libscrypt: New package
PATCH 1/4 libscrypt: New package
--- package/Config.in | 1 + package/libscrypt/Config.in | 7 +++++++ package/libscrypt/libscrypt.hash | 2 ++ package/libscrypt/libscrypt.mk | 33 +++++++++++++++++++++++++++++++++ 4 files changed, 43 insertions(+) create mode 100644 package/libscrypt/Config.in create mode 100644 package/libscrypt/libscrypt.hash create mode 100644 package/libscrypt/libscrypt.mk
package/Config.in +1 -0
@@ -928,6 +928,7 @@ menu "Crypto" source "package/libmcrypt/Config.in" source "package/libmhash/Config.in" source "package/libnss/Config.in" + source "package/libscrypt/Config.in" source "package/libsecret/Config.in" source "package/libsha1/Config.in" source "package/libsodium/Config.in"
package/libscrypt/Config.in new file +7 -0
@@ -0,0 +1,7 @@ +config BR2_PACKAGE_LIBSCRYPT + bool "libscrypt" + help + This is a library that implements the secure password + hashing function "scrypt". + + http://www.lolware.net/libscrypt.html
package/libscrypt/libscrypt.hash new file +2 -0
@@ -0,0 +1,2 @@ +# Locally calculated +sha256 68e377e79745c10d489b759b970e52d819dbb80dd8ca61f8c975185df3f457d3 v1.21.tar.gz
package/libscrypt/libscrypt.mk new file +33 -0
@@ -0,0 +1,33 @@ +################################################################################ +# +# libscrypt +# +################################################################################ + +LIBSCRYPT_VERSION = 1.21 +LIBSCRYPT_SOURCE = v$(LIBSCRYPT_VERSION).tar.gz +LIBSCRYPT_SITE = https://github.com/technion/libscrypt/archive +LIBSCRYPT_LICENSE = BSD +LIBSCRYPT_INSTALL_STAGING = YES + +define LIBSCRYPT_DISABLE_STACK_PROTECTOR + $(SED) 's/-fstack-protector//g' $(@D)/Makefile +endef + +ifeq ($(BR2_TOOLCHAIN_HAS_SSP),) +LIBSCRYPT_POST_EXTRACT_HOOKS += LIBSCRYPT_DISABLE_STACK_PROTECTOR +endif + +define LIBSCRYPT_BUILD_CMDS + $(MAKE) -C $(@D) CC="$(TARGET_CC) $(TARGET_CFLAGS)" +endef + +define LIBSCRYPT_INSTALL_STAGING_CMDS + $(MAKE) -C $(@D) PREFIX=/usr DESTDIR=$(STAGING_DIR) install +endef + +define LIBSCRYPT_INSTALL_TARGET_CMDS + $(MAKE) -C $(@D) PREFIX=/usr DESTDIR=$(TARGET_DIR) install +endef + +$(eval $(generic-package))
Signature · 1 line
2.9.3
PATCH 2/4 cracklib: New package
--- package/Config.in | 1 + package/cracklib/Config.in | 28 ++++++++++++++++++++++++++++ package/cracklib/cracklib.hash | 3 +++ package/cracklib/cracklib.mk | 39 +++++++++++++++++++++++++++++++++++++++ 4 files changed, 71 insertions(+) create mode 100644 package/cracklib/Config.in create mode 100644 package/cracklib/cracklib.hash create mode 100644 package/cracklib/cracklib.mk
package/Config.in +1 -0
@@ -1317,6 +1317,7 @@ menu "Other" source "package/clapack/Config.in" source "package/classpath/Config.in" source "package/cppcms/Config.in" + source "package/cracklib/Config.in" source "package/dawgdic/Config.in" source "package/ding-libs/Config.in" source "package/eigen/Config.in"
package/cracklib/Config.in new file +28 -0
