app-text/mupdf: security bump to 1.17.0

* Debundle dev-lang/mujs again for the
  security bug (bundled copy is probably OK
  in terms of release mujs, but not a new bug
  (CVE-2020-24343).

* Document bundled libs with references
  to check when bumping. Useful for both
  security@ and the maintainer.

* Include extra Debian patches for improved
  cross-compilation support (mostly pkg-config).

* Fix existing patch to respect libdir in pkgconfig
  file.

* Fix missing || dies.

Bug: https://bugs.gentoo.org/737034
Bug: https://bugs.gentoo.org/737020
Closes: https://bugs.gentoo.org/725672
Closes: https://bugs.gentoo.org/734898
Package-Manager: Portage-3.0.2, Repoman-2.3.23
Signed-off-by: Sam James <sam@gentoo.org>

3 files changed, 257 insertions, 0 deletions

diff --git a/app-text/mupdf/Manifest b/app-text/mupdf/Manifest
index 964f9c135010..7d7096950728 100644
--- a/app-text/mupdf/Manifest
+++ b/app-text/mupdf/Manifest
@@ -1 +1,2 @@
 DIST mupdf-1.16.1-source.tar.xz 45800404 BLAKE2B bc4158a457056c55db52a518efc13c289cca537c29a6b563046297dc225f3ce0add781adb8520c4d0829d653ed0539042597e341cb21c4fb4c462ed422bf735b SHA512 fa657e6b9251aff91c25e91b335ea829b797dd91a759505bfd7259f8236613f590a044bc741e9b0587da55817a1ab8c1499c067d65d683d099259d06d91a8f50
+DIST mupdf-1.17.0-source.tar.xz 48559964 BLAKE2B f46b09a6d288054da79bea356df4d7d98fe2759cf82bea1f0df2e961b94acebbab58826f7a731c4c68e8b086fd9367fddcabea6c7d2838f25ed84ddc1a0c2bd9 SHA512 39188e6ce3eaefb525b2c32767c4bf52ed881b41889edef086aa64bfe1c38e6f3cb853450c8284d175ef8854f32e9bc67415a692048ead26cf31c35645f9e0e5
diff --git a/app-text/mupdf/files/mupdf-1.17.0-cross-fixes.patch b/app-text/mupdf/files/mupdf-1.17.0-cross-fixes.patch
new file mode 100644
index 000000000000..ae14f9bb5e49
--- /dev/null
+++ b/app-text/mupdf/files/mupdf-1.17.0-cross-fixes.patch
@@ -0,0 +1,103 @@
+Refreshed patches based on:
+https://sources.debian.org/patches/mupdf/1.17.0+ds1-1/0004-MuPDF-crossbuild-use-target-arch-pkg-config.patch/
+https://sources.debian.org/patches/mupdf/1.17.0+ds1-1/0005-MuPDF-crossbuild-use-host-cc-for-utils.patch/
+--- a/Makefile
++++ b/Makefile
+@@ -134,6 +134,9 @@ PKCS7_OBJ := $(PKCS7_SRC:%.c=$(OUT)/%.o)
+ 
+ HEXDUMP_EXE := $(OUT)/scripts/hexdump.exe
+ 
++$(HEXDUMP_EXE): scripts/hexdump.c
++	$(QUIET_CC) $(MKTGTDIR) ; $(CC_FOR_BUILD) $(CFLAGS) -o $@ $<
++
+ FONT_BIN := $(sort $(wildcard resources/fonts/urw/*.cff))
+ FONT_BIN += $(sort $(wildcard resources/fonts/han/*.ttc))
+ FONT_BIN += $(sort $(wildcard resources/fonts/droid/*.ttf))
+--- a/Makerules
++++ b/Makerules
+@@ -15,6 +15,9 @@ OS := $(OS:MSYS%=MINGW)
+ OS := $(OS:Windows_NT=MINGW)
+ OS := $(OS:Darwin=MACOS)
+ 
++PKG_CONFIG ?= pkg-config
++CC_FOR_BUILD ?= $(CC)
++
+ ifeq ($(findstring -fembed-bitcode,$(XCFLAGS)),)
+   # clang does not support these in combination with -fembed-bitcode
