Merge branch 'master' into core-updates-frozen

1 files changed, 112 insertions, 77 deletions

diff --git a/gnu/packages/tls.scm b/gnu/packages/tls.scm
index 277d79e51f..c73559cb73 100644
--- a/gnu/packages/tls.scm
+++ b/gnu/packages/tls.scm
@@ -343,6 +343,7 @@ OpenSSL for TARGET."
   (package
     (name "openssl")
     (version "1.1.1k")
+    (replacement openssl-1.1.1l)
     (source (origin
               (method url-fetch)
               (uri (list (string-append "https://www.openssl.org/source/openssl-"
@@ -467,11 +468,11 @@ OpenSSL for TARGET."
     (license license:openssl)
     (home-page "https://www.openssl.org/")))
 
-(define-public openssl-1.0
+;; Replacement package to fix multiple CVEs.
+(define openssl-1.1.1l
   (package
     (inherit openssl)
-    (name "openssl")
-    (version "1.0.2u")
+    (version "1.1.1l")
     (source (origin
               (method url-fetch)
               (uri (list (string-append "https://www.openssl.org/source/openssl-"
@@ -481,84 +482,118 @@ OpenSSL for TARGET."
                          (string-append "ftp://ftp.openssl.org/source/old/"
                                         (string-trim-right version char-set:letter)
                                         "/openssl-" version ".tar.gz")))
+              (patches (search-patches "openssl-1.1-c-rehash-in.patch"))
               (sha256
                (base32
-                "05lxcs4hzyfqd5jn0d9p0fvqna62v2s4pc9qgmq0dpcknkzwdl7c"))
-              (patches (search-patches "openssl-runpath.patch"
-                                       "openssl-c-rehash-in.patch"))))
-    (outputs '("out"
-               "doc"                    ;1.5MiB of man3 pages
-               "static"))               ;6MiB of .a files
-    (arguments
-     (substitute-keyword-arguments (package-arguments openssl)
-       ;; Parallel build is not supported in 1.0.x.
-       ((#:parallel-build? _ #f) #f)
-       ((#:phases phases)
-       #~(modify-phases #$phases
-           (add-before 'patch-source-shebangs 'patch-tests
-             (lambda* (#:key inputs native-inputs #:allow-other-keys)
-               (let ((bash (assoc-ref (or native-inputs inputs) "bash")))
-                 (substitute* (find-files "test" ".*")
-                   (("/bin/sh")
-                    (string-append bash "/bin/sh"))
-                   (("/bin/rm")
-                    "rm"))
-                 #t)))
-           (add-before 'configure 'patch-Makefile.org
-             (lambda* (#:key outputs #:allow-other-keys)
-               ;; The default MANDIR is some unusual place.  Fix that.
-               (let ((out (assoc-ref outputs "out")))
-                 (patch-makefile-SHELL "Makefile.org")
-                 (substitute* "Makefile.org"
-                   (("^MANDIR[[:blank:]]*=.*$")
-                    (string-append "MANDIR = " out "/share/man\n")))
-                 #t)))
-	   (replace 'configure
-	     ;; Override this phase because OpenSSL 1.0 does not understand -rpath.
-	     (lambda* (#:key outputs #:allow-other-keys)
-	       (let ((out (assoc-ref outputs "out")))
-		 (invoke #$@(if (%current-target-system)
-			        #~("./Configure")
-			        #~("./config"))
-			 "shared"                 ;build shared libraries
-			 "--libdir=lib"
+                "1lbblxps2fhmz7bqh058iywh5wxfignbfx1s1kz2fj63b5g3wyhb"))))))
+
+;; We will not add any new uses of this package. If you add new code that uses
+;; this package, your change will be reverted!
+;;
+;; The only acceptable use for this package is to bootstrap Rust, in
+;; ((gnu packages rust) rust-1.19).
+;;
+;; OpenSSL 1.0 is no longer suppported upstream [0] and has several security
+;; vulnerabilities that will not be fixed [1].
+;;
+;; For more information from the Guix point of view, see
+;; <https://bugs.gnu.org/46602>.
+;;
+;; [0] https://www.openssl.org/policies/releasestrat.html
+;; [1] https://www.openssl.org/news/vulnerabilities.html
+(define-public openssl-1.0
+  (hidden-package
+    (package
+      (inherit openssl)
+      (name "openssl")
+      (version "1.0.2u")
+      (source (origin
+                (method url-fetch)
+                (uri (list (string-append "https://www.openssl.org/source/openssl-"
+                                          version ".tar.gz")
+                           (string-append "ftp://ftp.openssl.org/source/"
+                                          "openssl-" version ".tar.gz")
+                           (string-append "ftp://ftp.openssl.org/source/old/"
+                                          (string-trim-right version char-set:letter)
+                                          "/openssl-" version ".tar.gz")))
+                (sha256
+                 (base32
+                  "05lxcs4hzyfqd5jn0d9p0fvqna62v2s4pc9qgmq0dpcknkzwdl7c"))
+                (patches (search-patches "openssl-runpath.patch"
+                                         "openssl-c-rehash-in.patch"))))
+      (outputs '("out"
+                 "doc"                    ;1.5MiB of man3 pages
+                 "static"))               ;6MiB of .a files
+      (arguments
+       (substitute-keyword-arguments (package-arguments openssl)
+         ;; Parallel build is not supported in 1.0.x.
+         ((#:parallel-build? _ #f) #f)
+         ((#:phases phases)
+          #~(modify-phases #$phases
+             (add-before 'patch-source-shebangs 'patch-tests
+               (lambda* (#:key inputs native-inputs #:allow-other-keys)
+                 (let ((bash (assoc-ref (or native-inputs inputs) "bash")))
+                   (substitute* (find-files "test" ".*")
+                     (("/bin/sh")
+                      (string-append bash "/bin/sh"))
+                     (("/bin/rm")
+                      "rm"))
+                   #t)))
+             (add-before 'configure 'patch-Makefile.org
+               (lambda* (#:key outputs #:allow-other-keys)
+                 ;; The default MANDIR is some unusual place.  Fix that.
+                 (let ((out (assoc-ref outputs "out")))
+                   (patch-makefile-SHELL "Makefile.org")
+                   (substitute* "Makefile.org"
+                     (("^MANDIR[[:blank:]]*=.*$")
+                      (string-append "MANDIR = " out "/share/man\n")))
+                   #t)))
+             (replace 'configure
+               ;; Override this phase because OpenSSL 1.0 does not understand -rpath.
+               (lambda* (#:key outputs #:allow-other-keys)
+                 (let ((out (assoc-ref outputs "out")))
+                   (invoke #$@(if (%current-target-system)
+                                  #~("./Configure")
+                                  #~("./config"))
+                           "shared"                 ;build shared libraries
+                           "--libdir=lib"
 
