; then
788 + pax-mark m "${ED}/usr/sbin/nginx"
789 + fi
790 +
791 + if use nginx_modules_http_perl; then
792 + cd "${S}"/objs/src/http/modules/perl/ || die
793 + emake DESTDIR="${D}" INSTALLDIRS=vendor
794 + perl_delete_localpod
795 + cd "${S}" || die
796 + fi
797 +
798 + if use nginx_modules_http_cache_purge; then
799 + docinto ${HTTP_CACHE_PURGE_MODULE_P}
800 + dodoc "${HTTP_CACHE_PURGE_MODULE_WD}"/{CHANGES,README.md,TODO.md}
801 + fi
802 +
803 + if use nginx_modules_http_slowfs_cache; then
804 + docinto ${HTTP_SLOWFS_CACHE_MODULE_P}
805 + dodoc "${HTTP_SLOWFS_CACHE_MODULE_WD}"/{CHANGES,README.md}
806 + fi
807 +
808 + if use nginx_modules_http_fancyindex; then
809 + docinto ${HTTP_FANCYINDEX_MODULE_P}
810 + dodoc "${HTTP_FANCYINDEX_MODULE_WD}"/README.rst
811 + fi
812 +
813 + if use nginx_modules_http_lua; then
814 + docinto ${HTTP_LUA_MODULE_P}
815 + dodoc "${HTTP_LUA_MODULE_WD}"/README.markdown
816 + fi
817 +
818 + if use nginx_modules_http_auth_pam; then
819 + docinto ${HTTP_AUTH_PAM_MODULE_P}
820 + dodoc "${HTTP_AUTH_PAM_MODULE_WD}"/{README.md,ChangeLog}
821 + fi
822 +
823 + if use nginx_modules_http_upstream_check; then
824 + docinto ${HTTP_UPSTREAM_CHECK_MODULE_P}
825 + dodoc "${HTTP_UPSTREAM_CHECK_MODULE_WD}"/{README,CHANGES}
826 + fi
827 +
828 + if use nginx_modules_http_naxsi; then
829 + insinto /etc/nginx
830 + doins "${HTTP_NAXSI_MODULE_WD}"/../naxsi_config/naxsi_core.rules
831 + fi
832 +
833 + if use rtmp; then
834 + docinto ${RTMP_MODULE_P}
835 + dodoc "${RTMP_MODULE_WD}"/{AUTHORS,README.md,stat.xsl}
836 + fi
837 +
838 + if use nginx_modules_http_dav_ext; then
839 + docinto ${HTTP_DAV_EXT_MODULE_P}
840 + dodoc "${HTTP_DAV_EXT_MODULE_WD}"/README.rst
841 + fi
842 +
843 + if use nginx_modules_http_echo; then
844 + docinto ${HTTP_ECHO_MODULE_P}
845 + dodoc "${HTTP_ECHO_MODULE_WD}"/README.markdown
846 + fi
847 +
848 + if use nginx_modules_http_security; then
849 + docinto ${HTTP_SECURITY_MODULE_P}
850 + dodoc "${HTTP_SECURITY_MODULE_WD}"/{CHANGES,README.md,authors.txt}
851 + fi
852 +
853 + if use nginx_modules_http_push_stream; then
854 + docinto ${HTTP_PUSH_STREAM_MODULE_P}
855 + dodoc "${HTTP_PUSH_STREAM_MODULE_WD}"/{AUTHORS,CHANGELOG.textile,README.textile}
856 + fi
857 +
858 + if use nginx_modules_http_sticky; then
859 + docinto ${HTTP_STICKY_MODULE_P}
860 + dodoc "${HTTP_STICKY_MODULE_WD}"/{README.md,Changelog.txt,docs/sticky.pdf}
861 + fi
862 +
863 + if use nginx_modules_http_memc; then
864 + docinto ${HTTP_MEMC_MODULE_P}
865 + dodoc "${HTTP_MEMC_MODULE_WD}"/README.markdown
866 + fi
867 +
868 + if use nginx_modules_http_auth_ldap; then
869 + docinto ${HTTP_LDAP_MODULE_P}
870 + dodoc "${HTTP_LDAP_MODULE_WD}"/example.conf
871 + fi
872 +}
873 +
874 +pkg_postinst() {
875 + if use ssl; then
876 + if [[ ! -f "${EROOT}"/etc/ssl/${PN}/${PN}.key ]]; then
877 + install_cert /etc/ssl/${PN}/${PN}
878 + use prefix || chown ${PN}:${PN} "${EROOT}"/etc/ssl/${PN}/${PN}.{crt,csr,key,pem}
879 + fi
880 + fi
881 +
882 + if use nginx_modules_http_spdy; then
883 + ewarn ""
884 + ewarn "In nginx 1.9.5 the spdy module was superseded by http2."
