From ee553811d0228acba2f94a89b7783ec8a45b5e63 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 16 Aug 2018 09:16:02 +0200 Subject: [PATCH 01/13] Further patches for TLS1.3 deployment --- gnutls-3.6.3-gnutls-cli-fix.patch | 12 ++++++ gnutls-3.6.3-rollback-fix.patch | 65 +++++++++++++++++++++++++++++++ gnutls.spec | 11 +++++- 3 files changed, 87 insertions(+), 1 deletion(-) create mode 100644 gnutls-3.6.3-gnutls-cli-fix.patch create mode 100644 gnutls-3.6.3-rollback-fix.patch diff --git a/gnutls-3.6.3-gnutls-cli-fix.patch b/gnutls-3.6.3-gnutls-cli-fix.patch new file mode 100644 index 0000000..fbad690 --- /dev/null +++ b/gnutls-3.6.3-gnutls-cli-fix.patch @@ -0,0 +1,12 @@ +diff --git a/src/cli.c b/src/cli.c +index 21be015dc..42d027736 100644 +--- a/src/cli.c ++++ b/src/cli.c +@@ -1273,7 +1273,6 @@ int main(int argc, char **argv) + } + continue; + } +- bytes=strlen(buffer); + buffer[bytes] = 0; + + if (crlf != 0) { diff --git a/gnutls-3.6.3-rollback-fix.patch b/gnutls-3.6.3-rollback-fix.patch new file mode 100644 index 0000000..925382f --- /dev/null +++ b/gnutls-3.6.3-rollback-fix.patch @@ -0,0 +1,65 @@ +diff --git a/lib/handshake.c b/lib/handshake.c +index ebea926aa..8dce170fe 100644 +--- a/lib/handshake.c ++++ b/lib/handshake.c +@@ -248,6 +248,7 @@ int _gnutls_set_server_random(gnutls_session_t session, const version_entry_st * + memcpy(session->security_parameters.server_random, rnd, + GNUTLS_RANDOM_SIZE); + ++#if 0 /* This was not supposed to be checked in draft-versions */ + /* check whether the server random value is set according to + * to TLS 1.3. p4.1.3 requirements */ + if (!IS_DTLS(session) && vers->id <= GNUTLS_TLS1_2 && have_creds_for_tls13(session)) { +@@ -272,6 +273,7 @@ int _gnutls_set_server_random(gnutls_session_t session, const version_entry_st * + return gnutls_assert_val(GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER); + } + } ++#endif + + return 0; + } +@@ -291,6 +293,7 @@ int _gnutls_gen_server_random(gnutls_session_t session, int version) + + max = _gnutls_version_max(session); + ++#if 0 + if (!IS_DTLS(session) && max->id >= GNUTLS_TLS1_3 && + version <= GNUTLS_TLS1_2) { + if (version == GNUTLS_TLS1_2) { +@@ -303,7 +306,9 @@ int _gnutls_gen_server_random(gnutls_session_t session, int version) + ret = + gnutls_rnd(GNUTLS_RND_NONCE, session->security_parameters.server_random, GNUTLS_RANDOM_SIZE-8); + +- } else { ++ } else ++#endif ++ { + ret = + gnutls_rnd(GNUTLS_RND_NONCE, session->security_parameters.server_random, GNUTLS_RANDOM_SIZE); + } +diff --git a/tests/tls13/rnd-check-rollback-val.c b/tests/tls13/rnd-check-rollback-val.c +index f573596c5..6934b2507 100644 +--- a/tests/tls13/rnd-check-rollback-val.c ++++ b/tests/tls13/rnd-check-rollback-val.c +@@ -222,6 +222,8 @@ void doit(void) + int ret; + pid_t child; + ++ exit(77); ++ + signal(SIGCHLD, ch_handler); + signal(SIGPIPE, SIG_IGN); + +diff --git a/tests/tls13/rnd-rollback-detection.c b/tests/tls13/rnd-rollback-detection.c +index 0d1ef0149..8cbb658cf 100644 +--- a/tests/tls13/rnd-rollback-detection.c ++++ b/tests/tls13/rnd-rollback-detection.c +@@ -206,6 +206,8 @@ void doit(void) + int ret; + pid_t child; + ++ exit(77); ++ + signal(SIGCHLD, ch_handler); + signal(SIGPIPE, SIG_IGN); + diff --git a/gnutls.spec b/gnutls.spec index efe9d5d..e916416 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -1,11 +1,13 @@ # This spec file has been automatically updated Version: 3.6.3 -Release: 3%{?dist} +Release: 4%{?dist} Patch1: gnutls-3.2.7-rpath.patch Patch2: gnutls-3.4.2-no-now-guile.patch Patch3: gnutls-3.6.3-skip-new-priority-funcs-err-pos.patch Patch4: gnutls-3.6.3-backport-upstream-fixes.patch Patch5: gnutls-3.6.3-fix-ecdsa.patch +Patch6: gnutls-3.6.3-gnutls-cli-fix.patch +Patch7: gnutls-3.6.3-rollback-fix.patch %bcond_without dane %if 0%{?rhel} %bcond_with guile @@ -156,6 +158,8 @@ gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0} %patch3 -p1 %patch4 -p1 %patch5 -p1 +%patch6 -p1 +%patch7 -p1 sed -i -e 's|sys_lib_dlsearch_path_spec="/lib /usr/lib|sys_lib_dlsearch_path_spec="/lib /usr/lib %{_libdir}|g' configure rm -f lib/minitasn1/*.c lib/minitasn1/*.h @@ -311,6 +315,11 @@ fi %endif %changelog +* Thu Aug 16 2018 Nikos Mavrogiannopoulos - 3.6.3-4 +- Fixed gnutls-cli input reading +- Ensure that we do not cause issues with version rollback detection + and TLS1.3. + * Tue Aug 07 2018 Nikos Mavrogiannopoulos - 3.6.3-3 - Fixed ECDSA public key import (#1612803) From 1ea92621b839c05fda52c5239a25863af753dfb2 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 25 Sep 2018 08:58:48 +0200 Subject: [PATCH 02/13] Updated to 3.6.4 --- .gitignore | 2 + gnutls-3.6.3-backport-upstream-fixes.patch | 55 ---------------- gnutls-3.6.3-fix-ecdsa.patch | 27 -------- gnutls-3.6.3-gnutls-cli-fix.patch | 12 ---- gnutls-3.6.3-rollback-fix.patch | 65 ------------------- ....6.3-skip-new-priority-funcs-err-pos.patch | 30 --------- ...e.patch => gnutls-3.6.4-no-now-guile.patch | 9 +-- gnutls.spec | 35 ++++------ sources | 5 +- 9 files changed, 23 insertions(+), 217 deletions(-) delete mode 100644 gnutls-3.6.3-backport-upstream-fixes.patch delete mode 100644 gnutls-3.6.3-fix-ecdsa.patch delete mode 100644 gnutls-3.6.3-gnutls-cli-fix.patch delete mode 100644 gnutls-3.6.3-rollback-fix.patch delete mode 100644 gnutls-3.6.3-skip-new-priority-funcs-err-pos.patch rename gnutls-3.4.2-no-now-guile.patch => gnutls-3.6.4-no-now-guile.patch (57%) diff --git a/.gitignore b/.gitignore index ea696a1..37c5305 100644 --- a/.gitignore +++ b/.gitignore @@ -98,3 +98,5 @@ gnutls-2.10.1-nosrp.tar.bz2 /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /gnutls-3.6.3.tar.xz.sig /gnutls-3.6.3.tar.xz +/gnutls-3.6.4.tar.xz +/gnutls-3.6.4.tar.xz.sig diff --git a/gnutls-3.6.3-backport-upstream-fixes.patch b/gnutls-3.6.3-backport-upstream-fixes.patch deleted file mode 100644 index a7aad33..0000000 --- a/gnutls-3.6.3-backport-upstream-fixes.patch +++ /dev/null @@ -1,55 +0,0 @@ -diff --git a/lib/cert-cred.c b/lib/cert-cred.c -index d3777e51f..2150e903f 100644 ---- a/lib/cert-cred.c -+++ b/lib/cert-cred.c -@@ -387,6 +387,13 @@ static int call_legacy_cert_cb1(gnutls_session_t session, - if (ret < 0) - return gnutls_assert_val(ret); - -+ if (st2.ncerts == 0) { -+ *pcert_length = 0; -+ *ocsp_length = 0; -+ *privkey = NULL; -+ return 0; -+ } -+ - if (st2.cert_type != GNUTLS_CRT_X509) { - gnutls_assert(); - ret = GNUTLS_E_INVALID_REQUEST; -@@ -503,7 +510,10 @@ void gnutls_certificate_set_retrieve_function - gnutls_certificate_retrieve_function * func) - { - cred->legacy_cert_cb1 = func; -- cred->get_cert_callback3 = call_legacy_cert_cb1; -+ if (!func) -+ cred->get_cert_callback3 = NULL; -+ else -+ cred->get_cert_callback3 = call_legacy_cert_cb1; - } - - static int call_legacy_cert_cb2(gnutls_session_t session, -@@ -578,7 +588,10 @@ void gnutls_certificate_set_retrieve_function2 - gnutls_certificate_retrieve_function2 * func) - { - cred->legacy_cert_cb2 = func; -- cred->get_cert_callback3 = call_legacy_cert_cb2; -+ if (!func) -+ cred->get_cert_callback3 = NULL; -+ else -+ cred->get_cert_callback3 = call_legacy_cert_cb2; - } - - /** -diff --git a/lib/hello_ext.c b/lib/hello_ext.c -index a3027130a..f72afe77f 100644 ---- a/lib/hello_ext.c -+++ b/lib/hello_ext.c -@@ -208,7 +208,7 @@ int hello_ext_parse(void *_ctx, unsigned tls_id, const uint8_t *data, unsigned d - - if (tls_id == PRE_SHARED_KEY_TLS_ID) { - ctx->seen_pre_shared_key = 1; -- } else if (ctx->seen_pre_shared_key) { -+ } else if (ctx->seen_pre_shared_key && session->security_parameters.entity == GNUTLS_SERVER) { - /* the pre-shared key extension must always be the last one, - * draft-ietf-tls-tls13-28: 4.2.11 */ - return gnutls_assert_val(GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER); diff --git a/gnutls-3.6.3-fix-ecdsa.patch b/gnutls-3.6.3-fix-ecdsa.patch deleted file mode 100644 index d34efa0..0000000 --- a/gnutls-3.6.3-fix-ecdsa.patch +++ /dev/null @@ -1,27 +0,0 @@ -diff --git a/lib/pubkey.c b/lib/pubkey.c -index 162ceaa4a..8fc42b95a 100644 ---- a/lib/pubkey.c -+++ b/lib/pubkey.c -@@ -1072,7 +1072,6 @@ gnutls_pubkey_import(gnutls_pubkey_t key, - int result = 0, need_free = 0; - gnutls_datum_t _data; - ASN1_TYPE spk; -- gnutls_ecc_curve_t curve; - - if (key == NULL) { - gnutls_assert(); -@@ -1119,14 +1118,7 @@ gnutls_pubkey_import(gnutls_pubkey_t key, - goto cleanup; - } - -- /* this has already been called by get_asn_mpis() thus it cannot -- * fail. -- */ -- key->params.algo = _gnutls_x509_get_pk_algorithm(spk, "", &curve, NULL); -- -- key->params.curve = curve; - key->bits = pubkey_to_bits(&key->params); -- - result = 0; - - cleanup: diff --git a/gnutls-3.6.3-gnutls-cli-fix.patch b/gnutls-3.6.3-gnutls-cli-fix.patch deleted file mode 100644 index fbad690..0000000 --- a/gnutls-3.6.3-gnutls-cli-fix.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff --git a/src/cli.c b/src/cli.c -index 21be015dc..42d027736 100644 ---- a/src/cli.c -+++ b/src/cli.c -@@ -1273,7 +1273,6 @@ int main(int argc, char **argv) - } - continue; - } -- bytes=strlen(buffer); - buffer[bytes] = 0; - - if (crlf != 0) { diff --git a/gnutls-3.6.3-rollback-fix.patch b/gnutls-3.6.3-rollback-fix.patch deleted file mode 100644 index 925382f..0000000 --- a/gnutls-3.6.3-rollback-fix.patch +++ /dev/null @@ -1,65 +0,0 @@ -diff --git a/lib/handshake.c b/lib/handshake.c -index ebea926aa..8dce170fe 100644 ---- a/lib/handshake.c -+++ b/lib/handshake.c -@@ -248,6 +248,7 @@ int _gnutls_set_server_random(gnutls_session_t session, const version_entry_st * - memcpy(session->security_parameters.server_random, rnd, - GNUTLS_RANDOM_SIZE); - -+#if 0 /* This was not supposed to be checked in draft-versions */ - /* check whether the server random value is set according to - * to TLS 1.3. p4.1.3 requirements */ - if (!IS_DTLS(session) && vers->id <= GNUTLS_TLS1_2 && have_creds_for_tls13(session)) { -@@ -272,6 +273,7 @@ int _gnutls_set_server_random(gnutls_session_t session, const version_entry_st * - return gnutls_assert_val(GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER); - } - } -+#endif - - return 0; - } -@@ -291,6 +293,7 @@ int _gnutls_gen_server_random(gnutls_session_t session, int version) - - max = _gnutls_version_max(session); - -+#if 0 - if (!IS_DTLS(session) && max->id >= GNUTLS_TLS1_3 && - version <= GNUTLS_TLS1_2) { - if (version == GNUTLS_TLS1_2) { -@@ -303,7 +306,9 @@ int _gnutls_gen_server_random(gnutls_session_t session, int version) - ret = - gnutls_rnd(GNUTLS_RND_NONCE, session->security_parameters.server_random, GNUTLS_RANDOM_SIZE-8); - -- } else { -+ } else -+#endif -+ { - ret = - gnutls_rnd(GNUTLS_RND_NONCE, session->security_parameters.server_random, GNUTLS_RANDOM_SIZE); - } -diff --git a/tests/tls13/rnd-check-rollback-val.c b/tests/tls13/rnd-check-rollback-val.c -index f573596c5..6934b2507 100644 ---- a/tests/tls13/rnd-check-rollback-val.c -+++ b/tests/tls13/rnd-check-rollback-val.c -@@ -222,6 +222,8 @@ void doit(void) - int ret; - pid_t child; - -+ exit(77); -+ - signal(SIGCHLD, ch_handler); - signal(SIGPIPE, SIG_IGN); - -diff --git a/tests/tls13/rnd-rollback-detection.c b/tests/tls13/rnd-rollback-detection.c -index 0d1ef0149..8cbb658cf 100644 ---- a/tests/tls13/rnd-rollback-detection.c -+++ b/tests/tls13/rnd-rollback-detection.c -@@ -206,6 +206,8 @@ void doit(void) - int ret; - pid_t child; - -+ exit(77); -+ - signal(SIGCHLD, ch_handler); - signal(SIGPIPE, SIG_IGN); - diff --git a/gnutls-3.6.3-skip-new-priority-funcs-err-pos.patch b/gnutls-3.6.3-skip-new-priority-funcs-err-pos.patch deleted file mode 100644 index 326999e..0000000 --- a/gnutls-3.6.3-skip-new-priority-funcs-err-pos.patch +++ /dev/null @@ -1,30 +0,0 @@ -diff --git a/tests/priority-init2.c b/tests/priority-init2.c -index 850a6d9..d6b7659 100644 ---- a/tests/priority-init2.c -+++ b/tests/priority-init2.c -@@ -91,8 +91,8 @@ static void start(struct test_st *test) - if (test->exp_err == ret) { - if (ep-test->add_prio != test->err_pos) { - fprintf(stderr, "diff: %d\n", (int)(ep-test->add_prio)); -- fail("error expected error on different position[%d]: %s\n", -- test->err_pos, test->add_prio); -+// fail("error expected error on different position[%d]: %s\n", -+// test->err_pos, test->add_prio); - } - goto cleanup; - } -diff --git a/tests/set-default-prio.c b/tests/set-default-prio.c -index 48e8bf1..16235f8 100644 ---- a/tests/set-default-prio.c -+++ b/tests/set-default-prio.c -@@ -90,8 +90,8 @@ static void start(struct test_st *test) - if (test->exp_err == ret) { - if (ep-test->add_prio != test->err_pos) { - fprintf(stderr, "diff: %d\n", (int)(ep-test->add_prio)); -- fail("error expected error on different position[%d]: %s\n", -- test->err_pos, test->add_prio); -+// fail("error expected error on different position[%d]: %s\n", -+// test->err_pos, test->add_prio); - } - goto cleanup; - } diff --git a/gnutls-3.4.2-no-now-guile.patch b/gnutls-3.6.4-no-now-guile.patch similarity index 57% rename from gnutls-3.4.2-no-now-guile.patch rename to gnutls-3.6.4-no-now-guile.patch index 35c7699..d4edff0 100644 --- a/gnutls-3.4.2-no-now-guile.patch +++ b/gnutls-3.6.4-no-now-guile.patch @@ -1,7 +1,8 @@ -diff -up gnutls-3.4.2/guile/src/Makefile.in.jx gnutls-3.4.2/guile/src/Makefile.in ---- gnutls-3.4.2/guile/src/Makefile.in.jx 2015-06-16 12:23:31.000000000 -0400 -+++ gnutls-3.4.2/guile/src/Makefile.in 2015-07-02 14:01:19.415060204 -0400 -@@ -1316,7 +1316,7 @@ guileextension_LTLIBRARIES = guile-gnutl +diff --git a/guile/src/Makefile.in b/guile/src/Makefile.in +index 3e4f547..6ffec0e 100644 +--- a/guile/src/Makefile.in ++++ b/guile/src/Makefile.in +@@ -1430,7 +1430,7 @@ guileextension_LTLIBRARIES = guile-gnutls-v-2.la # Use '-module' to build a "dlopenable module", in Libtool terms. # Use '-undefined' to placate Libtool on Windows; see # . diff --git a/gnutls.spec b/gnutls.spec index e916416..883217e 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -1,13 +1,8 @@ # This spec file has been automatically updated -Version: 3.6.3 -Release: 4%{?dist} +Version: 3.6.4 +Release: 1%{?dist} Patch1: gnutls-3.2.7-rpath.patch -Patch2: gnutls-3.4.2-no-now-guile.patch -Patch3: gnutls-3.6.3-skip-new-priority-funcs-err-pos.patch -Patch4: gnutls-3.6.3-backport-upstream-fixes.patch -Patch5: gnutls-3.6.3-fix-ecdsa.patch -Patch6: gnutls-3.6.3-gnutls-cli-fix.patch -Patch7: gnutls-3.6.3-rollback-fix.patch +Patch2: gnutls-3.6.4-no-now-guile.patch %bcond_without dane %if 0%{?rhel} %bcond_with guile @@ -152,14 +147,7 @@ This package contains Guile bindings for the library. %prep gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0} -%setup -q -%patch1 -p1 -%patch2 -p1 -%patch3 -p1 -%patch4 -p1 -%patch5 -p1 -%patch6 -p1 -%patch7 -p1 +%autosetup -p1 sed -i -e 's|sys_lib_dlsearch_path_spec="/lib /usr/lib|sys_lib_dlsearch_path_spec="/lib /usr/lib %{_libdir}|g' configure rm -f lib/minitasn1/*.c lib/minitasn1/*.h @@ -167,16 +155,15 @@ rm -f src/libopts/*.c src/libopts/*.h src/libopts/compat/*.c src/libopts/compat/ echo "SYSTEM=NORMAL" >> tests/system.prio +# Note that we explicitly enable SHA1, as SHA1 deprecation is handled +# via the crypto policies + %build %configure --with-libtasn1-prefix=%{_prefix} \ -%if (0%{?fedora} <= 28) - --enable-ssl3-support \ -%else - --enable-tls13-support \ -%endif %if %{with fips} --enable-fips140-mode \ %endif + --enable-sha1-support \ --disable-static \ --disable-openssl-compatibility \ --disable-non-suiteb-curves \ @@ -315,6 +302,12 @@ fi %endif %changelog +* Tue Sep 25 2018 Nikos Mavrogiannopoulos - 3.6.4-1 +- Updated to upstream 3.6.4 release +- Added support for the latest version of the TLS1.3 protocol +- Enabled SHA1 support as SHA1 deprecation is handled via the + fedora crypto policies. + * Thu Aug 16 2018 Nikos Mavrogiannopoulos - 3.6.3-4 - Fixed gnutls-cli input reading - Ensure that we do not cause issues with version rollback detection diff --git a/sources b/sources index 609b378..98c4199 100644 --- a/sources +++ b/sources @@ -1,3 +1,2 @@ -SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 3b1989dc6a64d1140f83a2af0773da2adb03c50d97b6da7357cf09525050651aafa21131f1e3180baa540a8af922119a256f5ff5bcd6602996a806e8e1816bad -SHA512 (gnutls-3.6.3.tar.xz.sig) = 5377352aa239a4458b0ac6aaada438dce0336b989c4f65949fec3e469531dfb2397bb36dbe69dbc6f479f6944999937ebb4a5cb40e806d0bd4062c5647aa397b -SHA512 (gnutls-3.6.3.tar.xz) = 6238502464d229a9777e3076f4c745d16deaada83c9da756ecdcd370947576e0446bda3a7f85d5a099b745bbf8c0134ebdf6632e4b26d61daf170792fb4f5abe +SHA512 (gnutls-3.6.4.tar.xz) = f39ac09b48ebf230653cbf82b29ded39a1403313067135495b23f428b35783f9ef073993157d1f284678abedd19e2cf1fd01af843001b88320ca17b346b219ab +SHA512 (gnutls-3.6.4.tar.xz.sig) = 3f96dd3bb6f12f677b3106e6d46e93e56c501b9c4072c94f45235c35b9242ba2bddc71a22736bafe2b6532bcc498dac30869861beb8d705345b1197d3526da0e From 5e68879751ff97a57049fa68946a406131cae776 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Tue, 9 Oct 2018 12:42:34 +0200 Subject: [PATCH 03/13] Rebuilt for unbound 1.8 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Petr Menšík --- gnutls.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/gnutls.spec b/gnutls.spec index 883217e..cb68588 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated Version: 3.6.4 -Release: 1%{?dist} +Release: 2%{?dist} Patch1: gnutls-3.2.7-rpath.patch Patch2: gnutls-3.6.4-no-now-guile.patch %bcond_without dane @@ -302,6 +302,9 @@ fi %endif %changelog +* Tue Oct 09 2018 Petr Menšík - 3.6.4-2 +- Rebuilt for unbound 1.8 + * Tue Sep 25 2018 Nikos Mavrogiannopoulos - 3.6.4-1 - Updated to upstream 3.6.4 release - Added support for the latest version of the TLS1.3 protocol From 5c74fb3003a3611018902de751973cff8accadd9 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Wed, 17 Oct 2018 14:58:03 +0200 Subject: [PATCH 04/13] Fix issue with rehandshake affecting glib-networking (#1634736) --- gnutls-3.6.4-fix-rehandshake.patch | 15 +++++++++++++++ gnutls.spec | 6 +++++- 2 files changed, 20 insertions(+), 1 deletion(-) create mode 100644 gnutls-3.6.4-fix-rehandshake.patch diff --git a/gnutls-3.6.4-fix-rehandshake.patch b/gnutls-3.6.4-fix-rehandshake.patch new file mode 100644 index 0000000..fceed70 --- /dev/null +++ b/gnutls-3.6.4-fix-rehandshake.patch @@ -0,0 +1,15 @@ +diff --git a/lib/priority.c b/lib/priority.c +index 53c0d55..e727fcf 100644 +--- a/lib/priority.c ++++ b/lib/priority.c +@@ -592,7 +592,9 @@ gnutls_priority_set(gnutls_session_t session, gnutls_priority_t priority) + /* set the current version to the first in the chain. + * This will be overridden later. + */ +- if (session->internals.priorities->protocol.algorithms > 0) { ++ if (session->internals.priorities->protocol.algorithms > 0 && ++ !session->internals.handshake_in_progress && ++ !session->internals.initial_negotiation_completed) { + if (_gnutls_set_current_version(session, + session->internals.priorities-> + protocol.priority[0]) < 0) { diff --git a/gnutls.spec b/gnutls.spec index cb68588..332f278 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -1,8 +1,9 @@ # This spec file has been automatically updated Version: 3.6.4 -Release: 2%{?dist} +Release: 3%{?dist} Patch1: gnutls-3.2.7-rpath.patch Patch2: gnutls-3.6.4-no-now-guile.patch +Patch3: gnutls-3.6.4-fix-rehandshake.patch %bcond_without dane %if 0%{?rhel} %bcond_with guile @@ -302,6 +303,9 @@ fi %endif %changelog +* Wed Oct 17 2018 Nikos Mavrogiannopoulos - 3.6.4-3 +- Fix issue with rehandshake affecting glib-networking (#1634736) + * Tue Oct 09 2018 Petr Menšík - 3.6.4-2 - Rebuilt for unbound 1.8 From 3e2c68044f7661c84ae4310103dd6698182c810f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 19 Oct 2018 16:02:01 +0200 Subject: [PATCH 05/13] Rebuild for unbound 1.8 again --- gnutls.