depends: libgcrypt: update to 1.10.2

diff --git a/contrib/depends/packages/libgcrypt.mk b/contrib/depends/packages/libgcrypt.mk
index 676828b97be4f99c71b5e96b3a69fb9f3a403538..34456e7f430a0774aab1422f7f92df7036ae3e05 100644 (file)
--- a/contrib/depends/packages/libgcrypt.mk
+++ b/contrib/depends/packages/libgcrypt.mk
@@ -1,16 +1,18 @@
 package=libgcrypt
-$(package)_version=1.10.1
+$(package)_version=1.10.2
 $(package)_download_path=https://www.gnupg.org/ftp/gcrypt/libgcrypt/
 $(package)_file_name=libgcrypt-$($(package)_version).tar.bz2
-$(package)_sha256_hash=ef14ae546b0084cd84259f61a55e07a38c3b53afc0f546bffcef2f01baffe9de
+$(package)_sha256_hash=3b9c02a004b68c256add99701de00b383accccf37177e0d6c58289664cce0c03
 $(package)_dependencies=libgpg-error
+$(package)_patches=fix_getrandom_darwin.patch
 
 define $(package)_set_vars
    $(package)_build_opts=CFLAGS="-fPIE"
 endef
 
 define $(package)_preprocess_cmds
-    cp -f $(BASEDIR)/config.guess $(BASEDIR)/config.sub build-aux
+    cp -f $(BASEDIR)/config.guess $(BASEDIR)/config.sub build-aux && \
+    patch -p1 < $($(package)_patch_dir)/fix_getrandom_darwin.patch
 endef
 
 # TODO: building on linux with $($(package)_autoconf) fails for mysterious reasons

diff --git a/contrib/depends/patches/libgcrypt/fix_getrandom_darwin.patch b/contrib/depends/patches/libgcrypt/fix_getrandom_darwin.patch
new file mode 100644 (file)
index 0000000..c108571
--- /dev/null
+++ b/contrib/depends/patches/libgcrypt/fix_getrandom_darwin.patch
@@ -0,0 +1,131 @@
+diff --git a/random/rndgetentropy.c b/random/rndgetentropy.c
+index 513da0b9..a6f3c4ab 100644
+--- a/random/rndgetentropy.c
++++ b/random/rndgetentropy.c
+@@ -1,124 +1,126 @@
+ /* rndgetentropy.c  -  raw random number for OSes by getentropy function.
+  * Copyright (C) 1998, 2001, 2002, 2003, 2007,
+  *               2009  Free Software Foundation, Inc.
+  *
+  * This file is part of Libgcrypt.
+  *
+  * Libgcrypt is free software; you can redistribute it and/or modify
+  * it under the terms of the GNU Lesser General Public License as
+  * published by the Free Software Foundation; either version 2.1 of
+  * the License, or (at your option) any later version.
+  *
+  * Libgcrypt is distributed in the hope that it will be useful,
+  * but WITHOUT ANY WARRANTY; without even the implied warranty of
+  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  * GNU Lesser General Public License for more details.
+  *
+  * You should have received a copy of the GNU Lesser General Public
+  * License along with this program; if not, see <http://www.gnu.org/licenses/>.
+  */
+ 
+ 
+ #include <config.h>
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <errno.h>
+ #include <sys/types.h>
+ #include <string.h>
+ #include <unistd.h>
+ #ifdef HAVE_SYS_RANDOM_H
+ #include <sys/random.h>
+ #endif
+ 
+ #include "types.h"
+ #include "g10lib.h"
+ #include "rand-internal.h"
+ 
+ /* The function returns 0 on success or true on failure (in which case
+  * the caller will signal a fatal error).  */
+ int
+ _gcry_rndgetentropy_gather_random (void (*add)(const void*, size_t,
+                                                enum random_origins),
+                                    enum random_origins origin,
+                                    size_t length, int level)
+ {
+   byte buffer[256];
+ 
+   if (!add)
+     {
+       /* Special mode to release resouces.  */
+       _gcry_rndjent_fini ();
+       return 0;
+     }
+ 
+   /* When using a blocking random generator try to get some entropy
+    * from the jitter based RNG.  In this case we take up to 50% of the
+    * remaining requested bytes.  */
+   if (level >= GCRY_VERY_STRONG_RANDOM)
+     {
+       size_t n;
+ 
+       n = _gcry_rndjent_poll (add, origin, length/2);
+       if (n > length/2)
+         n = length/2;
+       if (length > 1)
+         length -= n;
+     }
+ 
+   /* Enter the loop.  */
+   while (length)
+     {
+       int ret;
+       size_t nbytes;
+ 
+       /* For a modern operating system, we use the new getentropy
+        * function.  That call guarantees that the kernel's RNG has
+        * been properly seeded before returning any data.  This is
+        * different from /dev/urandom which may, due to its
+        * non-blocking semantics, return data even if the kernel has
+        * not been properly seeded.  And it differs from /dev/random by
+        * never blocking once the kernel is seeded.  */
+       do
+         {
+           _gcry_pre_syscall ();
++#ifdef GRND_RANDOM
+           if (fips_mode ())
+             {
+               /* DRBG chaining defined in SP 800-90A (rev 1) specify
+                * the upstream (kernel) DRBG needs to be reseeded for
+                * initialization of downstream (libgcrypt) DRBG. For this
+                * in RHEL, we repurposed the GRND_RANDOM flag of getrandom API.
+                * The libgcrypt DRBG is initialized with 48B of entropy, but
+                * the kernel can provide only 32B at a time after reseeding
+                * so we need to limit our requests to 32B here.
+                * This is clarified in IG 7.19 / IG D.K. for FIPS 140-2 / 3
+                * and might not be applicable on other FIPS modules not running
+                * RHEL kernel.
+                */
+               nbytes = length < 32 ? length : 32;
+               ret = getrandom (buffer, nbytes, GRND_RANDOM);
+             }
+           else
++#endif
+             {
+               nbytes = length < sizeof (buffer) ? length : sizeof (buffer);
+               ret = getentropy (buffer, nbytes);
+             }
+           _gcry_post_syscall ();
+         }
+       while (ret == -1 && errno == EINTR);
+ 
+       if (ret == -1 && errno == ENOSYS)
+         log_fatal ("getentropy is not supported: %s\n", strerror (errno));
+       else
+         { /* getentropy is supported.  Some sanity checks.  */
+           if (ret == -1)
+             log_fatal ("unexpected error from getentropy: %s\n",
+                        strerror (errno));
+ 
+           (*add) (buffer, nbytes, origin);
+           length -= nbytes;
+         }
+     }
+   wipememory (buffer, sizeof buffer);
+ 
+   return 0; /* success */
+ }