--- openssl-1.1.0f.ebuild 2017-10-11 21:44:59.835115343 -0700 +++ openssl-1.1.0f-r2.ebuild 2017-10-13 14:05:43.486927051 -0700 @@ -27,6 +27,27 @@ )" PDEPEND="app-misc/ca-certificates" +# This does not copy the entire Fedora patchset, but JUST the parts that +# are needed to make it safe to use EC with RESTRICT=bindist. +# See openssl.spec for the matching numbering of SourceNNN, PatchNNN +SOURCE1=hobble-openssl +SOURCE12=ec_curve.c +SOURCE13=ectest.c +PATCH1=openssl-1.1.0-build.patch # Fixes EVP testcase for EC +PATCH37=openssl-1.1.0-ec-curves.patch +FEDORA_GIT_BASE='https://src.fedoraproject.org/cgit/rpms/openssl.git/plain/' +FEDORA_GIT_BRANCH='f27' +FEDORA_SRC_URI=() +FEDORA_SOURCE=( $SOURCE1 $SOURCE12 $SOURCE13 ) +FEDORA_PATCH=( $PATCH1 $PATCH37 ) +for i in "${FEDORA_SOURCE[@]}" ; do + FEDORA_SRC_URI+=( "${FEDORA_GIT_BASE}/${i}?h=${FEDORA_GIT_BRANCH} -> ${P}_${i}" ) +done +for i in "${FEDORA_PATCH[@]}" ; do # Already have a version prefix + FEDORA_SRC_URI+=( "${FEDORA_GIT_BASE}/${i}?h=${FEDORA_GIT_BRANCH} -> ${i}" ) +done +SRC_URI+=" bindist? ( ${FEDORA_SRC_URI[@]} )" + S="${WORKDIR}/${MY_P}" MULTILIB_WRAPPED_HEADERS=( @@ -38,6 +59,23 @@ ) src_prepare() { + if use bindist; then + # This just removes the prefix, and puts it into WORKDIR like the RPM. + for i in "${FEDORA_SOURCE[@]}" ; do + cp -f "${DISTDIR}"/"${P}_${i}" "${WORKDIR}"/"${i}" || die + done + # .spec %prep + bash "${WORKDIR}"/"${SOURCE1}" || die + cp -f "${WORKDIR}"/"${SOURCE12}" "${S}"/crypto/ec/ || die + cp -f "${WORKDIR}"/"${SOURCE13}" "${S}"/test/ || die + for i in "${FEDORA_PATCH[@]}" ; do + epatch "${DISTDIR}"/"${i}" + done + # Also see the configure parts below: + # enable-ec \ + # $(use_ssl !bindist ec2m) \ + + fi # keep this in sync with app-misc/c_rehash SSL_CNF_DIR="/etc/ssl" @@ -132,13 +170,15 @@ [[ -z ${sslout} ]] && config="config" echoit \ + # Fedora hobbled-EC needs 'no-ec2m'. ./${config} \ ${sslout} \ --api=1.0.0 \ $(use cpu_flags_x86_sse2 || echo "no-sse2") \ enable-camellia \ disable-deprecated \ - $(use_ssl !bindist ec) \ + enable-ec \ + $(use_ssl !bindist ec2m) \ ${ec_nistp_64_gcc_128} \ enable-idea \ enable-mdc2 \