Backup_Repos/pentoo-overlay
1
0
Fork 0
mirror of https://github.com/pentoo/pentoo-overlay synced 2026-05-02 11:40:51 +02:00
Code Issues Projects Releases Wiki Activity

openssl-bad: unmask, a new workaround works fine

Browse source
This commit is contained in:
Anton Bolshakov 2025-01-20 11:21:28 +08:00
parent d36b9c35f6
commit 63510f889b
No known key found for this signature in database
GPG key ID: 32BDCED870788F04
5 changed files with 259 additions and 163 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
dev-libs/openssl-bad/Manifest
View file

@ -1,2 +1,4 @@
DIST openssl-1.0.2t-bindist-1.0.tar.xz 13872 BLAKE2B b2aade96a6e0ca6209a39e205b1c838de945903fcf959c62cc29ddcd1a0cb360fc5db234df86860a6a4c096f5ecc237611e4c2946b986a5500c24ba93c208ef4 SHA512 a48a7efb9b973b865bcc5009d450b428ed6b4b95e4cefe70c51056e47392c8a7bec58215168d8b07712419dc74646c2bd2fd23bcfbba2031376e292249a6b1b6
DIST openssl-bad-1.0.2_p20220901.tar.gz 5530282 BLAKE2B 4e5311392596e40f491e36dbb79d41b20c7fc55d11396a828af23e76eb436e4eb5395cc5285f10dc14dab0be732db0eefe80beba15ecbec814da310526ce9285 SHA512 41b4e3d48e5ad090466ca90b4c6b1be1b166cd2978011f65b67502ca1b9fd0130796cc0d8c87908f0eaf342c9a1fb29f7c9f84c6f1fded8d2999099c12c227ed
DIST openssl-bad-1.0.2_p20250104.gh.tar.gz 5529207 BLAKE2B 8187086c1b566da364ffbb7d39816750445328d33a7c93d21a62219191e2de4ab3c4fa85493d421de36ef802dff540b567a22c47e0a8a176847fcdbca13cfa92 SHA512 ceaf16082f8e14bd24c6910c8d8a5f48361f02d9f9a5a471b456a91e06fabc08c81ffe71a4c5605fa9f62e927fd66626268ae49e8eb4bc5b72ae14361305934c
DIST openssl-compat-1.0.2u-versioned-symbols.patch.gz 24633 BLAKE2B 6bfad4ad27dbca0bd85bfd9521ffc844c3e93e6a1cca7c814edd49affc60ece1c706dd3aa7be2ce80857532531eac6f0f03f43c0be22a769d00d9241686eff71 SHA512 3d85aa34f2491e0e36eedc45829709e0fb552f6d558c2726b59dafa98c3e679b88497f3f7399d7565d88e727591e7d9b12f5b1e27116ba19b9a661d7f75b07a9

149
dev-libs/openssl-bad/files/4.patch
View file

@ -1,149 +0,0 @@
From 152026f7b1f3221e73de2a9dc21c002d1565dd8e Mon Sep 17 00:00:00 2001
From: Anton Bolshakov <blshkv@users.noreply.github.com>
Date: Sun, 19 Jan 2025 11:37:52 +0800
Subject: [PATCH] Update e_aes.c
replace that file with 1.0.2r version
---
crypto/evp/e_aes.c | 84 ++++++++++++++++++++++++++--------------------
1 file changed, 47 insertions(+), 37 deletions(-)
diff --git a/crypto/evp/e_aes.c b/crypto/evp/e_aes.c
index 3574b17f0c8d3..ccc626f1d81c2 100644
--- a/crypto/evp/e_aes.c
+++ b/crypto/evp/e_aes.c
@@ -1,5 +1,5 @@
/* ====================================================================
- * Copyright (c) 2001-2011 The OpenSSL Project. All rights reserved.
