|
| 1 | +# Copyright 1999-2026 Gentoo Authors |
| 2 | +# Distributed under the terms of the GNU General Public License v2 |
| 3 | + |
| 4 | +EAPI=8 |
| 5 | + |
| 6 | +VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssl.org.asc |
| 7 | +inherit edo flag-o-matic linux-info toolchain-funcs |
| 8 | +inherit multilib multilib-minimal multiprocessing preserve-libs |
| 9 | + |
| 10 | +DESCRIPTION="Robust, full-featured Open Source Toolkit for the Transport Layer Security (TLS)" |
| 11 | +HOMEPAGE="https://openssl-library.org/" |
| 12 | + |
| 13 | +MY_P=${P/_/-} |
| 14 | + |
| 15 | +if [[ ${PV} == *9999 ]] ; then |
| 16 | + [[ ${PV} == *.*.9999 ]] && EGIT_BRANCH="openssl-${PV%%.9999}" |
| 17 | + EGIT_REPO_URI="https://github.com/openssl/openssl.git" |
| 18 | + |
| 19 | + inherit git-r3 |
| 20 | +else |
| 21 | + inherit verify-sig |
| 22 | + SRC_URI=" |
| 23 | + https://github.com/openssl/openssl/releases/download/${P}/${P}.tar.gz |
| 24 | + verify-sig? ( |
| 25 | + https://github.com/openssl/openssl/releases/download/${P}/${P}.tar.gz.asc |
| 26 | + ) |
| 27 | + " |
| 28 | + |
| 29 | + if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then |
| 30 | + KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris" |
| 31 | + fi |
| 32 | + |
| 33 | + BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-openssl-20240920 )" |
| 34 | +fi |
| 35 | + |
| 36 | +S="${WORKDIR}"/${MY_P} |
| 37 | + |
| 38 | +LICENSE="Apache-2.0" |
| 39 | +SLOT="0/3" # .so version of libssl/libcrypto |
| 40 | +IUSE="+asm cpu_flags_x86_sse2 fips ktls rfc3779 sctp static-libs test tls-compression vanilla weak-ssl-ciphers" |
| 41 | +RESTRICT="!test? ( test )" |
| 42 | + |
| 43 | +COMMON_DEPEND=" |
| 44 | + tls-compression? ( >=virtual/zlib-1.2.8-r1:=[static-libs(+)?,${MULTILIB_USEDEP}] ) |
| 45 | +" |
| 46 | +BDEPEND+=" |
| 47 | + >=dev-lang/perl-5 |
| 48 | + sctp? ( >=net-misc/lksctp-tools-1.0.12 ) |
| 49 | + test? ( |
| 50 | + sys-apps/diffutils |
| 51 | + app-alternatives/bc |
| 52 | + sys-process/procps |
| 53 | + ) |
| 54 | +" |
| 55 | +DEPEND="${COMMON_DEPEND}" |
| 56 | +RDEPEND="${COMMON_DEPEND}" |
| 57 | +PDEPEND="app-misc/ca-certificates" |
| 58 | + |
| 59 | +MULTILIB_WRAPPED_HEADERS=( |
| 60 | + /usr/include/openssl/configuration.h |
| 61 | +) |
| 62 | + |
| 63 | +pkg_setup() { |
| 64 | + if use ktls ; then |
| 65 | + if kernel_is -lt 4 18 ; then |
| 66 | + ewarn "Kernel implementation of TLS (USE=ktls) requires kernel >=4.18!" |
| 67 | + else |
| 68 | + CONFIG_CHECK="~TLS ~TLS_DEVICE" |
| 69 | + ERROR_TLS="You will be unable to offload TLS to kernel because CONFIG_TLS is not set!" |
| 70 | + ERROR_TLS_DEVICE="You will be unable to offload TLS to kernel because CONFIG_TLS_DEVICE is not set!" |
| 71 | + use test && CONFIG_CHECK+=" ~CRYPTO_USER_API_SKCIPHER" |
| 72 | + |
| 73 | + linux-info_pkg_setup |
| 74 | + fi |
| 75 | + fi |
| 76 | + |
| 77 | + [[ ${MERGE_TYPE} == binary ]] && return |
| 78 | + |
| 79 | + # must check in pkg_setup; sysctl doesn't work with userpriv! |
| 80 | + if use test && use sctp ; then |
| 81 | + # test_ssl_new will fail with "Ensure SCTP AUTH chunks are enabled in kernel" |
| 82 | + # if sctp.auth_enable is not enabled. |
| 83 | + local sctp_auth_status=$(sysctl -n net.sctp.auth_enable 2>/dev/null) |
| 84 | + if [[ -z "${sctp_auth_status}" ]] || [[ ${sctp_auth_status} != 1 ]] ; then |
| 85 | + die "FEATURES=test with USE=sctp requires net.sctp.auth_enable=1!" |
| 86 | + fi |
| 87 | + fi |
| 88 | +} |
| 89 | + |
| 90 | +src_prepare() { |
| 91 | + # Make sure we only ever touch Makefile.org and avoid patching a file |
| 92 | + # that gets blown away anyways by the Configure script in src_configure |
| 93 | + rm -f Makefile || die |
| 94 | + |
| 95 | + if ! use vanilla ; then |
| 96 | + PATCHES+=( |
| 97 | + # Add patches which are Gentoo-specific customisations here |
| 98 | + ) |
| 99 | + fi |
| 100 | + |
| 101 | + default |
| 102 | + |
