app-arch/libarchive: Bump to 3.7.5

Signed-off-by: Michał Górny <mgorny@gentoo.org>

3 files changed, 513 insertions, 0 deletions

diff --git a/app-arch/libarchive/Manifest b/app-arch/libarchive/Manifest
index 0c49596464d7..56e85afbaa09 100644
--- a/app-arch/libarchive/Manifest
+++ b/app-arch/libarchive/Manifest
@@ -1,2 +1,4 @@
 DIST libarchive-3.7.4.tar.xz 5417660 BLAKE2B 128f72235da61e112201046c0cfe62a8c580cf73b426c4cfe270ae913356f6ad430ba33a663dcd617b082c7baf45ada8d1c9928c45fea16fd57e8020693a60bc SHA512 84bc346ba15861ab10aa54a3d687de955178e4efbe12bf3a49a467181e7f819673949f131f4c8338de8ed6e319a8565af376e5a540380bda08e60dffbc7c8686
 DIST libarchive-3.7.4.tar.xz.asc 659 BLAKE2B 77e705194f6e9a9f97da0ac43c9b3157e1a8a490d26da34079e4ef3f2bcf98d6f6e95567e110287fab0ec26d3fc27e5bbeff7569c9ca138de2caf47af737c6d0 SHA512 82caa18a78661ea717ce93cdcb0806eed48450c20fb4d45cb4c33001f2d4d0fb5a791552acbb24ad8c41772e1d0b66c76c9cb86946bc862109721a0c986f5331
+DIST libarchive-3.7.5.tar.xz 5437940 BLAKE2B e1cf8490b2db64e912bd181391310653b4e3524e74f35557e1ddb8c5eb53dcde307da945d393921acf7549ef0d4a6bf228d8f42ab4d795d06dd2248196a11c85 SHA512 b9cfb0a147bf0f77cca9e2bdea173f47a78dcba5df1d97a8e0e7b14a15039ac6d5467e325423b2a05741848f73ca7ab4fece922153f24f934f9370cb521d20df
+DIST libarchive-3.7.5.tar.xz.asc 659 BLAKE2B 7310b8d7e3f07b8c75910ff3355ffda653402ca2d6db9cdf7d669b9a4ac5f3fb4c4c4482e85184fd68a23c96bce587a95b56efb88ae971399e130e533bd0969a SHA512 7494518b61a58a9aa1e991a2cf6b16340e34d7aa2c25a3c531799785e165541781d1a915437260bc536fe8267140cc69abb2670e8c0576e975a5a2b7ecf8e20d
diff --git a/app-arch/libarchive/files/libarchive-3.7.5-iso9660-times.patch b/app-arch/libarchive/files/libarchive-3.7.5-iso9660-times.patch
new file mode 100644
index 000000000000..2c5bcc277364
--- /dev/null
+++ b/app-arch/libarchive/files/libarchive-3.7.5-iso9660-times.patch
@@ -0,0 +1,334 @@
+From b65d12b344a5d81c6060b1c1794afa8858fe234b Mon Sep 17 00:00:00 2001
+From: Tim Kientzle <kientzle@acm.org>
+Date: Sat, 14 Sep 2024 21:09:34 -0700
+Subject: [PATCH] Be more cautious about parsing ISO-9660 timestamps
+
+Some ISO images don't have valid timestamps for the root directory
+entry.  Parsing such timestamps can generate nonsensical results,
+which in one case showed up as an unexpected overflow on a 32-bit system.
+
+Add some validation logic that can check whether a 7-byte or 17-byte
+timestamp is reasonable-looking, and use this to ignore invalid
+timestamps in various locations.  This also requires us to be a little
+more careful about tracking which timestamps are actually known.
