6 files changed, 429 insertions, 0 deletions
diff --git a/patches/source/openssl/certwatch b/patches/source/openssl/certwatch
new file mode 100644
index 00000000..d52dc3dc
--- /dev/null
+++ b/patches/source/openssl/certwatch
@@ -0,0 +1,130 @@
+#!/bin/sh
+#
+# Will check all certificates stored in $CERTDIR for their expiration date,
+# and will display (if optional "stdout" argument is given), or mail a warning
+# message to $MAILADDR (if script is executed without any parameter
+# - unattended mode suitable for cron execution) for each particular certificate
+# that is about to expire in time less to, or equal to $DAYS after this script
+# has been executed, or if it has already expired.
+# This stupid script (C) 2006,2007 Jan Rafaj
+
+########################## CONFIGURATION SECTION BEGIN #########################
+# Note: all settings are mandatory
+# Warning will be sent if a certificate expires in time <= days given here
+DAYS=7
+# E-mail address where to send warnings
+MAILADDR=root
+# Directory with certificates to check
+CERTDIR=/etc/ssl/certs
+# Directory where to keep state files if this script isnt executed with "stdout"
+STATEDIR=/var/run
+########################### CONFIGURATION SECTION END ##########################
+
+PATH=/bin:/usr/bin:/sbin:/usr/sbin
+DAY_IN_SECS=$((60*60*24))
+DATE_CURRENT=$(date '+%s')
+
+usage()
+{
+  echo "Usage: $0 [stdout]"
+  echo
+  echo "Detailed description and configuration is embedded within the script."
+  exit 0
+}
+
+message()
+{
+  cat << EOF
+    WARNING: certificate $certfile
+    is about to expire in time equal to or less than $DAYS days from now on,
+    or has already expired - it might be a good idea to obtain/create new one.
+
+EOF
+}
+
+message_mail()
+{
+  message
+  cat << EOF
+    NOTE: This message is being sent only once.
+
+    A lock-file
+    $STATEDIR/certwatch-mailwarning-sent-$certfilebase
+    has been created, which will prevent this script from mailing you again
+    upon its subsequent executions by crond. You dont need to care about it;
+    the file will be auto-deleted as soon as you'll prolong your certificate.
+EOF
+}
+
+unset stdout
+case $# in
+  0) ;;
+  1) if   [ "$1" = "-h" -o "$1" == "--help" ]; then
+       usage
+     elif [ "$1" = "stdout" ]; then
+       stdout=1
+     else
+       usage
+     fi
+     ;;
+  *) usage ;;
+esac
+
+for dir in $STATEDIR $CERTDIR ; do
+  if [ ! -d $dir ]; then
+    echo "ERROR: directory $dir does not exist"
+    exit 1
+  fi
+done
+for binary in basename date find grep mail openssl touch ; do
+  if [ ! \( -x /usr/bin/$binary -o -x /bin/$binary \) ]; then
+    echo "ERROR: /usr/bin/$binary not found"
+    exit 1
+  fi
+done
+
+find $CERTDIR -type f -maxdepth 1 | while read certfile ; do
+  if [ "$certfile" != "/etc/ssl/certs/ca-certificates.crt" ]; then
+  certfilebase="$(basename "$certfile")"
+  inform=PEM
+  echo "$certfile" | grep -q -i '\.net$'
+  if [ $? -eq 0 ]; then
+    # This is based purely on filename extension, so may give false results.
+    # But lets assume noone uses NET format certs today, ok?
+    continue
+  fi
+  echo "$certfile" | grep -q -i '\.der$'
+  if [ $? -eq 0 -o "$(file "$certfile" | egrep '(ASCII|PEM)')" == "" ]; then
+    inform=DER
+  fi
+  # We wont use '-checkend' since it is not properly documented (as of
+  # OpenSSL 0.9.8e).
+  DATE_CERT_EXPIRES=$(openssl x509 -in "$certfile" -inform $inform -noout -enddate | sed 's/^notAfter=//')
+  DATE_CERT_EXPIRES=$(date -d"$DATE_CERT_EXPIRES" +%s)
+  if [ $(($DATE_CERT_EXPIRES - $DATE_CURRENT)) -le $(($DAYS * $DAY_IN_SECS)) ]
+  then
+    if [ $stdout ]; then
+      message
+    else
+      if [ ! -f $STATEDIR/certwatch-mailwarning-sent-"$certfilebase" ]; then
+        subject="$0: certificate $certfile expiration warning"
+        message_mail | mail -r "certwatch@$HOSTNAME" \
+                            -s "$subject" \
+                            $MAILADDR 2>/dev/null
+        # echo "Mail about expiring certificate $certfile sent to $MAILADDR."
