* [gentoo-commits] repo/gentoo:master commit in: net-vpn/tor/, net-vpn/tor/files/
@ 2018-02-25 0:58 Anthony G. Basile
0 siblings, 0 replies; 5+ messages in thread
From: Anthony G. Basile @ 2018-02-25 0:58 UTC (permalink / raw
To: gentoo-commits
commit: c0fe6a0d4e379ce403f88e54f23d77695fe2cf05
Author: William Breathitt Gray <vilhelm.gray <AT> gmail <DOT> com>
AuthorDate: Sun Feb 25 00:26:52 2018 +0000
Commit: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Sun Feb 25 00:57:29 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c0fe6a0d
net-vpn/tor: Fix tor.service failure when /var/run is tmpfs
Closes: https://bugs.gentoo.org/640040
.../files/tor-0.3.3.2-alpha-tor.service.in.patch | 12 +++
net-vpn/tor/tor-0.3.3.2_alpha-r1.ebuild | 85 ++++++++++++++++++++++
2 files changed, 97 insertions(+)
diff --git a/net-vpn/tor/files/tor-0.3.3.2-alpha-tor.service.in.patch b/net-vpn/tor/files/tor-0.3.3.2-alpha-tor.service.in.patch
new file mode 100644
index 00000000000..76e88bbaba9
--- /dev/null
+++ b/net-vpn/tor/files/tor-0.3.3.2-alpha-tor.service.in.patch
@@ -0,0 +1,12 @@
+--- a/contrib/dist/tor.service.in 2017-11-11 13:40:46.000000000 -0500
++++ b/contrib/dist/tor.service.in 2018-02-24 19:06:12.307506884 -0500
+@@ -21,6 +21,9 @@
+ LimitNOFILE=32768
+
+ # Hardening
++Group=tor
++RuntimeDirectory=tor
++RuntimeDirectoryMode=0770
+ PrivateTmp=yes
+ PrivateDevices=yes
+ ProtectHome=yes
diff --git a/net-vpn/tor/tor-0.3.3.2_alpha-r1.ebuild b/net-vpn/tor/tor-0.3.3.2_alpha-r1.ebuild
new file mode 100644
index 00000000000..65525074136
--- /dev/null
+++ b/net-vpn/tor/tor-0.3.3.2_alpha-r1.ebuild
@@ -0,0 +1,85 @@
+# Copyright 1999-2018 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="6"
+
+inherit flag-o-matic readme.gentoo-r1 systemd versionator user
+
+MY_PV="$(replace_version_separator 4 -)"
+MY_PF="${PN}-${MY_PV}"
+DESCRIPTION="Anonymizing overlay network for TCP"
+HOMEPAGE="http://www.torproject.org/"
+SRC_URI="https://www.torproject.org/dist/${MY_PF}.tar.gz
+ https://archive.torproject.org/tor-package-archive/${MY_PF}.tar.gz"
+S="${WORKDIR}/${MY_PF}"
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+# We need to keyword app-arch/zstd
+#KEYWORDS="~amd64 ~arm ~mips ~ppc ~ppc64 ~sparc ~x86 ~ppc-macos"
+KEYWORDS="~amd64 ~arm ~mips ~ppc ~ppc64 ~x86 ~ppc-macos"
+IUSE="libressl lzma scrypt seccomp selinux systemd tor-hardening test web zstd"
+
+DEPEND="
+ app-text/asciidoc
+ dev-libs/libevent[ssl]
+ sys-libs/zlib
+ !libressl? ( dev-libs/openssl:0=[-bindist] )
+ libressl? ( dev-libs/libressl:0= )
+ lzma? ( app-arch/xz-utils )
+ scrypt? ( app-crypt/libscrypt )
+ seccomp? ( sys-libs/libseccomp )
+ systemd? ( sys-apps/systemd )
+ zstd? ( app-arch/zstd )"
+RDEPEND="${DEPEND}
+ selinux? ( sec-policy/selinux-tor )"
+
+PATCHES=(
+ "${FILESDIR}"/${PN}-0.2.7.4-torrc.sample.patch
+ "${FILESDIR}"/${PN}-0.3.3.2-alpha-tor.service.in.patch
+)
+
+DOCS=( README ChangeLog ReleaseNotes doc/HACKING )
+
+pkg_setup() {
+ enewgroup tor
+ enewuser tor -1 -1 /var/lib/tor tor
+}
+
+src_configure() {
+ econf \
+ --localstatedir="${EPREFIX}/var" \
+ --enable-system-torrc \
+ --enable-asciidoc \
+ --disable-android \
+ --disable-libfuzzer \
+ --disable-rust \
+ --disable-restart-debugging \
+ $(use_enable lzma) \
+ $(use_enable scrypt libscrypt) \
+ $(use_enable seccomp) \
+ $(use_enable systemd) \
+ $(use_enable tor-hardening gcc-hardening) \
+ $(use_enable tor-hardening linker-hardening) \
+ $(use_enable web tor2web-mode) \
+ $(use_enable test unittests) \
+ $(use_enable test coverage) \
+ $(use_enable zstd)
+}
+
+src_install() {
+ default
+ readme.gentoo_create_doc
+
+ newconfd "${FILESDIR}"/tor.confd tor
+ newinitd "${FILESDIR}"/tor.initd-r8 tor
+ systemd_dounit contrib/dist/tor.service
+
+ keepdir /var/lib/tor
+
+ fperms 750 /var/lib/tor
+ fowners tor:tor /var/lib/tor
+
+ insinto /etc/tor/
+ newins "${FILESDIR}"/torrc-r1 torrc
+}
^ permalink raw reply related [flat|nested] 5+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-vpn/tor/, net-vpn/tor/files/
@ 2020-11-09 17:48 Anthony G. Basile
0 siblings, 0 replies; 5+ messages in thread
From: Anthony G. Basile @ 2020-11-09 17:48 UTC (permalink / raw
To: gentoo-commits
commit: 1b7eeddf3e05517493bcef669af7abb18877cb4c
Author: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Mon Nov 9 17:47:40 2020 +0000
Commit: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Mon Nov 9 17:47:59 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=1b7eeddf
net-vpn/tor: add new alpha, version 0.4.5.1_alpha
Package-Manager: Portage-3.0.8, Repoman-3.0.2
Signed-off-by: Anthony G. Basile <blueness <AT> gentoo.org>
net-vpn/tor/Manifest | 1 +
net-vpn/tor/files/tor.service | 38 +++++++++++++++
net-vpn/tor/tor-0.4.5.1_alpha.ebuild | 92 ++++++++++++++++++++++++++++++++++++
3 files changed, 131 insertions(+)
diff --git a/net-vpn/tor/Manifest b/net-vpn/tor/Manifest
index 0fe711a7de4..d897b8ed930 100644
--- a/net-vpn/tor/Manifest
+++ b/net-vpn/tor/Manifest
@@ -1,2 +1,3 @@
DIST tor-0.4.3.6.tar.gz 7745954 BLAKE2B 3b04b2c79281483ef72421f8f5bfbc4f48358b6d38c151470eea7ea9bd2666e7098fe3fb0887d551f796443718791a3a464b007669c96e6bbcce7d7fc4c25d3a SHA512 f4ab0788d27b3eab40853dde31eaf087ac84616fc3488973e7d01f4dbd3e71ba6ce3a3afcf0c6272223897d0a9c1556aa26dbc4d9b98cc5b43dd729d20a2fcca
DIST tor-0.4.4.5.tar.gz 7808696 BLAKE2B b1c7342d5f1998b372529a8da1719a4f31c4e2516f9b666755b0edf29c7d66fa84a730fceed11e5c0bd1346f6fe06d7c96dd6a2161b0b2c3824468cd2f88f077 SHA512 8b7bedf998c66b33cb7b248ef33eb551dd75cca7eabf2133f716948d5bc83408d0be2ec1968e1c860b1067746b5645ea6e8f23478458b5eb2f5573ea7ecaecb7
+DIST tor-0.4.5.1-alpha.tar.gz 7901876 BLAKE2B 328e6ee53125a2b3242436e57cb8df7ad6a2b79a31357ce08de6d035b70ff31c64d3574fc6cae59ef3a321c6cfd06bf996df222c531eeff73f46c1bd30636664 SHA512 f68dfae2a682d8648197fc97c516da13fce359902dc6da934605b402d1f5154e1322f4a4e63ad73629a170cc600396eb8dea89b4223c1ffae236291d0de87ea7
diff --git a/net-vpn/tor/files/tor.service b/net-vpn/tor/files/tor.service
new file mode 100644
index 00000000000..16638240c54
--- /dev/null
+++ b/net-vpn/tor/files/tor.service
@@ -0,0 +1,38 @@
+# tor.service -- this systemd configuration file for Tor sets up a
+# relatively conservative, hardened Tor service. You may need to
+# edit it if you are making changes to your Tor configuration that it
+# does not allow. Package maintainers: this should be a starting point
+# for your tor.service; it is not the last point.
+
+[Unit]
+Description=Anonymizing overlay network for TCP
+After=syslog.target network.target nss-lookup.target
+
+[Service]
+Type=notify
+NotifyAccess=all
+ExecStartPre=/usr/bin/tor -f /etc/tor/torrc --verify-config
+ExecStart=/usr/bin/tor -f /etc/tor/torrc
+ExecReload=/bin/kill -HUP ${MAINPID}
+KillSignal=SIGINT
+TimeoutSec=60
+Restart=on-failure
+WatchdogSec=1m
+LimitNOFILE=32768
+
+# Hardening
+Group=tor
+RuntimeDirectory=tor
+RuntimeDirectoryMode=0770
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectHome=yes
+ProtectSystem=full
+ReadOnlyDirectories=/
+ReadWriteDirectories=-/var/lib/tor
+ReadWriteDirectories=-/var/log/tor
+NoNewPrivileges=yes
+CapabilityBoundingSet=CAP_SETUID CAP_SETGID CAP_NET_BIND_SERVICE
+
+[Install]
+WantedBy=multi-user.target
diff --git a/net-vpn/tor/tor-0.4.5.1_alpha.ebuild b/net-vpn/tor/tor-0.4.5.1_alpha.ebuild
new file mode 100644
index 00000000000..689cf47c9f8
--- /dev/null
+++ b/net-vpn/tor/tor-0.4.5.1_alpha.ebuild
@@ -0,0 +1,92 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+inherit flag-o-matic readme.gentoo-r1 systemd
+
+MY_PV="$(ver_rs 4 -)"
+MY_PF="${PN}-${MY_PV}"
+DESCRIPTION="Anonymizing overlay network for TCP"
+HOMEPAGE="http://www.torproject.org/"
+SRC_URI="https://www.torproject.org/dist/${MY_PF}.tar.gz
+ https://archive.torproject.org/tor-package-archive/${MY_PF}.tar.gz"
+S="${WORKDIR}/${MY_PF}"
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~mips ~ppc ~ppc64 ~x86 ~ppc-macos"
+IUSE="caps doc libressl lzma +man scrypt seccomp selinux +server systemd tor-hardening test zstd"
+
+DEPEND="
+ dev-libs/libevent:=[ssl]
+ sys-libs/zlib
+ caps? ( sys-libs/libcap )
+ man? ( app-text/asciidoc )
+ !libressl? ( dev-libs/openssl:0=[-bindist] )
+ libressl? ( dev-libs/libressl:0= )
+ lzma? ( app-arch/xz-utils )
+ scrypt? ( app-crypt/libscrypt )
+ seccomp? ( >=sys-libs/libseccomp-2.4.1 )
+ systemd? ( sys-apps/systemd )
+ zstd? ( app-arch/zstd )"
+RDEPEND="
+ acct-user/tor
+ acct-group/tor
+ ${DEPEND}
+ selinux? ( sec-policy/selinux-tor )"
+
+PATCHES=(
+ "${FILESDIR}"/${PN}-0.2.7.4-torrc.sample.patch
+)
+
+DOCS=()
+
+RESTRICT="!test? ( test )"
+
+src_configure() {
+ use doc && DOCS+=( README ChangeLog ReleaseNotes doc/HACKING )
+ export ac_cv_lib_cap_cap_init=$(usex caps)
+ econf \
+ --localstatedir="${EPREFIX}/var" \
+ --disable-all-bugs-are-fatal \
+ --enable-system-torrc \
+ --disable-android \
+ --disable-html-manual \
+ --disable-libfuzzer \
+ --enable-missing-doc-warnings \
+ --disable-module-dirauth \
+ --enable-pic \
+ --disable-rust \
+ --disable-restart-debugging \
+ --disable-zstd-advanced-apis \
+ $(use_enable man asciidoc) \
+ $(use_enable man manpage) \
+ $(use_enable lzma) \
+ $(use_enable scrypt libscrypt) \
+ $(use_enable seccomp) \
+ $(use_enable server module-relay) \
+ $(use_enable systemd) \
+ $(use_enable tor-hardening gcc-hardening) \
+ $(use_enable tor-hardening linker-hardening) \
+ $(use_enable test unittests) \
+ $(use_enable test coverage) \
+ $(use_enable zstd)
+}
+
+src_install() {
+ default
+ readme.gentoo_create_doc
+
+ newconfd "${FILESDIR}"/tor.confd tor
+ newinitd "${FILESDIR}"/tor.initd-r9 tor
+ systemd_dounit "${FILESDIR}"/tor.service
+
+ keepdir /var/lib/tor
+
+ fperms 750 /var/lib/tor
+ fowners tor:tor /var/lib/tor
+
+ insinto /etc/tor/
+ newins "${FILESDIR}"/torrc-r2 torrc
+}
^ permalink raw reply related [flat|nested] 5+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-vpn/tor/, net-vpn/tor/files/
@ 2022-12-16 5:11 Sam James
0 siblings, 0 replies; 5+ messages in thread
From: Sam James @ 2022-12-16 5:11 UTC (permalink / raw
To: gentoo-commits
commit: 3a9140bd748838d248b145584bdde02fee63a656
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Fri Dec 16 04:59:40 2022 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Fri Dec 16 04:59:40 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3a9140bd
net-vpn/tor: drop 0.4.7.10-r1
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-vpn/tor/Manifest | 3 -
.../tor-0.4.7.10-strict-prototypes-clang16.patch | 75 ------------
net-vpn/tor/tor-0.4.7.10-r1.ebuild | 127 ---------------------
3 files changed, 205 deletions(-)
diff --git a/net-vpn/tor/Manifest b/net-vpn/tor/Manifest
index 657df6be0175..655ae9d6c656 100644
--- a/net-vpn/tor/Manifest
+++ b/net-vpn/tor/Manifest
@@ -1,6 +1,3 @@