+
+Resolves issue #2329
+---
+ .../archive_read_support_format_iso9660.c     | 186 ++++++++++++++++--
+ libarchive/test/test_read_format_iso_Z.c      |  12 +-
+ 2 files changed, 177 insertions(+), 21 deletions(-)
+
+diff --git a/libarchive/archive_read_support_format_iso9660.c b/libarchive/archive_read_support_format_iso9660.c
+index 056beb5ff..951afb603 100644
+--- a/libarchive/archive_read_support_format_iso9660.c
++++ b/libarchive/archive_read_support_format_iso9660.c
+@@ -273,7 +273,7 @@ struct file_info {
+ 	char		 re;		/* Having RRIP "RE" extension.	*/
+ 	char		 re_descendant;
+ 	uint64_t	 cl_offset;	/* Having RRIP "CL" extension.	*/
+-	int		 birthtime_is_set;
++	int		 time_is_set;	/* Bitmask indicating which times are known */
+ 	time_t		 birthtime;	/* File created time.		*/
+ 	time_t		 mtime;		/* File last modified time.	*/
+ 	time_t		 atime;		/* File last accessed time.	*/
+@@ -306,6 +306,11 @@ struct file_info {
+ 	} rede_files;
+ };
+ 
++#define BIRTHTIME_IS_SET 1
++#define MTIME_IS_SET 2
++#define ATIME_IS_SET 4
++#define CTIME_IS_SET 8
++
+ struct heap_queue {
+ 	struct file_info **files;
+ 	int		 allocated;
+@@ -394,7 +399,9 @@ static void	dump_isodirrec(FILE *, const unsigned char *isodirrec);
+ #endif
+ static time_t	time_from_tm(struct tm *);
+ static time_t	isodate17(const unsigned char *);
++static int	isodate17_valid(const unsigned char *);
+ static time_t	isodate7(const unsigned char *);
++static int	isodate7_valid(const unsigned char *);
+ static int	isBootRecord(struct iso9660 *, const unsigned char *);
+ static int	isVolumePartition(struct iso9660 *, const unsigned char *);
+ static int	isVDSetTerminator(struct iso9660 *, const unsigned char *);
+@@ -1351,13 +1358,22 @@ archive_read_format_iso9660_read_header(struct archive_read *a,
+ 	archive_entry_set_uid(entry, file->uid);
+ 	archive_entry_set_gid(entry, file->gid);
+ 	archive_entry_set_nlink(entry, file->nlinks);
+-	if (file->birthtime_is_set)
++	if ((file->time_is_set & BIRTHTIME_IS_SET))
+ 		archive_entry_set_birthtime(entry, file->birthtime, 0);
+ 	else
+ 		archive_entry_unset_birthtime(entry);
+-	archive_entry_set_mtime(entry, file->mtime, 0);
+-	archive_entry_set_ctime(entry, file->ctime, 0);
+-	archive_entry_set_atime(entry, file->atime, 0);
++	if ((file->time_is_set & MTIME_IS_SET))
++		archive_entry_set_mtime(entry, file->mtime, 0);
++	else
++		archive_entry_unset_mtime(entry);
++	if ((file->time_is_set & CTIME_IS_SET))
++		archive_entry_set_ctime(entry, file->ctime, 0);
++	else
++		archive_entry_unset_ctime(entry);
++	if ((file->time_is_set & ATIME_IS_SET))
++		archive_entry_set_atime(entry, file->atime, 0);
++	else
++		archive_entry_unset_atime(entry);
+ 	/* N.B.: Rock Ridge supports 64-bit device numbers. */
+ 	archive_entry_set_rdev(entry, (dev_t)file->rdev);
+ 	archive_entry_set_size(entry, iso9660->entry_bytes_remaining);
+@@ -1898,8 +1914,11 @@ parse_file_info(struct archive_read *a, struct file_info *parent,
+ 	file->parent = parent;
+ 	file->offset = offset;
+ 	file->size = fsize;
+-	file->mtime = isodate7(isodirrec + DR_date_offset);
+-	file->ctime = file->atime = file->mtime;
