From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id A37BC15812D for ; Tue, 24 Dec 2024 03:31:09 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id D9B39E07A5; Tue, 24 Dec 2024 03:31:07 +0000 (UTC) Received: from smtp.gentoo.org (woodpecker.gentoo.org [140.211.166.183]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 1C504E078A for ; Tue, 24 Dec 2024 03:31:06 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 1ADD233C4EE for ; Tue, 24 Dec 2024 03:31:05 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 6E89BAF5 for ; Tue, 24 Dec 2024 03:31:03 +0000 (UTC) From: "Sam James" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Sam James" Message-ID: <1735010977.9efafffdb94d2f0674f05f153760065d7d9516c4.sam@gentoo> Subject: [gentoo-commits] repo/gentoo:master commit in: sys-fs/cryptsetup/, sys-fs/cryptsetup/files/ X-VCS-Repository: repo/gentoo X-VCS-Files: sys-fs/cryptsetup/cryptsetup-2.7.5-r1.ebuild sys-fs/cryptsetup/files/cryptsetup-2.7.5-compat-test-passwdqc.patch sys-fs/cryptsetup/metadata.xml X-VCS-Directories: sys-fs/cryptsetup/files/ sys-fs/cryptsetup/ X-VCS-Committer: sam X-VCS-Committer-Name: Sam James X-VCS-Revision: 9efafffdb94d2f0674f05f153760065d7d9516c4 X-VCS-Branch: master Date: Tue, 24 Dec 2024 03:31:03 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply X-Archives-Salt: 98070fc6-c882-4395-a1a9-29c47fb368cc X-Archives-Hash: 0e40710098ea9c9e57b9f3e9f45e9ea9 commit: 9efafffdb94d2f0674f05f153760065d7d9516c4 Author: Gabi Falk gmx com> AuthorDate: Mon Dec 23 18:00:00 2024 +0000 Commit: Sam James gentoo org> CommitDate: Tue Dec 24 03:29:37 2024 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9efafffd sys-fs/cryptsetup: add USE=passwdqc flag Signed-off-by: Gabi Falk gmx.com> Closes: https://github.com/gentoo/gentoo/pull/35726 Signed-off-by: Sam James gentoo.org> sys-fs/cryptsetup/cryptsetup-2.7.5-r1.ebuild | 155 +++++++++++++++++++++ .../cryptsetup-2.7.5-compat-test-passwdqc.patch | 58 ++++++++ sys-fs/cryptsetup/metadata.xml | 1 + 3 files changed, 214 insertions(+) diff --git a/sys-fs/cryptsetup/cryptsetup-2.7.5-r1.ebuild b/sys-fs/cryptsetup/cryptsetup-2.7.5-r1.ebuild new file mode 100644 index 000000000000..99ae9173e684 --- /dev/null +++ b/sys-fs/cryptsetup/cryptsetup-2.7.5-r1.ebuild @@ -0,0 +1,155 @@ +# Copyright 1999-2024 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=8 + +# TODO: meson +inherit linux-info tmpfiles + +DESCRIPTION="Tool to setup encrypted devices with dm-crypt" +HOMEPAGE="https://gitlab.com/cryptsetup/cryptsetup" +SRC_URI="https://www.kernel.org/pub/linux/utils/${PN}/v$(ver_cut 1-2)/${P/_/-}.tar.xz" +S="${WORKDIR}"/${P/_/-} + +LICENSE="GPL-2+" +SLOT="0/12" # libcryptsetup.so version +if [[ ${PV} != *_rc* ]] ; then + KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86" +fi + +CRYPTO_BACKENDS="gcrypt kernel nettle +openssl" +# we don't support nss since it doesn't allow cryptsetup to be built statically +# and it's missing ripemd160 