/[smeserver]/rpms/openssl/sme8/openssl.spec
ViewVC logotype

Annotation of /rpms/openssl/sme8/openssl.spec

Parent Directory Parent Directory | Revision Log Revision Log | View Revision Graph Revision Graph


Revision 1.1 - (hide annotations) (download)
Tue Feb 18 03:03:10 2014 UTC (10 years, 8 months ago) by wellsi
Branch: MAIN
CVS Tags: openssl-0_9_8e-27_el5_10_1
Branch point for: upstream
Initial import

1 wellsi 1.1 # For the curious:
2     # 0.9.5a soversion = 0
3     # 0.9.6 soversion = 1
4     # 0.9.6a soversion = 2
5     # 0.9.6c soversion = 3
6     # 0.9.7a soversion = 4
7     # 0.9.7ef soversion = 5
8     # 0.9.8abe soversion = 6
9     %define soversion 6
10    
11     # Number of threads to spawn when testing some threading fixes.
12     %define thread_test_threads %{?threads:%{threads}}%{!?threads:1}
13    
14     # Arches on which we need to prevent arch conflicts on opensslconf.h, must
15     # also be handled in opensslconf-new.h.
16     %define multilib_arches %{ix86} ia64 ppc ppc64 s390 s390x x86_64
17    
18     # Arches for which we don't build subpackages.
19     %define optimize_arches i686
20    
21     Summary: The OpenSSL toolkit
22     Name: openssl
23     Version: 0.9.8e
24     Release: 27%{?dist}.1
25     # The tarball is based on the openssl-fips-1.2.0-test.tar.gz tarball
26     Source: openssl-fips-%{version}-usa.tar.bz2
27     Source1: hobble-openssl
28     Source2: Makefile.certificate
29     Source3: ca-bundle.crt
30     Source4: https://rhn.redhat.com/help/RHNS-CA-CERT
31     Source5: https://rhn.redhat.com/help/RHNS-CA-CERT.asc
32     Source6: make-dummy-cert
33     Source8: openssl-thread-test.c
34     Source9: opensslconf-new.h
35     Source10: opensslconf-new-warning.h
36     Source11: README.FIPS
37     # Build changes
38     Patch0: openssl-fips-0.9.8e-redhat.patch
39     Patch1: openssl-0.9.8a-defaults.patch
40     Patch2: openssl-0.9.8a-link-krb5.patch
41     Patch3: openssl-0.9.8b-soversion.patch
42     Patch4: openssl-0.9.8a-enginesdir.patch
43     Patch5: openssl-0.9.8a-no-rpath.patch
44     # Functionality changes
45     Patch32: openssl-0.9.7-beta6-ia64.patch
46     Patch33: openssl-0.9.7f-ca-dir.patch
47     Patch34: openssl-0.9.6-x509.patch
48     Patch35: openssl-0.9.7-beta5-version-add-engines.patch
49     Patch38: openssl-0.9.8a-reuse-cipher-change.patch
50     Patch39: openssl-0.9.8b-ipv6-apps.patch
51     # Backported fixes including security fixes
52     Patch61: openssl-0.9.8b-aliasing-bug.patch
53     Patch62: openssl-0.9.8b-x509-name-cmp.patch
54     Patch64: openssl-fips-0.9.8e-dtls-fixes.patch
55     Patch65: openssl-0.9.8b-cve-2007-5135.patch
56     Patch67: openssl-fips-0.9.8e-aescfb.patch
57     Patch68: openssl-fips-0.9.8e-abi.patch
58     Patch69: openssl-fips-0.9.8e-fipsmode.patch
59     Patch70: openssl-fips-0.9.8e-bn-fixes.patch
60     Patch71: openssl-fips-0.9.8e-use-fipscheck.patch
61     Patch72: openssl-fips-0.9.8e-env-zlib.patch
62     Patch73: openssl-fips-0.9.8e-default-paths.patch
63     Patch74: openssl-fips-0.9.8e-evp-nonfips.patch
64     Patch75: openssl-fips-0.9.8e-cve-2008-5077.patch
65     Patch76: openssl-fips-0.9.8e-multi-crl.patch
66     Patch77: openssl-fips-0.9.8e-no-pairwise.patch
67     Patch78: openssl-fips-0.9.8e-rng-seed.patch
68     Patch79: openssl-fips-0.9.8e-bad-mime.patch
69     Patch80: openssl-fips-0.9.8e-cve-2009-0590.patch
70     Patch81: openssl-fips-0.9.8e-dtls-dos.patch
71     Patch82: openssl-fips-0.9.8e-algo-doc.patch
72     Patch83: openssl-fips-0.9.8e-cve-2009-2409.patch
73     Patch84: openssl-fips-0.9.8e-cve-2009-4355.patch
74     Patch85: openssl-fips-0.9.8e-cve-2009-3555.patch
75     Patch86: openssl-fips-0.9.8e-cve-2010-0433.patch
76     Patch87: openssl-fips-0.9.8e-cve-2009-3245.patch
77     Patch88: openssl-fips-0.9.8e-cve-2010-4180.patch
78     Patch89: openssl-fips-0.9.8e-ssl-sha256.patch
79     Patch90: openssl-fips-0.9.8e-ciph-sort.patch
80     Patch91: openssl-fips-0.9.8e-apps-dgst.patch
81     Patch92: openssl-fips-0.9.8e-tls-version.patch
82     Patch93: openssl-fips-0.9.8e-chil-fixes.patch
83     Patch94: openssl-fips-0.9.8e-dh-check.patch
84     Patch95: openssl-fips-0.9.8e-sha2test.patch
85     Patch96: openssl-fips-0.9.8e-apps-yesno.patch
86     Patch97: openssl-fips-0.9.8e-dtls-fixes2.patch
