Source Mage code commit list

[Ismael Luceno <scm AT sourcemage.org>]

GIT changes to master grimoire by Ismael Luceno <ismael AT sourcemage.org>:

 crypto/libressl/DETAILS                                                      
      |   14 +++-
 crypto/libressl/HISTORY                                                      
      |    7 ++
 crypto/libressl/PREPARE                                                      
      |    9 ++-
 crypto/libressl/PRE_BUILD                                                    
      |    9 +--
 crypto/libressl/patches-2.9/001-non_glibc.patch                              
      |   28 +++++++++
 
crypto/libressl/patches-2.9/fix-compatibility-with-pre-rfc-5280-certificates.patch
 |   29 ++++++++++
 
crypto/libressl/patches-3.2/fix-compatibility-with-pre-rfc-5280-certificates.patch
 |   29 ++++++++++
 crypto/libressl/patches/001-non_glibc.patch                                  
      |   28 ---------
 8 files changed, 115 insertions(+), 38 deletions(-)

New commits:
commit 4b187be27a87b907611961c53febe8520e6a35d8
Author: Ismael Luceno <ismael AT sourcemage.org>
Commit: Ismael Luceno <ismael AT sourcemage.org>

    libressl: Fix verification of odd but valid certs
    
    Allow GENERALIZEDTIME for dates before 2050, it isn't a security issue,
    and enables interoperability with older (pre-RFC-5280) software.

commit 182c40e49025caadbbd1b96574d821dcb1e5422c
Author: Ismael Luceno <ismael AT sourcemage.org>
Commit: Ismael Luceno <ismael AT sourcemage.org>

    libressl 3.2.2

diff --git a/crypto/libressl/DETAILS b/crypto/libressl/DETAILS
index 3bd8470..0826e18 100755
--- a/crypto/libressl/DETAILS
+++ b/crypto/libressl/DETAILS
@@ -1,14 +1,18 @@
            SPELL=libressl
-if [[ "$LIBRESSL_BRANCH" == "devel" ]]; then
-         VERSION=3.1.0
+case "$LIBRESSL_BRANCH"
+in devel|stable|3.2)
+         VERSION=3.2.2
   SECURITY_PATCH=10
-elif [[ "$LIBRESSL_BRANCH" == "stable" ]]; then
+;; 3.1)
+         VERSION=3.1.4
+  SECURITY_PATCH=10
+;; 2.9)
          VERSION=2.9.2
   SECURITY_PATCH=8
-else
+;; *)
          VERSION=2.8.3
   SECURITY_PATCH=8
-fi
+;; esac
           SOURCE=$SPELL-$VERSION.tar.gz
          SOURCE2=$SOURCE.asc
    SOURCE_URL[0]=http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/$SOURCE
diff --git a/crypto/libressl/HISTORY b/crypto/libressl/HISTORY
index 09d5c31..7b721f8 100644
--- a/crypto/libressl/HISTORY
+++ b/crypto/libressl/HISTORY
@@ -1,3 +1,10 @@
+2020-11-01 Ismael Luceno <ismael AT sourcemage.org>
+       * DETAILS: updates devel & stable to 3.2.2
+       * DETAILS, PREPARE, PRE_BUILD: updated branches
+       * patches-2.9/fix-compatibility-with-pre-rfc-5280-certificates.patch,
+       * patches-3.2/fix-compatibility-with-pre-rfc-5280-certificates.patch:
+         Fix verification of odd but valid certificates
+
 2020-04-17 Treeve Jelbert <treeve AT sourcemage.org>
        * DETAILS: version 3.1.0
 