++	if (isodate7_valid(isodirrec + DR_date_offset)) {
++		file->time_is_set |= MTIME_IS_SET | ATIME_IS_SET | CTIME_IS_SET;
++		file->mtime = isodate7(isodirrec + DR_date_offset);
++		file->ctime = file->atime = file->mtime;
++	}
+ 	file->rede_files.first = NULL;
+ 	file->rede_files.last = &(file->rede_files.first);
+ 
+@@ -2573,51 +2592,73 @@ parse_rockridge_TF1(struct file_info *file, const unsigned char *data,
+ 		/* Use 17-byte time format. */
+ 		if ((flag & 1) && data_length >= 17) {
+ 			/* Create time. */
+-			file->birthtime_is_set = 1;
+-			file->birthtime = isodate17(data);
++			if (isodate17_valid(data)) {
++				file->time_is_set |= BIRTHTIME_IS_SET;
++				file->birthtime = isodate17(data);
++			}
+ 			data += 17;
+ 			data_length -= 17;
+ 		}
+ 		if ((flag & 2) && data_length >= 17) {
+ 			/* Modify time. */
+-			file->mtime = isodate17(data);
++			if (isodate17_valid(data)) {
++				file->time_is_set |= MTIME_IS_SET;
++				file->mtime = isodate17(data);
++			}
+ 			data += 17;
+ 			data_length -= 17;
+ 		}
+ 		if ((flag & 4) && data_length >= 17) {
+ 			/* Access time. */
+-			file->atime = isodate17(data);
++			if (isodate17_valid(data)) {
++				file->time_is_set |= ATIME_IS_SET;
++				file->atime = isodate17(data);
++			}
+ 			data += 17;
+ 			data_length -= 17;
+ 		}
+ 		if ((flag & 8) && data_length >= 17) {
+ 			/* Attribute change time. */
+-			file->ctime = isodate17(data);
++			if (isodate17_valid(data)) {
++				file->time_is_set |= CTIME_IS_SET;
++				file->ctime = isodate17(data);
++			}
+ 		}
+ 	} else {
+ 		/* Use 7-byte time format. */
+ 		if ((flag & 1) && data_length >= 7) {
+ 			/* Create time. */
+-			file->birthtime_is_set = 1;
+-			file->birthtime = isodate7(data);
++			if (isodate7_valid(data)) {
++				file->time_is_set |= BIRTHTIME_IS_SET;
++				file->birthtime = isodate7(data);
++			}
+ 			data += 7;
+ 			data_length -= 7;
+ 		}
+ 		if ((flag & 2) && data_length >= 7) {
+ 			/* Modify time. */
+-			file->mtime = isodate7(data);
++			if (isodate7_valid(data)) {
++				file->time_is_set |= MTIME_IS_SET;
++				file->mtime = isodate7(data);
++			}
+ 			data += 7;
+ 			data_length -= 7;
+ 		}
+ 		if ((flag & 4) && data_length >= 7) {
+ 			/* Access time. */
+-			file->atime = isodate7(data);
++			if (isodate7_valid(data)) {
++				file->time_is_set |= ATIME_IS_SET;
++				file->atime = isodate7(data);
++			}
+ 			data += 7;
+ 			data_length -= 7;
+ 		}
+ 		if ((flag & 8) && data_length >= 7) {
+ 			/* Attribute change time. */
+-			file->ctime = isodate7(data);
++			if (isodate7_valid(data)) {
++				file->time_is_set |= CTIME_IS_SET;
++				file->ctime = isodate7(data);
++			}
+ 		}
+ 	}
+ }
+@@ -3226,6 +3267,56 @@ isValid733Integer(const unsigned char *p)
+ 		&& p[3] == p[4]);
+ }
+ 
++static int
++isodate7_valid(const unsigned char *v)
++{
++	int year = v[0];
++	int month = v[1];
++	int day = v[2];
++	int hour = v[3];
++	int minute = v[4];
++	int second = v[5];
++	int gmt_off = (signed char)v[6];
++
++	/* ECMA-119 9.1.5 "If all seven values are zero, it shall mean
++	 * that the date is unspecified" */
++	if (year == 0
++	    && month == 0
