dev-util/pahole: verify src tarball

Signed-off-by: Matthias Schwarzott <zzam@gentoo.org>

3 files changed, 109 insertions, 1 deletions

diff --git a/dev-util/pahole/Manifest b/dev-util/pahole/Manifest
index 2d64ff51848d..768a7b64de02 100644
--- a/dev-util/pahole/Manifest
+++ b/dev-util/pahole/Manifest
@@ -1,4 +1,5 @@
 DIST dwarves-1.24.tar.xz 875744 BLAKE2B 6766b5a5ecbf64013227e7cd459af662fc213f230b5b1279354fcaaccebfa3d74f9a2254542dc4f3f1bb4a5def1d4c77e2445fa8b531fa8b9e331cdfc23155fe SHA512 3cdca183cf68ec46fd9a0301ae4a8a30b23a8139c65ffba64ae11f85f9e942f7341dca6f88a4a3b49f32bfd880927193a80fa011726e4a33d3e5a1a146326c06
 DIST dwarves-1.25.tar.xz 2244876 BLAKE2B 1926fa1fa123fc3ad0f7f063406260b1e1e2611c563fedebee4c837e491164571fdb40408421c0c4ea2fd24e89c54a7a1ea669313b6dd6d7dcfa4934e2c1336e SHA512 104bfb8712d863e04d0c827c008b23ebc49543b17bfb5b44ce276a5b3d39f12cf71f721055ae2e5f430aa77a3c70f85f6eeaf72fd8c1cdf547260488bc5b5070
+DIST dwarves-1.26.tar.sign 228 BLAKE2B 211f73da11d6ed61383fc0470c298360e7acae5fbeb2f963533fd3a984257f35b5626f04de9de92326723f06bea95a38903cee7f602146b12b1333cea2b720d0 SHA512 2f92951019847cddbfe90cd0e49a5746ca4886e25a9f8e26697688bec25d667255556bdc1ab897021eaa739d067a8d3e4fbbd0d7c9f7f56934676616fa11bce8
 DIST dwarves-1.26.tar.xz 2250036 BLAKE2B cb86bf964f22633432e80d335937379c2096877c6130f49dbe03f2653b7c932bb1c5d87621ac93383be9e4f35294a4f95aadb6392491fb782812db519b39b666 SHA512 72e3c708ac6304d28daaab1c4365b66252d016987cbf33ec6d18456718478d7b96d6916dc3686069a386e97a9db355bb1e5e078c0c7b40e93bd7e8bd0b0380be
 DIST pahole-1.24_p20221024-patches.tar.xz 22088 BLAKE2B b39458400411dd7da0f568257f42164952e170b952e4893a92d769e17ce4cf0de88b727808a38195438fe10e5537f245bf101f647f383b6df7642c5446fa5d45 SHA512 93f160f01023c5402535a34d59005f0a3e056662a2764722480d71b6e522f3bfef0d642084467d1fbea96e23386b4cbb708243713d59eb84f4f767c1ac5ab3f5
diff --git a/dev-util/pahole/pahole-1.26-r1.ebuild b/dev-util/pahole/pahole-1.26-r1.ebuild
new file mode 100644
index 000000000000..e9c3238b4568
--- /dev/null
+++ b/dev-util/pahole/pahole-1.26-r1.ebuild
@@ -0,0 +1,82 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{9..12} )
+inherit cmake python-single-r1
+
+MY_PN=dwarves
+MY_P=${MY_PN}-${PV%%_p*}
+
+DESCRIPTION="pahole (Poke-a-Hole) and other DWARF2 utilities"
+HOMEPAGE="https://git.kernel.org/cgit/devel/pahole/pahole.git/"
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://git.kernel.org/pub/scm/devel/pahole/pahole.git"
+	inherit git-r3
+else
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/arnaldocarvalhodemelo.asc
+	inherit verify-sig
+	SRC_URI="http://fedorapeople.org/~acme/${MY_PN}/${MY_P}.tar.xz
+		verify-sig? ( http://fedorapeople.org/~acme/${MY_PN}/${MY_P}.tar.sign )"
+	if [[ ${PV} == *_p* ]] ; then
+		# Patch rollups from git format-patch. Sometimes there are important
+		# fixes in git which haven't been released (and no release in sight).
+		# Patch rollups are a bit better for understanding where changes have
+		# come from for users.
+		SRC_URI+=" https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}-patches.tar.xz"
+	fi
+	S="${WORKDIR}"/${MY_P}