@@ -0,0 +1,28 @@ +config BR2_PACKAGE_CRACKLIB + bool "cracklib" + help + CrackLib tests passwords to determine whether they match + certain security-oriented characteristics, with the purpose + of stopping users from choosing passwords that are easy to + guess. CrackLib performs several tests on passwords: it + tries to generate words from a username and gecos entry and + checks those words against the password; it checks for + simplistic patterns in passwords; and it checks for the + password in a dictionary. + + https://github.com/cracklib/cracklib + +if BR2_PACKAGE_CRACKLIB + +config BR2_PACKAGE_CRACKLIB_TOOLS + bool "install tools" + help + Install cracklib command line tools for creating dicts. + +config BR2_PACKAGE_CRACKLIB_FULL_DICT + bool "full dict" + help + Install the full cracklib dict (requires about 8Mb extra target + space). + +endif
package/cracklib/cracklib.hash new file +3 -0
@@ -0,0 +1,3 @@ +# Locally calculated +sha256 17cf76943de272fd579ed831a1fd85339b393f8d00bf9e0d17c91e972f583343 cracklib-2.9.6.tar.gz +sha256 27973245225eeb9d0090e97f3dea4197dec99b64d9d3a791a60298f3b021824c cracklib-words-2.9.6.gz
package/cracklib/cracklib.mk new file +39 -0
@@ -0,0 +1,39 @@ +################################################################################ +# +# cracklib +# +################################################################################ + +CRACKLIB_VERSION = 2.9.6 +CRACKLIB_SITE = https://github.com/cracklib/cracklib/releases/download/cracklib-$(CRACKLIB_VERSION) +CRACKLIB_LICENSE = LGPLv2+ +CRACKLIB_LICENSE_FILES = COPYING.LIB README-LICENSE +CRACKLIB_INSTALL_STAGING = YES +CRACKLIB_DEPENDENCIES = host-cracklib +ifeq ($(BR2_PACKAGE_CRACKLIB_FULL_DICT),y) +CRACKLIB_EXTRA_DOWNLOADS = cracklib-words-$(CRACKLIB_VERSION).gz +endif + +ifeq ($(BR2_PACKAGE_CRACKLIB_TOOLS),) +define CRACKLIB_REMOVE_TOOLS + rm -f $(TARGET_DIR)/usr/sbin/*cracklib* +endef + +CRACKLIB_POST_INSTALL_TARGET_HOOKS += CRACKLIB_REMOVE_TOOLS +endif + +ifeq ($(BR2_PACKAGE_CRACKLIB_FULL_DICT),y) +CRACKLIB_DICT_SOURCE = $(DL_DIR)/cracklib-words-$(CRACKLIB_VERSION).gz +else +CRACKLIB_DICT_SOURCE = $(@D)/dicts/cracklib-small +endif + +define CRACKLIB_BUILD_DICT + cracklib-format $(CRACKLIB_DICT_SOURCE) | cracklib-packer $(TARGET_DIR)/usr/share/cracklib/pw_dict + rm $(TARGET_DIR)/usr/share/cracklib/cracklib-small +endef + +CRACKLIB_POST_INSTALL_TARGET_HOOKS += CRACKLIB_BUILD_DICT + +$(eval $(autotools-package)) +$(eval $(host-autotools-package))
Signature · 1 line
2.9.3
PATCH 2/4 cracklib: New package
Hello,
Thanks for your patch. It is almost ready for merging, but there are a few issues, most notably an issue when the full dict is used. See below for all comments.
Quoted 6 lines · Stefan S?rensen
Signed-off-by Stefan S?rensen <[email protected]>--- package/Config.in | 1 + package/cracklib/Config.in | 28 ++++++++++++++++++++++++++++ package/cracklib/cracklib.hash | 3 +++ package/cracklib/cracklib.mk | 39 +++++++++++++++++++++++++++++++++++++++
Our policy has changed: the update to the DEVELOPERS file should now be in the same patch as the one adding the package. Could you fix that in your next version?