-			 ;; The default for this catch-all directory is
-			 ;; PREFIX/ssl.  Change that to something more
-			 ;; conventional.
-			 (string-append "--openssldir=" out
-					"/share/openssl-" #$version)
+                           ;; The default for this catch-all directory is
+                           ;; PREFIX/ssl.  Change that to something more
+                           ;; conventional.
+                           (string-append "--openssldir=" out
+                                          "/share/openssl-" #$version)
 
-			 (string-append "--prefix=" out)
-			 #$@(if (%current-target-system)
-			        '((getenv "CONFIGURE_TARGET_ARCH"))
-			        '())))))
-        (delete 'move-extra-documentation)
-        (add-after 'install 'move-man3-pages
-          (lambda* (#:key outputs #:allow-other-keys)
-            ;; Move section 3 man pages to "doc".
-            (let* ((out    (assoc-ref outputs "out"))
-                   (man3   (string-append out "/share/man/man3"))
-                   (doc    (assoc-ref outputs "doc"))
-                   (target (string-append doc "/share/man/man3")))
-              (mkdir-p target)
-              (for-each (lambda (file)
-                          (rename-file file
-                                       (string-append target "/"
-                                                      (basename file))))
-                        (find-files man3))
-              (delete-file-recursively man3)
-              #t)))
-           ;; XXX: Duplicate this phase to make sure 'version' evaluates
-           ;; in the current scope and not the inherited one.
-           (replace 'remove-miscellany
-             (lambda* (#:key outputs #:allow-other-keys)
-               ;; The 'misc' directory contains random undocumented shell and Perl
-               ;; scripts.  Remove them to avoid retaining a reference on Perl.
-               (let ((out (assoc-ref outputs "out")))
-                 (delete-file-recursively (string-append out "/share/openssl-"
-                                                         #$version "/misc"))
-                 #t)))))))))
+                           (string-append "--prefix=" out)
+                           #$@(if (%current-target-system)
+                                  '((getenv "CONFIGURE_TARGET_ARCH"))
+                                  '())))))
+             (delete 'move-extra-documentation)
+             (add-after 'install 'move-man3-pages
+               (lambda* (#:key outputs #:allow-other-keys)
+                 ;; Move section 3 man pages to "doc".
+                 (let* ((out    (assoc-ref outputs "out"))
+                        (man3   (string-append out "/share/man/man3"))
+                        (doc    (assoc-ref outputs "doc"))
+                        (target (string-append doc "/share/man/man3")))
+                   (mkdir-p target)
+                   (for-each (lambda (file)
+                               (rename-file file
+                                            (string-append target "/"
+                                                           (basename file))))
+                             (find-files man3))
+                   (delete-file-recursively man3)
+                   #t)))
+             ;; XXX: Duplicate this phase to make sure 'version' evaluates
+             ;; in the current scope and not the inherited one.
+             (replace 'remove-miscellany
+               (lambda* (#:key outputs #:allow-other-keys)
+                 ;; The 'misc' directory contains random undocumented shell and Perl
+                 ;; scripts.  Remove them to avoid retaining a reference on Perl.
+                 (let ((out (assoc-ref outputs "out")))
+                   (delete-file-recursively (string-append out "/share/openssl-"
+                                                           #$version "/misc"))
+                   #t))))))))))
 
 (define-public libressl
   (package