885 + ewarn "Update your configs and package.use accordingly."
886 + fi
887 +
888 + if use nginx_modules_http_lua; then
889 + ewarn ""
890 + ewarn "While you can build lua 3rd party module against ${P}"
891 + ewarn "the author warns that >=${PN}-1.11.11 is still not an"
892 + ewarn "officially supported target yet. You are on your own."
893 + ewarn "Expect runtime failures, memory leaks and other problems!"
894 + fi
895 +
896 + if use nginx_modules_http_lua && use http2; then
897 + ewarn ""
898 + ewarn "Lua 3rd party module author warns against using ${P} with"
899 + ewarn "NGINX_MODULES_HTTP=\"lua http2\". For more info, see https://git.io/OldLsg"
900 + fi
901 +
902 + local _n_permission_layout_checks=0
903 + local _has_to_adjust_permissions=0
904 + local _has_to_show_permission_warning=0
905 +
906 + # Defaults to 1 to inform people doing a fresh installation
907 + # that we ship modified {scgi,uwsgi,fastcgi}_params files
908 + local _has_to_show_httpoxy_mitigation_notice=1
909 +
910 + local _replacing_version=
911 + for _replacing_version in ${REPLACING_VERSIONS}; do
912 + _n_permission_layout_checks=$((${_n_permission_layout_checks}+1))
913 +
914 + if [[ ${_n_permission_layout_checks} -gt 1 ]]; then
915 + # Should never happen:
916 + # Package is abusing slots but doesn't allow multiple parallel installations.
917 + # If we run into this situation it is unsafe to automatically adjust any
918 + # permission...
919 + _has_to_show_permission_warning=1
920 +
921 + ewarn "Replacing multiple ${PN}' versions is unsupported! " \
922 + "You will have to adjust permissions on your own."
923 +
924 + break
925 + fi
926 +
927 + local _replacing_version_branch=$(ver_cut 1-2 "${_replacing_version}")
928 + debug-print "Updating an existing installation (v${_replacing_version}; branch '${_replacing_version_branch}') ..."
929 +
930 + # Do we need to adjust permissions to fix CVE-2013-0337 (bug #458726, #469094)?
931 + # This was before we introduced multiple nginx versions so we
932 + # do not need to distinguish between stable and mainline
933 + local _need_to_fix_CVE2013_0337=1
934 +
935 + if ver_test ${_replacing_version} -ge 1.4.1-r2; then
936 + # We are updating an installation which should already be fixed
937 + _need_to_fix_CVE2013_0337=0
938 + debug-print "Skipping CVE-2013-0337 ... existing installation should not be affected!"
939 + else
940 + _has_to_adjust_permissions=1
941 + debug-print "Need to adjust permissions to fix CVE-2013-0337!"
942 + fi
943 +
944 + # Do we need to inform about HTTPoxy mitigation?
945 + # In repository since commit 8be44f76d4ac02cebcd1e0e6e6284bb72d054b0f
946 + if ver_test ${_replacing_version_branch} -lt 1.10; then
947 + # Updating from <1.10
948 + _has_to_show_httpoxy_mitigation_notice=1
949 + debug-print "Need to inform about HTTPoxy mitigation!"
950 + else
951 + # Updating from >=1.10
952 + local _fixed_in_pvr=
953 + case "${_replacing_version_branch}" in
954 + "1.10")
955 + _fixed_in_pvr="1.10.1-r2"
956 + ;;
957 + "1.11")
958 + _fixed_in_pvr="1.11.3-r1"
959 + ;;
960 + *)
961 + # This should be any future branch.
962 + # If we run this code it is safe to assume that the user has
963 + # already seen the HTTPoxy mitigation notice because he/she is doing
964 + # an update from previous version where we have already shown
965 + # the warning. Otherwise, we wouldn't hit this code path ...