87     Patch98: openssl-fips-0.9.8e-cve-2011-4109.patch
88     Patch99: openssl-fips-0.9.8e-cve-2011-4576.patch
89     Patch100: openssl-fips-0.9.8e-cve-2011-4619.patch
90     Patch101: openssl-fips-0.9.8e-cve-2012-0884.patch
91     Patch102: openssl-fips-0.9.8e-cve-2012-1165.patch
92     Patch103: openssl-fips-0.9.8e-cve-2012-2110.patch
93     Patch104: openssl-fips-0.9.8e-cve-2012-2333.patch
94     Patch105: openssl-fips-0.9.8e-secure-getenv.patch
95     Patch106: openssl-fips-0.9.8e-cve-2013-0166.patch
96     Patch107: openssl-fips-0.9.8e-cve-2013-0169.patch
97    
98     License: BSDish
99     Group: System Environment/Libraries
100     URL: http://www.openssl.org/
101     BuildRoot: %{_tmppath}/%{name}-%{version}-root
102     BuildRequires: mktemp, krb5-devel, perl, sed, zlib-devel, /usr/bin/cmp
103     Requires: mktemp
104    
105     %description
106     The OpenSSL toolkit provides support for secure communications between
107     machines. OpenSSL includes a certificate management tool and shared
108     libraries which provide various cryptographic algorithms and
109     protocols.
110    
111     %package devel
112     Summary: Files for development of applications which will use OpenSSL
113     Group: Development/Libraries
114     Requires: %{name} = %{version}-%{release}, krb5-devel, zlib-devel
115    
116     %description devel
117     OpenSSL is a toolkit for supporting cryptography. The openssl-devel
118     package contains static libraries and include files needed to develop
119     applications which support various cryptographic algorithms and
120     protocols.
121    
122     %package perl
123     Summary: Perl scripts provided with OpenSSL
124     Group: Applications/Internet
125     Requires: perl
126     Requires: %{name} = %{version}-%{release}
127    
128     %description perl
129     OpenSSL is a toolkit for supporting cryptography. The openssl-perl
130     package provides Perl scripts for converting certificates and keys
131     from other formats to the formats used by the OpenSSL toolkit.
132    
133     %prep
134     %setup -q -n %{name}-fips-%{version}
135    
136     %{SOURCE1} > /dev/null
137     %patch0 -p1 -b .redhat
138     %patch1 -p1 -b .defaults
139     # Fix link line for libssl (bug #111154).
140     %patch2 -p1 -b .krb5
141     %patch3 -p1 -b .soversion
142     %patch4 -p1 -b .enginesdir
143     %patch5 -p1 -b .no-rpath
144    
145    
146     %patch32 -p1 -b .ia64
147     #patch33 is applied after make test
148     %patch34 -p1 -b .x509
149     %patch35 -p1 -b .version-add-engines
150     %patch38 -p1 -b .cipher-change
151     %patch39 -p1 -b .ipv6-apps
152    
153     %patch61 -p1 -b .aliasing-bug
154     %patch62 -p1 -b .name-cmp
155     %patch64 -p1 -b .dtls-fixes
156     %patch65 -p1 -b .shciphers
157     %patch67 -p1 -b .aescfb
158     %patch68 -p1 -b .abi
159     %patch69 -p1 -b .fipsmode
160     %patch70 -p1 -b .bn-fixes
161     %patch71 -p1 -b .use-fipscheck
162     %patch72 -p1 -b .env-zlib
163     %patch73 -p1 -b .default-paths
164     %patch74 -p1 -b .nonfips
165     %patch75 -p1 -b .verifysig
166     %patch76 -p1 -b .multi-crl
167     %patch77 -p1 -b .no-pairwise
168     %patch78 -p1 -b .rng-seed
169     %patch79 -p1 -b .bad-mime
170     %patch80 -p1 -b .bad-string
171     %patch81 -p1 -b .dtls-dos
172     %patch82 -p1 -b .algo-doc
173     %patch83 -p1 -b .nomd2
174     %patch84 -p1 -b .compleak
175     %patch85 -p1 -b .reneg
176     %patch86 -p1 -b .nullprinc
177     %patch87 -p1 -b .wexpand
178     %patch88 -p1 -b .disable-nsbug
179     %patch89 -p1 -b .sha256
180     %patch90 -p1 -b .sort
181     %patch91 -p1 -b .dgst
182     %patch92 -p1 -b .tlsver
183     %patch93 -p1 -b .chil
184     %patch94 -p1 -b .dh-check
185     %patch95 -p1 -b .sha2test
186     %patch96 -p1 -b .yesno
187     %patch97 -p1 -b .dtls-fixes2
188     %patch98 -p1 -b .doublefree
189     %patch99 -p1 -b .padding
190     %patch100 -p1 -b .sgc-dos
191     %patch101 -p1 -b .cms-mma
192     %patch102 -p1 -b .bad-mime2
193     %patch103 -p1 -b .biobuf
194     %patch104 -p1 -b .reclen
195     %patch105 -p1 -b .secure-getenv
196     %patch106 -p1 -b .ocsp-dos
197     %patch107 -p1 -b .lucky13
198    
199     # Modify the various perl scripts to reference perl in the right location.
