NetCube-Systems-Austria/kumquat-buildroot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
dbd2132cd5
kumquat-buildroot/package/gnupg/gnupg.mk

90 lines
2.1 KiB
Makefile
Raw Normal View History

Normalize separator size to 80 Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com> Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2013-06-06 01:53:30 +02:00
################################################################################
package: add gnupg Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2012-10-15 09:19:55 +02:00
#
# gnupg
#
Normalize separator size to 80 Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com> Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2013-06-06 01:53:30 +02:00
################################################################################
package: add gnupg Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2012-10-15 09:19:55 +02:00
gnupg: security bump to version 1.4.23 Fixes CVE-2018-12020: Unsanitized file names might cause injection of terminal control characters into the status output of gnupg. Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-06-11 18:08:43 +02:00
GNUPG_VERSION = 1.4.23
package: add gnupg Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2012-10-15 09:19:55 +02:00
GNUPG_SOURCE = gnupg-$(GNUPG_VERSION).tar.bz2
gnupg: security bump to version 1.4.22 Mitigate a flush+reload side-channel attack on RSA secret keys dubbed "Sliding right into disaster". For details see <https://eprint.iacr.org/2017/627>. [CVE-2017-7526] Switch to https site for better firewall compatibility and security. Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2017-08-30 14:01:04 +02:00
GNUPG_SITE = https://gnupg.org/ftp/gcrypt/gnupg
boot, package: use SPDX short identifier for GPLv3/GPLv3+ We want to use SPDX identifier for license string as much as possible. SPDX short identifier for GPLv3/GPLv3+ is GPL-3.0/GPL-3.0+. This change is done using following command. find . -name "*.mk" | xargs sed -ri '/LICENSE( )?[\+:]?=/s/\<GPLv3\>/GPL-3.0/g' Signed-off-by: Rahul Bedarkar <rahulbedarkar89@gmail.com> Acked-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2017-03-30 15:43:33 +02:00
GNUPG_LICENSE = GPL-3.0+
package: add gnupg Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2012-10-15 09:19:55 +02:00
GNUPG_LICENSE_FILES = COPYING
gnupg: drop mandatory dependency on ncurses This package only needs ncurses when readline support is enabled, as it's the autoconf macro file for readline (used by autoconf to create the gnupg configure script) that checks for and pulls in ncurses. Since readline already depends on ncurses, gnupg need only depend on readline (when enabled). The host package always forces readline support off, so the host-ncurses dependency can be removed entirely. Signed-off-by: Trent Piepho <tpiepho@impinj.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2018-10-03 02:25:48 +02:00
GNUPG_DEPENDENCIES = zlib $(if $(BR2_PACKAGE_LIBICONV),libiconv)
gnupg: don't prefix assembly level functions with underscore Fixes http://autobuild.buildroot.net/results/45a0856bafa9f2f7e86e2c063528c2b5b04c08d6 gnupg's configure script defaults to prepending an underscore ('_') to the assembly level functions, which isn't correct for Linux and causes linker errors for the archs where it has asm optimizations. Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2012-10-16 22:05:19 +02:00
GNUPG_CONF_ENV = ac_cv_sys_symbol_underscore=no
gnupg: enable support for SHA-256 and SHA-512 hashes Signed-off-by: Jack Breese <jack@kumunetworks.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2017-04-07 03:09:43 +02:00
GNUPG_CONF_OPTS = \
--disable-rpath \
--enable-minimal \
--disable-regex \
--enable-sha256 \
--enable-sha512
package: add gnupg Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2012-10-15 09:19:55 +02:00
gnupg: drop mandatory dependency on ncurses This package only needs ncurses when readline support is enabled, as it's the autoconf macro file for readline (used by autoconf to create the gnupg configure script) that checks for and pulls in ncurses. Since readline already depends on ncurses, gnupg need only depend on readline (when enabled). The host package always forces readline support off, so the host-ncurses dependency can be removed entirely. Signed-off-by: Trent Piepho <tpiepho@impinj.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2018-10-03 02:25:48 +02:00
HOST_GNUPG_DEPENDENCIES = host-zlib