-DIST tor-0.4.7.10.tar.gz 7933376 BLAKE2B 46a9d932e7451bcc683e18d296d7a26bb4b544767cf4622910ebf90d82715718451ec3e0d6cd215eff5fe2cc3ae8441b8e6065c5877d7fc92c2f26ab5c7fa0cb SHA512 e82877807d9e73fe12ab424830641e52b9b45034ca06f07e37648f50a3c1c10cd1b07081d8646b8e92c58658bdff5f6e9670e5104e9d05a531b1d85d0851a606
-DIST tor-0.4.7.10.tar.gz.sha256sum 86 BLAKE2B 4b372b3508ffee497ecc9adab4a4d3d2b548100bb7dd54e1036c71004503d96148899096bbae807f2d626a5e26d0a947f7546df0a708a78b59b4d39bed3e849c SHA512 518b6e617702386df7a84155d528f1a904a45221c946402da3fc3d40170dcdac117bff38c92a2e58ef4dd8d422433950f3904d27da66a99d808204432732cc9b
-DIST tor-0.4.7.10.tar.gz.sha256sum.asc 1321 BLAKE2B fc7fd43115992e5d434cc1bf2808eeb971ead532935be7493b4eef7804a65cad3cf4f9fd18158a0c8f3e19bb9e55c5fe7487ded9adb6782cbc1583e1159aaf7c SHA512 789923b465e72a1a77b1b1951cd0f66c266c10119a480ce8b622f1f4aa07381b7403c27aca3badf51381da0b41498c9b0d42b2c5cedd6c54a617df9dc138689e
DIST tor-0.4.7.11.tar.gz 7983705 BLAKE2B 2d743e7d0aea63e76f6e24aa235792af8691fde419f56bbdf8c6ee865250a09ec06454ec84abac8ba47e3d61a363c937fc050376172d3ec6b0815998d1c8679e SHA512 318377916880310438aa9804d1ea0154c5416d6b13988c4ff7f2e65fd38c94e2cd6c53252fd76a4dcb488f452837468e19197bf5feee4020e3c1927a76ed2937
DIST tor-0.4.7.11.tar.gz.sha256sum 86 BLAKE2B 1e49ba88ae21af6589a9815603ee375cc0dc85fcd8dd5a5f52cd44659438874ae9d10b09b7f15cadd2c30d2e8012a27be4233dcb19195d4627f19a59ccf68d0b SHA512 cfdae54a70dc0d8eb0eaf8b8c9902a7dd8bc8d597a678d5a0bf431c3e09a8b56206b70b6f9207e3c06e1ba11913b25b81d7c269e49cde5f297ff7b165a3348a9
DIST tor-0.4.7.11.tar.gz.sha256sum.asc 716 BLAKE2B 2336ff3869b3a759626cd68c0c931dbdb6cf5b13e7a99e2dcc1c784e3832ba2f0314c1c2f3a9e5ccaba3f20d7aab9b9c918373194290769e358cbb5411323012 SHA512 b5e3c82378bc18268d6d4523787e12ece39246cc0f035fd1aedc50c2182d1ba3d2a8f8817a3dada2cd60acabb78f604f06ab347b92c6f42a82f260cc49285c2c
diff --git a/net-vpn/tor/files/tor-0.4.7.10-strict-prototypes-clang16.patch b/net-vpn/tor/files/tor-0.4.7.10-strict-prototypes-clang16.patch
deleted file mode 100644
index 9317b6b215b7..000000000000
--- a/net-vpn/tor/files/tor-0.4.7.10-strict-prototypes-clang16.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-https://gitlab.torproject.org/tpo/core/tor/-/commit/ee38514cc4372bfb7d01ee96a1110d600a30e061
-
-From ee38514cc4372bfb7d01ee96a1110d600a30e061 Mon Sep 17 00:00:00 2001
-From: Sam James <sam@gentoo.org>
-Date: Tue, 8 Nov 2022 06:42:59 +0000
-Subject: [PATCH] build: fix -Wstrict-prototypes (Clang 16)
-
-Clang 16 warns on -Wstrict-prototypes in preparation for C23 which can
-among other things, lead to some configure tests silently failing/returning the wrong result.
-
-Fixes this error:
-```
--ignoreme: warning: a function declaration without a prototype is deprecated in all versions of C [-Wstrict-prototypes]
-+ignoreme: error: a function declaration without a prototype is deprecated in all versions of C [-Werror,-Wstrict-prototypes]
- main ()
-```
-
-For more information, see LWN.net [0] or LLVM's Discourse [1], gentoo-dev@ [2],
-or the (new) c-std-porting mailing list [3].
-
-[0] https://lwn.net/Articles/913505/
-[1] https://discourse.llvm.org/t/configure-script-breakage-with-the-new-werror-implicit-function-declaration/65213
-[2] https://archives.gentoo.org/gentoo-dev/message/dd9f2d3082b8b6f8dfbccb0639e6e240
-[3] hosted at lists.linux.dev.
-
-Bug: https://bugs.gentoo.org/879747
-Signed-off-by: Sam James <sam@gentoo.org>
---- a/configure.ac
-+++ b/configure.ac
-@@ -1982,7 +1982,7 @@ AC_CACHE_CHECK([whether memset(0) sets pointers to NULL], tor_cv_null_is_zero,
- #ifdef HAVE_STDDEF_H
- #include <stddef.h>
- #endif
--int main () { char *p1,*p2; p1=NULL; memset(&p2,0,sizeof(p2));
-+int main (void) { char *p1,*p2; p1=NULL; memset(&p2,0,sizeof(p2));
- return memcmp(&p1,&p2,sizeof(char*))?1:0; }]])],
- [tor_cv_null_is_zero=yes],
- [tor_cv_null_is_zero=no],
-@@ -2006,7 +2006,7 @@ AC_CACHE_CHECK([whether memset(0) sets doubles to 0.0], tor_cv_dbl0_is_zero,
- #ifdef HAVE_STDDEF_H
- #include <stddef.h>
- #endif
--int main () { double d1,d2; d1=0; memset(&d2,0,sizeof(d2));
-+int main (void) { double d1,d2; d1=0; memset(&d2,0,sizeof(d2));
- return memcmp(&d1,&d2,sizeof(d1))?1:0; }]])],
- [tor_cv_dbl0_is_zero=yes],
- [tor_cv_dbl0_is_zero=no],
-@@ -2031,7 +2031,7 @@ AC_CACHE_CHECK([whether we can malloc(0) safely.], tor_cv_malloc_zero_works,
- #ifdef HAVE_STDDEF_H
- #include <stddef.h>
- #endif
--int main () { return malloc(0)?0:1; }]])],
-+int main (void) { return malloc(0)?0:1; }]])],
- [tor_cv_malloc_zero_works=yes],
- [tor_cv_malloc_zero_works=no],
- [tor_cv_malloc_zero_works=cross])])
-@@ -2049,7 +2049,7 @@ fi
- # whether we seem to be in a 2s-complement world.
- AC_CACHE_CHECK([whether we are using 2s-complement arithmetic], tor_cv_twos_complement,
- [AC_RUN_IFELSE([AC_LANG_SOURCE(
--[[int main () { int problem = ((-99) != (~99)+1);
-+[[int main (void) { int problem = ((-99) != (~99)+1);
- return problem ? 1 : 0; }]])],
- [tor_cv_twos_complement=yes],
- [tor_cv_twos_complement=no],
-@@ -2069,7 +2069,7 @@ fi
- # What does shifting a negative value do?
- AC_CACHE_CHECK([whether right-shift on negative values does sign-extension], tor_cv_sign_extend,
- [AC_RUN_IFELSE([AC_LANG_SOURCE(
--[[int main () { int okay = (-60 >> 8) == -1; return okay ? 0 : 1; }]])],
-+[[int main (void) { int okay = (-60 >> 8) == -1; return okay ? 0 : 1; }]])],
- [tor_cv_sign_extend=yes],
- [tor_cv_sign_extend=no],
- [tor_cv_sign_extend=cross])])
-GitLab
diff --git a/net-vpn/tor/tor-0.4.7.10-r1.ebuild b/net-vpn/tor/tor-0.4.7.10-r1.ebuild
deleted file mode 100644
index 219a9712b0bd..000000000000
--- a/net-vpn/tor/tor-0.4.7.10-r1.ebuild
+++ /dev/null
@@ -1,127 +0,0 @@
-# Copyright 1999-2022 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-
-PYTHON_COMPAT=( python3_{8..10} )
-inherit python-any-r1 readme.gentoo-r1 systemd verify-sig
-
-MY_PV="$(ver_rs 4 -)"
-MY_PF="${PN}-${MY_PV}"
-DESCRIPTION="Anonymizing overlay network for TCP"
-HOMEPAGE="https://www.torproject.org/"
-SRC_URI="https://www.torproject.org/dist/${MY_PF}.tar.gz
- https://archive.torproject.org/tor-package-archive/${MY_PF}.tar.gz
- verify-sig? (
- https://dist.torproject.org/${MY_PF}.tar.gz.sha256sum
- https://dist.torproject.org/${MY_PF}.tar.gz.sha256sum.asc
- )"
-S="${WORKDIR}/${MY_PF}"
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-if [[ ${PV} != *_alpha* && ${PV} != *_beta* && ${PV} != *_rc* ]]; then
- KEYWORDS="amd64 arm arm64 ~hppa ~mips ppc ppc64 ~riscv ~sparc x86 ~ppc-macos"
-fi
-IUSE="caps doc lzma +man scrypt seccomp selinux +server systemd tor-hardening test zstd"
-RESTRICT="!test? ( test )"
-
-VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/torproject.org.asc
-
-BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-tor-20220216 )"
-DEPEND="
- dev-libs/libevent:=[ssl]
- sys-libs/zlib
- caps? ( sys-libs/libcap )
- man? ( app-text/asciidoc )
- dev-libs/openssl:0=[-bindist(-)]
- lzma? ( app-arch/xz-utils )
- scrypt? ( app-crypt/libscrypt )
- seccomp? ( >=sys-libs/libseccomp-2.4.1 )
- systemd? ( sys-apps/systemd )
- zstd? ( app-arch/zstd )"
-RDEPEND="
- acct-user/tor
- acct-group/tor
- ${DEPEND}
- selinux? ( sec-policy/selinux-tor )"
-
-# bug #764260
-DEPEND+="
- test? (
- ${DEPEND}
- ${PYTHON_DEPS}
- )"
-
-DOCS=()
-
-PATCHES=(
- "${FILESDIR}"/${PN}-0.2.7.4-torrc.sample.patch
- "${FILESDIR}"/${P}-strict-prototypes-clang16.patch
-)
-
-# EAPI 8 tries to append it but it doesn't exist here
-# bug #831311 etc
-QA_CONFIGURE_OPTIONS="--disable-static"
-
-pkg_setup() {
- use test && python-any-r1_pkg_setup
-}
-
-src_unpack() {
- if use verify-sig; then
- cd "${DISTDIR}" || die
- verify-sig_verify_detached ${MY_PF}.tar.gz.sha256sum{,.asc}
- verify-sig_verify_unsigned_checksums \
- ${MY_PF}.tar.gz.sha256sum sha256 ${MY_PF}.tar.gz
- cd "${WORKDIR}" || die
- fi
-
- default
-}
-
-src_configure() {
- use doc && DOCS+=( README.md ChangeLog ReleaseNotes doc/HACKING )
- export ac_cv_lib_cap_cap_init=$(usex caps)
- econf \
- --localstatedir="${EPREFIX}/var" \
- --disable-all-bugs-are-fatal \
- --enable-system-torrc \
- --disable-android \
- --disable-html-manual \
- --disable-libfuzzer \
- --enable-missing-doc-warnings \
- --disable-module-dirauth \
- --enable-pic \
- --disable-restart-debugging \
- --disable-zstd-advanced-apis \
- $(use_enable man asciidoc) \
- $(use_enable man manpage) \
- $(use_enable lzma) \
- $(use_enable scrypt libscrypt) \
- $(use_enable seccomp) \
- $(use_enable server module-relay) \
- $(use_enable systemd) \
- $(use_enable tor-hardening gcc-hardening) \
- $(use_enable tor-hardening linker-hardening) \
- $(use_enable test unittests) \
- $(use_enable test coverage) \
- $(use_enable zstd)
-}
-
-src_install() {
- default
- readme.gentoo_create_doc
-
- newconfd "${FILESDIR}"/tor.confd tor
- newinitd "${FILESDIR}"/tor.initd-r9 tor
- systemd_dounit "${FILESDIR}"/tor.service
-
- keepdir /var/lib/tor
-
- fperms 750 /var/lib/tor
- fowners tor:tor /var/lib/tor
-
- insinto /etc/tor/
- newins "${FILESDIR}"/torrc-r2 torrc
-}
^ permalink raw reply related [flat|nested] 5+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-vpn/tor/, net-vpn/tor/files/
@ 2023-12-25 19:55 John Helmert III
0 siblings, 0 replies; 5+ messages in thread
From: John Helmert III @ 2023-12-25 19:55 UTC (permalink / raw
To: gentoo-commits
commit: ac63593feec203a38fccf1189ba0fe3e304f4f8b
Author: John Helmert III <ajak <AT> gentoo <DOT> org>
AuthorDate: Mon Dec 25 19:47:55 2023 +0000
Commit: John Helmert III <ajak <AT> gentoo <DOT> org>
CommitDate: Mon Dec 25 19:55:26 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ac63593f
net-vpn/tor: add 0.4.7.16-r1 for arm64 test patch
Closes: https://bugs.gentoo.org/920063
Signed-off-by: John Helmert III <ajak <AT> gentoo.org>
net-vpn/tor/files/tor-0.4.7.16-arm64-sandbox.patch | 337 +++++++++++++++++++++
net-vpn/tor/tor-0.4.7.16-r1.ebuild | 168 ++++++++++
2 files changed, 505 insertions(+)
diff --git a/net-vpn/tor/files/tor-0.4.7.16-arm64-sandbox.patch b/net-vpn/tor/files/tor-0.4.7.16-arm64-sandbox.patch
new file mode 100644
index 000000000000..2b473bf981b6
--- /dev/null
+++ b/net-vpn/tor/files/tor-0.4.7.16-arm64-sandbox.patch
@@ -0,0 +1,337 @@
+From https://gitlab.torproject.org/tpo/core/tor/-/merge_requests/574
+Gentoo Bug: https://bugs.gentoo.org/920063
+From: Pierre Bourdon <delroth@gmail.com>
+Date: Sat, 30 Apr 2022 11:52:59 +0200
+Subject: [PATCH 1/4] sandbox: fix openat filtering on AArch64
+
+New glibc versions not sign-extending 32 bit negative constants seems to
+not be a thing on AArch64. I suspect that this might not be the only
+architecture where the sign-extensions is happening, and the correct fix
+might be instead to use a proper 32 bit comparison for the first openat
+parameter. For now, band-aid fix this so the sandbox can work again on
+AArch64.
