Google's Certificate Transparency project is an open framework for monitoring

and auditing SSL certificates in nearly real time.  It makes it possible
to detect SSL certificates that have been mistakenly issued by a certificate
authority or maliciously acquired from an otherwise unimpeachable certificate
authority. It also makes it possible to identify certificate authorities
that have gone rogue and are maliciously issuing certificates.

WWW: https://www.certificate-transparency.org/

Sponsored by:	The FreeBSD Foundation

22 files changed, 343 insertions, 0 deletions

diff --git a/security/certificate-transparency/files/patch-Makefile.am b/security/certificate-transparency/files/patch-Makefile.am
new file mode 100644
index 000000000000..2ed94722fb77
--- /dev/null
+++ b/security/certificate-transparency/files/patch-Makefile.am
@@ -0,0 +1,30 @@
+--- Makefile.am.orig	2015-10-24 17:22:55.332874000 +0200
++++ Makefile.am	2015-10-24 17:22:58.002519000 +0200
+@@ -9,8 +9,6 @@ AM_CXXFLAGS = \
+ 	-fno-exceptions
+ 
+ BUILT_SOURCES = \
+-	cpp/gmock-all.cc \
+-	cpp/gtest-all.cc \
+ 	cpp/monitoring/prometheus/metrics.pb.cc \
+ 	cpp/monitoring/prometheus/metrics.pb.h \
+ 	proto/ct.pb.cc \
+@@ -115,9 +113,6 @@ endif
+ cpp/gtest-all.cc: $(GTEST_DIR)/src/gtest-all.cc
+ 	$(AM_V_at)cp $^ $@
+ 
+-cpp/gmock-all.cc: $(GMOCK_DIR)/src/gmock-all.cc
+-	$(AM_V_at)cp $^ $@
+-
+ test/testdata/urlfetcher_test_certs/localhost-key.pem: test/create_url_fetcher_test_certs.sh
+ 	$(AM_V_GEN)test/create_url_fetcher_test_certs.sh
+ 
+@@ -186,8 +181,6 @@ cpp_libtest_a_CPPFLAGS = \
+ 	-I$(GTEST_DIR) \
+ 	$(AM_CPPFLAGS)
+ cpp_libtest_a_SOURCES = \
+-	cpp/gmock-all.cc \
+-	cpp/gtest-all.cc \
+ 	cpp/util/testing.cc
+ 
+ cpp_server_ct_mirror_LDADD = \
diff --git a/security/certificate-transparency/files/patch-configure.ac b/security/certificate-transparency/files/patch-configure.ac
new file mode 100644
index 000000000000..45c7155df5d1
--- /dev/null
+++ b/security/certificate-transparency/files/patch-configure.ac
@@ -0,0 +1,31 @@
+--- configure.ac.orig	2015-10-23 16:31:08.000000000 +0200
++++ configure.ac	2015-11-23 19:43:54.895959000 +0100
+@@ -83,9 +83,7 @@ AC_CHECK_HEADER([gtest/gtest.h],, [missi
+ AS_VAR_APPEND([CPPFLAGS], [" -I$GMOCK_DIR/include"])
+ AC_CHECK_HEADER([gmock/gmock.h],, [missing_gmock=1])
+ AS_VAR_APPEND([CPPFLAGS], [" -I$GTEST_DIR"])
+-AC_CHECK_HEADER([$GTEST_DIR/src/gtest-all.cc],, [missing_gtest=1])
+ AS_VAR_APPEND([CPPFLAGS], [" -I$GMOCK_DIR"])
+-AC_CHECK_HEADER([$GMOCK_DIR/src/gmock-all.cc],, [missing_gmock=1])
+ CPPFLAGS="$saved_CPPFLAGS"
+ AS_IF([test -n "$missing_gtest"],
+       [AC_MSG_ERROR([could not find a working Google Test])])
+@@ -105,7 +103,7 @@ AC_SEARCH_LIBS([clock_gettime], [rt],,, 
+ 
+ AC_MSG_CHECKING([checking for gflags library])
+ LIBS="-lgflags $LIBS"
+-AC_LINK_IFELSE([AC_LANG_PROGRAM([#include <gflags/gflags.h>], [google::ParseCommandLineFlags(NULL, NULL, true)])], [have_gflags=yes], [have_gflags=no])
++AC_LINK_IFELSE([AC_LANG_PROGRAM([#include <gflags/gflags.h>], [gflags::ParseCommandLineFlags(NULL, NULL, true)])], [have_gflags=yes], [have_gflags=no])
+ AC_MSG_RESULT([$have_gflags])
+ AS_IF([test "x$have_gflags" = "xno"],
+       [AC_MSG_ERROR([gflags library could not be found])])
+@@ -117,6 +115,9 @@ AC_MSG_RESULT([$have_glog])
+ AS_IF([test "x$have_glog" = "xno"],
+       [AC_MSG_ERROR([glog library could not be found])])
+ 
++# Required for "make check" to build.