+        # echo "If you need to send it again, please remove lock-file"
+        # echo "$STATEDIR/certwatch-mailwarning-sent-$certfilebase ."
+        # echo
+      fi
+      touch $STATEDIR/certwatch-mailwarning-sent-"$certfilebase"
+    fi
+  else
+    if [ ! $stdout ]; then
+      if [ -f $STATEDIR/certwatch-mailwarning-sent-"$certfilebase" ]; then
+        rm $STATEDIR/certwatch-mailwarning-sent-"$certfilebase"
+      fi
+    fi
+  fi
+  fi
+done
+
diff --git a/patches/source/openssl/doinst.sh-openssl b/patches/source/openssl/doinst.sh-openssl
new file mode 100644
index 00000000..8fcf3d1c
--- /dev/null
+++ b/patches/source/openssl/doinst.sh-openssl
@@ -0,0 +1,26 @@
+config() {
+  NEW="$1"
+  OLD="`dirname $NEW`/`basename $NEW .new`"
+  # If there's no config file by that name, mv it over:
+  if [ ! -r $OLD ]; then
+    mv $NEW $OLD
+  elif [ "`cat $OLD | md5sum`" = "`cat $NEW | md5sum`" ]; then # toss the redundant copy
+    rm $NEW
+  fi
+  # Otherwise, we leave the .new copy for the admin to consider...
+}
+
+# If there is a known buggy certwatch script with no local
+# modifications, just replace it:
+if [ "$(md5sum etc/cron.daily/certwatch 2> /dev/null)" = "32556321806f1850d56cb2ef8384b7a1  etc/cron.daily/certwatch" ]; then
+  cat etc/cron.daily/certwatch.new > etc/cron.daily/certwatch
+  touch -r etc/cron.daily/certwatch.new etc/cron.daily/certwatch
+fi
+
+config etc/ssl/openssl.cnf.new
+config etc/cron.daily/certwatch.new
+
+# Rehash certificates if the package is upgraded on a running system:
+if [ -x /usr/bin/c_rehash ]; then
+  /usr/bin/c_rehash 1> /dev/null 2> /dev/null
+fi
diff --git a/patches/source/openssl/doinst.sh-openssl-solibs b/patches/source/openssl/doinst.sh-openssl-solibs
new file mode 100644
index 00000000..ed4fdfac
--- /dev/null
+++ b/patches/source/openssl/doinst.sh-openssl-solibs
@@ -0,0 +1,12 @@
+config() {
+  NEW="$1"
+  OLD="`dirname $NEW`/`basename $NEW .new`"
+  # If there's no config file by that name, mv it over:
+  if [ ! -r $OLD ]; then
+    mv $NEW $OLD
+  elif [ "`cat $OLD | md5sum`" = "`cat $NEW | md5sum`" ]; then # toss the redundant copy
+    rm $NEW
+  fi
+  # Otherwise, we leave the .new copy for the admin to consider...
+}
+config etc/ssl/openssl.cnf.new
diff --git a/patches/source/openssl/openssl.SlackBuild b/patches/source/openssl/openssl.SlackBuild
new file mode 100755
index 00000000..a5e4e59b
--- /dev/null
+++ b/patches/source/openssl/openssl.SlackBuild
@@ -0,0 +1,223 @@
+#!/bin/sh
+
+# Copyright 2000 BSDi, Inc. Concord, CA, USA
+# Copyright 2001, 2002 Slackware Linux, Inc.  Concord, CA, USA
+# Copyright 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013, 2014, 2015  Patrick J. Volkerding, Sebeka, MN, USA
+# All rights reserved.
