dev-libs/nss/nss-3.47.1.ebuild

   1 # Copyright 1999-2019 Gentoo Authors
   2 # Distributed under the terms of the GNU General Public License v2
   3
   4 EAPI=7
   5
   6 inherit eutils flag-o-matic multilib toolchain-funcs multilib-minimal
   7
   8 NSPR_VER="4.22"
   9 RTM_NAME="NSS_${PV//./_}_RTM"
  10 # Rev of https://git.fedorahosted.org/cgit/nss-pem.git
  11 PEM_GIT_REV="429b0222759d8ad8e6dcd29e62875ae3efd69116"
  12 PEM_P="${PN}-pem-20160329"
  13
  14 DESCRIPTION="Mozilla's Network Security Services library that implements PKI support"
  15 HOMEPAGE="http://www.mozilla.org/projects/security/pki/nss/"
  16 SRC_URI="https://archive.mozilla.org/pub/security/nss/releases/${RTM_NAME}/src/${P}.tar.gz
  17         cacert? ( https://dev.gentoo.org/~axs/distfiles/${PN}-cacert-class1-class3.patch )
  18         nss-pem? ( https://dev.gentoo.org/~polynomial-c/${PEM_P}.tar.xz )"
  19
  20 LICENSE="|| ( MPL-2.0 GPL-2 LGPL-2.1 )"
  21 SLOT="0"
  22 KEYWORDS="~alpha amd64 ~arm arm64 hppa ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc x86 ~amd64-linux ~x86-linux ~x86-macos ~sparc-solaris ~x64-solaris ~x86-solaris"
  23 IUSE="cacert +nss-pem utils"
  24 BDEPEND="
  25         >=virtual/pkgconfig-0-r1[${MULTILIB_USEDEP}]
  26 "
  27 RDEPEND="
  28         >=dev-libs/nspr-${NSPR_VER}[${MULTILIB_USEDEP}]
  29         >=dev-db/sqlite-3.8.2[${MULTILIB_USEDEP}]
  30         >=sys-libs/zlib-1.2.8-r1[${MULTILIB_USEDEP}]
  31 "
  32 DEPEND="${RDEPEND}"
  33
  34 RESTRICT="test"
  35
  36 S="${WORKDIR}/${P}/${PN}"
  37
  38 MULTILIB_CHOST_TOOLS=(
  39         /usr/bin/nss-config
  40 )
  41
  42 PATCHES=(
  43         # Custom changes for gentoo
  44         "${FILESDIR}/${PN}-3.47-gentoo-fixups.patch"
  45         "${FILESDIR}/${PN}-3.21-gentoo-fixup-warnings.patch"
  46         "${FILESDIR}/${PN}-3.23-hppa-byte_order.patch"
  47 )
  48
  49 src_unpack() {
  50         unpack ${A}
  51         if use nss-pem ; then
  52                 mv "${PN}"/lib/ckfw/pem/ "${S}"/lib/ckfw/ || die
  53         fi
  54 }
  55
  56 src_prepare() {
  57         if use nss-pem ; then
  58                 PATCHES+=(
  59                         "${FILESDIR}/${PN}-3.47-enable-pem.patch"
  60                 )
  61         fi
  62         if use cacert ; then #521462
  63                 PATCHES+=(
  64                         "${DISTDIR}/${PN}-cacert-class1-class3.patch"
  65                 )
  66         fi
  67
  68         default
  69
  70         pushd coreconf >/dev/null || die
  71         # hack nspr paths
  72         echo 'INCLUDES += -I$(DIST)/include/dbm' \
  73                 >> headers.mk || die "failed to append include"
  74
  75         # modify install path
  76         sed -e '/CORE_DEPTH/s:SOURCE_PREFIX.*$:SOURCE_PREFIX = $(CORE_DEPTH)/dist:' \
  77                 -i source.mk || die
  78
  79         # Respect LDFLAGS
  80         sed -i -e 's/\$(MKSHLIB) -o/\$(MKSHLIB) \$(LDFLAGS) -o/g' rules.mk
  81         popd >/dev/null || die
  82
  83         # Fix pkgconfig file for Prefix
  84         sed -i -e "/^PREFIX =/s:= /usr:= ${EPREFIX}/usr:" \
  85                 config/Makefile || die