+--- a/src/lib/sandbox/sandbox.c
++++ b/src/lib/sandbox/sandbox.c
+@@ -518,7 +518,12 @@ libc_uses_openat_for_opendir(void)
+ static int
+ libc_negative_constant_needs_cast(void)
+ {
++#if defined(__aarch64__) && defined(__LP64__)
++ /* Existing glibc versions always sign-extend to 64 bits on AArch64. */
++ return 0;
++#else
+ return is_libc_at_least(2, 27);
++#endif
+ }
+
+ /** Allow a single file to be opened. If <b>use_openat</b> is true,
+--
+GitLab
+
+
+From 8fd13f7a7bfd4efc02d888ce9d10bcb6a80a03c8 Mon Sep 17 00:00:00 2001
+From: Pierre Bourdon <delroth@gmail.com>
+Date: Sat, 30 Apr 2022 13:02:16 +0200
+Subject: [PATCH 2/4] sandbox: filter {chown,chmod,rename} via their *at
+ variant on Aarch64
+
+The chown/chmod/rename syscalls have never existed on AArch64, and libc
+implements the POSIX functions via the fchownat/fchmodat/renameat
+syscalls instead.
+
+Add new filter functions for fchownat/fchmodat/renameat, not made
+architecture specific since the syscalls exists everywhere else too.
+However, in order to limit seccomp filter space usage, we only insert
+rules for one of {chown, chown32, fchownat} depending on the
+architecture (resp. {chmod, fchmodat}, {rename, renameat}).
+--- a/src/lib/sandbox/sandbox.c
++++ b/src/lib/sandbox/sandbox.c
+@@ -614,6 +614,32 @@ sb_chmod(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
+ return 0;
+ }
+
++static int
++sb_fchmodat(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
++{
++ int rc;
++ sandbox_cfg_t *elem = NULL;
++
++ // for each dynamic parameter filters
++ for (elem = filter; elem != NULL; elem = elem->next) {
++ smp_param_t *param = elem->param;
++
++ if (param != NULL && param->prot == 1 && param->syscall
++ == SCMP_SYS(fchmodat)) {
++ rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(fchmodat),
++ SCMP_CMP_NEG(0, SCMP_CMP_EQ, AT_FDCWD),
++ SCMP_CMP_STR(1, SCMP_CMP_EQ, param->value));
++ if (rc != 0) {
++ log_err(LD_BUG,"(Sandbox) failed to add fchmodat syscall, received "
++ "libseccomp error %d", rc);
++ return rc;
++ }
++ }
++ }
++
++ return 0;
++}
++
+ #ifdef __i386__
+ static int
+ sb_chown32(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
+@@ -666,6 +692,32 @@ sb_chown(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
+ }
+ #endif /* defined(__i386__) */
+
++static int
++sb_fchownat(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
++{
++ int rc;
++ sandbox_cfg_t *elem = NULL;
++
++ // for each dynamic parameter filters
++ for (elem = filter; elem != NULL; elem = elem->next) {
++ smp_param_t *param = elem->param;
++
++ if (param != NULL && param->prot == 1 && param->syscall
++ == SCMP_SYS(fchownat)) {
++ rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(fchownat),
++ SCMP_CMP_NEG(0, SCMP_CMP_EQ, AT_FDCWD),
++ SCMP_CMP_STR(1, SCMP_CMP_EQ, param->value));
++ if (rc != 0) {
++ log_err(LD_BUG,"(Sandbox) failed to add fchownat syscall, received "
++ "libseccomp error %d", rc);
++ return rc;
++ }
++ }
++ }
++
++ return 0;
++}
++
+ /**
+ * Function responsible for setting up the rename syscall for
+ * the seccomp filter sandbox.
+@@ -697,6 +749,39 @@ sb_rename(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
+ return 0;
+ }
+
++/**
++ * Function responsible for setting up the renameat syscall for
++ * the seccomp filter sandbox.
++ */
++static int
++sb_renameat(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
++{
++ int rc;
++ sandbox_cfg_t *elem = NULL;
++
++ // for each dynamic parameter filters
++ for (elem = filter; elem != NULL; elem = elem->next) {
++ smp_param_t *param = elem->param;
++
++ if (param != NULL && param->prot == 1 &&
++ param->syscall == SCMP_SYS(renameat)) {
++
++ rc = seccomp_rule_add_4(ctx, SCMP_ACT_ALLOW, SCMP_SYS(renameat),
++ SCMP_CMP_NEG(0, SCMP_CMP_EQ, AT_FDCWD),
++ SCMP_CMP_STR(1, SCMP_CMP_EQ, param->value),
++ SCMP_CMP_NEG(2, SCMP_CMP_EQ, AT_FDCWD),
++ SCMP_CMP_STR(3, SCMP_CMP_EQ, param->value2));
++ if (rc != 0) {
++ log_err(LD_BUG,"(Sandbox) failed to add renameat syscall, received "
++ "libseccomp error %d", rc);
++ return rc;
++ }
++ }
++ }
++
++ return 0;
++}
++
+ /**
+ * Function responsible for setting up the openat syscall for
+ * the seccomp filter sandbox.
+@@ -1317,7 +1402,9 @@ static sandbox_filter_func_t filter_func[] = {
+ #else
+ sb_chown,
+ #endif
++ sb_fchownat,
+ sb_chmod,
++ sb_fchmodat,
+ sb_open,
+ sb_openat,
+ sb_opendir,
+@@ -1325,6 +1412,7 @@ static sandbox_filter_func_t filter_func[] = {
+ sb_ptrace,
+ #endif
+ sb_rename,
++ sb_renameat,
+ #ifdef __NR_fcntl64
+ sb_fcntl64,
+ #endif
+@@ -1592,10 +1680,24 @@ new_element(int syscall, char *value)
+
+ #ifdef __i386__
+ #define SCMP_chown SCMP_SYS(chown32)
++#elif defined(__aarch64__) && defined(__LP64__)
++#define SCMP_chown SCMP_SYS(fchownat)
+ #else
+ #define SCMP_chown SCMP_SYS(chown)
+ #endif
+
++#if defined(__aarch64__) && defined(__LP64__)
++#define SCMP_chmod SCMP_SYS(fchmodat)
++#else
++#define SCMP_chmod SCMP_SYS(chmod)
++#endif
++
++#if defined(__aarch64__) && defined(__LP64__)
++#define SCMP_rename SCMP_SYS(renameat)
++#else
++#define SCMP_rename SCMP_SYS(rename)
++#endif
++
+ #ifdef __NR_stat64
+ #define SCMP_stat SCMP_SYS(stat64)
+ #else
+@@ -1633,7 +1735,7 @@ sandbox_cfg_allow_chmod_filename(sandbox_cfg_t **cfg, char *file)
+ {
+ sandbox_cfg_t *elem = NULL;
+
+- elem = new_element(SCMP_SYS(chmod), file);
++ elem = new_element(SCMP_chmod, file);
+
+ elem->next = *cfg;
+ *cfg = elem;
+@@ -1659,7 +1761,7 @@ sandbox_cfg_allow_rename(sandbox_cfg_t **cfg, char *file1, char *file2)
+ {
+ sandbox_cfg_t *elem = NULL;
+
+- elem = new_element2(SCMP_SYS(rename), file1, file2);
++ elem = new_element2(SCMP_rename, file1, file2);
+
+ elem->next = *cfg;
+ *cfg = elem;
+--
+GitLab
+
+
+From eb0749d64917fee6ff74c3810dbec8cd063f546c Mon Sep 17 00:00:00 2001
+From: Pierre Bourdon <delroth@gmail.com>
+Date: Wed, 4 May 2022 07:19:40 +0200
+Subject: [PATCH 3/4] sandbox: replace SCMP_CMP_NEG with masked equality checks
+
+For some syscalls the kernel ABI uses 32 bit signed integers. Whether
+these 32 bit integer values are sign extended or zero extended to the
+native 64 bit register sizes is undefined and dependent on the {arch,
+compiler, libc} being used. Instead of trying to detect which cases
+zero-extend and which cases sign-extend, this commit uses a masked
+equality check on the lower 32 bits of the value.
+--- a/src/lib/sandbox/sandbox.c
++++ b/src/lib/sandbox/sandbox.c
+@@ -141,10 +141,12 @@ static sandbox_cfg_t *filter_dynamic = NULL;
+ * the high bits of the value might get masked out improperly. */
+ #define SCMP_CMP_MASKED(a,b,c) \
+ SCMP_CMP4((a), SCMP_CMP_MASKED_EQ, ~(scmp_datum_t)(b), (c))
+-/* For negative constants, the rule to add depends on the glibc version. */
+-#define SCMP_CMP_NEG(a,op,b) (libc_negative_constant_needs_cast() ? \
+- (SCMP_CMP((a), (op), (unsigned int)(b))) : \
+- (SCMP_CMP_STR((a), (op), (b))))
++/* Negative constants aren't consistently sign extended or zero extended.
++ * Different compilers, libc, and architectures behave differently. For cases
++ * where the kernel ABI uses a 32 bit integer, this macro can be used to
++ * mask-compare only the lower 32 bits of the value. */
++#define SCMP_CMP_LOWER32_EQ(a,b) \
++ SCMP_CMP4((a), SCMP_CMP_MASKED_EQ, 0xFFFFFFFF, (unsigned int)(b))
+
+ /** Variable used for storing all syscall numbers that will be allowed with the
+ * stage 1 general Tor sandbox.
