From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id 5E0D359CA5 for ; Thu, 24 Mar 2016 00:30:57 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 472DDE07E8; Thu, 24 Mar 2016 00:30:53 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id A444EE07E8 for ; Thu, 24 Mar 2016 00:30:52 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id A6EF8340CD0 for ; Thu, 24 Mar 2016 00:30:50 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id D977885E for ; Thu, 24 Mar 2016 00:30:47 +0000 (UTC) From: "Marc Schiffbauer" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Marc Schiffbauer" Message-ID: <1458779073.56242b0f136e683c90c0fd1c704a39d1c2869366.mschiff@gentoo> Subject: [gentoo-commits] repo/gentoo:master commit in: net-dns/opendnssec/, net-dns/opendnssec/files/ X-VCS-Repository: repo/gentoo X-VCS-Files: net-dns/opendnssec/files/opendnssec-1.3.18-eppclient-curl-CVE-2012-5582.patch net-dns/opendnssec/opendnssec-1.3.18-r1.ebuild X-VCS-Directories: net-dns/opendnssec/files/ net-dns/opendnssec/ X-VCS-Committer: mschiff X-VCS-Committer-Name: Marc Schiffbauer X-VCS-Revision: 56242b0f136e683c90c0fd1c704a39d1c2869366 X-VCS-Branch: master Date: Thu, 24 Mar 2016 00:30:47 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: bddac85f-ca19-48b5-8e88-2f3895d59ca9 X-Archives-Hash: ddbfc2b80d004b27fe1ca18a70a64771 commit: 56242b0f136e683c90c0fd1c704a39d1c2869366 Author: Marc Schiffbauer gentoo org> AuthorDate: Wed Mar 23 23:29:50 2016 +0000 Commit: Marc Schiffbauer gentoo org> CommitDate: Thu Mar 24 00:24:33 2016 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=56242b0f net-dns/opendnssec: revbump 1.3.18-r1 to fix bug #445172 Package-Manager: portage-2.2.28 ...nssec-1.3.18-eppclient-curl-CVE-2012-5582.patch | 12 ++ net-dns/opendnssec/opendnssec-1.3.18-r1.ebuild | 204 +++++++++++++++++++++ 2 files changed, 216 insertions(+) diff --git a/net-dns/opendnssec/files/opendnssec-1.3.18-eppclient-curl-CVE-2012-5582.patch b/net-dns/opendnssec/files/opendnssec-1.3.18-eppclient-curl-CVE-2012-5582.patch new file mode 100644 index 0000000..a0676dd --- /dev/null +++ b/net-dns/opendnssec/files/opendnssec-1.3.18-eppclient-curl-CVE-2012-5582.patch @@ -0,0 +1,12 @@ +diff -urN opendnssec-1.3.18.orig/plugins/eppclient/src/epp.c opendnssec-1.3.18/plugins/eppclient/src/epp.c +--- opendnssec-1.3.18.orig/plugins/eppclient/src/epp.c 2014-07-21 11:16:10.000000000 +0200 ++++ opendnssec-1.3.18/plugins/eppclient/src/epp.c 2016-03-23 22:25:18.679354984 +0100 +@@ -390,7 +390,7 @@ + curl_easy_setopt(curl, CURLOPT_URL, url); + curl_easy_setopt(curl, CURLOPT_CONNECT_ONLY, 1L); + curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1L); +- curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 1L); ++ curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 2L); + curl_easy_setopt(curl, CURLOPT_USE_SSL, CURLUSESSL_ALL); + curl_easy_setopt(curl, CURLOPT_ERRORBUFFER, curlerr); + curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 1L); diff --git a/net-dns/opendnssec/opendnssec-1.3.18-r1.ebuild b/net-dns/opendnssec/opendnssec-1.3.18-r1.ebuild new file mode 100644 index 0000000..0f38b64 --- /dev/null +++ b/net-dns/opendnssec/opendnssec-1.3.18-r1.ebuild @@ -0,0 +1,204 @@ +# Copyright 1999-2016 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Id$ + +EAPI=5 + +MY_P="${P/_}" +PKCS11_IUSE="+softhsm opensc external-hsm" +inherit base autotools multilib user + +DESCRIPTION="An open-source turn-key solution for DNSSEC" +HOMEPAGE="http://www.opendnssec.org/" +SRC_URI="http://www.