gnupg: add host package For E.G. post-build / post-image scripts as it generally cannot be expected to be available on the build host and/or there are some differences in behaviour between gnupg 1.x / 2.x. Provide gnupg 1.x instead of 2.x, as it is simpler to build (less dependencies) and easier to use in post-build / post-image scripts (E.G. no gpg-agent that keeps running in the background). Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-12-11 18:04:29 +01:00
HOST_GNUPG_CONF_OPTS = \
--disable-rpath \
--enable-minimal \
--disable-regex \
--enable-sha256 \
--enable-sha512 \
--enable-aes \
--enable-rsa \
--without-libcurl \
--without-readline
gnupg: disable assembly optimization for coldfire Fixes: http://autobuild.buildroot.net/results/d25425cff055a14b9285cefb0775bc138eb2f914/ Signed-off-by: Waldemar Brodkorb <wbx@openadk.org> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2016-07-31 10:27:19 +02:00
# gnupg doesn't support assembly for coldfire
ifeq ($(BR2_m68k_cf),y)
GNUPG_CONF_OPTS += --disable-asm
endif
package: add gnupg Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2012-10-15 09:19:55 +02:00
ifeq ($(BR2_PACKAGE_BZIP2),y)
packages: rename FOO_CONF_OPT into FOO_CONF_OPTS To be consistent with the recent change of FOO_MAKE_OPT into FOO_MAKE_OPTS, make the same change for FOO_CONF_OPT. Sed command used: find * -type f | xargs sed -i 's#_CONF_OPT\>#&S#g' Signed-off-by: Thomas De Schampheleire <thomas.de.schampheleire@gmail.com> Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2014-09-27 21:32:44 +02:00
GNUPG_CONF_OPTS += --enable-bzip2
package: add gnupg Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2012-10-15 09:19:55 +02:00
GNUPG_DEPENDENCIES += bzip2
endif
ifeq ($(BR2_PACKAGE_LIBCURL),y)
GNUPG_CONF_ENV += ac_cv_path__libcurl_config=$(STAGING_DIR)/usr/bin/curl-config
GNUPG_DEPENDENCIES += libcurl
else
packages: rename FOO_CONF_OPT into FOO_CONF_OPTS To be consistent with the recent change of FOO_MAKE_OPT into FOO_MAKE_OPTS, make the same change for FOO_CONF_OPT. Sed command used: find * -type f | xargs sed -i 's#_CONF_OPT\>#&S#g' Signed-off-by: Thomas De Schampheleire <thomas.de.schampheleire@gmail.com> Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2014-09-27 21:32:44 +02:00
GNUPG_CONF_OPTS += --without-libcurl
package: add gnupg Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2012-10-15 09:19:55 +02:00
endif
ifeq ($(BR2_PACKAGE_READLINE),y)
GNUPG_DEPENDENCIES += readline
else
packages: rename FOO_CONF_OPT into FOO_CONF_OPTS To be consistent with the recent change of FOO_MAKE_OPT into FOO_MAKE_OPTS, make the same change for FOO_CONF_OPT. Sed command used: find * -type f | xargs sed -i 's#_CONF_OPT\>#&S#g' Signed-off-by: Thomas De Schampheleire <thomas.de.schampheleire@gmail.com> Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2014-09-27 21:32:44 +02:00
GNUPG_CONF_OPTS += --without-readline
package: add gnupg Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2012-10-15 09:19:55 +02:00
endif
gnupg: add option for AES cipher Similar to our RSA option. Enabling this adds ~17K to the gpg binary (ARMv7): ls -lah output/target/usr/bin/gpg{.orig,} -rwxr-xr-x 1 peko peko 532K Jul 2 17:29 output/target/usr/bin/gpg -rwxr-xr-x 1 peko peko 515K Jul 2 17:29 output/target/usr/bin/gpg.orig Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2015-07-02 17:30:24 +02:00
ifeq ($(BR2_PACKAGE_GNUPG_AES),y)
GNUPG_CONF_OPTS += --enable-aes
else
GNUPG_CONF_OPTS += --disable-aes
endif
gnupg: option to include RSA support. gnupg is compiled with --enable-minimal flag. This produces a binary that only supports ElGamal and DSA public key algorithms. RSA has been the default for `gpg --gen-key` since 2009, so it makes sense to be able to build a gnupg binary that supports it. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2013-09-30 02:25:20 +02:00
ifeq ($(BR2_PACKAGE_GNUPG_RSA),y)
packages: rename FOO_CONF_OPT into FOO_CONF_OPTS To be consistent with the recent change of FOO_MAKE_OPT into FOO_MAKE_OPTS, make the same change for FOO_CONF_OPT. Sed command used: find * -type f | xargs sed -i 's#_CONF_OPT\>#&S#g' Signed-off-by: Thomas De Schampheleire <thomas.de.schampheleire@gmail.com> Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2014-09-27 21:32:44 +02:00
GNUPG_CONF_OPTS += --enable-rsa
gnupg: option to include RSA support. gnupg is compiled with --enable-minimal flag. This produces a binary that only supports ElGamal and DSA public key algorithms. RSA has been the default for `gpg --gen-key` since 2009, so it makes sense to be able to build a gnupg binary that supports it. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2013-09-30 02:25:20 +02:00