+   CFLAGS += -ffunction-sections -fdata-sections
+@@ -101,35 +104,35 @@ else ifeq ($(OS),MACOS)
+ else ifeq ($(OS),Linux)
+   HAVE_OBJCOPY := yes
+ 
+-  ifeq ($(shell pkg-config --exists freetype2 && echo yes),yes)
+-	SYS_FREETYPE_CFLAGS := $(shell pkg-config --cflags freetype2)
+-	SYS_FREETYPE_LIBS := $(shell pkg-config --libs freetype2)
++  ifeq ($(shell $(PKG_CONFIG) --exists freetype2 && echo yes),yes)
++	SYS_FREETYPE_CFLAGS := $(shell $(PKG_CONFIG) --cflags freetype2)
++	SYS_FREETYPE_LIBS := $(shell $(PKG_CONFIG) --libs freetype2)
+   endif
+-  ifeq ($(shell pkg-config --exists harfbuzz && echo yes),yes)
+-	SYS_HARFBUZZ_CFLAGS := $(shell pkg-config --cflags harfbuzz)
+-	SYS_HARFBUZZ_LIBS := $(shell pkg-config --libs harfbuzz)
++  ifeq ($(shell $(PKG_CONFIG) --exists harfbuzz && echo yes),yes)
++	SYS_HARFBUZZ_CFLAGS := $(shell $(PKG_CONFIG) --cflags harfbuzz)
++	SYS_HARFBUZZ_LIBS := $(shell $(PKG_CONFIG) --libs harfbuzz)
+   endif
+-  ifeq ($(shell pkg-config --exists lcms2 && echo yes),yes)
+-	SYS_LCMS2_CFLAGS := $(shell pkg-config --cflags lcms2)
+-	SYS_LCMS2_LIBS := $(shell pkg-config --libs lcms2)
++  ifeq ($(shell $(PKG_CONFIG) --exists lcms2 && echo yes),yes)
++	SYS_LCMS2_CFLAGS := $(shell $(PKG_CONFIG) --cflags lcms2)
++	SYS_LCMS2_LIBS := $(shell $(PKG_CONFIG) --libs lcms2)
+   endif
+-  ifeq ($(shell pkg-config --exists libjpeg && echo yes),yes)
+-	SYS_LIBJPEG_CFLAGS := $(shell pkg-config --cflags libjpeg)
+-	SYS_LIBJPEG_LIBS := $(shell pkg-config --libs libjpeg)
++  ifeq ($(shell $(PKG_CONFIG) --exists libjpeg && echo yes),yes)
++	SYS_LIBJPEG_CFLAGS := $(shell $(PKG_CONFIG) --cflags libjpeg)
++	SYS_LIBJPEG_LIBS := $(shell $(PKG_CONFIG) --libs libjpeg)
+   endif
+-  ifeq ($(shell pkg-config --exists libopenjp2 && echo yes),yes)
+-	SYS_OPENJPEG_CFLAGS := $(shell pkg-config --cflags libopenjp2)
+-	SYS_OPENJPEG_LIBS := $(shell pkg-config --libs libopenjp2)
++  ifeq ($(shell $(PKG_CONFIG) --exists libopenjp2 && echo yes),yes)
++	SYS_OPENJPEG_CFLAGS := $(shell $(PKG_CONFIG) --cflags libopenjp2)
++	SYS_OPENJPEG_LIBS := $(shell $(PKG_CONFIG) --libs libopenjp2)
+   endif
+-  ifeq ($(shell pkg-config --exists zlib && echo yes),yes)
+-	SYS_ZLIB_CFLAGS := $(shell pkg-config --cflags zlib)
+-	SYS_ZLIB_LIBS := $(shell pkg-config --libs zlib)
++  ifeq ($(shell $(PKG_CONFIG) --exists zlib && echo yes),yes)
++	SYS_ZLIB_CFLAGS := $(shell $(PKG_CONFIG) --cflags zlib)
++	SYS_ZLIB_LIBS := $(shell $(PKG_CONFIG) --libs zlib)
+   endif
+ 
+-  HAVE_SYS_CURL := $(shell pkg-config --exists libcurl && echo yes)
++  HAVE_SYS_CURL := $(shell $(PKG_CONFIG) --exists libcurl && echo yes)
+   ifeq ($(HAVE_SYS_CURL),yes)
+-	SYS_CURL_CFLAGS := $(shell pkg-config --cflags libcurl)
+-	SYS_CURL_LIBS := $(shell pkg-config --libs libcurl)
++	SYS_CURL_CFLAGS := $(shell $(PKG_CONFIG) --cflags libcurl)