+@@ -513,19 +515,6 @@ libc_uses_openat_for_opendir(void)
+ (is_libc_at_least(2, 15) && !is_libc_at_least(2, 22));
+ }
+
+-/* Return true if we think we're running with a libc that needs to cast
+- * negative arguments like AT_FDCWD for seccomp rules. */
+-static int
+-libc_negative_constant_needs_cast(void)
+-{
+-#if defined(__aarch64__) && defined(__LP64__)
+- /* Existing glibc versions always sign-extend to 64 bits on AArch64. */
+- return 0;
+-#else
+- return is_libc_at_least(2, 27);
+-#endif
+-}
+-
+ /** Allow a single file to be opened. If <b>use_openat</b> is true,
+ * we're using a libc that remaps all the opens into openats. */
+ static int
+@@ -533,7 +522,7 @@ allow_file_open(scmp_filter_ctx ctx, int use_openat, const char *file)
+ {
+ if (use_openat) {
+ return seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(openat),
+- SCMP_CMP_NEG(0, SCMP_CMP_EQ, AT_FDCWD),
++ SCMP_CMP_LOWER32_EQ(0, AT_FDCWD),
+ SCMP_CMP_STR(1, SCMP_CMP_EQ, file));
+ } else {
+ return seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(open),
+@@ -627,7 +616,7 @@ sb_fchmodat(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
+ if (param != NULL && param->prot == 1 && param->syscall
+ == SCMP_SYS(fchmodat)) {
+ rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(fchmodat),
+- SCMP_CMP_NEG(0, SCMP_CMP_EQ, AT_FDCWD),
++ SCMP_CMP_LOWER32_EQ(0, AT_FDCWD),
+ SCMP_CMP_STR(1, SCMP_CMP_EQ, param->value));
+ if (rc != 0) {
+ log_err(LD_BUG,"(Sandbox) failed to add fchmodat syscall, received "
+@@ -705,7 +694,7 @@ sb_fchownat(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
+ if (param != NULL && param->prot == 1 && param->syscall
+ == SCMP_SYS(fchownat)) {
+ rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(fchownat),
+- SCMP_CMP_NEG(0, SCMP_CMP_EQ, AT_FDCWD),
++ SCMP_CMP_LOWER32_EQ(0, AT_FDCWD),
+ SCMP_CMP_STR(1, SCMP_CMP_EQ, param->value));
+ if (rc != 0) {
+ log_err(LD_BUG,"(Sandbox) failed to add fchownat syscall, received "
+@@ -767,9 +756,9 @@ sb_renameat(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
+ param->syscall == SCMP_SYS(renameat)) {
+
+ rc = seccomp_rule_add_4(ctx, SCMP_ACT_ALLOW, SCMP_SYS(renameat),
+- SCMP_CMP_NEG(0, SCMP_CMP_EQ, AT_FDCWD),
++ SCMP_CMP_LOWER32_EQ(0, AT_FDCWD),
+ SCMP_CMP_STR(1, SCMP_CMP_EQ, param->value),
+- SCMP_CMP_NEG(2, SCMP_CMP_EQ, AT_FDCWD),
++ SCMP_CMP_LOWER32_EQ(2, AT_FDCWD),
+ SCMP_CMP_STR(3, SCMP_CMP_EQ, param->value2));
+ if (rc != 0) {
+ log_err(LD_BUG,"(Sandbox) failed to add renameat syscall, received "
+@@ -799,7 +788,7 @@ sb_openat(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
+ if (param != NULL && param->prot == 1 && param->syscall
+ == SCMP_SYS(openat)) {
+ rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(openat),
+- SCMP_CMP_NEG(0, SCMP_CMP_EQ, AT_FDCWD),
++ SCMP_CMP_LOWER32_EQ(0, AT_FDCWD),
+ SCMP_CMP_STR(1, SCMP_CMP_EQ, param->value),
+ SCMP_CMP(2, SCMP_CMP_EQ, O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY|
+ O_CLOEXEC));
+--
+GitLab
+
+
+From 42034ae9da2866c67ce8cb8522d6a619d8b21170 Mon Sep 17 00:00:00 2001
+From: Pierre Bourdon <delroth@gmail.com>
+Date: Wed, 4 May 2022 07:31:06 +0200
+Subject: [PATCH 4/4] changes: add entry for MR !574
+
+--- /dev/null
++++ b/changes/aarch64_sandbox
+@@ -0,0 +1,5 @@
++ o Minor bugfixes (sandbox):
++ - Fix sandbox support on AArch64 systems. More "*at" variants of syscalls
++ are now supported. Signed 32 bit syscall parameters are checked more
++ precisely, which should lead to lower likelihood of breakages with future
++ compiler and libc releases. Fixes bug 40599; bugfix on 0.4.4.3-alpha.
+--
+GitLab
+
diff --git a/net-vpn/tor/tor-0.4.7.16-r1.ebuild b/net-vpn/tor/tor-0.4.7.16-r1.ebuild
new file mode 100644
index 000000000000..1c40fca5fb09
--- /dev/null
+++ b/net-vpn/tor/tor-0.4.7.16-r1.ebuild
@@ -0,0 +1,168 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..12} )
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/torproject.org.asc
+inherit edo python-any-r1 readme.gentoo-r1 systemd verify-sig
+
+MY_PV="$(ver_rs 4 -)"
+MY_PF="${PN}-${MY_PV}"
+DESCRIPTION="Anonymizing overlay network for TCP"
+HOMEPAGE="https://www.torproject.org/ https://gitlab.torproject.org/tpo/core/tor/"
+
+if [[ ${PV} == 9999 ]] ; then
+ EGIT_REPO_URI="https://gitlab.torproject.org/tpo/core/tor"
+ inherit autotools git-r3
+else
+ SRC_URI="
+ https://www.torproject.org/dist/${MY_PF}.tar.gz
+ https://archive.torproject.org/tor-package-archive/${MY_PF}.tar.gz
+ verify-sig? (
+ https://dist.torproject.org/${MY_PF}.tar.gz.sha256sum
+ https://dist.torproject.org/${MY_PF}.tar.gz.sha256sum.asc
+ )
+ "
+
+ S="${WORKDIR}/${MY_PF}"
+
+ if [[ ${PV} != *_alpha* && ${PV} != *_beta* && ${PV} != *_rc* ]]; then
+ KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86 ~ppc-macos"
+ fi
+
+ BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-tor-20230727 )"
+fi
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+IUSE="caps doc lzma +man scrypt seccomp selinux +server systemd tor-hardening test zstd"
+RESTRICT="!test? ( test )"
+
+DEPEND="
+ >=dev-libs/libevent-2.1.12-r1:=[ssl]
+ dev-libs/openssl:=[-bindist(-)]
+ sys-libs/zlib
+ caps? ( sys-libs/libcap )
+ man? ( app-text/asciidoc )
+ lzma? ( app-arch/xz-utils )
+ scrypt? ( app-crypt/libscrypt )
+ seccomp? ( >=sys-libs/libseccomp-2.4.1 )
+ systemd? ( sys-apps/systemd:= )
+ zstd? ( app-arch/zstd:= )
+"
+RDEPEND="
+ acct-user/tor
+ acct-group/tor
+ ${DEPEND}
+ selinux? ( sec-policy/selinux-tor )
+"
+DEPEND+="
+ test? (
+ ${DEPEND}
+ ${PYTHON_DEPS}
+ )
+"
+
+DOCS=()
+
+PATCHES=(
+ "${FILESDIR}"/${PN}-0.2.7.4-torrc.sample.patch
+ "${FILESDIR}"/${P}-arm64-sandbox.patch
+)
+
+pkg_setup() {
+ use test && python-any-r1_pkg_setup
+}
+
+src_unpack() {
+ if [[ ${PV} == 9999 ]] ; then
+ git-r3_src_unpack
+ else
+ if use verify-sig; then
+ cd "${DISTDIR}" || die
+ verify-sig_verify_detached ${MY_PF}.tar.gz.sha256sum{,.asc}
+ verify-sig_verify_unsigned_checksums \
+ ${MY_PF}.tar.gz.sha256sum sha256 ${MY_PF}.tar.gz
+ cd "${WORKDIR}" || die
+ fi
+
+ default
+ fi
+}
+
+src_prepare() {
+ default
+
+ # Running shellcheck automagically isn't useful for ebuild testing.
+ echo "exit 0" > scripts/maint/checkShellScripts.sh || die
+
+ if [[ ${PV} == 9999 ]] ; then
+ eautoreconf
+ fi
+}
+
+src_configure() {
+ use doc && DOCS+=( README.md ChangeLog ReleaseNotes doc/HACKING )
+
+ export ac_cv_lib_cap_cap_init=$(usex caps)
+ export tor_cv_PYTHON="${EPYTHON}"
+
+ local myeconfargs=(
+ --localstatedir="${EPREFIX}/var"
+ --disable-all-bugs-are-fatal
+ --enable-system-torrc
+ --disable-android
+ --disable-coverage
+ --disable-html-manual
+ --disable-libfuzzer
+ --enable-missing-doc-warnings
+ --disable-module-dirauth
+ --enable-pic
+ --disable-restart-debugging
+
+ $(use_enable man asciidoc)
+ $(use_enable man manpage)
+ $(use_enable lzma)
+ $(use_enable scrypt libscrypt)
+ $(use_enable seccomp)
+ $(use_enable server module-relay)
+ $(use_enable systemd)
+ $(use_enable tor-hardening gcc-hardening)
+ $(use_enable tor-hardening linker-hardening)
+ $(use_enable test unittests)
+ $(use_enable zstd)
+ )
+
+ econf "${myeconfargs[@]}"
+}
+
+src_test() {
+ local skip_tests=(
+ # Fails in sandbox
+ :sandbox/open_filename
+ :sandbox/openat_filename
+ )
+
+ # The makefile runs these by parallel by chunking them with a script
+ # but that means we lose verbosity and can't skip individual tests easily
+ # either.
+ edo ./src/test/test --verbose "${skip_tests[@]}"
+}
+
+src_install() {
+ default
+ readme.gentoo_create_doc
+
+ newconfd "${FILESDIR}"/tor.confd tor
+ newinitd "${FILESDIR}"/tor.initd-r9 tor
+ systemd_dounit "${FILESDIR}"/tor.service
+
+ keepdir /var/lib/tor
+
+ fperms 750 /var/lib/tor
+ fowners tor:tor /var/lib/tor
+
+ insinto /etc/tor/
+ newins "${FILESDIR}"/torrc-r2 torrc
+}
^ permalink raw reply related [flat|nested] 5+ messages in thread* [gentoo-commits] repo/gentoo:master commit in: net-vpn/tor/, net-vpn/tor/files/
@ 2024-07-17 5:54 Sam James
0 siblings, 0 replies; 5+ messages in thread
From: Sam James @ 2024-07-17 5:54 UTC (permalink / raw
To: gentoo-commits
commit: 7102d5944702889c29e3f0a08640c67255f075a4
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Wed Jul 17 05:26:15 2024 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Wed Jul 17 05:53:00 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7102d594
net-vpn/tor: drop 0.4.7.13-r1, 0.4.7.16, 0.4.7.16-r1, 0.4.8.10
Bug: https://bugs.gentoo.org/916759
Bug: https://bugs.gentoo.org/917142
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-vpn/tor/Manifest | 9 -
net-vpn/tor/files/tor-0.4.7.13-libressl.patch | 202 ------------
net-vpn/tor/files/tor-0.4.7.16-arm64-sandbox.patch | 337 ---------------------
net-vpn/tor/tor-0.4.7.13-r1.ebuild | 149 ---------
net-vpn/tor/tor-0.4.7.16-r1.ebuild | 180 -----------
net-vpn/tor/tor-0.4.7.16.ebuild | 167 ----------
net-vpn/tor/tor-0.4.8.10.ebuild | 189 ------------
7 files changed, 1233 deletions(-)
diff --git a/net-vpn/tor/Manifest b/net-vpn/tor/Manifest
index 06f3b10d8861..710454f24605 100644
--- a/net-vpn/tor/Manifest
+++ b/net-vpn/tor/Manifest
@@ -1,12 +1,3 @@
-DIST tor-0.4.7.13.tar.gz 8031948 BLAKE2B 338a0a541423f27f594a091307b5edeafc9826bb651c2bd050f3282c9355d9d43d1ef4791f3c98a37dc4c0f64bc40925ea1c1e32cbdff78b1a7308df501f279a SHA512 0900416887afbb24f7b72e6ef181b7b01308d1bb35c37736f3b13e06810a07febf9f47fadd9ff6c0e73204d93b49545e4e2516906eb3ba74398ad2b299f530be
-DIST tor-0.4.7.13.tar.gz.sha256sum 86 BLAKE2B 339db9869bfe485cbd328fe942cc23e60c08ad67fc2d9e7927ed3c9f3b606192e5efac34013c5bf0b0e8b26e957dcf8b586e1cc0a0c27756b8b3d823af37fdee SHA512 ec1d19fa662255df5dd575ba943f4ccb30d9dfa49ff656cdfa73df2d24248b52a3bfd715f4d3efe11d8129968b0e06e3c75e8d82416e1807020ebf65f65401a0
-DIST tor-0.4.7.13.tar.gz.sha256sum.asc 716 BLAKE2B 968a3852293ab9bcadac626862c9dc360b17de5afd00af7c46358fa2adfc03b55c02dfe029e9427efba999f553489a04388b395e8fb8fe16325e0895663c2deb SHA512 eb78e8369941d8de833e3616a9a1c1e59b0d3dde918353e2f4fa5eb5da09f038238c46f5e180844bd3cba1211a9daa6d60e9ddb5690998e27a6b7d1616aa20cc