+ * Copyright (c) 2001-2018 The OpenSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
@@ -1089,6 +1089,8 @@ static int aes_cfb1_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
CRYPTO_cfb128_1_encrypt(in, out, MAXBITCHUNK * 8, &dat->ks,
ctx->iv, &ctx->num, ctx->encrypt, dat->block);
len -= MAXBITCHUNK;
+ out += MAXBITCHUNK;
+ in += MAXBITCHUNK;
}
if (len)
CRYPTO_cfb128_1_encrypt(in, out, len * 8, &dat->ks,
@@ -1120,6 +1122,8 @@ BLOCK_CIPHER_generic_pack(NID_aes, 128, EVP_CIPH_FLAG_FIPS)
static int aes_gcm_cleanup(EVP_CIPHER_CTX *c)
{
EVP_AES_GCM_CTX *gctx = c->cipher_data;
+ if (gctx == NULL)
+ return 0;
OPENSSL_cleanse(&gctx->gcm, sizeof(gctx->gcm));
if (gctx->iv != c->iv)
OPENSSL_free(gctx->iv);
@@ -1235,10 +1239,15 @@ static int aes_gcm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
{
unsigned int len = c->buf[arg - 2] << 8 | c->buf[arg - 1];
/* Correct length for explicit IV */
+ if (len < EVP_GCM_TLS_EXPLICIT_IV_LEN)
+ return 0;
len -= EVP_GCM_TLS_EXPLICIT_IV_LEN;
/* If decrypting correct for tag too */
- if (!c->encrypt)
+ if (!c->encrypt) {
+ if (len < EVP_GCM_TLS_TAG_LEN)
+ return 0;
len -= EVP_GCM_TLS_TAG_LEN;
+ }
c->buf[arg - 2] = len >> 8;
c->buf[arg - 1] = len & 0xff;
}
@@ -1271,56 +1280,57 @@ static int aes_gcm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
}
}
-static ctr128_f aes_gcm_set_key(AES_KEY *aes_key, GCM128_CONTEXT *gcm_ctx,
- const unsigned char *key, size_t key_len)
+static int aes_gcm_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
+ const unsigned char *iv, int enc)
{
+ EVP_AES_GCM_CTX *gctx = ctx->cipher_data;
+ if (!iv && !key)
+ return 1;
+ if (key) {
+ do {
# ifdef HWAES_CAPABLE
- if (HWAES_CAPABLE) {
- HWAES_set_encrypt_key(key, key_len * 8, aes_key);
- CRYPTO_gcm128_init(gcm_ctx, aes_key,
- (block128_f) HWAES_encrypt);
+ if (HWAES_CAPABLE) {
+ HWAES_set_encrypt_key(key, ctx->key_len * 8, &gctx->ks.ks);
+ CRYPTO_gcm128_init(&gctx->gcm, &gctx->ks,
+ (block128_f) HWAES_encrypt);
# ifdef HWAES_ctr32_encrypt_blocks
- return (ctr128_f) HWAES_ctr32_encrypt_blocks;
+ gctx->ctr = (ctr128_f) HWAES_ctr32_encrypt_blocks;
# else
- return NULL;
+ gctx->ctr = NULL;
# endif
- } else
+ break;
+ } else
# endif
# ifdef BSAES_CAPABLE
- if (BSAES_CAPABLE) {
- AES_set_encrypt_key(key, key_len * 8, aes_key);
- CRYPTO_gcm128_init(gcm_ctx, aes_key,
- (block128_f) AES_encrypt);
- return (ctr128_f) bsaes_ctr32_encrypt_blocks;
- }
+ if (BSAES_CAPABLE) {
