From 12a62d57b37ec63b1378edaf7780adc880d9425d Mon Sep 17 00:00:00 2001 From: Wang Mingyu Date: Tue, 10 Dec 2024 07:56:38 +0800 Subject: gnupg: upgrade 2.5.1 -> 2.5.2 0001-fix-compile-failure-with-musl.patch relocate.patch refreshed for 2.5.2 Changelog: ============ * gpg: Add option 16 to --full-gen-key to create ECC+Kyber. * gpg: For composite algos add the algo string to the colons listings. * gpg: Validate the trustdb after the import of a trusted key. * gpg: Exclude expired trusted keys from the key validation process. * gpg: Fix a wrong decryption failed status for signed and OCB encrypted messages without a signature verification key. * gpg: Retain binary representation for import->export with Ed25519 key signatures. * gpg: Fix comparing ed448 to ed25519 with --assert-pubkey-algo. * gpg: Avoid a failure exit code for expired ultimately trusted keys. * gpg: Emit status error for an invalid ADSK. * gpg: Allow the use of an ADSK subkey as ADSK subkey. * gpg: Fix --quick-set-expire for V5 subkey fingerprints. * gpg: Robust error handling for SCD READKEY. * gpg: Fix cv25519 v5 export regression. * gpgsm: Nearly fourfold speedup of validated certificate listings. * gpgsm: Improvement for some rare P12 files. * gpgsm: Terminate key listing on output write error. * agent: Add option --status to the LISTRUSTED command. * agent: Fix detection of the yet unused trustflag de-vs. * agent: Allow ssh to sign data larger than the Assuan line length. * keyboxd: Fix a race condition on the database handle. * dirmngr: A list of used URLs for loaded CRLs is printed first in the output of the LISTCRL command. * scd: More mitigations against lock ups with multiple cards or apps. * gpgtar: Use log-file from common.conf only in --batch mode. * gpgtar: Fix directory creation during extraction. * gpg-mail-tube: Minor fixes. * gpgconf: Add list flag to trusted-key et al. * Implement GNUPG_ASSUME_COMPLIANCE envvar and registry key for testing de-vs compliance mode. * Enable additional runtime protections in speedo builds for windows. * Fix a race condition in creating the socket directory. * Fix a build problem on macOS (missing unistd.h). (From OE-Core rev: 2ab817c434ac443e29d66105056675d6256e8a2c) Signed-off-by: Wang Mingyu Signed-off-by: Richard Purdie --- .../gnupg/0001-fix-compile-failure-with-musl.patch | 8 +-- meta/recipes-support/gnupg/gnupg/relocate.patch | 18 ++--- meta/recipes-support/gnupg/gnupg_2.5.1.bb | 84 ---------------------- meta/recipes-support/gnupg/gnupg_2.5.2.bb | 84 ++++++++++++++++++++++ 4 files changed, 97 insertions(+), 97 deletions(-) delete mode 100644 meta/recipes-support/gnupg/gnupg_2.5.1.bb create mode 100644 meta/recipes-support/gnupg/gnupg_2.5.2.bb diff --git a/meta/recipes-support/gnupg/gnupg/0001-fix-compile-failure-with-musl.patch b/meta/recipes-support/gnupg/gnupg/0001-fix-compile-failure-with-musl.patch index 13c1a36366..ec99f4b10c 100644 --- a/meta/recipes-support/gnupg/gnupg/0001-fix-compile-failure-with-musl.patch +++ b/meta/recipes-support/gnupg/gnupg/0001-fix-compile-failure-with-musl.patch @@ -1,4 +1,4 @@ -From 2e7534f3f7694ba426615b2061c235908097bb9b