++	    && day == 0
++	    && hour == 0
++	    && minute == 0
++	    && second == 0
++	    && gmt_off == 0)
++		return 0;
++	/*
++	 * Sanity-test each individual field
++	 */
++	/* Year can have any value */
++	/* Month must be 1-12 */
++	if (month < 1 || month > 12)
++		return 0;
++	/* Day must be 1-31 */
++	if (day < 1 || day > 31)
++		return 0;
++	/* Hour must be 0-23 */
++	if (hour > 23)
++		return 0;
++	/* Minute must be 0-59 */
++	if (minute > 59)
++		return 0;
++	/* second must be 0-59 according to ECMA-119 9.1.5 */
++	/* BUT: we should probably allow for the time being in UTC, which
++	   allows up to 61 seconds in a minute in certain cases */
++	if (second > 61)
++		return 0;
++	/* Offset from GMT must be -48 to +52 */
++	if (gmt_off < -48 || gmt_off > +52)
++		return 0;
++
++	/* All tests pass, this is OK */
++	return 1;
++}
++
+ static time_t
+ isodate7(const unsigned char *v)
+ {
+@@ -3252,6 +3343,67 @@ isodate7(const unsigned char *v)
+ 	return (t);
+ }
+ 
++static int
++isodate17_valid(const unsigned char *v)
++{
++	/* First 16 bytes are all ASCII digits */
++	for (int i = 0; i < 16; i++) {
++		if (v[i] < '0' || v[i] > '9')
++			return 0;
++	}
++
++	int year = (v[0] - '0') * 1000 + (v[1] - '0') * 100
++		+ (v[2] - '0') * 10 + (v[3] - '0');
++	int month = (v[4] - '0') * 10 + (v[5] - '0');
++	int day = (v[6] - '0') * 10 + (v[7] - '0');
++	int hour = (v[8] - '0') * 10 + (v[9] - '0');
++	int minute = (v[10] - '0') * 10 + (v[11] - '0');
++	int second = (v[12] - '0') * 10 + (v[13] - '0');
++	int hundredths = (v[14] - '0') * 10 + (v[15] - '0');
++	int gmt_off = (signed char)v[16];
++
++	if (year == 0 && month == 0 && day == 0
++	    && hour == 0 && minute == 0 && second == 0
++	    && hundredths == 0 && gmt_off == 0)
++		return 0;
++	/*
++	 * Sanity-test each individual field
++	 */
++
++	/* Year must be 1900-2300 */
++	/* (Not specified in ECMA-119, but these seem
++	   like reasonable limits. */
++	if (year < 1900 || year > 2300)
++		return 0;
++	/* Month must be 1-12 */
++	if (month < 1 || month > 12)
++		return 0;
++	/* Day must be 1-31 */
++	if (day < 1 || day > 31)
++		return 0;
++	/* Hour must be 0-23 */
++	if (hour > 23)
++		return 0;
++	/* Minute must be 0-59 */
++	if (minute > 59)
++		return 0;
++	/* second must be 0-59 according to ECMA-119 9.1.5 */
++	/* BUT: we should probably allow for the time being in UTC, which
++	   allows up to 61 seconds in a minute in certain cases */
++	if (second > 61)
++		return 0;
++	/* Hundredths must be 0-99 */
++	if (hundredths > 99)
++		return 0;
++	/* Offset from GMT must be -48 to +52 */
++	if (gmt_off < -48 || gmt_off > +52)
++		return 0;
++
++	/* All tests pass, this is OK */
++	return 1;
++
++}
++
+ static time_t
+ isodate17(const unsigned char *v)
+ {
+diff --git a/libarchive/test/test_read_format_iso_Z.c b/libarchive/test/test_read_format_iso_Z.c
+index d07bc1bc8..716552fa3 100644
+--- a/libarchive/test/test_read_format_iso_Z.c
++++ b/libarchive/test/test_read_format_iso_Z.c
+@@ -93,16 +93,20 @@ test_small(const char *name)
+ 	assertEqualIntA(a, ARCHIVE_OK,
+ 	    archive_read_next_header(a, &ae));