+ AES_set_encrypt_key(key, ctx->key_len * 8, &gctx->ks.ks);
+ CRYPTO_gcm128_init(&gctx->gcm, &gctx->ks,
+ (block128_f) AES_encrypt);
+ gctx->ctr = (ctr128_f) bsaes_ctr32_encrypt_blocks;
+ break;
+ } else
# endif
# ifdef VPAES_CAPABLE
- if (VPAES_CAPABLE) {
- vpaes_set_encrypt_key(key, key_len * 8, aes_key);
- CRYPTO_gcm128_init(gcm_ctx, aes_key,
- (block128_f)vpaes_encrypt);
- return NULL;
- } else
+ if (VPAES_CAPABLE) {
+ vpaes_set_encrypt_key(key, ctx->key_len * 8, &gctx->ks.ks);
+ CRYPTO_gcm128_init(&gctx->gcm, &gctx->ks,
+ (block128_f) vpaes_encrypt);
+ gctx->ctr = NULL;
+ break;
+ } else
# endif
- (void)0; /* terminate potentially open 'else' */
+ (void)0; /* terminate potentially open 'else' */
- AES_set_encrypt_key(key, key_len * 8, aes_key);
- CRYPTO_gcm128_init(gcm_ctx, aes_key, (block128_f) AES_encrypt);
+ AES_set_encrypt_key(key, ctx->key_len * 8, &gctx->ks.ks);
+ CRYPTO_gcm128_init(&gctx->gcm, &gctx->ks,
+ (block128_f) AES_encrypt);
# ifdef AES_CTR_ASM
- return (ctr128_f) AES_ctr32_encrypt;
+ gctx->ctr = (ctr128_f) AES_ctr32_encrypt;
# else
- return NULL;
+ gctx->ctr = NULL;
# endif
-}
+ } while (0);
-static int aes_gcm_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
- const unsigned char *iv, int enc)
-{
- EVP_AES_GCM_CTX *gctx = ctx->cipher_data;
- if (!iv && !key)
- return 1;
- if (key) {
- gctx->ctr = aes_gcm_set_key(&gctx->ks, &gctx->gcm, key, ctx->key_len);
/*
* If we have an iv can set it directly, otherwise use saved IV.
*/

216
dev-libs/openssl-bad/openssl-bad-1.0.2_p20220901-r1.ebuild Normal file
View file

@ -0,0 +1,216 @@
# Copyright 1999-2020 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2
EAPI=8
inherit flag-o-matic toolchain-funcs multilib-minimal
DESCRIPTION="Snapshot for testssl.sh >2.8 from PM's fork, ready to compile"
HOMEPAGE="https://github.com/drwetter/openssl-1.0.2.bad"
#EGIT_BRANCH="1.0.2-chacha"
MY_COMMIT="698be5f5b6d0d150fb45182824864016389f1868"
SRC_URI="https://github.com/drwetter/openssl-1.0.2.bad/archive/${MY_COMMIT}.tar.gz -> ${P}.tar.gz"
S="${WORKDIR}/openssl-1.0.2.bad-${MY_COMMIT}"
LICENSE="openssl"
SLOT="0"
KEYWORDS="alpha amd64 arm arm64 hppa m68k ~mips ppc ppc64 sparc x86 ~arm-linux ~x86-linux"
IUSE="+asm bindist gmp +kerberos rfc3779 sctp cpu_flags_x86_sse2 +sslv2 +sslv3 static-libs test +tls-heartbeat vanilla zlib"
RESTRICT="!bindist? ( bindist )
!test? ( test )"
RDEPEND=">=app-misc/c_rehash-1.7-r1