966 + _fixed_in_pvr=
967 + esac
968 +
969 + if [[ -z "${_fixed_in_pvr}" ]] || ver_test ${_replacing_version} -ge ${_fixed_in_pvr}; then
970 + # We are updating an installation where we already informed
971 + # that we are mitigating HTTPoxy per default
972 + _has_to_show_httpoxy_mitigation_notice=0
973 + debug-print "No need to inform about HTTPoxy mitigation ... information was already shown for existing installation!"
974 + else
975 + _has_to_show_httpoxy_mitigation_notice=1
976 + debug-print "Need to inform about HTTPoxy mitigation!"
977 + fi
978 + fi
979 +
980 + # Do we need to adjust permissions to fix CVE-2016-1247 (bug #605008)?
981 + # All branches up to 1.11 are affected
982 + local _need_to_fix_CVE2016_1247=1
983 +
984 + if ver_test ${_replacing_version_branch} -lt 1.10; then
985 + # Updating from <1.10
986 + _has_to_adjust_permissions=1
987 + debug-print "Need to adjust permissions to fix CVE-2016-1247!"
988 + else
989 + # Updating from >=1.10
990 + local _fixed_in_pvr=
991 + case "${_replacing_version_branch}" in
992 + "1.10")
993 + _fixed_in_pvr="1.10.2-r3"
994 + ;;
995 + "1.11")
996 + _fixed_in_pvr="1.11.6-r1"
997 + ;;
998 + *)
999 + # This should be any future branch.
1000 + # If we run this code it is safe to assume that we have already
1001 + # adjusted permissions or were never affected because user is
1002 + # doing an update from previous version which was safe or did
1003 + # the adjustments. Otherwise, we wouldn't hit this code path ...
1004 + _fixed_in_pvr=
1005 + esac
1006 +
1007 + if [[ -z "${_fixed_in_pvr}" ]] || ver_test ${_replacing_version} -ge ${_fixed_in_pvr}; then
1008 + # We are updating an installation which should already be adjusted
1009 + # or which was never affected
1010 + _need_to_fix_CVE2016_1247=0
1011 + debug-print "Skipping CVE-2016-1247 ... existing installation should not be affected!"
1012 + else
1013 + _has_to_adjust_permissions=1
1014 + debug-print "Need to adjust permissions to fix CVE-2016-1247!"
1015 + fi
1016 + fi
1017 + done
1018 +
1019 + if [[ ${_has_to_adjust_permissions} -eq 1 ]]; then
1020 + # We do not DIE when chmod/chown commands are failing because
1021 + # package is already merged on user's system at this stage
1022 + # and we cannot retry without losing the information that
1023 + # the existing installation needs to adjust permissions.
1024 + # Instead we are going to a show a big warning ...
1025 +
1026 + if [[ ${_has_to_show_permission_warning} -eq 0 ]] && [[ ${_need_to_fix_CVE2013_0337} -eq 1 ]]; then
1027 + ewarn ""
1028 + ewarn "The world-readable bit (if set) has been removed from the"
1029 + ewarn "following directories to mitigate a security bug"
1030 + ewarn "(CVE-2013-0337, bug #458726):"
1031 + ewarn ""
1032 + ewarn " ${EPREFIX}/var/log/nginx"
1033 + ewarn " ${EPREFIX}${NGINX_HOME_TMP}/{,client,proxy,fastcgi,scgi,uwsgi}"
1034 + ewarn ""
1035 + ewarn "Check if this is correct for your setup before restarting nginx!"
1036 + ewarn "This is a one-time change and will not happen on subsequent updates."
1037 + ewarn "Furthermore nginx' temp directories got moved to '${EPREFIX}${NGINX_HOME_TMP}'"
1038 + chmod o-rwx \
1039 + "${EPREFIX}"/var/log/nginx \
1040 + "${EPREFIX}"${NGINX_HOME_TMP}/{,client,proxy,fastcgi,scgi,uwsgi} || \
1041 + _has_to_show_permission_warning=1
1042 + fi
1043 +
1044 + if [[ ${_has_to_show_permission_warning} -eq 0 ]] && [[ ${_need_to_fix_CVE2016_1247} -eq 1 ]]; then
1045 + ewarn ""
1046 + ewarn "The permissions on the following directory have been reset in"
1047 + ewarn "order to mitigate a security bug (CVE-2016-1247, bug #605008):"
1048 + ewarn ""
1049 + ewarn " ${EPREFIX}/var/log/nginx"
1050 + ewarn ""
1051 + ewarn "Check if this is correct for your setup before restarting nginx!"