-DIST tor-0.4.7.16.tar.gz 8120424 BLAKE2B 59b7cf6b69cf552caac09ab000732bf6fa6cd5a171f00e86bea5a89ba9ce548e404fa7adb25d3aebed9f500b15ae2ca5272b07f61921f19bc5bc71b3f42a88e6 SHA512 4b1e08f158369dfd51f72a45b67fccb42095980c674e94c7a917f44996783296544b15ec1cbb7506f78d2a1473679326a128501d4341bb0251966770cf6a3d1b
-DIST tor-0.4.7.16.tar.gz.sha256sum 86 BLAKE2B 8468b7728bb47ee1e27b2895f264f1fbbb4e21a20532da76bf7b5de139b7d1c5307a9016159ee834b4f696f156acfb6f252c95d094e62480ce36a7414815cc71 SHA512 858bb461c4d7a10b32aa4088c5e75eaa6527211314bfa02197578dfb8837cc263abe06ea565a352e6255eb0b1c7c1b80807713b1906f52c2bf883b6c945345d2
-DIST tor-0.4.7.16.tar.gz.sha256sum.asc 716 BLAKE2B 108bf2ba3c5678da0be72e6816b3ebe981d56733ddae00bcc79ecae050753580df3da2c2aef179310efc426e7caa5e6df991ac9e4b87d4a7aaa53556e00fb8ce SHA512 9595dbedef35fabdd0b19bf055329580326447cefd269c21c8e73c9f65f2f02ec70fdf3431255b4b3356d3d82175c8a5c99d0368bf733c63d87d81ca9f7ce4a3
-DIST tor-0.4.8.10.tar.gz 8272740 BLAKE2B ef470664d85e019f6cac2366e934d5dc31b8ae92f121a2b4c8c95f8267abce5ce4413d30a24affa40a069d587212364ae5a7c3cd114488e50a535f01c54c6e77 SHA512 3827902541a0289ed1bfcae9bb0ac8bf8dee7bedacbfdf9c703bb38c3c586d1cfe5eeb20a477664e10a2b81b90a7fd5d623e556f3ee32aad4f8a9f828bc4dd83
-DIST tor-0.4.8.10.tar.gz.sha256sum 86 BLAKE2B 1410a5e7e486c7c33b6b217a53d250bc3e1d76c87e74ad29f6c6a67cbdacb3627521cc8936f7e8e8d72c3333078cede222d13c825b8d66df7c1d50721043f89e SHA512 853a88b75ecd195e6b155361c8321b575c5fd526f5d73da8b5de99ac875b2f22f2b8668f7c9a68a8e599170290041533345fd324dd56a0102d5cd5ddf8020461
-DIST tor-0.4.8.10.tar.gz.sha256sum.asc 716 BLAKE2B 0154ef1defa1a8227813ef3589f1fd4215f5bd305447fec1404f7950c0b89e6d9fcb6686900e4819d0f1a635d3b08e60cdc9c96a4f74e603185afb6eb1e29279 SHA512 aaeee664c9342a6cddaacfeea6e6974ce374d746153a28943dee1db3db48a8e08f36a076856358819cae8ea2f8b7d912d0e6dc2dc772465dba3283b553f43b91
DIST tor-0.4.8.11.tar.gz 9690074 BLAKE2B b7f5bb855a6f8fe7dfd0e0efe7b48798e9d4642e401641c83554ed0f98fe238a5f303e9466e9e24a7ade63488a745b3c957ed6cc53a2f5e21f5f9c3f78f7fa78 SHA512 186fb690a751b4c0dda87afc741627a4c8c9b1a781b295dcf25b767c40c3b62664c08c63fc98f80095af76dfa1060b42e19936941528d091db50fafdce88be6e
DIST tor-0.4.8.11.tar.gz.sha256sum 86 BLAKE2B 062077991dc4ca70c457a7c1a70c815d288b5afcd54246a51dd86685454fb0cf52aa8e12974e7909ef2c0b8e764c369278113c5b7d84e866fad0a66bdff93ebc SHA512 061411e2e5695fec84fcade7cf8ed36e14d5ea3ccfab7b0d7abdb53a57ca1d3647f73f416e5cc55c0d11f8d5405bba1a972d0b8ed05e6e20d088de57eac027bf
DIST tor-0.4.8.11.tar.gz.sha256sum.asc 1321 BLAKE2B fbb12fbef8ef2c33a0a1c40eefb7b180e63f1d0c97ef15352e209a55decdcbfee3ed82be0ce28e95e47dc22f85602ff53008d585b15c82e2b669f39d987c106a SHA512 9f35e5a17293f4e5175fb617de913ad2622a695461d0f5fb78ad8b942c6af1e8d1de782e6bb06796ce7e8acb70c0c9c75ff6d6ac605defb73526c26dbe313546
diff --git a/net-vpn/tor/files/tor-0.4.7.13-libressl.patch b/net-vpn/tor/files/tor-0.4.7.13-libressl.patch
deleted file mode 100644
index bba0c45f3fc3..000000000000
--- a/net-vpn/tor/files/tor-0.4.7.13-libressl.patch
+++ /dev/null
@@ -1,202 +0,0 @@
-Upstream-MR: https://gitlab.torproject.org/tpo/core/tor/-/merge_requests/598
-Upstream-Commit: https://gitlab.torproject.org/tpo/core/tor/-/commit/da52d7206a4a8e4fa8b5e80b5ed73de50fbe8692
-Upstream-MR: https://gitlab.torproject.org/tpo/core/tor/-/merge_requests/713
-Upstream-Commit: https://gitlab.torproject.org/tpo/core/tor/-/commit/9850dc59c0db5cbcadc314be8d324a992880fce1
-
-From f3dabd705f26c56076934323f24b5b05ecdfd39c Mon Sep 17 00:00:00 2001
-From: "Alex Xu (Hello71)" <alex_y_xu@yahoo.ca>
-Date: Tue, 5 Jul 2022 11:37:30 -0400
-Subject: [PATCH 1/2] LibreSSL 3.5 compatibility
-
-LibreSSL is now closer to OpenSSL 1.1 than OpenSSL 1.0. According to
-https://undeadly.org/cgi?action=article;sid=20220116121253, this is the
-intention of OpenBSD developers.
-
-According to #40630, many special cases are needed to compile Tor against
-LibreSSL 3.5 when using Tor's OpenSSL 1.0 compatibility mode, whereas only a
-small number of #defines are required when using OpenSSL 1.1 compatibility
-mode. One additional workaround is required for LibreSSL 3.4 compatibility.
-
-Compiles and passes unit tests with LibreSSL 3.4.3 and 3.5.1.
----
- configure.ac | 2 +-
- src/lib/crypt_ops/compat_openssl.h | 22 +++++++++++++---------
- src/lib/crypt_ops/crypto_openssl_mgt.h | 3 +--
- src/lib/crypt_ops/crypto_rsa_openssl.c | 8 +++++---
- 4 files changed, 20 insertions(+), 15 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index 8baae007cf..6ab7903010 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -1022,7 +1022,7 @@ AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
- AC_MSG_CHECKING([for OpenSSL < 1.0.1])
- AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
- #include <openssl/opensslv.h>
--#if !defined(LIBRESSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER < 0x1000100fL
-+#if OPENSSL_VERSION_NUMBER < 0x1000100fL
- #error "too old"
- #endif
- ]], [[]])],
-diff --git a/src/lib/crypt_ops/compat_openssl.h b/src/lib/crypt_ops/compat_openssl.h
-index 0f56f338b5..c5eccdb015 100644
---- a/src/lib/crypt_ops/compat_openssl.h
-+++ b/src/lib/crypt_ops/compat_openssl.h
-@@ -20,32 +20,36 @@
- * \brief compatibility definitions for working with different openssl forks
- **/
-
--#if !defined(LIBRESSL_VERSION_NUMBER) && \
-- OPENSSL_VERSION_NUMBER < OPENSSL_V_SERIES(1,0,1)
-+#if OPENSSL_VERSION_NUMBER < OPENSSL_V_SERIES(1,0,1)
- #error "We require OpenSSL >= 1.0.1"
- #endif
-
--#if OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(1,1,0) && \
-- ! defined(LIBRESSL_VERSION_NUMBER)
-+#if OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(1,1,0)
- /* We define this macro if we're trying to build with the majorly refactored
- * API in OpenSSL 1.1 */
- #define OPENSSL_1_1_API
- #endif /* OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(1,1,0) && ... */
-
--#ifndef OPENSSL_1_1_API
--#define OpenSSL_version(v) SSLeay_version(v)
--#define tor_OpenSSL_version_num() SSLeay()
-+/* LibreSSL claims to be OpenSSL 2.0 but lacks these OpenSSL 1.1 APIs */
-+#if !defined(OPENSSL_1_1_API) || defined(LIBRESSL_VERSION_NUMBER)
- #define RAND_OpenSSL() RAND_SSLeay()
- #define STATE_IS_SW_SERVER_HELLO(st) \
- (((st) == SSL3_ST_SW_SRVR_HELLO_A) || \
- ((st) == SSL3_ST_SW_SRVR_HELLO_B))
- #define OSSL_HANDSHAKE_STATE int
- #define CONST_IF_OPENSSL_1_1_API
--#else /* defined(OPENSSL_1_1_API) */
--#define tor_OpenSSL_version_num() OpenSSL_version_num()
-+#else
- #define STATE_IS_SW_SERVER_HELLO(st) \
- ((st) == TLS_ST_SW_SRVR_HELLO)
- #define CONST_IF_OPENSSL_1_1_API const
-+#endif
-+
-+/* OpenSSL 1.1 and LibreSSL both have these APIs */
-+#ifndef OPENSSL_1_1_API
-+#define OpenSSL_version(v) SSLeay_version(v)
-+#define tor_OpenSSL_version_num() SSLeay()
-+#else /* defined(OPENSSL_1_1_API) */
-+#define tor_OpenSSL_version_num() OpenSSL_version_num()
- #endif /* !defined(OPENSSL_1_1_API) */
-
- #endif /* defined(ENABLE_OPENSSL) */
-diff --git a/src/lib/crypt_ops/crypto_openssl_mgt.h b/src/lib/crypt_ops/crypto_openssl_mgt.h
-index c6f63ffa08..96a37721dd 100644
---- a/src/lib/crypt_ops/crypto_openssl_mgt.h
-+++ b/src/lib/crypt_ops/crypto_openssl_mgt.h
-@@ -54,8 +54,7 @@
- #define DISABLE_ENGINES
- #endif
-
--#if OPENSSL_VERSION_NUMBER >= OPENSSL_VER(1,1,0,0,5) && \
-- !defined(LIBRESSL_VERSION_NUMBER)
-+#if OPENSSL_VERSION_NUMBER >= OPENSSL_VER(1,1,0,0,5)
- /* OpenSSL as of 1.1.0pre4 has an "new" thread API, which doesn't require
- * setting up various callbacks.
- *
-diff --git a/src/lib/crypt_ops/crypto_rsa_openssl.c b/src/lib/crypt_ops/crypto_rsa_openssl.c
-index a21c4a65cf..544d72e6ca 100644
---- a/src/lib/crypt_ops/crypto_rsa_openssl.c
-+++ b/src/lib/crypt_ops/crypto_rsa_openssl.c
-@@ -572,7 +572,9 @@ static bool
- rsa_private_key_too_long(RSA *rsa, int max_bits)
- {
- const BIGNUM *n, *e, *p, *q, *d, *dmp1, *dmq1, *iqmp;
--#ifdef OPENSSL_1_1_API
-+#if defined(OPENSSL_1_1_API) && \
-+ (!defined(LIBRESSL_VERSION_NUMBER) || \
-+ LIBRESSL_VERSION_NUMBER >= OPENSSL_V_SERIES(3,5,0))
-
- #if OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(1,1,1)
- n = RSA_get0_n(rsa);
-@@ -591,7 +593,7 @@ rsa_private_key_too_long(RSA *rsa, int max_bits)
-
- if (RSA_bits(rsa) > max_bits)
- return true;
--#else /* !defined(OPENSSL_1_1_API) */
-+#else /* !defined(OPENSSL_1_1_API) && ... */
- n = rsa->n;
- e = rsa->e;
- p = rsa->p;
-@@ -600,7 +602,7 @@ rsa_private_key_too_long(RSA *rsa, int max_bits)
- dmp1 = rsa->dmp1;
- dmq1 = rsa->dmq1;
- iqmp = rsa->iqmp;
--#endif /* defined(OPENSSL_1_1_API) */
-+#endif /* defined(OPENSSL_1_1_API) && ... */
-
- if (n && BN_num_bits(n) > max_bits)
- return true;
---
-GitLab
-
-
-From b1545b6d18fbef6c790e2731a814fa54230d8857 Mon Sep 17 00:00:00 2001
-From: "Alex Xu (Hello71)" <alex_y_xu@yahoo.ca>
-Date: Tue, 19 Jul 2022 16:18:29 -0400
-Subject: [PATCH 2/2] Changes file for #40630 (LibreSSL 3.5 compatibility)
-
----
- changes/issue40630 | 3 +++
- 1 file changed, 3 insertions(+)
- create mode 100644 changes/issue40630
-
-diff --git a/changes/issue40630 b/changes/issue40630
-new file mode 100644
-index 0000000000..faf04941b6
---- /dev/null
-+++ b/changes/issue40630
-@@ -0,0 +1,3 @@
-+ o Minor features (portability, compilation):
-+ - Use OpenSSL 1.1 APIs for LibreSSL, fixing LibreSSL 3.5 compatibility.
-+ Fixes issue 40630; patch by Alex Xu (Hello71).
---
-GitLab
-
-From 9850dc59c0db5cbcadc314be8d324a992880fce1 Mon Sep 17 00:00:00 2001
-From: orbea <orbea@riseup.net>
-Date: Mon, 29 May 2023 12:56:37 -0700
-Subject: [PATCH] tls: Disable a warning with LibreSSL >= 3.8.0
-
-Skip a warning using EC_GFp_nist_method() which was removed in LibreSSL
-3.8.
-
-Based on a patch from OpenBSD.
-
-https://github.com/openbsd/ports/commit/33fe251a08cb11f30ce6094a2e0759c3bb63ed16
-
-These functions are deprecated since OpenSSL 3.0.
