I had to mark TrueCrypt 6.0a as stable (why it's marked unstable when it's been available for months, I'll never know), only to find out that there is a newer version available. I tried installing 6.0a anyway, only to find that the source code for past versions of TrueCrypt are not available. Please develop a stable ebuild for TrueCrypt 6.1. Reproducible: Always Steps to Reproduce: 1. Mark TrueCrypt 6.0a as stable. 2. Emerge it. You will be prompted to manually fetch the sources. 3. Check their website. Only the source code for version 6.1 is available, which is not supported on Gentoo. Expected Results: Portage should have TrueCrypt 6.1 in the stable x86/amd64 trees.
under question as to continue truecrypt inclusion as per bug #241650. You thoughts please?
(In reply to comment #1) > under question as to continue truecrypt inclusion as per bug #241650. You > thoughts please? After USE flags and CFLAGS, Portage is one of Gentoo's greatest benefits. It's got strengths over the ever-popular apt and yum, but this isn't the place to wax poetic over Portage. Plus, TrueCrypt is a fairly well-known program. Not having an ebuild for this is like not having an ebuild for, say, Thunderbird. While I'm not fluent in the ebuild syntax, I wouldn't mind picking up a reference document and making an ebuild for TrueCrypt 6.1 later tonight (unless someone beats me to it).
(In reply to comment #2) the question was more legal related. I know portage is good and I see truecrypt is popular. Added to package.mask until resolved due to cascading bugs.
(In reply to comment #3) > (In reply to comment #2) > the question was more legal related. I know portage is good and I see truecrypt > is popular. Added to package.mask until resolved due to cascading bugs. As far as legal concerns go, I think giving the user a warning about the license and keeping fetch restriction turned on is the best solution (in the old days, it worked for sun-jdk-bin, and Captive NTFS which required Windows system files). But bug #241650 is the place to discuss the licensing issues, not here. I'll be back with an ebuild for TrueCrypt 6.1 later.
This is alpha truecrypt-6.1.ebuild simply changed from truecrypt-6.0a. PKCS #11 header files download from ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-11/v2-20/ (according Readme.txt) EXTRA_CFLAGS="${CFLAGS} -O0" and EXTRA_CXXFLAGS="${CXXFLAGS} -O0" for compiling on gcc-4.3 (Bug#: 237493)
Created attachment 170665 [details] alpha ebuild Reprodused on x86, gcc-4.3
This ebuild works for me :) Yaroslav: thanks for posting it.
I think that simply publishing build instructions (and ebuilds with fetch/mirror restrictions are nothing else imho) shoud be legally OK for Gentoo. It's the users who download the code and thus have a chance to read the license. As the license has been changed since bug 241650 was opened, and 6.1 includes this change, it would be desirable to have this version in portage. So much for the legal, let's turn technical. I tried the ebuild from comment #6. Fails for me with "error: ‘BOOL’ does not name a type" even when -DBOOL=int is among the compiler arguments. The culprit seems to be wx/db.h from x11-libs/wxGTK-2.8.9.1-r1. It contains an #undef BOOL and gets included via this path: Application.cpp -> "System.h" -> "SystemPrecompiled.h" -> <wx/wx.h> -> "wx/window.h" -> "wx/colour.h" -> "wx/variant.h" -> "wx/db.h" The truecrypt-5.0-bool.patch from bug 209467 originally addressed this. As I believe wxGTK to be a better place to fix this, I just filed bug 245973. Let's also look at the other patches which have been commented out. truecrypt-5.1a-external-wx.patch: Seems to be included in spirit, although WX_CONFIG_EXTRA should probably be renamed to WX_CONFIG_ARGS and include --unicode. truecrypt-5.1-64bit.patch: Should be tested on amd64. The wget commands in the ebuild are really bad, I think. Especially considering that they prevent the downloaded files from being checksummed, introducing possibly untrusted code into a security relevant application. I see several alternatives: 1. Include them in SRC_URI. Due to fetch restrictions users would have to manually download those as well. 2. Make a separate ebuild for these header files, and give their location using the PKCS11_INC environment variable. 3. Place the files in ${FILESDIR}. About 120k of additional data in the portage tree, which most portage users won't need as they don't use truecrypt. 4. Try to build truecrypt against files of the same name from dev-libs/nss. Didn't work out of the box for me, and I don't know how much work it would be. Other than this, the ebuild works for me. I would like to see this in portage once it works clean enough.
