commit: 93fe7824125191ae98cfdd05704a516cb78fac35 Author: Alon Bar-Lev <alonbl <AT> gentoo <DOT> org> AuthorDate: Fri Mar 3 22:53:11 2017 +0000 Commit: Alon Bar-Lev <alonbl <AT> gentoo <DOT> org> CommitDate: Fri Mar 3 22:54:02 2017 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=93fe7824
mail-filter/opendkim: support gnutls-3.4 + eapi bump Bug: 583752 Package-Manager: Portage-2.3.3, Repoman-2.3.1 .../files/opendkim-2.10.3-gnutls-3.4.patch | 52 ++++++ mail-filter/opendkim/opendkim-2.10.3-r3.ebuild | 204 +++++++++++++++++++++ 2 files changed, 256 insertions(+) diff --git a/mail-filter/opendkim/files/opendkim-2.10.3-gnutls-3.4.patch b/mail-filter/opendkim/files/opendkim-2.10.3-gnutls-3.4.patch new file mode 100644 index 00000000000..f4594efaac9 --- /dev/null +++ b/mail-filter/opendkim/files/opendkim-2.10.3-gnutls-3.4.patch @@ -0,0 +1,52 @@ +From 3eea12e5f9af7739d5d009c6888b65bd4875a554 Mon Sep 17 00:00:00 2001 +From: Alon Bar-Lev <alon.bar...@gmail.com> +Date: Sat, 4 Mar 2017 00:41:35 +0200 +Subject: [PATCH] crypto: support gnutls-3.4 + +https://sourceforge.net/p/opendkim/patches/36/ + +Signed-off-by: Alon Bar-Lev <alon.bar...@gmail.com> +--- + libopendkim/dkim.c | 19 ++++++++++++++++++- + 1 file changed, 18 insertions(+), 1 deletion(-) + +diff --git a/libopendkim/dkim.c b/libopendkim/dkim.c +index d0d75a5..0c2278e 100644 +--- a/libopendkim/dkim.c ++++ b/libopendkim/dkim.c +@@ -5301,6 +5301,8 @@ dkim_sig_process(DKIM *dkim, DKIM_SIGINFO *sig) + size_t diglen = 0; + #ifdef USE_GNUTLS + gnutls_datum_t key; ++ gnutls_digest_algorithm_t hash; ++ gnutls_sign_algorithm_t sign_algo; + #else /* USE_GNUTLS */ + BIO *key; + #endif /* USE_GNUTLS */ +@@ -5442,7 +5444,22 @@ dkim_sig_process(DKIM *dkim, DKIM_SIGINFO *sig) + return DKIM_STAT_OK; + } + +- rsastat = gnutls_pubkey_verify_hash(rsa->rsa_pubkey, 0, ++ hash = GNUTLS_DIG_SHA1; ++ ++ if (dkim_libfeature(dkim->dkim_libhandle, ++ DKIM_FEATURE_SHA256) && ++ sig->sig_hashtype == DKIM_HASHTYPE_SHA256) ++ hash = GNUTLS_DIG_SHA256; ++ ++ sign_algo = gnutls_pk_to_sign(GNUTLS_PK_RSA, hash); ++ if (sign_algo == GNUTLS_SIGN_UNKNOWN) ++ { ++ assert(0); ++ /* NOTREACHED */ ++ } ++ ++ rsastat = gnutls_pubkey_verify_hash2(rsa->rsa_pubkey, ++ sign_algo, 0, + &rsa->rsa_digest, + &rsa->rsa_sig); + if (rsastat < 0) +-- +2.10.2 + diff --git a/mail-filter/opendkim/opendkim-2.10.3-r3.ebuild b/mail-filter/opendkim/opendkim-2.10.3-r3.ebuild new file mode 100644 index 00000000000..a58a39496e5 --- /dev/null +++ b/mail-filter/opendkim/opendkim-2.10.3-r3.ebuild @@ -0,0 +1,204 @@ +# Copyright 1999-2017 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +EAPI=6 + +inherit autotools db-use eutils systemd user + +# for betas +#MY_P=${P/_b/.B} +#S=${WORKDIR}/${PN}-2.8.0 +#SRC_URI="mirror://sourceforge/opendkim/${MY_P}.tar.gz" + +DESCRIPTION="A milter-based application to provide DKIM signing and