From ce3415da91920ed9f89beea962889e8c94b7aa08 Mon Sep 17 00:00:00 2001 From: Ross Burton Date: Wed, 25 Sep 2024 13:12:14 +0100 Subject: gnutls: upgrade to 3.8.7.1 A notable change in 3.8.7 is that the linkage to compression libraries was changed to use a new tool called dlwrap, so these libraries should be loaded at runtime with dlopen() instead of dynamically linked at build time. However, the dlopen() detection fails in cross builds[1] and it falls back to dynamic linking so this isn't an issue we need to deal with at present. Also note that whilst dlwrap is a tool written in rust that needs the clang includes, it's a maintainer tool and the generated files are in git, so we should never need to rerun it. Backport a patch to fix AM_CONDITIONAL to resolve linkage problems. The 3.8.7.1 tarball is actually just a rebuild of 3.8.7 with the translations included (which were missing in 3.8.7), so set S explicitly for this release. [1] https://gitlab.com/gnutls/gnutls/-/issues/1583 (From OE-Core rev: d38f32f493192fa5965f7271ef6ba5aae33849f5) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie --- .../gnutls/gnutls/conditional.patch | 42 +++++++++ meta/recipes-support/gnutls/gnutls_3.8.6.bb | 100 -------------------- meta/recipes-support/gnutls/gnutls_3.8.7.1.bb | 104 +++++++++++++++++++++ 3 files changed, 146 insertions(+), 100 deletions(-) create mode 100644 meta/recipes-support/gnutls/gnutls/conditional.patch delete mode 100644 meta/recipes-support/gnutls/gnutls_3.8.6.bb create mode 100644 meta/recipes-support/gnutls/gnutls_3.8.7.1.bb diff --git a/meta/recipes-support/gnutls/gnutls/conditional.patch b/meta/recipes-support/gnutls/gnutls/conditional.patch new file mode 100644 index 0000000000..2ff532fb53 --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/conditional.patch @@ -0,0 +1,42 @@ +From 292f96f26d7ce80e4a165c903c4fd569b85c1c1f Mon Sep 17 00:00:00 2001 +From: Daiki Ueno +Date: Fri, 16 Aug 2024 09:42:15 +0900 +Subject: [PATCH] build: fix setting AM_CONDITIONAL for brotli and zstd + +As the with_{libbrotli,libzsttd} variables are unset if configured +with --without-{brotli,zstd}, check the unequality to "no" doesn't +work; use explicit matching with "yes" instead. + +Signed-off-by: Daiki Ueno + +Upstream-Status: Backport +Signed-off-by: Ross Burton +--- + configure.ac | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/configure.ac b/configure.ac +index 95ec4c1515..a476176800 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -1158,7 +1158,7 @@ if test x$ac_brotli != xno; then + else + AC_MSG_RESULT(no) + fi +-AM_CONDITIONAL(HAVE_LIBBROTLI, test "$with_libbrotlienc" != "no" && test "$with_libbrotlidec" != "no") ++AM_CONDITIONAL(HAVE_LIBBROTLI, test "$with_libbrotlienc" = yes && test "$with_libbrotlidec" = yes) + + AS_IF([test "$ac_cv_dlopen_soname_works" = yes], [ + save_CFLAGS=$CFLAGS +@@ -1203,7 +1203,7 @@ if test x$ac_zstd != xno; then + else + AC_MSG_RESULT(no) + fi +-AM_CONDITIONAL(HAVE_LIBZSTD, test "$with_libzstd" != "no") ++AM_CONDITIONAL(HAVE_LIBZSTD, test "$with_libzstd" = yes) + + AS_IF([test "$ac_cv_dlopen_soname_works" = yes], [ + save_CFLAGS=$CFLAGS +-- +GitLab + diff --git a/meta/recipes-support/gnutls/gnutls_3.8.6.bb b/meta/recipes-support/gnutls/gnutls_3.8.6.bb deleted file mode 100644 index 37d12fb5ea..0000000000 --- a/meta/recipes-support/gnutls/gnutls_3.8.6.bb +++ /dev/null @@ -1,100 +0,0 @@ -SUMMARY = "GNU Transport Layer Security Library" -DESCRIPTION = "a secure communications library implementing the SSL, \ -TLS and DTLS protocols and technologies around them." -HOMEPAGE = "https://gnutls.org/" -BUGTRACKER = "https://savannah.gnu.org/support/?group=gnutls" - -LICENSE = "GPL-3.0-or-later & LGPL-2.1-or-later" -LICENSE:${PN} = "LGPL-2.1-or-later" -LICENSE:${PN}-xx = "LGPL-2.1-or-later" -LICENSE:${PN}-bin = "GPL-3.0-or-later" -LICENSE:${PN}-openssl = "GPL-3.0-or-later" - -LIC_FILES_CHKSUM = "file://LICENSE;md5=71391c8e0c1cfe68077e7fce3b586283 \ - file://doc/COPYING;md5=1ebbd3e34237af26da5dc08a4e440464 \ - file://doc/COPYING.LESSER;md5=4fbd65380cdd255951079008b364516c" - -DEPENDS = "nettle gmp virtual/libiconv libunistring" - -SHRT_VER = "${@d.getVar('PV').split('.')[0]}.${@d.getVar('PV').split('.')[1]}" - -SRC_URI = "https://www.gnupg.org/ftp/gcrypt/gnutls/v${SHRT_VER}/gnutls-${PV}.tar.xz \ - file://arm_eabi.patch \ - file://0001-Creating-.hmac-file-should-be-excuted-in-target-envi.patch \ - file://run-ptest \ - file://Add-ptest-support.patch \ - " - -SRC_URI[sha256sum] = "2e1588aae53cb32d43937f1f4eca28febd9c0c7aa1734fc5dd61a7e81e0ebcdd" - -inherit autotools texinfo pkgconfig gettext lib_package gtk-doc ptest - -PACKAGECONFIG ??= "libidn libtasn1 ${@bb.utils.filter('DISTRO_FEATURES', 'seccomp', d)}" - -# You must also have CONFIG_SECCOMP enabled in the kernel for -# seccomp to work. -PACKAGECONFIG[seccomp] = "--with-libseccomp-prefix=${STAGING_EXECPREFIXDIR},ac_cv_libseccomp=no,libseccomp" -PACKAGECONFIG[libidn] = "--with-idn,--without-idn,libidn2" -PACKAGECONFIG[libtasn1] = "--without-included-libtasn1,--with-included-libtasn1,libtasn1" -PACKAGECONFIG[p11-kit] = "--with-p11-kit,--without-p11-kit,p11-kit" -PACKAGECONFIG[tpm] = "--with-tpm,--without-tpm,trousers" -PACKAGECONFIG[fips] = "--enable-fips140-mode --with-libdl-prefix=${STAGING_BASELIBDIR}" -PACKAGECONFIG[dane] = "--enable-libdane,--disable-libdane,unbound" -# Certificate compression -PACKAGECONFIG[brotli] = "--with-brotli,--without-brotli,brotli" -PACKAGECONFIG[zlib] = "--with-zlib,--without-zlib,zlib" -PACKAGECONFIG[zstd] = "--with-zstd,--without-zstd,zstd" - -EXTRA_OECONF = " \ - --enable-doc \ - --disable-rpath \ - --enable-openssl-compatibility \ - --with-libpthread-prefix=${STAGING_DIR_HOST}${prefix} \ - --with-librt-prefix=${STAGING_DIR_HOST}${prefix} \ - --with-default-trust-store-file=${sysconfdir}/ssl/certs/ca-certificates.crt \ -" - -# Otherwise the tools try and use HOSTTOOLS_DIR/bash as a shell. -export POSIX_SHELL="${base_bindir}/sh" - -do_configure:prepend() { - for dir in . lib; do - rm -f ${dir}/aclocal.m4 ${dir}/m4/libtool.m4 ${dir}/m4/lt*.m4 - done -} - -do_compile_ptest() { - oe_runmake -C tests buildtest-TESTS -} - -do_install:append:class-target() { - if ${@bb.utils.contains('PACKAGECONFIG', 'fips', 'true', 'false', d)}; then - install -d ${D}${bindir}/bin - install -m 0755 ${B}/lib/.libs/fipshmac ${D}/${bindir}/ - fi -} - -PACKAGES =+ "${PN}-dane ${PN}-openssl ${PN}-xx ${PN}-fips" - -FILES:${PN}-dev += "${bindir}/gnutls-cli-debug" - -FILES:${PN}-dane = "${libdir}/libgnutls-dane.so.*" -FILES:${PN}-openssl = "${libdir}/libgnutls-openssl.so.*" -FILES:${PN}-xx = "${libdir}/libgnutlsxx.so.*" -FILES:${PN}-fips = "${bindir}/fipshmac" - -RDEPENDS:${PN}-ptest += "python3" - -BBCLASSEXTEND = "native nativesdk" - -pkg_postinst_ontarget:${PN}-fips () { - if test -x ${bindir}/fipshmac - then - mkdir ${sysconfdir}/gnutls - touch ${sysconfdir}/gnutls/config - ${bindir}/fipshmac ${libdir}/libgnutls.so.30.*.* > ${libdir}/.libgnutls.so.30.hmac - ${bindir}/fipshmac ${libdir}/libnettle.so.8.* > ${libdir}/.libnettle.so.8.hmac - ${bindir}/fipshmac ${libdir}/libgmp.so.10.*.* > ${libdir}/.libgmp.so.10.hmac - ${bindir}/fipshmac ${libdir}/libhogweed.so.6.* > ${libdir}/.libhogweed.so.6.hmac - fi -} diff --git a/meta/recipes-support/gnutls/gnutls_3.8.7.1.bb b/meta/recipes-support/gnutls/gnutls_3.8.7.1.bb new file mode 100644 index 0000000000..b381520e2e --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls_3.8.7.1.bb @@ -0,0 +1,104 @@ +SUMMARY = "GNU Transport Layer Security Library" +DESCRIPTION = "a secure communications library implementing the SSL, \ +TLS and DTLS protocols and technologies around them." +HOMEPAGE = "https://gnutls.org/" +BUGTRACKER = "https://savannah.gnu.org/support/?group=gnutls" + +LICENSE = "GPL-3.0-or-later & LGPL-2.1-or-later" +LICENSE:${PN} = "LGPL-2.1-or-later" +LICENSE:${PN}-xx = "LGPL-2.1-or-later" +LICENSE:${PN}-bin = "GPL-3.0-or-later" +LICENSE:${PN}-openssl = "GPL-3.0-or-later" + +LIC_FILES_CHKSUM = "file://LICENSE;md5=71391c8e0c1cfe68077e7fce3b586283 \ + file://doc/COPYING;md5=1ebbd3e34237af26da5dc08a4e440464 \ + file://doc/COPYING.LESSER;md5=4fbd65380cdd255951079008b364516c" + +DEPENDS = "nettle gmp virtual/libiconv libunistring" + +SHRT_VER = "${@d.getVar('PV').split('.')[0]}.${@d.getVar('PV').split('.')[1]}" + +SRC_URI = "https://www.gnupg.org/ftp/gcrypt/gnutls/v${SHRT_VER}/gnutls-${PV}.tar.xz \ + file://arm_eabi.patch \ + file://0001-Creating-.hmac-file-should-be-excuted-in-target-envi.patch \ + file://conditional.patch \ + file://run-ptest \ + file://Add-ptest-support.patch \ + " + +SRC_URI[sha256sum] = "9ca0ddaccce28a74fa18d738744190afb3b0daebef74e6ad686bf7bef99abd60" + +# This is only needed for 3.8.7.1, remove when upgrading to 3.8.8 onwards +S = "${WORKDIR}/gnutls-3.8.7" + +inherit autotools texinfo pkgconfig gettext lib_package gtk-doc ptest + +PACKAGECONFIG ??