dev-libs/nss/nss-3.47.1-r1.ebuild

   1 # Copyright 1999-2020 Gentoo Authors
   2 # Distributed under the terms of the GNU General Public License v2
   3
   4 EAPI=7
   5
   6 inherit eutils flag-o-matic multilib toolchain-funcs multilib-minimal
   7
   8 NSPR_VER="4.22"
   9 RTM_NAME="NSS_${PV//./_}_RTM"
  10 # Rev of https://git.fedorahosted.org/cgit/nss-pem.git
  11 PEM_GIT_REV="429b0222759d8ad8e6dcd29e62875ae3efd69116"
  12 PEM_P="${PN}-pem-20160329"
  13
  14 DESCRIPTION="Mozilla's Network Security Services library that implements PKI support"
  15 HOMEPAGE="http://www.mozilla.org/projects/security/pki/nss/"
  16 SRC_URI="https://archive.mozilla.org/pub/security/nss/releases/${RTM_NAME}/src/${P}.tar.gz
  17         cacert? ( https://dev.gentoo.org/~axs/distfiles/${PN}-cacert-class1-class3.patch )
  18         nss-pem? ( https://dev.gentoo.org/~polynomial-c/${PEM_P}.tar.xz )"
  19
  20 LICENSE="|| ( MPL-2.0 GPL-2 LGPL-2.1 )"
  21 SLOT="0"
  22 KEYWORDS="~alpha amd64 arm arm64 hppa ia64 ~m68k ~mips ppc ppc64 s390 sparc x86 ~amd64-linux ~x86-linux ~x86-macos ~sparc-solaris ~x64-solaris ~x86-solaris"
  23 IUSE="cacert +nss-pem utils"
  24 BDEPEND="
  25         >=virtual/pkgconfig-0-r1[${MULTILIB_USEDEP}]
  26 "
  27 RDEPEND="
  28         >=dev-libs/nspr-${NSPR_VER}[${MULTILIB_USEDEP}]
  29         >=dev-db/sqlite-3.8.2[${MULTILIB_USEDEP}]
  30         >=sys-libs/zlib-1.2.8-r1[${MULTILIB_USEDEP}]
  31 "
  32 DEPEND="${RDEPEND}"
  33
  34 RESTRICT="test"
  35
  36 S="${WORKDIR}/${P}/${PN}"
  37
  38 MULTILIB_CHOST_TOOLS=(
  39         /usr/bin/nss-config
  40 )
  41
  42 PATCHES=(
  43         # Custom changes for gentoo
  44         "${FILESDIR}/${PN}-3.47-gentoo-fixups.patch"
  45         "${FILESDIR}/${PN}-3.21-gentoo-fixup-warnings.patch"
  46         "${FILESDIR}/${PN}-3.23-hppa-byte_order.patch"
  47 )
  48
  49 src_unpack() {
  50         unpack ${A}
  51         if use nss-pem ; then
  52                 mv "${PN}"/lib/ckfw/pem/ "${S}"/lib/ckfw/ || die
  53         fi
  54 }
  55
  56 src_prepare() {
  57         if use nss-pem ; then
  58                 PATCHES+=(
  59                         "${FILESDIR}/${PN}-3.47-enable-pem.patch"
  60                 )
  61         fi
  62         if use cacert ; then #521462
  63                 PATCHES+=(
  64                         "${DISTDIR}/${PN}-cacert-class1-class3.patch"
  65                 )
  66         fi
  67
  68         default
  69
  70         pushd coreconf >/dev/null || die
  71         # hack nspr paths
  72         echo 'INCLUDES += -I$(DIST)/include/dbm' \
  73                 >> headers.mk || die "failed to append include"
  74
  75         # modify install path
  76         sed -e '/CORE_DEPTH/s:SOURCE_PREFIX.*$:SOURCE_PREFIX = $(CORE_DEPTH)/dist:' \
  77                 -i source.mk || die
  78
  79         # Respect LDFLAGS
  80         sed -i -e 's/\$(MKSHLIB) -o/\$(MKSHLIB) \$(LDFLAGS) -o/g' rules.mk
  81         popd >/dev/null || die
  82
  83         # Fix pkgconfig file for Prefix
  84         sed -i -e "/^PREFIX =/s:= /usr:= ${EPREFIX}/usr:" \
  85                 config/Makefile || die
  86