verification" +HOMEPAGE="http://opendkim.org"; +SRC_URI="mirror://sourceforge/opendkim/${P}.tar.gz" + +LICENSE="Sendmail-Open-Source BSD" +SLOT="0" +KEYWORDS="~amd64 ~arm ~x86" +IUSE="+berkdb gnutls ldap libressl lmdb lua memcached opendbx poll sasl selinux +ssl static-libs unbound" + +DEPEND="|| ( mail-filter/libmilter mail-mta/sendmail ) + dev-libs/libbsd + ssl? ( + !libressl? ( dev-libs/openssl:0= ) + libressl? ( dev-libs/libressl:0= ) + ) + berkdb? ( >=sys-libs/db-3.2:* ) + opendbx? ( >=dev-db/opendbx-1.4.0 ) + lua? ( dev-lang/lua:* ) + ldap? ( net-nds/openldap ) + lmdb? ( dev-db/lmdb ) + memcached? ( dev-libs/libmemcached ) + sasl? ( dev-libs/cyrus-sasl ) + unbound? ( >=net-dns/unbound-1.4.1 net-dns/dnssec-root ) + !unbound? ( net-libs/ldns ) + gnutls? ( >=net-libs/gnutls-3.3 )" + +RDEPEND="${DEPEND} + sys-process/psmisc + selinux? ( sec-policy/selinux-dkim ) +" + +REQUIRED_USE="sasl? ( ldap )" + +PATCHES=( + "${FILESDIR}/${P}-gnutls-3.4.patch" +) + +pkg_setup() { + enewgroup milter + # mail-milter/spamass-milter creates milter user with this home directory + # For consistency reasons, milter user must be created here with this home directory + # even though this package doesn't need a home directory for this user (#280571) + enewuser milter -1 -1 /var/lib/milter milter +} + +src_prepare() { + default + + sed -i -e 's:/var/db/dkim:/etc/opendkim:g' \ + -e 's:/var/db/opendkim:/var/lib/opendkim:g' \ + -e 's:/etc/mail:/etc/opendkim:g' \ + -e 's:mailnull:milter:g' \ + -e 's:^#[[:space:]]*PidFile.*:PidFile /run/opendkim/opendkim.pid:' \ + opendkim/opendkim.conf.sample opendkim/opendkim.conf.simple.in \ + stats/opendkim-reportstats{,.in} || die + + sed -i -e 's:dist_doc_DATA:dist_html_DATA:' libopendkim/docs/Makefile.am \ + || die + + sed -i -e '/sock.*mt.getcwd/s:mt.getcwd():"/tmp":' opendkim/tests/*.lua + sed -i -e '/sock.*mt.getcwd/s:mt.getcwd():"/proc/self/cwd":' opendkim/tests/*.lua + + eautoreconf +} + +src_configure() { + local myconf=() + if use berkdb ; then + myconf+=( + $(db_includedir) + --with-db-incdir=${myconf#-I} + --enable-popauth + --enable-query_cache + --enable-stats + ) + fi + if use unbound; then + myconf+=( --with-unbound ) + else + myconf+=( --with-ldns ) + fi + if use ldap; then + myconf+=( $(use_with sasl) ) + fi + econf \ + $(use_with berkdb db) \ + $(use_with opendbx odbx) \ + $(use_with lua) \ + $(use_enable lua rbl) \ + $(use_with ldap openldap) \ + $(use_with lmdb) \ + $(use_enable poll) \ + $(use_enable static-libs static) \ + $(use_with gnutls) \ + $(use_with memcached libmemcached) \ + ${myconf[@]} \ + --enable-filter \ + --enable-atps \ + --enable-identity_header \ + --enable-rate_limit \ + --enable-resign \ + --enable-replace_rules \ + --enable-default_sender \ + --enable-sender_macro \ + --enable-vbr \ + --disable-live-testing + #--with-test-socket=/tmp/opendkim-$(echo ${RANDOM})-S + #--disable-rpath +} + +src_install() { + default + prune_libtool_files + + dosbin stats/opendkim-reportstats + + newinitd "${FILESDIR}/opendkim.init.r3" opendkim + systemd_newunit "${FILESDIR}/opendkim-r1.service" opendkim.service + + dodir /etc/opendkim /var/lib/opendkim + fowners milter:milter /var/lib/opendkim + + # default configuration + if [ ! -f "${ROOT}"/etc/opendkim/opendkim.conf ]; then + grep ^[^#] "${S}"/opendkim/opendkim.conf.simple \ + > "${D}"/etc/opendkim/opendkim.conf + if use unbound; then + echo TrustAnchorFile /etc/dnssec/root-anchors.txt >> "${D}"/etc/opendkim/opendkim.conf + fi + echo UserID milter >> "${D}"/etc/opendkim/opendkim.conf + if use berkdb; then + echo Statistics /var/lib/opendkim/stats.dat >> \ + "${D}"/etc/opendkim/opendkim.conf + fi + fi +} + +pkg_postinst() { + if [[ -z ${REPLACING_VERSION} ]]; then + elog "If you want to sign your mail messages and need some help" + elog "please run:" + elog " emerge --config ${CATEGORY}/${PN}" + elog "It will help you create your key and give you hints on how" + elog "to configure your DNS and MTA." + + ewarn "Make sure your MTA has r/w access to the socket file." + ewarn "This can be done either by setting UMask to 002 and adding MTA's user" + ewarn "to milter group or you can simply set UMask to 000." + fi +} + +pkg_config() { + local selector keysize pubkey + + read -p "Enter the selector name (default ${HOSTNAME}): " selector + [[ -n "${selector}" ]] || selector=${HOSTNAME} + if [[ -z "${selector}" ]]; then + eerror "Oddly enough, you don't have a HOSTNAME." + return 1 + fi + if [[ -f "${ROOT}"etc/opendkim/${selector}.private ]]; then + ewarn "The private key for this selector already exists." + else + keysize=1024 + # generate the private and public keys + opendkim-genkey -b ${keysize} -D "${ROOT}"etc/opendkim/ \ + -s ${selector} -d '(your domain)' && \ + chown milter:milter \ + "${ROOT}"etc/opendkim/"${selector}".private || \ + { eerror "Failed to create private and public keys." ; return 1; } + chmod go-r "${ROOT}"etc/opendkim/"${selector}".private + fi + + # opendkim selector configuration + echo + einfo "Make sure you have the following settings in your /etc/opendkim/opendkim.conf:" + einfo " Keyfile /etc/opendkim/${selector}.private" + einfo " Selector ${selector}" + + # MTA configuration + echo + einfo "If you are using Postfix, add following lines to your main.cf:" + einfo " smtpd_milters = unix:/var/run/opendkim/opendkim.sock" + einfo " non_smtpd_milters = unix:/var/run/opendkim/opendkim.sock" + einfo " and read http://www.postfix.org/MILTER_README.html"; + + # DNS configuration + einfo "After you configured your MTA, publish your key by adding this TXT record to your domain:" + cat "${ROOT}"etc/opendkim/${selector}.txt + einfo "t=y signifies you only test the DKIM on your domain. See following page for the complete list of tags:" + einfo " http://www.dkim.org/specs/rfc4871-dkimbase.html#key-text"; +}