++LIBS="$LIBS -lgtest -lgmock"
++
+ save_LIBS="$LIBS"
+ AS_UNSET([LIBS])
+ AC_SEARCH_LIBS([snappy_compress], [snappy],,, [$save_LIBS])
diff --git a/security/certificate-transparency/files/patch-cpp-client-ct.cc b/security/certificate-transparency/files/patch-cpp-client-ct.cc
new file mode 100644
index 000000000000..6621e0ecb9a9
--- /dev/null
+++ b/security/certificate-transparency/files/patch-cpp-client-ct.cc
@@ -0,0 +1,48 @@
+--- cpp/client/ct.cc.orig	2015-10-24 17:45:59.877372000 +0200
++++ cpp/client/ct.cc	2015-10-24 17:47:35.728512000 +0200
+@@ -458,8 +458,8 @@ static void MakeCert() {
+ // (This means the relevant section should be last in the configuration.)
+ // 1.2.3.1=DER:[raw encoding of proof]
+ static void WriteProofToConfig() {
+-  CHECK(!FLAGS_sct_token.empty()) << google::ProgramUsage();
+-  CHECK(!FLAGS_extensions_config_out.empty()) << google::ProgramUsage();
++  CHECK(!FLAGS_sct_token.empty()) << gflags::ProgramUsage();
++  CHECK(!FLAGS_extensions_config_out.empty()) << gflags::ProgramUsage();
+ 
+   string sct;
+ 
+@@ -486,8 +486,8 @@ static const char kPEMLabel[] = "SERVERI
+ // Wrap the proof in the format expected by the TLS extension,
+ // so that we can feed it to OpenSSL.
+ static void ProofToExtensionData() {
+-  CHECK(!FLAGS_sct_token.empty()) << google::ProgramUsage();
+-  CHECK(!FLAGS_tls_extension_data_out.empty()) << google::ProgramUsage();
++  CHECK(!FLAGS_sct_token.empty()) << gflags::ProgramUsage();
++  CHECK(!FLAGS_tls_extension_data_out.empty()) << gflags::ProgramUsage();
+ 
+   string serialized_sct;
+   PCHECK(util::ReadBinaryFile(FLAGS_sct_token, &serialized_sct))
+@@ -986,12 +986,12 @@ int Monitor() {
+ // Exit code upon abnormal exit (CHECK failures): != 0
+ // (on UNIX, 134 is expected)
+ int main(int argc, char** argv) {
+-  google::SetUsageMessage(argv[0] + string(kUsage));
++  gflags::SetUsageMessage(argv[0] + string(kUsage));
+   util::InitCT(&argc, &argv);
+ 
+   const string main_command(argv[0]);
+   if (argc < 2) {
+-    std::cout << google::ProgramUsage();
++    std::cout << gflags::ProgramUsage();
+     return 1;
+   }
+ 
+@@ -1031,7 +1031,7 @@ int main(int argc, char** argv) {
+   } else if (cmd == "sth") {
+     ret = GetSTH();
+   } else {
+-    std::cout << google::ProgramUsage();
++    std::cout << gflags::ProgramUsage();
+     ret = 1;
+   }
+ 
diff --git a/security/certificate-transparency/files/patch-cpp-fetcher-remote_peer_test.cc b/security/certificate-transparency/files/patch-cpp-fetcher-remote_peer_test.cc
new file mode 100644
index 000000000000..9280c3fc5817
--- /dev/null
+++ b/security/certificate-transparency/files/patch-cpp-fetcher-remote_peer_test.cc
@@ -0,0 +1,11 @@
+--- cpp/fetcher/remote_peer_test.cc.orig	2015-11-20 15:20:24.460754000 +0100
++++ cpp/fetcher/remote_peer_test.cc	2015-11-20 15:22:18.618590000 +0100
+@@ -1,5 +1,8 @@
+ #include <gflags/gflags.h>
+ #include <glog/logging.h>
++// Without this, build will fail due to clash between onigposix.h
++// and regex.h; note it's only compiled with "make check".