Quoted 6 lines
package/cracklib/cracklib.mk new file +0
-0
package/cracklib/cracklib.mk line 9
Quoted 9 lines
package/cracklib/cracklib.mk new file +9
-0@@ -0,0 +1,39 @@ +################################################################################ +# +# cracklib +# +################################################################################ + +CRACKLIB_VERSION = 2.9.6 +CRACKLIB_SITE = https://github.com/cracklib/cracklib/releases/download/cracklib-$(CRACKLIB_VERSION) +CRACKLIB_LICENSE = LGPLv2+
This doesn't seem correct to me:
- We've switched to SPDX license codes since today, so it should be LGPL-2.0 or LGPL-2.1
- The license is not LGPLv2, but LGPLv2.1, so the license code to use is LGPL-2.1.
- I don't see any indication of the "or later" that justifies the "+", so I guess CRACKLIB_LICENSE = LGPL-2.1 is the correct thing here.
package/cracklib/cracklib.mk line 10
Quoted 1 line
package/cracklib/cracklib.mk new file +1
-0+CRACKLIB_LICENSE_FILES = COPYING.LIB README-LICENSE
I believe README-LICENSE is very historical and just give details on how the migration to LGPL licensing was done. Now that this relicensing is done (since 2008), I don't think adding this file to the licensing information adds much value.
package/cracklib/cracklib.mk line 15
Quoted 5 lines
package/cracklib/cracklib.mk new file +5
-0+CRACKLIB_INSTALL_STAGING = YES +CRACKLIB_DEPENDENCIES = host-cracklib +ifeq ($(BR2_PACKAGE_CRACKLIB_FULL_DICT),y) +CRACKLIB_EXTRA_DOWNLOADS = cracklib-words-$(CRACKLIB_VERSION).gz +endif
Unfortunately, this full dict thing doesn't work, at install time, I see:
cracklib-format /home/thomas/dl/cracklib-words-2.9.6.gz | cracklib-packer /home/thomas/projets/buildroot/output/target/usr/share/cracklib/pw_dict skipping line: 1
4 3
and the generated files on the target are really, really small:
-rw-r--r-- 1 thomas thomas 1024 avril 1 23:04 output/target/usr/share/cracklib/pw_dict.hwm -rw-r--r-- 1 thomas thomas 50 avril 1 23:04 output/target/usr/share/cracklib/pw_dict.pwd -rw-r--r-- 1 thomas thomas 16 avril 1 23:04 output/target/usr/share/cracklib/pw_dict.pwi
Could you have a look into this, and submit an updated version that fixes this issue?
Thanks a lot!
Thomas
Signature · 3 lines
Thomas Petazzoni, CTO, Free Electrons Embedded Linux and Kernel engineering http://free-electrons.com
PATCH 2/4 cracklib: New package
Quoted 25 lines · Thomas Petazzoni
+CRACKLIB_INSTALL_STAGING = YES
package/cracklib/cracklib.mk line 15
Quoted 4 lines
package/cracklib/cracklib.mk new file +4
-0+CRACKLIB_DEPENDENCIES = host-cracklib +ifeq ($(BR2_PACKAGE_CRACKLIB_FULL_DICT),y) +CRACKLIB_EXTRA_DOWNLOADS = cracklib-words-$(CRACKLIB_VERSION).gz +endifUnfortunately, this full dict thing doesn't work, at install time, I see:
cracklib-format
/home/thomas/dl/cracklib-words-2.9.6.gz| cracklib- packer/home/thomas/projets/buildroot/output/target/usr/share/cracklib/pw_dict
skipping line: 1
4 3and the generated files on the target are really, really small:
-rw-r--r-- 1 thomas thomas 1024 avril??1 23:04
output/target/usr/share/cracklib/pw_dict.hwm
-rw-r--r-- 1 thomas thomas???50 avril??1 23:04
output/target/usr/share/cracklib/pw_dict.pwd
-rw-r--r-- 1 thomas thomas???16 avril??1 23:04
output/target/usr/share/cracklib/pw_dict.pwi
Quoted 2 lines
Could you have a look into this, and submit an updated version that fixes this issue?
I am not able to reproduce this, though I just notices that it uses the
cracklib tools from the PATH, not the ones built in host-cracklib, so
maybe that is what is causing the issue.
I will submit new patches with this and the other issues you mentioned fixed.