  87         # use host shlibsign if need be #436216
  88         if tc-is-cross-compiler ; then
  89                 sed -i \
  90                         -e 's:"${2}"/shlibsign:shlibsign:' \
  91                         cmd/shlibsign/sign.sh || die
  92         fi
  93
  94         # dirty hack
  95         sed -i -e "/CRYPTOLIB/s:\$(SOFTOKEN_LIB_DIR):../freebl/\$(OBJDIR):" \
  96                 lib/ssl/config.mk || die
  97         sed -i -e "/CRYPTOLIB/s:\$(SOFTOKEN_LIB_DIR):../../lib/freebl/\$(OBJDIR):" \
  98                 cmd/platlibs.mk || die
  99
 100         multilib_copy_sources
 101
 102         strip-flags
 103 }
 104
 105 multilib_src_configure() {
 106         # Ensure we stay multilib aware
 107         sed -i -e "/@libdir@/ s:lib64:$(get_libdir):" config/Makefile || die
 108 }
 109
 110 nssarch() {
 111         # Most of the arches are the same as $ARCH
 112         local t=${1:-${CHOST}}
 113         case ${t} in
 114                 aarch64*)echo "aarch64";;
 115                 hppa*)   echo "parisc";;
 116                 i?86*)   echo "i686";;
 117                 x86_64*) echo "x86_64";;
 118                 *)       tc-arch ${t};;
 119         esac
 120 }
 121
 122 nssbits() {
 123         local cc cppflags="${1}CPPFLAGS" cflags="${1}CFLAGS"
 124         if [[ ${1} == BUILD_ ]]; then
 125                 cc=$(tc-getBUILD_CC)
 126         else
 127                 cc=$(tc-getCC)
 128         fi
 129         echo > "${T}"/test.c || die
 130         ${cc} ${!cppflags} ${!cflags} -c "${T}"/test.c -o "${T}/${1}test.o" || die
 131         case $(file "${T}/${1}test.o") in
 132                 *32-bit*x86-64*) echo USE_X32=1;;
 133                 *64-bit*|*ppc64*|*x86_64*) echo USE_64=1;;
 134                 *32-bit*|*ppc*|*i386*) ;;
 135                 *) die "Failed to detect whether ${cc} builds 64bits or 32bits, disable distcc if you're using it, please";;
 136         esac
 137 }
 138
 139 multilib_src_compile() {
 140         # use ABI to determine bit'ness, or fallback if unset
 141         local buildbits mybits
 142         case "${ABI}" in
 143                 n32) mybits="USE_N32=1";;
 144                 x32) mybits="USE_X32=1";;
 145                 s390x|*64) mybits="USE_64=1";;
 146                 ${DEFAULT_ABI})
 147                         einfo "Running compilation test to determine bit'ness"
 148                         mybits=$(nssbits)
 149                         ;;
 150         esac
 151         # bitness of host may differ from target
 152         if tc-is-cross-compiler; then
 153                 buildbits=$(nssbits BUILD_)
 154         fi
 155
 156         local makeargs=(
 157                 CC="$(tc-getCC)"
 158                 CCC="$(tc-getCXX)"
 159                 AR="$(tc-getAR) rc \$@"
 160                 RANLIB="$(tc-getRANLIB)"
 161                 OPTIMIZER=
 162                 ${mybits}
 163         )
 164
 165         # Take care of nspr settings #436216
 166         local myCPPFLAGS="${CPPFLAGS} $($(tc-getPKG_CONFIG) nspr --cflags)"
 167         unset NSPR_INCLUDE_DIR
 168
 169         # Do not let `uname` be used.
