From e0766837b39a90c12cc2a8822110c0bb41b3e21d Mon Sep 17 00:00:00 2001 From: Jeff Law Date: Fri, 21 Aug 2020 16:34:01 -0600 Subject: [PATCH 1/3] Re-enable LTO --- libgcrypt.spec | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/libgcrypt.spec b/libgcrypt.spec index c082e02..89f5ef1 100644 --- a/libgcrypt.spec +++ b/libgcrypt.spec @@ -1,6 +1,6 @@ Name: libgcrypt Version: 1.8.6 -Release: 3%{?dist} +Release: 4%{?dist} URL: http://www.gnupg.org/ Source0: libgcrypt-%{version}-hobbled.tar.xz # The original libgcrypt sources now contain potentially patented ECC @@ -105,11 +105,14 @@ cp %{SOURCE4} cipher/ cp %{SOURCE5} %{SOURCE6} tests/ %build -# configure tests try to compile code containing ASMs to a .o file -# In an LTO world, that always works as compilation does not happen until -# link time. As a result we get the wrong results from configure. -# Disable LTO. -%define _lto_cflags %{nil} +# This package has a configure test which uses ASMs, but does not link the +# resultant .o files. As such the ASM test is always successful, even on +# architectures were the ASM is not valid when compiling with LTO. +# +# -ffat-lto-objects is sufficient to address this issue. It is the default +# for F33, but is expected to only be enabled for packages that need it in +# F34, so we use it here explicitly +%define _lto_cflags -flto=auto -ffat-lto-objects autoreconf -f %configure --disable-static \ @@ -208,6 +211,9 @@ install -m644 %{SOURCE7} $RPM_BUILD_ROOT/etc/gcrypt/random.conf %license COPYING %changelog +* Fri Aug 21 2020 Jeff Law - 1.8.6-4 +- Re-enable LTO + * Tue Jul 28 2020 Fedora Release Engineering - 1.8.6-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild From acefd74731914eb0d4e1cd4efe82a0d80762f929 Mon Sep 17 00:00:00 2001 From: Jakub Jelen Date: Tue, 24 Nov 2020 15:09:21 +0100 Subject: [PATCH 2/3] 1.8.7-1 --- .gitignore | 1 + libgcrypt.spec | 10 ++++++++-- sources | 2 +- 3 files changed, 10 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 48ec3ad..956ba5f 100644 --- a/.gitignore +++ b/.gitignore @@ -22,3 +22,4 @@ libgcrypt-1.4.5-hobbled.tar.bz2 /libgcrypt-1.8.4-hobbled.tar.xz /libgcrypt-1.8.5-hobbled.tar.xz /libgcrypt-1.8.6-hobbled.tar.xz +/libgcrypt-1.8.7-hobbled.tar.xz diff --git a/libgcrypt.spec b/libgcrypt.spec index 89f5ef1..6c82b2e 100644 --- a/libgcrypt.spec +++ b/libgcrypt.spec @@ -1,12 +1,15 @@ Name: libgcrypt -Version: 1.8.6 -Release: 4%{?dist} +Version: 1.8.7 +Release: 1%{?dist} URL: http://www.gnupg.org/ Source0: libgcrypt-%{version}-hobbled.tar.xz # The original libgcrypt sources now contain potentially patented ECC # cipher support. We have to remove it in the tarball we ship with # the hobble-libgcrypt script. # (We replace it with RH approved ECC in Source4-5) +# tar -xf libgcrypt-1.8.7.tar.bz2 +# pushd libgcrypt-1.8.7 && ../hobble-libgcrypt && popd +# tar -cvJf libgcrypt-1.8.7-hobbled.tar.xz libgcrypt-1.8.7 #Source0: ftp://ftp.gnupg.org/gcrypt/libgcrypt/libgcrypt-{version}.tar.bz2 #Source1: ftp://ftp.gnupg.org/gcrypt/libgcrypt/libgcrypt-{version}.tar.bz2.sig Source2: wk@g10code.com @@ -211,6 +214,9 @@ install -m644 %{SOURCE7} $RPM_BUILD_ROOT/etc/gcrypt/random.conf %license COPYING %changelog +* Tue Nov 24 2020 Jakub Jelen - 1.8.7-1 +- new upstream release (#1891123) + * Fri Aug 21 2020 Jeff Law - 1.8.6-4 - Re-enable LTO diff --git a/sources b/sources index 09310c9..b46a259 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (libgcrypt-1.8.6-hobbled.tar.xz) = b59a3c6544e989033acb1f75a526487075b12aac65f18e38264aa9921fe89306485bfee5f4b0dd75d9ed4a35f23851d302359983c75d6f5a0d6f74007a553743 +SHA512 (libgcrypt-1.8.7-hobbled.tar.xz) = e9655f5387f08d18dcfcef3bce737aa7bb0242a5ebcb2be0dd2892fad3761496e3e51b283b61e8537b30b157a3ef5657a5bf4288c7d3aec94982b0c6da749876 From 4eb62490ba03d0d7ff168714a93b57f8e1ed16d3 Mon Sep 17 00:00:00 2001 From: Jakub Jelen Date: Mon, 14 Jun 2021 08:33:41 +0200 Subject: [PATCH 3/3] libgcrypt-1.8.8-1 Fixing CVE-2021-33560 (#1970098) --- .gitignore | 1 + libgcrypt.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 956ba5f..fdd8743 100644 --- a/.gitignore +++ b/.gitignore @@ -23,3 +23,4 @@ libgcrypt-1.4.5-hobbled.tar.bz2 /libgcrypt-1.8.5-hobbled.tar.xz /libgcrypt-1.8.6-hobbled.tar.xz /libgcrypt-1.8.7-hobbled.tar.xz +/libgcrypt-1.8.8-hobbled.tar.xz diff --git a/libgcrypt.spec b/libgcrypt.spec index 6c82b2e..9147d5b 100644 --- a/libgcrypt.spec +++ b/libgcrypt.spec @@ -1,5 +1,5 @@ Name: libgcrypt -Version: 1.8.7 +Version: 1.8.8 Release: 1%{?dist} URL: http://www.gnupg.org/ Source0: libgcrypt-%{version}-hobbled.tar.xz @@ -214,6 +214,9 @@ install -m644 %{SOURCE7} $RPM_BUILD_ROOT/etc/gcrypt/random.conf %license COPYING %changelog +* Mon Jun 14 2021 Jakub Jelen - 1.8.8-1 +- New upstream release fixing CVE-2021-33560 (#1970098) + * Tue Nov 24 2020 Jakub Jelen - 1.8.7-1 - new upstream release (#1891123) diff --git a/sources b/sources index b46a259..a948c03 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (libgcrypt-1.8.7-hobbled.tar.xz) = e9655f5387f08d18dcfcef3bce737aa7bb0242a5ebcb2be0dd2892fad3761496e3e51b283b61e8537b30b157a3ef5657a5bf4288c7d3aec94982b0c6da749876 +SHA512 (libgcrypt-1.8.8-hobbled.tar.xz) = b31c277b75d13a9ff4c172be6f00f891eceabfbe5c360b1d0644fe98858f52062b6c733baafc47bbcde81ae42e360703756e1f6e907374375a067d88b246750a