+#
+# Redistribution and use of this script, with or without modification, is
+# permitted provided that the following conditions are met:
+#
+# 1. Redistributions of this script must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+#
+#  THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED
+#  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+#  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO
+#  EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+#  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+#  PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
+#  OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+#  WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+#  OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+#  ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+# Set initial variables:
+CWD=$(pwd)
+TMP=${TMP:-/tmp}
+
+VERSION=${VERSION:-$(echo openssl-*.tar.gz | rev | cut -f 3- -d . | cut -f 1 -d - | rev)}
+BUILD=${BUILD:-1_slack14.2}
+
+# Automatically determine the architecture we're building on:
+if [ -z "$ARCH" ]; then
+  case "$( uname -m )" in
+    i?86) export ARCH=i586 ;;
+    arm*) export ARCH=arm ;;
+    # Unless $ARCH is already set, use uname -m for all other archs:
+       *) export ARCH=$( uname -m ) ;;
+  esac
+fi
+
+PKG1=$TMP/package-openssl
+PKG2=$TMP/package-ossllibs
+NAME1=openssl-$VERSION-$ARCH-$BUILD
+NAME2=openssl-solibs-$VERSION-$ARCH-$BUILD
+
+# Parallel build doesn't link properly.
+#NUMJOBS=${NUMJOBS:--j6}
+
+# So that ls has the right field counts for parsing...
+export LC_ALL=C
+
+cd $TMP
+rm -rf $PKG1 $PKG2 openssl-$VERSION
+
+tar xvf $CWD/openssl-$VERSION.tar.gz || exit 1
+cd openssl-$VERSION
+
+# Fix pod syntax errors which are fatal wih a newer perl:
+find . -name "*.pod" -exec sed -i "s/^\=item \([0-9]\)\(\ \|$\)/\=item C<\1>/g" {} \;
+
+# Use .so.1, not .so.1.0.0:
+sed -i "s/soname=\$\$SHLIB\$\$SHLIB_SOVER\$\$SHLIB_SUFFIX/soname=\$\$SHLIB.1/g" Makefile.shared
+
+if [ "$ARCH" = "i586" ]; then
+  # Build with -march=i586 -mtune=i686:
+  sed -i "/linux-elf/s/fomit-frame-pointer/fomit-frame-pointer -march=i586 -mtune=i686/g" Configure
+  LIBDIRSUFFIX=""
+elif [ "$ARCH" = "i686" ]; then
+  # Build with -march=i686 -mtune=i686:
+  sed -i "/linux-elf/s/fomit-frame-pointer/fomit-frame-pointer -march=i686 -mtune=i686/g" Configure
+  LIBDIRSUFFIX=""
+elif [ "$ARCH" = "x86_64" ]; then
+  LIBDIRSUFFIX="64"
+fi
+
+# OpenSSL has a (nasty?) habit of bumping the internal version number with
+# every release.  This wouldn't be so bad, but some applications are so
+# paranoid that they won't run against a different OpenSSL version than
+# what they were compiled against, whether or not the ABI has changed.
+#
+# So, we will use the OPENSSL_VERSION_NUMBER from openssl-1.0.2e unless ABI
+# breakage forces it to change.  Yes, we're finally using this old trick.  :)
+sed -i "s/#define OPENSSL_VERSION_NUMBER.*/\/* Use 0x1000205fL (1.0.2e) below to avoid pointlessly breaking the ABI *\/\n#define OPENSSL_VERSION_NUMBER 0x1000205fL/g" crypto/opensslv.h || exit 1
+
+chown -R root:root .
+mkdir -p $PKG1/usr/doc/openssl-$VERSION
+cp -a CHANGES CHANGES.SSLeay FAQ INSTALL INSTALL.MacOS INSTALL.VMS INSTALL.W32 \
+  LICENSE NEWS README README.ENGINE doc $PKG1/usr/doc/openssl-$VERSION
+find $PKG1/usr/doc/openssl-$VERSION -type d -exec chmod 755 {} \;
+find $PKG1/usr/doc/openssl-$VERSION -type f -exec chmod 644 {} \;
+
+# If there's a CHANGES file, installing at least part of the recent history
+# is useful, but don't let it get totally out of control:
+if [ -r CHANGES ]; then
+  DOCSDIR=$(echo $PKG1/usr/doc/*-$VERSION)
+  cat CHANGES | head -n 2000 > $DOCSDIR/CHANGES
+  touch -r CHANGES $DOCSDIR/CHANGES
+fi
+
+# These are the known patent issues with OpenSSL:
+# name   #         expires
+# MDC-2: 4,908,861  2007-03-13, not included.
+# IDEA:  5,214,703  2010-05-25, not included.
+# RC5:   5,724,428  2015-03-03, not included.
+#
+# Although all of the above are expired, it's still probably
+# not a good idea to include them as there are better
+# algorithms to use.
