security/libressl: Update to 2.2.2

[brnrd]

Summary

Proposed commit log:

security/libressl: Update to 2.2.2

  * Bump SHLIB versions of libssl/crypto/tls
  * Bump OPENSSL_SHLIBVER in bsd.openssl.mk
  * Add UPDATING entry for SHLIB version bump
  * Narrow scope of CONFLICTS (portlint)

Changes: 

  ftp://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.2.2-relnotes.txt

Differential_revision:	D3278
Reviewed by:        koobs (mentor), vsevolod (maintainer, mentor)
Approved by:        koobs (mentor), vsevolod (maintainer, mentor)

Test Plan

• testport: OK success
• portlint -AC (removed conflict warning)

% portlint -AC
WARN: Makefile: for new port, make $FreeBSD$ tag in comment section empty, to make SVN happy.
0 fatal errors and 1 warning found.

• regression-test:

============================================================================
Testsuite summary for libressl 2.2.2
============================================================================
# TOTAL: 50
# PASS:  50
# SKIP:  0
# XFAIL: 0
# FAIL:  0
# XPASS: 0
# ERROR: 0
============================================================================

• poudriere bulk (115 packages built, no problems sofar)

[brnrd]

Add Mk/bsd.openssl.mk and UPDATING diffs

[mat]

UPDATING

18

What's wrong with running either pkg info -r libressl, or if you only want the one really depending on the libs, pkg shlib -r libcrypto.so.34 and such ?

[brnrd]

UPDATING

18

Thanks for the suggestion! I borrowed the solution from other UPDATING entries. I'd be happy to change it at minimum to pkg info -r as that's an easy simplification.

The pkg info -r method returns the same list, to replicate the function with pkg shlib I had to resort to

`pkg info -qb libressl | xargs -n1 pkg shlib -qR | sort -u`

since pkg-shlib discards all but the first shlib

[mat]

UPDATING

18

pkg shlib does not take more than one argument, so, I'm not sure what you are complaining about.

[koobs]

Can you explain the rationale for updating to a PRE-release?

[brnrd]

In D3278#66877, @koobs wrote:

Can you explain the rationale for updating to a PRE-release?

Just to elicit early feedback. Like with 2.2.1 I'll update this review with the -RELEASE once that's out there.

UPDATING

18

Just that the command becomes a bit long, that's all. the xargs and sort bother me most.

Will go with pkg info -r

[koobs]

UPDATING

21

Provide user instructions for "how" to do this.

dangling shared library dependencies is not necessarily an easily/obviously understood concept

security/libressl/Makefile

12–13

No LICENSE_FILE?

26

regression-test: build

security/libressl/pkg-plist

2

Doesn't this and other /etc/ssl/ entries CONFLICT with ca_root_nss?

80–81

Can you PLIST_SUB+=OPENSSL_SHLIBVER for these?

81

Can you PLIST_SUB+=OPENSSL_SHLIBVER for these?

84–85

Can you PLIST_SUB+=OPENSSL_SHLIBVER for these?

85

Can you PLIST_SUB+=OPENSSL_SHLIBVER for these?

1546

Doesn't this and other /etc/ssl/ entries CONFLICT with ca_root_nss?

[brnrd]

Update patches for 2.2.2 RELEASE

[koobs]

Also, for your commit log message:

* Minor update from OpenBSD LibreSSL-portable

This doesnt describe the changeset/revision. No need to describe 'upstream changes' in itemized changes list, just 'port changes. '

* Bumps SHLIB versions of libssl/crypto/tls
* Bumps OPENSSL_SHLIBVER in bsd.openssl.mk

Use "Bump", or "Increment"

* Pet portlint

describe the change, not the kind of change, eg: Blah blah (portlint)

Changes: 

  ftp://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.2.2-relnotes.txt

Is there a http(s) URL available?

[brnrd]

Add LICENSE_FILE, rename test target

security/libressl/pkg-plist

2

Doesn't conflict with ca_root_nss. That installs /etc/ssl/cert.pem as a symlink to /usr/local/share/certs/ca-root-nss.crt

80–81

That would only be possible for libcrypto as that is what OPENSSL_SHLIBVER is for. That libssl now has version 35 seems to be merely a coincidence, most of the releases these differ, see https://wiki.freebsd.org/LibreSSL#History

[brnrd]

Changes: 

  ftp://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.2.2-relnotes.txt

Is there a http(s) URL available?

Not that I could find. Not even www.libressl.org supports https!

[koobs]

security/libressl/pkg-plist

81

Incorrectly marked "Done"

Only mark done if a change was made based on feedback.

Since OPENSSL_SHLIBVER applies to libcrypto, you can use it for these lines (not libssl's)

[brnrd]

Make use of the SHLIBVER as defined in bsd.openssl.mk

[koobs]

LGTM, if it still builds (post recent plist change). SHIP IT

[vsevolod]

security/libressl/Makefile

22

What's the meaning of this use btw? I'm NOT convinced that libressl should be built merely if OPENSSL_PORT is security/libressl. And by your patch, that's the new behaviour (as you use OPENSSL_SHLIBVER in further). Anyway, I'm not explicitly against this option, just curious and a bit confused.

[brnrd]

security/libressl/Makefile

22

This is here solely to get OPENSSL_SHLIBVER defined so it can be used for PLIST_SUB.

I checked for cyclic dependency and haven't found an issue with build/reinstall. If OPENSSL_PORT is set to security/libressl by the user and any port defines USE_OPENSSL=YES isn't the expected behaviour to build LibreSSL?

[brnrd]

Forgot to remove the _ from Differential_review :'(

[antoine]

The circular dependency is wrong, WITH_OPENSSL_PORT and OPENSSL_PORT are things people put in make.conf

[antoine]

With make.conf containing:

WITH_OPENSSL_PORT=yes
OPENSSL_PORT=security/libressl

You get this when building with poudriere:

[00:00:03] ====>> Calculating ports order and dependencies
[00:00:03] ====>> Error: security/libressl incorrectly depends on itself. Please contact maintainer of the port to fix this.
[00:00:03] ====>> Error: Fatal errors encountered calculating dependencies
[00:00:03] ====>> Cleaning up