 170         if use kernel_linux ; then
 171                 makeargs+=(
 172                         OS_TARGET=Linux
 173                         OS_RELEASE=2.6
 174                         OS_TEST="$(nssarch)"
 175                 )
 176         fi
 177
 178         export NSS_ALLOW_SSLKEYLOGFILE=1
 179         export NSS_ENABLE_WERROR=0 #567158
 180         export BUILD_OPT=1
 181         export NSS_USE_SYSTEM_SQLITE=1
 182         export NSDISTMODE=copy
 183         export NSS_ENABLE_ECC=1
 184         export FREEBL_NO_DEPEND=1
 185         export FREEBL_LOWHASH=1
 186         export NSS_SEED_ONLY_DEV_URANDOM=1
 187         export ASFLAGS=""
 188
 189         local d
 190
 191         # Build the host tools first.
 192         LDFLAGS="${BUILD_LDFLAGS}" \
 193         XCFLAGS="${BUILD_CFLAGS}" \
 194         NSPR_LIB_DIR="${T}/fakedir" \
 195         emake -j1 -C coreconf \
 196                 CC="$(tc-getBUILD_CC)" \
 197                 ${buildbits:-${mybits}}
 198         makeargs+=( NSINSTALL="${PWD}/$(find -type f -name nsinstall)" )
 199
 200         # Then build the target tools.
 201         for d in . lib/dbm ; do
 202                 CPPFLAGS="${myCPPFLAGS}" \
 203                 XCFLAGS="${CFLAGS} ${CPPFLAGS}" \
 204                 NSPR_LIB_DIR="${T}/fakedir" \
 205                 emake -j1 "${makeargs[@]}" -C ${d}
 206         done
 207 }
 208
 209 # Altering these 3 libraries breaks the CHK verification.
 210 # All of the following cause it to break:
 211 # - stripping
 212 # - prelink
 213 # - ELF signing
 214 # http://www.mozilla.org/projects/security/pki/nss/tech-notes/tn6.html
 215 # Either we have to NOT strip them, or we have to forcibly resign after
 216 # stripping.
 217 #local_libdir="$(get_libdir)"
 218 #export STRIP_MASK="
 219 #       */${local_libdir}/libfreebl3.so*
 220 #       */${local_libdir}/libnssdbm3.so*
 221 #       */${local_libdir}/libsoftokn3.so*"
 222
 223 export NSS_CHK_SIGN_LIBS="freebl3 nssdbm3 softokn3"
 224
 225 generate_chk() {
 226         local shlibsign="$1"
 227         local libdir="$2"
 228         einfo "Resigning core NSS libraries for FIPS validation"
 229         shift 2
 230         local i
 231         for i in ${NSS_CHK_SIGN_LIBS} ; do
 232                 local libname=lib${i}.so
 233                 local chkname=lib${i}.chk
 234                 "${shlibsign}" \
 235                         -i "${libdir}"/${libname} \
 236                         -o "${libdir}"/${chkname}.tmp \
 237                 && mv -f \
 238                         "${libdir}"/${chkname}.tmp \
 239                         "${libdir}"/${chkname} \
 240                 || die "Failed to sign ${libname}"
 241         done
 242 }
 243
 244 cleanup_chk() {
 245         local libdir="$1"
 246         shift 1
 247         local i
 248         for i in ${NSS_CHK_SIGN_LIBS} ; do
 249                 local libfname="${libdir}/lib${i}.so"
 250                 # If the major version has changed, then we have old chk files.
