Adding metadata

5 files changed, 400 insertions, 1 deletions

diff --git a/sys-libs/libxcrypt/Manifest b/sys-libs/libxcrypt/Manifest
index 259a3cce265b..836304e2047c 100644
--- a/sys-libs/libxcrypt/Manifest
+++ b/sys-libs/libxcrypt/Manifest
@@ -1 +1,2 @@
 DIST libxcrypt-4.4.38-autotools.tar.xz 630696 BLAKE2B 471066e83495fbaf3ef8dee066b4a7bff36dbc36d6ae1c09f2510d79b041b8517d6cc345e678d92508f5d044dc25fd7b1d36e0243aa46314bbbe7e3201838a5c SHA512 9b1d53119e0d808f6bc30e39cbe85710e3abb774109df28e05b90adebb828f47db3f7126de4ffdea2e63073905648ad941985d1a2167ba7282c01e132ef4e2b2
+DIST libxcrypt-4.5.2-autotools.tar.xz 671272 BLAKE2B 029617ef745cffd6ef871414262509e6cae346cb1608c54bf62b5a2cebd63b7113dcdfb62b241c9ad2f15746b53293f3f355b950985f1ba8b9ff2a04a673a80e SHA512 8de4a3be418abe61676634518fceaec4a08235f7736124959a727c57ae001c0a246c63277d78cabe4826ed0a42990b1315565691daf2abf377546e7e3c16b596
diff --git a/sys-libs/libxcrypt/files/libxcrypt-4.5.2-const.patch b/sys-libs/libxcrypt/files/libxcrypt-4.5.2-const.patch
new file mode 100644
index 000000000000..634fa584ad6c
--- /dev/null
+++ b/sys-libs/libxcrypt/files/libxcrypt-4.5.2-const.patch
@@ -0,0 +1,41 @@
+https://github.com/besser82/libxcrypt/commit/174c24d6e87aeae631bc0a7bb1ba983cf8def4de
+
+From 174c24d6e87aeae631bc0a7bb1ba983cf8def4de Mon Sep 17 00:00:00 2001
+From: Stanislav Zidek <szidek@redhat.com>
+Date: Wed, 10 Dec 2025 14:03:54 +0100
+Subject: [PATCH] fix -Werror=discarded-qualifiers
+
+On Fedora rawhide (to be Fedora 44), gcc became more strict
+wrt. const-ness.
+---
+ lib/crypt-gost-yescrypt.c | 2 +-
+ lib/crypt-sm3-yescrypt.c  | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/lib/crypt-gost-yescrypt.c b/lib/crypt-gost-yescrypt.c
+index 190ae94b..e9dc7e80 100644
+--- a/lib/crypt-gost-yescrypt.c
++++ b/lib/crypt-gost-yescrypt.c
+@@ -131,7 +131,7 @@ crypt_gost_yescrypt_rn (const char *phrase, size_t phr_size,
+   intbuf->outbuf[1] = 'g';
+ 
+   /* extract yescrypt output from "$y$param$salt$output" */
+-  char *hptr = strchr ((const char *) intbuf->retval + 3, '$');
++  char *hptr = strchr ((char *) intbuf->retval + 3, '$');
+   if (!hptr)
+     {
+       errno = EINVAL;
+diff --git a/lib/crypt-sm3-yescrypt.c b/lib/crypt-sm3-yescrypt.c
+index 4f42aa66..17da83e1 100644
+--- a/lib/crypt-sm3-yescrypt.c
++++ b/lib/crypt-sm3-yescrypt.c
+@@ -136,7 +136,7 @@ crypt_sm3_yescrypt_rn (const char *phrase, size_t phr_size,
+   intbuf->outbuf[3] = '3';
+ 
+   /* extract yescrypt output from "$y$param$salt$output" */
+-  char *hptr = strchr ((const char *) intbuf->retval + 3, '$');
++  char *hptr = strchr ((char *) intbuf->retval + 3, '$');
+   if (!hptr)
+     {
+       errno = EINVAL;
+
diff --git a/sys-libs/libxcrypt/files/libxcrypt-4.5.2-getrandom.patch b/sys-libs/libxcrypt/files/libxcrypt-4.5.2-getrandom.patch
new file mode 100644
index 000000000000..3532a5a47b2e
--- /dev/null
+++ b/sys-libs/libxcrypt/files/libxcrypt-4.5.2-getrandom.patch
@@ -0,0 +1,96 @@
+https://github.com/besser82/libxcrypt/commit/d6faad7de2bdbff18da4c5379e97871ec3839e7f
+
+From d6faad7de2bdbff18da4c5379e97871ec3839e7f Mon Sep 17 00:00:00 2001
+From: Nathaniel Wesley Filardo <nwfilardo@gmail.com>
+Date: Sat, 22 Nov 2025 15:32:08 +0000
+Subject: [PATCH] test/getrandom-fallbacks: fix open shim types
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+In C, functions taking a variable number of arguments are not guaranteed to have
+the same calling convention as functions taking a fixed number of arguments
+[^0].  Since `open()` and `open64()` are defined as taking a variable number of
+arguments, the `__wrap_open()` and `__wrap_open64()` mocks must be as well.
