main/python2: backport fix for libressl-2.7

2 files changed, 89 insertions, 3 deletions

diff --git a/main/python2/APKBUILD b/main/python2/APKBUILD
index bc06fd5afc..9516d4fbe3 100644
--- a/main/python2/APKBUILD
+++ b/main/python2/APKBUILD
@@ -4,7 +4,7 @@ pkgname=python2
 # the python2-tkinter's pkgver needs to be synchronized with this.
 pkgver=2.7.14
 _verbase=${pkgver%.*}
-pkgrel=3
+pkgrel=4
 pkgdesc="A high-level scripting language"
 url="http://www.python.org"
 arch="all"
@@ -17,7 +17,9 @@ makedepends="expat-dev libressl-dev zlib-dev ncurses-dev bzip2-dev
 	gdbm-dev sqlite-dev libffi-dev readline-dev linux-headers paxmark"
 source="http://www.python.org/ftp/python/$pkgver/Python-$pkgver.tar.xz
 	musl-find_library.patch
-	unchecked-ioctl.patch"
+	unchecked-ioctl.patch
+	libressl-2.7.patch
+	"
 builddir="$srcdir/Python-$pkgver"
 
 prepare() {
@@ -121,4 +123,5 @@ gdbm() {
 
 sha512sums="78310b0be6388ffa15f29a80afb9ab3c03a572cb094e9da00cfe391afadb51696e41f592eb658d6a31a2f422fdac8a55214a382cbb8cfb43d4a127d5b35ea7f9  Python-2.7.14.tar.xz
 ab8eaa2858d5109049b1f9f553198d40e0ef8d78211ad6455f7b491af525bffb16738fed60fc84e960c4889568d25753b9e4a1494834fea48291b33f07000ec2  musl-find_library.patch
-5a8e013a4132d71c4360771f130d27b37275ae59330cf9a75378dc8a11236017f540eb224f2a148984e82ca3fb6b29129375b1080ba05b81044faa717520ab82  unchecked-ioctl.patch"
+5a8e013a4132d71c4360771f130d27b37275ae59330cf9a75378dc8a11236017f540eb224f2a148984e82ca3fb6b29129375b1080ba05b81044faa717520ab82  unchecked-ioctl.patch
+af9aca18d5e9df0b55cfb9aea92a5e7b90188e6708a71f8b290eb05caa06308be542dd7e9f62ff7b2624249e1705aa72973c09f3840ba3a42c4ffa7a30525d65  libressl-2.7.patch"
diff --git a/main/python2/libressl-2.7.patch b/main/python2/libressl-2.7.patch
new file mode 100644
index 0000000000..b8da869dc1
--- /dev/null
+++ b/main/python2/libressl-2.7.patch
@@ -0,0 +1,83 @@
+From edd541897b9c28ee0d0f0131746aa5f19665a104 Mon Sep 17 00:00:00 2001
+From: Christian Heimes <christian@python.org>
+Date: Sat, 24 Mar 2018 19:34:15 +0100
+Subject: [PATCH] [2.7] bpo-33127: Compatibility patch for LibreSSL 2.7.0
+ (GH-6210) (GH-6215)
+
+LibreSSL 2.7 introduced OpenSSL 1.1.0 API. The ssl module now detects
+LibreSSL 2.7 and only provides API shims for OpenSSL < 1.1.0 and
+LibreSSL < 2.7.
+
+Documentation updates and fixes for failing tests will be provided in
+another patch set.
+
+Signed-off-by: Christian Heimes <christian@python.org>.
+(cherry picked from commit 4ca0739c9d97ac7cd45499e0d31be68dc659d0e1)
+
+Co-authored-by: Christian Heimes <christian@python.org>
+---
+ .../2018-03-24-15-08-24.bpo-33127.olJmHv.rst       |  1 +
+ Modules/_ssl.c                                     | 24 ++++++++++++++--------
+ Tools/ssl/multissltests.py                         |  3 ++-
+ 3 files changed, 19 insertions(+), 9 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Library/2018-03-24-15-08-24.bpo-33127.olJmHv.rst
+
+diff --git a/Misc/NEWS.d/next/Library/2018-03-24-15-08-24.bpo-33127.olJmHv.rst b/Misc/NEWS.d/next/Library/2018-03-24-15-08-24.bpo-33127.olJmHv.rst
+new file mode 100644
+index 000000000000..635aabbde031
+--- /dev/null
++++ b/Misc/NEWS.d/next/Library/2018-03-24-15-08-24.bpo-33127.olJmHv.rst
+@@ -0,0 +1 @@
++The ssl module now compiles with LibreSSL 2.7.1.
+diff --git a/Modules/_ssl.c b/Modules/_ssl.c
+index da8b20f54f35..d0ce913d3d89 100644
+--- a/Modules/_ssl.c
++++ b/Modules/_ssl.c
+@@ -102,6 +102,12 @@ struct py_ssl_library_code {
+ 
+ #if (OPENSSL_VERSION_NUMBER >= 0x10100000L) && !defined(LIBRESSL_VERSION_NUMBER)
+ #  define OPENSSL_VERSION_1_1 1
++#  define PY_OPENSSL_1_1_API 1
++#endif
++
++/* LibreSSL 2.7.0 provides necessary OpenSSL 1.1.0 APIs */
++#if defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER >= 0x2070000fL
++#  define PY_OPENSSL_1_1_API 1
+ #endif
+ 
+ /* Openssl comes with TLSv1.1 and TLSv1.2 between 1.0.0h and 1.0.1
+@@ -149,16 +155,18 @@ struct py_ssl_library_code {
+ #define INVALID_SOCKET (-1)
+ #endif
+ 
+-#ifdef OPENSSL_VERSION_1_1
+-/* OpenSSL 1.1.0+ */
+-#ifndef OPENSSL_NO_SSL2
+-#define OPENSSL_NO_SSL2
+-#endif
+-#else /* OpenSSL < 1.1.0 */
+-#if defined(WITH_THREAD)
++/* OpenSSL 1.0.2 and LibreSSL needs extra code for locking */
++#if !defined(OPENSSL_VERSION_1_1) && defined(WITH_THREAD)
+ #define HAVE_OPENSSL_CRYPTO_LOCK
+ #endif
+ 
++#if defined(OPENSSL_VERSION_1_1) && !defined(OPENSSL_NO_SSL2)
++#define OPENSSL_NO_SSL2
++#endif
++
++#ifndef PY_OPENSSL_1_1_API
++/* OpenSSL 1.1 API shims for OpenSSL < 1.1.0 and LibreSSL < 2.7.0 */
++
+ #define TLS_method SSLv23_method
+ 
+ static int X509_NAME_ENTRY_set(const X509_NAME_ENTRY *ne)
+@@ -201,7 +209,7 @@ static X509_VERIFY_PARAM *X509_STORE_get0_param(X509_STORE *store)
+ {
+     return store->param;
+ }
+-#endif /* OpenSSL < 1.1.0 or LibreSSL */
++#endif /* OpenSSL < 1.1.0 or LibreSSL < 2.7.0 */
+ 
+ 
+ enum py_ssl_error {