Created attachment 171455 [details] proposed ebuild 1. PKCS11 headers are included in SRC_URI. 2. 5.1a-external-wx, 5.1-64bit and 5.0-bool patches are updated. 3. -O0 optimization flag is enabled only for gcc-4.3.x (Bug#: 237493) Please test.
Created attachment 171456 [details, diff] truecrypt-6.1-64bit.patch
Created attachment 171458 [details, diff] truecrypt-6.1-bool.patch
Created attachment 171459 [details, diff] truecrypt-6.1-external-wx
Created attachment 171462 [details, diff] truecrypt-6.1-bool.patch
Newest ebuild and patches work fine for me. Thanks :)
Created attachment 171565 [details] proposed ebuild I found that truecrypt-6.1 compiled well using gcc-4.3.2, if >=sys-libs/glibc-2.7 is installed. Therefore in this ebuild -O0 flag is used only if has_version '<=sys-libs/glibc-2.7' and "$(gcc-version)" = "4.3".
Latest patches and ebuild work great. Removing the mask (due to licensing), keyword, getting the files for the fetch restriction, and getting them digested because it's an overlay is a serious pain - but the build works perfectly.
Even though I get the device mapper error as well I assume this is easely solved so I'd say its working for me as well. Using latest ebuild+patches and manually downloaded files. Gentoo 64-bit (multilib). I do think however that making people downloading these files by hand is way too much work (the source and other files - not the ebuild+patches ofc). I like TrueCrypt and I want it to be safe but if each update causes an interrupted 'emerge world' - what most people run unattended and expect to finish on its own - and looking up instructions & downloading an moving the files, people might not be inclined to update. At least I would simply mask new versions until I finally need some new feature or think its time to upgrade - which is probably not the intent. What is wrong with the current delivery system? Manifests already have a checksum for all files right? So why would wget-ing the files be any problem?
Sorry, I was unclear - nothing is wrong with the current delivery system (that can be resolved), it's just a really long process when you have to put the ebuild in an overlay. That would be fixed by getting 6.1 into the tree. In regards to the fetch restriction, as far as I understand, that has to stay unless truecrypt changes their license or their website (or both?) to allow it to be downloaded via the ebuild - right now the license prohibits redistribution, I believe. So that one can't really be resolved. One thing that could be changed is fixing the ebuild to expect the same filename as the download from truecrypt's website ('Truecrypt 6.1 Source.tar.gz'), to avoid having to rename that. It would be great if someone could work with TrueCrypt to get the license revised into something more friendly to distributions, but from what i've seen, they haven't been very cooperative on that front so far. For now, i'd say we should just get 6.1 into the tree and preferably get the mask removed.
1. I'm getting error when mounting encrypted volume: Error: device-mapper: reload ioctl failed: Bad argument Command failed Everything was fine with 4.3a version. Because of this error I have to use "-m nokernelcrypto" option -- volume is mounted through /dev/loop instead of device-mapper. 2. Many command line options has changes since 4.3a so there could be some note at the end of emerge process. 3. The need to rename source tarball is a bit awkward. 4. Not counting above -- ebuild works fine.
I had the same error. I had to upgrade to kernel 2.6.27, because there the RIPEMD-160 hash algorithm is included. Also XTS (Experimental) has to be activated. Both options are found under "Cryptographic API" in the kernel configuration menu.
>Error: device-mapper: reload ioctl failed: Bad argument I solve this in gentoo-sourses-2.6.25-gentoo-r8 You should add some Cryptographic API in kernel. Please, read http://forums.gentoo.org/viewtopic-t-713591.html If you have time, you can find which options MUST be enabled in kernel.