  86
  87         # use host shlibsign if need be #436216
  88         if tc-is-cross-compiler ; then
  89                 sed -i \
  90                         -e 's:"${2}"/shlibsign:shlibsign:' \
  91                         cmd/shlibsign/sign.sh || die
  92         fi
  93
  94         # dirty hack
  95         sed -i -e "/CRYPTOLIB/s:\$(SOFTOKEN_LIB_DIR):../freebl/\$(OBJDIR):" \
  96                 lib/ssl/config.mk || die
  97         sed -i -e "/CRYPTOLIB/s:\$(SOFTOKEN_LIB_DIR):../../lib/freebl/\$(OBJDIR):" \
  98                 cmd/platlibs.mk || die
  99
 100         multilib_copy_sources
 101
 102         strip-flags
 103 }
 104
 105 multilib_src_configure() {
 106         # Ensure we stay multilib aware
 107         sed -i -e "/@libdir@/ s:lib64:$(get_libdir):" config/Makefile || die
 108 }
 109
 110 nssarch() {
 111         # Most of the arches are the same as $ARCH
 112         local t=${1:-${CHOST}}
 113         case ${t} in
 114                 aarch64*)echo "aarch64";;
 115                 hppa*)   echo "parisc";;
 116                 i?86*)   echo "i686";;
 117                 x86_64*) echo "x86_64";;
 118                 *)       tc-arch ${t};;
 119         esac
 120 }
 121
 122 nssbits() {
 123         local cc cppflags="${1}CPPFLAGS" cflags="${1}CFLAGS"
 124         if [[ ${1} == BUILD_ ]]; then
 125                 cc=$(tc-getBUILD_CC)
 126         else
 127                 cc=$(tc-getCC)
 128         fi
 129         echo > "${T}"/test.c || die
 130         ${cc} ${!cppflags} ${!cflags} -c "${T}"/test.c -o "${T}/${1}test.o" || die
 131         case $(file "${T}/${1}test.o") in
 132                 *32-bit*x86-64*) echo USE_X32=1;;
 133                 *64-bit*|*ppc64*|*x86_64*) echo USE_64=1;;
 134                 *32-bit*|*ppc*|*i386*) ;;
 135                 *) die "Failed to detect whether ${cc} builds 64bits or 32bits, disable distcc if you're using it, please";;
 136         esac
 137 }
 138
 139 multilib_src_compile() {
 140         # use ABI to determine bit'ness, or fallback if unset
 141         local buildbits mybits
 142         case "${ABI}" in
 143                 n32) mybits="USE_N32=1";;
 144                 x32) mybits="USE_X32=1";;
 145                 s390x|*64) mybits="USE_64=1";;
 146                 ${DEFAULT_ABI})
 147                         einfo "Running compilation test to determine bit'ness"
 148                         mybits=$(nssbits)
 149                         ;;
 150         esac
 151         # bitness of host may differ from target
 152         if tc-is-cross-compiler; then
 153                 buildbits=$(nssbits BUILD_)
 154         fi
 155
 156         local makeargs=(
 157                 CC="$(tc-getCC)"
 158                 CCC="$(tc-getCXX)"
 159                 AR="$(tc-getAR) rc \$@"
 160                 RANLIB="$(tc-getRANLIB)"
 161                 OPTIMIZER=
 162                 ${mybits}
 163         )
 164
 165         # Take care of nspr settings #436216
 166         local myCPPFLAGS="${CPPFLAGS} $($(tc-getPKG_CONFIG) nspr --cflags)"
 167         unset NSPR_INCLUDE_DIR
 168
 169         # Do not let `uname` be used.