+
+[^0]: C23 §6.7.7.4¶14 says: "For two function types to be compatible, both shall
+specify compatible return types. Moreover, the parameter type lists shall agree
+in the number of parameters and in use of the final ellipsis; corresponding
+parameters shall have compatible types."
+
+This fixes the test on my powerpc64el machine building nixpkgs a8d610af3f1.
+---
+ test/getrandom-fallbacks.c | 46 +++++++++++++++++++++++++++++++++-----
+ 1 file changed, 40 insertions(+), 6 deletions(-)
+
+diff --git a/test/getrandom-fallbacks.c b/test/getrandom-fallbacks.c
+index b124c181..4048ae29 100644
+--- a/test/getrandom-fallbacks.c
++++ b/test/getrandom-fallbacks.c
+@@ -151,13 +151,38 @@ __wrap_syscall(long number, ...)
+    there's no way to _clear_ that flag again.  This test chooses to
+    exercise the read-failure path, not the open-failure path.  */
+ #if defined HAVE_SYS_STAT_H && defined HAVE_FCNTL_H && defined HAVE_UNISTD_H
++
++static bool open_needs_mode(int flags)
++{
++  if (flags & O_CREAT)
++  {
++    return true;
++  }
++#if defined(O_TMPFILE)
++  if ((flags & O_TMPFILE) == O_TMPFILE)
++  {
++    return true;
++  }
++#endif
++  return false;
++}
++
+ static bool urandom_should_fail = false;
+ static int urandom_fd = -1;
+-extern int __wrap_open (const char *, int, mode_t);
+-extern int __real_open (const char *, int, mode_t);
++extern int __wrap_open (const char *, int, ...);
++extern int __real_open (const char *, int, ...);
+ int
+-__wrap_open (const char *path, int flags, mode_t mode)
++__wrap_open (const char *path, int flags, ...)
+ {
++  int mode = 0;
++  if (open_needs_mode(flags))
++  {
++    va_list args;
++    va_start(args, flags);
++    mode = va_arg(args, int);
++    va_end(args);
++  }
++
+   int ret = __real_open (path, flags, mode);
+   if (ret == -1)
+     return ret;
+@@ -167,11 +192,20 @@ __wrap_open (const char *path, int flags, mode_t mode)
+ }
+ 
+ #ifdef HAVE_OPEN64
+-extern int __wrap_open64 (const char *, int, mode_t);
+-extern int __real_open64 (const char *, int, mode_t);
++extern int __wrap_open64 (const char *, int, ...);
++extern int __real_open64 (const char *, int, ...);
+ int
+-__wrap_open64 (const char *path, int flags, mode_t mode)
++__wrap_open64 (const char *path, int flags, ...)
+ {
++  int mode = 0;
++  if (open_needs_mode(flags))
++  {
++    va_list args;
++    va_start(args, flags);
++    mode = va_arg(args, int);
++    va_end(args);
++  }
++
+   int ret = __real_open64 (path, flags, mode);
+   if (ret == -1)
+     return ret;
+
diff --git a/sys-libs/libxcrypt/libxcrypt-4.5.2.ebuild b/sys-libs/libxcrypt/libxcrypt-4.5.2.ebuild
new file mode 100644
index 000000000000..e0cd94f3543f
--- /dev/null
+++ b/sys-libs/libxcrypt/libxcrypt-4.5.2.ebuild
@@ -0,0 +1,261 @@
+# Copyright 2004-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{13..14} )
+# NEED_BOOTSTRAP is for developers to quickly generate a tarball
+# for publishing to the tree.