++	SYS_CURL_LIBS := $(shell $(PKG_CONFIG) --libs libcurl)
+   endif
+ 
+   HAVE_GLUT := yes
+@@ -140,14 +143,14 @@ else ifeq ($(OS),Linux)
+ 
+   HAVE_X11 := not-unless-portage-tells-me
+   ifeq ($(HAVE_X11),yes)
+-	X11_CFLAGS := $(shell pkg-config --cflags x11 xext)
+-	X11_LIBS := $(shell pkg-config --libs x11 xext)
++	X11_CFLAGS := $(shell $(PKG_CONFIG) --cflags x11 xext)
++	X11_LIBS := $(shell $(PKG_CONFIG) --libs x11 xext)
+   endif
+ 
+   HAVE_LIBCRYPTO := not-unless-portage-tells-me
+   ifeq ($(HAVE_LIBCRYPTO),yes)
+-	LIBCRYPTO_CFLAGS := $(shell pkg-config --cflags libcrypto) -DHAVE_LIBCRYPTO
+-	LIBCRYPTO_LIBS := $(shell pkg-config --libs libcrypto)
++	LIBCRYPTO_CFLAGS := $(shell $(PKG_CONFIG) --cflags libcrypto) -DHAVE_LIBCRYPTO
++	LIBCRYPTO_LIBS := $(shell $(PKG_CONFIG) --libs libcrypto)
+   endif
+ 
+   HAVE_PTHREAD := yes
diff --git a/app-text/mupdf/mupdf-1.17.0.ebuild b/app-text/mupdf/mupdf-1.17.0.ebuild
new file mode 100644
index 000000000000..61f7125c382c
--- /dev/null
+++ b/app-text/mupdf/mupdf-1.17.0.ebuild
@@ -0,0 +1,153 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit desktop flag-o-matic toolchain-funcs xdg
+
+DESCRIPTION="a lightweight PDF viewer and toolkit written in portable C"
+HOMEPAGE="https://mupdf.com/"
+SRC_URI="https://mupdf.com/downloads/archive/${P}-source.tar.xz"
+S="${WORKDIR}/${P}-source"
+
+LICENSE="AGPL-3"
+SLOT="0/${PV}"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~ppc ~ppc64 ~s390 ~x86 ~amd64-linux ~ppc-macos ~x64-macos ~x86-macos"
+IUSE="X +javascript libressl opengl ssl static-libs"
+
+# Although we use the bundled, patched version of freeglut in mupdf (because of
+# bug #653298), the best way to ensure that its dependencies are present is to
+# install system's freeglut.
+BDEPEND="virtual/pkgconfig"
+RDEPEND="
+	>=dev-lang/mujs-1.0.7:=[static-libs?]
+	media-libs/freetype:2=[static-libs?]
+	media-libs/harfbuzz:=[static-libs?,truetype]
+	media-libs/jbig2dec:=[static-libs?]
+	media-libs/libpng:0=[static-libs?]
+	>=media-libs/openjpeg-2.1:2=[static-libs?]
+	virtual/jpeg[static-libs?]
+	opengl? ( >=media-libs/freeglut-3.0.0:= )
+	ssl? (
+		libressl? ( >=dev-libs/libressl-2.8:0=[static-libs?] )
+		!libressl? ( >=dev-libs/openssl-1.1:0=[static-libs?] )
+	)
+	X? (
+		x11-libs/libX11[static-libs?]
+		x11-libs/libXext[static-libs?]
+	)"
+DEPEND="${RDEPEND}"
+
+REQUIRED_USE="opengl? ( !static-libs )"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-1.15-CFLAGS.patch
+	"${FILESDIR}"/${PN}-1.15-Makefile.patch
+	"${FILESDIR}"/${PN}-1.10a-add-desktop-pc-xpm-files.patch
+	# See bugs #662352
+	"${FILESDIR}"/${PN}-1.15-openssl-x11.patch
+	"${FILESDIR}"/${PN}-1.16.1-freeglut-fg_gl2-gcc-10.patch
+	# General cross fixes from Debian (refreshed)
+	"${FILESDIR}"/${PN}-1.17.0-cross-fixes.patch
+)
+
+src_prepare() {