-
-https://www.openssl.org/docs/man3.1/man3/EC_GFp_nist_method.html
----
- src/lib/tls/tortls_openssl.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/src/lib/tls/tortls_openssl.c b/src/lib/tls/tortls_openssl.c
-index 12260c09d3..c0a89ac272 100644
---- a/src/lib/tls/tortls_openssl.c
-+++ b/src/lib/tls/tortls_openssl.c
-@@ -340,8 +340,10 @@ tor_tls_init(void)
- SSL_load_error_strings();
- #endif /* defined(OPENSSL_1_1_API) */
-
--#if (SIZEOF_VOID_P >= 8 && \
-- OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(1,0,1))
-+#if (SIZEOF_VOID_P >= 8 && \
-+ OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(1,0,1) && \
-+ (!defined(LIBRESSL_VERSION_NUMBER) || \
-+ LIBRESSL_VERSION_NUMBER < 0x3080000fL))
- long version = tor_OpenSSL_version_num();
-
- /* LCOV_EXCL_START : we can't test these lines on the same machine */
---
-GitLab
-
diff --git a/net-vpn/tor/files/tor-0.4.7.16-arm64-sandbox.patch b/net-vpn/tor/files/tor-0.4.7.16-arm64-sandbox.patch
deleted file mode 100644
index 2b473bf981b6..000000000000
--- a/net-vpn/tor/files/tor-0.4.7.16-arm64-sandbox.patch
+++ /dev/null
@@ -1,337 +0,0 @@
-From https://gitlab.torproject.org/tpo/core/tor/-/merge_requests/574
-Gentoo Bug: https://bugs.gentoo.org/920063
-From: Pierre Bourdon <delroth@gmail.com>
-Date: Sat, 30 Apr 2022 11:52:59 +0200
-Subject: [PATCH 1/4] sandbox: fix openat filtering on AArch64
-
-New glibc versions not sign-extending 32 bit negative constants seems to
-not be a thing on AArch64. I suspect that this might not be the only
-architecture where the sign-extensions is happening, and the correct fix
-might be instead to use a proper 32 bit comparison for the first openat
-parameter. For now, band-aid fix this so the sandbox can work again on
-AArch64.
---- a/src/lib/sandbox/sandbox.c
-+++ b/src/lib/sandbox/sandbox.c
-@@ -518,7 +518,12 @@ libc_uses_openat_for_opendir(void)
- static int
- libc_negative_constant_needs_cast(void)
- {
-+#if defined(__aarch64__) && defined(__LP64__)
-+ /* Existing glibc versions always sign-extend to 64 bits on AArch64. */
-+ return 0;
-+#else
- return is_libc_at_least(2, 27);
-+#endif
- }
-
- /** Allow a single file to be opened. If <b>use_openat</b> is true,
---
-GitLab
-
-
-From 8fd13f7a7bfd4efc02d888ce9d10bcb6a80a03c8 Mon Sep 17 00:00:00 2001
-From: Pierre Bourdon <delroth@gmail.com>
-Date: Sat, 30 Apr 2022 13:02:16 +0200
-Subject: [PATCH 2/4] sandbox: filter {chown,chmod,rename} via their *at
- variant on Aarch64
-
-The chown/chmod/rename syscalls have never existed on AArch64, and libc
-implements the POSIX functions via the fchownat/fchmodat/renameat
-syscalls instead.
-
-Add new filter functions for fchownat/fchmodat/renameat, not made
-architecture specific since the syscalls exists everywhere else too.
-However, in order to limit seccomp filter space usage, we only insert
-rules for one of {chown, chown32, fchownat} depending on the
-architecture (resp. {chmod, fchmodat}, {rename, renameat}).
---- a/src/lib/sandbox/sandbox.c
-+++ b/src/lib/sandbox/sandbox.c
-@@ -614,6 +614,32 @@ sb_chmod(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
- return 0;
- }
-
-+static int
-+sb_fchmodat(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
-+{
-+ int rc;
-+ sandbox_cfg_t *elem = NULL;
-+
-+ // for each dynamic parameter filters
-+ for (elem = filter; elem != NULL; elem = elem->next) {
-+ smp_param_t *param = elem->param;
-+
-+ if (param != NULL && param->prot == 1 && param->syscall
-+ == SCMP_SYS(fchmodat)) {
-+ rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(fchmodat),
-+ SCMP_CMP_NEG(0, SCMP_CMP_EQ, AT_FDCWD),
-+ SCMP_CMP_STR(1, SCMP_CMP_EQ, param->value));
-+ if (rc != 0) {
-+ log_err(LD_BUG,"(Sandbox) failed to add fchmodat syscall, received "
-+ "libseccomp error %d", rc);
-+ return rc;
-+ }
-+ }
-+ }
-+
-+ return 0;
-+}
-+
- #ifdef __i386__
- static int
- sb_chown32(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
-@@ -666,6 +692,32 @@ sb_chown(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
- }
- #endif /* defined(__i386__) */
-
-+static int
-+sb_fchownat(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
-+{
-+ int rc;
-+ sandbox_cfg_t *elem = NULL;
-+
-+ // for each dynamic parameter filters
-+ for (elem = filter; elem != NULL; elem = elem->next) {
-+ smp_param_t *param = elem->param;
-+
-+ if (param != NULL && param->prot == 1 && param->syscall
-+ == SCMP_SYS(fchownat)) {
-+ rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(fchownat),
-+ SCMP_CMP_NEG(0, SCMP_CMP_EQ, AT_FDCWD),
-+ SCMP_CMP_STR(1, SCMP_CMP_EQ, param->value));
-+ if (rc != 0) {
-+ log_err(LD_BUG,"(Sandbox) failed to add fchownat syscall, received "
-+ "libseccomp error %d", rc);
-+ return rc;
-+ }
-+ }
-+ }
-+
-+ return 0;
-+}
-+
- /**
- * Function responsible for setting up the rename syscall for
- * the seccomp filter sandbox.
-@@ -697,6 +749,39 @@ sb_rename(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
- return 0;
- }
-
-+/**
-+ * Function responsible for setting up the renameat syscall for
-+ * the seccomp filter sandbox.
-+ */
-+static int
-+sb_renameat(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
-+{
-+ int rc;
-+ sandbox_cfg_t *elem = NULL;
-+
-+ // for each dynamic parameter filters
-+ for (elem = filter; elem != NULL; elem = elem->next) {
-+ smp_param_t *param = elem->param;
-+
-+ if (param != NULL && param->prot == 1 &&
-+ param->syscall == SCMP_SYS(renameat)) {
-+
-+ rc = seccomp_rule_add_4(ctx, SCMP_ACT_ALLOW, SCMP_SYS(renameat),
-+ SCMP_CMP_NEG(0, SCMP_CMP_EQ, AT_FDCWD),
-+ SCMP_CMP_STR(1, SCMP_CMP_EQ, param->value),
-+ SCMP_CMP_NEG(2, SCMP_CMP_EQ, AT_FDCWD),
-+ SCMP_CMP_STR(3, SCMP_CMP_EQ, param->value2));
-+ if (rc != 0) {
-+ log_err(LD_BUG,"(Sandbox) failed to add renameat syscall, received "
-+ "libseccomp error %d", rc);
-+ return rc;
-+ }
-+ }
-+ }
-+
-+ return 0;
-+}
-+
- /**
- * Function responsible for setting up the openat syscall for
- * the seccomp filter sandbox.
-@@ -1317,7 +1402,9 @@ static sandbox_filter_func_t filter_func[] = {
- #else
- sb_chown,
- #endif
-+ sb_fchownat,
- sb_chmod,
-+ sb_fchmodat,
- sb_open,
- sb_openat,
- sb_opendir,
-@@ -1325,6 +1412,7 @@ static sandbox_filter_func_t filter_func[] = {
- sb_ptrace,
- #endif
- sb_rename,
-+ sb_renameat,
- #ifdef __NR_fcntl64
- sb_fcntl64,
- #endif
-@@ -1592,10 +1680,24 @@ new_element(int syscall, char *value)
-
- #ifdef __i386__
- #define SCMP_chown SCMP_SYS(chown32)
-+#elif defined(__aarch64__) && defined(__LP64__)
-+#define SCMP_chown SCMP_SYS(fchownat)
- #else
- #define SCMP_chown SCMP_SYS(chown)
- #endif
-
-+#if defined(__aarch64__) && defined(__LP64__)
-+#define SCMP_chmod SCMP_SYS(fchmodat)
-+#else
-+#define SCMP_chmod SCMP_SYS(chmod)
-+#endif
-+
-+#if defined(__aarch64__) && defined(__LP64__)
-+#define SCMP_rename SCMP_SYS(renameat)
-+#else
-+#define SCMP_rename SCMP_SYS(rename)
-+#endif
-+
- #ifdef __NR_stat64
- #define SCMP_stat SCMP_SYS(stat64)
- #else
-@@ -1633,7 +1735,7 @@ sandbox_cfg_allow_chmod_filename(sandbox_cfg_t **cfg, char *file)
- {
- sandbox_cfg_t *elem = NULL;
-
-- elem = new_element(SCMP_SYS(chmod), file);
-+ elem = new_element(SCMP_chmod, file);
-
- elem->next = *cfg;
- *cfg = elem;
-@@ -1659,7 +1761,7 @@ sandbox_cfg_allow_rename(sandbox_cfg_t **cfg, char *file1, char *file2)
- {
- sandbox_cfg_t *elem = NULL;
-
-- elem = new_element2(SCMP_SYS(rename), file1, file2);
-+ elem = new_element2(SCMP_rename, file1, file2);
-
- elem->next = *cfg;
- *cfg = elem;
---
-GitLab
-
-
-From eb0749d64917fee6ff74c3810dbec8cd063f546c Mon Sep 17 00:00:00 2001
-From: Pierre Bourdon <delroth@gmail.com>
-Date: Wed, 4 May 2022 07:19:40 +0200
-Subject: [PATCH 3/4] sandbox: replace SCMP_CMP_NEG with masked equality checks
-
-For some syscalls the kernel ABI uses 32 bit signed integers. Whether
-these 32 bit integer values are sign extended or zero extended to the
-native 64 bit register sizes is undefined and dependent on the {arch,
-compiler, libc} being used. Instead of trying to detect which cases
-zero-extend and which cases sign-extend, this commit uses a masked
-equality check on the lower 32 bits of the value.
---- a/src/lib/sandbox/sandbox.c
-+++ b/src/lib/sandbox/sandbox.c
-@@ -141,10 +141,12 @@ static sandbox_cfg_t *filter_dynamic = NULL;
- * the high bits of the value might get masked out improperly. */
- #define SCMP_CMP_MASKED(a,b,c) \
- SCMP_CMP4((a), SCMP_CMP_MASKED_EQ, ~(scmp_datum_t)(b), (c))
--/* For negative constants, the rule to add depends on the glibc version. */
--#define SCMP_CMP_NEG(a,op,b) (libc_negative_constant_needs_cast() ? \
-- (SCMP_CMP((a), (op), (unsigned int)(b))) : \
-- (SCMP_CMP_STR((a), (op), (b))))
-+/* Negative constants aren't consistently sign extended or zero extended.
-+ * Different compilers, libc, and architectures behave differently. For cases
-+ * where the kernel ABI uses a 32 bit integer, this macro can be used to
-+ * mask-compare only the lower 32 bits of the value. */
-+#define SCMP_CMP_LOWER32_EQ(a,b) \
-+ SCMP_CMP4((a), SCMP_CMP_MASKED_EQ, 0xFFFFFFFF, (unsigned int)(b))
-
- /** Variable used for storing all syscall numbers that will be allowed with the
- * stage 1 general Tor sandbox.