${PN}.org/files/source/${MY_P}.tar.gz" + +LICENSE="BSD GPL-2" +SLOT="0" +KEYWORDS="~amd64 ~x86" +IUSE="-auditor +curl debug doc eppclient mysql +signer +sqlite test ${PKCS11_IUSE}" + +RDEPEND=" + dev-lang/perl + dev-libs/libxml2 + dev-libs/libxslt + net-libs/ldns + curl? ( net-misc/curl ) + mysql? ( + virtual/mysql + dev-perl/DBD-mysql + ) + opensc? ( dev-libs/opensc ) + softhsm? ( dev-libs/softhsm ) + sqlite? ( + dev-db/sqlite:3 + dev-perl/DBD-SQLite + ) +" +DEPEND="${RDEPEND} + doc? ( app-doc/doxygen ) + test? ( + app-text/trang + ) +" +# test? dev-util/cunit # Requires running test DB + +REQUIRED_USE=" + ^^ ( mysql sqlite ) + ^^ ( softhsm opensc external-hsm ) + eppclient? ( curl ) +" + +PATCHES=( + "${FILESDIR}/${PN}-fix-localstatedir.patch" + "${FILESDIR}/${PN}-fix-run-dir.patch" + "${FILESDIR}/${PN}-1.3.14-drop-privileges.patch" + "${FILESDIR}/${PN}-1.3.14-use-system-trang.patch" + "${FILESDIR}/${PN}-1.3.18-eppclient-curl-CVE-2012-5582.patch" +) + +S="${WORKDIR}/${MY_P}" + +DOCS=( MIGRATION NEWS ) + +check_pkcs11_setup() { + # PKCS#11 HSM's are often only available with proprietary drivers not + # available in portage tree. + + if use softhsm; then + PKCS11_LIB=softhsm + if has_version ">=dev-libs/softhsm-1.3.1"; then + PKCS11_PATH=/usr/$(get_libdir)/softhsm/libsofthsm.so + else + PKCS11_PATH=/usr/$(get_libdir)/libsofthsm.so + fi + elog "Building with SoftHSM PKCS#11 library support." + fi + if use opensc; then + PKCS11_LIB=opensc + PKCS11_PATH=/usr/$(get_libdir)/opensc-pkcs11.so + elog "Building with OpenSC PKCS#11 library support." + fi + if use external-hsm; then + if [[ -n ${PKCS11_SCA6000} ]]; then + PKCS11_LIB=sca6000 + PKCS11_PATH=${PKCS11_SCA6000} + elif [[ -n ${PKCS11_ETOKEN} ]]; then + PKCS11_LIB=etoken + PKCS11_PATH=${PKCS11_ETOKEN} + elif [[ -n ${PKCS11_NCIPHER} ]]; then + PKCS11_LIB=ncipher + PKCS11_PATH=${PKCS11_NCIPHER} + elif [[ -n ${PKCS11_AEPKEYPER} ]]; then + PKCS11_LIB=aepkeyper + PKCS11_PATH=${PKCS11_AEPKEYPER} + else + ewarn "You enabled USE flag 'external-hsm' but did not specify a path to a PKCS#11" + ewarn "library. To set a path, set one of the following environment variables:" + ewarn " for Sun Crypto Accelerator 6000, set: PKCS11_SCA6000=" + ewarn " for Aladdin eToken, set: PKCS11_ETOKEN=" + ewarn " for Thales/nCipher netHSM, set: PKCS11_NCIPHER=" + ewarn " for AEP Keyper, set: PKCS11_AEPKEYPER=" + ewarn "Example:" + ewarn " PKCS11_ETOKEN=\"/opt/etoken/lib/libeTPkcs11.so\" emerge -pv opendnssec" + ewarn "or store the variable into /etc/make.conf" + die "USE flag 'external-hsm' set but no PKCS#11 library path specified." + fi + elog "Building with external PKCS#11 library support ($PKCS11_LIB): ${PKCS11_PATH}" + fi +} + +pkg_pretend() { + local i + + for i in eppclient mysql; do + if use ${i}; then + ewarn + ewarn "Usage of ${i} is considered experimental." + ewarn "Do not report bugs against this feature." + ewarn + fi + done + + check_pkcs11_setup +} + +pkg_setup() { + enewgroup opendnssec + enewuser opendnssec -1 -1 -1 opendnssec + + # pretend does not preserve variables so we need to run this once more + check_pkcs11_setup +} + +src_prepare() { + base_src_prepare + eautoreconf +} + +src_configure() { + # $(use_with test cunit "${EPREFIX}/usr/") \ + econf \ + --without-cunit \ + --localstatedir="${EPREFIX}/var/" \ + --disable-static \ + --with-database-backend=$(use mysql && echo "mysql")$(use sqlite && echo "sqlite3") \ + --with-pkcs11-${PKCS11_LIB}=${PKCS11_PATH} \ + --disable-auditor \ + $(use_with curl) \ + $(use_enable debug timeshift) \ + $(use_enable eppclient) \ + $(use_enable signer) +} + +src_compile() { + default + use doc && emake docs +} + +src_install() { + default + + # remove useless .la files + find "${ED}" -name '*.la' -delete + + # Remove subversion tags from config files to avoid useless config updates + sed -i \ + -e '/