(In reply to comment #3) > (In reply to comment #2) > the question was more legal related. I know portage is good and I see truecrypt > is popular. Added to package.mask until resolved due to cascading bugs. > I was just reading over http://bugs.gentoo.org/show_bug.cgi?id=241650 regarding the licensing issues, it refers to this post: http://lists.freedesktop.org/archives/distributions/2008-October/000276.html I checked the current licenese http://www.truecrypt.org/legal/license and it would appear that the relveant parts have been changed. Hopefully this somewhat mitagtes the legal issues?
> I found that truecrypt-6.1 compiled well using gcc-4.3.2, if > >=sys-libs/glibc-2.7 is installed. > if has_version'<=sys-libs/glibc-2.7' and "$(gcc-version)" = "4.3". Shouldn't that be "<sys-libs/glibc-2.7"?
(In reply to comment #23) > > I found that truecrypt-6.1 compiled well using gcc-4.3.2, if > > >=sys-libs/glibc-2.7 is installed. > > > if has_version'<=sys-libs/glibc-2.7' and "$(gcc-version)" = "4.3". > > Shouldn't that be "<sys-libs/glibc-2.7"? > Now only glibc-2.7-r2 available therefore both are the same. I will change it, thanks
Created attachment 173927 [details] proposed ebuild
truecrypt-6.1a released. Source for 6.1 no longer available. http://bugs.gentoo.org/show_bug.cgi?id=249543
*** Bug 249543 has been marked as a duplicate of this bug. ***
Created attachment 174114 [details] truecrypt-6.1a.ebuild
Problem when compiling 6.1a on amd64 + gcc-4.3.2. /var/tmp/portage/app-crypt/truecrypt-6.1a/work/truecrypt-6.1a-source/Common/SecurityToken.h:205: error: ‘CK_FUNCTION_LIST_PTR’ does not name a type make[1]: *** [Keyfile.o] Error 1 make[1]: *** Waiting for unfinished jobs.... make[1]: Leaving directory `/var/tmp/portage/app-crypt/truecrypt-6.1a/work/truecrypt-6.1a-source/Volume' make: *** [all] Error 2 * * ERROR: app-crypt/truecrypt-6.1a failed. * Call stack: * ebuild.sh, line 49: Called src_compile * environment, line 2266: Called die * The specific snippet of code: * emake ${EXTRA} PKCS11_INC="${DISTDIR}" NOSTRIP=1 VERBOSE=1 NOTEST=1 CC="$(tc-getCC)" AR="$(tc-getAR)" CXX="$(tc-getCXX)" RANLIB="$(tc-getRANLIB)" EXTRA_CFLAGS="${CFLAGS}" EXTRA_CXXFLAGS="${CXXFLAGS}" EXTRA_LDFLAGS="${LDFLAGS}" WX_CONFIG="${WX_CONFIG}" WX_CONFIG_EXTRA="" || die * The die message: * (no error message) Any suggestions ?
(In reply to comment #1) > under question as to continue truecrypt inclusion as per bug #241650. You > thoughts please? > for me it seems that this issue was discussed as TrueCrypt License was in version 2.5. The version in question is distributed with the TrueCrypt License Version 2.6 and so the changes in the license should be reviewed.
(In reply to comment #30) [snip] > for me it seems that this issue was discussed as TrueCrypt License was in > version 2.5. The version in question is distributed with the TrueCrypt License > Version 2.6 and so the changes in the license should be reviewed. IANAL, but I reviewed the relevant portions of the current (v2.6) version of the truecrypt license against the suggestions laid out in this post: http://lists.freedesktop.org/archives/distributions/2008-October/000276.html From the way it looks, only one of the suggested changes given by Tom Calloway at Fedora legal was *not* implemented in the new license. The piece in question currently reads as follows: >Section VI, Paragraph 2: > > NOTHING IN THIS LICENSE SHALL IMPLY OR BE CONSTRUED AS A PROMISE, > OBLIGATION, OR COVENANT NOT TO SUE FOR COPYRIGHT OR TRADEMARK > INFRINGEMENT. With the (apparently rejected) suggested wording being: > NOTHING IN THIS LICENSE SHALL IMPLY OR BE CONSTRUED AS A PROMISE, > OBLIGATION, OR COVENANT NOT TO SUE FOR TRADEMARK INFRINGEMENT. The problem with this is that a license is in effect "a promise not to sue for actions that are allowed under the license." Unfortunately, with the word "COPYRIGHT" placed in the wording on VI,2 this promise is seemingly nullified. I'm not sure, but it unfortunately looks like this paragraph was the critical show-stopper for Fedora...
