git: 9fae06866ad7 - main - www/squid: Improve port: apply portclippy and portfmt, fix silent grab security/nettle
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Sun, 29 Dec 2024 16:59:06 UTC
The branch main has been updated by vvd: URL: https://cgit.FreeBSD.org/ports/commit/?id=9fae06866ad741b7c3458896f18c851b33678d9a commit 9fae06866ad741b7c3458896f18c851b33678d9a Author: Pavel Timofeev <timp87@gmail.com> AuthorDate: 2024-12-29 16:55:36 +0000 Commit: Vladimir Druzenko <vvd@FreeBSD.org> CommitDate: 2024-12-29 16:58:59 +0000 www/squid: Improve port: apply portclippy and portfmt, fix silent grab security/nettle Upstream bug report about silent grab security/nettle: https://github.com/squid-cache/squid/pull/937#issuecomment-2564333146 PR: 283669 --- www/squid/Makefile | 297 ++++++++++++++++++++-------------------- www/squid/files/patch-configure | 17 ++- 2 files changed, 158 insertions(+), 156 deletions(-) diff --git a/www/squid/Makefile b/www/squid/Makefile index 2571ecb379d9..4b032430d7d8 100644 --- a/www/squid/Makefile +++ b/www/squid/Makefile @@ -5,80 +5,169 @@ MASTER_SITES= http://www2.pl.squid-cache.org/Versions/v6/ \ http://www1.il.squid-cache.org/Versions/v6/ \ http://www2.gr.squid-cache.org/Versions/v6/ \ http://ca2.squid-cache.org/Versions/v6/ \ - http://www.squid-cache.org/Versions/v6/ + https://www.squid-cache.org/Versions/v6/ PATCH_SITES= http://www2.pl.squid-cache.org/%SUBDIR%/ \ http://www1.il.squid-cache.org/%SUBDIR%/ \ http://www2.gr.squid-cache.org/%SUBDIR%/ \ http://ca2.squid-cache.org/%SUBDIR%/ \ - http://www.squid-cache.org/%SUBDIR%/ + https://www.squid-cache.org/%SUBDIR%/ PATCH_SITE_SUBDIR= Versions/v6/changesets MAINTAINER= timp87@gmail.com COMMENT= HTTP Caching Proxy -WWW= http://www.squid-cache.org/ +WWW= https://www.squid-cache.org/ LICENSE= GPLv2 LICENSE_FILE= ${WRKSRC}/COPYING -USES= compiler:c++11-lib cpe gmake localbase:ldflags perl5 shebangfix tar:xz - -CONFLICTS= squid-devel +USES= compiler:c++11-lib cpe gmake localbase:ldflags perl5 \ + shebangfix tar:xz CPE_VENDOR= squid-cache -SHEBANG_FILES= scripts/*.pl contrib/*.pl tools/*.pl -GNU_CONFIGURE= yes -GNU_CONFIGURE_MANPREFIX= ${PREFIX}/share USE_RC_SUBR= squid +SHEBANG_FILES= contrib/*.pl scripts/*.pl tools/*.pl + +GNU_CONFIGURE= yes +CONFIGURE_ARGS= --bindir=${PREFIX}/sbin \ + --datadir=${ETCDIR} \ + --disable-arch-native \ + --disable-epoll \ + --disable-strict-error-checking \ + --enable-build-info \ + --enable-removal-policies="lru heap" \ + --libexecdir=${PREFIX}/libexec/squid \ + --localstatedir=/var \ + --sbindir=${PREFIX}/sbin \ + --sysconfdir=${ETCDIR} \ + --with-default-user=squid \ + --with-included-ltdl \ + --with-logdir=/var/log/squid \ + --with-pidfile=/var/run/squid/squid.pid \ + --with-swapdir=/var/squid/cache \ + --without-cap \ + --without-gnutls \ + --without-netfilter-conntrack \ + --without-systemd + +CONFLICTS= squid-devel + +SUB_FILES+= pkg-install pkg-message + USERS= squid GROUPS= squid -MYDOCS= QUICKSTART README RELEASENOTES.html doc/debug-sections.txt +.if !defined(SQUID_CONFIGURE_ARGS) || \ + ${SQUID_CONFIGURE_ARGS:M*--disable-unlinkd*} == "" +PLIST_SUB+= UNLINKD="" +.else +PLIST_SUB+= UNLINKD="@comment " +.endif PORTDOCS= ${MYDOCS:T} PORTEXAMPLES= * -SUB_FILES+= pkg-install pkg-message - -OPTIONS_SUB= yes -OPTIONS_GROUP= AUTH -OPTIONS_RADIO= FW -OPTIONS_GROUP_AUTH=AUTH_LDAP AUTH_NIS AUTH_SASL AUTH_SMB AUTH_SQL -OPTIONS_RADIO_FW=TP_IPF TP_IPFW TP_PF -OPTIONS_DEFINE= ARP_ACL TDB CACHE_DIGESTS DEBUG DELAY_POOLS DOCS ECAP ESI EXAMPLES \ - FOLLOW_XFF FS_AUFS FS_DISKD FS_ROCK HTCP ICAP ICMP IDENT IPV6 \ - KQUEUE LARGEFILE LAX_HTTP NETTLE SNMP SSL SSL_CRTD \ - STACKTRACES VIA_DB WCCP WCCPV2 -OPTIONS_SINGLE= GSSAPI -OPTIONS_SINGLE_GSSAPI= GSSAPI_NONE GSSAPI_BASE GSSAPI_HEIMDAL GSSAPI_MIT +OPTIONS_DEFINE= ARP_ACL CACHE_DIGESTS DEBUG DELAY_POOLS DOCS ECAP ESI \ + EXAMPLES FOLLOW_XFF FS_AUFS FS_DISKD FS_ROCK HTCP ICAP \ + ICMP IDENT IPV6 KQUEUE LARGEFILE LAX_HTTP NETTLE SNMP \ + SSL SSL_CRTD STACKTRACES TDB VIA_DB WCCP WCCPV2 +OPTIONS_DEFAULT= ARP_ACL AUTH_NIS CACHE_DIGESTS DELAY_POOLS FOLLOW_XFF \ + FS_AUFS FS_DISKD FS_ROCK GSSAPI_BASE HTCP ICAP ICMP \ + IDENT KQUEUE LARGEFILE LAX_HTTP SNMP SSL SSL_CRTD \ + TP_IPFW VIA_DB WCCP WCCPV2 AUTH_LDAP +OPTIONS_GROUP= AUTH +OPTIONS_GROUP_AUTH= AUTH_LDAP AUTH_NIS AUTH_SASL AUTH_SMB AUTH_SQL +OPTIONS_RADIO= FW +OPTIONS_RADIO_FW= TP_IPF TP_IPFW TP_PF +OPTIONS_SINGLE= GSSAPI +OPTIONS_SINGLE_GSSAPI= GSSAPI_BASE GSSAPI_HEIMDAL GSSAPI_MIT GSSAPI_NONE +OPTIONS_SUB= yes -OPTIONS_DEFAULT=ARP_ACL AUTH_NIS CACHE_DIGESTS DELAY_POOLS FOLLOW_XFF FS_AUFS \ - FS_DISKD FS_ROCK GSSAPI_BASE HTCP ICAP ICMP IDENT KQUEUE \ - LARGEFILE LAX_HTTP SNMP SSL SSL_CRTD TP_IPFW VIA_DB WCCP \ - WCCPV2 +ARP_ACL_DESC= ARP/MAC/EUI based authentification +AUTH_DESC= Authentication helpers +AUTH_LDAP_DESC= Install LDAP authentication helpers +AUTH_NIS_DESC= Install NIS/YP authentication helpers +AUTH_SASL_DESC= Install SASL authentication helpers +AUTH_SMB_DESC= Install SMB auth. helpers (req. Samba) +AUTH_SQL_DESC= Install SQL based auth +CACHE_DIGESTS_DESC= Use cache digests +DEBUG_DESC= Build with extended debugging support +DELAY_POOLS_DESC= Delay pools (bandwidth limiting) +ECAP_DESC= Loadable content adaptation modules +ESI_DESC= ESI support +FOLLOW_XFF_DESC= Support for the X-Following-For header +FS_AUFS_DESC= AUFS (threaded-io) support +FS_DISKD_DESC= DISKD storage engine controlled by separate service +FS_ROCK_DESC= ROCK