1052 + ewarn "Also ensure that no other log directory used by any of your"
1053 + ewarn "vhost(s) is not writeable for nginx user. Any of your log files"
1054 + ewarn "used by nginx can be abused to escalate privileges!"
1055 + ewarn "This is a one-time change and will not happen on subsequent updates."
1056 + chown 0:nginx "${EPREFIX}"/var/log/nginx || _has_to_show_permission_warning=1
1057 + chmod 710 "${EPREFIX}"/var/log/nginx || _has_to_show_permission_warning=1
1058 + fi
1059 +
1060 + if [[ ${_has_to_show_permission_warning} -eq 1 ]]; then
1061 + # Should never happen ...
1062 + ewarn ""
1063 + ewarn "*************************************************************"
1064 + ewarn "*************** W A R N I N G ***************"
1065 + ewarn "*************************************************************"
1066 + ewarn "The one-time only attempt to adjust permissions of the"
1067 + ewarn "existing nginx installation failed. Be aware that we will not"
1068 + ewarn "try to adjust the same permissions again because now you are"
1069 + ewarn "using a nginx version where we expect that the permissions"
1070 + ewarn "are already adjusted or that you know what you are doing and"
1071 + ewarn "want to keep custom permissions."
1072 + ewarn ""
1073 + fi
1074 + fi
1075 +
1076 + # Sanity check for CVE-2016-1247
1077 + # Required to warn users who received the warning above and thought
1078 + # they could fix it by unmerging and re-merging the package or have
1079 + # unmerged a affected installation on purpose in the past leaving
1080 + # /var/log/nginx on their system due to keepdir/non-empty folder
1081 + # and are now installing the package again.
1082 + local _sanity_check_testfile=$(mktemp --dry-run "${EPREFIX}"/var/log/nginx/.CVE-2016-1247.XXXXXXXXX)
1083 + su -s /bin/sh -c "touch ${_sanity_check_testfile}" nginx >&/dev/null
1084 + if [ $? -eq 0 ] ; then
1085 + # Cleanup -- no reason to die here!
1086 + rm -f "${_sanity_check_testfile}"
1087 +
1088 + ewarn ""
1089 + ewarn "*************************************************************"
1090 + ewarn "*************** W A R N I N G ***************"
1091 + ewarn "*************************************************************"
1092 + ewarn "Looks like your installation is vulnerable to CVE-2016-1247"
1093 + ewarn "(bug #605008) because nginx user is able to create files in"
1094 + ewarn ""
1095 + ewarn " ${EPREFIX}/var/log/nginx"
1096 + ewarn ""
1097 + ewarn "Also ensure that no other log directory used by any of your"
1098 + ewarn "vhost(s) is not writeable for nginx user. Any of your log files"
1099 + ewarn "used by nginx can be abused to escalate privileges!"
1100 + fi
1101 +
1102 + if [[ ${_has_to_show_httpoxy_mitigation_notice} -eq 1 ]]; then
1103 + # HTTPoxy mitigation
1104 + ewarn ""
1105 + ewarn "This nginx installation comes with a mitigation for the HTTPoxy"
1106 + ewarn "vulnerability for FastCGI, SCGI and uWSGI applications by setting"
1107 + ewarn "the HTTP_PROXY parameter to an empty string per default when you"
1108 + ewarn "are sourcing one of the default"
1109 + ewarn ""
1110 + ewarn " - 'fastcgi_params' or 'fastcgi.conf'"
1111 + ewarn " - 'scgi_params'"
1112 + ewarn " - 'uwsgi_params'"
1113 + ewarn ""
1114 + ewarn "files in your server block(s)."
1115 + ewarn ""
1116 + ewarn "If this is causing any problems for you make sure that you are sourcing the"
1117 + ewarn "default parameters _before_ you set your own values."
1118 + ewarn "If you are relying on user-supplied proxy values you have to remove the"
1119 + ewarn "correlating lines from the file(s) mentioned above."
1120 + ewarn ""
1121 + fi
1122 +}