Stefan
PATCH 2/4 cracklib: New package
Hello,
Quoted 6 lines · Stefan
Quoted 2 lines
Could you have a look into this, and submit an updated version that fixes this issue?
I am not able to reproduce this, though I just notices that it uses the
cracklib tools from the PATH, not the ones built in host-cracklib, so
maybe that is what is causing the issue.
I'm not sure it's the problem, because I'm pretty sure I ran the command manually by explicitly calling the tools built in output/host/usr/bin.
But anyway, I'll test your next iteration, and see if I can still reproduce the issue.
Thanks!
Thomas
Signature · 3 lines
Thomas Petazzoni, CTO, Free Electrons Embedded Linux and Kernel engineering http://free-electrons.com
PATCH 3/4 libpwquality: New package
In reply to Stefan Sørensen--- package/Config.in | 1 + ...ith-disable-nls-on-platforms-without-libi.patch | 42 ++++++++++++++++++++++ ...leak-in-settings-when-using-bad-word-list.patch | 23 ++++++++++++ package/libpwquality/Config.in | 18 ++++++++++ package/libpwquality/libpwquality.hash | 2 ++ package/libpwquality/libpwquality.mk | 24 +++++++++++++ 6 files changed, 110 insertions(+) create mode 100644 package/libpwquality/0001-Fix-build-with-disable-nls-on-platforms-without-libi.patch create mode 100644 package/libpwquality/0002-Fix-memory-leak-in-settings-when-using-bad-word-list.patch create mode 100644 package/libpwquality/Config.in create mode 100644 package/libpwquality/libpwquality.hash create mode 100644 package/libpwquality/libpwquality.mk
package/Config.in +1 -0
@@ -1360,6 +1360,7 @@ menu "Other" source "package/libplist/Config.in" source "package/libpthread-stubs/Config.in" source "package/libpthsem/Config.in" + source "package/libpwquality/Config.in" source "package/libseccomp/Config.in" source "package/libsigc/Config.in" source "package/libsigsegv/Config.in"
package/libpwquality/0001-Fix-build-with-disable-nls-on-platforms-without-libi.patch new file +42 -0
42 lines not on this page · raw message
package/libpwquality/0002-Fix-memory-leak-in-settings-when-using-bad-word-list.patch new file +23 -0
@@ -0,0 +1,23 @@ +Status: Upstream + +Signed-off-by: Stefan S?rensen <[email protected]> + +# HG changeset patch +# User Stefan S?rensen <[email protected]> +# Date 1486030646 -3600 +# Thu Feb 02 11:17:26 2017 +0100 +# Node ID 7d2ba499cbd538065931251042ce93b8e5f4edf2 +# Parent 3a716ca2bbf90cde4d86ef3c4597884d6a416525 +Fix memory leak in settings when using bad word list. + +diff -r 3a716ca2bbf9 -r 7d2ba499cbd5 src/settings.c +--- a/src/settings.c Thu Feb 02 11:16:49 2017 +0100 ++++ b/src/settings.c Thu Feb 02 11:17:26 2017 +0100 +@@ -46,6 +46,7 @@ + { + if (pwq) { + free(pwq->dict_path); ++ free(pwq->bad_words); + free(pwq); + } + }
package/libpwquality/Config.in new file +18 -0
@@ -0,0 +1,18 @@ +config BR2_PACKAGE_LIBPWQUALITY + bool "libpwquality" + help + This is a library for password quality checks and generation + of random passwords that pass the checks. This library uses + the cracklib and cracklib dictionaries to perform some of + the checks. + + https://fedorahosted.org/libpwquality/ + +if BR2_PACKAGE_LIBPWQUALITY + +config BR2_PACKAGE_LIBPWQUALITY_TOOLS + bool "install tools" + help + Install libpwquality command line tools generating/checking passwords. + +endif
package/libpwquality/libpwquality.hash new file +2 -0
@@ -0,0 +1,2 @@ +# Locally calculated +sha256 74d2ea90e103323c1f2d6a6cc9617cdae6877573eddb31aaf31a40f354cc2d2a libpwquality-1.3.0.tar.bz2
package/libpwquality/libpwquality.mk new file +24 -0
