net-vpn/tor: add 0.4.8.3_rc (unkeyworded)

Closes: https://bugs.gentoo.org/909556
Signed-off-by: Sam James <sam@gentoo.org>

3 files changed, 214 insertions, 3 deletions

diff --git a/net-vpn/tor/Manifest b/net-vpn/tor/Manifest
index 60c28123eafd..b3a25b764aaf 100644
--- a/net-vpn/tor/Manifest
+++ b/net-vpn/tor/Manifest
@@ -4,3 +4,6 @@ DIST tor-0.4.7.13.tar.gz.sha256sum.asc 716 BLAKE2B 968a3852293ab9bcadac626862c9d
 DIST tor-0.4.7.14.tar.gz 8220496 BLAKE2B 909bf9bbff68179f4aa66a875cd42b1ecebe2767c1789f46c0cc9cb67eaeb6777d1f42d68caa89cfad424069f50953c57461d39edbd776dfed453226f6e2250f SHA512 3c11ae3f765351122984675401dd7d2015914e15257a2308020937d394d6375bf532a080bb2c4274ac068484edcd688c24c2264e206a28ef3d4d1161eca15436
 DIST tor-0.4.7.14.tar.gz.sha256sum 86 BLAKE2B 41e0ceb68f7de77dcd74b7c48b733e18f2a452d82e588425a1fb25c92017208dd5c2dca588d32910ca13a6366ae1d1f76f758b76bf217e8bdad37f24a63436f3 SHA512 cf54d1021948ca11e240e31c64942e15683eea3df043d26d3293f92fef08a09253cad56120c2198c5099fcb5ae5ce8fc0bbd864d3cab869c885cfdc2af014b36
 DIST tor-0.4.7.14.tar.gz.sha256sum.asc 1321 BLAKE2B 0ed3a4ab5c119f097367c2f2b88bd4f688382a7922ddac62aae5e6c128f017aaf5863b2214198bd217d6266e2d3d04e0f7ab06201fa183bd93841e37bfebac2a SHA512 61f56c43c043a1b83fcb0252e0b6fb2cca29e39eb5041ac0b6337560839851bcd515ab314bd25e25d77c51408228cf5f39e5065d928ab73ee5851b86c3d46162
+DIST tor-0.4.8.3-rc.tar.gz 8425071 BLAKE2B 14e151bbd5b5e2f59dc9db8aefc6902fdd3fa6c6f0edea759e8b8fff7c925bfeaa4b37779877358e08f68a86a42ffbaf803da8764f8b10ac640464dc95b481b5 SHA512 9cc13c68beadc8223a3d1f3c2f795a873bf201302a2b9042e2c3b9601f21d292843d2e9adde2bb22b7eb02c433ddad2d3adf8de73d2b0a052d0015e11823bb11
+DIST tor-0.4.8.3-rc.tar.gz.sha256sum 88 BLAKE2B a5dee663db3bb0183049043d3d2c9a0c996fd1ac7af155cf7eac255443eb5fe777ae85442a22b232b723217b8861d77b5dddfc95b8cc9253e449ad3c52304be0 SHA512 34e81d7b7148dfe00e7becc239637f2f1baaa4c485e7c87a8c920ffaf3b45a308cdaf1aed8ccf0636c012bf6a3d5ff955f27e51b8131335a7ec2257b541924f7
+DIST tor-0.4.8.3-rc.tar.gz.sha256sum.asc 716 BLAKE2B 33980ca5e5946f0324c724336a3966c0484ff9fd2655dae222a4bd3cbbfaed4cb5906ba3b0da59a8fa187ab182bbb0c31e4d3f7b32955fdf5a634e8d430164f0 SHA512 2498779691fad21c15d65f5119ba24563d13b631248be0281a270e9d382caff7ed18bae2dbea68b824e12cbc0cd7c650a4833357203b6a67f7ad30161dadefed
diff --git a/net-vpn/tor/tor-0.4.8.3_rc.ebuild b/net-vpn/tor/tor-0.4.8.3_rc.ebuild
new file mode 100644
index 000000000000..8c577a42be89
--- /dev/null
+++ b/net-vpn/tor/tor-0.4.8.3_rc.ebuild
@@ -0,0 +1,185 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..12} )
+VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/torproject.org.asc
+inherit edo python-any-r1 readme.gentoo-r1 systemd verify-sig
+
+MY_PV="$(ver_rs 4 -)"
+MY_PF="${PN}-${MY_PV}"
+DESCRIPTION="Anonymizing overlay network for TCP"
+HOMEPAGE="https://www.torproject.org/ https://gitlab.torproject.org/tpo/core/tor/"
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://gitlab.torproject.org/tpo/core/tor"
+	inherit autotools git-r3
+else
+	SRC_URI="
+		https://www.torproject.org/dist/${MY_PF}.tar.gz
+		https://archive.torproject.org/tor-package-archive/${MY_PF}.tar.gz
+		verify-sig? (
+			https://dist.torproject.org/${MY_PF}.tar.gz.sha256sum
+			https://dist.torproject.org/${MY_PF}.tar.gz.sha256sum.asc
+		)
+	"
+
+	S="${WORKDIR}/${MY_PF}"
+
+	if [[ ${PV} != *_alpha* && ${PV} != *_beta* && ${PV} != *_rc* ]]; then
+		KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86 ~ppc-macos"
+	fi
+
+	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-tor-20230727 )"
+fi
+
+# BSD in general, but for PoW, needs --enable-gpl (GPL-3 per --version)
+# We also already had GPL-2 listed here for the init script, but obviously
+# that's different from the actual binary.
+LICENSE="BSD GPL-2 GPL-3"
+SLOT="0"
+IUSE="caps doc lzma +man scrypt seccomp selinux +server systemd tor-hardening test zstd"