diff --git a/crypto/libressl/PREPARE b/crypto/libressl/PREPARE
index 07c703d..c8710f9 100755
--- a/crypto/libressl/PREPARE
+++ b/crypto/libressl/PREPARE
@@ -1,6 +1,13 @@
 . ${GRIMOIRE}/FUNCTIONS &&
 list_remove LIBRESSL_BRANCH "experimental" &&
-prepare_select_branch stable old devel &&
+prepare_select_branch \
+  stable \
+  devel \
+  3.2 \
+  3.1 \
+  2.9 \
+  2.8 \
+  &&
 if spell_ok openssl; then
   # should be replaced with something less hacky
   export WGET_RECAST_REQUIRED="y"
diff --git a/crypto/libressl/PRE_BUILD b/crypto/libressl/PRE_BUILD
index d3b7c52..36935d5 100755
--- a/crypto/libressl/PRE_BUILD
+++ b/crypto/libressl/PRE_BUILD
@@ -1,6 +1,7 @@
 default_pre_build  &&
 cd  "${SOURCE_DIRECTORY}" &&
-
-if [[ "${LIBRESSL_BRANCH}" == "stable" ]]; then
-  apply_patch_dir patches
-fi
+ver="$LIBRESSL_BRANCH" &&
+case "$ver" in
+  stable|devel) ver=3.2 ;;
+esac &&
+apply_patch_dir "patches-$ver"
diff --git a/crypto/libressl/patches-2.9/001-non_glibc.patch 
b/crypto/libressl/patches-2.9/001-non_glibc.patch
new file mode 100644
index 0000000..4067b68
--- /dev/null
+++ b/crypto/libressl/patches-2.9/001-non_glibc.patch
@@ -0,0 +1,28 @@
+diff -rup a/crypto/compat/getprogname_linux.c 
b/crypto/compat/getprogname_linux.c
+--- a/crypto/compat/getprogname_linux.c        2019-05-07 07:05:51.000000000 
+0000
++++ b/crypto/compat/getprogname_linux.c        2019-05-22 07:06:20.780029886 
+0000
+@@ -12,23 +12,14 @@ getprogname(void)
+        * Since Android is using portions of OpenBSD libc, it should have
+        * a symbol called __progname [1].
+        *
+-       * Regarding program_invocation_short_name, it is a GNU libc ext [2] 
and
+-       * so make it conditional to __GLIBC__ [3].
+-       *
+        * .. [0] 
https://github.com/aosp-mirror/platform_bionic/blob/1eb6d3/libc/include/stdlib.h#L160
+        *
+        * .. [1] https://github.com/aosp-mirror/platform_bionic/commit/692207
+-       *
+-       * .. [2] https://linux.die.net/man/3/program_invocation_short_name
+-       *
+-       * .. [3] 
https://android.googlesource.com/platform/system/core/+/2819c0/base/logging.cpp#65
+        */
+ #if defined(__ANDROID_API__) && __ANDROID_API__ < 21
+       extern const char *__progname;
+       return __progname;
+-#elif defined(__GLIBC__)
+-      return program_invocation_short_name;
+ #else
+-#error "Cannot emulate getprogname"
++      return program_invocation_short_name;
+ #endif
+ }
diff --git 
a/crypto/libressl/patches-2.9/fix-compatibility-with-pre-rfc-5280-certificates.patch
 
b/crypto/libressl/patches-2.9/fix-compatibility-with-pre-rfc-5280-certificates.patch
new file mode 100644
index 0000000..acaeb9d
--- /dev/null
+++ 
b/crypto/libressl/patches-2.9/fix-compatibility-with-pre-rfc-5280-certificates.patch
@@ -0,0 +1,29 @@
+From 405a4a7f3e60310095d7ef244e69d9acccc12322 Mon Sep 17 00:00:00 2001
+From: Ismael Luceno <ismael AT iodev.co.uk>
+Date: Sun, 1 Nov 2020 01:59:11 +0100
+Subject: [PATCH for 2.9] Fix compatibility with pre-RFC-5280 certificates
+
+Allow GENERALIZEDTIME for dates before 2050, it isn't a security issue, and
+enables interoperability with older software.
+
+Based on a patch by Johan de Vries <devries AT wivion.nl>.
+---
+ crypto/x509/x509_vfy.c            |  3 +++
+ 1 files changed, 3 insertions(+)
+
+diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c
+index e98272a6c3..a3dd4e798d 100644
+--- a/crypto/x509/x509_vfy.c
++++ b/crypto/x509/x509_vfy.c
+@@ -1885,6 +1885,9 @@ X509_cmp_time_internal(const ASN1_TIME *ctm, time_t 
*cmp_time, int clamp_notafte
+       if (type == -1)
+               goto out; /* invalid time */
+
++      /* Allow GENERALIZEDTIME for dates before 2050, it isn't a security
++       * issue, and enables interoperability with older software. */
++      if (type != V_ASN1_GENERALIZEDTIME)
+       /* RFC 5280 section 4.1.2.5 */
+       if (tm1.tm_year < 150 && type != V_ASN1_UTCTIME)
+               goto out;
+--
+2.28.0
diff --git 
a/crypto/libressl/patches-3.2/fix-compatibility-with-pre-rfc-5280-certificates.patch
 