+NEED_BOOTSTRAP="no"
+inherit crossdev multibuild multilib python-any-r1 flag-o-matic
+inherit toolchain-funcs multilib-minimal
+
+DESCRIPTION="Extended crypt library for descrypt, md5crypt, bcrypt, and others"
+HOMEPAGE="https://github.com/besser82/libxcrypt"
+if [[ ${NEED_BOOTSTRAP} == "yes" ]] ; then
+	inherit autotools
+	SRC_URI="https://github.com/besser82/libxcrypt/releases/download/v${PV}/${P}.tar.xz"
+else
+	SRC_URI="https://distfiles.gentoo.org/pub/proj/toolchain/libxcrypt/${P}-autotools.tar.xz"
+fi
+
+LICENSE="LGPL-2.1+ public-domain BSD BSD-2"
+SLOT="0/1"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="+compat static-libs +system test headers-only"
+RESTRICT="!test? ( test )"
+
+DEPEND="
+	system? (
+		elibc_glibc? (
+			${CATEGORY}/glibc[-crypt(-)]
+			!${CATEGORY}/glibc[crypt(-)]
+		)
+		elibc_musl? (
+			${CATEGORY}/musl[-crypt(+)]
+			!${CATEGORY}/musl[crypt(+)]
+		)
+	)
+"
+RDEPEND="
+	${DEPEND}
+	!<sys-apps/man-pages-6.16-r1
+"
+BDEPEND="
+	dev-lang/perl
+	test? ( $(python_gen_any_dep 'dev-python/libpass[${PYTHON_USEDEP}]') )
+"
+
+PATCHES=(
+	"${FILESDIR}"/${P}-const.patch
+	"${FILESDIR}"/${P}-getrandom.patch
+)
+
+python_check_deps() {
+	python_has_version "dev-python/libpass[${PYTHON_USEDEP}]"
+}
+
+pkg_pretend() {
+	if has "distcc" ${FEATURES} ; then
+		ewarn "Please verify all distcc nodes are using the same versions of GCC (>= 10) and Binutils!"
+		ewarn "Older/mismatched versions of GCC may lead to a misbehaving library: bug #823179."
+
+		if [[ ${BUILD_TYPE} != "binary" ]] && tc-is-gcc && [[ $(gcc-major-version) -lt 10 ]] ; then
+			die "libxcrypt is known to fail to build or be broken at runtime with < GCC 10 (bug #823179)!"
+		fi
+	fi
+}
+
+pkg_setup() {
+	:
+}
+
+src_prepare() {
+	default
+
+	# WARNING: Please read on bumping or applying patches!
+	#
+	# There are two circular dependencies to be aware of:
+	# 1)
+	#	if we're bootstrapping configure and makefiles:
+	#		libxcrypt -> automake -> perl -> libxcrypt
+	#
+	#   mitigation:
+	#		toolchain@ manually runs `make dist` after running autoconf + `./configure`
+	#		and the ebuild uses that.
+	#		(Don't include the pre-generated Perl artefacts.)
+	#
+	#	solution for future:
+	#		Upstream are working on producing `make dist` tarballs.
+	#		https://github.com/besser82/libxcrypt/issues/134#issuecomment-871833573
+	#
+	# 2)
+	#	configure *unconditionally* needs Perl at build time to generate
+	#	a list of enabled algorithms based on the set passed to `configure`:
+	#		libxcrypt -> perl -> libxcrypt
+	#
+	#	mitigation:
+	#		None at the moment.
+	#
+	#	solution for future:
+	#		Not possible right now. Upstream intend on depending on Perl for further
+	#		configuration options.
+	#		https://github.com/besser82/libxcrypt/issues/134#issuecomment-871833573
+	#
+	# Therefore, on changes (inc. bumps):
+	#	* You must check whether upstream have started providing tarballs with bootstrapped
+	#	  auto{conf,make};
+	#
+	#	* diff the build system changes!
+	#
+	if [[ ${NEED_BOOTSTRAP} == "yes" ]] ; then
+		# Facilitate our split variant build for compat + non-compat
+		eapply "${FILESDIR}"/${PN}-4.4.19-multibuild.patch
+		eautoreconf
+	fi
+}
+
+src_configure() {
+	MULTIBUILD_VARIANTS=(
+		$(usev compat 'xcrypt_compat')
+		xcrypt_nocompat
+	)
+
+	MYPREFIX=${EPREFIX}
+	MYSYSROOT=${ESYSROOT}
+
+	if target_is_not_host; then
+		# Hack to work around missing TARGET_CC support.
+		# See bug 949976.
+		if tc-is-clang; then
+			export CC="${CTARGET}-clang"
+		else
+			export CC="${CTARGET}-gcc"
+		fi
+
+		local CHOST=${CTARGET}
+
+		MYPREFIX=
+		MYSYSROOT=${ESYSROOT}/usr/${CTARGET}
+
+		# Ensure we get compatible libdir
+		unset DEFAULT_ABI MULTILIB_ABIS
+		multilib_env
+		ABI=${DEFAULT_ABI}
+
+		strip-unsupported-flags
+	fi
+
+	if use headers-only; then
+		# Nothing is compiled which would affect the headers, so we set
+		# CC and PKG_CONFIG to ensure configure passes without defaulting
+		# to the unprefixed host variants e.g. "pkg-config"
+		local -x CC="$(tc-getBUILD_CC)"
+		local -x PKG_CONFIG="false"
+	fi
+
+	# Doesn't work with LTO: bug #852917.