 170         if use kernel_linux ; then
 171                 makeargs+=(
 172                         OS_TARGET=Linux
 173                         OS_RELEASE=2.6
 174                         OS_TEST="$(nssarch)"
 175                 )
 176         fi
 177
 178         export NSS_ENABLE_WERROR=0 #567158
 179         export BUILD_OPT=1
 180         export NSS_USE_SYSTEM_SQLITE=1
 181         export NSDISTMODE=copy
 182         export NSS_ENABLE_ECC=1
 183         export FREEBL_NO_DEPEND=1
 184         export FREEBL_LOWHASH=1
 185         export NSS_SEED_ONLY_DEV_URANDOM=1
 186         export ASFLAGS=""
 187
 188         local d
 189
 190         # Build the host tools first.
 191         LDFLAGS="${BUILD_LDFLAGS}" \
 192         XCFLAGS="${BUILD_CFLAGS}" \
 193         NSPR_LIB_DIR="${T}/fakedir" \
 194         emake -j1 -C coreconf \
 195                 CC="$(tc-getBUILD_CC)" \
 196                 ${buildbits:-${mybits}}
 197         makeargs+=( NSINSTALL="${PWD}/$(find -type f -name nsinstall)" )
 198
 199         # Then build the target tools.
 200         for d in . lib/dbm ; do
 201                 CPPFLAGS="${myCPPFLAGS}" \
 202                 XCFLAGS="${CFLAGS} ${CPPFLAGS}" \
 203                 NSPR_LIB_DIR="${T}/fakedir" \
 204                 emake -j1 "${makeargs[@]}" -C ${d}
 205         done
 206 }
 207
 208 # Altering these 3 libraries breaks the CHK verification.
 209 # All of the following cause it to break:
 210 # - stripping
 211 # - prelink
 212 # - ELF signing
 213 # http://www.mozilla.org/projects/security/pki/nss/tech-notes/tn6.html
 214 # Either we have to NOT strip them, or we have to forcibly resign after
 215 # stripping.
 216 #local_libdir="$(get_libdir)"
 217 #export STRIP_MASK="
 218 #       */${local_libdir}/libfreebl3.so*
 219 #       */${local_libdir}/libnssdbm3.so*
 220 #       */${local_libdir}/libsoftokn3.so*"
 221
 222 export NSS_CHK_SIGN_LIBS="freebl3 nssdbm3 softokn3"
 223
 224 generate_chk() {
 225         local shlibsign="$1"
 226         local libdir="$2"
 227         einfo "Resigning core NSS libraries for FIPS validation"
 228         shift 2
 229         local i
 230         for i in ${NSS_CHK_SIGN_LIBS} ; do
 231                 local libname=lib${i}.so
 232                 local chkname=lib${i}.chk
 233                 "${shlibsign}" \
 234                         -i "${libdir}"/${libname} \
 235                         -o "${libdir}"/${chkname}.tmp \
 236                 && mv -f \
 237                         "${libdir}"/${chkname}.tmp \
 238                         "${libdir}"/${chkname} \
 239                 || die "Failed to sign ${libname}"
 240         done
 241 }
 242
 243 cleanup_chk() {
 244         local libdir="$1"
 245         shift 1
 246         local i
 247         for i in ${NSS_CHK_SIGN_LIBS} ; do
 248                 local libfname="${libdir}/lib${i}.so"
 249                 # If the major version has changed, then we have old chk files.
 250                 [ ! -f "${libfname}" -a -f "${libfname}.chk" ] \
 251                         && rm -f "${libfname}.chk"
 252         done
 253 }
 254
 255 multilib_src_install() {
 256         pushd dist >/dev/null || die
 257
 258         dodir /usr/$(get_libdir)
 259         cp -L */lib/*$(get_libname) "${ED}"/usr/$(get_libdir) || die "copying shared libs failed"
 260         local i
 261         for i in crmf freebl nssb nssckfw ; do
 262                 cp -L */lib/lib${i}.a "${ED}"/usr/$(get_libdir) || die "copying libs failed"
 263         done
 264
 265         # Install nss-config and pkgconfig file
 266         dodir /usr/bin
 267         cp -L */bin/nss-config "${ED}"/usr/bin || die
 268         dodir /usr/$(get_libdir)/pkgconfig
 269         cp -L */lib/pkgconfig/nss.pc "${ED}"/usr/$(get_libdir)/pkgconfig || die
 270
 271         # create an nss-softokn.pc from nss.pc for libfreebl and some private headers
 272         # bug 517266
 273         sed     -e 's#Libs:#Libs: -lfreebl#' \
 274                 -e 's#Cflags:#Cflags: -I${includedir}/private#' \
 275                 */lib/pkgconfig/nss.pc >"${ED}"/usr/$(get_libdir)/pkgconfig/nss-softokn.pc \
 276                 || die "could not create nss-softokn.pc"
 277
 278         # all the include files
 279         insinto /usr/include/nss
 280         doins public/nss/*.{h,api}
 281         insinto /usr/include/nss/private
 282         doins private/nss/{blapi,alghmac}.h
 283
 284         popd >/dev/null || die
 285
 286         local f nssutils
 287         # Always enabled because we need it for chk generation.
