From 37e7d965c619c01fdfeda3cbdc4bce9f014a90fe Mon Sep 17 00:00:00 2001 From: Christopher Byrne Date: Tue, 14 Jul 2026 17:14:45 -0500 Subject: [PATCH] app-crypt/clevis: add 23 Because upstream uses automagic dependencies, patches have been applied (and sent upstream) to use less of them. I'm not sure if this version fixes https://github.com/latchset/clevis/issues/456. Testers welcome. Closes: https://bugs.gentoo.org/945493 Closes: https://bugs.gentoo.org/973538 Signed-off-by: Christopher Byrne --- app-crypt/clevis/Manifest | 1 + app-crypt/clevis/clevis-23.ebuild | 93 ++++ ...3-cleanup-meson-deprecation-warnings.patch | 425 ++++++++++++++++++ .../files/clevis-23-disable-automagic.patch | 77 ++++ .../clevis-23-disable-pkcs11-automagic.patch | 21 + .../clevis/files/clevis-23-openrc-fixes.patch | 25 ++ app-crypt/clevis/metadata.xml | 5 +- 7 files changed, 646 insertions(+), 1 deletion(-) create mode 100644 app-crypt/clevis/clevis-23.ebuild create mode 100644 app-crypt/clevis/files/clevis-23-cleanup-meson-deprecation-warnings.patch create mode 100644 app-crypt/clevis/files/clevis-23-disable-automagic.patch create mode 100644 app-crypt/clevis/files/clevis-23-disable-pkcs11-automagic.patch create mode 100644 app-crypt/clevis/files/clevis-23-openrc-fixes.patch diff --git a/app-crypt/clevis/Manifest b/app-crypt/clevis/Manifest index 87942abebb..f3dea06463 100644 --- a/app-crypt/clevis/Manifest +++ b/app-crypt/clevis/Manifest @@ -1,3 +1,4 @@ DIST clevis-19.tar.gz 81324 BLAKE2B 75323940d0b53e307f5dbc197e3117e7ddc900d76ae1043bac3d17cc3af0264ba00a5f840c5c9dd3c2dd9c8fbde2cf05934b8ab3e89cd403ad8a8eb28609bb78 SHA512 dee19354c908c3843fc295a84b431780d5d6062c77766ee7ce9550636d3623d92b0cd1f6d4c40d57bef14debddc161da2b72289a5d6185cdd17b09a1ef67409a DIST clevis-20.tar.gz 83668 BLAKE2B df00752f630762e8d52fb3fb9e0cd76129a53cf3c85300eb2c3967f9cb39139eb2b38e434e72dd879a5062555d7b5933558b87bba2dd01533bf92d0c059fbc5e SHA512 bee42f1e44b8ca8b1be7b9abf265d1bef14a8ecca6e18f48fbc33f3624b6633c5d150a83745eb8ea13a9a343235de07b0754b6ff9b462a1e7376964e7672a80d DIST clevis-21.tar.gz 101599 BLAKE2B 3c02b409e3571d73ad46383da1863e2e2af33786e5a4d4a671b0423133442f379cd42e63f0d8c907604f3339bbf253c255eeefc7567b636ccf1cdb9993efa6dd SHA512 f069969a45195679cc5e521ed0b4ec2199d774aab59ec1d60533a3e9af70468aa2c75dfc695e9d48a255828971a3cf199388c92ffa999faadfc16d7c80eb9fde +DIST clevis-23.tar.gz 137146 BLAKE2B d3a3a898ecc5124f40bb19cadda7e3ae395426a537d843f303dd552f92c69691c0121f817cd9453f081ce9d3084a8f2d13b4de150da46975a26474eca9286751 SHA512 305d9ee4d180314a646e6010ee2755c9e6dc981dbebc3c3194c53980d14fbf78a48427ccd15c2b7c89465ab5389550c53a47065866ce97afc604d9fdee86c546 diff --git a/app-crypt/clevis/clevis-23.ebuild b/app-crypt/clevis/clevis-23.ebuild new file mode 100644 index 0000000000..a656ab3177 --- /dev/null +++ b/app-crypt/clevis/clevis-23.ebuild @@ -0,0 +1,93 @@ +# Copyright 2022-2024 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=8 + +inherit meson shell-completion + +DESCRIPTION="Automated Encryption Framework" +HOMEPAGE="https://github.com/latchset/clevis" +SRC_URI="https://github.com/latchset/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz" + +LICENSE="GPL-3" +SLOT="0" +KEYWORDS="~amd64" +IUSE="dracut pkcs11 test tpm tpm1 udisks" + +BDEPEND="app-text/asciidoc + test? ( tpm? ( app-crypt/swtpm ) + tpm1? ( app-crypt/swtpm ) + net-misc/socat + sys-process/lsof + ) + udisks? ( dev-util/glib-utils ) +" + +# dev-libs/openssl is an automagic dependency for clevis sss pin +# net-misc/curl is an automagic dependency for clevis tang pin +# app-crypt/tpm2-tools is an automagic dependency for clevis tpm2 pin +# Even though they are only invoked at rum time, the build process will not include +# support if they are not on the build host, hance they must be DEPEND. + +PINS_AUTOMAGIC_DEPEND=" + dev-libs/openssl:= + net-misc/curl + app-crypt/tpm2-tools +" + +# sys-fs/cryptsetup and dev-libs/luksmeta