blob: 36a16b580555ce6a2acf969f57bc03607419c45b (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
|
# Copyright 1999-2011 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
# $Header: /var/cvsroot/gentoo-x86/dev-libs/nss/nss-3.12.11-r1.ebuild,v 1.8 2011/11/25 17:31:41 xarthisius Exp $
EAPI=3
inherit eutils flag-o-matic multilib toolchain-funcs
NSPR_VER="4.8.9"
RTM_NAME="NSS_${PV//./_}_RTM"
DESCRIPTION="Mozilla's Network Security Services library that implements PKI support"
HOMEPAGE="http://www.mozilla.org/projects/security/pki/nss/"
SRC_URI="ftp://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/${RTM_NAME}/src/${P}.tar.gz"
LICENSE="|| ( MPL-1.1 GPL-2 LGPL-2.1 )"
SLOT="0"
KEYWORDS="alpha amd64 arm hppa ia64 ~mips ppc ppc64 sparc x86 ~x86-fbsd ~amd64-linux ~x86-linux ~x64-macos ~x86-macos ~sparc-solaris ~x64-solaris ~x86-solaris"
IUSE="utils"
DEPEND="dev-util/pkgconfig"
RDEPEND=">=dev-libs/nspr-${NSPR_VER}
>=dev-db/sqlite-3.5"
src_prepare() {
# Custom changes for gentoo
epatch "${FILESDIR}/${PN}-3.12.5-gentoo-fixups.diff"
epatch "${FILESDIR}/${PN}-3.12.6-gentoo-fixup-warnings.patch"
# Fix for bug #388045
epatch "${FILESDIR}/${P}-CVE-2011-3640.patch"
cd "${S}"/mozilla/security/coreconf
# hack nspr paths
echo 'INCLUDES += -I'"${EPREFIX}"'/usr/include/nspr -I$(DIST)/include/dbm' \
>> headers.mk || die "failed to append include"
# modify install path
sed -e 's:SOURCE_PREFIX = $(CORE_DEPTH)/\.\./dist:SOURCE_PREFIX = $(CORE_DEPTH)/dist:' \
-i source.mk
# Respect LDFLAGS
sed -i -e 's/\$(MKSHLIB) -o/\$(MKSHLIB) \$(LDFLAGS) -o/g' rules.mk
# Ensure we stay multilib aware
sed -i -e "s:gentoo\/nss:$(get_libdir):" "${S}"/mozilla/security/nss/config/Makefile || die "Failed to fix for multilib"
# Fix pkgconfig file for Prefix
sed -i -e "/^PREFIX =/s:= /usr:= ${EPREFIX}/usr:" \
"${S}"/mozilla/security/nss/config/Makefile || die
if [[ ${CHOST} == *-darwin* ]] ; then
# Fix pkgconfig for Darwin (no RPATH stuff)
sed -i -e 's/-Wl,-R${\?libdir}\?//' \
"${S}"/mozilla/security/nss/config/nss-config.in \
"${S}"/mozilla/security/nss/config/nss.pc.in || die
fi
# Avoid install_name_tooling post install
sed -i -e "s:@executable_path:${EPREFIX}/usr/$(get_libdir):" \
"${S}"/mozilla/security/coreconf/Darwin.mk \
"${S}"/mozilla/security/nss/lib/freebl/config.mk || die
epatch "${FILESDIR}"/${PN}-3.12.4-solaris-gcc.patch # breaks non-gnu tools
# dirty hack
cd "${S}"/mozilla/security/nss
sed -i -e "/CRYPTOLIB/s:\$(SOFTOKEN_LIB_DIR):../freebl/\$(OBJDIR):" \
lib/ssl/config.mk || die
sed -i -e "/CRYPTOLIB/s:\$(SOFTOKEN_LIB_DIR):../../lib/freebl/\$(OBJDIR):" \
cmd/platlibs.mk || die
}
src_compile() {
strip-flags
echo > "${T}"/test.c
$(tc-getCC) ${CFLAGS} -c "${T}"/test.c -o "${T}"/test.o
case $(file "${T}"/test.o) in
*64-bit*|*ppc64*|*x86_64*) export USE_64=1;;
*32-bit*|*ppc*|*i386*) ;;
*) die "Failed to detect whether your arch is 64bits or 32bits, disable distcc if you're using it, please";;
esac
export NSPR_INCLUDE_DIR=`nspr-config --includedir`
export NSPR_LIB_DIR=`nspr-config --libdir`
export BUILD_OPT=1
export NSS_USE_SYSTEM_SQLITE=1
export NSDISTMODE=copy
export NSS_ENABLE_ECC=1
export XCFLAGS="${CFLAGS}"
export FREEBL_NO_DEPEND=1
cd "${S}"/mozilla/security/coreconf
emake -j1 CC="$(tc-getCC)" || die "coreconf make failed"
cd "${S}"/mozilla/security/dbm
emake -j1 CC="$(tc-getCC)" || die "dbm make failed"
cd "${S}"/mozilla/security/nss
emake -j1 CC="$(tc-getCC)" || die "nss make failed"
