Bugzilla Bug 245322

I had to mark TrueCrypt 6.0a as stable (why it's marked unstable when it's been
available for months, I'll never know), only to find out that there is a newer
version available.  I tried installing 6.0a anyway, only to find that the
source code for past versions of TrueCrypt are not available.

Please develop a stable ebuild for TrueCrypt 6.1.

Reproducible: Always

Steps to Reproduce:
1.  Mark TrueCrypt 6.0a as stable.
2.  Emerge it.  You will be prompted to manually fetch the sources.
3.  Check their website.  Only the source code for version 6.1 is available,
which is not supported on Gentoo.


Expected Results:  
Portage should have TrueCrypt 6.1 in the stable x86/amd64 trees.

under question as to continue truecrypt inclusion as per bug #241650. You
thoughts please?

(In reply to comment #1)
> under question as to continue truecrypt inclusion as per bug #241650. You
> thoughts please?

After USE flags and CFLAGS, Portage is one of Gentoo's greatest benefits.  It's
got strengths over the ever-popular apt and yum, but this isn't the place to
wax poetic over Portage.  Plus, TrueCrypt is a fairly well-known program.  Not
having an ebuild for this is like not having an ebuild for, say, Thunderbird.

While I'm not fluent in the ebuild syntax, I wouldn't mind picking up a
reference document and making an ebuild for TrueCrypt 6.1 later tonight (unless
someone beats me to it).

(In reply to comment #2)
the question was more legal related. I know portage is good and I see truecrypt
is popular. Added to package.mask until resolved due to cascading bugs.

(In reply to comment #3)
> (In reply to comment #2)
> the question was more legal related. I know portage is good and I see truecrypt
> is popular. Added to package.mask until resolved due to cascading bugs.

As far as legal concerns go, I think giving the user a warning about the
license and keeping fetch restriction turned on is the best solution (in the
old days, it worked for sun-jdk-bin, and Captive NTFS which required Windows
system files).  But bug #241650 is the place to discuss the licensing issues,
not here.

I'll be back with an ebuild for TrueCrypt 6.1 later.

This is alpha truecrypt-6.1.ebuild simply changed from truecrypt-6.0a.

PKCS #11 header files download from
ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-11/v2-20/ (according Readme.txt)

EXTRA_CFLAGS="${CFLAGS} -O0" and EXTRA_CXXFLAGS="${CXXFLAGS} -O0" for compiling
on gcc-4.3 (Bug#: 237493)

Created an attachment (id=170665) [details]
alpha ebuild

Reprodused on x86, gcc-4.3

This ebuild works for me :)

Yaroslav: thanks for posting it.

I think that simply publishing build instructions (and ebuilds with
fetch/mirror restrictions are nothing else imho) shoud be legally OK for
Gentoo. It's the users who download the code and thus have a chance to read the
license. As the license has been changed since bug 241650 was opened, and 6.1
includes this change, it would be desirable to have this version in portage. So
much for the legal, let's turn technical.

I tried the ebuild from comment #6. Fails for me with "error: ‘BOOL’ does
not name a type" even when -DBOOL=int is among the compiler arguments. The
culprit seems to be wx/db.h from x11-libs/wxGTK-2.8.9.1-r1. It contains an
#undef BOOL and gets included via this path:
Application.cpp -> "System.h" -> "SystemPrecompiled.h" -> <wx/wx.h> ->
"wx/window.h" -> "wx/colour.h" -> "wx/variant.h" -> "wx/db.h"
The truecrypt-5.0-bool.patch from bug 209467 originally addressed this. As I
believe wxGTK to be a better place to fix this, I just filed bug 245973.

Let's also look at the other patches which have been commented out.

truecrypt-5.1a-external-wx.patch:
Seems to be included in spirit, although WX_CONFIG_EXTRA should probably be
renamed to WX_CONFIG_ARGS and include --unicode.

truecrypt-5.1-64bit.patch:
Should be tested on amd64.

The wget commands in the ebuild are really bad, I think. Especially considering
that they prevent the downloaded files from being checksummed, introducing
possibly untrusted code into a security relevant application. I see several
alternatives:
1. Include them in SRC_URI. Due to fetch restrictions users would have to
manually download those as well.
2. Make a separate ebuild for these header files, and give their location using
the PKCS11_INC environment variable.
3. Place the files in ${FILESDIR}. About 120k of additional data in the portage
tree, which most portage users won't need as they don't use truecrypt.
4. Try to build truecrypt against files of the same name from dev-libs/nss.
Didn't work out of the box for me, and I don't know how much work it would be.