gmp? ( >=dev-libs/gmp-5.1.3-r1[static-libs(+)?,${MULTILIB_USEDEP}] )
zlib? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] )
kerberos? ( >=app-crypt/mit-krb5-1.11.4[${MULTILIB_USEDEP}] )"
DEPEND="${RDEPEND}
>=dev-lang/perl-5
sctp? ( >=net-misc/lksctp-tools-1.0.12 )
test? (
sys-apps/diffutils
sys-devel/bc
)"
PDEPEND="app-misc/ca-certificates"
MULTILIB_WRAPPED_HEADERS=(
usr/include/openssl/opensslconf.h
)
src_prepare() {
# fix https://github.com/testssl/openssl-1.0.2.bad/issues/3
append-cflags -Wno-error=implicit-function-declaration -Wno-error=incompatible-pointer-types
# keep this in sync with app-misc/c_rehash
SSL_CNF_DIR="/etc/ssl"
# Make sure we only ever touch Makefile.org and avoid patching a file
# that gets blown away anyways by the Configure script in src_configure
rm -f Makefile
if ! use vanilla ; then
# eapply "${FILESDIR}"/openssl-1.0.0a-ldflags.patch #327421
# eapply "${FILESDIR}"/openssl-1.0.2a-parallel-obj-headers.patch
# eapply "${FILESDIR}"/openssl-1.0.2a-parallel-install-dirs.patch
# eapply "${FILESDIR}"/openssl-1.0.2a-parallel-symlinking.patch #545028
# eapply "${FILESDIR}"/openssl-1.0.2a-x32-asm.patch #542618
# eapply "${FILESDIR}"/openssl-1.0.1p-default-source.patch #554338
eapply "${FILESDIR}"/patch/*.patch
fi
# eapply "${FILESDIR}"/4.patch
eapply_user
# disable fips in the build
# make sure the man pages are suffixed #302165
# don't bother building man pages if they're disabled
sed -i \
-e '/^MANSUFFIX/s:=.*:=ssl:' \
-e '/^MAKEDEPPROG/s:=.*:=$(CC):' \
-e $(has noman FEATURES \
&& echo '/^install:/s:install_docs::' \
|| echo '/^MANDIR=/s:=.*:='${EPREFIX}'/usr/share/man:') \
Makefile.org \
|| die
# show the actual commands in the log
sed -i '/^SET_X/s:=.*:=set -x:' Makefile.shared
# since we're forcing $(CC) as makedep anyway, just fix
# the conditional as always-on
# helps clang (#417795), and versioned gcc (#499818)
# this breaks build with 1.0.2p, not sure if it is needed anymore
#sed -i 's/expr.*MAKEDEPEND.*;/true;/' util/domd || die
# quiet out unknown driver argument warnings since openssl
# doesn't have well-split CFLAGS and we're making it even worse
# and 'make depend' uses -Werror for added fun (#417795 again)
[[ ${CC} == *clang* ]] && append-flags -Qunused-arguments
# allow openssl to be cross-compiled
cp "${FILESDIR}"/gentoo.config-1.0.2 gentoo.config || die
chmod a+rx gentoo.config || die
append-flags -fno-strict-aliasing
append-flags $(test-flags-CC -Wa,--noexecstack)