200     perl util/perlpath.pl `dirname %{__perl}`
201    
202     # Generate a table with the compile settings for my perusal.
203     touch Makefile
204     make TABLE PERL=%{__perl}
205    
206     %build
207     # Figure out which flags we want to use.
208     # default
209     sslarch=%{_os}-%{_arch}
210     %ifarch %ix86
211     sslarch=linux-elf
212     if ! echo %{_target} | grep -q i686 ; then
213     sslflags="no-asm 386"
214     fi
215     %endif
216     %ifarch sparc
217     sslarch=linux-sparcv9
218     sslflags=no-asm
219     %endif
220     %ifarch alpha
221     sslarch=linux-alpha-gcc
222     %endif
223     %ifarch s390
224     # The -fno-regmove is a workaround for bug #199604
225     sslarch="linux-generic32 -DB_ENDIAN -DNO_ASM -march=z900 -fno-regmove"
226     %endif
227     %ifarch s390x
228     sslarch="linux-generic64 -DB_ENDIAN -DNO_ASM"
229     %endif
230     # ia64, x86_64, ppc, ppc64 are OK by default
231     # Configure the build tree. Override OpenSSL defaults with known-good defaults
232     # usable on all platforms. The Configure script already knows to use -fPIC and
233     # RPM_OPT_FLAGS, so we can skip specifiying them here.
234     ./Configure \
235     --prefix=%{_prefix} --openssldir=%{_sysconfdir}/pki/tls ${sslflags} \
236     zlib no-idea no-mdc2 no-rc5 no-ec no-ecdh no-ecdsa shared \
237     --with-krb5-flavor=MIT --enginesdir=%{_libdir}/openssl/engines \
238     -I%{_prefix}/kerberos/include -L%{_prefix}/kerberos/%{_lib} \
239     ${sslarch} fipscanisterbuild
240    
241     # Add -Wa,--noexecstack here so that libcrypto's assembler modules will be
242     # marked as not requiring an executable stack.
243     RPM_OPT_FLAGS="$RPM_OPT_FLAGS -Wa,--noexecstack -DOPENSSL_USE_NEW_FUNCTIONS -fno-strict-aliasing"
244     make depend
245     make all
246    
247     # Generate hashes for the included certs.
248     make rehash
249    
250     # Overwrite FIPS README
251     cp -f %{SOURCE11} .
252    
253     # Verify that what was compiled actually works.
254     LD_LIBRARY_PATH=`pwd`${LD_LIBRARY_PATH:+:${LD_LIBRARY_PATH}}
255     export LD_LIBRARY_PATH
256     make -C test apps tests
257     %{__cc} -o openssl-thread-test \
258     `krb5-config --cflags` \
259     -I./include \
260     $RPM_OPT_FLAGS \
261     %{SOURCE8} \
262     -L. \
263     -lssl -lcrypto \
264     `krb5-config --libs` \
265     -lpthread -lz -ldl
266     ./openssl-thread-test --threads %{thread_test_threads}
267    
268     # Patch33 must be patched after tests otherwise they will fail
269     patch -p1 -b -z .ca-dir < %{PATCH33}
270    
271     # Add generation of HMAC checksum of the final stripped library
272     %define __spec_install_post \
273     %{?__debug_package:%{__debug_install_post}} \
274     %{__arch_install_post} \
275     %{__os_install_post} \
276     fips/fips_standalone_sha1 $RPM_BUILD_ROOT/%{_lib}/libcrypto.so.%{version} >$RPM_BUILD_ROOT/%{_lib}/.libcrypto.so.%{version}.hmac \
277     ln -sf .libcrypto.so.%{version}.hmac $RPM_BUILD_ROOT/%{_lib}/.libcrypto.so.%{soversion}.hmac \
278     fips/fips_standalone_sha1 $RPM_BUILD_ROOT/%{_lib}/libssl.so.%{version} >$RPM_BUILD_ROOT/%{_lib}/.libssl.so.%{version}.hmac \
279     ln -sf .libssl.so.%{version}.hmac $RPM_BUILD_ROOT/%{_lib}/.libssl.so.%{soversion}.hmac \
280     %{nil}
281    
282     %install
283     [ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT
284     # Install OpenSSL.
