From 6eaffccd00555e127e54f6a9684a7fc0b15d10f7 Mon Sep 17 00:00:00 2001 From: Andrew Savchenko Date: Wed, 6 Jan 2021 21:02:35 +0300 Subject: [PATCH] net-proxy/privoxy: version bump Update to 3.0.29: - This fixes multiple security bugs - Add support for brotli compressed data - Add support for HTTPS inspection using either mbedtls or openssl, libressl is deliberately not added since it is pending removal from the tree. Bug: https://bugs.gentoo.org/758428 Package-Manager: Portage-3.0.12, Repoman-3.0.2 Signed-off-by: Andrew Savchenko --- net-proxy/privoxy/Manifest | 1 + .../privoxy/files/privoxy-3.0.29-gentoo.patch | 118 ++++++++++++++ net-proxy/privoxy/metadata.xml | 11 +- net-proxy/privoxy/privoxy-3.0.29.ebuild | 145 ++++++++++++++++++ 4 files changed, 272 insertions(+), 3 deletions(-) create mode 100644 net-proxy/privoxy/files/privoxy-3.0.29-gentoo.patch create mode 100644 net-proxy/privoxy/privoxy-3.0.29.ebuild diff --git a/net-proxy/privoxy/Manifest b/net-proxy/privoxy/Manifest index 1aba478ea9240..cb6d11ed6c115 100644 --- a/net-proxy/privoxy/Manifest +++ b/net-proxy/privoxy/Manifest @@ -1 +1,2 @@ DIST privoxy-3.0.28-stable-src.tar.gz 1753809 BLAKE2B 1ea0d6339c96bd294eadc124ebac252c43dcdc062709868668959bdb4f959267afb2ec7f27fc0d58db3655102f2412f1c8acb273267d447271465ac21f7a9be4 SHA512 5d58024ae73d623a2b8fb2ac49e18f047dfe252c9441388f025cf888c0e4b11546b8796cfa559759ee137002b1b31b30ad28b356ae226836454f32591eb835fc +DIST privoxy-3.0.29-stable-src.tar.gz 1830550 BLAKE2B ecd0a78f2c4a3a6006fb229a7115a3c1b5041508233ef36d7995607984e5f9fbf7f117aa4611f384eed4434a6a3204a7f31a33857112d5f1f0a71fddb2134df3 SHA512 2f483a37d697738815f4c58a775fbf116a34ac5e0e74d19814252c5ff1572350181066d468327189faf20c92d808d551b0017a9525ec98276330ee539554c1ba diff --git a/net-proxy/privoxy/files/privoxy-3.0.29-gentoo.patch b/net-proxy/privoxy/files/privoxy-3.0.29-gentoo.patch new file mode 100644 index 0000000000000..572d03439b97c --- /dev/null +++ b/net-proxy/privoxy/files/privoxy-3.0.29-gentoo.patch @@ -0,0 +1,118 @@ +diff '--color=auto' -Naur privoxy-3.0.29-stable.orig/config privoxy-3.0.29-stable/config +--- privoxy-3.0.29-stable.orig/config 2020-11-28 13:19:00.000000000 +0300 ++++ privoxy-3.0.29-stable/config 2021-01-06 19:44:52.824746891 +0300 +@@ -259,7 +259,7 @@ + # + # No trailing "/", please. + # +-confdir . ++confdir /etc/privoxy + # + # 2.2. templdir + # ============== +@@ -344,7 +344,7 @@ + # + # No trailing "/", please. + # +-logdir . ++logdir /var/log/privoxy + # + # 2.5. actionsfile + # ================= +@@ -477,7 +477,7 @@ + # require additional software to do it. For details, please + # refer to the documentation for your operating system. + # +-logfile logfile ++logfile privoxy.log + # + # 2.8. trustfile + # =============== +diff '--color=auto' -Naur privoxy-3.0.29-stable.orig/default.action.master privoxy-3.0.29-stable/default.action.master +--- privoxy-3.0.29-stable.orig/default.action.master 2020-11-28 13:19:00.000000000 +0300 ++++ privoxy-3.0.29-stable/default.action.master 2021-01-06 19:44:52.825746892 +0300 +@@ -559,7 +559,7 @@ + +client-header-tagger{image-requests} \ + +client-header-tagger{range-requests} \ + +hide-from-header{block} \ +-+set-image-blocker{pattern} \ +++set-image-blocker{blank} \ + } + standard.Cautious + +@@ -582,7 +582,7 @@ + +hide-from-header{block} \ + +hide-referrer{conditional-block} \ + +session-cookies-only \ +-+set-image-blocker{pattern} \ +++set-image-blocker{blank} \ + } + standard.Medium + +@@ -622,7 +622,7 @@ + +hide-referrer{conditional-block} \ + +limit-connect{,} \ + +overwrite-last-modified{randomize} \ +-+set-image-blocker{pattern} \ +++set-image-blocker{blank} \ + } + standard.Advanced + +diff '--color=auto' -Naur privoxy-3.0.29-stable.orig/GNUmakefile.in privoxy-3.0.29-stable/GNUmakefile.in +--- privoxy-3.0.29-stable.orig/GNUmakefile.in 2020-11-28 13:19:00.000000000 +0300 ++++ privoxy-3.0.29-stable/GNUmakefile.in 2021-01-06 19:45:20.535798829 +0300 +@@ -62,8 +62,8 @@ + MAN_DEST = $(MAN_DIR)/man1 + MAN_PAGE = privoxy.1 + SHARE_DEST = @datadir@ +-DOC_DEST = $(SHARE_DEST)/doc/privoxy +-VAR_DEST = @localstatedir@ ++DOC_DEST = @docdir@ ++VAR_DEST = /var + LOGS_DEST = $(VAR_DEST)/log/privoxy + PIDS_DEST = $(VAR_DEST)/run + +@@ -890,8 +890,6 @@ + $(INSTALL) $(INSTALL_T) $(DOK_WEB)/man-page/*html $(DESTDIR)$$DOC/man-page;\ + $(INSTALL) $(INSTALL_T) $(DOK_WEB)/privoxy-index.html $(DESTDIR)$$DOC/index.html;\ + $(INSTALL) $(INSTALL_T) AUTHORS $(DESTDIR)$$DOC;\ +- $(INSTALL) $(INSTALL_T) LICENSE $(DESTDIR)$$DOC;\ +- $(INSTALL) $(INSTALL_T) LICENSE.GPLv3 $(DESTDIR)$$DOC;\ + $(INSTALL) $(INSTALL_T) README $(DESTDIR)$$DOC;\ + $(INSTALL) $(INSTALL_T) ChangeLog $(DESTDIR)$$DOC;\ + $(INSTALL) $(INSTALL_T) $(DOK_WEB)/p_doc.css $(DESTDIR)$$DOC;\ +@@ -962,34 +960,8 @@ + fi ;\ + $(ECHO) Installing configuration files to $(DESTDIR)$(CONF_DEST);\ + for i in $(CONFIGS); do \ +- if [ "$$i" = "default.action" ] || [ "$$i" = "default.filter" ] ; then \ +- $(RM) $(DESTDIR)$(CONF_DEST)/$$i ;\ +- $(ECHO) Installing fresh $$i;\ + $(INSTALL) $$INSTALL_CONF $$i $(DESTDIR)$(CONF_DEST) || exit 1;\ +- elif [ -s "$(CONF_DEST)/$$i" ]; then \ +- $(ECHO) Installing $$i as $$i.new ;\ +- $(INSTALL) $$INSTALL_CONF $$i $(DESTDIR)$(CONF_DEST)/$$i.new || exit 1;\ +- NEW=1;\ +- else \ +- $(INSTALL) $$INSTALL_CONF $$i $(DESTDIR)$(CONF_DEST) || exit 1;\ +- fi ;\ + done ;\ +- if [ -n "$$NEW" ]; then \ +- $(CHMOD) $(RWD_MODE) $(DESTDIR)$(CONF_DEST)/*.new || exit 1 ;\ +- $(ECHO) "Warning: Older config files are preserved. Check new versions for changes!" ;\ +- fi ;\ +- [ ! -f $(DESTDIR)$(LOG_DEST)/logfile ] && $(ECHO) Creating logfiles in $(DESTDIR)$(LOG_DEST) || \ +- $(ECHO) Checking logfiles in $(DESTDIR)$(LOG_DEST) ;\ +- $(TOUCH) $(DESTDIR)$(LOG_DEST)/logfile || exit 1 ;\ +- if [ x$$USER != x ]; then \ +- $(CHOWN) $$USER $(DESTDIR)$(LOG_DEST)/logfile || \ +- $(ECHO) "** WARNING ** current install user different from configured user. Logging may fail!!" ;\ +- fi ;\ +- if [ x$$GROUP_T != x ]; then \ +- $(CHGRP) $$GROUP_T $(DESTDIR)$(LOG_DEST)/logfile || \ +- $(ECHO) "** WARNING ** current install user different from configured user. Logging may fail!!" ;\ +- fi ;\ +- $(CHMOD) $(RWD_MODE) $(DESTDIR)$(LOG_DEST)/logfile || exit 1 ;\ + if [ "$(prefix)" = "/usr/local" ] || [ "$(prefix)" = "/usr" ]; then \ + if [ -f /etc/slackware-version ] && [ -d /etc/rc.d/ ] && [ -w /etc/rc.d/ ] ; then \ + $(SED) 's+%PROGRAM%+$(PROGRAM)+' slackware/rc.privoxy.orig | \ diff --git a/net-proxy/privoxy/metadata.xml b/net-proxy/privoxy/metadata.xml index 3794962c56719..adfe49818f337 100644 --- a/net-proxy/privoxy/metadata.xml +++ b/net-proxy/privoxy/metadata.xml @@ -14,10 +14,12 @@ systems and multi-user networks. - Enable the web-based actions file editor + Decompress brotli compressed data using app-arch/brotli before filtering Enable support for client-specific tags Allow privoxy to compress buffered content before sending to the client, if it supports it - Enable and require PCRE syntax in host patterns. You must convert action files to PCRE, see privoxy-url-pattern-translator.pl Use at your own risk! + Enable the web-based actions file editor + Enable and require PCRE syntax in host patterns. You must convert action files to PCRE, see privoxy-url-pattern-translator.pl (see tools USE flag). Use at your own risk! + Gather extended statistics Allow to filter content with scripts and programs. Experimental Support fast redirects Allow single-page disable (force load) @@ -25,12 +27,15 @@ Allow to shutdown Privoxy through the webinterface Allows the +handle-as-image action, to send "blocked" images instead of HTML Support large files (>2GB) on 32-bit systems + Use net-libs/mbedtls for HTTPS filtering + Use dev-libs/openssl for HTTPS filtering Use PNG format instead of GIF for built-in images + HTTPS inspection support. Enables privoxy to perform SSL MITM filtering, see docs, use with care Keep statistics Support temporary disable toggle via web interface Install log parser, regression tester and user agent generator tools Support trust files (white lists) - Use sys-libs/zlib to decompress data before filtering + Decompress zlib compressed data using sys-libs/zlib before filtering ijbswa diff --git a/net-proxy/privoxy/privoxy-3.0.29.ebuild b/net-proxy/privoxy/privoxy-3.0.29.ebuild new file mode 100644 index 0000000000000..6d4bcb7581c30 --- /dev/null +++ b/net-proxy/privoxy/privoxy-3.0.29.ebuild @@ -0,0 +1,145 @@ +# Copyright 1999-2021 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=7 + +inherit autotools systemd toolchain-funcs + +[ "${PV##*_}" = "beta" ] && + PRIVOXY_STATUS="beta" || + PRIVOXY_STATUS="stable" + +HOMEPAGE="https://www.privoxy.org https://sourceforge.net/projects/ijbswa/" +DESCRIPTION="A web proxy with advanced filtering capabilities for enhancing privacy" +SRC_URI="mirror://sourceforge/ijbswa/${P%_*}-${PRIVOXY_STATUS}-src.tar.gz" + +IUSE="+acl brotli client-tags compression editor extended-host-patterns +extended-statistics external-filters +fast-redirects +force fuzz +graceful-termination +image-blocking ipv6 lfs mbedtls openssl +png-images selinux ssl +stats +threads toggle tools whitelists ++zlib" +SLOT="0" +KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~ppc ~ppc64 ~sparc ~x86" +LICENSE="GPL-2+" + +DEPEND=" + acct-group/privoxy + acct-user/privoxy + dev-libs/libpcre + brotli? ( app-arch/brotli ) + mbedtls? ( net-libs/mbedtls ) + openssl? ( dev-libs/openssl ) + zlib? ( sys-libs/zlib ) +" +RDEPEND="${DEPEND} + extended-host-patterns? ( dev-lang/perl ) + selinux? ( sec-policy/selinux-privoxy ) + tools? ( + net-misc/curl + dev-lang/perl + ) +" +REQUIRED_USE=" + client-tags? ( threads ) + toggle? ( editor ) + compression? ( zlib ) + brotli? ( zlib ) + fuzz? ( zlib ) + ssl? ( ^^ ( mbedtls openssl ) ) + mbedtls? ( ssl ) + openssl? ( ssl ) +" + +S="${WORKDIR}/${P%_*}-${PRIVOXY_STATUS}" + +PATCHES=( + "${FILESDIR}"/${P}-gentoo.patch + "${FILESDIR}"/${PN}-3.0.28-chdir.patch + "${FILESDIR}"/${PN}-3.0.28-null-termination.patch + "${FILESDIR}"/${PN}-3.0.28-strip.patch +) + +pkg_pretend() { + if ! use threads; then + ewarn + ewarn "Privoxy may be very slow without threads support, consider to enable them." + ewarn "See also http://www.privoxy.org/faq/trouble.html#GENTOO-RICERS" + ewarn + fi +} + +src_prepare() { + default + mv configure.in configure.ac || die + sed -i "s|/p\.p/|/config.privoxy.org/|g" tools/privoxy-regression-test.pl || die + + # autoreconf needs to be called even if we don't modify any autotools source files + # See main makefile + eautoreconf +} + +src_configure() { + # --with-debug only enables debug CFLAGS + # --with-docbook and --with-db2html and their deps are useless, + # since docs are already pregenerated in the source tarball + econf \ + --sysconfdir=/etc/privoxy \ + --enable-dynamic-pcre \ + --with-user=privoxy \ + --with-group=privoxy \ + $(use_enable acl acl-support) \ + $(use_enable compression) \ + $(use_enable client-tags) \ + $(use_enable editor) \ + $(use_enable extended-host-patterns pcre-host-patterns) \ + $(use_enable extended-statistics) \ + $(use_enable fast-redirects) \ + $(use_enable force) \ + $(use_enable fuzz) \ + $(use_enable graceful-termination) \ + $(use_enable image-blocking) \ + $(use_enable ipv6 ipv6-support) \ + $(use_enable kernel_FreeBSD accept-filter) \ + $(use_enable lfs large-file-support) \ + $(use_enable png-images no-gifs) \ + $(use_enable stats) \ + $(use_enable threads pthread) \ + $(use_enable toggle) \ + $(use_enable whitelists trust-files) \ + $(use_enable zlib) \ + $(use_with brotli) \ + $(use_with mbedtls) \ + $(use_with openssl) +} + +src_install() { + default + + newinitd "${FILESDIR}/privoxy.initd-3" privoxy + systemd_dounit "${FILESDIR}"/${PN}.service + + insinto /etc/logrotate.d + newins "${FILESDIR}/privoxy.logrotate" privoxy + + diropts -m 0750 -g privoxy -o privoxy + keepdir /var/log/privoxy + + use extended-host-patterns && newbin tools/url-pattern-translator.pl privoxy-url-pattern-translator.pl + if use tools; then + dobin tools/{privoxy-log-parser.pl,privoxy-regression-test.pl} + newbin tools/uagen.pl privoxy-uagen.pl + fi + + rmdir "${ED}/var/run" || die + chown privoxy:root "${ED}/etc/privoxy" || die +} + +pkg_postinst() { + if use extended-host-patterns; then + ewarn + ewarn "You enabled extended-host-patterns, now you *must* convert all action files in" + ewarn "PCRE-compatible format, or privoxy will fail to start. Helper tool" + ewarn "privoxy-url-pattern-translator.pl is available." + ewarn + fi +}