-@@ -513,19 +515,6 @@ libc_uses_openat_for_opendir(void)
- (is_libc_at_least(2, 15) && !is_libc_at_least(2, 22));
- }
-
--/* Return true if we think we're running with a libc that needs to cast
-- * negative arguments like AT_FDCWD for seccomp rules. */
--static int
--libc_negative_constant_needs_cast(void)
--{
--#if defined(__aarch64__) && defined(__LP64__)
-- /* Existing glibc versions always sign-extend to 64 bits on AArch64. */
-- return 0;
--#else
-- return is_libc_at_least(2, 27);
--#endif
--}
--
- /** Allow a single file to be opened. If <b>use_openat</b> is true,
- * we're using a libc that remaps all the opens into openats. */
- static int
-@@ -533,7 +522,7 @@ allow_file_open(scmp_filter_ctx ctx, int use_openat, const char *file)
- {
- if (use_openat) {
- return seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(openat),
-- SCMP_CMP_NEG(0, SCMP_CMP_EQ, AT_FDCWD),
-+ SCMP_CMP_LOWER32_EQ(0, AT_FDCWD),
- SCMP_CMP_STR(1, SCMP_CMP_EQ, file));
- } else {
- return seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(open),
-@@ -627,7 +616,7 @@ sb_fchmodat(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
- if (param != NULL && param->prot == 1 && param->syscall
- == SCMP_SYS(fchmodat)) {
- rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(fchmodat),
-- SCMP_CMP_NEG(0, SCMP_CMP_EQ, AT_FDCWD),
-+ SCMP_CMP_LOWER32_EQ(0, AT_FDCWD),
- SCMP_CMP_STR(1, SCMP_CMP_EQ, param->value));
- if (rc != 0) {
- log_err(LD_BUG,"(Sandbox) failed to add fchmodat syscall, received "
-@@ -705,7 +694,7 @@ sb_fchownat(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
- if (param != NULL && param->prot == 1 && param->syscall
- == SCMP_SYS(fchownat)) {
- rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(fchownat),
-- SCMP_CMP_NEG(0, SCMP_CMP_EQ, AT_FDCWD),
-+ SCMP_CMP_LOWER32_EQ(0, AT_FDCWD),
- SCMP_CMP_STR(1, SCMP_CMP_EQ, param->value));
- if (rc != 0) {
- log_err(LD_BUG,"(Sandbox) failed to add fchownat syscall, received "
-@@ -767,9 +756,9 @@ sb_renameat(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
- param->syscall == SCMP_SYS(renameat)) {
-
- rc = seccomp_rule_add_4(ctx, SCMP_ACT_ALLOW, SCMP_SYS(renameat),
-- SCMP_CMP_NEG(0, SCMP_CMP_EQ, AT_FDCWD),
-+ SCMP_CMP_LOWER32_EQ(0, AT_FDCWD),
- SCMP_CMP_STR(1, SCMP_CMP_EQ, param->value),
-- SCMP_CMP_NEG(2, SCMP_CMP_EQ, AT_FDCWD),
-+ SCMP_CMP_LOWER32_EQ(2, AT_FDCWD),
- SCMP_CMP_STR(3, SCMP_CMP_EQ, param->value2));
- if (rc != 0) {
- log_err(LD_BUG,"(Sandbox) failed to add renameat syscall, received "
-@@ -799,7 +788,7 @@ sb_openat(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
- if (param != NULL && param->prot == 1 && param->syscall
- == SCMP_SYS(openat)) {
- rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(openat),
-- SCMP_CMP_NEG(0, SCMP_CMP_EQ, AT_FDCWD),
-+ SCMP_CMP_LOWER32_EQ(0, AT_FDCWD),
- SCMP_CMP_STR(1, SCMP_CMP_EQ, param->value),
- SCMP_CMP(2, SCMP_CMP_EQ, O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY|
- O_CLOEXEC));
---
-GitLab
-
-
-From 42034ae9da2866c67ce8cb8522d6a619d8b21170 Mon Sep 17 00:00:00 2001
-From: Pierre Bourdon <delroth@gmail.com>
-Date: Wed, 4 May 2022 07:31:06 +0200
-Subject: [PATCH 4/4] changes: add entry for MR !574
-
---- /dev/null
-+++ b/changes/aarch64_sandbox
-@@ -0,0 +1,5 @@
-+ o Minor bugfixes (sandbox):
-+ - Fix sandbox support on AArch64 systems. More "*at" variants of syscalls
-+ are now supported. Signed 32 bit syscall parameters are checked more
-+ precisely, which should lead to lower likelihood of breakages with future
-+ compiler and libc releases. Fixes bug 40599; bugfix on 0.4.4.3-alpha.
---
-GitLab
-
diff --git a/net-vpn/tor/tor-0.4.7.13-r1.ebuild b/net-vpn/tor/tor-0.4.7.13-r1.ebuild
deleted file mode 100644
index 8603bc87a710..000000000000
--- a/net-vpn/tor/tor-0.4.7.13-r1.ebuild
+++ /dev/null
@@ -1,149 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-PYTHON_COMPAT=( python3_{10..12} )
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/torproject.org.asc
-inherit autotools python-any-r1 readme.gentoo-r1 systemd verify-sig
-
-MY_PV="$(ver_rs 4 -)"
-MY_PF="${PN}-${MY_PV}"
-DESCRIPTION="Anonymizing overlay network for TCP"
-HOMEPAGE="https://www.torproject.org/ https://gitlab.torproject.org/tpo/core/tor/"
-SRC_URI="
- https://www.torproject.org/dist/${MY_PF}.tar.gz
- https://archive.torproject.org/tor-package-archive/${MY_PF}.tar.gz
- verify-sig? (
- https://dist.torproject.org/${MY_PF}.tar.gz.sha256sum
- https://dist.torproject.org/${MY_PF}.tar.gz.sha256sum.asc
- )
-"
-S="${WORKDIR}/${MY_PF}"
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-if [[ ${PV} != *_alpha* && ${PV} != *_beta* && ${PV} != *_rc* ]]; then
- KEYWORDS="amd64 arm arm64 ~hppa ~mips ppc ppc64 ~riscv ~sparc x86 ~ppc-macos"
-fi
-IUSE="caps doc lzma +man scrypt seccomp selinux +server systemd tor-hardening test zstd"
-RESTRICT="!test? ( test )"
-
-DEPEND="
- >=dev-libs/libevent-2.1.12-r1:=[ssl]
- sys-libs/zlib
- caps? ( sys-libs/libcap )
- man? ( app-text/asciidoc )
- dev-libs/openssl:=[-bindist(-)]
- lzma? ( app-arch/xz-utils )
- scrypt? ( app-crypt/libscrypt )
- seccomp? ( >=sys-libs/libseccomp-2.4.1 )
- systemd? ( sys-apps/systemd )
- zstd? ( app-arch/zstd )
-"
-RDEPEND="
- acct-user/tor
- acct-group/tor
- ${DEPEND}
- selinux? ( sec-policy/selinux-tor )
-"
-DEPEND+="
- test? (
- ${DEPEND}
- ${PYTHON_DEPS}
- )
-"
-BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-tor-20221213 )"
-
-DOCS=()
-
-PATCHES=(
- "${FILESDIR}"/${PN}-0.2.7.4-torrc.sample.patch
- "${FILESDIR}"/${PN}-0.4.7.13-libressl.patch
-)
-
-pkg_setup() {
- use test && python-any-r1_pkg_setup
-}
-
-src_unpack() {
- if use verify-sig; then
- cd "${DISTDIR}" || die
- verify-sig_verify_detached ${MY_PF}.tar.gz.sha256sum{,.asc}
- verify-sig_verify_unsigned_checksums \
- ${MY_PF}.tar.gz.sha256sum sha256 ${MY_PF}.tar.gz
- cd "${WORKDIR}" || die
- fi
-
- default
-}
-
-src_prepare() {
- default
-
- # Running shellcheck automagically isn't useful for ebuild testing.
- echo "exit 0" > scripts/maint/checkShellScripts.sh || die
-
- # Only needed for libressl patch
- eautoreconf
-}
-
-src_configure() {
- use doc && DOCS+=( README.md ChangeLog ReleaseNotes doc/HACKING )
-
- export ac_cv_lib_cap_cap_init=$(usex caps)
- export tor_cv_PYTHON="${EPYTHON}"
-
- local myeconfargs=(
- --localstatedir="${EPREFIX}/var"
- --disable-all-bugs-are-fatal
- --enable-system-torrc
- --disable-android
- --disable-coverage
- --disable-html-manual
- --disable-libfuzzer
- --enable-missing-doc-warnings
- --disable-module-dirauth
- --enable-pic
- --disable-restart-debugging
-
- # This option is enabled by default upstream w/ zstd, surprisingly.
- # zstd upstream says this shouldn't be relied upon and it may
- # break API & ABI at any point, so Tor tries to fake static-linking
- # to make it work, but then requires a rebuild on any new zstd version
- # even when its standard ABI hasn't changed.
- # See bug #727406 and bug #905708.
- --disable-zstd-advanced-apis
-
- $(use_enable man asciidoc)
- $(use_enable man manpage)
- $(use_enable lzma)
- $(use_enable scrypt libscrypt)
- $(use_enable seccomp)
- $(use_enable server module-relay)
- $(use_enable systemd)
- $(use_enable tor-hardening gcc-hardening)
- $(use_enable tor-hardening linker-hardening)
- $(use_enable test unittests)
- $(use_enable zstd)
- )
-
- econf "${myeconfargs[@]}"
-}
-
-src_install() {
- default
- readme.gentoo_create_doc
-
- newconfd "${FILESDIR}"/tor.confd tor
- newinitd "${FILESDIR}"/tor.initd-r9 tor
- systemd_dounit "${FILESDIR}"/tor.service
-
- keepdir /var/lib/tor
-
- fperms 750 /var/lib/tor
- fowners tor:tor /var/lib/tor
-
- insinto /etc/tor/
- newins "${FILESDIR}"/torrc-r2 torrc
-}
diff --git a/net-vpn/tor/tor-0.4.7.16-r1.ebuild b/net-vpn/tor/tor-0.4.7.16-r1.ebuild
deleted file mode 100644
index 6837ebeb76ed..000000000000
--- a/net-vpn/tor/tor-0.4.7.16-r1.ebuild
+++ /dev/null
@@ -1,180 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-PYTHON_COMPAT=( python3_{10..12} )
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/torproject.org.asc
-inherit edo python-any-r1 readme.gentoo-r1 systemd verify-sig
-
-MY_PV="$(ver_rs 4 -)"
-MY_PF="${PN}-${MY_PV}"
-DESCRIPTION="Anonymizing overlay network for TCP"
-HOMEPAGE="https://www.torproject.org/ https://gitlab.torproject.org/tpo/core/tor/"
-
-if [[ ${PV} == 9999 ]] ; then
- EGIT_REPO_URI="https://gitlab.torproject.org/tpo/core/tor"
- inherit autotools git-r3
-else
- SRC_URI="
- https://www.torproject.org/dist/${MY_PF}.tar.gz
- https://archive.torproject.org/tor-package-archive/${MY_PF}.tar.gz
- verify-sig? (
- https://dist.torproject.org/${MY_PF}.tar.gz.sha256sum
- https://dist.torproject.org/${MY_PF}.tar.gz.sha256sum.asc
- )
- "
-
- S="${WORKDIR}/${MY_PF}"
-
- if [[ ${PV} != *_alpha* && ${PV} != *_beta* && ${PV} != *_rc* ]]; then
- KEYWORDS="~amd64 arm arm64 ~hppa ~mips ~ppc ~ppc64 ~riscv ~sparc x86 ~ppc-macos"
- fi
-
- BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-tor-20230727 )"
-fi
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-IUSE="caps doc lzma +man scrypt seccomp selinux +server systemd tor-hardening test zstd"
-RESTRICT="!test? ( test )"
-
-DEPEND="
- >=dev-libs/libevent-2.1.12-r1:=[ssl]
- dev-libs/openssl:=[-bindist(-)]
- sys-libs/zlib
- caps? ( sys-libs/libcap )
- man? ( app-text/asciidoc )
- lzma? ( app-arch/xz-utils )
- scrypt? ( app-crypt/libscrypt )
- seccomp? ( >=sys-libs/libseccomp-2.4.1 )
- systemd? ( sys-apps/systemd:= )
- zstd? ( app-arch/zstd:= )
-"
-RDEPEND="
- acct-user/tor
- acct-group/tor
- ${DEPEND}
- selinux? ( sec-policy/selinux-tor )
-"
-DEPEND+="
- test? (
- ${DEPEND}
- ${PYTHON_DEPS}
- )
-"
-
-DOCS=()
-
-PATCHES=(
- "${FILESDIR}"/${PN}-0.2.7.4-torrc.sample.patch
- "${FILESDIR}"/${P}-arm64-sandbox.patch
-)
-
-pkg_setup() {
- use test && python-any-r1_pkg_setup
-}
-
-src_unpack() {
- if [[ ${PV} == 9999 ]] ; then
- git-r3_src_unpack
- else
- if use verify-sig; then
- cd "${DISTDIR}" || die
- verify-sig_verify_detached ${MY_PF}.tar.gz.sha256sum{,.asc}
- verify-sig_verify_unsigned_checksums \
- ${MY_PF}.tar.gz.sha256sum sha256 ${MY_PF}.tar.gz
- cd "${WORKDIR}" || die
- fi
-
- default
- fi
-}
-
-src_prepare() {
- default
-
- # Running shellcheck automagically isn't useful for ebuild testing.
- echo "exit 0" > scripts/maint/checkShellScripts.sh || die
-
- if [[ ${PV} == 9999 ]] ; then
- eautoreconf
- fi
-}
-
-src_configure() {
- use doc && DOCS+=( README.md ChangeLog ReleaseNotes doc/HACKING )
-
- export ac_cv_lib_cap_cap_init=$(usex caps)
- export tor_cv_PYTHON="${EPYTHON}"
-
- local myeconfargs=(
- --localstatedir="${EPREFIX}/var"
- --disable-all-bugs-are-fatal
- --enable-system-torrc
- --disable-android
- --disable-coverage
- --disable-html-manual
- --disable-libfuzzer
- --enable-missing-doc-warnings
- --disable-module-dirauth
- --enable-pic
- --disable-restart-debugging
-
- $(use_enable man asciidoc)
- $(use_enable man manpage)
- $(use_enable lzma)
- $(use_enable scrypt libscrypt)
- $(use_enable seccomp)
- $(use_enable server module-relay)
- $(use_enable systemd)
- $(use_enable tor-hardening gcc-hardening)
- $(use_enable tor-hardening linker-hardening)
- $(use_enable test unittests)
- $(use_enable zstd)
- )
-
- econf "${myeconfargs[@]}"
-}
-
-src_test() {
- local skip_tests=(
- # Fails in sandbox
- :sandbox/open_filename
- :sandbox/openat_filename
- )
-
- if use arm ; then
- skip_tests+=(
- # bug #920905
- # https://gitlab.torproject.org/tpo/core/tor/-/issues/40912
- :sandbox/opendir_dirname
- :sandbox/openat_filename
- :sandbox/chmod_filename
- :sandbox/chown_filename
- :sandbox/rename_filename
- )
- fi
-
- # The makefile runs these by parallel by chunking them with a script
- # but that means we lose verbosity and can't skip individual tests easily
- # either.