+	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-arnaldocarvalhodemelo )"
+	KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+fi
+
+LICENSE="GPL-2" # only
+SLOT="0"
+IUSE="debug"
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+
+RDEPEND="${PYTHON_DEPS}
+	>=dev-libs/elfutils-0.178
+	sys-libs/zlib"
+DEPEND="${RDEPEND}"
+
+DOCS=( README README.ctracer NEWS )
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-1.10-python-import.patch
+)
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+		return
+	elif use verify-sig ; then
+		mkdir "${T}"/verify-sig || die
+		pushd "${T}"/verify-sig &>/dev/null || die
+
+		# Upstream sign the decompressed .tar
+		# Let's do it separately in ${T} then cleanup to avoid external
+		# effects on normal unpack.
+		xz -d -c "${DISTDIR}"/${MY_P}.tar.xz > ${MY_P}.tar || die
+		verify-sig_verify_detached ${MY_P}.tar "${DISTDIR}"/${MY_P}.tar.sign
+
+		popd &>/dev/null || die
+		rm -r "${T}"/verify-sig || die
+	fi
+
+	default
+}
+
+src_prepare() {
+	[[ -d "${WORKDIR}"/${P}-patches ]] && PATCHES+=( "${WORKDIR}"/${P}-patches )
+
+	cmake_src_prepare
+	python_fix_shebang ostra/ostra-cg ostra/python/ostra.py
+}
+
+src_configure() {
+	local mycmakeargs=( "-D__LIB=$(get_libdir)" )
+	cmake_src_configure
+}
diff --git a/dev-util/pahole/pahole-9999.ebuild b/dev-util/pahole/pahole-9999.ebuild
index aaef5d2f6e6c..e9c3238b4568 100644
--- a/dev-util/pahole/pahole-9999.ebuild
+++ b/dev-util/pahole/pahole-9999.ebuild
@@ -16,7 +16,10 @@ if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://git.kernel.org/pub/scm/devel/pahole/pahole.git"
 	inherit git-r3
 else
-	SRC_URI="http://fedorapeople.org/~acme/${MY_PN}/${MY_P}.tar.xz"
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/arnaldocarvalhodemelo.asc
+	inherit verify-sig
+	SRC_URI="http://fedorapeople.org/~acme/${MY_PN}/${MY_P}.tar.xz
+		verify-sig? ( http://fedorapeople.org/~acme/${MY_PN}/${MY_P}.tar.sign )"
 	if [[ ${PV} == *_p* ]] ; then
 		# Patch rollups from git format-patch. Sometimes there are important
 		# fixes in git which haven't been released (and no release in sight).
@@ -25,6 +28,7 @@ else
 		SRC_URI+=" https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}-patches.tar.xz"
 	fi
 	S="${WORKDIR}"/${MY_P}
+	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-arnaldocarvalhodemelo )"
 	KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
 fi
 
@@ -44,6 +48,27 @@ PATCHES=(
 	"${FILESDIR}"/${PN}-1.10-python-import.patch
 )
 
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+		return
+	elif use verify-sig ; then
+		mkdir "${T}"/verify-sig || die
+		pushd "${T}"/verify-sig &>/dev/null || die
+
+		# Upstream sign the decompressed .tar
+		# Let's do it separately in ${T} then cleanup to avoid external
+		# effects on normal unpack.
+		xz -d -c "${DISTDIR}"/${MY_P}.tar.xz > ${MY_P}.tar || die
+		verify-sig_verify_detached ${MY_P}.tar "${DISTDIR}"/${MY_P}.tar.sign
+
+		popd &>/dev/null || die
+		rm -r "${T}"/verify-sig || die
+	fi
+
+	default
+}
+
 src_prepare() {
 	[[ -d "${WORKDIR}"/${P}-patches ]] && PATCHES+=( "${WORKDIR}"/${P}-patches )