storage engine +HTCP_DESC= HTCP support +ICAP_DESC= the ICAP client +ICMP_DESC= ICMP pinging and network measurement +IDENT_DESC= Ident lookups (RFC 931) +KQUEUE_DESC= Kqueue(2) support +LARGEFILE_DESC= Support large (>2GB) cache and log files +LAX_HTTP_DESC= Do not enforce strict HTTP compliance +NETTLE_DESC= Nettle MD5 algorithm support +SNMP_DESC= SNMP support +SSL_CRTD_DESC= Use ssl_crtd to handle SSL cert requests +SSL_DESC= SSL gatewaying support +STACKTRACES_DESC= Enable automatic backtraces on fatal errors +TDB_DESC= TrivialDB support required for session and time quota external helpers +TP_IPFW_DESC= Transparent proxying with IPFW +TP_IPF_DESC= Transparent proxying with IPFilter +TP_PF_DESC= Transparent proxying with PF +VIA_DB_DESC= Forward/Via database +WCCPV2_DESC= Web Cache Coordination Protocol v2 +WCCP_DESC= Web Cache Coordination Protocol ARP_ACL_CONFIGURE_ENABLE= eui -AUTH_LDAP_CONFIGURE_WITH= ldap AUTH_LDAP_USES= ldap -AUTH_LDAP_VARS= BASIC_AUTH+=LDAP DIGEST_AUTH+="eDirectory LDAP" EXTERNAL_ACL+="LDAP_group eDirectory_userip" +AUTH_LDAP_CONFIGURE_WITH= ldap +AUTH_LDAP_VARS= BASIC_AUTH+=LDAP \ + DIGEST_AUTH+="eDirectory LDAP" \ + EXTERNAL_ACL+="LDAP_group eDirectory_userip" AUTH_SASL_LIB_DEPENDS= libsasl2.so:security/cyrus-sasl2 AUTH_SASL_VARS= BASIC_AUTH+=SASL AUTH_SMB_USES= samba:run -AUTH_SMB_VARS= BASIC_AUTH+=SMB EXTERNAL_ACL+=wbinfo_group +AUTH_SMB_VARS= BASIC_AUTH+=SMB \ + EXTERNAL_ACL+=wbinfo_group AUTH_SQL_RUN_DEPENDS= p5-DBI>=1.08:databases/p5-DBI AUTH_SQL_VARS= EXTERNAL_ACL+=SQL_session -TDB_CONFIGURE_WITH= tdb -TDB_LIB_DEPENDS= libtdb.so:databases/tdb -TDB_VARS= EXTERNAL_ACL+="time_quota session" CACHE_DIGESTS_CONFIGURE_ENABLE= cache-digests DELAY_POOLS_CONFIGURE_ENABLE= delay-pools -ECAP_CONFIGURE_ENABLE= ecap ECAP_LIB_DEPENDS= libecap.so:www/libecap ECAP_USES= pkgconfig:build -ESI_CONFIGURE_ENABLE= esi -ESI_CONFIGURE_WITH= expat xml2 +ECAP_CONFIGURE_ENABLE= ecap ESI_LIB_DEPENDS= libexpat.so:textproc/expat2 \ libxml2.so:textproc/libxml2 +ESI_CONFIGURE_ENABLE= esi +ESI_CONFIGURE_WITH= expat xml2 FOLLOW_XFF_CONFIGURE_ENABLE= follow-x-forwarded-for +FS_AUFS_CONFIGURE_WITH= pthreads +# Nil aufs threads is default, set any other value via SQUID_CONFIGURE_ARGS, +# e.g. SQUID_CONFIGURE_ARGS=--with-aufs-threads=N +FS_AUFS_LDFLAGS= -pthread +FS_AUFS_VARS= DISKIO_MODULES+=DiskThreads \ + STORAGE_SCHEMES+=aufs +FS_DISKD_VARS= DISKIO_MODULES+=DiskDaemon \ + STORAGE_SCHEMES+=diskd +FS_ROCK_VARS= STORAGE_SCHEMES+=rock +GSSAPI_BASE_USES= gssapi +GSSAPI_BASE_CONFIGURE_ON= ${GSSAPI_CONFIGURE_ARGS} \ + --with-heimdal-krb5=${GSSAPIBASEDIR} \ + krb5_config=${GSSAPIBASEDIR}/bin/krb5-config +GSSAPI_BASE_PLIST_SUB= AUTH_KERB="" +GSSAPI_HEIMDAL_USES= gssapi:heimdal +GSSAPI_HEIMDAL_CONFIGURE_ON= ${GSSAPI_CONFIGURE_ARGS} \ + --with-heimdal-krb5=${GSSAPIBASEDIR} \ + krb5_config=${GSSAPIBASEDIR}/bin/krb5-config +GSSAPI_HEIMDAL_PLIST_SUB= AUTH_KERB="" +GSSAPI_MIT_USES= gssapi:mit +GSSAPI_MIT_CONFIGURE_ON= ${GSSAPI_CONFIGURE_ARGS} \ + --with-mit-krb5=${GSSAPIBASEDIR} \ + krb5_config=${GSSAPIBASEDIR}/bin/krb5-config +GSSAPI_MIT_PLIST_SUB= AUTH_KERB="" +GSSAPI_NONE_CONFIGURE_ON= --without-gnugss \ + --without-heimdal-krb5 \ + --without-mit-krb5 HTCP_CONFIGURE_ENABLE= htcp ICAP_CONFIGURE_ENABLE= icap-client ICMP_CONFIGURE_ENABLE= icmp @@ -87,30 +176,26 @@ IPV6_CONFIGURE_ENABLE= ipv6 KQUEUE_CONFIGURE_ENABLE= kqueue LARGEFILE_CONFIGURE_WITH= large-files LAX_HTTP_CONFIGURE_ENABLE= http-violations -FS_AUFS_VARS= STORAGE_SCHEMES+=aufs DISKIO_MODULES+=DiskThreads -# Nil aufs threads is default, set any other value via SQUID_CONFIGURE_ARGS, -# e.g. SQUID_CONFIGURE_ARGS=--with-aufs-threads=N -FS_AUFS_LDFLAGS= -pthread -FS_AUFS_CONFIGURE_WITH= pthreads -FS_DISKD_VARS= STORAGE_SCHEMES+=diskd DISKIO_MODULES+=DiskDaemon -FS_ROCK_VARS= STORAGE_SCHEMES+=rock NETTLE_LIB_DEPENDS= libnettle.so:security/nettle NETTLE_CONFIGURE_WITH= nettle SNMP_CONFIGURE_ENABLE= snmp -SSL_CONFIGURE_ENABLE= ssl -SSL_CONFIGURE_ON= --with-openssl \ - --enable-security-cert-generators="file" \ +SSL_USES= ssl +SSL_CONFIGURE_ON= --enable-security-cert-generators="file" \ + --with-openssl \ LIBOPENSSL_CFLAGS=-I${OPENSSLINC} \ LIBOPENSSL_LIBS="-lcrypto -lssl" -SSL_USES= ssl -SSL_CRTD_CONFIGURE_ENABLE= ssl-crtd +SSL_CONFIGURE_ENABLE= ssl SSL_CRTD_IMPLIES= SSL -STACKTRACES_CONFIGURE_ENABLE= stacktraces -STACKTRACES_EXTRA_PATCHES= ${FILESDIR}/extra-patch-gen-stacktrace +SSL_CRTD_CONFIGURE_ENABLE= ssl-crtd STACKTRACES_LIB_DEPENDS= libunwind.so:devel/libunwind +STACKTRACES_CONFIGURE_ENABLE= stacktraces STACKTRACES_CFLAGS= -g STACKTRACES_LDFLAGS= -lunwind +STACKTRACES_EXTRA_PATCHES= ${FILESDIR}/extra-patch-gen-stacktrace STACKTRACES_VARS= STRIP="" +TDB_LIB_DEPENDS= libtdb.so:databases/tdb +TDB_CONFIGURE_WITH= tdb +TDB_VARS= EXTERNAL_ACL+="time_quota session" TP_IPFW_CONFIGURE_ENABLE= ipfw-transparent TP_IPF_CONFIGURE_ENABLE= ipf-transparent TP_PF_CONFIGURE_ENABLE= pf-transparent @@ -119,108 +204,16 @@ VIA_DB_CONFIGURE_ENABLE= forw-via-db WCCPV2_CONFIGURE_ENABLE= wccpv2 WCCP_CONFIGURE_ENABLE= wccp -GSSAPI_NONE_CONFIGURE_ON= --without-heimdal-krb5 \ - --without-mit-krb5 \ - --without-gnugss - -GSSAPI_BASE_USES= gssapi -GSSAPI_BASE_CONFIGURE_ON= --with-heimdal-krb5=${GSSAPIBASEDIR} \ - ${GSSAPI_CONFIGURE_ARGS} \ - krb5_config=${GSSAPIBASEDIR}/bin/krb5-config -GSSAPI_BASE_PLIST_SUB= AUTH_KERB="" - -GSSAPI_HEIMDAL_USES= gssapi:heimdal -GSSAPI_HEIMDAL_CONFIGURE_ON= --with-heimdal-krb5=${GSSAPIBASEDIR} \ - ${GSSAPI_CONFIGURE_ARGS} \ - krb5_config=${GSSAPIBASEDIR}/bin/krb5-config -GSSAPI_HEIMDAL_PLIST_SUB= AUTH_KERB="" - -GSSAPI_MIT_USES= gssapi:mit -GSSAPI_MIT_CONFIGURE_ON= --with-mit-krb5=${GSSAPIBASEDIR} \ - ${GSSAPI_CONFIGURE_ARGS} \ - krb5_config=${GSSAPIBASEDIR}/bin/krb5-config -GSSAPI_MIT_PLIST_SUB= AUTH_KERB="" - -ARP_ACL_DESC= ARP/MAC/EUI based authentification -AUTH_DESC= Authentication helpers -AUTH_LDAP_DESC= Install LDAP authentication helpers -AUTH_NIS_DESC= Install NIS/YP authentication helpers -AUTH_SASL_DESC= Install SASL authentication helpers -AUTH_SMB_DESC= Install SMB auth. helpers (req. Samba) -AUTH_SQL_DESC= Install SQL based auth -TDB_DESC= TrivialDB support required for session and time quota external helpers -CACHE_DIGESTS_DESC= Use cache digests -DEBUG_DESC= Build with extended debugging support -DELAY_POOLS_DESC= Delay pools (bandwidth limiting) -ECAP_DESC= Loadable content adaptation modules -ESI_DESC= ESI support -FOLLOW_XFF_DESC= Support for the X-Following-For header -FS_AUFS_DESC= AUFS (threaded-io) support -FS_DISKD_DESC= DISKD storage engine controlled by separate service -FS_ROCK_DESC= ROCK storage engine -HTCP_DESC= HTCP support -ICAP_DESC= the ICAP client -ICMP_DESC= ICMP pinging and network measurement -IDENT_DESC= Ident lookups (RFC 931) -KQUEUE_DESC= Kqueue(2) support -LARGEFILE_DESC= Support large (>2GB) cache and log files -NETTLE_DESC= Nettle MD5 algorithm support -SNMP_DESC= SNMP support -SSL_CRTD_DESC= Use ssl_crtd to handle SSL cert requests -SSL_DESC= SSL gatewaying support -STACKTRACES_DESC= Enable automatic backtraces on fatal errors -LAX_HTTP_DESC= Do not enforce strict HTTP compliance -TP_IPFW_DESC= Transparent proxying with IPFW -TP_IPF_DESC= Transparent proxying with IPFilter -TP_PF_DESC= Transparent proxying with PF -VIA_DB_DESC= Forward/Via database -WCCPV2_DESC= Web Cache Coordination Protocol v2 -WCCP_DESC= Web Cache Coordination Protocol - -change_files= ChangeLog \ - errors/Makefile.am \ - errors/Makefile.in \ - src/auth/basic/SMB_LM/README.html \ - src/Makefile.am \ - src/Makefile.in \ - src/cf_gen.cc \ - src/squid.8.in \ - test-suite/Makefile.in \ - tools/Makefile.am \ - tools/Makefile.in - -.if !defined(SQUID_CONFIGURE_ARGS) \ - || ${SQUID_CONFIGURE_ARGS:M*--disable-unlinkd*} == "" -PLIST_SUB+= UNLINKD="" -.else -PLIST_SUB+= UNLINKD="@comment " -.endif +MYDOCS= QUICKSTART README RELEASENOTES.html doc/debug-sections.txt -CONFIGURE_ARGS= --with-default-user=squid \ - --bindir=${PREFIX}/sbin \ - --sbindir=${PREFIX}/sbin \ - --datadir=${ETCDIR} \ - --libexecdir=${PREFIX}/libexec/squid \ - --localstatedir=/var \ - --sysconfdir=${ETCDIR} \ - --with-logdir=/var/log/squid \ - --with-pidfile=/var/run/squid/squid.pid \ - --with-swapdir=/var/squid/cache \ - --without-gnutls \ - --with-included-ltdl \ - --enable-build-info \ - --enable-removal-policies="lru heap" \ - --disable-epoll \ - --disable-arch-native \ - --disable-strict-error-checking \ - --without-systemd \ - --without-netfilter-conntrack \ - --without-cap +change_files= ChangeLog errors/Makefile.am errors/Makefile.in \ + src/auth/basic/SMB_LM/README.html src/Makefile.am \ + src/Makefile.in src/cf_gen.cc src/squid.8.in \ + test-suite/Makefile.in tools/Makefile.am tools/Makefile.in .include <bsd.port.options.mk> # Authentication methods and modules: - BASIC_AUTH+= DB NCSA PAM POP3 RADIUS SMB_LM fake getpwnam DIGEST_AUTH+= file EXTERNAL_ACL+= file_userip unix_group delayer @@ -231,7 +224,8 @@ BASIC_AUTH+= NIS .endif # POLA: allow the old global make.conf(5) (pre src.conf(5)) defines, too: -.if ${PORT_OPTIONS:MGSSAPI_NONE} || defined(NO_KERBEROS) || defined(WITHOUT_KERBEROS) +.if ${PORT_OPTIONS:MGSSAPI_NONE} || defined(NO_KERBEROS) || \ + defined(WITHOUT_KERBEROS) NEGOTIATE_AUTH= none PLIST_SUB+= AUTH_KERB="@comment " .else @@ -251,14 +245,13 @@ CONFIGURE_ARGS+= --enable-auth-basic="${BASIC_AUTH}" \ --enable-auth-digest="${DIGEST_AUTH}" \ --enable-auth-negotiate="${NEGOTIATE_AUTH}" \ --enable-auth-ntlm="fake SMB_LM" \ - --enable-log-daemon-helpers="file DB" \ + --enable-disk-io="${DISKIO_MODULES}" \ --enable-external-acl-helpers="${EXTERNAL_ACL}" \ - --enable-url-rewrite-helpers="fake LFS" \ + --enable-log-daemon-helpers="file DB" \ --enable-security-cert-validators="fake" \ --enable-storeid-rewrite-helpers="file" \ --enable-storeio="${STORAGE_SCHEMES}" \ - --enable-disk-io="${DISKIO_MODULES}" \ - + --enable-url-rewrite-helpers="fake LFS" # Other options set via 'make config': .if ${PORT_OPTIONS:MDEBUG} || defined(WITH_DEBUG) diff --git a/www/squid/files/patch-configure b/www/squid/files/patch-configure index 24648548bddc..c98cda36c325 100644 --- a/www/squid/files/patch-configure +++ b/www/squid/files/patch-configure @@ -1,6 +1,15 @@ ---- configure.orig 2024-03-04 05:50:28 UTC +--- configure.orig 2024-10-11 07:24:17 UTC +++ configure -@@ -43985,7 +43985,10 @@ _ACEOF +@@ -29452,7 +29452,7 @@ fi + fi + + +-if test "x$with_nettle" != "xno"] ++if test "x$with_nettle" != "xno" + then : + + +@@ -44043,7 +44043,10 @@ else $as_nop else $as_nop @@ -12,7 +21,7 @@ fi -@@ -50834,6 +50837,7 @@ fi +@@ -50892,6 +50895,7 @@ ac_fn_cxx_check_type "$LINENO" "cpu_set_t" "ac_cv_type ac_fn_cxx_check_type "$LINENO" "cpu_set_t" "ac_cv_type_cpu_set_t" " #if HAVE_SCHED_H @@ -20,7 +29,7 @@ #include <sched.h> #endif -@@ -54020,6 +54024,7 @@ else $as_nop +@@ -53860,6 +53864,7 @@ else $as_nop # include <sys/ioccom.h> # include <netinet/in.h> #undef minor_t