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/gnutls.spec b/gnutls.spec index 332f278..a6c638b 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated Version: 3.6.4 -Release: 3%{?dist} +Release: 4%{?dist} Patch1: gnutls-3.2.7-rpath.patch Patch2: gnutls-3.6.4-no-now-guile.patch Patch3: gnutls-3.6.4-fix-rehandshake.patch @@ -303,6 +303,9 @@ fi %endif %changelog +* Fri Oct 19 2018 Petr Menšík - 3.6.4-4 +- Rebuild for unbound 1.8 again + * Wed Oct 17 2018 Nikos Mavrogiannopoulos - 3.6.4-3 - Fix issue with rehandshake affecting glib-networking (#1634736) From 5a1eece9463d4f07f83de7a1d3e98458cd95fc1f Mon Sep 17 00:00:00 2001 From: Anderson Toshiyuki Sasaki Date: Tue, 11 Dec 2018 18:34:21 +0100 Subject: [PATCH 06/13] Preparing for the new release - Removed unnecessary patch - Corrected release path - Removed ldconfig scriptlet, now done via. transfiletrigger in glibc - Added missing annobin notes for assembler sources --- gnutls-3.6.4-fix-rehandshake.patch | 15 --------------- gnutls.spec | 29 +++++------------------------ 2 files changed, 5 insertions(+), 39 deletions(-) delete mode 100644 gnutls-3.6.4-fix-rehandshake.patch diff --git a/gnutls-3.6.4-fix-rehandshake.patch b/gnutls-3.6.4-fix-rehandshake.patch deleted file mode 100644 index fceed70..0000000 --- a/gnutls-3.6.4-fix-rehandshake.patch +++ /dev/null @@ -1,15 +0,0 @@ -diff --git a/lib/priority.c b/lib/priority.c -index 53c0d55..e727fcf 100644 ---- a/lib/priority.c -+++ b/lib/priority.c -@@ -592,7 +592,9 @@ gnutls_priority_set(gnutls_session_t session, gnutls_priority_t priority) - /* set the current version to the first in the chain. - * This will be overridden later. - */ -- if (session->internals.priorities->protocol.algorithms > 0) { -+ if (session->internals.priorities->protocol.algorithms > 0 && -+ !session->internals.handshake_in_progress && -+ !session->internals.initial_negotiation_completed) { - if (_gnutls_set_current_version(session, - session->internals.priorities-> - protocol.priority[0]) < 0) { diff --git a/gnutls.spec b/gnutls.spec index a6c638b..69a37a9 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -1,9 +1,8 @@ # This spec file has been automatically updated Version: 3.6.4 -Release: 4%{?dist} +Release: 5%{?dist} Patch1: gnutls-3.2.7-rpath.patch Patch2: gnutls-3.6.4-no-now-guile.patch -Patch3: gnutls-3.6.4-fix-rehandshake.patch %bcond_without dane %if 0%{?rhel} %bcond_with guile @@ -46,8 +45,8 @@ BuildRequires: unbound-devel unbound-libs BuildRequires: guile-devel %endif URL: http://www.gnutls.org/ -Source0: ftp://ftp.gnutls.org/gcrypt/gnutls/%{name}-%{version}.tar.xz -Source1: ftp://ftp.gnutls.org/gcrypt/gnutls/%{name}-%{version}.tar.xz.sig +Source0: ftp://ftp.gnutls.org/gcrypt/gnutls/v3.6/%{name}-%{version}.tar.xz +Source1: ftp://ftp.gnutls.org/gcrypt/gnutls/v3.6/%{name}-%{version}.tar.xz.sig Source2: gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg # Wildcard bundling exception https://fedorahosted.org/fpc/ticket/174 @@ -160,6 +159,8 @@ echo "SYSTEM=NORMAL" >> tests/system.prio # via the crypto policies %build +CCASFLAGS="$CCASFLAGS -Wa,--generate-missing-build-notes=yes" +export CCASFLAGS %configure --with-libtasn1-prefix=%{_prefix} \ %if %{with fips} --enable-fips140-mode \ @@ -215,14 +216,6 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/pkgconfig/gnutls-dane.pc %check make check %{?_smp_mflags} -%post -p /sbin/ldconfig - -%postun -p /sbin/ldconfig - -%post c++ -p /sbin/ldconfig - -%postun c++ -p /sbin/ldconfig - %post devel if [ -f %{_infodir}/gnutls.info.gz ]; then /sbin/install-info %{_infodir}/gnutls.info.gz %{_infodir}/dir || : @@ -233,18 +226,6 @@ if [ $1 = 0 -a -f %{_infodir}/gnutls.info.gz ]; then /sbin/install-info --delete %{_infodir}/gnutls.info.gz %{_infodir}/dir || : fi -%if %{with dane} -%post dane -p /sbin/ldconfig - -%postun dane -p /sbin/ldconfig -%endif - -%if %{with guile} -%post guile -p /sbin/ldconfig - -%postun guile -p /sbin/ldconfig -%endif - %files -f gnutls.lang %defattr(-,root,root,-) %{_libdir}/libgnutls.so.30* From 51ac0e58983ab1a9b0578c43826a569882703adc Mon Sep 17 00:00:00 