Date: Sat, 11 Dec 2021 12:42:48 GMT From: Matthias Andree <mandree@FreeBSD.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org Subject: git: 5cc978dcfe58 - main - security/openvpn: license incompat mbedTLS, LZO+LibreSSL Message-ID: <202112111242.1BBCgmrU006953@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by mandree: URL: https://cgit.FreeBSD.org/ports/commit/?id=5cc978dcfe58a52b9a163e080d855b022ac22545 commit 5cc978dcfe58a52b9a163e080d855b022ac22545 Author: Matthias Andree <mandree@FreeBSD.org> AuthorDate: 2021-12-11 12:38:37 +0000 Commit: Matthias Andree <mandree@FreeBSD.org> CommitDate: 2021-12-11 12:42:31 +0000 security/openvpn: license incompat mbedTLS, LZO+LibreSSL After reviewing licenses again, - mark mbedTLS broken for now, since it uses the Apache License 2.0, which is incompatible with the GPLv2 (OpenVPN does not employ the "or any later version" escape hatch). This will be handed to the OpenVPN-devel mailing list for review. - block out the combination of LZO with LibreSSL, since OpenVPN only has a linking exception for OpenSSL itself. Remedy is to either forgo LibreSSL, or to disable the LZO option, which requires proper configuration on either end. The maintainer's recommendation is to compile with OpenSSL instead. Bump PORTREVISION in spite of unchanged contents to flush out old packages. MFH: 2021Q4 --- security/openvpn/Makefile | 28 +++++++++++++++++++++++++--- 1 file changed, 25 insertions(+), 3 deletions(-) diff --git a/security/openvpn/Makefile b/security/openvpn/Makefile index 491d24572863..4dbee597511b 100644 --- a/security/openvpn/Makefile +++ b/security/openvpn/Makefile @@ -2,7 +2,7 @@ PORTNAME= openvpn DISTVERSION= 2.5.4 -PORTREVISION?= 1 +PORTREVISION?= 2 CATEGORIES= security net net-vpn MASTER_SITES= https://swupdate.openvpn.org/community/releases/ \ https://build.openvpn.net/downloads/releases/ \ @@ -43,7 +43,8 @@ OPTIONS_SINGLE= SSL OPTIONS_SINGLE_SSL= OPENSSL MBEDTLS ASYNC_PUSH_DESC= Enable async-push support EASYRSA_DESC= Install security/easy-rsa RSA helper package -MBEDTLS_DESC= SSL/TLS via mbedTLS (lacks TLS v1.3) +LZO_DESC= LZO compression support (incompatible with LibreSSL) +MBEDTLS_DESC= LICENSE BROKEN - SSL/TLS via mbedTLS (lacks TLS v1.3) PKCS11_DESC= Use security/pkcs11-helper (OpenSSL only) SMALL_DESC= Build a smaller executable with fewer features TUNNELBLICK_DESC= Tunnelblick XOR scramble patch (READ HELP!) @@ -94,16 +95,37 @@ CFLAGS+= -DLOG_OPENVPN=${LOG_OPENVPN} .if ${PORT_OPTIONS:MMBEDTLS} BROKEN_FreeBSD_14= OpenVPN-mbedTLS fails on FreeBSD 14 +BROKEN= License under clarification, OpenVPN is GPLv2-only and mbedTLS under Apache License 2.0, which are incompatible _tlslibs=libmbedtls libmbedx509 libmbedcrypto .else # OpenSSL _tlslibs=libssl libcrypto .endif +.if ${PORT_OPTIONS:MLZO} +IGNORE_SSL=libressl libressl-devel +IGNORE_SSL_REASON=OpenVPN does not have permission to include LZO with LibreSSL. Compile against OpenSSL, or if your setups support it, disable LZO support +.endif + .if ! ${PORT_OPTIONS:MLZ4} && ! ${PORT_OPTIONS:MLZO} CONFIGURE_ARGS+= --enable-comp-stub .endif +.include <bsd.port.pre.mk> + +.if !empty(PORT_OPTIONS:MLZO) && !empty(SSL_DEFAULT:Nbase:Nopenssl*) +# in-depth security net if Mk/Uses/ssl.mk changes +pre-everything:: + @${ECHO_CMD} >&2 "ERROR: OpenVPN is not licensed to combine LZO with other OpenSSL-licensed libraries than OpenSSL. Compile against OpenSSL, or if your setups support it, disable LZO support." + @${SHELL} -c 'exit 1' +.endif + +.if !empty(PORT_OPTIONS:MMBEDTLS) +pre-everything:: + @${ECHO_CMD} >&2 "License under clarification, OpenVPN is GPLv2-only and mbedTLS under Apache License 2.0, which are incompatible." + @${SHELL} -c 'exit 1' +.endif + post-patch: ${REINPLACE_CMD} -E -i '' -e 's/(user|group) nobody/\1 openvpn/' \ -e 's/"nobody"( after init)/"openvpn" \1/' \ @@ -162,4 +184,4 @@ post-install-EXAMPLES-on: ${CHMOD} ${BINMODE} ${STAGEDIR}${EXAMPLESDIR}/sample-scripts/* ${RM} ${STAGEDIR}${EXAMPLESDIR}/sample-config-files/*.orig -.include <bsd.port.mk> +.include <bsd.port.post.mk>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202112111242.1BBCgmrU006953>