security/libressl-devel: Add next-stable LibreSSL 2.3 port

[brnrd]

Summary

Proposed commit message:

security/libressl-devel: Add next-stable LibreSSL 2.3 port

  - Transfer maintainership of security/libressl to brnrd@
  - Add security/libressl-devel for version 2.3.1
  - Including corrections for CVE-2015-3194/3195
  - Add support for multiple versions to bsd.openssl.mk
  - Add option to optionally install API man-pages (201462)
  - Disable silent rules output

Changes:

  - ftp://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.3.0-relnotes.txt
  - ftp://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.3.1-relnotes.txt

PR:		201462
Submitted by: 	adamw (201462)
Reviewed_by:	vsevolod (mentor, maintainer), koobs (mentor), feld (mentor)
Approved by:	(mentor)
Differential_Revision:	https://reviews.freebsd.org/D3585

Test Plan

• Poudriere testport
• Poudriere Bulk of private repo
• portlint -AC (clean)
• make regression-test all tests PASS

[adamw]

security/libressl/Makefile

42 ↗

(On Diff #8930)

Did you want to uncomment the post-install-MAN3-off target?

[brnrd]

security/libressl/Makefile

24 ↗

(On Diff #8930)

There's now a maintainer-approved patch for devel/tcltls see D3695

42 ↗

(On Diff #8930)

Yes. This has now been fixed.

[brnrd]

Update with latest patch-set closing all comments

• devel/tcltls conflict solved in D3695
• Include Mk/bsd.openssl.mk patch
• Include security/Makefile patch

[brnrd]

Update to latest including vulnerability fixes

[koobs]

LGTM, great work.

The commit log is missing spaces where there should be some, and Differential Revision: needs to go on the last line.

[brnrd]

Transfer maintainership

[koobs]

security/libressl-devel/Makefile

7

PORTREVISION shouldn't be needed for an initial add port?

security/libressl-devel/files/patch-include_openssl_opensslv.h

9

/* These will never change */

But they changed, please document the need/rationale in the patch header for future selves

[brnrd]

security/libressl-devel/Makefile

7

Correct. This was done for PC-BSD that already had 2.3.0 without a security patch in use.
Gone now.

security/libressl-devel/files/patch-include_openssl_opensslv.h

9

Added comment to patch file

[brnrd]

• Update security/libressl-devel to 2.3.1
• Add comment to OPENSSL_VERSION patch
• Redo optional nc install

[koobs]

security/libressl-devel/Makefile

34

Since the new test framework (See TEST_* in Mk/bsd.port.mk), should be able to update this to:

TEST_TARGET=check

[brnrd]

Rework regression-test target to TEST_TARGET

[brnrd]

Add patch for CVE-2015-1794

[brnrd]

Add fix for CVE-2015-3195 as well

• Bump portrevision for PC-BSD

[brnrd]

Update LibreSSL patches

• Record change of maintainer for security/libressl

[koobs]

@brnrd Can you pull the security/libressl changes out of this review, leaving only the new -devel parts?

They should really be in isolated changes. Apologies for not asking for this sooner

[brnrd]

Make change atomic, exclude changes to other ports

[brnrd]

In D3585#100968, @koobs wrote:

@brnrd Can you pull the security/libressl changes out of this review, leaving only the new -devel parts?

They should really be in isolated changes. Apologies for not asking for this sooner

Corrected!

security/libressl-devel/Makefile

8

Required for PC-BSD that has been using LibreSSL 2.3 since 2015-10-03 and the security/libressl-devel port since 2015-11-13 for pcbsd-101-RELEASE. This revision includes the CVE-2015-3194 and CVE-2015-3195 corrections

[brnrd]

Fix imminent make index failure

[feld]

what happened to the man page situation? It still looks like we're installing 1400 man pages :-)

[adamw]

In D3585#101156, @feld wrote:

what happened to the man page situation? It still looks like we're installing 1400 man pages :-)

Is the MAN3 option not working for you?

They're removed before packaging in post-install-MAN3-off. It's simple that way, and less trivial to patch up libressl not to install them to STAGEDIR in the first place (but still to install the man1 page

In this case, they're processed/installed with install(1) and ln(1), so it doesn't add much to build time. In openssl, by contrast, it has its own installation script (because openssl has to roll their own everything), and processing the manpages adds considerable build time.

[feld]

I didn't build it yet to confirm -- the pkg-plist visualization in phabric that makes it appear that it will be using a 1562 line pkg-plist with 1400+ man pages.

[adamw]

In D3585#101174, @feld wrote:

I didn't build it yet to confirm -- the pkg-plist visualization in phabric that makes it appear that it will be using a 1562 line pkg-plist with 1400+ man pages.

Gotcha. It deletes those lines from the plist as the last step. The manpages are all installed by default.

[feld]

In D3585#101175, @adamw wrote:

In D3585#101174, @feld wrote:

I didn't build it yet to confirm -- the pkg-plist visualization in phabric that makes it appear that it will be using a 1562 line pkg-plist with 1400+ man pages.

Gotcha. It deletes those lines from the plist as the last step. The manpages are all installed by default.

Aha! I'm not used to seeing the plist handled like that. :) I've tested build and this looks sane to me.

[brnrd]

UPDATING

18 ↗

(On Diff #8752)

After refactoring to keep the current security/libressl and creating a new security/libressl-devel this addition to UPDATING has been removed

security/libressl-devel/Makefile

43

In D3585#101156, @feld wrote:

what happened to the man page situation? It still looks like we're installing 1400 man pages :-)

This not working for you?

[koobs]

@dinoex doesn't have a phabricator account to review/approval.

@mat approved the removal of portmgr from this review given they do not maintain openssl.mk

This commit is free to land @brnrd