| 103 | + if use test && use sctp && has network-sandbox ${FEATURES} ; then |
| 104 | + einfo "Disabling test '80-test_ssl_new.t' which is known to fail with FEATURES=network-sandbox ..." |
| 105 | + rm test/recipes/80-test_ssl_new.t || die |
| 106 | + fi |
| 107 | + |
| 108 | + # Test fails depending on kernel configuration, bug #699134 |
| 109 | + rm test/recipes/30-test_afalg.t || die |
| 110 | +} |
| 111 | + |
| 112 | +src_configure() { |
| 113 | + # Keep this in sync with app-misc/c_rehash |
| 114 | + SSL_CNF_DIR="/etc/ssl" |
| 115 | + |
| 116 | + # Quiet out unknown driver argument warnings since openssl |
| 117 | + # doesn't have well-split CFLAGS and we're making it even worse |
| 118 | + # and 'make depend' uses -Werror for added fun (bug #417795 again) |
| 119 | + tc-is-clang && append-flags -Qunused-arguments |
| 120 | + |
| 121 | + # We really, really need to build OpenSSL w/ strict aliasing disabled. |
| 122 | + # It's filled with violations and it *will* result in miscompiled |
| 123 | + # code. This has been in the ebuild for > 10 years but even in 2022, |
| 124 | + # it's still relevant: |
| 125 | + # - https://github.com/llvm/llvm-project/issues/55255 |
| 126 | + # - https://github.com/openssl/openssl/issues/12247 |
| 127 | + # - https://github.com/openssl/openssl/issues/18225 |
| 128 | + # - https://github.com/openssl/openssl/issues/18663#issuecomment-1181478057 |
| 129 | + # Don't remove the no strict aliasing bits below! |
| 130 | + filter-flags -fstrict-aliasing |
| 131 | + append-flags -fno-strict-aliasing |
| 132 | + # The OpenSSL developers don't test with LTO right now, it leads to various |
| 133 | + # warnings/errors (which may or may not be false positives), it's considered |
| 134 | + # unsupported, and it's not tested in CI: https://github.com/openssl/openssl/issues/18663. |
| 135 | + filter-lto |
| 136 | + |
| 137 | + append-flags $(test-flags-CC -Wa,--noexecstack) |
| 138 | + |
| 139 | + # bug #895308 |
| 140 | + append-atomic-flags |
| 141 | + # Configure doesn't respect LIBS |
| 142 | + export LDLIBS="${LIBS}" |
| 143 | + |
| 144 | + # bug #197996 |
| 145 | + unset APPS |
| 146 | + # bug #312551 |
| 147 | + unset SCRIPTS |
| 148 | + # bug #311473 |
| 149 | + unset CROSS_COMPILE |
| 150 | + |
| 151 | + tc-export AR CC CXX RANLIB RC |
| 152 | + |
| 153 | + multilib-minimal_src_configure |
| 154 | +} |
| 155 | + |
| 156 | +multilib_src_configure() { |
| 157 | + use_ssl() { usex $1 "enable-${2:-$1}" "no-${2:-$1}" " ${*:3}" ; } |
| 158 | + |
| 159 | + local krb5=$(has_version app-crypt/mit-krb5 && echo "MIT" || echo "Heimdal") |
| 160 | + |
| 161 | + # See if our toolchain supports __uint128_t. If so, it's 64bit |
| 162 | + # friendly and can use the nicely optimized code paths, bug #460790. |
| 163 | + #local ec_nistp_64_gcc_128 |
| 164 | + # |
| 165 | + # Disable it for now though (bug #469976) |
| 166 | + # Do NOT re-enable without substantial discussion first! |
| 167 | + # |
| 168 | + #echo "__uint128_t i;" > "${T}"/128.c |
| 169 | + #if ${CC} ${CFLAGS} -c "${T}"/128.c -o /dev/null >&/dev/null ; then |
| 170 | + # ec_nistp_64_gcc_128="enable-ec_nistp_64_gcc_128" |
| 171 | + #fi |
| 172 | + |
| 173 | + local sslout=$(bash "${FILESDIR}/gentoo.config-1.0.4") |
| 174 | + einfo "Using configuration: ${sslout:-(openssl knows best)}" |
| 175 | + |
| 176 | + # https://github.com/openssl/openssl/blob/master/INSTALL.md#enable-and-disable-features |
| 177 | + local myeconfargs=( |
| 178 | + ${sslout} |
| 179 | + |
| 180 | + $(use cpu_flags_x86_sse2 || echo "no-sse2") |
| 181 | + enable-camellia |
| 182 | + enable-ec |
| 183 | + enable-ec2m |
| 184 | + enable-sm2 |
| 185 | + enable-srp |
| 186 | + $(use elibc_musl && echo "no-async") |
| 187 | + enable-idea |
| 188 | + enable-mdc2 |
| 189 | + enable-rc5 |
| 190 | + $(use fips && echo "enable-fips") |
| 191 | + $(use_ssl asm) |
| 192 | + $(use_ssl ktls) |
