blob: c8c4d8f072e347499fa97b9475bcd1de14eac5c1 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
|
# Copyright 1999-2026 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2
EAPI=8
# TODO: meson (not just yet as of 2.8.0, see https://gitlab.com/cryptsetup/cryptsetup/-/issues/949#note_2585304492)
VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/milanbroz.asc
inherit linux-info tmpfiles verify-sig
DESCRIPTION="Tool to setup encrypted devices with dm-crypt"
HOMEPAGE="https://gitlab.com/cryptsetup/cryptsetup"
SRC_URI="
https://www.kernel.org/pub/linux/utils/${PN}/v$(ver_cut 1-2)/${P/_/-}.tar.xz
verify-sig? ( https://www.kernel.org/pub/linux/utils/${PN}/v$(ver_cut 1-2)/${P/_/-}.tar.sign )
"
S="${WORKDIR}"/${P/_/-}
LICENSE="GPL-2+"
SLOT="0/12" # libcryptsetup.so version
if [[ ${PV} != *_rc* ]] ; then
KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
fi
CRYPTO_BACKENDS="gcrypt kernel nettle +openssl"
# We don't support nss since it doesn't allow cryptsetup to be built statically
# and it's missing ripemd160 support so it can't provide full backward compatibility
IUSE="${CRYPTO_BACKENDS} +argon2 fips nls pwquality passwdqc ssh static static-libs test +udev urandom"
RESTRICT="!test? ( test )"
# bug #496612, bug #832711, bug #843863
REQUIRED_USE="
?? ( pwquality passwdqc )
^^ ( ${CRYPTO_BACKENDS//+/} )
static? ( !ssh !udev !fips )
static-libs? ( !passwdqc )
fips? ( !kernel !nettle )
"
LIB_DEPEND="
dev-libs/json-c:=[static-libs(+)]
dev-libs/popt[static-libs(+)]
>=sys-apps/util-linux-2.31-r1[static-libs(+)]
argon2? ( app-crypt/argon2:=[static-libs(+)] )
gcrypt? (
dev-libs/libgcrypt:0=[static-libs(+)]
dev-libs/libgpg-error[static-libs(+)]
)
nettle? ( >=dev-libs/nettle-2.4[static-libs(+)] )
openssl? ( dev-libs/openssl:0=[static-libs(+)] )
pwquality? ( dev-libs/libpwquality[static-libs(+)] )
passwdqc? ( sys-auth/passwdqc )
ssh? ( net-libs/libssh[static-libs(+)] net-libs/libssh[sftp(+)] )
sys-fs/lvm2[static-libs(+)]
"
# We have to always depend on ${LIB_DEPEND} rather than put behind
# !static? () because we provide a shared library which links against
# these other packages. bug #414665
RDEPEND="
static-libs? ( ${LIB_DEPEND} )
${LIB_DEPEND//\[static-libs\([+-]\)\]}
udev? ( virtual/libudev:= )
"
DEPEND="
${RDEPEND}
static? ( ${LIB_DEPEND} )
"
BDEPEND="
virtual/pkgconfig
test? (
app-misc/jq
dev-tcltk/expect
dev-util/xxd
)
verify-sig? ( sec-keys/openpgp-keys-milanbroz )
"
pkg_setup() {
local CONFIG_CHECK="~DM_CRYPT ~CRYPTO ~CRYPTO_CBC ~CRYPTO_SHA256"
local WARNING_DM_CRYPT="CONFIG_DM_CRYPT:\tis not set (required for cryptsetup)\n"
local WARNING_CRYPTO_SHA256="CONFIG_CRYPTO_SHA256:\tis not set (required for cryptsetup)\n"
local WARNING_CRYPTO_CBC="CONFIG_CRYPTO_CBC:\tis not set (required for kernel 2.6.19)\n"
local WARNING_CRYPTO="CONFIG_CRYPTO:\tis not set (required for cryptsetup)\n"
# The kernel crypto backend talks to the in-kernel crypto API via AF_ALG
if use kernel ; then
ewarn "AF_ALG support (controlled by USE=kernel) is deprecated and to-be-removed from the Linux kernel."
ewarn "Please test your usecases with USE=-kernel in preparation for removal."
CONFIG_CHECK+=" ~CRYPTO_USER_API ~CRYPTO_USER_API_HASH ~CRYPTO_USER_API_SKCIPHER"
local WARNING_CRYPTO_USER_API="CONFIG_CRYPTO_USER_API:\tis not set (required for the kernel crypto backend)\n"
local WARNING_CRYPTO_USER_API_HASH="CONFIG_CRYPTO_USER_API_HASH:\tis not set (required for the kernel crypto backend)\n"
local WARNING_CRYPTO_USER_API_SKCIPHER="CONFIG_CRYPTO_USER_API_SKCIPHER:\tis not set (required for the kernel crypto backend)\n"
fi
check_extra_config
}
src_unpack() {
if use verify-sig; then
verify-sig_uncompress_verify_unpack "${DISTDIR}"/${P/_/-}.tar.xz \
"${DISTDIR}"/${P/_/-}.tar.sign
else
default
fi
}
src_configure() {
# configure may search for libselinux but it seems to only be for
# statically linking lvm2
local myeconfargs=(
--disable-internal-argon2
--disable-asciidoc
--enable-shared
--sbindir="${EPREFIX}"/sbin
# for later use
--with-default-luks-format=LUKS2
--with-tmpfilesdir="${EPREFIX}/usr/lib/tmpfiles.d"
--with-crypto_backend=$(for x in ${CRYPTO_BACKENDS//+/} ; do usev ${x} ; done)
$(use_enable argon2 libargon2)
$(use_enable nls)
$(use_enable pwquality)
$(use_enable passwdqc)
$(use_enable !static external-tokens)
$(use_enable static static-cryptsetup)
$(use_enable static-libs static)
$(use_enable udev)
$(use_enable !urandom dev-random)
$(use_enable ssh ssh-token)
$(usev !argon2 '--with-luks2-pbkdf=pbkdf2')
$(use_enable fips)
)
econf "${myeconfargs[@]}"
}
src_install() {
default
if use static ; then
mv "${ED}"/sbin/cryptsetup{.static,} || die
mv "${ED}"/sbin/veritysetup{.static,} || die
mv "${ED}"/sbin/integritysetup{.static,} || die
if use ssh ; then
mv "${ED}"/sbin/cryptsetup-ssh{.static,} || die
fi
fi
find "${ED}" -type f -name "*.la" -delete || die
dodoc docs/v*ReleaseNotes
newconfd "${FILESDIR}"/2.4.3-dmcrypt.confd dmcrypt
newinitd "${FILESDIR}"/2.4.3-dmcrypt.rc dmcrypt
}
pkg_postinst() {
tmpfiles_process cryptsetup.conf
if use kernel ; then
ewarn "Note that kernel backend is very slow for this type of operation"
ewarn "and is provided mainly for embedded systems wanting to avoid"
ewarn "userspace crypto libraries."
fi
}
|