285     install -d $RPM_BUILD_ROOT/{%{_lib},%{_bindir},%{_includedir},%{_libdir},%{_mandir},%{_libdir}/openssl}
286     make INSTALL_PREFIX=$RPM_BUILD_ROOT install
287     make INSTALL_PREFIX=$RPM_BUILD_ROOT install_docs
288     # OpenSSL install doesn't use correct _libdir
289     mv $RPM_BUILD_ROOT/usr/lib/lib*.so.%{soversion} $RPM_BUILD_ROOT/%{_lib}/
290     mv $RPM_BUILD_ROOT/usr/lib/engines $RPM_BUILD_ROOT/%{_libdir}/openssl
291     mv $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/man/* $RPM_BUILD_ROOT%{_mandir}/
292     rmdir $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/man
293     mv $RPM_BUILD_ROOT/usr/lib/* $RPM_BUILD_ROOT%{_libdir}/ || :
294     rename so.%{soversion} so.%{version} $RPM_BUILD_ROOT/%{_lib}/*.so.%{soversion}
295     for lib in $RPM_BUILD_ROOT/%{_lib}/*.so.%{version} ; do
296     chmod 755 ${lib}
297     ln -s -f ../../%{_lib}/`basename ${lib}` $RPM_BUILD_ROOT%{_libdir}/`basename ${lib} .%{version}`
298     ln -s -f `basename ${lib}` $RPM_BUILD_ROOT/%{_lib}/`basename ${lib} .%{version}`.%{soversion}
299     rm -f $RPM_BUILD_ROOT%{_libdir}/`basename ${lib} .%{version}`.%{soversion}
300     done
301    
302     # Install a makefile for generating keys and self-signed certs, and a script
303     # for generating them on the fly.
304     mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/certs
305     install -m644 %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/certs/Makefile
306     install -m755 %{SOURCE6} $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/certs/make-dummy-cert
307    
308     # Make sure we actually include the headers we built against.
309     for header in $RPM_BUILD_ROOT%{_includedir}/openssl/* ; do
310     if [ -f ${header} -a -f include/openssl/$(basename ${header}) ] ; then
311     install -m644 include/openssl/`basename ${header}` ${header}
312     fi
313     done
314    
315     # Rename man pages so that they don't conflict with other system man pages.
316     pushd $RPM_BUILD_ROOT%{_mandir}
317     for manpage in man*/* ; do
318     if [ -L ${manpage} ]; then
319     TARGET=`ls -l ${manpage} | awk '{ print $NF }'`
320     ln -snf ${TARGET}ssl ${manpage}ssl
321     rm -f ${manpage}
322     else
323     mv ${manpage} ${manpage}ssl
324     fi
325     done
326     for conflict in passwd rand ; do
327     rename ${conflict} ssl${conflict} man*/${conflict}*
328     done
329     popd
330    
331     # Pick a CA script.
332     pushd $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/misc
333     mv CA.sh CA
334     popd
335    
336     mkdir -m700 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA
337     mkdir -m700 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA/private
338    
339     # Install root CA stuffs.
340     cat << EOF > RHNS-blurb.txt
341     #
342     # RHNS CA certificate. Appended to the ca-bundle at package build-time.
343     #
344     EOF
345     cat %{SOURCE3} RHNS-blurb.txt %{SOURCE4} > ca-bundle.crt
346     install -m644 ca-bundle.crt $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/certs/
347     ln -s certs/ca-bundle.crt $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/cert.pem
348    
349     # Fix libdir.
350     pushd $RPM_BUILD_ROOT/%{_libdir}/pkgconfig
351     for i in *.pc ; do
352     sed 's,^libdir=${exec_prefix}/lib,libdir=${exec_prefix}/%{_lib},g' \
353     $i >$i.tmp && \
354     cat $i.tmp >$i && \
355     rm -f $i.tmp
356     done
357     popd
358    
359     # Determine which arch opensslconf.h is going to try to #include.
360     basearch=%{_arch}
361     %ifarch %{ix86}
362     basearch=i386
363     %endif
364    
365     %ifarch %{multilib_arches}
366     # Do an opensslconf.h switcheroo to avoid file conflicts on systems where you
367     # can have both a 32- and 64-bit version of the library, and they each need
368     # their own correct-but-different versions of opensslconf.h to be usable.
369     install -m644 %{SOURCE10} \
370     $RPM_BUILD_ROOT/%{_prefix}/include/openssl/opensslconf-${basearch}.h
371     cat $RPM_BUILD_ROOT/%{_prefix}/include/openssl/opensslconf.h >> \
372     $RPM_BUILD_ROOT/%{_prefix}/include/openssl/opensslconf-${basearch}.h
373     install -m644 %{SOURCE9} \
374     $RPM_BUILD_ROOT/%{_prefix}/include/openssl/opensslconf.h
375     %endif
376    
377     %ifarch %{optimize_arches}
378     # Remove bits which belong in subpackages.