++#define GTEST_HAS_POSIX_RE 0
+ #include <gmock/gmock.h>
+ #include <gtest/gtest.h>
+ #include "log/etcd_consistent_store.h"
diff --git a/security/certificate-transparency/files/patch-cpp-log-cluster_state_controller_test.cc b/security/certificate-transparency/files/patch-cpp-log-cluster_state_controller_test.cc
new file mode 100644
index 000000000000..ad17dadd00da
--- /dev/null
+++ b/security/certificate-transparency/files/patch-cpp-log-cluster_state_controller_test.cc
@@ -0,0 +1,9 @@
+--- cpp/log/cluster_state_controller_test.cc.orig	2015-11-20 15:24:59.021489000 +0100
++++ cpp/log/cluster_state_controller_test.cc	2015-11-20 15:25:23.094886000 +0100
+@@ -1,3 +1,6 @@
++// Without this, build will fail due to clash between onigposix.h
++// and regex.h; note it's only compiled with "make check".
++#define GTEST_HAS_POSIX_RE 0
+ #include <gtest/gtest.h>
+ #include <map>
+ #include <memory>
diff --git a/security/certificate-transparency/files/patch-cpp-log-etcd_consistent_store_test.cc b/security/certificate-transparency/files/patch-cpp-log-etcd_consistent_store_test.cc
new file mode 100644
index 000000000000..66a42331b4e5
--- /dev/null
+++ b/security/certificate-transparency/files/patch-cpp-log-etcd_consistent_store_test.cc
@@ -0,0 +1,12 @@
+--- cpp/log/etcd_consistent_store_test.cc.orig	2015-11-20 15:30:32.679028000 +0100
++++ cpp/log/etcd_consistent_store_test.cc	2015-11-20 15:30:49.997410000 +0100
+@@ -3,6 +3,9 @@
+ #include <atomic>
+ #include <functional>
+ #include <gflags/gflags.h>
++// Without this, build will fail due to clash between onigposix.h
++// and regex.h; note it's only compiled with "make check".
++#define GTEST_HAS_POSIX_RE 0
+ #include <gmock/gmock.h>
+ #include <gtest/gtest.h>
+ #include <map>
diff --git a/security/certificate-transparency/files/patch-cpp-log-frontend_signer_test.cc b/security/certificate-transparency/files/patch-cpp-log-frontend_signer_test.cc
new file mode 100644
index 000000000000..8ab658c96888
--- /dev/null
+++ b/security/certificate-transparency/files/patch-cpp-log-frontend_signer_test.cc
@@ -0,0 +1,11 @@
+--- cpp/log/frontend_signer_test.cc.orig	2015-11-20 15:32:59.815039000 +0100
++++ cpp/log/frontend_signer_test.cc	2015-11-20 15:33:30.684240000 +0100
+@@ -1,5 +1,8 @@
+ /* -*- indent-tabs-mode: nil -*- */
+ #include <glog/logging.h>
++// Without this, build will fail due to clash between onigposix.h
++// and regex.h; note it's only compiled with "make check".