b/crypto/libressl/patches-3.2/fix-compatibility-with-pre-rfc-5280-certificates.patch
new file mode 100644
index 0000000..d4bbe02
--- /dev/null
+++ 
b/crypto/libressl/patches-3.2/fix-compatibility-with-pre-rfc-5280-certificates.patch
@@ -0,0 +1,29 @@
+From 405a4a7f3e60310095d7ef244e69d9acccc12322 Mon Sep 17 00:00:00 2001
+From: Ismael Luceno <ismael AT iodev.co.uk>
+Date: Sun, 1 Nov 2020 01:59:11 +0100
+Subject: [PATCH for 3.2] Fix compatibility with pre-RFC-5280 certificates
+
+Allow GENERALIZEDTIME for dates before 2050, it isn't a security issue, and
+enables interoperability with older software.
+
+Based on a patch by Johan de Vries <devries AT wivion.nl>.
+---
+ crypto/x509/x509_verify.c            |  3 +++
+ 1 files changed, 3 insertions(+)
+
+diff --git a/crypto/x509/x509_verify.c b/crypto/x509/x509_verify.c
+index 0c32cd04b741..3dda41ea825f 100644
+--- a/crypto/x509/x509_verify.c
++++ b/crypto/x509/x509_verify.c
+@@ -522,6 +522,9 @@ x509_verify_asn1_time_to_tm(const ASN1_TIME *atime, 
struct tm *tm, int notafter)
+       if (type == -1)
+               return 0;
+ 
++      /* Allow GENERALIZEDTIME for dates before 2050, it isn't a security
++       * issue, and enables interoperability with older software. */
++      if (type != V_ASN1_GENERALIZEDTIME)
+       /* RFC 5280 section 4.1.2.5 */
+       if (tm->tm_year < 150 && type != V_ASN1_UTCTIME)
+               return 0;
+--
+2.28.0
diff --git a/crypto/libressl/patches/001-non_glibc.patch 
b/crypto/libressl/patches/001-non_glibc.patch
deleted file mode 100644
index 4067b68..0000000
--- a/crypto/libressl/patches/001-non_glibc.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-diff -rup a/crypto/compat/getprogname_linux.c 
b/crypto/compat/getprogname_linux.c
---- a/crypto/compat/getprogname_linux.c        2019-05-07 07:05:51.000000000 
+0000
-+++ b/crypto/compat/getprogname_linux.c        2019-05-22 07:06:20.780029886 
+0000
-@@ -12,23 +12,14 @@ getprogname(void)
-        * Since Android is using portions of OpenBSD libc, it should have
-        * a symbol called __progname [1].
-        *
--       * Regarding program_invocation_short_name, it is a GNU libc ext [2] 
and
--       * so make it conditional to __GLIBC__ [3].
--       *
-        * .. [0] 
https://github.com/aosp-mirror/platform_bionic/blob/1eb6d3/libc/include/stdlib.h#L160
-        *
-        * .. [1] https://github.com/aosp-mirror/platform_bionic/commit/692207
--       *
--       * .. [2] https://linux.die.net/man/3/program_invocation_short_name
--       *
--       * .. [3] 
https://android.googlesource.com/platform/system/core/+/2819c0/base/logging.cpp#65
-        */
- #if defined(__ANDROID_API__) && __ANDROID_API__ < 21
-       extern const char *__progname;
-       return __progname;
--#elif defined(__GLIBC__)
--      return program_invocation_short_name;
- #else
--#error "Cannot emulate getprogname"
-+      return program_invocation_short_name;
- #endif
- }