else
packages: rename FOO_CONF_OPT into FOO_CONF_OPTS To be consistent with the recent change of FOO_MAKE_OPT into FOO_MAKE_OPTS, make the same change for FOO_CONF_OPT. Sed command used: find * -type f | xargs sed -i 's#_CONF_OPT\>#&S#g' Signed-off-by: Thomas De Schampheleire <thomas.de.schampheleire@gmail.com> Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2014-09-27 21:32:44 +02:00
GNUPG_CONF_OPTS += --disable-rsa
gnupg: option to include RSA support. gnupg is compiled with --enable-minimal flag. This produces a binary that only supports ElGamal and DSA public key algorithms. RSA has been the default for `gpg --gen-key` since 2009, so it makes sense to be able to build a gnupg binary that supports it. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2013-09-30 02:25:20 +02:00
endif
package: add gnupg Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2012-10-15 09:19:55 +02:00
ifneq ($(BR2_PACKAGE_GNUPG_GPGV),y)
define GNUPG_REMOVE_GPGV
gnupg: don't bother removing a man page The target-finalize target in the main Makefile removes $(TARGET_DIR)/usr/share/man entirely, so there's no point in having some package specific logic to remove man pages. Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Acked-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2014-11-30 15:18:23 +01:00
rm -f $(TARGET_DIR)/usr/bin/gpgv
package: add gnupg Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2012-10-15 09:19:55 +02:00
endef
GNUPG_POST_INSTALL_TARGET_HOOKS += GNUPG_REMOVE_GPGV
endif
ifneq ($(BR2_PACKAGE_GNUPG_GPGSPLIT),y)
define GNUPG_REMOVE_GPGSPLIT
rm -f $(TARGET_DIR)/usr/bin/gpgsplit
endef
GNUPG_POST_INSTALL_TARGET_HOOKS += GNUPG_REMOVE_GPGSPLIT
endif
package/gnupg: fix TAR path in gpg-zip script gnupg installs a shell script called gpg-zip, which contains a reference to the 'tar' program. Unfortunately, the location of the tar program is determined at build time, and is therefore incorrect on the target. This causes runtime issues, but also potentially leaks some host paths into the target, causing BR2_REPRODUCIBLE=y failures. gnupg has a --with-tar option, but it doesn't work properly as the implementation of the GNUPG_CHECK_USTAR m4 macro in m4/tar-ustar.m4 is incomplete: - If --with-tar is passed, AC_PATH_PROG is not called, so the TAR variable is not defined and AC_SUBST([TAR]) is not called, so the @TAR@ replacement in tools/gpg-zip.in is replaced by the empty string. - If --with-tar is passed, the check that this tar version support the ustar format is not executed, so the HAVE_USTAR automake conditional is never defined. There is unfortunately no way to determine if the target tar supports ustar or not, but since even the Busybox variant apparently does, we can probably assume all tar versions that Buildroot can build support the ustar format. Fixing this logic is a bit cumbersome, gnupg 1.4.x is not really maintained anymore and fixing the logic would require an AUTORECONF = YES. So we just opt with a very simple solution: replace TAR=something by TAR=/bin/tar, through a post-install target hook. We only do this if gpg-zip is installed, since its installation is optional. Note that the logic is still not ideal, because the installation (or not) of gpg-zip depends on whether the system/host tar has ustar format or not. Fixes the gpg-zip reproducibility issue reported in: http://autobuild.buildroot.net/results/d1c/d1c5ad34ba928edfbb5901eb936c7e4457cc9083//diffoscope-results.txt Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2019-12-26 23:14:36 +01:00
define GNUPG_FIXUP_GPG_ZIP
test -f $(TARGET_DIR)/usr/bin/gpg-zip && \
$(SED) 's%^TAR=.*%TAR=/bin/tar%' $(TARGET_DIR)/usr/bin/gpg-zip
endef
GNUPG_POST_INSTALL_TARGET_HOOKS += GNUPG_FIXUP_GPG_ZIP
package: add gnupg Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2012-10-15 09:19:55 +02:00
$(eval $(autotools-package))
gnupg: add host package For E.G. post-build / post-image scripts as it generally cannot be expected to be available on the build host and/or there are some differences in behaviour between gnupg 1.x / 2.x. Provide gnupg 1.x instead of 2.x, as it is simpler to build (less dependencies) and easier to use in post-build / post-image scripts (E.G. no gpg-agent that keeps running in the background). Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-12-11 18:04:29 +01:00
$(eval $(host-autotools-package))
Reference in New Issue Copy Permalink