379     rm -rf $RPM_BUILD_ROOT/%{_prefix}/include/openssl
380     rm -rf $RPM_BUILD_ROOT/%{_libdir}/*.a
381     rm -rf $RPM_BUILD_ROOT/%{_libdir}/*.so
382     rm -rf $RPM_BUILD_ROOT/%{_libdir}/pkgconfig
383     rm -rf $RPM_BUILD_ROOT/%{_mandir}/man3/*
384    
385     rm -rf $RPM_BUILD_ROOT/%{_bindir}/c_rehash
386     rm -rf $RPM_BUILD_ROOT/%{_mandir}/man1*/*.pl*
387     rm -rf $RPM_BUILD_ROOT/%{_sysconfdir}/pki/tls/misc/*.pl
388     %endif
389    
390     # Remove fips fingerprint script
391     rm -rf $RPM_BUILD_ROOT/%{_bindir}/openssl_fips_fingerprint
392    
393     %clean
394     [ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT
395    
396     %files
397     %defattr(-,root,root)
398     %doc FAQ LICENSE CHANGES NEWS INSTALL README
399     %doc doc/c-indentation.el doc/openssl.txt
400     %doc doc/openssl_button.html doc/openssl_button.gif
401     %doc doc/ssleay.txt
402     %doc README.FIPS
403     %dir %{_sysconfdir}/pki/tls
404     %dir %{_sysconfdir}/pki/tls/certs
405     %{_sysconfdir}/pki/tls/certs/make-dummy-cert
406     %{_sysconfdir}/pki/tls/certs/Makefile
407     %{_sysconfdir}/pki/tls/cert.pem
408     %dir %{_sysconfdir}/pki/tls/misc
409     %{_sysconfdir}/pki/tls/misc/CA
410     %dir %{_sysconfdir}/pki/CA
411     %dir %{_sysconfdir}/pki/CA/private
412     %{_sysconfdir}/pki/tls/misc/c_*
413     %{_sysconfdir}/pki/tls/private
414    
415     %config(noreplace) %{_sysconfdir}/pki/tls/openssl.cnf
416     %config(noreplace) %{_sysconfdir}/pki/tls/certs/ca-bundle.crt
417    
418     %attr(0755,root,root) %{_bindir}/openssl
419     %attr(0755,root,root) /%{_lib}/*.so.%{version}
420     %attr(0755,root,root) /%{_lib}/*.so.%{soversion}
421     %attr(0644,root,root) /%{_lib}/.libcrypto.so.*.hmac
422     %attr(0644,root,root) /%{_lib}/.libssl.so.*.hmac
423     %dir %{_libdir}/openssl
424     %attr(0755,root,root) %{_libdir}/openssl/engines
425     %attr(0644,root,root) %{_mandir}/man1*/[ABD-Zabcd-z]*
426     %attr(0644,root,root) %{_mandir}/man5*/*
427     %attr(0644,root,root) %{_mandir}/man7*/*
428    
429     %ifnarch %{optimize_arches}
430     %files devel
431     %defattr(-,root,root)
432     %{_prefix}/include/openssl
433     %attr(0644,root,root) %{_libdir}/*.a
434     %attr(0755,root,root) %{_libdir}/*.so
435     %attr(0644,root,root) %{_mandir}/man3*/*
436     %attr(0644,root,root) %{_libdir}/pkgconfig/*.pc
437    
438     %files perl
439     %defattr(-,root,root)
440     %attr(0755,root,root) %{_bindir}/c_rehash
441     %attr(0644,root,root) %{_mandir}/man1*/*.pl*
442     %dir %{_sysconfdir}/pki/tls/misc
443     %{_sysconfdir}/pki/tls/misc/*.pl
444     %endif
445    
446     %post -p /sbin/ldconfig
447    
448     %postun -p /sbin/ldconfig
449    
450     %changelog
451     * Tue Jan 28 2014 Tomas Mraz <tmraz@redhat.com> 0.9.8e-27.1
452     - replace expired GlobalSign Root CA certificate in ca-bundle.crt
453    
454     * Mon Feb 25 2013 Tomas Mraz <tmraz@redhat.com> 0.9.8e-27
455     - fix for CVE-2013-0169 - SSL/TLS CBC timing attack (#907589)
456     - fix for CVE-2013-0166 - DoS in OCSP signatures checking (#908052)
457     - enable compression only if explicitly asked for or OPENSSL_DEFAULT_ZLIB
458     environment variable is set (fixes CVE-2012-4929 #857051)
459     - use __secure_getenv() everywhere instead of getenv() (#839735)
460    
461     * Tue May 15 2012 Tomas Mraz <tmraz@redhat.com> 0.9.8e-26
462     - fix for CVE-2012-2333 - improper checking for record length in DTLS (#820686)
463    
464     * Mon Apr 23 2012 Tomas Mraz <tmraz@redhat.com> 0.9.8e-25
465     - fix for CVE-2012-2110 - memory corruption in asn1_d2i_read_bio() (#814185)
466    
467     * Mon Mar 19 2012 Tomas Mraz <tmraz@redhat.com> 0.9.8e-23
468     - fix problem with the SGC restart patch that might terminate handshake
469     incorrectly
470     - fix for CVE-2012-0884 - MMA weakness in CMS and PKCS#7 code (#802725)
471     - fix for CVE-2012-1165 - NULL read dereference on bad MIME headers (#802489)
472    
473     * Wed Jan 18 2012 Tomas Mraz <tmraz@redhat.com> 0.9.8e-22
474     - fix for CVE-2011-4108 & CVE-2012-0050 - DTLS plaintext recovery
475     vulnerability and additional DTLS fixes (#771770)
476     - fix for CVE-2011-4109 - double free in policy checks (#771771)
477     - fix for CVE-2011-4576 - uninitialized SSL 3.0 padding (#771775)
478     - fix for CVE-2011-4619 - SGC restart DoS attack (#771780)
479    
480     * Tue Oct 18 2011 Tomas Mraz <tmraz@redhat.com> 0.9.8e-21
481     - add known answer test for SHA2 algorithms (#740866)
482     - make default private key length in certificate Makefile 2048 bits
483     (can be changed with PRIVATE_KEY_BITS setting) (#745410)
484     - fix incorrect return value in parse_yesno() (#726593)
485     - added DigiCert CA certificates to ca-bundle (#735819)
486     - added a new section about error states to README.FIPS (#628976)
487    