support so it can't provide full backward compatibility +IUSE="${CRYPTO_BACKENDS} +argon2 fips nls pwquality passwdqc ssh static static-libs test +udev urandom" +RESTRICT="!test? ( test )" +# bug #496612, bug #832711, bug #843863 +REQUIRED_USE=" + ?? ( pwquality passwdqc ) + ^^ ( ${CRYPTO_BACKENDS//+/} ) + static? ( !ssh !udev !fips ) + static-libs? ( !passwdqc ) + fips? ( !kernel !nettle ) +" + +LIB_DEPEND=" + dev-libs/json-c:=[static-libs(+)] + dev-libs/popt[static-libs(+)] + >=sys-apps/util-linux-2.31-r1[static-libs(+)] + argon2? ( app-crypt/argon2:=[static-libs(+)] ) + gcrypt? ( + dev-libs/libgcrypt:0=[static-libs(+)] + dev-libs/libgpg-error[static-libs(+)] + ) + nettle? ( >=dev-libs/nettle-2.4[static-libs(+)] ) + openssl? ( dev-libs/openssl:0=[static-libs(+)] ) + pwquality? ( dev-libs/libpwquality[static-libs(+)] ) + passwdqc? ( sys-auth/passwdqc ) + ssh? ( net-libs/libssh[static-libs(+)] ) + sys-fs/lvm2[static-libs(+)] +" +# We have to always depend on ${LIB_DEPEND} rather than put behind +# !static? () because we provide a shared library which links against +# these other packages. bug #414665 +RDEPEND=" + static-libs? ( ${LIB_DEPEND} ) + ${LIB_DEPEND//\[static-libs\([+-]\)\]} + udev? ( virtual/libudev:= ) +" +DEPEND=" + ${RDEPEND} + static? ( ${LIB_DEPEND} ) +" +# vim-core needed for xxd in tests +BDEPEND=" + virtual/pkgconfig + test? ( app-editors/vim-core ) +" + +PATCHES=( "${FILESDIR}"/${P}-compat-test-passwdqc.patch ) + +pkg_setup() { + local CONFIG_CHECK="~DM_CRYPT ~CRYPTO ~CRYPTO_CBC ~CRYPTO_SHA256" + local WARNING_DM_CRYPT="CONFIG_DM_CRYPT:\tis not set (required for cryptsetup)\n" + local WARNING_CRYPTO_SHA256="CONFIG_CRYPTO_SHA256:\tis not set (required for cryptsetup)\n" + local WARNING_CRYPTO_CBC="CONFIG_CRYPTO_CBC:\tis not set (required for kernel 2.6.19)\n" + local WARNING_CRYPTO="CONFIG_CRYPTO:\tis not set (required for cryptsetup)\n" + check_extra_config +} + +src_prepare() { + default + + sed -i '/^LOOPDEV=/s:$: || exit 0:' tests/{compat,mode}-test || die +} + +src_configure() { + local myeconfargs=( + --disable-internal-argon2 + --disable-asciidoc + --enable-shared + --sbindir="${EPREFIX}"/sbin + # for later use + --with-default-luks-format=LUKS2 + --with-tmpfilesdir="${EPREFIX}/usr/lib/tmpfiles.d" + --with-crypto_backend=$(for x in ${CRYPTO_BACKENDS//+/} ; do usev ${x} ; done) + $(use_enable argon2 libargon2) + $(use_enable nls) + $(use_enable pwquality) + $(use_enable passwdqc) + $(use_enable !static external-tokens) + $(use_enable static static-cryptsetup) + $(use_enable static-libs static) + $(use_enable udev) + $(use_enable !urandom dev-random) + $(use_enable ssh ssh-token) + $(usev !argon2 '--with-luks2-pbkdf=pbkdf2') + $(use_enable fips) + ) + + econf "${myeconfargs[@]}" +} + +src_test() { + if [[ ! -e /dev/mapper/control ]] ; then + ewarn "No /dev/mapper/control found -- skipping tests" + return 0 + fi + + local p + for p in /dev/mapper /dev/loop* ; do + addwrite ${p} + done + + default +} + +src_install() { + default + + if use static ; then + mv "${ED}"/sbin/cryptsetup{.static,} || die + mv "${ED}"/sbin/veritysetup{.static,} || die + mv "${ED}"/sbin/integritysetup{.static,} || die + + if use ssh ; then + mv "${ED}"/sbin/cryptsetup-ssh{.static,} || die + fi + fi + + find "${ED}" -type f -name "*.la" -delete || die + + dodoc docs/v*ReleaseNotes + + newconfd "${FILESDIR}"/2.4.3-dmcrypt.confd dmcrypt + newinitd "${FILESDIR}"/2.4.3-dmcrypt.rc dmcrypt +} + +pkg_postinst() { + tmpfiles_process cryptsetup.conf + + if use kernel ; then + ewarn "Note that kernel backend is very slow for this type of operation" + ewarn "and is provided mainly for embedded systems wanting to avoid" + ewarn "userspace crypto libraries." + fi +} diff --git a/sys-fs/cryptsetup/files/cryptsetup-2.7.5-compat-test-passwdqc.patch b/sys-fs/cryptsetup/files/cryptsetup-2.7.5-compat-test-passwdqc.patch new file mode 100644 index 000000000000..b266f142f2f4 --- /dev/null +++ b/sys-fs/cryptsetup/files/cryptsetup-2.7.5-compat-test-passwdqc.patch @@ -0,0 +1,58 @@ +https://gitlab.com/cryptsetup/cryptsetup/-/commit/64fb1c1b2673e7f366b789943d1627c859a70b1f.patch +https://gitlab.com/cryptsetup/cryptsetup/-/merge_requests/737 + +From 64fb1c1b2673e7f366b789943d1627c859a70b1f Mon Sep 17 00:00:00 2001 +From: Gabi Falk +Date: Sun, 22 Dec 2024 16:00:00 +0000 +Subject: [PATCH] tests/compat-test: Adjust test for compatibility with + passwdqc + +Unlike libpwquality, passwdqc does not consider 'compatkey' a strong +password and rejects 512 character long passwords. + +Closes: https://gitlab.com/cryptsetup/cryptsetup/-/issues/928 +Signed-off-by: Gabi Falk +--- + tests/compat-test | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/tests/compat-test b/tests/compat-test +index 0b2463dd..f01f3032 100755 +--- a/tests/compat-test ++++ b/tests/compat-test +@@ -250,7 +250,7 @@ echo $PWD1 | $CRYPTSETUP luksAddKey $IMG $FAST_PBKDF_OPT 2>/dev/null && fail + echo -e "$PWD1\n$PWD2" | $CRYPTSETUP luksAddKey $IMG $FAST_PBKDF_OPT || fail + echo -e "$PWD0\n$PWD1" | $CRYPTSETUP luksAddKey $IMG $FAST_PBKDF_OPT 2>/dev/null && fail + echo "[4] change key" +-echo -e "$PWD1\n$PWD0\n" | $CRYPTSETUP luksChangeKey $FAST_PBKDF_OPT $IMG || fail ++echo -e "$PWD1\n$PWD0\n" | $CRYPTSETUP luksChangeKey --force-password $FAST_PBKDF_OPT $IMG || fail + echo -e "$PWD1\n$PWD2\n" | $CRYPTSETUP luksChangeKey $FAST_PBKDF_OPT $IMG 2>/dev/null && fail + [ $? -ne 2 ] && fail "luksChangeKey should return EPERM exit code" + echo "[5] remove key" +@@ -941,7 +941,7 @@ prepare "[35] Interactive format of device." wipe + expect_run - >/dev/null <$KEYE + expect_run - >/dev/null <Use dev-libs/nettle crypto backend Use dev-libs/openssl crypto backend Use dev-libs/libpwquality for password quality checking + Use sys-auth/passwdqc for password quality checking Build cryptsetup-ssh for experimental support of token via SSH-server Use /dev/urandom instead of /dev/random