+
+./config \
+ --prefix=/usr \
+ --openssldir=/etc/ssl \
+ no-mdc2 \
+ no-idea \
+ no-rc5 \
+ no-sse2 \
+ no-ssl2 \
+ no-weak-ssl-ciphers \
+ shared
+
+make $NUMJOBS depend || make depend || exit 1
+
+make $NUMJOBS || make || exit 1
+
+make install INSTALL_PREFIX=$PKG1 || exit 1
+
+# Make the .so.? library symlinks:
+( cd $PKG1/usr/lib${LIBDIRSUFFIX} ; ldconfig -l lib*.so.* )
+
+# Move libraries, as they might be needed by programs that bring a network
+# mounted /usr online:
+
+mkdir $PKG1/lib${LIBDIRSUFFIX}
+( cd $PKG1/usr/lib${LIBDIRSUFFIX}
+  for file in lib*.so.?.* ; do
+    mv $file ../../lib${LIBDIRSUFFIX}
+    ln -sf ../../lib${LIBDIRSUFFIX}/$file .
+  done 
+  cp -a lib*.so.? ../../lib${LIBDIRSUFFIX}
+)
+
+# Add a cron script to warn root if a certificate is going to expire soon:
+mkdir -p $PKG1/etc/cron.daily
+zcat $CWD/certwatch.gz > $PKG1/etc/cron.daily/certwatch.new
+chmod 755 $PKG1/etc/cron.daily/certwatch.new
+
+mv $PKG1/etc/ssl/openssl.cnf $PKG1/etc/ssl/openssl.cnf.new
+
+( cd $PKG1
+  find . | xargs file | grep "executable" | grep ELF | cut -f 1 -d : | xargs strip --strip-unneeded 2> /dev/null
+  find . | xargs file | grep "shared object" | grep ELF | cut -f 1 -d : | xargs strip --strip-unneeded 2> /dev/null
+)
+
+mv $PKG1/etc/ssl/man $PKG1/usr
+( cd $PKG1/usr/man/man1 ; mv passwd.1 ssl_passwd.1 )
+( cd $PKG1/usr/man/man3 ; mv rand.3 ssl_rand.3 )
+( cd $PKG1/usr/man/man3 ; mv err.3 ssl_err.3 )
+# Compress and symlink the man pages:
+if [ -d $PKG1/usr/man ]; then
+  ( cd $PKG1/usr/man
+    for manpagedir in $(find . -type d -name "man*") ; do
+      ( cd $manpagedir
+        for eachpage in $( find . -type l -maxdepth 1) ; do
+          ln -s $( readlink $eachpage ).gz $eachpage.gz
+          rm $eachpage
+        done
+        gzip -9 *.?
+      )
+    done
+  )
+fi
+
+# If there's an openssl0 directory, then build openssl-0 shared libraries for
+# compatibility with programs linked to those:
+if [ -d $CWD/openssl0 ]; then
+  ( cd $CWD/openssl0
+    ./openssl0.build || exit 1
+  ) || exit 1
+  # Don't put these in the openssl package...  openssl-solibs is enough.