2001 From: Anderson Toshiyuki Sasaki Date: Wed, 12 Dec 2018 09:04:21 +0100 Subject: [PATCH 07/13] Update to 3.6.5-1 - Update to upstream 3.6.5 release --- .gitignore | 3 +++ gnutls.spec | 7 +++++-- sources | 5 +++-- 3 files changed, 11 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 37c5305..acc1519 100644 --- a/.gitignore +++ b/.gitignore @@ -100,3 +100,6 @@ gnutls-2.10.1-nosrp.tar.bz2 /gnutls-3.6.3.tar.xz /gnutls-3.6.4.tar.xz /gnutls-3.6.4.tar.xz.sig +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/gnutls-3.6.5.tar.xz.sig +/gnutls-3.6.5.tar.xz diff --git a/gnutls.spec b/gnutls.spec index 69a37a9..d3c2793 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated -Version: 3.6.4 -Release: 5%{?dist} +Version: 3.6.5 +Release: 1%{?dist} Patch1: gnutls-3.2.7-rpath.patch Patch2: gnutls-3.6.4-no-now-guile.patch %bcond_without dane @@ -284,6 +284,9 @@ fi %endif %changelog +* Wed Dec 12 2018 Anderson Toshiyuki Sasaki - 3.6.5-1 +- Update to upstream 3.6.5 release + * Fri Oct 19 2018 Petr Menšík - 3.6.4-4 - Rebuild for unbound 1.8 again diff --git a/sources b/sources index 98c4199..13911c8 100644 --- a/sources +++ b/sources @@ -1,2 +1,3 @@ -SHA512 (gnutls-3.6.4.tar.xz) = f39ac09b48ebf230653cbf82b29ded39a1403313067135495b23f428b35783f9ef073993157d1f284678abedd19e2cf1fd01af843001b88320ca17b346b219ab -SHA512 (gnutls-3.6.4.tar.xz.sig) = 3f96dd3bb6f12f677b3106e6d46e93e56c501b9c4072c94f45235c35b9242ba2bddc71a22736bafe2b6532bcc498dac30869861beb8d705345b1197d3526da0e +SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 3b1989dc6a64d1140f83a2af0773da2adb03c50d97b6da7357cf09525050651aafa21131f1e3180baa540a8af922119a256f5ff5bcd6602996a806e8e1816bad +SHA512 (gnutls-3.6.5.tar.xz.sig) = 91c51442dd661bf827e7547ab88c61fb4c6683d9f90f3df7e6bab3f1b7218b69126702cfbe12d26647b477bda0746e2cfd6e5a3c10899860a42314a8a8ac15d5 +SHA512 (gnutls-3.6.5.tar.xz) = 127f053ce45c63cd745fa5a654a2d8e4fbc322f5e17dcc3740fb2e7b376dd18dad59318d66e6e93e37d6a179fca4b35cf2ae62d13be5645cd2d06badd79d4dce From 37ee9234ab8fc55a78d4f08cbe5d8e959026f304 Mon Sep 17 00:00:00 2001 From: Anderson Toshiyuki Sasaki Date: Fri, 11 Jan 2019 17:42:50 +0100 Subject: [PATCH 08/13] Add explicit Requires for nettle >= 3.4.1 --- gnutls.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/gnutls.spec b/gnutls.spec index d3c2793..2ebaab0 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated Version: 3.6.5 -Release: 1%{?dist} +Release: 2%{?dist} Patch1: gnutls-3.2.7-rpath.patch Patch2: gnutls-3.6.4-no-now-guile.patch %bcond_without dane @@ -21,7 +21,7 @@ BuildRequires: p11-kit-devel >= 0.21.3, gettext-devel BuildRequires: zlib-devel, readline-devel, libtasn1-devel >= 4.3 BuildRequires: libtool, automake, autoconf, texinfo BuildRequires: autogen-libopts-devel >= 5.18 autogen -BuildRequires: nettle-devel >= 3.1.1 +BuildRequires: nettle-devel >= 3.4.1 BuildRequires: trousers-devel >= 0.3.11.2 BuildRequires: libidn2-devel BuildRequires: libunistring-devel @@ -36,6 +36,7 @@ BuildRequires: p11-kit-trust, ca-certificates Requires: crypto-policies Requires: p11-kit-trust Requires: libtasn1 >= 4.3 +Requires: nettle >= 3.4.1 Recommends: trousers >= 0.3.11.2 %if %{with dane} @@ -284,6 +285,9 @@ fi %endif %changelog +* Fri Jan 11 2019 Anderson Toshiyuki Sasaki - 3.6.5-2 +- Add explicit Requires for nettle >= 3.4.1 + * Wed Dec 12 2018 Anderson Toshiyuki Sasaki - 3.6.5-1 - Update to upstream 3.6.5 release From 8f4e8fe3296d860d0af04fad0e0386e99af3cf48 Mon Sep 17 00:00:00 2001 From: Igor Gnatenko Date: Sun, 27 Jan 2019 19:01:11 +0100 Subject: [PATCH 09/13] Remove obsolete scriptlets References: https://fedoraproject.org/wiki/Changes/RemoveObsoleteScriptlets Signed-off-by: Igor Gnatenko --- gnutls.spec | 12 ------------ 1 file changed, 12 deletions(-) diff --git a/gnutls.spec b/gnutls.spec index 2ebaab0..01dbd91 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -66,8 +66,6 @@ Requires: %{name}-c++%{?_isa} = %{version}-%{release} Requires: %{name}-dane%{?_isa} = %{version}-%{release} %endif Requires: pkgconfig -Requires(post): /sbin/install-info -Requires(preun): /sbin/install-info %package utils License: GPLv3+ @@ -217,16 +215,6 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/pkgconfig/gnutls-dane.pc %check make check %{?