488     * Wed May 4 2011 Tomas Mraz <tmraz@redhat.com> 0.9.8e-20
489     - add missing DH_check_pub_key() call when DH key is computed (#698175)
490    
491     * Mon Apr 4 2011 Tomas Mraz <tmraz@redhat.com> 0.9.8e-19
492     - presort list of ciphers available in SSL (#688901)
493     - accept connection in s_server even if getaddrinfo() fails (#561260)
494     - point to openssl dgst for list of supported digests (#608639)
495     - fix handling of future TLS versions (#599112)
496     - added VeriSign Class 3 Public Primary Certification Authority - G5
497     and StartCom Certification Authority certs to ca-bundle (#675671, #617856)
498     - upstream fixes for the CHIL engine (#622003, #671484)
499    
500     * Wed Mar 9 2011 Tomas Mraz <tmraz@redhat.com> 0.9.8e-18
501     - add SHA-2 hashes in SSL_library_init() (#676384)
502    
503     * Tue Dec 7 2010 Tomas Mraz <tmraz@redhat.com> 0.9.8e-17
504     - fix CVE-2010-4180 - completely disable code for
505     SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG (#659462)
506    
507     * Fri Mar 12 2010 Tomas Mraz <tmraz@redhat.com> 0.9.8e-16
508     - fix CVE-2009-3245 - add missing bn_wexpand return checks (#570924)
509    
510     * Thu Mar 4 2010 Tomas Mraz <tmraz@redhat.com> 0.9.8e-15
511     - fix CVE-2010-0433 - do not pass NULL princ to krb5_kt_get_entry which
512     in the RHEL-5 and newer versions will crash in such case (#569774)
513    
514     * Thu Feb 18 2010 Tomas Mraz <tmraz@redhat.com> 0.9.8e-14
515     - fix CVE-2009-3555 - support the safe renegotiation extension and
516     do not allow legacy renegotiation on the server by default (#533125)
517    
518     * Thu Jan 14 2010 Tomas Mraz <tmraz@redhat.com> 0.9.8e-13
519     - fix CVE-2009-2409 - drop MD2 algorithm from EVP tables (#510197)
520     - fix CVE-2009-4355 - do not leak memory when CRYPTO_cleanup_all_ex_data()
521     is called prematurely by application (#546707)
522    
523     * Mon Jun 29 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8e-12
524     - abort if selftests failed and random number generator is polled
525     - mention EVP_aes and EVP_sha2xx routines in the manpages
526     - add README.FIPS
527    
528     * Thu May 21 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8e-10
529     - fix CVE-2009-1386 CVE-2009-1387 (DTLS DoS problems)
530     (#503685, #503688)
531    
532     * Thu May 21 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8e-9
533     - fix CVE-2009-1377 CVE-2009-1378 CVE-2009-1379
534     (DTLS DoS problems) (#501253, #501254, #501572)
535    
536     * Wed Apr 15 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8e-8
537     - support multiple CRLs with same subject in a store (#457134)
538     - fix CVE-2009-0590 - reject incorrectly encoded ASN.1 strings (#492304)
539     - seed FIPS rng directly from kernel random device
540     - do not require fipscheck to build the package (#475798)
541     - call pairwise key tests in FIPS mode only (#479817)
542     - do not crash when parsing bad mime data (#472440)
543    
544     * Tue Dec 16 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8e-7
545     - fix CVE-2008-5077 - incorrect checks for malformed signatures (#476671)
546    
547     * Fri Oct 31 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8e-6
548     - allow lookup of algorithms in engine
549    
550     * Fri Oct 24 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8e-5
551     - implement the integrity checking inside libcrypto so OpenSSL
552     can be used in FIPS mode by the fipscheck library
553    
554     * Thu Oct 9 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8e-4
555     - FIPS mode kernel flag is /proc/sys/crypto/fips_enabled
556    
557     * Wed Sep 10 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8e-3
558     - disable strict aliasing
559    
560     * Tue Sep 9 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8e-2
561     - more changes for FIPS validation (#444800)
562     - correctly initialize default CA paths (#450987)
563     - allow disabling zlib support through environment (#442624)
564    
565     * Tue Jul 15 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8e-1
566     - rebase to version undergoing FIPS validation (#455634)
567    
568     * Tue Jan 15 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8b-10
569     - compile with -march=z900 on s390 for performance improvements (#250818)
570     - make ssl session ID matching strict (#233599)
571    
572     * Mon Oct 8 2007 Tomas Mraz <tmraz@redhat.com> 0.9.8b-9
573     - fix CVE-2007-3108 - side channel attack on private keys (#250581)
574     - fix CVE-2007-5135 - off-by-one in SSL_get_shared_ciphers (#309881)
575     - fix CVE-2007-4995 - out of order DTLS fragments buffer overflow (#321221)
576    
577     * Thu Nov 30 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-8.3
578     - the previous change still didn't make X509_NAME_cmp transitive