Other than this, the ebuild works for me. I would like to see this in portage
once it works clean enough.

Created an attachment (id=171455) [details]
proposed ebuild

1. PKCS11 headers are included in SRC_URI.
2. 5.1a-external-wx, 5.1-64bit and 5.0-bool patches are updated.
3. -O0 optimization flag is enabled only for gcc-4.3.x (Bug#: 237493)

Please test.

Created an attachment (id=171456) [details]
truecrypt-6.1-64bit.patch

Created an attachment (id=171458) [details]
truecrypt-6.1-bool.patch

Created an attachment (id=171459) [details]
truecrypt-6.1-external-wx

Created an attachment (id=171462) [details]
truecrypt-6.1-bool.patch

Newest ebuild and patches work fine for me. Thanks :)

Created an attachment (id=171565) [details]
proposed ebuild

I found that truecrypt-6.1 compiled well using gcc-4.3.2, if
>=sys-libs/glibc-2.7 is installed.

Therefore in this ebuild -O0 flag is used only if has_version
'<=sys-libs/glibc-2.7' and "$(gcc-version)" = "4.3".

Latest patches and ebuild work great. Removing the mask (due to licensing),
keyword, getting the files for the fetch restriction, and getting them digested
because it's an overlay is a serious pain - but the build works perfectly.

Even though I get the device mapper error as well I assume this is easely
solved so I'd say its working for me as well. Using latest ebuild+patches and
manually downloaded files. Gentoo 64-bit (multilib).

I do think however that making people downloading these files by hand is way
too much work (the source and other files - not the ebuild+patches ofc). I like
TrueCrypt and I want it to be safe but if each update causes an interrupted
'emerge world' - what most people run unattended and expect to finish on its
own - and looking up instructions & downloading an moving the files, people
might not be inclined to update. At least I would simply mask new versions
until I finally need some new feature or think its time to upgrade - which is
probably not the intent.

What is wrong with the current delivery system? Manifests already have a
checksum for all files right? So why would wget-ing the files be any problem?

Sorry, I was unclear - nothing is wrong with the current delivery system (that
can be resolved), it's just a really long process when you have to put the
ebuild in an overlay. That would be fixed by getting 6.1 into the tree.

In regards to the fetch restriction, as far as I understand, that has to stay
unless truecrypt changes their license or their website (or both?) to allow it
to be downloaded via the ebuild - right now the license prohibits
redistribution, I believe. So that one can't really be resolved. One thing that
could be changed is fixing the ebuild to expect the same filename as the
download from truecrypt's website ('Truecrypt 6.1 Source.tar.gz'), to avoid
having to rename that.

It would be great if someone could work with TrueCrypt to get the license
revised into something more friendly to distributions, but from what i've seen,
they haven't been very cooperative on that front so far. For now, i'd say we
should just get 6.1 into the tree and preferably get the mask removed.

1. I'm getting error when mounting encrypted volume:

Error: device-mapper: reload ioctl failed: Bad argument
Command failed

Everything was fine with 4.3a version.
Because of this error I have to use "-m nokernelcrypto" option -- volume is
mounted through /dev/loop instead of device-mapper.

2. Many command line options has changes since 4.3a so there could be some note
at the end of emerge process.

3. The need to rename source tarball is a bit awkward.

4. Not counting above -- ebuild works fine.

I had the same error. I had to upgrade to kernel 2.6.27, because there the
RIPEMD-160 hash algorithm is included. Also XTS (Experimental) has to be
activated. Both options are found under "Cryptographic API" in the kernel
configuration menu.

>Error: device-mapper: reload ioctl failed: Bad argument

I solve this in gentoo-sourses-2.6.25-gentoo-r8

You should add some Cryptographic API in kernel. Please, read
http://forums.gentoo.org/viewtopic-t-713591.html

If you have time, you can find which options MUST be enabled in kernel.

(In reply to comment #3)
> (In reply to comment #2)
> the question was more legal related. I know portage is good and I see truecrypt
> is popular. Added to package.mask until resolved due to cascading bugs.
> 

I was just reading over http://bugs.gentoo.org/show_bug.cgi?id=241650 regarding
the licensing issues, it refers to this post:
http://lists.freedesktop.org/archives/distributions/2008-October/000276.html

I checked the current licenese http://www.truecrypt.org/legal/license and it
would appear that the relveant parts have been changed. Hopefully this somewhat
mitagtes the legal issues?