}
# Altering these 3 libraries breaks the CHK verification.
# All of the following cause it to break:
# - stripping
# - prelink
# - ELF signing
# http://www.mozilla.org/projects/security/pki/nss/tech-notes/tn6.html
# Either we have to NOT strip them, or we have to forcibly resign after
# stripping.
#local_libdir="$(get_libdir)"
#export STRIP_MASK="
# */${local_libdir}/libfreebl3.so*
# */${local_libdir}/libnssdbm3.so*
# */${local_libdir}/libsoftokn3.so*"
export NSS_CHK_SIGN_LIBS="freebl3 nssdbm3 softokn3"
generate_chk() {
local shlibsign="$1"
local libdir="$2"
einfo "Resigning core NSS libraries for FIPS validation"
shift 2
for i in ${NSS_CHK_SIGN_LIBS} ; do
local libname=lib${i}$(get_libname)
local chkname=lib${i}.chk
"${shlibsign}" \
-i "${libdir}"/${libname} \
-o "${libdir}"/${chkname}.tmp \
&& mv -f \
"${libdir}"/${chkname}.tmp \
"${libdir}"/${chkname} \
|| die "Failed to sign ${libname}"
done
}
cleanup_chk() {
local libdir="$1"
shift 1
for i in ${NSS_CHK_SIGN_LIBS} ; do
local libfname="${libdir}/lib${i}$(get_libname)"
# If the major version has changed, then we have old chk files.
[ ! -f "${libfname}" -a -f "${libfname}.chk" ] \
&& rm -f "${libfname}.chk"
done
}
src_install () {
MINOR_VERSION=12
cd "${S}"/mozilla/security/dist
dodir /usr/$(get_libdir)
cp -L */lib/*$(get_libname) "${ED}"/usr/$(get_libdir) || die "copying shared libs failed"
# We generate these after stripping the libraries, else they don't match.
#cp -L */lib/*.chk "${ED}"/usr/$(get_libdir) || die "copying chk files failed"
cp -L */lib/libcrmf.a "${ED}"/usr/$(get_libdir) || die "copying libs failed"
# Install nss-config and pkgconfig file
dodir /usr/bin
cp -L */bin/nss-config "${ED}"/usr/bin
dodir /usr/$(get_libdir)/pkgconfig
cp -L */lib/pkgconfig/nss.pc "${ED}"/usr/$(get_libdir)/pkgconfig
# all the include files
insinto /usr/include/nss
doins public/nss/*.h
cd "${ED}"/usr/$(get_libdir)
local n=
for file in *$(get_libname); do
n=${file%$(get_libname)}$(get_libname ${MINOR_VERSION})
mv ${file} ${n}
ln -s ${n} ${file}
done
local nssutils
# Always enabled because we need it for chk generation.
nssutils="shlibsign"
if use utils; then
# The tests we do not need to install.
#nssutils_test="bltest crmftest dbtest dertimetest
#fipstest remtest sdrtest"
nssutils="addbuiltin atob baddbdir btoa certcgi certutil checkcert
cmsutil conflict crlutil derdump digest makepqg mangle modutil multinit
nonspr10 ocspclnt oidcalc p7content p7env p7sign p7verify pk11mode
pk12util pp rsaperf selfserv shlibsign signtool signver ssltap strsclnt
symkeyutil tstclnt vfychain vfyserv"
fi
cd "${S}"/mozilla/security/dist/*/bin/
for f in $nssutils; do
dobin ${f}
done
# Prelink breaks the CHK files. We don't have any reliable way to run
# shlibsign after prelink.
declare -a libs
for l in ${NSS_CHK_SIGN_LIBS} ; do
libs+=("${EPREFIX}/usr/$(get_libdir)/lib${l}$(get_libname)")
done
OLD_IFS="${IFS}" IFS=":" ; liblist="${libs[*]}" ; IFS="${OLD_IFS}"
echo -e "PRELINK_PATH_MASK=${liblist}" >"${T}/90nss"
unset libs liblist
doenvd "${T}/90nss"
}
pkg_postinst() {
elog "We have reverted back to using upstreams soname."
elog "Please run revdep-rebuild --library libnss3$(get_libname 12) , this"
elog "will correct most issues. If you find a binary that does"
elog "not run please re-emerge package to ensure it properly"
elog "links after upgrade."
elog
# We must re-sign the ELF libraries AFTER they are stripped.
[[ ${CHOST} != *-darwin* ]] && \
generate_chk "${EROOT}"/usr/bin/shlibsign "${EROOT}"/usr/$(get_libdir)
}
pkg_postrm() {
cleanup_chk "${EROOT}"/usr/$(get_libdir)
}
|
GitWeb