Okay so I downloaded the ebuild for 6.1a but I still can't emerge truecrypt: jordanwb@JORDAN-8FC7A898 ~ $ emerge -pv =app-crypt/truecrypt-6.1a These are the packages that would be merged, in order: Calculating dependencies - * Missing digest for '/usr/portage/app-crypt/truecrypt/truecrypt-6.1a.ebuild' ... done! !!! All ebuilds that could satisfy "=app-crypt/truecrypt-6.1a" have been masked. !!! One of the following masked packages is required to complete your request: - app-crypt/truecrypt-6.1a (masked by: corruption) For more information, see the MASKED PACKAGES section in the emerge man page or refer to the Gentoo Handbook.
Jordan, Whenever you're missing a digest, you can either simply re-sync to get that digest: $ emerge --sync Or you can generate the digest yourself; this is most useful when there's no digest available in the tree (for instance when you downloaded an ebuild manually) $ ebuild /usr/portage/app-crypt/truecrypt/truecrypt-6.1a.ebuild digest
(In reply to comment #28) > Created an attachment (id=174114) [edit] > truecrypt-6.1a.ebuild > Yaroslav, I have a comment on the ebuild. Are the RSA pkcs11 headers any different from the ones provided by NSS? If not you could just add a DEPEND on dev-libs/nss, and use PKCS11_INC="/usr/include/nss". Otherwise opensc also supplies pkcs11 headers, perhaps these could be used? Either way this gets the headers out of DISTDIR.
* Messages for package app-crypt/truecrypt-6.1a: * Cannot find $EPATCH_SOURCE! Value for $EPATCH_SOURCE is: * * /usr/local/portage/app-crypt/truecrypt/files/truecrypt-6.1-64bit.patch * ( truecrypt-6.1-64bit.patch ) * * ERROR: app-crypt/truecrypt-6.1a failed. * Call stack: * ebuild.sh, line 49: Called src_unpack * environment, line 2221: Called epatch '/usr/local/portage/app-cr ypt/truecrypt/files/truecrypt-6.1-64bit.patch' * environment, line 1021: Called die * The specific snippet of code: * die "Cannot find $EPATCH_SOURCE!"; * The die message: * Cannot find $EPATCH_SOURCE! * * If you need support, post the topmost build error, and the call stack if rele vant. * A complete build log is located at '/var/tmp/portage/app-crypt/truecrypt-6.1a /temp/build.log'. * The ebuild environment file is located at '/var/tmp/portage/app-crypt/truecry pt-6.1a/temp/environment'. * This ebuild is from an overlay: '/usr/local/portage/' * Can someone advise me of where I can obtain all the files/patches required by the 6.1a ebuild please?
(In reply to comment #35) > Can someone advise me of where I can obtain all the files/patches required by > the 6.1a ebuild please? > Download truecrypt-6.1-external-wx.patch, truecrypt-6.1-bool.patch, truecrypt-6.1-64bit.patch from this page to /usr/local/portage/app-crypt/truecry pt/files Other way is ti use <a href="http://code.google.com/p/yarik-overlay">yarik-overlay</a>. See http://en.gentoo-wiki.com/wiki/TrueCrypt
(In reply to comment #36) > (In reply to comment #35) > > Can someone advise me of where I can obtain all the files/patches required by > > the 6.1a ebuild please? > > > > Download truecrypt-6.1-external-wx.patch, truecrypt-6.1-bool.patch, > truecrypt-6.1-64bit.patch from this page to > /usr/local/portage/app-crypt/truecry > pt/files > > Other way is ti use <a > href="http://code.google.com/p/yarik-overlay">yarik-overlay</a>. See > http://en.gentoo-wiki.com/wiki/TrueCrypt > Thanks for the pointer, I'm sure that I'm going blind in my old age. I successfully emerge truecrypt, but I got the following error when trying to run it: server truecrypt # truecrypt -N 1 /dev/md5 truecrypt: /usr/lib/gcc/i486-pc-linux-gnu/4.1.2/libstdc++.so.6: version `GLIBCXX_3.4.9' not found (required by truecrypt) truecrypt: /usr/lib/gcc/i486-pc-linux-gnu/4.1.2/libstdc++.so.6: version `GLIBCXX_3.4.9' not found (required by /usr/lib/libwx_baseu-2.8.so.0) I edited the ebuild and added the -oO CFLAGS and CXXFLAGS manually, which got rid of the first error, but not the second. Any help would be much appreciated.