+RESTRICT="!test? ( test )"
+
+DEPEND="
+	>=dev-libs/libevent-2.1.12-r1:=[ssl]
+	sys-libs/zlib
+	caps? ( sys-libs/libcap )
+	man? ( app-text/asciidoc )
+	dev-libs/openssl:=[-bindist(-)]
+	lzma? ( app-arch/xz-utils )
+	scrypt? ( app-crypt/libscrypt )
+	seccomp? ( >=sys-libs/libseccomp-2.4.1 )
+	systemd? ( sys-apps/systemd )
+	zstd? ( app-arch/zstd )
+"
+RDEPEND="
+	acct-user/tor
+	acct-group/tor
+	${DEPEND}
+	selinux? ( sec-policy/selinux-tor )
+"
+DEPEND+="
+	test? (
+		${DEPEND}
+		${PYTHON_DEPS}
+	)
+"
+
+DOCS=()
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-0.2.7.4-torrc.sample.patch
+)
+
+pkg_setup() {
+	use test && python-any-r1_pkg_setup
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+	else
+		if use verify-sig; then
+			cd "${DISTDIR}" || die
+			verify-sig_verify_detached ${MY_PF}.tar.gz.sha256sum{,.asc}
+			verify-sig_verify_unsigned_checksums \
+				${MY_PF}.tar.gz.sha256sum sha256 ${MY_PF}.tar.gz
+			cd "${WORKDIR}" || die
+		fi
+
+		default
+	fi
+}
+
+src_prepare() {
+	default
+
+	# Running shellcheck automagically isn't useful for ebuild testing.
+	echo "exit 0" > scripts/maint/checkShellScripts.sh || die
+
+	if [[ ${PV} == 9999 ]] ; then
+		eautoreconf
+	fi
+}
+
+src_configure() {
+	use doc && DOCS+=( README.md ChangeLog ReleaseNotes doc/HACKING )
+
+	export ac_cv_lib_cap_cap_init=$(usex caps)
+	export tor_cv_PYTHON="${EPYTHON}"
+
+	local myeconfargs=(
+		--localstatedir="${EPREFIX}/var"
+		--disable-all-bugs-are-fatal
+		--enable-system-torrc
+		--disable-android
+		--disable-coverage
+		--disable-html-manual
+		--disable-libfuzzer
+		--enable-missing-doc-warnings
+		--disable-module-dirauth
+		--enable-pic
+		--disable-restart-debugging
+
+		# Unless someone asks & has a compelling reason, just always
+		# build in GPL mode for pow, given we don't want yet another USE
+		# flag combination to have to test just for the sake of it.
+		# (PoW requires GPL.)
+		--enable-gpl
+		--enable-module-pow
+
+		# This option is enabled by default upstream w/ zstd, surprisingly.
+		# zstd upstream says this shouldn't be relied upon and it may
+		# break API & ABI at any point, so Tor tries to fake static-linking
+		# to make it work, but then requires a rebuild on any new zstd version
+		# even when its standard ABI hasn't changed.
+		# See bug #727406 and bug #905708.
+		--disable-zstd-advanced-apis
+
+		$(use_enable man asciidoc)
+		$(use_enable man manpage)
+		$(use_enable lzma)
+		$(use_enable scrypt libscrypt)
+		$(use_enable seccomp)
+		$(use_enable server module-relay)
+		$(use_enable systemd)
+		$(use_enable tor-hardening gcc-hardening)
+		$(use_enable tor-hardening linker-hardening)
+		$(use_enable test unittests)
+		$(use_enable zstd)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_test() {
+	local skip_tests=(
+		# Fails in sandbox
+		:sandbox/open_filename
+		:sandbox/openat_filename
+	)
+
+	# The makefile runs these by parallel by chunking them with a script
+	# but that means we lose verbosity and can't skip individual tests easily
+	# either.
+	edo ./src/test/test --verbose "${skip_tests[@]}"
+}
+
+src_install() {
+	default
+	readme.gentoo_create_doc
+
+	newconfd "${FILESDIR}"/tor.confd tor
+	newinitd "${FILESDIR}"/tor.initd-r9 tor
+	systemd_dounit "${FILESDIR}"/tor.service
+
+	keepdir /var/lib/tor
+
+	fperms 750 /var/lib/tor
+	fowners tor:tor /var/lib/tor
+
+	insinto /etc/tor/
+	newins "${FILESDIR}"/torrc-r2 torrc
+}
diff --git a/net-vpn/tor/tor-9999.ebuild b/net-vpn/tor/tor-9999.ebuild
index 0d1196f060ac..8c577a42be89 100644
--- a/net-vpn/tor/tor-9999.ebuild
+++ b/net-vpn/tor/tor-9999.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 
 PYTHON_COMPAT=( python3_{10..12} )
 VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/torproject.org.asc
-inherit python-any-r1 readme.gentoo-r1 systemd verify-sig
+inherit edo python-any-r1 readme.gentoo-r1 systemd verify-sig
 