append-cppflags -DOPENSSL_NO_BUF_FREELISTS
sed -i '1s,^:$,#!'"${EPREFIX}"'/usr/bin/perl,' Configure #141906
# The config script does stupid stuff to prompt the user. Kill it.
sed -i '/stty -icanon min 0 time 50; read waste/d' config || die
./config --test-sanity || die "I AM NOT SANE"
multilib_copy_sources
}
multilib_src_configure() {
unset APPS #197996
unset SCRIPTS #312551
unset CROSS_COMPILE #311473
tc-export CC AR RANLIB RC
# Clean out patent-or-otherwise-encumbered code
# Camellia: Royalty Free https://en.wikipedia.org/wiki/Camellia_(cipher)
# IDEA: Expired https://en.wikipedia.org/wiki/International_Data_Encryption_Algorithm
# EC: ????????? ??/??/2015 https://en.wikipedia.org/wiki/Elliptic_Curve_Cryptography
# MDC2: Expired https://en.wikipedia.org/wiki/MDC-2
# RC5: Expired https://en.wikipedia.org/wiki/RC5
use_ssl() { usex $1 "enable-${2:-$1}" "no-${2:-$1}" " ${*:3}" ; }
echoit() { echo "$@" ; "$@" ; }
local krb5=$(has_version app-crypt/mit-krb5 && echo "MIT" || echo "Heimdal")
# See if our toolchain supports __uint128_t. If so, it's 64bit
# friendly and can use the nicely optimized code paths. #460790
local ec_nistp_64_gcc_128
# Disable it for now though #469976
#if ! use bindist ; then
# echo "__uint128_t i;" > "${T}"/128.c
# if ${CC} ${CFLAGS} -c "${T}"/128.c -o /dev/null >&/dev/null ; then
# ec_nistp_64_gcc_128="enable-ec_nistp_64_gcc_128"
# fi
#fi
# https://github.com/openssl/openssl/issues/2286
# if use ia64 ; then
# replace-flags -g3 -g2
# replace-flags -ggdb3 -ggdb2
# fi
local sslout=$(./gentoo.config)
einfo "Use configuration ${sslout:-(openssl knows best)}"
local config="Configure"
[[ -z ${sslout} ]] && config="config"
STDOPTIONS="--prefix=/usr/ --openssldir=/etc/ssl -DOPENSSL_USE_BUILD_DATE enable-zlib \
enable-ssl2 enable-ssl3 enable-ssl-trace enable-rc5 enable-rc2 \
enable-gost enable-cms enable-md2 enable-mdc2 enable-ec enable-ec2m enable-ecdh enable-ecdsa \
enable-seed enable-camellia enable-idea enable-rfc3779 experimental-jpake"
# Fedora hobbled-EC needs 'no-ec2m', 'no-srp'
echoit \
./${config} \
${sslout} \
$(use cpu_flags_x86_sse2 || echo "no-sse2") \
enable-camellia \
enable-ec \
$(use_ssl !bindist ec2m) \
$(use_ssl !bindist srp) \
${ec_nistp_64_gcc_128} \
enable-idea \
enable-mdc2 \
enable-rc5 \
enable-tlsext \
enable-cast \
enable-ripemd \
$(use_ssl asm) \
$(use_ssl gmp gmp -lgmp) \
$(use_ssl kerberos krb5 --with-krb5-flavor=${krb5}) \
$(use_ssl rfc3779) \
$(use_ssl sctp) \
$(use_ssl sslv2 ssl2) \
$(use_ssl sslv3 ssl3) \
$(use_ssl tls-heartbeat heartbeats) \
$(use_ssl zlib) \
--prefix="${EPREFIX}"/usr \
--openssldir="${EPREFIX}"${SSL_CNF_DIR} \
--libdir=$(get_libdir) \
-static threads $STDOPTIONS \
|| die
# Clean out hardcoded flags that openssl uses
local CFLAG=$(grep ^CFLAG= Makefile | LC_ALL=C sed \
-e 's:^CFLAG=::' \
-e 's:-fomit-frame-pointer ::g' \
-e 's:-O[0-9] ::g' \
-e 's:-march=[-a-z0-9]* ::g' \
-e 's:-mcpu=[-a-z0-9]* ::g' \
-e 's:-m[a-z0-9]* ::g' \
)
sed -i \
-e "/^CFLAG/s|=.*|=${CFLAG} ${CFLAGS}|" \
-e "/^SHARED_LDFLAGS=/s|$| ${LDFLAGS}|" \
Makefile || die
#why is this run in src_configure and src_compile?