are automagic dependencies for LUKS support +DEPEND=" + ${PINS_AUTOMAGIC_DEPEND} + dev-libs/jansson + dev-libs/jose + dev-libs/luksmeta + sys-fs/cryptsetup + dracut? ( sys-kernel/dracut ) + pkcs11? ( + dev-libs/opensc + sys-apps/pcsc-lite[policykit] + ) + tpm1? ( app-crypt/tpm-tools ) + udisks? ( + dev-libs/glib + sys-fs/udisks + sys-process/audit + ) +" + +# clevis-luks-edit has an RDEPEND on app-misc/jq +RDEPEND=" + ${DEPEND} + app-misc/jq + app-crypt/tpm2-tools +" + +RESTRICT="!test? ( test )" + +PATCHES=( + "${FILESDIR}/${PN}-23-openrc-fixes.patch" + "${FILESDIR}/${PN}-23-cleanup-meson-deprecation-warnings.patch" + "${FILESDIR}/${PN}-23-disable-automagic.patch" + "${FILESDIR}/${PN}-23-disable-pkcs11-automagic.patch" +) + +src_configure() { + local emesonargs=( + $(meson_feature dracut) + $(meson_feature pkcs11) + $(meson_feature tpm1) + $(meson_feature udisks) + "-Dbashcompdir=$(get_bashcompdir)" + ) + meson_src_configure +} + +# Most of the tests require root (FEATURES="-userpriv") +# To run the tang pin tests, install app-crypt/tang beforehand +src_test() { + local excludedtests=( +# Doesn't work in the sandbox or without root + "pin-tpm2-sw" + ) + meson_src_test $(meson test -C "${BUILD_DIR}" --list | grep -v "${excludedtests[@]}") +} diff --git a/app-crypt/clevis/files/clevis-23-cleanup-meson-deprecation-warnings.patch b/app-crypt/clevis/files/clevis-23-cleanup-meson-deprecation-warnings.patch new file mode 100644 index 0000000000..ae67a91359 --- /dev/null +++ b/app-crypt/clevis/files/clevis-23-cleanup-meson-deprecation-warnings.patch @@ -0,0 +1,425 @@ +diff --git a/meson.build b/meson.build +index 8c45872..cd786d7 100644 +--- a/meson.build ++++ b/meson.build +@@ -1,6 +1,10 @@ + project('clevis', 'c', license: 'GPL3+', + version: '23', +- default_options: 'c_std=c99' ++ default_options: [ ++ 'c_std=c99', ++ 'warning_level=2', ++ 'werror=true' ++ ] + ) + + libexecdir = join_paths(get_option('prefix'), get_option('libexecdir')) +@@ -15,9 +19,6 @@ data.set('bindir', bindir) + data.set('libdir', libdir) + + add_project_arguments( +- '-Wall', +- '-Wextra', +- '-Werror', + '-Wstrict-aliasing', + '-Wchar-subscripts', + '-Wformat-security', +diff --git a/src/bash/meson.build b/src/bash/meson.build +index 89ba746..e9e597a 100644 +--- a/src/bash/meson.build ++++ b/src/bash/meson.build +@@ -1,7 +1,7 @@ + bashcomp = dependency('bash-completion', required: false) + + if bashcomp.found() +- bashcompdir = bashcomp.get_pkgconfig_variable('completionsdir') ++ bashcompdir = bashcomp.get_variable(pkgconfig : 'completionsdir') + install_data('clevis', install_dir: bashcompdir) + else + warning('Will not install bash completion due to missing dependencies!') +diff --git a/src/luks/dracut/clevis-pin-null/meson.build b/src/luks/dracut/clevis-pin-null/meson.build +index 57278f7..0c7e172 100644 +--- a/src/luks/dracut/clevis-pin-null/meson.build ++++ b/src/luks/dracut/clevis-pin-null/meson.build +@@ -1,7 +1,7 @@ + dracut = dependency('dracut', required: false) + + if dracut.found() +- dracutdir = dracut.get_pkgconfig_variable('dracutmodulesdir') + '/50' + meson.project_name() + '-pin-null' ++ dracutdir = dracut.get_variable(pkgconfig : 'dracutmodulesdir') + '/50' + meson.project_name() + '-pin-null' + + configure_file( + input: 'module-setup.sh.in', +diff --git a/src/luks/dracut/clevis-pin-pkcs11/meson.build b/src/luks/dracut/clevis-pin-pkcs11/meson.build +index 689222b..ecd1421 100644 +--- a/src/luks/dracut/clevis-pin-pkcs11/meson.build ++++ b/src/luks/dracut/clevis-pin-pkcs11/meson.build +@@ -1,7 +1,7 @@ + dracut = dependency('dracut', required: false) + + if dracut.found() +- dracutdir = dracut.get_pkgconfig_variable('dracutmodulesdir') + '/50' + meson.project_name() + '-pin-pkcs11' ++ dracutdir = dracut.get_variable(pkgconfig : 'dracutmodulesdir') + '/50' + meson.project_name() + '-pin-pkcs11' + + configure_file( + input: 'module-setup.sh.in', +diff --git a/src/luks/dracut/clevis-pin-sss/meson.build b/src/luks/dracut/clevis-pin-sss/meson.build +index c652a9e..34a7345 100644 +--- a/src/luks/dracut/clevis-pin-sss/meson.build ++++ b/src/luks/dracut/clevis-pin-sss/meson.build +@@ -1,7 +1,7 @@ + dracut = dependency('dracut', required: false) + + if dracut.found() +- dracutdir = dracut.get_pkgconfig_variable('dracutmodulesdir') + '/50' + meson.project_name() + '-pin-sss' ++ dracutdir = dracut.get_variable(pkgconfig : 'dracutmodulesdir') + '/50' + meson.project_name() + '-pin-sss' + + configure_file( + input: 'module-setup.sh.in', +diff --git a/src/luks/dracut/clevis-pin-tang/meson.build b/src/luks/dracut/clevis-pin-tang/meson.build +index 8e1cfca..92af675 100644 +--- a/src/luks/dracut/clevis-pin-tang/meson.build ++++ b/src/luks/dracut/clevis-pin-tang/meson.build +@@ -1,7 +1,7 @@ + dracut = dependency('dracut', required: false) + + if dracut.found() +- dracutdir = dracut.get_pkgconfig_variable('dracutmodulesdir') + '/50' + meson.project_name() + '-pin-tang' ++ dracutdir = dracut.get_variable(pkgconfig : 'dracutmodulesdir') + '/50' + meson.project_name() + '-pin-tang' + + configure_file( + input: 'module-setup.sh.in', +diff --git a/src/luks/dracut/clevis-pin-tpm1/meson.build b/src/luks/dracut/clevis-pin-tpm1/meson.build +index 8e5a675..6515b6a 100644 +--- a/src/luks/dracut/clevis-pin-tpm1/meson.build ++++ b/src/luks/dracut/clevis-pin-tpm1/meson.build +@@ -1,7 +1,7 @@ + dracut = dependency('dracut', required: false) + + if dracut.found() +- dracutdir = dracut.get_pkgconfig_variable('dracutmodulesdir') + '/50' + meson.project_name() + '-pin-tpm1' ++ dracutdir = dracut.get_variable(pkgconfig : 'dracutmodulesdir') + '/50' + meson.project_name() + '-pin-tpm1' + + configure_file( + input: 'module-setup.sh.in', +diff --git a/src/luks/dracut/clevis-pin-tpm2/meson.build b/src/luks/dracut/clevis-pin-tpm2/meson.build +index 7863f8b..58990e7 100644 +--- a/src/luks/dracut/clevis-pin-tpm2/meson.build ++++ b/src/luks/dracut/clevis-pin-tpm2/meson.build +@@ -1,7 +1,7 @@ + dracut = dependency('dracut', required: false) + + if dracut.found() +- dracutdir = dracut.get_pkgconfig_variable('dracutmodulesdir') + '/50' + meson.project_name() + '-pin-tpm2' ++ dracutdir = dracut.get_variable(pkgconfig : 'dracutmodulesdir') + '/50' + meson.project_name() + '-pin-tpm2' + + configure_file( + input: 'module-setup.sh.in', +diff --git a/src/luks/dracut/clevis/meson.build b/src/luks/dracut/clevis/meson.build +index e6230f3..ca21624 100644 +--- a/src/luks/dracut/clevis/meson.build ++++ b/src/luks/dracut/clevis/meson.build +@@ -1,7 +1,7 @@ + dracut = dependency('dracut', required: false) + + if dracut.found() +- dracutdir = dracut.get_pkgconfig_variable('dracutmodulesdir') + '/50' + meson.project_name() ++ dracutdir = dracut.get_variable(pkgconfig : 'dracutmodulesdir') + '/50' + meson.project_name() + + dracut_data = configuration_data() + dracut_data.merge_from(data) +diff --git a/src/luks/meson.build b/src/luks/meson.build +index 6c7b035..5469c3b 100644 +--- a/src/luks/meson.build ++++ b/src/luks/meson.build +@@ -42,7 +42,7 @@ clevis_luks_unbind = configure_file(input: 'clevis-luks-unbind.in', + + # SystemD dependencies checked here, used both in systemd and dracut subdirs + systemd = dependency('systemd', required: false) +-systemdutildir = systemd.found() ? systemd.get_pkgconfig_variable('systemdutildir', default: '') : '' ++systemdutildir = systemd.found() ? systemd.get_variable(pkgconfig : 'systemdutildir', default_value: '') : '' + + sd_reply_pass = find_program( + (systemdutildir != '') ? join_paths(systemdutildir, 'systemd-reply-password') : '', +diff --git a/src/luks/tests/meson.build b/src/luks/tests/meson.build +index aebc481..0735219 100644 +--- a/src/luks/tests/meson.build ++++ b/src/luks/tests/meson.build +@@ -28,21 +28,21 @@ common_functions = configure_file(input: 'luks-common-test-functions.in', + + env = environment() + env.prepend('PATH', +- join_paths(meson.source_root(), 'src'), +- join_paths(meson.source_root(), 'src', 'luks'), +- join_paths(meson.source_root(), 'src', 'pins', 'sss'), +- join_paths(meson.source_root(), 'src', 'pins', 'tang'), +- join_paths(meson.source_root(), 'src', 'pins', 'tpm1'), +- join_paths(meson.source_root(), 'src', 'pins', 'tpm2'), ++ join_paths(meson.project_source_root(), 'src'), ++ join_paths(meson.project_source_root(), 'src', 'luks'), ++ join_paths(meson.project_source_root(), 'src', 'pins', 'sss'), ++ join_paths(meson.project_source_root(), 'src', 'pins', 'tang'), ++ join_paths(meson.project_source_root(), 'src', 'pins', 'tpm1'), ++ join_paths(meson.project_source_root(), 'src', 'pins', 'tpm2'), + meson.current_source_dir(), + meson.current_build_dir(), +- join_paths(meson.build_root(), 'src'), +- join_paths(meson.build_root(), 'src', 'luks'), +- join_paths(meson.build_root(), 'src', 'pins', 'sss'), +- join_paths(meson.build_root(), 'src', 'pins', 'tang'), +- join_paths(meson.build_root(), 'src', 'pins', 'tang', 'tests'), +- join_paths(meson.build_root(), 'src', 'pins', 'tpm1'), +- join_paths(meson.build_root(), 'src', 'pins', 'tpm2'), ++ join_paths(meson.project_build_root(), 'src'), ++ join_paths(meson.project_build_root(), 'src', 'luks'), ++ join_paths(meson.project_build_root(), 'src', 'pins', 'sss'), ++ join_paths(meson.project_build_root(), 'src', 'pins', 'tang'), ++ join_paths(meson.project_build_root(), 'src', 'pins', 'tang', 'tests'), ++ join_paths(meson.project_build_root(), 'src', 'pins', 'tpm1'), ++ join_paths(meson.project_build_root(), 'src', 'pins', 'tpm2'), + separator: ':' + ) + +diff --git a/src/pins/file/meson.build b/src/pins/file/meson.build +index dbd9a56..fd43e14 100644 +--- a/src/pins/file/meson.build ++++ b/src/pins/file/meson.build +@@ -8,7 +8,7 @@ mans += join_paths(meson.current_source_dir(), 'clevis-encrypt-file.1') + + env = environment() + env.append('PATH', +- join_paths(meson.source_root(), 'src'), ++ join_paths(meson.project_source_root(), 'src'), + meson.current_source_dir(), + '/usr/libexec', + libexecdir, +@@ -18,7 +18,7 @@ env.append('PATH', + test('pin-file', find_program('./pin-file'), env: env) + + if dracut.found() +- dracutdir = dracut.get_pkgconfig_variable('dracutmodulesdir') + '/50' + meson.project_name() + '-pin-file' ++ dracutdir = dracut.get_variable(pkgconfig : 'dracutmodulesdir') + '/50' + meson.project_name() + '-pin-file' + configure_file( + input: 'dracut.module-setup.sh.in', + output: 'module-setup.sh', +diff --git a/src/pins/pkcs11/tests/meson.build b/src/pins/pkcs11/tests/meson.build +index 73ca2f7..998562d 100644 +--- a/src/pins/pkcs11/tests/meson.build ++++ b/src/pins/pkcs11/tests/meson.build +@@ -1,22 +1,22 @@ + env = environment() + env.prepend('PATH', +- join_paths(meson.source_root(), 'src'), +- join_paths(meson.source_root(), 'src', 'pins', 'pkcs11'), +- join_paths(meson.source_root(), 'src', 'pins', 'pkcs11', 'tests'), +- join_paths(meson.build_root(), 'src'), +- join_paths(meson.build_root(), 'src', 'pins'), +- join_paths(meson.build_root(), 'src', 'pins', 'pkcs11'), +- join_paths(meson.build_root(), 'src', 'pins', 'pkcs11', 'tests'), +- join_paths(meson.source_root(), 'src'), +- join_paths(meson.source_root(), 'src', 'luks'), +- join_paths(meson.source_root(), 'src', 'luks', 'tests'), +- join_paths(meson.build_root(), 'src'), +- join_paths(meson.build_root(), 'src', 'luks'), +- join_paths(meson.build_root(), 'src', 'luks', 'tests'), +- join_paths(meson.source_root(), 'src', 'pins', 'tang'), +- join_paths(meson.source_root(), 'src', 'pins', 'tang', 'tests'), +- join_paths(meson.build_root(), 'src', 'pins', 'tang'), +- join_paths(meson.build_root(), 'src', 'pins', 'tang', 'tests'), ++ join_paths(meson.project_source_root(), 'src'), ++ join_paths(meson.project_source_root(), 'src', 'pins', 'pkcs11'), ++ join_paths(meson.project_source_root(), 'src', 'pins', 