++#define GTEST_HAS_POSIX_RE 0
+ #include <gmock/gmock.h>
+ #include <gtest/gtest.h>
+ #include <memory>
diff --git a/security/certificate-transparency/files/patch-cpp-log-frontend_test.cc b/security/certificate-transparency/files/patch-cpp-log-frontend_test.cc
new file mode 100644
index 000000000000..e0d6c4b8a9aa
--- /dev/null
+++ b/security/certificate-transparency/files/patch-cpp-log-frontend_test.cc
@@ -0,0 +1,11 @@
+--- cpp/log/frontend_test.cc.orig	2015-11-20 15:34:34.528539000 +0100
++++ cpp/log/frontend_test.cc	2015-11-20 15:34:47.368662000 +0100
+@@ -1,5 +1,8 @@
+ /* -*- indent-tabs-mode: nil -*- */
+ #include <glog/logging.h>
++// Without this, build will fail due to clash between onigposix.h
++// and regex.h; note it's only compiled with "make check".
++#define GTEST_HAS_POSIX_RE 0
+ #include <gmock/gmock.h>
+ #include <gtest/gtest.h>
+ #include <memory>
diff --git a/security/certificate-transparency/files/patch-cpp-log-log_lookup_test.cc b/security/certificate-transparency/files/patch-cpp-log-log_lookup_test.cc
new file mode 100644
index 000000000000..39ccca929b28
--- /dev/null
+++ b/security/certificate-transparency/files/patch-cpp-log-log_lookup_test.cc
@@ -0,0 +1,10 @@
+--- cpp/log/log_lookup_test.cc.orig	2015-11-20 15:36:32.679863000 +0100
++++ cpp/log/log_lookup_test.cc	2015-11-20 15:36:50.639269000 +0100
+@@ -1,4 +1,7 @@
+ /* -*- indent-tabs-mode: nil -*- */
++// Without this, build will fail due to clash between onigposix.h
++// and regex.h; note it's only compiled with "make check".
++#define GTEST_HAS_POSIX_RE 0
+ #include <gtest/gtest.h>
+ #include <memory>
+ #include <string>
diff --git a/security/certificate-transparency/files/patch-cpp-log-tree_signer_test.cc b/security/certificate-transparency/files/patch-cpp-log-tree_signer_test.cc
new file mode 100644
index 000000000000..60f426d62e32
--- /dev/null
+++ b/security/certificate-transparency/files/patch-cpp-log-tree_signer_test.cc
@@ -0,0 +1,10 @@
+--- cpp/log/tree_signer_test.cc.orig	2015-11-20 15:50:58.101424000 +0100
++++ cpp/log/tree_signer_test.cc	2015-11-20 15:51:15.216405000 +0100
+@@ -1,4 +1,7 @@
+ /* -*- indent-tabs-mode: nil -*- */
++// Without this, build will fail due to clash between onigposix.h
++// and regex.h; note it's only compiled with "make check".
++#define GTEST_HAS_POSIX_RE 0
+ #include <gtest/gtest.h>
+ #include <memory>
+ #include <stdint.h>
diff --git a/security/certificate-transparency/files/patch-cpp-net-url_fetcher_test.cc b/security/certificate-transparency/files/patch-cpp-net-url_fetcher_test.cc
new file mode 100644
index 000000000000..46bb352bd837
--- /dev/null
+++ b/security/certificate-transparency/files/patch-cpp-net-url_fetcher_test.cc
@@ -0,0 +1,12 @@
+--- cpp/net/url_fetcher_test.cc.orig	2015-11-20 15:17:37.750964000 +0100
++++ cpp/net/url_fetcher_test.cc	2015-11-20 15:18:12.043994000 +0100
+@@ -8,6 +8,9 @@
+ #include <fcntl.h>
+ #include <gflags/gflags.h>
+ #include <glog/logging.h>
++// Without this, build will fail due to clash between onigposix.h
++// and regex.h; note it's only compiled with "make check".
++#define GTEST_HAS_POSIX_RE 0
+ #include <gtest/gtest.h>
+ #ifdef HAVE_NETDB_H
+ #  include <netdb.h>
diff --git a/security/certificate-transparency/files/patch-cpp-server-ct-mirror.cc b/security/certificate-transparency/files/patch-cpp-server-ct-mirror.cc
new file mode 100644
index 000000000000..c42e1394e9f2
--- /dev/null
+++ b/security/certificate-transparency/files/patch-cpp-server-ct-mirror.cc
@@ -0,0 +1,11 @@
+--- cpp/server/ct-mirror.cc.orig	2015-10-24 17:49:55.279261000 +0200
++++ cpp/server/ct-mirror.cc	2015-10-24 17:50:05.284510000 +0200
+@@ -124,7 +124,7 @@ using cert_trans::Update;
+ using cert_trans::UrlFetcher;
+ using ct::ClusterNodeState;
+ using ct::SignedTreeHead;
+-using google::RegisterFlagValidator;
++using gflags::RegisterFlagValidator;
+ using std::bind;
+ using std::chrono::duration;
+ using std::chrono::duration_cast;
diff --git a/security/certificate-transparency/files/patch-cpp-server-ct-server.cc b/security/certificate-transparency/files/patch-cpp-server-ct-server.cc
new file mode 100644
index 000000000000..b93862c1844f
--- /dev/null
+++ b/security/certificate-transparency/files/patch-cpp-server-ct-server.cc
@@ -0,0 +1,11 @@
+--- cpp/server/ct-server.cc.orig	2015-10-24 17:48:38.840376000 +0200
++++ cpp/server/ct-server.cc	2015-10-24 17:49:03.684762000 +0200
+@@ -116,7 +116,7 @@ using cert_trans::Update;
+ using cert_trans::UrlFetcher;
+ using ct::ClusterNodeState;
+ using ct::SignedTreeHead;
+-using google::RegisterFlagValidator;
++using gflags::RegisterFlagValidator;
+ using std::bind;
+ using std::chrono::duration;
+ using std::chrono::duration_cast;
diff --git a/security/certificate-transparency/files/patch-cpp-tools-dump_sth.cc b/security/certificate-transparency/files/patch-cpp-tools-dump_sth.cc
new file mode 100644
index 000000000000..d4cc82fc5c8d
--- /dev/null
+++ b/security/certificate-transparency/files/patch-cpp-tools-dump_sth.cc
@@ -0,0 +1,17 @@
+--- cpp/tools/dump_sth.cc.orig	2015-10-27 10:35:13.973569000 +0100
++++ cpp/tools/dump_sth.cc	2015-10-27 10:35:44.745588000 +0100
+@@ -26,11 +26,11 @@ void DumpSth(const char *filename) {
+ 
+ 
+ int main(int argc, char *argv[]) {
+-  google::SetVersionString(cert_trans::kBuildVersion);
+-  google::ParseCommandLineFlags(&argc, &argv, true);
++  gflags::SetVersionString(cert_trans::kBuildVersion);
++  gflags::ParseCommandLineFlags(&argc, &argv, true);
+   google::InitGoogleLogging(argv[0]);
+ 
+-  LOG(INFO) << "Build version: " << google::VersionString();
++  LOG(INFO) << "Build version: " << gflags::VersionString();
+ 
+   for (int i = 1; i < argc; ++i)
+     DumpSth(argv[i]);
diff --git a/security/certificate-transparency/files/patch-cpp-util-bench_etcd.cc b/security/certificate-transparency/files/patch-cpp-util-bench_etcd.cc
new file mode 100644
index 000000000000..959fda5331d3
--- /dev/null
+++ b/security/certificate-transparency/files/patch-cpp-util-bench_etcd.cc
@@ -0,0 +1,11 @@
+--- cpp/util/bench_etcd.cc	2015-10-27 10:34:16.495831000 +0100
++++ cpp/util/bench_etcd.cc.orig	2015-10-27 10:33:58.482267000 +0100
+@@ -105,7 +105,7 @@ void test_etcd(int thread_num) {
+ 
+ 
+ int main(int argc, char* argv[]) {
+-  google::ParseCommandLineFlags(&argc, &argv, true);
++  gflags::ParseCommandLineFlags(&argc, &argv, true);
+   google::InitGoogleLogging(argv[0]);
+   evthread_use_pthreads();
+ 
diff --git a/security/certificate-transparency/files/patch-cpp-util-etcd_masterelection.cc b/security/certificate-transparency/files/patch-cpp-util-etcd_masterelection.cc
new file mode 100644
index 000000000000..19dfd913cc40
--- /dev/null
+++ b/security/certificate-transparency/files/patch-cpp-util-etcd_masterelection.cc
@@ -0,0 +1,11 @@
+--- cpp/util/etcd_masterelection.cc.orig	2015-10-27 10:32:35.670615000 +0100
++++ cpp/util/etcd_masterelection.cc	2015-10-27 10:33:16.624128000 +0100
+@@ -24,7 +24,7 @@ DEFINE_string(node_id, "", "unique node 
+ 
+ 
+ int main(int argc, char* argv[]) {
+-  google::ParseCommandLineFlags(&argc, &argv, true);
++  gflags::ParseCommandLineFlags(&argc, &argv, true);
+   google::InitGoogleLogging(argv[0]);
+   evthread_use_pthreads();
+   CHECK(!FLAGS_node_id.empty()) << "Must set --node_id";
diff --git a/security/certificate-transparency/files/patch-cpp-util-etcd_test.cc b/security/certificate-transparency/files/patch-cpp-util-etcd_test.cc
new file mode 100644
index 000000000000..6d33d8ec3a09
--- /dev/null
+++ b/security/certificate-transparency/files/patch-cpp-util-etcd_test.cc
@@ -0,0 +1,9 @@
+--- cpp/util/etcd_test.cc.orig	2015-11-20 15:52:11.557932000 +0100
++++ cpp/util/etcd_test.cc	2015-11-20 15:52:28.585505000 +0100
+@@ -1,3 +1,6 @@
++// Without this, build will fail due to clash between onigposix.h
++// and regex.h; note it's only compiled with "make check".
++#define GTEST_HAS_POSIX_RE 0
+ #include <gmock/gmock.h>
+ #include <gtest/gtest.h>
+ #include <list>
diff --git a/security/certificate-transparency/files/patch-cpp-util-fake_etcd_test.cc b/security/certificate-transparency/files/patch-cpp-util-fake_etcd_test.cc
new file mode 100644
index 000000000000..f451deee8675
--- /dev/null
+++ b/security/certificate-transparency/files/patch-cpp-util-fake_etcd_test.cc
@@ -0,0 +1,12 @@
+--- cpp/util/fake_etcd_test.cc.orig	2015-11-20 15:53:01.290954000 +0100
++++ cpp/util/fake_etcd_test.cc	2015-11-20 15:53:17.991665000 +0100
+@@ -4,6 +4,9 @@
+ #include <functional>
+ #include <gflags/gflags.h>
+ #include <glog/logging.h>
++// Without this, build will fail due to clash between onigposix.h
++// and regex.h; note it's only compiled with "make check".
++#define GTEST_HAS_POSIX_RE 0
+ #include <gmock/gmock.h>
+ #include <gtest/gtest.h>
+ #include <memory>
diff --git a/security/certificate-transparency/files/patch-cpp-util-init.cc b/security/certificate-transparency/files/patch-cpp-util-init.cc
new file mode 100644
index 000000000000..8a9a3237cecc
--- /dev/null
+++ b/security/certificate-transparency/files/patch-cpp-util-init.cc
@@ -0,0 +1,22 @@
+--- cpp/util/init.cc.orig	2015-10-24 17:36:31.678280000 +0200
++++ cpp/util/init.cc	2015-10-24 17:37:42.378343000 +0200
+@@ -48,8 +48,8 @@ void LibEventLog(int severity, const cha
+ 
+ 
+ void InitCT(int* argc, char** argv[]) {
+-  google::SetVersionString(cert_trans::kBuildVersion);
+-  google::ParseCommandLineFlags(argc, argv, true);
++  gflags::SetVersionString(cert_trans::kBuildVersion);
++  gflags::ParseCommandLineFlags(argc, argv, true);
+   google::InitGoogleLogging(*argv[0]);
+   google::InstallFailureSignalHandler();
+ 
+@@ -67,7 +67,7 @@ void InitCT(int* argc, char** argv[]) {
+ 
+   cert_trans::LoadCtExtensions();
+ 
+-  LOG(INFO) << "Build version: " << google::VersionString();
++  LOG(INFO) << "Build version: " << gflags::VersionString();
+ #ifdef ENABLE_HARDENING
+   LOG(INFO) << "Binary built with hardening enabled.";
+ #else
diff --git a/security/certificate-transparency/files/patch-cpp-util-libevent_wrapper_test.cc b/security/certificate-transparency/files/patch-cpp-util-libevent_wrapper_test.cc
new file mode 100644
index 000000000000..2ec750e1d0d0
--- /dev/null
+++ b/security/certificate-transparency/files/patch-cpp-util-libevent_wrapper_test.cc
@@ -0,0 +1,11 @@
+--- cpp/util/libevent_wrapper_test.cc.orig	2015-11-20 15:53:58.271952000 +0100
++++ cpp/util/libevent_wrapper_test.cc	2015-11-20 15:54:14.240116000 +0100
+@@ -1,5 +1,8 @@
+ #include "util/libevent_wrapper.h"
+ 
++// Without this, build will fail due to clash between onigposix.h
++// and regex.h; note it's only compiled with "make check".
++#define GTEST_HAS_POSIX_RE 0
+ #include <gtest/gtest.h>
+ 
+ #include "util/testing.h"
diff --git a/security/certificate-transparency/files/patch-cpp-util-masterelection_test.cc b/security/certificate-transparency/files/patch-cpp-util-masterelection_test.cc
new file mode 100644
index 000000000000..ce1e48899ac5
--- /dev/null
+++ b/security/certificate-transparency/files/patch-cpp-util-masterelection_test.cc
@@ -0,0 +1,12 @@
+--- cpp/util/masterelection_test.cc.orig	2015-11-20 15:54:47.351564000 +0100
++++ cpp/util/masterelection_test.cc	2015-11-20 15:55:09.284855000 +0100
+@@ -6,6 +6,9 @@
+ #include <string>
+ #include <gflags/gflags.h>
+ #include <glog/logging.h>
++// Without this, build will fail due to clash between onigposix.h
++// and regex.h; note it's only compiled with "make check".
++#define GTEST_HAS_POSIX_RE 0
+ #include <gmock/gmock.h>
+ #include <gtest/gtest.h>
+ 
diff --git a/security/certificate-transparency/files/patch-cpp-util-testing.cc b/security/certificate-transparency/files/patch-cpp-util-testing.cc
new file mode 100644
index 000000000000..1dfb9a9bdf3c
--- /dev/null
+++ b/security/certificate-transparency/files/patch-cpp-util-testing.cc
@@ -0,0 +1,21 @@
+--- cpp/util/testing.cc.orig	2015-10-23 16:31:08.000000000 +0200
++++ cpp/util/testing.cc	2015-10-30 10:54:40.169083000 +0100
+@@ -3,6 +3,9 @@
+ #include <event2/thread.h>
+ #include <evhtp.h>
+ #include <glog/logging.h>
++// Without this, build will fail due to clash between onigposix.h
++// and regex.h.
++#define GTEST_HAS_POSIX_RE 0
+ #include <gtest/gtest.h>
+ 
+ #include "config.h"
+@@ -15,7 +18,7 @@ namespace test {
+ void InitTesting(const char* name, int* argc, char*** argv,
+                  bool remove_flags) {
+   ::testing::InitGoogleTest(argc, *argv);
+-  google::ParseCommandLineFlags(argc, argv, remove_flags);
++  gflags::ParseCommandLineFlags(argc, argv, remove_flags);
+   google::InitGoogleLogging(name);
+   google::InstallFailureSignalHandler();
+   evthread_use_pthreads();