emake -j1 depend
}
multilib_src_compile() {
# depend is needed to use $confopts; it also doesn't matter
# that it's -j1 as the code itself serializes subdirs
emake -j1 V=1 depend
emake all
# rehash is needed to prep the certs/ dir; do this
# separately to avoid parallel build issues.
#emake rehash
}
multilib_src_test() {
emake -j1 test
}
multilib_src_install() {
newbin apps/openssl openssl-bad
}

53
dev-libs/openssl-bad/openssl-bad-1.0.2_p20250104.ebuild
View file

@ -5,11 +5,21 @@ EAPI=8
inherit flag-o-matic toolchain-funcs multilib-minimal
# This patch set is based on the following files from Fedora 25,
# see https://src.fedoraproject.org/rpms/openssl/blob/25/f/openssl.spec
# for more details:
# - hobble-openssl (SOURCE1)
# - ec_curve.c (SOURCE12) -- MODIFIED
# - ectest.c (SOURCE13)
# - openssl-1.1.1-ec-curves.patch (PATCH37) -- MODIFIED
BINDIST_PATCH_SET="openssl-1.0.2t-bindist-1.0.tar.xz"
DESCRIPTION="full-strength general purpose cryptography library (including SSL and TLS)"
HOMEPAGE="https://github.com/testssl/openssl-1.0.2.bad"
MY_COMMIT="a9c866be14959b8b213a66ee47736be16db968fd"
SRC_URI="https://github.com/drwetter/openssl-1.0.2.bad/archive/${MY_COMMIT}.tar.gz -> ${P}.gh.tar.gz
mirror://gentoo/ec/openssl-compat-1.0.2u-versioned-symbols.patch.gz
mirror://gentoo/bb/${BINDIST_PATCH_SET}
"
S="${WORKDIR}/openssl-1.0.2.bad-${MY_COMMIT}"
@ -17,7 +27,7 @@ S="${WORKDIR}/openssl-1.0.2.bad-${MY_COMMIT}"
LICENSE="openssl"
SLOT="1.0.2"
KEYWORDS="~alpha amd64 arm arm64 hppa ~m68k ~ppc ppc64 ~riscv ~s390 sparc x86 ~x86-linux"
IUSE="+asm bindist gmp kerberos rfc3779 sctp cpu_flags_x86_sse2 sslv2 +sslv3 static-libs test +tls-heartbeat vanilla tls-compression"
IUSE="+asm bindist gmp +kerberos rfc3779 sctp cpu_flags_x86_sse2 +sslv2 +sslv3 static-libs test +tls-heartbeat vanilla tls-compression"
RESTRICT="!bindist? ( bindist )
test"
@ -37,14 +47,15 @@ BDEPEND="
app-alternatives/bc
)"
# Do not install any docs
DOCS=()
MULTILIB_WRAPPED_HEADERS=(
usr/include/openssl/opensslconf.h
)
src_prepare() {
# fix https://github.com/testssl/openssl-1.0.2.bad/issues/3
append-cflags -Wno-error=implicit-function-declaration -Wno-error=incompatible-pointer-types
#mv "${WORKDIR}"/openssl-compat-1.0.2u-versioned-symbols.patch "${WORKDIR}"/patch || die
if use bindist; then
@ -73,7 +84,7 @@ src_prepare() {
eapply "${FILESDIR}"/patch/*.patch
fi
# Fix https://github.com/testssl/openssl-1.0.2.bad/issues/3
eapply "${FILESDIR}"/4.patch
#eapply "${FILESDIR}"/4.patch
eapply_user
@ -95,7 +106,8 @@ src_prepare() {
# since we're forcing $(CC) as makedep anyway, just fix
# the conditional as always-on
# helps clang (#417795), and versioned gcc (#499818)
sed -i 's/expr.*MAKEDEPEND.*;/true;/' util/domd || die
# this breaks build with 1.0.2p, not sure if it is needed anymore
#sed -i 's/expr.*MAKEDEPEND.*;/true;/' util/domd || die
# quiet out unknown driver argument warnings since openssl
# doesn't have well-split CFLAGS and we're making it even worse
@ -110,7 +122,7 @@ src_prepare() {
append-flags $(test-flags-CC -Wa,--noexecstack)