Mon Sep 17 00:00:00 2001 +From 81c222ea179ef73fcae4b50c56342bdad4787a28 Mon Sep 17 00:00:00 2001 From: Hongxu Jia Date: Thu, 22 Aug 2024 15:31:16 +0800 Subject: [PATCH] fix compile failure with musl @@ -20,7 +20,7 @@ Signed-off-by: Hongxu Jia 1 file changed, 1 insertion(+) diff --git a/scd/app.c b/scd/app.c -index 525950e..7180178 100644 +index ba7bb23..7d41e53 100644 --- a/scd/app.c +++ b/scd/app.c @@ -24,6 +24,7 @@ @@ -29,5 +29,5 @@ index 525950e..7180178 100644 #include +#include - #include "scdaemon.h" - #include "../common/exechelp.h" + #ifndef HAVE_W32_SYSTEM + #include /* F_SETFD F_GETFL F_SETFL O_NONBLOCK fcntl(2) */ diff --git a/meta/recipes-support/gnupg/gnupg/relocate.patch b/meta/recipes-support/gnupg/gnupg/relocate.patch index 6fcbc2d18f..08e70fb444 100644 --- a/meta/recipes-support/gnupg/gnupg/relocate.patch +++ b/meta/recipes-support/gnupg/gnupg/relocate.patch @@ -1,4 +1,4 @@ -From 3c761174b0ec6f49f184f16a0b0eaade44264edc Mon Sep 17 00:00:00 2001 +From 93fef8f493ee66856ef02351da25583eea94202d Mon Sep 17 00:00:00 2001 From: Ross Burton Date: Wed, 19 Sep 2018 14:44:40 +0100 Subject: [PATCH] Allow the environment to override where gnupg looks for its @@ -13,10 +13,10 @@ Signed-off-by: Alexander Kanavin 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/common/homedir.c b/common/homedir.c -index a73182e..9994a9a 100644 +index d26ddd9..24224c0 100644 --- a/common/homedir.c +++ b/common/homedir.c -@@ -1439,7 +1439,7 @@ gnupg_socketdir (void) +@@ -1451,7 +1451,7 @@ gnupg_socketdir (void) if (!name) { unsigned int dummy; @@ -25,7 +25,7 @@ index a73182e..9994a9a 100644 gpgrt_annotate_leaked_object (name); } -@@ -1468,7 +1468,7 @@ gnupg_sysconfdir (void) +@@ -1480,7 +1480,7 @@ gnupg_sysconfdir (void) if (dir) return dir; else @@ -34,7 +34,7 @@ index a73182e..9994a9a 100644 #endif /*!HAVE_W32_SYSTEM*/ } -@@ -1504,7 +1504,7 @@ gnupg_bindir (void) +@@ -1516,7 +1516,7 @@ gnupg_bindir (void) return name; } else @@ -43,7 +43,7 @@ index a73182e..9994a9a 100644 #endif /*!HAVE_W32_SYSTEM*/ } -@@ -1531,7 +1531,7 @@ gnupg_libexecdir (void) +@@ -1543,7 +1543,7 @@ gnupg_libexecdir (void) return name; } else @@ -52,7 +52,7 @@ index a73182e..9994a9a 100644 #endif /*!HAVE_W32_SYSTEM*/ } -@@ -1561,7 +1561,7 @@ gnupg_libdir (void) +@@ -1573,7 +1573,7 @@ gnupg_libdir (void) return name; } else @@ -61,7 +61,7 @@ index a73182e..9994a9a 100644 #endif /*!HAVE_W32_SYSTEM*/ } -@@ -1592,7 +1592,7 @@ gnupg_datadir (void) +@@ -1604,7 +1604,7 @@ gnupg_datadir (void) return name; } else @@ -70,7 +70,7 @@ index a73182e..9994a9a 100644 #endif /*!HAVE_W32_SYSTEM*/ } -@@ -1624,7 +1624,7 @@ gnupg_localedir (void) +@@ -1636,7 +1636,7 @@ gnupg_localedir (void) return name; } else diff --git a/meta/recipes-support/gnupg/gnupg_2.5.1.bb b/meta/recipes-support/gnupg/gnupg_2.5.1.bb deleted file mode 100644 index 080056f74c..0000000000 --- a/meta/recipes-support/gnupg/gnupg_2.5.1.bb +++ /dev/null @@ -1,84 +0,0 @@ -SUMMARY = "GNU Privacy Guard - encryption and signing tools (2.x)" -DESCRIPTION = "A complete and free implementation of the OpenPGP standard \ -as defined by RFC4880 (also known as PGP). GnuPG allows you to encrypt \ -and sign your data and communications; it features a versatile key \ -management system, along with access modules for all kinds of public \ -key directories." -HOMEPAGE = "http://www.gnupg.org/" -LICENSE = "GPL-3.0-only & LGPL-3.0-only" -LIC_FILES_CHKSUM = "file://COPYING;md5=189af8afca6d6075ba6c9e0aa8077626 \ - file://COPYING.LGPL3;md5=a2b6bf2cb38ee52619e60f30a1fc7257" - -DEPENDS = "npth libassuan libksba zlib bzip2 readline libgcrypt" - -inherit autotools gettext texinfo pkgconfig - -UPSTREAM_CHECK_URI = "https://gnupg.org/download/index.html" -SRC_URI = "${GNUPG_MIRROR}/${BPN}/${BPN}-${PV}.tar.bz2 \ - file://0002-use-pkgconfig-instead-of-npth-config.patch \ - file://0004-autogen.sh-fix-find-version-for-beta-checking.patch \ - file://0001-Woverride-init-is-not-needed-with-gcc-9.patch \ - file://0001-fix-compile-failure-with-musl.patch \ - " -SRC_URI:append:class-native = " file://0001-configure.ac-use-a-custom-value-for-the-location-of-.patch \ - file://relocate.patch" -SRC_URI:append:class-nativesdk = " file://relocate.patch" - -SRC_URI[sha256sum] = "8a34bb318499867962c939e156666ada93ed81f01926590ac68f3ff79178375e" - -EXTRA_OECONF = "--disable-ldap \ - --disable-ccid-driver \ - --with-zlib=${STAGING_LIBDIR}/.. \ - --with-bzip2=${STAGING_LIBDIR}/.. \ - --with-readline=${STAGING_LIBDIR}/.. \ - --with-mailprog=${sbindir}/sendmail \ - --disable-tests \ - --disable-doc \ - " - -# A minimal package containing just enough to run gpg+gpgagent (E.g. use gpgme in opkg) -PACKAGES =+ "${PN}-gpg" -FILES:${PN}-gpg = " \ - ${bindir}/gpg \ - ${bindir}/gpg-agent \ -" - -# Normal package (gnupg) should depend on minimal package (gnupg-gpg) -# to ensure all tools are included. This is done only in non-native -# builds. Native builds don't have sub-packages, so appending RDEPENDS -# in this case breaks recipe parsing. -RDEPENDS:${PN} += "${@ "" if ("native" in d.getVar("PN")) else (d.getVar("PN") + "-gpg")}" - -RRECOMMENDS:${PN} = "pinentry" - -do_configure:prepend () { - # Else these could be used in prefernce to those in aclocal-copy - rm -f ${S}/m4/gpg-error.m4 - rm -f ${S}/m4/libassuan.m4 - rm -f ${S}/m4/ksba.m4 - rm -f ${S}/m4/libgcrypt.m4 -} - -do_install:append:class-native() { - create_wrappers ${STAGING_BINDIR_NATIVE} -} - -do_install:append:class-nativesdk() { - create_wrappers ${SDKPATHNATIVE}${bindir_nativesdk} -} - -create_wrappers() { - for i in gpg gpgconf gpg-agent gpg-connect-agent; do - create_wrapper ${D}${bindir}/$i GNUPG_BINDIR=$1 - done -} - -PACKAGECONFIG ??= "gnutls" -PACKAGECONFIG[gnutls] = "--enable-gnutls, --disable-gnutls, gnutls" -PACKAGECONFIG[sqlite3] = "--enable-sqlite, --disable-sqlite, sqlite3" - -BBCLASSEXTEND = "native nativesdk" - -lcl_maybe_fortify:mipsarch = "" - -CVE_STATUS[CVE-2022-3219] = "upstream-wontfix: Upstream doesn't seem to be keen on merging the proposed commit - https://dev.gnupg.org/T5993" diff --git a/meta/recipes-support/gnupg/gnupg_2.5.2.bb b/meta/recipes-support/gnupg/gnupg_2.5.2.bb new file mode 100644 index 0000000000..64c63e31ce --- /dev/null +++ b/meta/recipes-support/gnupg/gnupg_2.5.2.bb @@ -0,0 +1,84 @@ +SUMMARY = "GNU Privacy Guard - encryption and signing tools (2.x)" +DESCRIPTION = "A complete and free implementation of the OpenPGP standard \ +as defined by RFC4880 (also known as PGP). GnuPG allows you to encrypt \ +and sign your data and communications; it features a versatile key \ +management system, along with access modules for all kinds of public \ +key directories." +HOMEPAGE = "http://www.gnupg.org/" +LICENSE = "GPL-3.0-only & LGPL-3.0-only" +LIC_FILES_CHKSUM = "file://COPYING;md5=189af8afca6d6075ba6c9e0aa8077626 \ + file://COPYING.LGPL3;md5=a2b6bf2cb38ee52619e60f30a1fc7257" + +DEPENDS = "npth libassuan libksba zlib bzip2 readline libgcrypt" + +inherit autotools gettext texinfo pkgconfig + +UPSTREAM_CHECK_URI = "https://gnupg.org/download/index.html" +SRC_URI = "${GNUPG_MIRROR}/${BPN}/${BPN}-${PV}.tar.bz2 \ + file://0002-use-pkgconfig-instead-of-npth-config.patch \ + file://0004-autogen.sh-fix-find-version-for-beta-checking.patch \ + file://0001-Woverride-init-is-not-needed-with-gcc-9.patch \ + file://0001-fix-compile-failure-with-musl.patch \ + " +SRC_URI:append:class-native = " file://0001-configure.ac-use-a-custom-value-for-the-location-of-.patch \ + file://relocate.patch" +SRC_URI:append:class-nativesdk = " file://relocate.patch" + +SRC_URI[sha256sum] = "7f404ccc6a58493fedc15faef59f3ae914831cff866a23f0bf9d66cfdd0fea29" + +EXTRA_OECONF = "--disable-ldap \ + --disable-ccid-driver \ + --with-zlib=${STAGING_LIBDIR}/.. \ + --with-bzip2=${STAGING_LIBDIR}/.. \ + --with-readline=${STAGING_LIBDIR}/.. \ + --with-mailprog=${sbindir}/sendmail \ + --disable-tests \ + --disable-doc \ + " + +# A minimal package containing just enough to run gpg+gpgagent (E.g. use gpgme in opkg) +PACKAGES =+ "${PN}-gpg" +FILES:${PN}-gpg = " \ + ${bindir}/gpg \ + ${bindir}/gpg-agent \ +" + +# Normal package (gnupg) should depend on minimal package (gnupg-gpg) +# to ensure all tools are included. This is done only in non-native +# builds. Native builds don't have sub-packages, so appending RDEPENDS +# in this case breaks recipe parsing. +RDEPENDS:${PN} += "${@ "" if ("native" in d.getVar("PN")) else (d.getVar("PN") + "-gpg")}" + +RRECOMMENDS:${PN} = "pinentry" + +do_configure:prepend () { + # Else these could be used in prefernce to those in aclocal-copy + rm -f ${S}/m4/gpg-error.m4 + rm -f ${S}/m4/libassuan.m4 + rm -f ${S}/m4/ksba.m4 + rm -f ${S}/m4/libgcrypt.m4 +} + +do_install:append:class-native() { + create_wrappers ${STAGING_BINDIR_NATIVE} +} + +do_install:append:class-nativesdk() { + create_wrappers ${SDKPATHNATIVE}${bindir_nativesdk} +} + +create_wrappers() { + for i in gpg gpgconf gpg-agent gpg-connect-agent; do + create_wrapper ${D}${bindir}/$i GNUPG_BINDIR=$1 + done +} + +PACKAGECONFIG ??= "gnutls" +PACKAGECONFIG[gnutls] = "--enable-gnutls, --disable-gnutls, gnutls" +PACKAGECONFIG[sqlite3] = "--enable-sqlite, --disable-sqlite, sqlite3" + +BBCLASSEXTEND = "native nativesdk" + +lcl_maybe_fortify:mipsarch = "" + +CVE_STATUS[CVE-2022-3219] = "upstream-wontfix: Upstream doesn't seem to be keen on merging the proposed commit - https://dev.gnupg.org/T5993" -- cgit v1.2.3-54-g00ecf