= "libidn libtasn1 ${@bb.utils.filter('DISTRO_FEATURES', 'seccomp', d)}" + +# You must also have CONFIG_SECCOMP enabled in the kernel for +# seccomp to work. +PACKAGECONFIG[seccomp] = "--with-libseccomp-prefix=${STAGING_EXECPREFIXDIR},ac_cv_libseccomp=no,libseccomp" +PACKAGECONFIG[libidn] = "--with-idn,--without-idn,libidn2" +PACKAGECONFIG[libtasn1] = "--without-included-libtasn1,--with-included-libtasn1,libtasn1" +PACKAGECONFIG[p11-kit] = "--with-p11-kit,--without-p11-kit,p11-kit" +PACKAGECONFIG[tpm] = "--with-tpm,--without-tpm,trousers" +PACKAGECONFIG[fips] = "--enable-fips140-mode --with-libdl-prefix=${STAGING_BASELIBDIR}" +PACKAGECONFIG[dane] = "--enable-libdane,--disable-libdane,unbound" +# Certificate compression +PACKAGECONFIG[brotli] = "--with-brotli,--without-brotli,brotli" +PACKAGECONFIG[zlib] = "--with-zlib,--without-zlib,zlib" +PACKAGECONFIG[zstd] = "--with-zstd,--without-zstd,zstd" + +EXTRA_OECONF = " \ + --enable-doc \ + --disable-rpath \ + --enable-openssl-compatibility \ + --with-libpthread-prefix=${STAGING_DIR_HOST}${prefix} \ + --with-librt-prefix=${STAGING_DIR_HOST}${prefix} \ + --with-default-trust-store-file=${sysconfdir}/ssl/certs/ca-certificates.crt \ +" + +# Otherwise the tools try and use HOSTTOOLS_DIR/bash as a shell. +export POSIX_SHELL="${base_bindir}/sh" + +do_configure:prepend() { + for dir in . lib; do + rm -f ${dir}/aclocal.m4 ${dir}/m4/libtool.m4 ${dir}/m4/lt*.m4 + done +} + +do_compile_ptest() { + oe_runmake -C tests buildtest-TESTS +} + +do_install:append:class-target() { + if ${@bb.utils.contains('PACKAGECONFIG', 'fips', 'true', 'false', d)}; then + install -d ${D}${bindir}/bin + install -m 0755 ${B}/lib/.libs/fipshmac ${D}/${bindir}/ + fi +} + +PACKAGES =+ "${PN}-dane ${PN}-openssl ${PN}-xx ${PN}-fips" + +FILES:${PN}-dev += "${bindir}/gnutls-cli-debug" + +FILES:${PN}-dane = "${libdir}/libgnutls-dane.so.*" +FILES:${PN}-openssl = "${libdir}/libgnutls-openssl.so.*" +FILES:${PN}-xx = "${libdir}/libgnutlsxx.so.*" +FILES:${PN}-fips = "${bindir}/fipshmac" + +RDEPENDS:${PN}-ptest += "python3" + +BBCLASSEXTEND = "native nativesdk" + +pkg_postinst_ontarget:${PN}-fips () { + if test -x ${bindir}/fipshmac + then + mkdir ${sysconfdir}/gnutls + touch ${sysconfdir}/gnutls/config + ${bindir}/fipshmac ${libdir}/libgnutls.so.30.*.* > ${libdir}/.libgnutls.so.30.hmac + ${bindir}/fipshmac ${libdir}/libnettle.so.8.* > ${libdir}/.libnettle.so.8.hmac + ${bindir}/fipshmac ${libdir}/libgmp.so.10.*.* > ${libdir}/.libgmp.so.10.hmac + ${bindir}/fipshmac ${libdir}/libhogweed.so.6.* > ${libdir}/.libhogweed.so.6.hmac + fi +} -- cgit v1.2.3-54-g00ecf