> I found that truecrypt-6.1 compiled well using gcc-4.3.2, if
> >=sys-libs/glibc-2.7 is installed.

> if has_version'<=sys-libs/glibc-2.7' and "$(gcc-version)" = "4.3".

Shouldn't that be "<sys-libs/glibc-2.7"?

(In reply to comment #23)
> > I found that truecrypt-6.1 compiled well using gcc-4.3.2, if
> > >=sys-libs/glibc-2.7 is installed.
> 
> > if has_version'<=sys-libs/glibc-2.7' and "$(gcc-version)" = "4.3".
> 
> Shouldn't that be "<sys-libs/glibc-2.7"?
> 

Now only glibc-2.7-r2 available therefore both are the same.

I will change it, thanks

Created an attachment (id=173927) [details]
proposed ebuild

truecrypt-6.1a released. Source for 6.1 no longer available.

http://bugs.gentoo.org/show_bug.cgi?id=249543

*** Bug 249543 has been marked as a duplicate of this bug. ***

Created an attachment (id=174114) [details]
truecrypt-6.1a.ebuild

Problem when compiling 6.1a on amd64 + gcc-4.3.2.

/var/tmp/portage/app-crypt/truecrypt-6.1a/work/truecrypt-6.1a-source/Common/SecurityToken.h:205:
error: ‘CK_FUNCTION_LIST_PTR’ does not name a type 
make[1]: *** [Keyfile.o] Error 1 
make[1]: *** Waiting for unfinished jobs.... 
make[1]: Leaving directory
`/var/tmp/portage/app-crypt/truecrypt-6.1a/work/truecrypt-6.1a-source/Volume' 
make: *** [all] Error 2 
* 
* ERROR: app-crypt/truecrypt-6.1a failed. 
* Call stack: 
* ebuild.sh, line 49: Called src_compile 
* environment, line 2266: Called die 
* The specific snippet of code: 
* emake ${EXTRA} PKCS11_INC="${DISTDIR}" NOSTRIP=1 VERBOSE=1 NOTEST=1
CC="$(tc-getCC)" AR="$(tc-getAR)" CXX="$(tc-getCXX)" RANLIB="$(tc-getRANLIB)"
EXTRA_CFLAGS="${CFLAGS}" EXTRA_CXXFLAGS="${CXXFLAGS}"
EXTRA_LDFLAGS="${LDFLAGS}" WX_CONFIG="${WX_CONFIG}" WX_CONFIG_EXTRA="" || die 
* The die message: 
* (no error message)

Any suggestions ?

(In reply to comment #1)
> under question as to continue truecrypt inclusion as per bug #241650. You
> thoughts please?
> 

for me it seems that this issue was discussed as TrueCrypt License was in
version 2.5. The version in question is distributed with the TrueCrypt License
Version 2.6 and so the changes in the license should be reviewed.

(In reply to comment #30)
[snip]
> for me it seems that this issue was discussed as TrueCrypt License was in
> version 2.5. The version in question is distributed with the TrueCrypt License
> Version 2.6 and so the changes in the license should be reviewed.

IANAL, but I reviewed the relevant portions of the current (v2.6) version of
the truecrypt license against the suggestions laid out in this post:
http://lists.freedesktop.org/archives/distributions/2008-October/000276.html

From the way it looks, only one of the suggested changes given by Tom Calloway
at Fedora legal was *not* implemented in the new license.  The piece in
question currently reads as follows:

>Section VI, Paragraph 2:
>
>  NOTHING IN THIS LICENSE SHALL IMPLY OR BE CONSTRUED AS A PROMISE, 
>  OBLIGATION, OR COVENANT NOT TO SUE FOR COPYRIGHT OR TRADEMARK 
>  INFRINGEMENT.

With the (apparently rejected) suggested wording being:

>  NOTHING IN THIS LICENSE SHALL IMPLY OR BE CONSTRUED AS A PROMISE,
>  OBLIGATION, OR COVENANT NOT TO SUE FOR TRADEMARK INFRINGEMENT.