+  #mkdir -p $PKG1/lib${LIBDIRSUFFIX}
+  #cp -a $TMP/package-openssl0/usr/lib/lib*.so.?.?.? $PKG1/lib${LIBDIRSUFFIX}
+  #( cd $PKG1/lib${LIBDIRSUFFIX} ; ldconfig -l lib*.so.?.?.? )
+  mkdir -p $PKG2/lib${LIBDIRSUFFIX}
+  cp -a $TMP/package-openssl0/usr/lib/lib*.so.?.?.? $PKG2/lib${LIBDIRSUFFIX}
+  ( cd $PKG2/lib${LIBDIRSUFFIX} ; ldconfig -l lib*.so.?.?.? )
+fi
+
+cd $PKG1
+chmod 755 usr/lib${LIBDIRSUFFIX}/pkgconfig
+sed -i -e "s#lib\$#lib${LIBDIRSUFFIX}#" usr/lib${LIBDIRSUFFIX}/pkgconfig/*.pc
+mkdir -p install
+zcat $CWD/doinst.sh-openssl.gz > install/doinst.sh
+cat $CWD/slack-desc.openssl > install/slack-desc
+/sbin/makepkg -l y -c n $TMP/${NAME1}.txz
+
+# Make runtime package:
+mkdir -p $PKG2/lib${LIBDIRSUFFIX}
+( cd lib${LIBDIRSUFFIX} ; cp -a lib*.so.* $PKG2/lib${LIBDIRSUFFIX} )
+( cd $PKG2/lib${LIBDIRSUFFIX} ; ldconfig -l * )
+mkdir -p $PKG2/etc
+( cd $PKG2/etc ; cp -a $PKG1/etc/ssl . )
+mkdir -p $PKG2/usr/doc/openssl-$VERSION
+( cd $TMP/openssl-$VERSION
+  cp -a CHANGES CHANGES.SSLeay FAQ INSTALL INSTALL.MacOS INSTALL.VMS INSTALL.W32 \
+  LICENSE NEWS README README.ENGINE $PKG2/usr/doc/openssl-$VERSION
+  # If there's a CHANGES file, installing at least part of the recent history
+  # is useful, but don't let it get totally out of control:
+  if [ -r CHANGES ]; then
+    DOCSDIR=$(echo $PKG2/usr/doc/*-$VERSION)
+    cat CHANGES | head -n 2000 > $DOCSDIR/CHANGES
+    touch -r CHANGES $DOCSDIR/CHANGES
+  fi
+)
+
+find $PKG2/usr/doc/openssl-$VERSION -type d -exec chmod 755 {} \;
+find $PKG2/usr/doc/openssl-$VERSION -type f -exec chmod 644 {} \;
+cd $PKG2
+mkdir -p install
+zcat $CWD/doinst.sh-openssl-solibs.gz > install/doinst.sh
+cat $CWD/slack-desc.openssl-solibs > install/slack-desc
+/sbin/makepkg -l y -c n $TMP/${NAME2}.txz
diff --git a/patches/source/openssl/slack-desc.openssl b/patches/source/openssl/slack-desc.openssl
new file mode 100644
index 00000000..57227c04
--- /dev/null
+++ b/patches/source/openssl/slack-desc.openssl
@@ -0,0 +1,19 @@
+# HOW TO EDIT THIS FILE:
+# The "handy ruler" below makes it easier to edit a package description.  Line
+# up the first '|' above the ':' following the base package name, and the '|' on
+# the right side marks the last column you can put a character in.  You must make
+# exactly 11 lines for the formatting to be correct.  It's also customary to
+# leave one space after the ':'.
+
+       |-----handy-ruler------------------------------------------------------|
+openssl: openssl (Secure Sockets Layer toolkit)
+openssl:
+openssl: The OpenSSL certificate management tool and the shared libraries that
+openssl: provide various encryption and decryption algorithms and protocols.
+openssl:
+openssl: This product includes software developed by the OpenSSL Project for
+openssl: use in the OpenSSL Toolkit (http://www.openssl.org).  This product
+openssl: includes cryptographic software written by Eric Young
+openssl: (eay@cryptsoft.com).  This product includes software written by Tim
+openssl: Hudson (tjh@cryptsoft.com).
+openssl:
diff --git a/patches/source/openssl/slack-desc.openssl-solibs b/patches/source/openssl/slack-desc.openssl-solibs
new file mode 100644
index 00000000..58609e68
--- /dev/null
+++ b/patches/source/openssl/slack-desc.openssl-solibs
@@ -0,0 +1,19 @@
+# HOW TO EDIT THIS FILE:
+# The "handy ruler" below makes it easier to edit a package description.  Line
+# up the first '|' above the ':' following the base package name, and the '|' on
+# the right side marks the last column you can put a character in.  You must make
+# exactly 11 lines for the formatting to be correct.  It's also customary to
+# leave one space after the ':'.
+
+              |-----handy-ruler------------------------------------------------------|
+openssl-solibs: openssl-solibs (OpenSSL shared libraries)
+openssl-solibs:
+openssl-solibs: These shared libraries provide encryption routines required by
+openssl-solibs: programs such as openssh, bind, sendmail, and many others.
+openssl-solibs:
+openssl-solibs: This product includes software developed by the OpenSSL Project for
+openssl-solibs: use in the OpenSSL Toolkit (http://www.openssl.org).  This product
+openssl-solibs: includes cryptographic software written by Eric Young
+openssl-solibs: (eay@cryptsoft.com).  This product includes software written by Tim
+openssl-solibs: Hudson (tjh@cryptsoft.com).
+openssl-solibs: