From 411382829af3189bc1a0de0fbf4ccace29d893e0 Mon Sep 17 00:00:00 2001
From: sergio <sergiovelasquezzeballos@gmail.com>
Date: Sat, 11 Jul 2026 00:34:41 -0400
Subject: [PATCH] =?UTF-8?q?base-system-3:=20gnupg=20construye=20=E2=80=94?=
 =?UTF-8?q?=20gpg=202.4.9=20(firma/cifrado),=20cierra=20la=20cadena=20cryp?=
 =?UTF-8?q?to?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

b3:f9de6d2a. deps = cadena canónica sellada (libgpg-error/libgcrypt/libassuan/libksba/npth/zlib).
Fase configure explícita --disable-{tofu,scdaemon,dirmngr,doc,bzip2} + --with-*-prefix=/usr. gpg+gpgv
estáticos; round-trip cifrado simétrico -c/-d + --print-md SHA512 verificados. Nota: NO apareció el
ubsan de libz.a (el zlib limpio de este mismo commit-set ya se materializa). base-system-3 completo.
---
 recipes/incoming-clib/gnupg.toml | 60 ++++++++++++++++++++++++++++++++
 1 file changed, 60 insertions(+)
 create mode 100644 recipes/incoming-clib/gnupg.toml

diff --git a/recipes/incoming-clib/gnupg.toml b/recipes/incoming-clib/gnupg.toml
new file mode 100644
index 00000000..af53f77f
--- /dev/null
+++ b/recipes/incoming-clib/gnupg.toml
@@ -0,0 +1,60 @@
+# gnupg 2.4.9 — GnuPG (gpg: firma/cifrado/verificación). De-Alpinizada (Etapa G).
+# Cadena crypto canónica sellada: libgpg-error, libgcrypt, libassuan, libksba, npth.
+# Objetivo mínimo: binario gpg (y gpgv) estático musl. scdaemon/dirmngr/tofu desactivados
+# (quitan deps de red/smartcard/sqlite); doc/nls/bzip2 fuera para no arrastrar deps ausentes.
+name    = "gnupg"
+version = "2.4.9"
+
+[source]
+tarball = "https://gnupg.org/ftp/gcrypt/gnupg/gnupg-2.4.9.tar.bz2"
+sha256  = "dd17ab2e9a04fd79d39d853f599cbc852062ddb9ab52a4ddeb4176fd8b302964"
+patches = ["0001-include-unistd.patch", "0010-avoid-beta-warning.patch", "0020-avoid-regenerating-defsincdate-use-shipped-file.patch", "0110-avoid-simple-memory-dumps-via-ptrace.patch", "0210-dirmngr-hkp-avoid-potential-race-condition-when-some-host-die.patch", "0230-dirmngr-avoid-automatically-checking-upstream-swdb.patch", "0330-gpg-default-to-sha512-for-all-signature-types-on-rsa-keys.patch", "0340-gpg-prefer-sha512-and-sha384-in-personal-digest.patch", "0420-gpg-drop-import-clean-from-default-keyserver-import-options.patch", "fix-i18n.patch", "HACK-revert-rfc4880bis-default.patch"]
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+configure = '''
+./configure \
+	--build=$CBUILD \
+	--host=$CHOST \
+	--prefix=/usr \
+	--sysconfdir=/etc \
+	--localstatedir=/var \
+	--enable-static \
+	--disable-shared \
+	--disable-nls \
+	--disable-tofu \
+	--disable-scdaemon \
+	--disable-dirmngr \
+	--disable-doc \
+	--disable-gpgtar \
+	--disable-wks-tools \
+	--disable-photo-viewers \
+	--without-readline \
+	--disable-bzip2 \
+	--with-libgpg-error-prefix=/usr \
+	--with-libgcrypt-prefix=/usr \
+	--with-libassuan-prefix=/usr \
+	--with-ksba-prefix=/usr \
+	--with-npth-prefix=/usr
+'''
+compile = 'make'
+install = '''
+make DESTDIR="/out" install
+
+cd "/out"
+
+# compat symlinks
+ln -s gpg  usr/bin/gpg2
+ln -s gpgv usr/bin/gpgv2
+
+# tool interno de tests
+rm -f usr/bin/gpgscm
+'''
+
+[deps]
+build = ["libgpg-error", "libgcrypt", "libassuan", "libksba", "npth", "zlib", "linux-headers", "pkgconf"]