_smp_mflags} -%post devel -if [ -f %{_infodir}/gnutls.info.gz ]; then - /sbin/install-info %{_infodir}/gnutls.info.gz %{_infodir}/dir || : -fi - -%preun devel -if [ $1 = 0 -a -f %{_infodir}/gnutls.info.gz ]; then - /sbin/install-info --delete %{_infodir}/gnutls.info.gz %{_infodir}/dir || : -fi - %files -f gnutls.lang %defattr(-,root,root,-) %{_libdir}/libgnutls.so.30* From de43e1069a955d49eb0c2bb887d01fb0ac4f7886 Mon Sep 17 00:00:00 2001 From: Igor Gnatenko Date: Mon, 28 Jan 2019 20:17:46 +0100 Subject: [PATCH 10/13] Remove obsolete Group tag References: https://fedoraproject.org/wiki/Changes/Remove_Group_Tag --- gnutls.spec | 4 ---- 1 file changed, 4 deletions(-) diff --git a/gnutls.spec b/gnutls.spec index 01dbd91..523a21f 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -16,7 +16,6 @@ Summary: A TLS protocol implementation Name: gnutls # The libraries are LGPLv2.1+, utilities are GPLv3+ License: GPLv3+ and LGPLv2+ -Group: System Environment/Libraries BuildRequires: p11-kit-devel >= 0.21.3, gettext-devel BuildRequires: zlib-devel, readline-devel, libtasn1-devel >= 4.3 BuildRequires: libtool, automake, autoconf, texinfo @@ -59,7 +58,6 @@ Requires: %{name}%{?_isa} = %{version}-%{release} %package devel Summary: Development files for the %{name} package -Group: Development/Libraries Requires: %{name}%{?_isa} = %{version}-%{release} Requires: %{name}-c++%{?_isa} = %{version}-%{release} %if %{with dane} @@ -70,7 +68,6 @@ Requires: pkgconfig %package utils License: GPLv3+ Summary: Command line tools for TLS protocol -Group: Applications/System Requires: %{name}%{?_isa} = %{version}-%{release} %if %{with dane} Requires: %{name}-dane%{?_isa} = %{version}-%{release} @@ -85,7 +82,6 @@ Requires: %{name}%{?_isa} = %{version}-%{release} %if %{with guile} %package guile Summary: Guile bindings for the GNUTLS library -Group: Development/Libraries Requires: %{name}%{?_isa} = %{version}-%{release} Requires: guile %endif From b1a85175aab768934489054155cc2bf2c5d3c790 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 31 Jan 2019 23:30:24 +0000 Subject: [PATCH 11/13] - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- gnutls.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/gnutls.spec b/gnutls.spec index 523a21f..1704490 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated Version: 3.6.5 -Release: 2%{?dist} +Release: 3%{?dist} Patch1: gnutls-3.2.7-rpath.patch Patch2: gnutls-3.6.4-no-now-guile.patch %bcond_without dane @@ -269,6 +269,9 @@ make check %{?_smp_mflags} %endif %changelog +* Thu Jan 31 2019 Fedora Release Engineering - 3.6.5-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + * Fri Jan 11 2019 Anderson Toshiyuki Sasaki - 3.6.5-2 - Add explicit Requires for nettle >= 3.4.1 From ac2c19de9a89a46253fb6cb47e5b886f34fe31d7 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 1 Feb 2019 17:48:23 +0100 Subject: [PATCH 12/13] updated to 3.6.6 This brings an additional patch from master to allow compiling with guile 2.0 Signed-off-by: Nikos Mavrogiannopoulos --- .gitignore | 2 ++ gnutls-3.6.6-use-old-guile.patch | 12 ++++++++++++ gnutls.spec | 9 +++++++-- sources | 4 ++-- 4 files changed, 23 insertions(+), 4 deletions(-) create mode 100644 gnutls-3.6.6-use-old-guile.patch diff --git a/.gitignore b/.gitignore index acc1519..b8580ee 100644 --- a/.gitignore +++ b/.gitignore @@ -103,3 +103,5 @@ gnutls-2.10.1-nosrp.tar.bz2 /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /gnutls-3.6.5.tar.xz.sig /gnutls-3.6.5.tar.xz +/gnutls-3.6.6.tar.xz +/gnutls-3.6.6.tar.xz.sig diff --git a/gnutls-3.6.6-use-old-guile.patch b/gnutls-3.6.6-use-old-guile.patch new file mode 100644 index 0000000..a434910 --- /dev/null +++ b/gnutls-3.6.6-use-old-guile.patch @@ -0,0 +1,12 @@ +diff --git a/configure.ac b/configure.ac +index ea6f39c53..7568363ef 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -859,6 +859,7 @@ if test "$opt_guile_bindings" = "yes"; then + AC_PATH_PROG([GUILD], [guild]) + AC_SUBST([GUILD]) + ++ GUILE_PKG + GUILE_PROGS + GUILE_FLAGS + diff --git a/gnutls.spec b/gnutls.spec index 1704490..6abc3b4 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -1,8 +1,9 @@ # This spec file has been automatically updated -Version: 3.6.5 -Release: 3%{?dist} +Version: 3.6.6 +Release: 1%{?dist} Patch1: gnutls-3.2.7-rpath.patch Patch2: gnutls-3.6.4-no-now-guile.patch +Patch3: gnutls-3.6.6-use-old-guile.patch %bcond_without dane %if 0%{?rhel} %bcond_with guile @@ -143,6 +144,7 @@ This package contains Guile bindings for the library. gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0} %autosetup -p1 +autoreconf sed -i -e 's|sys_lib_dlsearch_path_spec="/lib /usr/lib|sys_lib_dlsearch_path_spec="/lib /usr/lib %{_libdir}|g' configure rm -f lib/minitasn1/*.c lib/minitasn1/*.h @@ -269,6 +271,9 @@ make check %{?_smp_mflags} %endif %changelog +* Fri Feb 1 2019 Nikos Mavrogiannopoulos - 3.6.6-1 +- Update to upstream 3.6.6 release + * Thu Jan 31 2019 Fedora Release Engineering - 3.6.5-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild diff --git a/sources b/sources index 13911c8..8d4e08c 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ +SHA512 (gnutls-3.6.6.tar.xz) = 4ff34f38d7dc543bc5750d8fdfe9be84af60c66e8d41da45f6cffc11d6c6c726784fd2d471b3416604ca1f3f9efb22ff7a290d5c92c96deda38df6ae3e794cc1 +SHA512 (gnutls-3.6.6.tar.xz.sig) = 7fb484a62775804dfd7b200b4a55cb07406e91a52c2c90fb779777b757b87c8ce7df0fa92dc7639891bca68eba5d2a66580c2a1734f8b884b9f5254e2e5e3012 SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 3b1989dc6a64d1140f83a2af0773da2adb03c50d97b6da7357cf09525050651aafa21131f1e3180baa540a8af922119a256f5ff5bcd6602996a806e8e1816bad -SHA512 (gnutls-3.6.5.tar.xz.sig) = 91c51442dd661bf827e7547ab88c61fb4c6683d9f90f3df7e6bab3f1b7218b69126702cfbe12d26647b477bda0746e2cfd6e5a3c10899860a42314a8a8ac15d5 -SHA512 (gnutls-3.6.5.tar.xz) = 127f053ce45c63cd745fa5a654a2d8e4fbc322f5e17dcc3740fb2e7b376dd18dad59318d66e6e93e37d6a179fca4b35cf2ae62d13be5645cd2d06badd79d4dce From 65f63d957e92fe4689fa557042f30f380b230744 Mon Sep 17 00:00:00 2001 From: Anderson Toshiyuki Sasaki Date: Wed, 27 Mar 2019 13:28:07 +0100 Subject: [PATCH 13/13] Update to 3.6.7 - Fixed CVE-2019-3836 (#1693214) - Fixed CVE-2019-3829 (#1693210) Signed-off-by: Anderson Toshiyuki Sasaki --- .gitignore | 2 ++ gnutls-3.6.6-use-old-guile.patch | 12 ------------ ...ow-guile.patch => gnutls-3.6.7-no-now-guile.patch | 10 ++++------ gnutls.spec | 10 +++++++--- sources | 4 ++-- 5 files changed, 15 insertions(+), 23 deletions(-) delete mode 100644 gnutls-3.6.6-use-old-guile.patch rename gnutls-3.6.4-no-now-guile.patch => gnutls-3.6.7-no-now-guile.patch (52%) diff --git a/.gitignore b/.gitignore index b8580ee..f0f7092 100644 --- a/.gitignore +++ b/.gitignore @@ -105,3 +105,5 @@ gnutls-2.10.1-nosrp.tar.bz2 /gnutls-3.6.5.tar.xz /gnutls-3.6.6.tar.xz /gnutls-3.6.6.tar.xz.sig +/gnutls-3.6.7.tar.xz +/gnutls-3.6.7.tar.xz.sig diff --git a/gnutls-3.6.6-use-old-guile.patch b/gnutls-3.6.6-use-old-guile.patch deleted file mode 100644 index a434910..0000000 --- a/gnutls-3.6.6-use-old-guile.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff --git a/configure.ac b/configure.ac -index ea6f39c53..7568363ef 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -859,6 +859,7 @@ if test "$opt_guile_bindings" = "yes"; then - AC_PATH_PROG([GUILD], [guild]) - AC_SUBST([GUILD]) - -+ GUILE_PKG - GUILE_PROGS - GUILE_FLAGS - diff --git a/gnutls-3.6.4-no-now-guile.patch b/gnutls-3.6.7-no-now-guile.patch similarity index 52% rename from gnutls-3.6.4-no-now-guile.patch rename to gnutls-3.6.7-no-now-guile.patch index d4edff0..d14e8df 100644 --- a/gnutls-3.6.4-no-now-guile.patch +++ b/gnutls-3.6.7-no-now-guile.patch @@ -1,11 +1,9 @@ -diff --git a/guile/src/Makefile.in b/guile/src/Makefile.in -index 3e4f547..6ffec0e 100644 ---- a/guile/src/Makefile.in -+++ b/guile/src/Makefile.in -@@ -1430,7 +1430,7 @@ guileextension_LTLIBRARIES = guile-gnutls-v-2.la +--- a/guile/src/Makefile.in 2019-03-27 11:51:55.984398001 +0100 ++++ b/guile/src/Makefile.in 2019-03-27 11:52:27.259626076 +0100 +@@ -1472,7 +1472,7 @@ # Use '-module' to build a "dlopenable module", in Libtool terms. # Use '-undefined' to placate Libtool on Windows; see - # . + # . -guile_gnutls_v_2_la_LDFLAGS = -module -no-undefined +guile_gnutls_v_2_la_LDFLAGS = -module -no-undefined -Wl,-z,lazy diff --git a/gnutls.spec b/gnutls.spec index 6abc3b4..bbd3b48 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -1,9 +1,8 @@ # This spec file has been automatically updated -Version: 3.6.6 +Version: 3.6.7 Release: 1%{?dist} Patch1: gnutls-3.2.7-rpath.patch -Patch2: gnutls-3.6.4-no-now-guile.patch -Patch3: gnutls-3.6.6-use-old-guile.patch +Patch2: gnutls-3.6.7-no-now-guile.patch %bcond_without dane %if 0%{?rhel} %bcond_with guile @@ -271,6 +270,11 @@ make check %{?_smp_mflags} %endif %changelog +* Wed Mar 27 2019 Anderson Toshiyuki Sasaki - 3.6.7-1 +- Update to upstream 3.6.7 release +- Fixed CVE-2019-3836 (#1693214) +- Fixed CVE-2019-3829 (#1693210) + * Fri Feb 1 2019 Nikos Mavrogiannopoulos - 3.6.6-1 - Update to upstream 3.6.6 release diff --git a/sources b/sources index 8d4e08c..b47599f 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (gnutls-3.6.6.tar.xz) = 4ff34f38d7dc543bc5750d8fdfe9be84af60c66e8d41da45f6cffc11d6c6c726784fd2d471b3416604ca1f3f9efb22ff7a290d5c92c96deda38df6ae3e794cc1 -SHA512 (gnutls-3.6.6.tar.xz.sig) = 7fb484a62775804dfd7b200b4a55cb07406e91a52c2c90fb779777b757b87c8ce7df0fa92dc7639891bca68eba5d2a66580c2a1734f8b884b9f5254e2e5e3012 +SHA512 (gnutls-3.6.7.tar.xz) = ae9b8996eb9b7269d28213f0aca3a4a17890ba8d47e3dc3b8e754ab8e2b4251e9412aaaa161a8bf56167f04cc169b4cada46f55a7bde92b955eb36cd717a99f3 +SHA512 (gnutls-3.6.7.tar.xz.sig) = fd397cab1f658053d52cdd214a9d816262993b572cd4b623f3e276fd6759e2e620bd3f27d5a749a2b066173c6c39fcc357225d3136996b99e2f88d268aef5baf SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 3b1989dc6a64d1140f83a2af0773da2adb03c50d97b6da7357cf09525050651aafa21131f1e3180baa540a8af922119a256f5ff5bcd6602996a806e8e1816bad