'pkcs11', 'tests'), ++ join_paths(meson.project_build_root(), 'src'), ++ join_paths(meson.project_build_root(), 'src', 'pins'), ++ join_paths(meson.project_build_root(), 'src', 'pins', 'pkcs11'), ++ join_paths(meson.project_build_root(), 'src', 'pins', 'pkcs11', 'tests'), ++ join_paths(meson.project_source_root(), 'src'), ++ join_paths(meson.project_source_root(), 'src', 'luks'), ++ join_paths(meson.project_source_root(), 'src', 'luks', 'tests'), ++ join_paths(meson.project_build_root(), 'src'), ++ join_paths(meson.project_build_root(), 'src', 'luks'), ++ join_paths(meson.project_build_root(), 'src', 'luks', 'tests'), ++ join_paths(meson.project_source_root(), 'src', 'pins', 'tang'), ++ join_paths(meson.project_source_root(), 'src', 'pins', 'tang', 'tests'), ++ join_paths(meson.project_build_root(), 'src', 'pins', 'tang'), ++ join_paths(meson.project_build_root(), 'src', 'pins', 'tang', 'tests'), + separator: ':' + ) + +diff --git a/src/pins/sss/meson.build b/src/pins/sss/meson.build +index 2a5295a..d77fa24 100644 +--- a/src/pins/sss/meson.build ++++ b/src/pins/sss/meson.build +@@ -19,8 +19,8 @@ if jansson.found() and libcrypto.found() + + env = environment() + env.prepend('PATH', +- join_paths(meson.source_root(), 'src'), +- join_paths(meson.source_root(), 'src', 'pins', 'tang'), ++ join_paths(meson.project_source_root(), 'src'), ++ join_paths(meson.project_source_root(), 'src', 'pins', 'tang'), + meson.current_build_dir(), + '/usr/libexec', + libexecdir, +diff --git a/src/pins/tang/tests/meson.build b/src/pins/tang/tests/meson.build +index 47fa5d6..feb02a9 100644 +--- a/src/pins/tang/tests/meson.build ++++ b/src/pins/tang/tests/meson.build +@@ -23,15 +23,15 @@ tang_data.set('TANGD_KEYGEN', '') + tang_data.set('TANGD', '') + + if socat.found() +- tang_data.set('SOCAT', socat.path()) ++ tang_data.set('SOCAT', socat.full_path()) + endif + + if kgen.found() +- tang_data.set('TANGD_KEYGEN', kgen.path()) ++ tang_data.set('TANGD_KEYGEN', kgen.full_path()) + endif + + if tang.found() +- tang_data.set('TANGD', tang.path()) ++ tang_data.set('TANGD', tang.full_path()) + endif + + tang_tests_common = configure_file( +@@ -42,10 +42,10 @@ tang_tests_common = configure_file( + + env = environment() + env.prepend('PATH', +- join_paths(meson.source_root(), 'src'), +- join_paths(meson.source_root(), 'src', 'pins', 'tang'), +- join_paths(meson.build_root(), 'src', 'luks', 'tests'), +- join_paths(meson.build_root(), 'src', 'pins', 'tang', 'tests'), ++ join_paths(meson.project_source_root(), 'src'), ++ join_paths(meson.project_source_root(), 'src', 'pins', 'tang'), ++ join_paths(meson.project_build_root(), 'src', 'luks', 'tests'), ++ join_paths(meson.project_build_root(), 'src', 'pins', 'tang', 'tests'), + separator: ':' + ) + +diff --git a/src/pins/template/meson.build b/src/pins/template/meson.build +index e307526..5a84aa9 100644 +--- a/src/pins/template/meson.build ++++ b/src/pins/template/meson.build +@@ -20,7 +20,7 @@ if curl.found() + #%# Set up a test environment + env = environment() + env.append('PATH', +- join_paths(meson.source_root(), 'src'), ++ join_paths(meson.project_source_root(), 'src'), + meson.current_source_dir(), + '/usr/libexec', + libexecdir, +@@ -35,7 +35,7 @@ endif + + #%# dracut support + if dracut.found() +- dracutdir = dracut.get_pkgconfig_variable('dracutmodulesdir') + '/50' + meson.project_name() + '-pin-@pin@' ++ dracutdir = dracut.get_variable(pkgconfig : 'dracutmodulesdir') + '/50' + meson.project_name() + '-pin-@pin@' + #?# In general, substituation is not needed but it's better to + #?