+	xdg_src_prepare
+
+	use hppa && append-cflags -ffunction-sections
+
+	use javascript || \
+		sed -e '/* #define FZ_ENABLE_JS/ a\#define FZ_ENABLE_JS 0' \
+			-i include/mupdf/fitz/config.h || die
+
+	# See bug #670832
+	use ssl && use libressl && eapply "${FILESDIR}"/${PN}-1.14-libressl.patch
+
+	sed -e "1iOS = Linux" \
+		-e "1iCC = $(tc-getCC)" \
+		-e "1iLD = $(tc-getLD)" \
+		-e "1iAR = $(tc-getAR)" \
+		-e "1iverbose = yes" \
+		-e "1ibuild = debug" \
+		-e "1iprefix = ${ED}/usr" \
+		-e "1ilibdir = ${ED}/usr/$(get_libdir)" \
+		-e "1idocdir = ${ED}/usr/share/doc/${PF}" \
+		-i Makerules || die
+}
+
+_emake() {
+	# When HAVE_OBJCOPY is yes, we end up with a lot of QA warnings.
+
+	# Bundled libs
+	# * General
+	# Note that USE_SYSTEM_LIBS=yes is a metaoption which will set to upstream's
+	# recommendations. It does not mean "always use system libs".
+	# See [0] below for what it means in a specific version.
+	#
+	# * freeglut
+	# We don't use system's freeglut because upstream has a special modified
+	# version of it that gives mupdf clipboard support. See bug #653298
+	#
+	# * mujs
+	# As of v1.15.0, mupdf started using symbols in mujs that were not part
+	# of any release. We then went back to using the bundled version of it.
+	# But v1.17.0 looks ok, so we'll go unbundled again. Be aware of this risk
+	# when bumping and check!
+	# See bug #685244
+	#
+	# * lmms2
+	# mupdf uses a bundled version of lcms2 [0] because Artifex have forked it [1].
+	# It is therefore not appropriate for us to unbundle it at this time.
+	#
+	# [0] https://git.ghostscript.com/?p=mupdf.git;a=blob;f=Makethird;h=c4c540fa4a075df0db85e6fdaab809099881f35a;hb=HEAD#l9
+	# [1] https://www.ghostscript.com/doc/lcms2mt/doc/WhyThisFork.txt
+
+	emake \
+		GENTOO_PV=${PV} \
+		HAVE_GLUT=$(usex opengl) \
+		HAVE_LIBCRYPTO=$(usex ssl) \
+		HAVE_X11=$(usex X) \
+		USE_SYSTEM_LIBS=yes \
+		USE_SYSTEM_MUJS=yes \
+		USE_SYSTEM_GLUT=no \
+		HAVE_OBJCOPY=no \
+		"$@"
+}
+
+src_compile() {
+	_emake XCFLAGS="-fpic"
+
+	use static-libs && \
+		_emake build/debug/lib${PN}.a
+}
+
+src_install() {
+	if use X || use opengl ; then
+		domenu platform/debian/${PN}.desktop
+		doicon platform/debian/${PN}.xpm
+	else
+		rm docs/man/${PN}.1 || die
+	fi
+
+	_emake install
+
+	dosym libmupdf.so.${PV} /usr/$(get_libdir)/lib${PN}.so
+
+	use static-libs && \
+		dolib.a build/debug/lib${PN}.a
+	if use opengl ; then
+		einfo "mupdf symlink points to mupdf-gl (bug 616654)"
+		dosym ${PN}-gl /usr/bin/${PN}
+	elif use X ; then
+		einfo "mupdf symlink points to mupdf-x11 (bug 616654)"
+		dosym ${PN}-x11 /usr/bin/${PN}
+	fi
+
+	# Respect libdir (bug #734898)
+	sed -i -e "s:/lib:/$(get_libdir):" platform/debian/${PN}.pc || die
+
+	insinto /usr/$(get_libdir)/pkgconfig
+	doins platform/debian/${PN}.pc
+
+	dodoc README CHANGES CONTRIBUTORS
+}