- edo ./src/test/test --verbose "${skip_tests[@]}"
-}
-
-src_install() {
- default
- readme.gentoo_create_doc
-
- newconfd "${FILESDIR}"/tor.confd tor
- newinitd "${FILESDIR}"/tor.initd-r9 tor
- systemd_dounit "${FILESDIR}"/tor.service
-
- keepdir /var/lib/tor
-
- fperms 750 /var/lib/tor
- fowners tor:tor /var/lib/tor
-
- insinto /etc/tor/
- newins "${FILESDIR}"/torrc-r2 torrc
-}
diff --git a/net-vpn/tor/tor-0.4.7.16.ebuild b/net-vpn/tor/tor-0.4.7.16.ebuild
deleted file mode 100644
index 5e354a9a9c39..000000000000
--- a/net-vpn/tor/tor-0.4.7.16.ebuild
+++ /dev/null
@@ -1,167 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-PYTHON_COMPAT=( python3_{10..12} )
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/torproject.org.asc
-inherit edo python-any-r1 readme.gentoo-r1 systemd verify-sig
-
-MY_PV="$(ver_rs 4 -)"
-MY_PF="${PN}-${MY_PV}"
-DESCRIPTION="Anonymizing overlay network for TCP"
-HOMEPAGE="https://www.torproject.org/ https://gitlab.torproject.org/tpo/core/tor/"
-
-if [[ ${PV} == 9999 ]] ; then
- EGIT_REPO_URI="https://gitlab.torproject.org/tpo/core/tor"
- inherit autotools git-r3
-else
- SRC_URI="
- https://www.torproject.org/dist/${MY_PF}.tar.gz
- https://archive.torproject.org/tor-package-archive/${MY_PF}.tar.gz
- verify-sig? (
- https://dist.torproject.org/${MY_PF}.tar.gz.sha256sum
- https://dist.torproject.org/${MY_PF}.tar.gz.sha256sum.asc
- )
- "
-
- S="${WORKDIR}/${MY_PF}"
-
- if [[ ${PV} != *_alpha* && ${PV} != *_beta* && ${PV} != *_rc* ]]; then
- KEYWORDS="amd64 ~arm ~arm64 ~hppa ~mips ppc ppc64 ~riscv ~sparc ~x86 ~ppc-macos"
- fi
-
- BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-tor-20230727 )"
-fi
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-IUSE="caps doc lzma +man scrypt seccomp selinux +server systemd tor-hardening test zstd"
-RESTRICT="!test? ( test )"
-
-DEPEND="
- >=dev-libs/libevent-2.1.12-r1:=[ssl]
- dev-libs/openssl:=[-bindist(-)]
- sys-libs/zlib
- caps? ( sys-libs/libcap )
- man? ( app-text/asciidoc )
- lzma? ( app-arch/xz-utils )
- scrypt? ( app-crypt/libscrypt )
- seccomp? ( >=sys-libs/libseccomp-2.4.1 )
- systemd? ( sys-apps/systemd:= )
- zstd? ( app-arch/zstd:= )
-"
-RDEPEND="
- acct-user/tor
- acct-group/tor
- ${DEPEND}
- selinux? ( sec-policy/selinux-tor )
-"
-DEPEND+="
- test? (
- ${DEPEND}
- ${PYTHON_DEPS}
- )
-"
-
-DOCS=()
-
-PATCHES=(
- "${FILESDIR}"/${PN}-0.2.7.4-torrc.sample.patch
-)
-
-pkg_setup() {
- use test && python-any-r1_pkg_setup
-}
-
-src_unpack() {
- if [[ ${PV} == 9999 ]] ; then
- git-r3_src_unpack
- else
- if use verify-sig; then
- cd "${DISTDIR}" || die
- verify-sig_verify_detached ${MY_PF}.tar.gz.sha256sum{,.asc}
- verify-sig_verify_unsigned_checksums \
- ${MY_PF}.tar.gz.sha256sum sha256 ${MY_PF}.tar.gz
- cd "${WORKDIR}" || die
- fi
-
- default
- fi
-}
-
-src_prepare() {
- default
-
- # Running shellcheck automagically isn't useful for ebuild testing.
- echo "exit 0" > scripts/maint/checkShellScripts.sh || die
-
- if [[ ${PV} == 9999 ]] ; then
- eautoreconf
- fi
-}
-
-src_configure() {
- use doc && DOCS+=( README.md ChangeLog ReleaseNotes doc/HACKING )
-
- export ac_cv_lib_cap_cap_init=$(usex caps)
- export tor_cv_PYTHON="${EPYTHON}"
-
- local myeconfargs=(
- --localstatedir="${EPREFIX}/var"
- --disable-all-bugs-are-fatal
- --enable-system-torrc
- --disable-android
- --disable-coverage
- --disable-html-manual
- --disable-libfuzzer
- --enable-missing-doc-warnings
- --disable-module-dirauth
- --enable-pic
- --disable-restart-debugging
-
- $(use_enable man asciidoc)
- $(use_enable man manpage)
- $(use_enable lzma)
- $(use_enable scrypt libscrypt)
- $(use_enable seccomp)
- $(use_enable server module-relay)
- $(use_enable systemd)
- $(use_enable tor-hardening gcc-hardening)
- $(use_enable tor-hardening linker-hardening)
- $(use_enable test unittests)
- $(use_enable zstd)
- )
-
- econf "${myeconfargs[@]}"
-}
-
-src_test() {
- local skip_tests=(
- # Fails in sandbox
- :sandbox/open_filename
- :sandbox/openat_filename
- )
-
- # The makefile runs these by parallel by chunking them with a script
- # but that means we lose verbosity and can't skip individual tests easily
- # either.
- edo ./src/test/test --verbose "${skip_tests[@]}"
-}
-
-src_install() {
- default
- readme.gentoo_create_doc
-
- newconfd "${FILESDIR}"/tor.confd tor
- newinitd "${FILESDIR}"/tor.initd-r9 tor
- systemd_dounit "${FILESDIR}"/tor.service
-
- keepdir /var/lib/tor
-
- fperms 750 /var/lib/tor
- fowners tor:tor /var/lib/tor
-
- insinto /etc/tor/
- newins "${FILESDIR}"/torrc-r2 torrc
-}
diff --git a/net-vpn/tor/tor-0.4.8.10.ebuild b/net-vpn/tor/tor-0.4.8.10.ebuild
deleted file mode 100644
index 6ece856a4d65..000000000000
--- a/net-vpn/tor/tor-0.4.8.10.ebuild
+++ /dev/null
@@ -1,189 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-PYTHON_COMPAT=( python3_{10..12} )
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/torproject.org.asc
-inherit edo python-any-r1 readme.gentoo-r1 systemd verify-sig
-
-MY_PV="$(ver_rs 4 -)"
-MY_PF="${PN}-${MY_PV}"
-DESCRIPTION="Anonymizing overlay network for TCP"
-HOMEPAGE="https://www.torproject.org/ https://gitlab.torproject.org/tpo/core/tor/"
-
-if [[ ${PV} == 9999 ]] ; then
- EGIT_REPO_URI="https://gitlab.torproject.org/tpo/core/tor"
- inherit autotools git-r3
-else
- SRC_URI="
- https://www.torproject.org/dist/${MY_PF}.tar.gz
- https://archive.torproject.org/tor-package-archive/${MY_PF}.tar.gz
- verify-sig? (
- https://dist.torproject.org/${MY_PF}.tar.gz.sha256sum
- https://dist.torproject.org/${MY_PF}.tar.gz.sha256sum.asc
- )
- "
-
- S="${WORKDIR}/${MY_PF}"
-
- if [[ ${PV} != *_alpha* && ${PV} != *_beta* && ${PV} != *_rc* ]]; then
- KEYWORDS="amd64 arm arm64 ~hppa ~mips ppc ppc64 ~riscv ~sparc x86 ~ppc-macos"
- fi
-
- BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-tor-20230727 )"
-fi
-
-# BSD in general, but for PoW, needs --enable-gpl (GPL-3 per --version)
-# We also already had GPL-2 listed here for the init script, but obviously
-# that's different from the actual binary.
-LICENSE="BSD GPL-2 GPL-3"
-SLOT="0"
-IUSE="caps doc lzma +man scrypt seccomp selinux +server systemd tor-hardening test zstd"
-RESTRICT="!test? ( test )"
-
-DEPEND="
- >=dev-libs/libevent-2.1.12-r1:=[ssl]
- dev-libs/openssl:=[-bindist(-)]
- sys-libs/zlib
- caps? ( sys-libs/libcap )
- man? ( app-text/asciidoc )
- lzma? ( app-arch/xz-utils )
- scrypt? ( app-crypt/libscrypt )
- seccomp? ( >=sys-libs/libseccomp-2.4.1 )
- systemd? ( sys-apps/systemd:= )
- zstd? ( app-arch/zstd:= )
-"
-RDEPEND="
- acct-user/tor
- acct-group/tor
- ${DEPEND}
- selinux? ( sec-policy/selinux-tor )
-"
-DEPEND+="
- test? (
- ${DEPEND}
- ${PYTHON_DEPS}
- )
-"
-
-DOCS=()
-
-PATCHES=(
- "${FILESDIR}"/${PN}-0.2.7.4-torrc.sample.patch
-)
-
-pkg_setup() {
- use test && python-any-r1_pkg_setup
-}
-
-src_unpack() {
- if [[ ${PV} == 9999 ]] ; then
- git-r3_src_unpack
- else
- if use verify-sig; then
- cd "${DISTDIR}" || die
- verify-sig_verify_detached ${MY_PF}.tar.gz.sha256sum{,.asc}
- verify-sig_verify_unsigned_checksums \
- ${MY_PF}.tar.gz.sha256sum sha256 ${MY_PF}.tar.gz
- cd "${WORKDIR}" || die
- fi
-
- default
- fi
-}
-
-src_prepare() {
- default
-
- # Running shellcheck automagically isn't useful for ebuild testing.
- echo "exit 0" > scripts/maint/checkShellScripts.sh || die
-
- if [[ ${PV} == 9999 ]] ; then
- eautoreconf
- fi
-}
-
-src_configure() {
- use doc && DOCS+=( README.md ChangeLog ReleaseNotes doc/HACKING )
-
- export ac_cv_lib_cap_cap_init=$(usex caps)
- export tor_cv_PYTHON="${EPYTHON}"
-
- local myeconfargs=(
- --localstatedir="${EPREFIX}/var"
- --disable-all-bugs-are-fatal
- --enable-system-torrc
- --disable-android
- --disable-coverage
- --disable-html-manual
- --disable-libfuzzer
- --enable-missing-doc-warnings
- --disable-module-dirauth
- --enable-pic
- --disable-restart-debugging
-
- # Unless someone asks & has a compelling reason, just always
- # build in GPL mode for pow, given we don't want yet another USE
- # flag combination to have to test just for the sake of it.
- # (PoW requires GPL.)
- --enable-gpl
- --enable-module-pow
-
- $(use_enable man asciidoc)
- $(use_enable man manpage)
- $(use_enable lzma)
- $(use_enable scrypt libscrypt)
- $(use_enable seccomp)
- $(use_enable server module-relay)
- $(use_enable systemd)
- $(use_enable tor-hardening gcc-hardening)
- $(use_enable tor-hardening linker-hardening)
- $(use_enable test unittests)
- $(use_enable zstd)
- )
-
- econf "${myeconfargs[@]}"
-}
-
-src_test() {
- local skip_tests=(
- # Fails in sandbox
- :sandbox/open_filename
- :sandbox/openat_filename
- )
-
- if use arm ; then
- skip_tests+=(
- # bug #920905
- # https://gitlab.torproject.org/tpo/core/tor/-/issues/40912
- :sandbox/opendir_dirname
- :sandbox/openat_filename
- :sandbox/chmod_filename
- :sandbox/chown_filename
- :sandbox/rename_filename
- )
- fi
-
- # The makefile runs these by parallel by chunking them with a script
- # but that means we lose verbosity and can't skip individual tests easily
- # either.
- edo ./src/test/test --verbose "${skip_tests[@]}"
-}
-
-src_install() {
- default
- readme.gentoo_create_doc
-
- newconfd "${FILESDIR}"/tor.confd tor
- newinitd "${FILESDIR}"/tor.initd-r9 tor
- systemd_dounit "${FILESDIR}"/tor.service
-
- keepdir /var/lib/tor
-
- fperms 750 /var/lib/tor
- fowners tor:tor /var/lib/tor
-
- insinto /etc/tor/
- newins "${FILESDIR}"/torrc-r2 torrc
-}
^ permalink raw reply related [flat|nested] 5+ messages in thread
end of thread, other threads:[~2024-07-17 5:54 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-02-25 0:58 [gentoo-commits] repo/gentoo:master commit in: net-vpn/tor/, net-vpn/tor/files/ Anthony G. Basile
-- strict thread matches above, loose matches on Subject: below --
2020-11-09 17:48 Anthony G. Basile
2022-12-16 5:11 Sam James
2023-12-25 19:55 John Helmert III
2024-07-17 5:54 Sam James
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox