From 1a5ffb7d218233bf2064bf5c53e2aac2c2563b65 Mon Sep 17 00:00:00 2001 From: Jan Grulich Date: Mon, 20 Oct 2025 19:37:41 +0200 Subject: [PATCH] 6.9.3 --- .gitignore | 1 + ...t-store-locations-for-modern-Red-Hat.patch | 62 ------------------- qt6-qtbase.spec | 15 +++-- sources | 2 +- 4 files changed, 9 insertions(+), 71 deletions(-) delete mode 100644 0001-Update-SSL-trust-store-locations-for-modern-Red-Hat.patch diff --git a/.gitignore b/.gitignore index 400b424..8a57793 100644 --- a/.gitignore +++ b/.gitignore @@ -36,3 +36,4 @@ /qtbase-everywhere-src-6.9.0.tar.xz /qtbase-everywhere-src-6.9.1.tar.xz /qtbase-everywhere-src-6.9.2.tar.xz +/qtbase-everywhere-src-6.9.3.tar.xz diff --git a/0001-Update-SSL-trust-store-locations-for-modern-Red-Hat.patch b/0001-Update-SSL-trust-store-locations-for-modern-Red-Hat.patch deleted file mode 100644 index 6812535..0000000 --- a/0001-Update-SSL-trust-store-locations-for-modern-Red-Hat.patch +++ /dev/null @@ -1,62 +0,0 @@ -From 10a6f2b2d27ad2372c314bd1f2b21e225ece069b Mon Sep 17 00:00:00 2001 -From: Adam Williamson -Date: Mon, 28 Jul 2025 11:52:41 -0700 -Subject: [PATCH] Update SSL trust store locations for modern Red Hat - -Red Hat family distros haven't used /usr/share/ssl since 2004: -https://bugzilla.redhat.com/show_bug.cgi?id=143392 - -/etc/ssl/certs has never been a canonical location on Red Hat -family distros, and as of -https://fedoraproject.org/wiki/Changes/dropingOfCertPemFile is -being removed. The same change also removes -/etc/pki/tls/certs/ca-bundle.crt . This updates both magic lists -with the modern canonical locations for Red Hat and derived -distros. The tls-ca-bundle.pem bundle has been around in Fedora -since around 2013: -https://src.fedoraproject.org/rpms/ca-certificates/c/d538ada99cda951da7da3a72dc5eea06f02be212 -The directory-hash dir has been around since around 2021: -https://src.fedoraproject.org/rpms/ca-certificates/c/1c8b67fb5ab3954a308d019461bb30d50412087e - -As I blogged in 2015, it is generally a bad idea to be trying to -second-guess your SSL library about this stuff. OpenSSL has -`SSL_CTX_set_default_verify_paths` etc.; why not use them? At -least in the first instance; you can fall back to magic lists if -that fails. - -https://www.happyassassin.net/posts/2015/01/12/a-note-about-ssltls-trusted-certificate-stores-and-platforms/ - -Signed-off-by: Adam Williamson ---- - src/network/ssl/qsslsocket.cpp | 3 ++- - src/plugins/tls/openssl/qtlsbackend_openssl.cpp | 3 ++- - 2 files changed, 4 insertions(+), 2 deletions(-) - -diff --git a/src/network/ssl/qsslsocket.cpp b/src/network/ssl/qsslsocket.cpp -index 9e7b51d7..b3be3490 100644 ---- a/src/network/ssl/qsslsocket.cpp -+++ b/src/network/ssl/qsslsocket.cpp -@@ -2963,7 +2963,8 @@ QList QSslSocketPrivate::unixRootCertDirectories() - static const QByteArray dirs[] = { - ba("/etc/ssl/certs/"), // (K)ubuntu, OpenSUSE, Mandriva ... - ba("/usr/lib/ssl/certs/"), // Gentoo, Mandrake -- ba("/usr/share/ssl/"), // Centos, Redhat, SuSE -+ ba("/usr/share/ssl/"), // Red Hat pre-2004, SuSE -+ ba("/etc/pki/ca-trust/extracted/pem/directory-hash/"), // Red Hat 2021+ - ba("/usr/local/ssl/"), // Normal OpenSSL Tarball - ba("/var/ssl/certs/"), // AIX - ba("/usr/local/ssl/certs/"), // Solaris -diff --git a/src/plugins/tls/openssl/qtlsbackend_openssl.cpp b/src/plugins/tls/openssl/qtlsbackend_openssl.cpp -index c8bda9bc..024b5f55 100644 ---- a/src/plugins/tls/openssl/qtlsbackend_openssl.cpp -+++ b/src/plugins/tls/openssl/qtlsbackend_openssl.cpp -@@ -389,7 +389,8 @@ QList systemCaCertificates() - { - const QList directories = QSslSocketPrivate::unixRootCertDirectories(); - QSet certFiles = { -- QStringLiteral("/etc/pki/tls/certs/ca-bundle.crt"), // Fedora, Mandriva -+ QStringLiteral("/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem"), // Red Hat 2013+ -+ QStringLiteral("/etc/pki/tls/certs/ca-bundle.crt"), // Red Hat older, Mandriva - QStringLiteral("/usr/local/share/certs/ca-root-nss.crt") // FreeBSD's ca_root_nss - }; - diff --git a/qt6-qtbase.spec b/qt6-qtbase.spec index e829610..c87d469 100644 --- a/qt6-qtbase.spec +++ b/qt6-qtbase.spec @@ -45,7 +45,7 @@ BuildRequires: pkgconfig(libsystemd) Name: qt6-qtbase Summary: Qt6 - QtBase components -Version: 6.9.2 +Version: 6.9.3 Release: 1%{?dist} License: LGPL-3.0-only OR GPL-3.0-only WITH Qt-GPL-exception-1.0 @@ -95,10 +95,6 @@ Patch56: qtbase-mysql.patch # fix FTBFS against libglvnd-1.3.4+ Patch58: qtbase-libglvnd.patch -# Adjust to https://fedoraproject.org/wiki/Changes/dropingOfCertPemFile -# https://codereview.qt-project.org/c/qt/qtbase/+/664056 -Patch59: 0001-Update-SSL-trust-store-locations-for-modern-Red-Hat.patch - # upstream patches # Do not check any files in %%{_qt6_plugindir}/platformthemes/ for requires. @@ -432,7 +428,7 @@ translationdir=%{_qt6_translationdir} Name: Qt6 Description: Qt6 Configuration -Version: 6.9.2 +Version: 6.9.3 EOF # rpm macros @@ -673,7 +669,7 @@ make check -k ||: %{_qt6_libdir}/libQt6Widgets.prl %{_qt6_libdir}/libQt6Widgets.so %{_qt6_libdir}/libQt6XcbQpa.prl -%{_qt6_libdir}/libQt6XcbQpa.so +%{_qt6_libdir}/libQt6XcbQpa.so %{_qt6_libdir}/libQt6Xml.prl %{_qt6_libdir}/libQt6Xml.so %{_qt6_libdir}/cmake/Qt6/3rdparty/extra-cmake-modules/REUSE.toml @@ -932,6 +928,9 @@ make check -k ||: %changelog +* Mon Oct 20 2025 Jan Grulich - 6.9.3-1 +- 6.9.3 + * Thu Aug 28 2025 Jan Grulich - 6.9.2-1 - 6.9.2 @@ -1140,7 +1139,7 @@ make check -k ||: * Fri Apr 7 2023 Marie Loise Nolden - 6.5.0-2 - fix xcb plugin with new dependency xcb-cursor instead of Xcursor introduction with qt 6.5, add firebird sql plugin cleanly, clean up spec file - + * Mon Apr 03 2023 Jan Grulich - 6.5.0-1 - 6.5.0 diff --git a/sources b/sources index 7656a84..cb20cdd 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (qtbase-everywhere-src-6.9.2.tar.xz) = 3fab05fd17165b5e4501236f736c2b4c8d28929e17ce19de614851ae69adad88d621360c441d1ff2954ab24dee0d461d948cf699bc1c58f4b766ca8379de651e +SHA512 (qtbase-everywhere-src-6.9.3.tar.xz) = d49b6356869830b7421e8bb94354884c132dcb37b9b2d56c88671bff0fe60e51a4ee961a7db3f248da84d0eda64af1636f1bdf59fdc0bbf8e50147c370e901de