 MY_PV="$(ver_rs 4 -)"
 MY_PF="${PN}-${MY_PV}"
@@ -28,13 +28,16 @@ else
 	S="${WORKDIR}/${MY_PF}"
 
 	if [[ ${PV} != *_alpha* && ${PV} != *_beta* && ${PV} != *_rc* ]]; then
-		KEYWORDS="amd64 arm arm64 ~hppa ~mips ppc ppc64 ~riscv ~sparc x86 ~ppc-macos"
+		KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86 ~ppc-macos"
 	fi
 
 	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-tor-20230727 )"
 fi
 
-LICENSE="BSD GPL-2"
+# BSD in general, but for PoW, needs --enable-gpl (GPL-3 per --version)
+# We also already had GPL-2 listed here for the init script, but obviously
+# that's different from the actual binary.
+LICENSE="BSD GPL-2 GPL-3"
 SLOT="0"
 IUSE="caps doc lzma +man scrypt seccomp selinux +server systemd tor-hardening test zstd"
 RESTRICT="!test? ( test )"
@@ -120,6 +123,13 @@ src_configure() {
 		--enable-pic
 		--disable-restart-debugging
 
+		# Unless someone asks & has a compelling reason, just always
+		# build in GPL mode for pow, given we don't want yet another USE
+		# flag combination to have to test just for the sake of it.
+		# (PoW requires GPL.)
+		--enable-gpl
+		--enable-module-pow
+
 		# This option is enabled by default upstream w/ zstd, surprisingly.
 		# zstd upstream says this shouldn't be relied upon and it may
 		# break API & ABI at any point, so Tor tries to fake static-linking
@@ -144,6 +154,19 @@ src_configure() {
 	econf "${myeconfargs[@]}"
 }
 
+src_test() {
+	local skip_tests=(
+		# Fails in sandbox
+		:sandbox/open_filename
+		:sandbox/openat_filename
+	)
+
+	# The makefile runs these by parallel by chunking them with a script
+	# but that means we lose verbosity and can't skip individual tests easily
+	# either.
+	edo ./src/test/test --verbose "${skip_tests[@]}"
+}
+
 src_install() {
 	default
 	readme.gentoo_create_doc