+ 	assertEqualString(".", archive_entry_pathname(ae));
+-	assertEqualIntA(a, 3443989665, archive_entry_atime(ae));
+-	assertEqualIntA(a, 0, archive_entry_birthtime(ae));
+-	assertEqualIntA(a, 3443989665, archive_entry_ctime(ae));
++	assertEqualInt(0, archive_entry_atime_is_set(ae));
++	assertEqualInt(0, archive_entry_atime(ae));
++	assertEqualInt(0, archive_entry_birthtime_is_set(ae));
++	assertEqualInt(0, archive_entry_birthtime(ae));
++	assertEqualInt(0, archive_entry_ctime_is_set(ae));
++	assertEqualInt(0, archive_entry_ctime(ae));
+ 	assertEqualIntA(a, 0, archive_entry_dev(ae));
+ 	assertEqualIntA(a, AE_IFDIR, archive_entry_filetype(ae));
+ 	assertEqualIntA(a, 0, archive_entry_gid(ae));
+ 	assertEqualStringA(a, NULL, archive_entry_gname(ae));
+ 	assertEqualIntA(a, 0, archive_entry_ino(ae));
+ 	assertEqualIntA(a, AE_IFDIR | 0700, archive_entry_mode(ae));
+-	assertEqualIntA(a, 3443989665, archive_entry_mtime(ae));
++	assertEqualInt(0, archive_entry_mtime_is_set(ae));
++	assertEqualInt(0, archive_entry_mtime(ae));
+ 	assertEqualIntA(a, 4, archive_entry_nlink(ae));
+ 	assertEqualIntA(a, 0700, archive_entry_perm(ae));
+ 	assertEqualIntA(a, 2048, archive_entry_size(ae));
diff --git a/app-arch/libarchive/libarchive-3.7.5.ebuild b/app-arch/libarchive/libarchive-3.7.5.ebuild
new file mode 100644
index 000000000000..c5d6394eed24
--- /dev/null
+++ b/app-arch/libarchive/libarchive-3.7.5.ebuild
@@ -0,0 +1,177 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit libtool multilib-minimal toolchain-funcs verify-sig
+
+DESCRIPTION="Multi-format archive and compression library"
+HOMEPAGE="
+	https://www.libarchive.org/
+	https://github.com/libarchive/libarchive/
+"
+SRC_URI="
+	https://www.libarchive.de/downloads/${P}.tar.xz
+	verify-sig? ( https://www.libarchive.de/downloads/${P}.tar.xz.asc )
+"
+
+LICENSE="BSD BSD-2 BSD-4 public-domain"
+SLOT="0/13"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="
+	acl blake2 +bzip2 +e2fsprogs expat +iconv lz4 +lzma lzo nettle
+	static-libs test xattr +zstd
+"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	sys-libs/zlib:=[${MULTILIB_USEDEP}]
+	acl? ( virtual/acl:=[${MULTILIB_USEDEP}] )
+	blake2? ( app-crypt/libb2:=[${MULTILIB_USEDEP}] )
+	bzip2? ( app-arch/bzip2:=[${MULTILIB_USEDEP}] )
+	expat? ( dev-libs/expat:=[${MULTILIB_USEDEP}] )
+	!expat? ( dev-libs/libxml2:=[${MULTILIB_USEDEP}] )
+	iconv? ( virtual/libiconv:=[${MULTILIB_USEDEP}] )
+	dev-libs/openssl:=[${MULTILIB_USEDEP}]
+	lz4? ( >=app-arch/lz4-0_p131:=[${MULTILIB_USEDEP}] )
+	lzma? ( >=app-arch/xz-utils-5.2.5-r1:=[${MULTILIB_USEDEP}] )
+	lzo? ( >=dev-libs/lzo-2:=[${MULTILIB_USEDEP}] )
+	nettle? ( dev-libs/nettle:=[${MULTILIB_USEDEP}] )
+	zstd? ( app-arch/zstd:=[${MULTILIB_USEDEP}] )
+"
+# TODO: fix attr/xattr.h includes and remove sys-apps/attr dep
+DEPEND="${RDEPEND}
+	kernel_linux? (
+		virtual/os-headers
+		e2fsprogs? ( sys-fs/e2fsprogs[${MULTILIB_USEDEP}] )
+		xattr? ( sys-apps/attr[${MULTILIB_USEDEP}] )
+	)
+	test? (
+		app-arch/lrzip
+		app-arch/lz4
+		app-arch/lzip
+		app-arch/lzop
+		app-arch/xz-utils
+		app-arch/zstd
+		lzma? ( app-arch/xz-utils[extra-filters(+)] )