# stay flexible. + configure_file( +diff --git a/src/pins/tpm1/tests/meson.build b/src/pins/tpm1/tests/meson.build +index 4f7ebbd..ca1be7d 100644 +--- a/src/pins/tpm1/tests/meson.build ++++ b/src/pins/tpm1/tests/meson.build +@@ -1,14 +1,14 @@ + # Tests + env = environment() + env.prepend('PATH', +- join_paths(meson.source_root(), 'src'), +- join_paths(meson.source_root(), 'src', 'pins', 'tpm1'), +- join_paths(meson.source_root(), 'src', 'pins', 'tpm1', 'tests'), +- join_paths(meson.build_root(), 'src'), +- join_paths(meson.build_root(), 'src', 'luks', 'tests'), +- join_paths(meson.build_root(), 'src', 'pins', 'tang', 'tests'), +- join_paths(meson.build_root(), 'src', 'pins', 'tpm1'), +- join_paths(meson.build_root(), 'src', 'pins', 'tpm1', 'tests'), ++ join_paths(meson.project_source_root(), 'src'), ++ join_paths(meson.project_source_root(), 'src', 'pins', 'tpm1'), ++ join_paths(meson.project_source_root(), 'src', 'pins', 'tpm1', 'tests'), ++ join_paths(meson.project_build_root(), 'src'), ++ join_paths(meson.project_build_root(), 'src', 'luks', 'tests'), ++ join_paths(meson.project_build_root(), 'src', 'pins', 'tang', 'tests'), ++ join_paths(meson.project_build_root(), 'src', 'pins', 'tpm1'), ++ join_paths(meson.project_build_root(), 'src', 'pins', 'tpm1', 'tests'), + separator: ':' + ) + +@@ -23,14 +23,14 @@ tcsd = find_program('tcsd', '/usr/sbin/tcsd', required: false) + swtpm = find_program('swtpm', '/usr/bin/swtpm', required: false) + swtpm_setup = find_program('swtpm_setup', '/usr/bin/swtpm_setup', required: false) + +-tpm1_data.set('TPM_VERSION_BIN', tpm_version.found() ? tpm_version.path() : '') +-tpm1_data.set('TPM_SEALDATA_BIN', tpm_sealdata.found() ? tpm_sealdata.path() : '') +-tpm1_data.set('TPM_UNSEALDATA_BIN', tpm_unsealdata.found() ? tpm_unsealdata.path() : '') +-tpm1_data.set('TPM_TAKEOWNERSHIP_BIN', tpm_takeownership.found() ? tpm_takeownership.path() : '') +-tpm1_data.set('TCSD_BIN', tcsd.found() ? tcsd.path() : '') +-tpm1_data.set('SWTPM_BIN', swtpm.found() ? swtpm.path() : '') +-tpm1_data.set('SWTPM_SETUP_BIN', swtpm_setup.found() ? swtpm_setup.path() : '') +-tpm1_data.set('LIBCLEVIS_TPM1_TCSD_PRELOAD', libclevis_tpm1_tcsd_preload.path()) ++tpm1_data.set('TPM_VERSION_BIN', tpm_version.found() ? tpm_version.full_path() : '') ++tpm1_data.set('TPM_SEALDATA_BIN', tpm_sealdata.found() ? tpm_sealdata.full_path() : '') ++tpm1_data.set('TPM_UNSEALDATA_BIN', tpm_unsealdata.found() ? tpm_unsealdata.full_path() : '') ++tpm1_data.set('TPM_TAKEOWNERSHIP_BIN', tpm_takeownership.found() ? tpm_takeownership.full_path() : '') ++tpm1_data.set('TCSD_BIN', tcsd.found() ? tcsd.full_path() : '') ++tpm1_data.set('SWTPM_BIN', swtpm.found() ? swtpm.full_path() : '') ++tpm1_data.set('SWTPM_SETUP_BIN', swtpm_setup.found() ? swtpm_setup.full_path() : '') ++tpm1_data.set('LIBCLEVIS_TPM1_TCSD_PRELOAD', libclevis_tpm1_tcsd_preload.full_path()) + + configure_file( + input: 'tpm1-common-test-functions.in', +diff --git a/src/pins/tpm2/tests/meson.build b/src/pins/tpm2/tests/meson.build +index f3e21e1..cd0d15d 100644 +--- a/src/pins/tpm2/tests/meson.build ++++ b/src/pins/tpm2/tests/meson.build +@@ -1,20 +1,20 @@ + # Tests. + env = environment() + env.prepend('PATH', +- join_paths(meson.source_root(), 'src'), +- join_paths(meson.source_root(), 'src', 'luks'), +- join_paths(meson.source_root(), 'src', 'luks', 'tests'), +- join_paths(meson.source_root(), 'src', 'pins', 'sss'), +- join_paths(meson.source_root(), 'src', 'pins', 'tang'), +- join_paths(meson.source_root(), 'src', 'pins', 'tpm2'), +- join_paths(meson.source_root(), 'src', 'pins', 'tpm2', 'tests'), +- join_paths(meson.build_root(), 'src'), +- join_paths(meson.build_root(), 'src', 'luks'), +- join_paths(meson.build_root(), 'src', 'luks', 'tests'), +- join_paths(meson.build_root(), 'src', 'pins', 'sss'), +- join_paths(meson.build_root(), 'src', 'pins', 'tang'), +- join_paths(meson.build_root(), 'src', 'pins', 'tpm2'), +- join_paths(meson.build_root(), 'src', 'pins', 'tpm2', 'tests'), ++ join_paths(meson.project_source_root(), 'src'), ++ join_paths(meson.project_source_root(), 'src', 'luks'), ++ join_paths(meson.project_source_root(), 'src', 'luks', 'tests'), ++ join_paths(meson.project_source_root(), 'src', 'pins', 'sss'), ++ join_paths(meson.project_source_root(), 