The problem with this is that a license is in effect "a promise not to sue for
actions that are allowed under the license."  Unfortunately, with the word
"COPYRIGHT" placed in the wording on VI,2 this promise is seemingly nullified.

I'm not sure, but it unfortunately looks like this paragraph was the critical
show-stopper for Fedora...

Okay so I downloaded the ebuild for 6.1a but I still can't emerge truecrypt:

jordanwb@JORDAN-8FC7A898 ~ $ emerge -pv =app-crypt/truecrypt-6.1a

These are the packages that would be merged, in order:

Calculating dependencies - * Missing digest for
'/usr/portage/app-crypt/truecrypt/truecrypt-6.1a.ebuild'
... done!

!!! All ebuilds that could satisfy "=app-crypt/truecrypt-6.1a" have been
masked.
!!! One of the following masked packages is required to complete your request:
- app-crypt/truecrypt-6.1a (masked by: corruption)

For more information, see the MASKED PACKAGES section in the emerge
man page or refer to the Gentoo Handbook.

Jordan,

Whenever you're missing a digest, you can either simply re-sync to get that
digest:

$ emerge --sync

Or you can generate the digest yourself; this is most useful when there's no
digest available in the tree (for instance when you downloaded an ebuild
manually)

$ ebuild /usr/portage/app-crypt/truecrypt/truecrypt-6.1a.ebuild digest

(In reply to comment #28)
> Created an attachment (id=174114) [edit] [details]
> truecrypt-6.1a.ebuild
> 
Yaroslav,
I have a comment on the ebuild. Are the RSA pkcs11 headers any different from
the ones provided by NSS? If not you could just add a DEPEND on dev-libs/nss,
and use PKCS11_INC="/usr/include/nss". Otherwise opensc also supplies pkcs11
headers, perhaps these could be used? Either way this gets the headers out of
DISTDIR.

 * Messages for package app-crypt/truecrypt-6.1a:                               

 * Cannot find $EPATCH_SOURCE!  Value for $EPATCH_SOURCE is:                    
 *                                                                              
 *   /usr/local/portage/app-crypt/truecrypt/files/truecrypt-6.1-64bit.patch     
 *   ( truecrypt-6.1-64bit.patch )                                              
 *                                                                              
 * ERROR: app-crypt/truecrypt-6.1a failed.                                      
 * Call stack:                                                                  
 *               ebuild.sh, line   49:  Called src_unpack                       
 *             environment, line 2221:  Called epatch
'/usr/local/portage/app-cr
ypt/truecrypt/files/truecrypt-6.1-64bit.patch'                                  
 *             environment, line 1021:  Called die                              
 * The specific snippet of code:                                                
 *                   die "Cannot find $EPATCH_SOURCE!";                         
 *  The die message:                                                            
 *   Cannot find $EPATCH_SOURCE!                                                
 *                                                                              
 * If you need support, post the topmost build error, and the call stack if
rele
vant.                                                                           
 * A complete build log is located at
'/var/tmp/portage/app-crypt/truecrypt-6.1a
/temp/build.log'.                                                               
 * The ebuild environment file is located at
'/var/tmp/portage/app-crypt/truecry
pt-6.1a/temp/environment'.                                                      
 * This ebuild is from an overlay: '/usr/local/portage/'
 * 


Can someone advise me of where I can obtain all the files/patches required by
the 6.1a ebuild please?

(In reply to comment #35)
> Can someone advise me of where I can obtain all the files/patches required by
> the 6.1a ebuild please?
> 

Download truecrypt-6.1-external-wx.patch, truecrypt-6.1-bool.patch,
truecrypt-6.1-64bit.patch from this page to
/usr/local/portage/app-crypt/truecry
pt/files

Other way is ti use <a
href="http://code.google.com/p/yarik-overlay">yarik-overlay</a>. See
http://en.gentoo-wiki.com/wiki/TrueCrypt

(In reply to comment #36)
> (In reply to comment #35)
> > Can someone advise me of where I can obtain all the files/patches required by
> > the 6.1a ebuild please?
> > 
> 
> Download truecrypt-6.1-external-wx.patch, truecrypt-6.1-bool.patch,
> truecrypt-6.1-64bit.patch from this page to
> /usr/local/portage/app-crypt/truecry
> pt/files
> 
> Other way is ti use <a
> href="http://code.google.com/p/yarik-overlay">yarik-overlay</a>. See
> http://en.gentoo-wiki.com/wiki/TrueCrypt
> 