+	)
+"
+BDEPEND="
+	verify-sig? ( >=sec-keys/openpgp-keys-libarchive-20221209 )
+	elibc_musl? ( sys-libs/queue-standalone )
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/libarchive.org.asc
+
+# false positives (checks for libc-defined hash functions)
+QA_CONFIG_IMPL_DECL_SKIP=(
+	SHA256_Init SHA256_Update SHA256_Final
+	SHA384_Init SHA384_Update SHA384_Final
+	SHA512_Init SHA512_Update SHA512_Final
+)
+
+PATCHES=(
+	# https://github.com/libarchive/libarchive/issues/2069
+	# (we can simply update the command since we don't support old lrzip)
+	"${FILESDIR}/${PN}-3.7.2-lrzip.patch"
+	# https://github.com/libarchive/libarchive/pull/2330
+	"${FILESDIR}/${P}-iso9660-times.patch"
+)
+
+src_prepare() {
+	default
+
+	# Needed for flags to be respected w/ LTO
+	elibtoolize
+}
+
+multilib_src_configure() {
+	export ac_cv_header_ext2fs_ext2_fs_h=$(usex e2fsprogs) #354923
+
+	local myconf=(
+		$(use_enable acl)
+		$(use_enable static-libs static)
+		$(use_enable xattr)
+		$(use_with blake2 libb2)
+		$(use_with bzip2 bz2lib)
+		$(use_with expat)
+		$(use_with !expat xml2)
+		$(use_with iconv)
+		$(use_with lz4)
+		$(use_with lzma)
+		$(use_with lzo lzo2)
+		$(use_with nettle)
+		--with-zlib
+		$(use_with zstd)
+
+		# Windows-specific
+		--without-cng
+	)
+	if multilib_is_native_abi ; then
+		myconf+=(
+			--enable-bsdcat="$(tc-is-static-only && echo static || echo shared)"
+			--enable-bsdcpio="$(tc-is-static-only && echo static || echo shared)"
+			--enable-bsdtar="$(tc-is-static-only && echo static || echo shared)"
+			--enable-bsdunzip="$(tc-is-static-only && echo static || echo shared)"
+		)
+	else
+		myconf+=(
+			--disable-bsdcat
+			--disable-bsdcpio
+			--disable-bsdtar
+			--disable-bsdunzip
+		)
+	fi
+
+	ECONF_SOURCE="${S}" econf "${myconf[@]}"
+}
+
+multilib_src_compile() {
+	if multilib_is_native_abi ; then
+		emake
+	else
+		emake libarchive.la
+	fi
+}
+
+src_test() {
+	mkdir -p "${T}"/bin || die
+	# tests fail when lbzip2[symlink] is used in place of ref bunzip2
+	ln -s "${BROOT}/bin/bunzip2" "${T}"/bin || die
+	# workaround lrzip broken on 32-bit arches with >= 10 threads
+	# https://bugs.gentoo.org/927766
+	cat > "${T}"/bin/lrzip <<-EOF || die
+		#!/bin/sh
+		exec "$(type -P lrzip)" -p1 "\${@}"
+	EOF
+	chmod +x "${T}/bin/lrzip" || die
+	local -x PATH=${T}/bin:${PATH}
+	multilib-minimal_src_test
+}
+
+multilib_src_test() {
+	# sandbox is breaking long symlink behavior
+	local -x SANDBOX_ON=0
+	local -x LD_PRELOAD=
+	# some locales trigger different output that breaks tests
+	local -x LC_ALL=C.UTF-8
+	emake check
+}
+
+multilib_src_install() {
+	if multilib_is_native_abi ; then
+		emake DESTDIR="${D}" install
+	else
+		local install_targets=(
+			install-includeHEADERS
+			install-libLTLIBRARIES
+			install-pkgconfigDATA
+		)
+		emake DESTDIR="${D}" "${install_targets[@]}"
+	fi
+
+	# Libs.private: should be used from libarchive.pc instead
+	find "${ED}" -type f -name "*.la" -delete || die
+	# https://github.com/libarchive/libarchive/issues/1766
+	sed -e '/Requires\.private/s:iconv::' \
+		-i "${ED}/usr/$(get_libdir)/pkgconfig/libarchive.pc" || die
+}