@@ -0,0 +1,24 @@ +################################################################################ +# +# libpwquality +# +################################################################################ + +LIBPWQUALITY_VERSION = 1.3.0 +LIBPWQUALITY_SOURCE = libpwquality-$(LIBPWQUALITY_VERSION).tar.bz2 +LIBPWQUALITY_SITE = https://fedorahosted.org/releases/l/i/libpwquality +LIBPWQUALITY_LICENSE = BSD or LGPLv2+ +LIBPWQUALITY_INSTALL_STAGING = YES +LIBPWQUALITY_DEPENDENCIES = cracklib +LIBPWQUALITY_AUTORECONF = YES + +ifeq ($(BR2_PACKAGE_LIBPWQUALITY_TOOLS),) +define LIBPWQUALITY_REMOVE_TOOLS + rm -f $(TARGET_DIR)/usr/bin/pwmake + rm -f $(TARGET_DIR)/usr/bin/pwscore +endef + +LIBPWQUALITY_POST_INSTALL_TARGET_HOOKS += LIBPWQUALITY_REMOVE_TOOLS +endif + +$(eval $(autotools-package))
Signature · 1 line
2.9.3
PATCH 3/4 libpwquality: New package
Hello Stefan,
Quoted 1 line · Stefan S?rensen
Signed-off-by Stefan S?rensen <[email protected]>
Thanks for this patch. A few comments below.
Quoted 6 lines
package/Config.in | 1 + ...ith-disable-nls-on-platforms-without-libi.patch | 42 ++++++++++++++++++++++ ...leak-in-settings-when-using-bad-word-list.patch | 23 ++++++++++++ package/libpwquality/Config.in | 18 ++++++++++ package/libpwquality/libpwquality.hash | 2 ++ package/libpwquality/libpwquality.mk | 24 +++++++++++++
As said on the cracklib review, we now want the update to the DEVELOPERS file to be done as part of the patch adding the package. I normally fix this up when applying, but I have other comments below.
package/libpwquality/0001-Fix-build-with-disable-nls-on-platforms-without-libi.patch line 3
Quoted 9 lines
package/libpwquality/0001-Fix-build-with-disable-nls-on-platforms-without-libi.patch new file +3
-0@@ -0,0 +1,42 @@ +Status: Upstream + +Signed-off-by: Stefan S?rensen <[email protected]>
Such information should go at the end of the patch description, ...
package/libpwquality/0001-Fix-build-with-disable-nls-on-platforms-without-libi.patch line 11
Quoted 8 lines
package/libpwquality/0001-Fix-build-with-disable-nls-on-platforms-without-libi.patch new file +8
-0+ +# HG changeset patch +# User Stefan S?rensen <[email protected]> +# Date 1486030609 -3600 +# Thu Feb 02 11:16:49 2017 +0100 +# Node ID 3a716ca2bbf90cde4d86ef3c4597884d6a416525 +# Parent 79ca3b91513faf3bd03464808d107b71ba5d6c3b +Fix build with --disable-nls on platforms without libintl included in libc.
... here.
Also, both of your patches have been submitted upstream. Has upstream released a new version with your fixes?
package/libpwquality/0002-Fix-memory-leak-in-settings-when-using-bad-word-list.patch line 3
Quoted 9 lines
package/libpwquality/0002-Fix-memory-leak-in-settings-when-using-bad-word-list.patch new file +3
-0@@ -0,0 +1,23 @@ +Status: Upstream + +Signed-off-by: Stefan S?rensen <[email protected]>
Ditto formatting of the patch.
Quoted 6 lines
package/libpwquality/Config.in new file +0
-0
package/libpwquality/Config.in line 9
Quoted 9 lines
package/libpwquality/Config.in new file +9
-0@@ -0,0 +1,18 @@ +config BR2_PACKAGE_LIBPWQUALITY + bool "libpwquality" + help + This is a library for password quality checks and generation + of random passwords that pass the checks. This library uses + the cracklib and cracklib dictionaries to perform some of + the checks. + + https://fedorahosted.org/libpwquality/
fedorahosted.org is dead, so it is no longer possible to use this as an upstream/download location. Has the project moved elsewhere?
package/libpwquality/Config.in line 16
Quoted 6 lines
package/libpwquality/Config.in new file +6
-0+if BR2_PACKAGE_LIBPWQUALITY + +config BR2_PACKAGE_LIBPWQUALITY_TOOLS + bool "install tools" + help + Install libpwquality command line tools generating/checking passwords.