'src', 'pins', 'tang'), ++ join_paths(meson.project_source_root(), 'src', 'pins', 'tpm2'), ++ join_paths(meson.project_source_root(), 'src', 'pins', 'tpm2', 'tests'), ++ join_paths(meson.project_build_root(), 'src'), ++ join_paths(meson.project_build_root(), 'src', 'luks'), ++ join_paths(meson.project_build_root(), 'src', 'luks', 'tests'), ++ join_paths(meson.project_build_root(), 'src', 'pins', 'sss'), ++ join_paths(meson.project_build_root(), 'src', 'pins', 'tang'), ++ join_paths(meson.project_build_root(), 'src', 'pins', 'tpm2'), ++ join_paths(meson.project_build_root(), 'src', 'pins', 'tpm2', 'tests'), + separator: ':' + ) + +@@ -25,9 +25,9 @@ socat = find_program('socat', required: false) + swtpm = find_program('swtpm', '/usr/bin/swtpm', required: false) + swtpm_setup = find_program('swtpm_setup', '/usr/bin/swtpm_setup', required: false) + +-tpm2_data.set('SOCAT_BIN', socat.found() ? socat.path() : '') +-tpm2_data.set('SWTPM_BIN', swtpm.found() ? swtpm.path() : '') +-tpm2_data.set('SWTPM_SETUP_BIN', swtpm_setup.found() ? swtpm_setup.path() : '') ++tpm2_data.set('SOCAT_BIN', socat.found() ? socat.full_path() : '') ++tpm2_data.set('SWTPM_BIN', swtpm.found() ? swtpm.full_path() : '') ++tpm2_data.set('SWTPM_SETUP_BIN', swtpm_setup.found() ? swtpm_setup.full_path() : '') + + configure_file( + input: 'tpm2-common-test-functions.in', diff --git a/app-crypt/clevis/files/clevis-23-disable-automagic.patch b/app-crypt/clevis/files/clevis-23-disable-automagic.patch new file mode 100644 index 0000000000..96d294f682 --- /dev/null +++ b/app-crypt/clevis/files/clevis-23-disable-automagic.patch @@ -0,0 +1,77 @@ +diff --git a/meson_options.txt b/meson_options.txt +index 0c22fd6..11a810b 100644 +--- a/meson_options.txt ++++ b/meson_options.txt +@@ -1,3 +1,6 @@ + option('user', type: 'string', value: 'clevis', description: 'Unprivileged user for secure clevis operations') + option('group', type: 'string', value: 'clevis', description: 'Unprivileged group for secure clevis operations') + option('tpm1', type: 'feature', value: 'auto', description: 'Enable TPM 1.2 pin support') ++option('dracut', type: 'feature', value: 'auto', description: 'Enable dracut support for clevis') ++option('udisks', type: 'feature', value: 'auto', description: 'Enable udisks2 support for clevis') ++option('bashcompdir', type: 'string', value: '', description: 'Directory for bash completion files') +diff --git a/src/bash/meson.build b/src/bash/meson.build +index e9e597a..c353361 100644 +--- a/src/bash/meson.build ++++ b/src/bash/meson.build +@@ -1,7 +1,11 @@ + bashcomp = dependency('bash-completion', required: false) + +-if bashcomp.found() +- bashcompdir = bashcomp.get_variable(pkgconfig : 'completionsdir') ++if get_option('bashcompdir') != '' or bashcomp.found() ++ if get_option('bashcompdir') != '' ++ bashcompdir = get_option('bashcompdir') ++ else ++ bashcompdir = bashcomp.get_variable(pkgconfig: 'completionsdir') ++ endif + install_data('clevis', install_dir: bashcompdir) + else + warning('Will not install bash completion due to missing dependencies!') +diff --git a/src/luks/dracut/meson.build b/src/luks/dracut/meson.build +index d78af7d..fb61872 100644 +--- a/src/luks/dracut/meson.build ++++ b/src/luks/dracut/meson.build +@@ -1,9 +1,12 @@ +-subdir('clevis') +-subdir('clevis-pin-tang') +-if not get_option('tpm1').disabled() +- subdir('clevis-pin-tpm1') ++dracut = dependency('dracut', required: get_option('dracut')) ++if dracut.found() ++ subdir('clevis') ++ subdir('clevis-pin-tang') ++ if not get_option('tpm1').disabled() ++ subdir('clevis-pin-tpm1') ++ endif ++ subdir('clevis-pin-tpm2') ++ subdir('clevis-pin-sss') ++ subdir('clevis-pin-null') ++ subdir('clevis-pin-pkcs11') + endif +-subdir('clevis-pin-tpm2') +-subdir('clevis-pin-sss') +-subdir('clevis-pin-null') +-subdir('clevis-pin-pkcs11') +diff --git a/src/luks/udisks2/meson.build b/src/luks/udisks2/meson.build +index 866055b..8bf4a2d 100644 +--- a/src/luks/udisks2/meson.build ++++ b/src/luks/udisks2/meson.build +@@ -1,6 +1,6 @@ +-audit = dependency('audit', version: '>=2.7.8', required: false) +-udisks2 = dependency('udisks2', required: false) +-gio = dependency('gio-2.0', required: false) ++udisks2 = dependency('udisks2', required: get_option('udisks')) ++audit = dependency('audit', version: '>=2.7.8', required: get_option('udisks')) ++gio = dependency('gio-2.0', required: get_option('udisks')) + + if udisks2.found() and audit.found() and gio.found() + autostartdir = join_paths(sysconfdir, 'xdg', 'autostart') +@@ -18,7 +18,7 @@ if udisks2.found() and audit.found() and gio.found() + install_dir: libexecdir, + install: true, + ) +-else ++elif get_option('udisks').auto() + warning('Will not build udisks2 support due to missing dependencies!') + endif + diff --git a/app-crypt/clevis/files/clevis-23-disable-pkcs11-automagic.patch b/app-crypt/clevis/files/clevis-23-disable-pkcs11-automagic.patch new file mode 100644 index 0000000000..14e3688ce5 --- /dev/null +++ b/app-crypt/clevis/files/clevis-23-disable-pkcs11-automagic.patch @@ -0,0 +1,21 @@ +diff --git a/meson_options.txt b/meson_options.txt +index 11a810b..0f1dd68 100644 +--- a/meson_options.txt ++++ b/meson_options.txt +@@ -4,3 +4,4 @@ option('tpm1', type: 'feature', value: 'auto', description: 'Enable TPM 1.2 pin + option('dracut', type: 'feature', value: 'auto', description: 'Enable dracut support for clevis') + option('udisks', type: 'feature', value: 'auto', description: 'Enable udisks2 support for clevis') + option('bashcompdir', type: 'string', value: '', description: 'Directory for bash completion files') ++option('pkcs11', type: 'feature', value: 'auto', description: 'Enable PKCS11 pin support') +diff --git a/src/pins/pkcs11/meson.build b/src/pins/pkcs11/meson.build +index 95182e9..6ca708d 100644 +--- a/src/pins/pkcs11/meson.build ++++ b/src/pins/pkcs11/meson.build +@@ -1,5 +1,5 @@ +-pcscd = find_program('pcscd', required: false) +-pkcs11tool = find_program('pkcs11-tool', required: false) ++pcscd = find_program('pcscd', required: get_option('pkcs11')) ++pkcs11tool = find_program('pkcs11-tool', required: get_option('pkcs11')) + pcscd_disable_polkit = false + git = find_program('git', required: false) + diff --git a/app-crypt/clevis/files/clevis-23-openrc-fixes.patch b/app-crypt/clevis/files/clevis-23-openrc-fixes.patch new file mode 100644 index 0000000000..cb4da2883e --- /dev/null +++ b/app-crypt/clevis/files/clevis-23-openrc-fixes.patch @@ -0,0 +1,25 @@ +diff --git a/src/luks/dracut/clevis/meson.build b/src/luks/dracut/clevis/meson.build +index f37cc3ce..e6230f33 100644 +--- a/src/luks/dracut/clevis/meson.build ++++ b/src/luks/dracut/clevis/meson.build +@@ -5,7 +5,7 @@ if dracut.found() + + dracut_data = configuration_data() + dracut_data.merge_from(data) +- dracut_data.set('SYSTEMD_REPLY_PASS', sd_reply_pass.path()) ++ dracut_data.set('SYSTEMD_REPLY_PASS', sd_reply_pass.found() ? sd_reply_pass.path() : '') + + configure_file( + input: 'module-setup.sh.in', +diff --git a/src/luks/dracut/clevis/module-setup.sh.in b/src/luks/dracut/clevis/module-setup.sh.in +index 32fac41f..cb0bd22f 100755 +--- a/src/luks/dracut/clevis/module-setup.sh.in ++++ b/src/luks/dracut/clevis/module-setup.sh.in +@@ -52,6 +52,7 @@ install() { + inst_script "$moddir"/clevis-password-unlocker-prepare /bin/clevis-password-unlocker-prepare + inst_multiple \ + clevis-luks-unlock \ ++ chmod \ + blkid + fi + diff --git a/app-crypt/clevis/metadata.xml b/app-crypt/clevis/metadata.xml index d2b62a7828..49edd02196 100644 --- a/app-crypt/clevis/metadata.xml +++ b/app-crypt/clevis/metadata.xml @@ -13,7 +13,10 @@ latchset/clevis + Install dracut modules Enable LUKS support - Enable TPM support + Enable PKCS#11 smartcard support + Enable support for Trusted Platform Module (TPM) 2.0 + Enable support for Trusted Platform Module (TPM) 1.2