Thanks for the pointer, I'm sure that I'm going blind in my old age. I
successfully emerge truecrypt, but I got the following error when trying to run
it:
server truecrypt # truecrypt -N 1 /dev/md5
truecrypt: /usr/lib/gcc/i486-pc-linux-gnu/4.1.2/libstdc++.so.6: version
`GLIBCXX_3.4.9' not found (required by truecrypt)
truecrypt: /usr/lib/gcc/i486-pc-linux-gnu/4.1.2/libstdc++.so.6: version
`GLIBCXX_3.4.9' not found (required by /usr/lib/libwx_baseu-2.8.so.0)

I edited the ebuild and added the -oO CFLAGS and CXXFLAGS manually, which got
rid of the first error, but not the second. Any help would be much appreciated.

You switched your gcc after compiling truecrypt/wxwidgets. Try running
gcc-config -l and update to the latest available version.

(In reply to comment #38)
> You switched your gcc after compiling truecrypt/wxwidgets. Try running
> gcc-config -l and update to the latest available version.
> 

I already have the latest version selected:
server truecrypt # gcc-config -l
 [1] i486-pc-linux-gnu-4.1.2
 [2] i686-pc-linux-gnu-4.3.3 *

I've tried re-emerging truecrypt and glibc, to no effect.

Apparently your system includes the 4.1.2 libs. If truecrypt is the only binary
affected, maybe you need source /etc/profile again, or it uses some kind of
startup script which is broken.
Anyway: New bug or ask on irc/forums for further assistance.

Created an attachment (id=182734) [details]
truecrypt-6.1-gcc44.patch

I had to add this patch to compile truecrypt with gcc-4.4.

Patch is dirty and probably 64bit specific, so rather don't use :).

Especially first part with typedefs is strange, but I'm not sure why including
of <stdint.h> or <sys/types.h> didn't defined int32_t for me.. Maybe because
>glibc-2.7 (2.9_p20081201-r2 here), because then is used macro __intN_t(N,
MODE).

*** Bug 269558 has been marked as a duplicate of this bug. ***

Created an attachment (id=191064) [details]
truecrypt-6.2.ebuild

Fixed.

I'm trying to emerge truecrypt 6.2, but official site offers 6.2a, so as
expected emerge gives check sum error.

Please update the ebuild for new version of truecrypt.

Reproducible: Always

Steps to reproduce:
1. emerge --sync
2. emerge truecrypt
3. Follow the instructions, download latest source code avaliable (6.2a)
4. Run emerge truecrypt again, get an error

Expected Results:
Portage should have an ebuild for TrueCrypt 6.2a

Emerge ourput:
ghost distfiles # emerge truecrypt
Calculating dependencies... done!

>>> Verifying ebuild manifests

>>> Emerging (1 of 1) app-crypt/truecrypt-6.2
Refetching... File renamed to
'/usr/portage/distfiles/truecrypt-6.2.tar.gz._checksum_failure_.S6tusR'


!!! app-crypt/truecrypt-6.2 has fetch restriction turned on.
!!! This probably means that this ebuild's files must be downloaded
!!! manually.  See the comments in the ebuild for more information.

 * Please download tar.gz source from:
 * http://www.truecrypt.org/downloads2.php
 * Then put the file in /usr/portage/distfiles/truecrypt-6.2.tar.gz
 * Fetch failed for 'app-crypt/truecrypt-6.2', Log file:
 *  '/var/tmp/portage/app-crypt/truecrypt-6.2/temp/build.log'

>>> Failed to emerge app-crypt/truecrypt-6.2, Log file:

>>>  '/var/tmp/portage/app-crypt/truecrypt-6.2/temp/build.log'

 * Messages for package app-crypt/truecrypt-6.2:

 * Fetch failed for 'app-crypt/truecrypt-6.2', Log file:
 *  '/var/tmp/portage/app-crypt/truecrypt-6.2/temp/build.log'

Created an attachment (id=195487) [details]
truecrypt-6.2a.ebuild

Available in yarik-overlay

(In reply to comment #45 and comment #46)

Bug #245322 was fixed long time ago. Please don't use it for other problems.

(In reply to comment #46)
> Created an attachment (id=195487) [edit] [details]
> truecrypt-6.2a.ebuild
> 
> Available in yarik-overlay

Your ebuild specifies wrong LICENSE.