Line too long.
package/libpwquality/Config.in line 18
Quoted 3 lines
package/libpwquality/Config.in new file +3
-0+LIBPWQUALITY_VERSION = 1.3.0 +LIBPWQUALITY_SOURCE = libpwquality-$(LIBPWQUALITY_VERSION).tar.bz2 +LIBPWQUALITY_SITE = https://fedorahosted.org/releases/l/i/libpwquality
As said above, this site is dead.
Quoted 1 line
+LIBPWQUALITY_LICENSE = BSD or LGPLv2+
BSD is not precise enough. Which BSD variant?
LGPLv2+ should now be LGPL-2.0+ or LGPL-2.1+, as we use SPDX license codes.
No LIBPWQUALITY_LICENSE_FILES ?
package/libpwquality/Config.in
Quoted 3 lines
package/libpwquality/Config.in new file +3
-0+LIBPWQUALITY_INSTALL_STAGING = YES +LIBPWQUALITY_DEPENDENCIES = cracklib +LIBPWQUALITY_AUTORECONF = YES
Why is an autoreconf needed?
Thanks!
Thomas
Signature · 3 lines
Thomas Petazzoni, CTO, Free Electrons Embedded Linux and Kernel engineering http://free-electrons.com
PATCH 4/4 DEVELOPERS: Add Stefan Sørensen for cracklib, libpwquality and libscrypt.
In reply to Stefan Sørensen--- DEVELOPERS | 5 +++++ 1 file changed, 5 insertions(+)
DEVELOPERS +5 -0
@@ -1417,6 +1417,11 @@ F: package/libtasn1/ F: package/proxychains-ng/ F: package/yasm/ +N: Stefan S?rensen <[email protected]> +F: package/cracklib/ +F: package/libpwquality/ +F: package/libscrypt/ + N: Stephan Hoffmann <[email protected]> F: package/cache-calibrator/ F: package/gtest/
Signature · 1 line
2.9.3
PATCH 1/4 libscrypt: New package
In reply to Stefan SørensenHello,
Quoted 10 lines · Stefan S?rensen
Signed-off-by Stefan S?rensen <[email protected]>--- package/Config.in | 1 + package/libscrypt/Config.in | 7 +++++++ package/libscrypt/libscrypt.hash | 2 ++ package/libscrypt/libscrypt.mk | 33 +++++++++++++++++++++++++++++++++ 4 files changed, 43 insertions(+) create mode 100644 package/libscrypt/Config.in create mode 100644 package/libscrypt/libscrypt.hash create mode 100644 package/libscrypt/libscrypt.mk
Thanks for your contribution, I've applied to master, after doing the following changes:
[Thomas:
- Add entry to DEVELOPERS file for the new package
- Add dependency on !BR2_STATIC_LIBS, because the Makefile unconditionally builds a shared library
- Use the "github" helper function to define <pkg>_SITE, get rid of <pkg>_SOURCE.
- License is BSD-2c, not just BSD.
- Add <pkg>_LICENSE_FILES variable.
- Define LIBSCRYPT_DISABLE_STACK_PROTECTOR inside the BR2_TOOLCHAIN_HAS_SSP condition, and move from a LIBSCRYPT_POST_EXTRACT_HOOKS to a LIBSCRYPT_POST_PATCH_HOOKS.
- Pass $(TARGET_CONFIGURE_OPTS) instead of just passing CC.
- Pass $(TARGET_MAKE_ENV) when calling $(MAKE).]
Thanks a lot!
Thomas
Signature · 3 lines
Thomas Petazzoni, CTO, Free Electrons Embedded Linux, Kernel and Android engineering http://free-electrons.com