 288         nssutils=( shlibsign )
 289
 290         if multilib_is_native_abi ; then
 291                 if use utils; then
 292                         # The tests we do not need to install.
 293                         #nssutils_test="bltest crmftest dbtest dertimetest
 294                         #fipstest remtest sdrtest"
 295                         # checkcert utils has been removed in nss-3.22:
 296                         # https://bugzilla.mozilla.org/show_bug.cgi?id=1187545
 297                         # https://hg.mozilla.org/projects/nss/rev/df1729d37870
 298                         # certcgi has been removed in nss-3.36:
 299                         # https://bugzilla.mozilla.org/show_bug.cgi?id=1426602
 300                         nssutils+=(
 301                                 addbuiltin
 302                                 atob
 303                                 baddbdir
 304                                 btoa
 305                                 certutil
 306                                 cmsutil
 307                                 conflict
 308                                 crlutil
 309                                 derdump
 310                                 digest
 311                                 makepqg
 312                                 mangle
 313                                 modutil
 314                                 multinit
 315                                 nonspr10
 316                                 ocspclnt
 317                                 oidcalc
 318                                 p7content
 319                                 p7env
 320                                 p7sign
 321                                 p7verify
 322                                 pk11mode
 323                                 pk12util
 324                                 pp
 325                                 rsaperf
 326                                 selfserv
 327                                 signtool
 328                                 signver
 329                                 ssltap
 330                                 strsclnt
 331                                 symkeyutil
 332                                 tstclnt
 333                                 vfychain
 334                                 vfyserv
 335                         )
 336                         # install man-pages for utils (bug #516810)
 337                         doman doc/nroff/*.1
 338                 fi
 339                 pushd dist/*/bin >/dev/null || die
 340                 for f in ${nssutils[@]}; do
 341                         dobin ${f}
 342                 done
 343                 popd >/dev/null || die
 344         fi
 345
 346         # Prelink breaks the CHK files. We don't have any reliable way to run
 347         # shlibsign after prelink.
 348         dodir /etc/prelink.conf.d
 349         printf -- "-b ${EPREFIX}/usr/$(get_libdir)/lib%s.so\n" ${NSS_CHK_SIGN_LIBS} \
 350                 > "${ED}"/etc/prelink.conf.d/nss.conf
 351 }
 352
 353 pkg_postinst() {
 354         multilib_pkg_postinst() {
 355                 # We must re-sign the libraries AFTER they are stripped.
 356                 local shlibsign="${EROOT}/usr/bin/shlibsign"
 357                 # See if we can execute it (cross-compiling & such). #436216
 358                 "${shlibsign}" -h >&/dev/null
 359                 if [[ $? -gt 1 ]] ; then
 360                         shlibsign="shlibsign"
 361                 fi
 362                 generate_chk "${shlibsign}" "${EROOT}"/usr/$(get_libdir)
 363         }
 364
 365         multilib_foreach_abi multilib_pkg_postinst
 366 }
 367
 368 pkg_postrm() {
 369         multilib_pkg_postrm() {
 370                 cleanup_chk "${EROOT}"/usr/$(get_libdir)
 371         }
 372
 373         multilib_foreach_abi multilib_pkg_postrm
 374 }