 251                 [ ! -f "${libfname}" -a -f "${libfname}.chk" ] \
 252                         && rm -f "${libfname}.chk"
 253         done
 254 }
 255
 256 multilib_src_install() {
 257         pushd dist >/dev/null || die
 258
 259         dodir /usr/$(get_libdir)
 260         cp -L */lib/*$(get_libname) "${ED}"/usr/$(get_libdir) || die "copying shared libs failed"
 261         local i
 262         for i in crmf freebl nssb nssckfw ; do
 263                 cp -L */lib/lib${i}.a "${ED}"/usr/$(get_libdir) || die "copying libs failed"
 264         done
 265
 266         # Install nss-config and pkgconfig file
 267         dodir /usr/bin
 268         cp -L */bin/nss-config "${ED}"/usr/bin || die
 269         dodir /usr/$(get_libdir)/pkgconfig
 270         cp -L */lib/pkgconfig/nss.pc "${ED}"/usr/$(get_libdir)/pkgconfig || die
 271
 272         # create an nss-softokn.pc from nss.pc for libfreebl and some private headers
 273         # bug 517266
 274         sed     -e 's#Libs:#Libs: -lfreebl#' \
 275                 -e 's#Cflags:#Cflags: -I${includedir}/private#' \
 276                 */lib/pkgconfig/nss.pc >"${ED}"/usr/$(get_libdir)/pkgconfig/nss-softokn.pc \
 277                 || die "could not create nss-softokn.pc"
 278
 279         # all the include files
 280         insinto /usr/include/nss
 281         doins public/nss/*.{h,api}
 282         insinto /usr/include/nss/private
 283         doins private/nss/{blapi,alghmac}.h
 284
 285         popd >/dev/null || die
 286
 287         local f nssutils
 288         # Always enabled because we need it for chk generation.
 289         nssutils=( shlibsign )
 290
 291         if multilib_is_native_abi ; then
 292                 if use utils; then
 293                         # The tests we do not need to install.
 294                         #nssutils_test="bltest crmftest dbtest dertimetest
 295                         #fipstest remtest sdrtest"
 296                         # checkcert utils has been removed in nss-3.22:
 297                         # https://bugzilla.mozilla.org/show_bug.cgi?id=1187545
 298                         # https://hg.mozilla.org/projects/nss/rev/df1729d37870
 299                         # certcgi has been removed in nss-3.36:
 300                         # https://bugzilla.mozilla.org/show_bug.cgi?id=1426602
 301                         nssutils+=(
 302                                 addbuiltin
 303                                 atob
 304                                 baddbdir
 305                                 btoa
 306                                 certutil
 307                                 cmsutil
 308                                 conflict
 309                                 crlutil
 310                                 derdump
 311                                 digest
 312                                 makepqg
 313                                 mangle
 314                                 modutil
 315                                 multinit
 316                                 nonspr10
 317                                 ocspclnt
 318                                 oidcalc
 319                                 p7content
 320                                 p7env
 321                                 p7sign
 322                                 p7verify
 323                                 pk11mode
 324                                 pk12util
 325                                 pp
 326                                 rsaperf
 327                                 selfserv
 328                                 signtool
 329                                 signver
 330                                 ssltap
 331                                 strsclnt
 332                                 symkeyutil
 333                                 tstclnt
 334                                 vfychain
 335                                 vfyserv
 336                         )
 337                         # install man-pages for utils (bug #516810)
 338                         doman doc/nroff/*.1
 339                 fi
 340                 pushd dist/*/bin >/dev/null || die
 341                 for f in ${nssutils[@]}; do
 342                         dobin ${f}
 343                 done
 344                 popd >/dev/null || die
 345         fi
 346
 347         # Prelink breaks the CHK files. We don't have any reliable way to run
 348         # shlibsign after prelink.
 349         dodir /etc/prelink.conf.d
 350         printf -- "-b ${EPREFIX}/usr/$(get_libdir)/lib%s.so\n" ${NSS_CHK_SIGN_LIBS} \
 351                 > "${ED}"/etc/prelink.conf.d/nss.conf
 352 }
 353
 354 pkg_postinst() {
 355         multilib_pkg_postinst() {
 356                 # We must re-sign the libraries AFTER they are stripped.
 357                 local shlibsign="${EROOT}/usr/bin/shlibsign"
 358                 # See if we can execute it (cross-compiling & such). #436216
 359                 "${shlibsign}" -h >&/dev/null
 360                 if [[ $? -gt 1 ]] ; then
 361                         shlibsign="shlibsign"
 362                 fi
 363                 generate_chk "${shlibsign}" "${EROOT}"/usr/$(get_libdir)
 364         }
 365
 366         multilib_foreach_abi multilib_pkg_postinst
 367 }
 368
 369 pkg_postrm() {
 370         multilib_pkg_postrm() {
 371                 cleanup_chk "${EROOT}"/usr/$(get_libdir)
 372         }
 373
 374         multilib_foreach_abi multilib_pkg_postrm
 375 }