| 193 | + $(use_ssl rfc3779) |
| 194 | + $(use_ssl sctp) |
| 195 | + $(use test || echo "no-tests") |
| 196 | + $(use_ssl tls-compression zlib) |
| 197 | + $(use_ssl weak-ssl-ciphers) |
| 198 | + |
| 199 | + --prefix="${EPREFIX}"/usr |
| 200 | + --openssldir="${EPREFIX}"${SSL_CNF_DIR} |
| 201 | + --libdir=$(get_libdir) |
| 202 | + |
| 203 | + shared |
| 204 | + threads |
| 205 | + ) |
| 206 | + |
| 207 | + edo perl "${S}/Configure" "${myeconfargs[@]}" |
| 208 | +} |
| 209 | + |
| 210 | +multilib_src_compile() { |
| 211 | + emake build_sw |
| 212 | + |
| 213 | + if multilib_is_native_abi; then |
| 214 | + emake build_docs |
| 215 | + fi |
| 216 | +} |
| 217 | + |
| 218 | +multilib_src_test() { |
| 219 | + # VFP = show subtests verbosely and show failed tests verbosely |
| 220 | + # Normal V=1 would show everything verbosely but this slows things down. |
| 221 | + emake HARNESS_JOBS="$(makeopts_jobs)" -Onone VFP=1 test |
| 222 | +} |
| 223 | + |
| 224 | +multilib_src_install() { |
| 225 | + # Only -j1 is supported for the install targets: |
| 226 | + # https://github.com/openssl/openssl/issues/21999#issuecomment-1771150305 |
| 227 | + emake DESTDIR="${D}" -j1 install_sw |
| 228 | + if use fips; then |
| 229 | + emake DESTDIR="${D}" -j1 install_fips |
| 230 | + # Regen this in pkg_preinst, bug 900625 |
| 231 | + rm "${ED}${SSL_CNF_DIR}"/fipsmodule.cnf || die |
| 232 | + fi |
| 233 | + |
| 234 | + if multilib_is_native_abi; then |
| 235 | + emake DESTDIR="${D}" -j1 install_ssldirs |
| 236 | + emake DESTDIR="${D}" DOCDIR='$(INSTALLTOP)'/share/doc/${PF} -j1 install_docs |
| 237 | + fi |
| 238 | + |
| 239 | + # This is crappy in that the static archives are still built even |
| 240 | + # when USE=static-libs. But this is due to a failing in the openssl |
| 241 | + # build system: the static archives are built as PIC all the time. |
| 242 | + # Only way around this would be to manually configure+compile openssl |
| 243 | + # twice; once with shared lib support enabled and once without. |
| 244 | + if ! use static-libs ; then |
| 245 | + rm "${ED}"/usr/$(get_libdir)/lib{crypto,ssl}.a || die |
| 246 | + fi |
| 247 | +} |
| 248 | + |
| 249 | +multilib_src_install_all() { |
| 250 | + # openssl installs perl version of c_rehash by default, but |
| 251 | + # we provide a shell version via app-misc/c_rehash |
| 252 | + rm "${ED}"/usr/bin/c_rehash || die |
| 253 | + |
| 254 | + dodoc {AUTHORS,CHANGES,NEWS,README,README-PROVIDERS}.md doc/*.txt doc/${PN}-c-indent.el |
| 255 | + |
| 256 | + # Create the certs directory |
| 257 | + keepdir ${SSL_CNF_DIR}/certs |
| 258 | + |
| 259 | + # bug #254521 |
| 260 | + dodir /etc/sandbox.d |
| 261 | + echo 'SANDBOX_PREDICT="/dev/crypto"' > "${ED}"/etc/sandbox.d/10openssl |
| 262 | + |
| 263 | + diropts -m0700 |
| 264 | + keepdir ${SSL_CNF_DIR}/private |
| 265 | +} |
| 266 | + |
| 267 | +pkg_preinst() { |
| 268 | + if use fips; then |
| 269 | + # Regen fipsmodule.cnf, bug 900625 |
| 270 | + ebegin "Running openssl fipsinstall" |
| 271 | + LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \ |
| 272 | + "${ED}/usr/bin/openssl" fipsinstall -quiet \ |
| 273 | + -out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \ |
| 274 | + -module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so" |
| 275 | + eend $? |
| 276 | + fi |
| 277 | + |
| 278 | + preserve_old_lib /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \ |
| 279 | + /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1) |
| 280 | +} |
| 281 | + |
| 282 | +pkg_postinst() { |
| 283 | + ebegin "Running 'openssl rehash ${EROOT}${SSL_CNF_DIR}/certs' to rebuild hashes (bug #333069)" |
| 284 | + openssl rehash "${EROOT}${SSL_CNF_DIR}/certs" |
| 285 | + eend $? |
| 286 | + |
| 287 | + preserve_old_lib_notify /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \ |
| 288 | + /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1) |
| 289 | +} |
0 commit comments