+	# https://github.com/besser82/libxcrypt/issues/24
+	filter-lto
+
+	append-ldflags $(test-flags-CCLD -Wl,--undefined-version)
+
+	if use test; then
+		python_setup
+	fi
+
+	multibuild_foreach_variant multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	local myconf=(
+		--disable-werror
+		--prefix="${MYPREFIX}/usr"
+		--libdir="${MYPREFIX}/usr/$(get_libdir)$(usev !system /xcrypt)"
+		--includedir="${MYPREFIX}/usr/include$(usev !system /xcrypt)"
+		--with-pkgconfigdir="${MYPREFIX}/usr/$(get_libdir)/pkgconfig"
+		--with-sysroot="${MYSYSROOT}"
+	)
+
+	tc-export PKG_CONFIG
+
+	case "${MULTIBUILD_ID}" in
+		xcrypt_compat-*)
+			myconf+=(
+				--disable-static
+				--disable-xcrypt-compat-files
+				--enable-obsolete-api=yes
+			)
+			;;
+		xcrypt_nocompat-*)
+			myconf+=(
+				--enable-obsolete-api=no
+				$(use_enable static-libs static)
+			)
+			;;
+		*) die "Unexpected MULTIBUILD_ID: ${MULTIBUILD_ID}";;
+	esac
+
+	ECONF_SOURCE="${S}" econf "${myconf[@]}"
+}
+
+src_compile() {
+	use headers-only && return
+
+	multibuild_foreach_variant multilib-minimal_src_compile
+}
+
+multilib_src_test() {
+	emake check
+}
+
+src_test() {
+	multibuild_foreach_variant multilib-minimal_src_test
+}
+
+src_install() {
+	local DESTDIR=${D}
+	if target_is_not_host; then
+		DESTDIR=${ED}/usr/${CTARGET}
+	fi
+
+	multibuild_foreach_variant multilib-minimal_src_install
+
+	find "${ED}" -name '*.la' -delete || die
+
+	if target_is_not_host; then
+		insinto /usr/${CTARGET}/usr/share
+		doins -r "${ED}/usr/share/doc"
+		rm -r "${ED}/usr/share/doc" || die
+		rmdir "${ED}/usr/share" || die
+	fi
+}
+
+multilib_src_install() {
+	if use headers-only; then
+		emake DESTDIR="${DESTDIR}" install-nodist_includeHEADERS
+	else
+		emake DESTDIR="${DESTDIR}" install
+	fi
+}
+
+pkg_preinst() {
+	# Verify we're not in a bad case like bug #843209 with broken symlinks.
+	# This can be dropped when, if ever, the split-usr && system && compat case
+	# is cleaned up in *_src_install.
+	local broken_symlinks=()
+	mapfile -d '' broken_symlinks < <(
+		find "${ED}" -xtype l -print0
+	)
+
+	if [[ ${#broken_symlinks[@]} -gt 0 ]]; then
+		eerror "Broken symlinks found before merging!"
+		local symlink target resolved
+		for symlink in "${broken_symlinks[@]}" ; do
+			target="$(readlink "${symlink}")"
+			resolved="$(readlink -f "${symlink}")"
+			eerror "  '${symlink}' -> '${target}' (${resolved})"
+		done
+		die "Broken symlinks found! Aborting to avoid damaging system. Please report a bug."
+	fi
+}
diff --git a/sys-libs/libxcrypt/metadata.xml b/sys-libs/libxcrypt/metadata.xml
index 2d00168bbce9..574cca04b3cb 100644
--- a/sys-libs/libxcrypt/metadata.xml
+++ b/sys-libs/libxcrypt/metadata.xml
@@ -12,8 +12,8 @@
 	</longdescription>
   <use>
     <flag name="compat">Build with compatibility interfaces for other crypt implementations</flag>
-    <flag name="system">Install as system libcrypt.so rather than to an alternate directory (will collide with <pkg>sys-libs/glibc</pkg>'s version)</flag>
     <flag name="headers-only">Build and install only the headers. This is mostly useful for toolchain bootstrapping, to avoid circular deps.</flag>
+    <flag name="system">Install as system libcrypt.so rather than to an alternate directory (will collide with <pkg>sys-libs/glibc</pkg>'s version)</flag>
   </use>
   <origin>baldeagleos-repo</origin>
 </pkgmetadata>