You switched your gcc after compiling truecrypt/wxwidgets. Try running gcc-config -l and update to the latest available version.
(In reply to comment #38) > You switched your gcc after compiling truecrypt/wxwidgets. Try running > gcc-config -l and update to the latest available version. > I already have the latest version selected: server truecrypt # gcc-config -l [1] i486-pc-linux-gnu-4.1.2 [2] i686-pc-linux-gnu-4.3.3 * I've tried re-emerging truecrypt and glibc, to no effect.
Apparently your system includes the 4.1.2 libs. If truecrypt is the only binary affected, maybe you need source /etc/profile again, or it uses some kind of startup script which is broken. Anyway: New bug or ask on irc/forums for further assistance.
Created attachment 182734 [details, diff] truecrypt-6.1-gcc44.patch I had to add this patch to compile truecrypt with gcc-4.4. Patch is dirty and probably 64bit specific, so rather don't use :). Especially first part with typedefs is strange, but I'm not sure why including of <stdint.h> or <sys/types.h> didn't defined int32_t for me.. Maybe because >glibc-2.7 (2.9_p20081201-r2 here), because then is used macro __intN_t(N, MODE).
*** Bug 269558 has been marked as a duplicate of this bug. ***
Created attachment 191064 [details] truecrypt-6.2.ebuild
Fixed.
I'm trying to emerge truecrypt 6.2, but official site offers 6.2a, so as expected emerge gives check sum error. Please update the ebuild for new version of truecrypt. Reproducible: Always Steps to reproduce: 1. emerge --sync 2. emerge truecrypt 3. Follow the instructions, download latest source code avaliable (6.2a) 4. Run emerge truecrypt again, get an error Expected Results: Portage should have an ebuild for TrueCrypt 6.2a Emerge ourput: ghost distfiles # emerge truecrypt Calculating dependencies... done! >>> Verifying ebuild manifests >>> Emerging (1 of 1) app-crypt/truecrypt-6.2 Refetching... File renamed to '/usr/portage/distfiles/truecrypt-6.2.tar.gz._checksum_failure_.S6tusR' !!! app-crypt/truecrypt-6.2 has fetch restriction turned on. !!! This probably means that this ebuild's files must be downloaded !!! manually. See the comments in the ebuild for more information. * Please download tar.gz source from: * http://www.truecrypt.org/downloads2.php * Then put the file in /usr/portage/distfiles/truecrypt-6.2.tar.gz * Fetch failed for 'app-crypt/truecrypt-6.2', Log file: * '/var/tmp/portage/app-crypt/truecrypt-6.2/temp/build.log' >>> Failed to emerge app-crypt/truecrypt-6.2, Log file: >>> '/var/tmp/portage/app-crypt/truecrypt-6.2/temp/build.log' * Messages for package app-crypt/truecrypt-6.2: * Fetch failed for 'app-crypt/truecrypt-6.2', Log file: * '/var/tmp/portage/app-crypt/truecrypt-6.2/temp/build.log'
Created attachment 195487 [details] truecrypt-6.2a.ebuild Available in yarik-overlay
(In reply to comment #45 and comment #46) Bug #245322 was fixed long time ago. Please don't use it for other problems.
(In reply to comment #46) > Created an attachment (id=195487) [edit] > truecrypt-6.2a.ebuild > > Available in yarik-overlay Your ebuild specifies wrong LICENSE.