append-cppflags -DOPENSSL_NO_BUF_FREELISTS
sed -i '1s,^:$,#!'${EPREFIX}'/usr/bin/perl,' Configure #141906
sed -i '1s,^:$,#!'"${EPREFIX}"'/usr/bin/perl,' Configure #141906
# The config script does stupid stuff to prompt the user. Kill it.
sed -i '/stty -icanon min 0 time 50; read waste/d' config || die
./config --test-sanity || die "I AM NOT SANE"
@ -154,6 +166,11 @@ multilib_src_configure() {
local config="Configure"
[[ -z ${sslout} ]] && config="config"
STDOPTIONS="--prefix=/usr/ --openssldir=/etc/ssl -DOPENSSL_USE_BUILD_DATE enable-zlib \
enable-ssl2 enable-ssl3 enable-ssl-trace enable-rc5 enable-rc2 \
enable-gost enable-cms enable-md2 enable-mdc2 enable-ec enable-ec2m enable-ecdh enable-ecdsa \
enable-seed enable-camellia enable-idea enable-rfc3779 experimental-jpake"
# Fedora hobbled-EC needs 'no-ec2m', 'no-srp'
# Make sure user flags don't get added *yet* to avoid duplicated
# flags.
@ -162,12 +179,16 @@ multilib_src_configure() {
${sslout} \
$(use cpu_flags_x86_sse2 || echo "no-sse2") \
enable-camellia \
$(use_ssl !bindist ec) \
enable-ec \
$(use_ssl !bindist ec2m) \
$(use_ssl !bindist srp) \
${ec_nistp_64_gcc_128} \
enable-idea \
enable-mdc2 \
enable-rc5 \
enable-tlsext \
enable-cast \
enable-ripemd \
$(use_ssl asm) \
$(use_ssl gmp gmp -lgmp) \
$(use_ssl kerberos krb5 --with-krb5-flavor=${krb5}) \
@ -175,16 +196,16 @@ multilib_src_configure() {
$(use_ssl sctp) \
$(use_ssl sslv2 ssl2) \
$(use_ssl sslv3 ssl3) \
$(use_ssl tls-heartbeat heartbeats) \
$(use_ssl tls-compression zlib) \
$(use_ssl tls-heartbeat heartbeats) \
--prefix="${EPREFIX}"/usr \
--openssldir="${EPREFIX}"${SSL_CNF_DIR} \
--libdir=$(get_libdir) \
shared threads \
-static threads $STDOPTIONS \
|| die
# Clean out hardcoded flags that openssl uses
local CFLAG=$(grep ^CFLAG= Makefile | LC_ALL=C sed \
local DEFAULT_CFLAGS=$(grep ^CFLAG= Makefile | LC_ALL=C sed \
-e 's:^CFLAG=::' \
-e 's:-fomit-frame-pointer ::g' \
-e 's:-O[0-9] ::g' \
@ -195,16 +216,22 @@ multilib_src_configure() {
# Now insert clean default flags with user flags
sed -i \
-e "/^CFLAG/s|=.*|=${CFLAG} ${CFLAGS}|" \
-e "/^CFLAG/s|=.*|=${DEFAULT_CFLAGS} ${CFLAGS}|" \
-e "/^SHARED_LDFLAGS=/s|$| ${LDFLAGS}|" \
Makefile || die
#why is this run in src_configure and src_compile?
emake -j1 depend
}
multilib_src_compile() {
# depend is needed to use $confopts; it also doesn't matter
# that it's -j1 as the code itself serializes subdirs
emake -j1 V=1 depend
emake build_libs
emake all
# rehash is needed to prep the certs/ dir; do this
# separately to avoid parallel build issues.
#emake rehash
}
multilib_src_test() {
@ -212,5 +239,5 @@ multilib_src_test() {
}
multilib_src_install() {
dolib.so lib{crypto,ssl}.so.${SLOT}
newbin apps/openssl openssl-bad
}

2
profiles/pentoo/base/package.use.force
View file

@ -1,4 +1,4 @@
net-misc/wget ssl
# dev-libs/openssl-bad doesn't build so force bundled
net-analyzer/testssl bundled-openssl
# net-analyzer/testssl bundled-openssl