579    
580     * Thu Nov 23 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-8.2
581     - make X509_NAME_cmp transitive otherwise certificate lookup
582     is broken (#216050)
583    
584     * Fri Nov 3 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-8.1
585     - aliasing bug in engine loading, patch by IBM (#213216)
586    
587     * Mon Oct 2 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-8
588     - CVE-2006-2940 fix was incorrect (#208744)
589    
590     * Mon Sep 25 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-7
591     - fix CVE-2006-2937 - mishandled error on ASN.1 parsing (#207276)
592     - fix CVE-2006-2940 - parasitic public keys DoS (#207274)
593     - fix CVE-2006-3738 - buffer overflow in SSL_get_shared_ciphers (#206940)
594     - fix CVE-2006-4343 - sslv2 client DoS (#206940)
595    
596     * Tue Sep 5 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-6
597     - fix CVE-2006-4339 - prevent attack on PKCS#1 v1.5 signatures (#205180)
598    
599     * Wed Aug 2 2006 Tomas Mraz <tmraz@redhat.com> - 0.9.8b-5
600     - set buffering to none on stdio/stdout FILE when bufsize is set (#200580)
601     patch by IBM
602    
603     * Fri Jul 28 2006 Alexandre Oliva <aoliva@redhat.com> - 0.9.8b-4.1
604     - rebuild with new binutils (#200330)
605    
606     * Fri Jul 21 2006 Tomas Mraz <tmraz@redhat.com> - 0.9.8b-4
607     - add a temporary workaround for sha512 test failure on s390 (#199604)
608    
609     * Thu Jul 20 2006 Tomas Mraz <tmraz@redhat.com>
610     - add ipv6 support to s_client and s_server (by Jan Pazdziora) (#198737)
611     - add patches for BN threadsafety, AES cache collision attack hazard fix and
612     pkcs7 code memleak fix from upstream CVS
613    
614     * Wed Jul 12 2006 Jesse Keating <jkeating@redhat.com> - 0.9.8b-3.1
615     - rebuild
616    
617     * Wed Jun 21 2006 Tomas Mraz <tmraz@redhat.com> - 0.9.8b-3
618     - dropped libica and ica engine from build
619    
620     * Wed Jun 21 2006 Joe Orton <jorton@redhat.com>
621     - update to new CA bundle from mozilla.org; adds CA certificates
622     from netlock.hu and startcom.org
623    
624     * Mon Jun 5 2006 Tomas Mraz <tmraz@redhat.com> - 0.9.8b-2
625     - fixed a few rpmlint warnings
626     - better fix for #173399 from upstream
627     - upstream fix for pkcs12
628    
629     * Thu May 11 2006 Tomas Mraz <tmraz@redhat.com> - 0.9.8b-1
630     - upgrade to new version, stays ABI compatible
631     - there is no more linux/config.h (it was empty anyway)
632    
633     * Tue Apr 4 2006 Tomas Mraz <tmraz@redhat.com> - 0.9.8a-6
634     - fix stale open handles in libica (#177155)
635     - fix build if 'rand' or 'passwd' in buildroot path (#178782)
636     - initialize VIA Padlock engine (#186857)
637    
638     * Fri Feb 10 2006 Jesse Keating <jkeating@redhat.com> - 0.9.8a-5.2
639     - bump again for double-long bug on ppc(64)
640    
641     * Tue Feb 07 2006 Jesse Keating <jkeating@redhat.com> - 0.9.8a-5.1
642     - rebuilt for new gcc4.1 snapshot and glibc changes
643    
644     * Thu Dec 15 2005 Tomas Mraz <tmraz@redhat.com> 0.9.8a-5
645     - don't include SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
646     in SSL_OP_ALL (#175779)
647    
648     * Fri Dec 09 2005 Jesse Keating <jkeating@redhat.com>
649     - rebuilt
650    
651     * Tue Nov 29 2005 Tomas Mraz <tmraz@redhat.com> 0.9.8a-4
652     - fix build (-lcrypto was erroneusly dropped) of the updated libica
653     - updated ICA engine to 1.3.6-rc3
654    
655     * Tue Nov 22 2005 Tomas Mraz <tmraz@redhat.com> 0.9.8a-3
656     - disable builtin compression methods for now until they work
657     properly (#173399)
658    
659     * Wed Nov 16 2005 Tomas Mraz <tmraz@redhat.com> 0.9.8a-2
660     - don't set -rpath for openssl binary
661    
662     * Tue Nov 8 2005 Tomas Mraz <tmraz@redhat.com> 0.9.8a-1
663     - new upstream version
664     - patches partially renumbered
665    
666     * Fri Oct 21 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-11
667     - updated IBM ICA engine library and patch to latest upstream version
668    
669     * Wed Oct 12 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-10
670     - fix CAN-2005-2969 - remove SSL_OP_MSIE_SSLV2_RSA_PADDING which
671     disables the countermeasure against man in the middle attack in SSLv2
672     (#169863)
673     - use sha1 as default for CA and cert requests - CAN-2005-2946 (#169803)
674    
675     * Tue Aug 23 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-9
676     - add *.so.soversion as symlinks in /lib (#165264)
677     - remove unpackaged symlinks (#159595)
678     - fixes from upstream (constant time fixes for DSA,
679     bn assembler div on ppc arch, initialize memory on realloc)
680    
681     * Thu Aug 11 2005 Phil Knirsch <pknirsch@redhat.com> 0.9.7f-8
682     - Updated ICA engine IBM patch to latest upstream version.
683    
684     * Thu May 19 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-7
685     - fix CAN-2005-0109 - use constant time/memory access mod_exp
686     so bits of private key aren't leaked by cache eviction (#157631)
687     - a few more fixes from upstream 0.9.7g
688    
689     * Wed Apr 27 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-6
690     - use poll instead of select in rand (#128285)
691     - fix Makefile.certificate to point to /etc/pki/tls
692     - change the default string mask in ASN1 to PrintableString+UTF8String
693    
694     * Mon Apr 25 2005 Joe Orton <jorton@redhat.com> 0.9.7f-5
695     - update to revision 1.37 of Mozilla CA bundle
696    
697     * Thu Apr 21 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-4
698     - move certificates to _sysconfdir/pki/tls (#143392)
699     - move CA directories to _sysconfdir/pki/CA
700     - patch the CA script and the default config so it points to the
701     CA directories
702    
703     * Fri Apr 1 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-3
704     - uninitialized variable mustn't be used as input in inline
705     assembly
706     - reenable the x86_64 assembly again
707    
708     * Thu Mar 31 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-2
709     - add back RC4_CHAR on ia64 and x86_64 so the ABI isn't broken
710     - disable broken bignum assembly on x86_64
711    
712     * Wed Mar 30 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-1
713     - reenable optimizations on ppc64 and assembly code on ia64
714     - upgrade to new upstream version (no soname bump needed)
715     - disable thread test - it was testing the backport of the
716     RSA blinding - no longer needed
717     - added support for changing serial number to
718     Makefile.certificate (#151188)
719     - make ca-bundle.crt a config file (#118903)
720    
721     * Tue Mar 1 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7e-3
722     - libcrypto shouldn't depend on libkrb5 (#135961)
723    
724     * Mon Feb 28 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7e-2
725     - rebuild
726    
727     * Mon Feb 28 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7e-1
728     - new upstream source, updated patches
729     - added patch so we are hopefully ABI compatible with upcoming
730     0.9.7f
731    
732     * Thu Feb 10 2005 Tomas Mraz <tmraz@redhat.com>
733     - Support UTF-8 charset in the Makefile.certificate (#134944)
734     - Added cmp to BuildPrereq
735    
736     * Thu Jan 27 2005 Joe Orton <jorton@redhat.com> 0.9.7a-46
737     - generate new ca-bundle.crt from Mozilla certdata.txt (revision 1.32)
738    
739     * Thu Dec 23 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-45
740     - Fixed and updated libica-1.3.4-urandom.patch patch (#122967)
741    
742     * Fri Nov 19 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-44
743     - rebuild
744    
745     * Fri Nov 19 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-43
746     - rebuild
747    
748     * Fri Nov 19 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-42
749     - rebuild
750    
751     * Fri Nov 19 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-41
752     - remove der_chop, as upstream cvs has done (CAN-2004-0975, #140040)
753    
754     * Tue Oct 05 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-40
755     - Include latest libica version with important bugfixes
756    
757     * Tue Jun 15 2004 Elliot Lee <sopwith@redhat.com>
758     - rebuilt
759    
760     * Mon Jun 14 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-38
761     - Updated ICA engine IBM patch to latest upstream version.
762    
763     * Mon Jun 7 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-37
764     - build for linux-alpha-gcc instead of alpha-gcc on alpha (Jeff Garzik)
765    
766     * Tue May 25 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-36
767     - handle %%{_arch}=i486/i586/i686/athlon cases in the intermediate
768     header (#124303)
769    
770     * Thu Mar 25 2004 Joe Orton <jorton@redhat.com> 0.9.7a-35
771     - add security fixes for CAN-2004-0079, CAN-2004-0112
772    
773     * Tue Mar 16 2004 Phil Knirsch <pknirsch@redhat.com>
774     - Fixed libica filespec.
775    
776     * Thu Mar 10 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-34
777     - ppc/ppc64 define __powerpc__/__powerpc64__, not __ppc__/__ppc64__, fix
778     the intermediate header
779    
780     * Wed Mar 10 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-33
781     - add an intermediate <openssl/opensslconf.h> which points to the right
782     arch-specific opensslconf.h on multilib arches
783    
784     * Tue Mar 02 2004 Elliot Lee <sopwith@redhat.com>
785     - rebuilt
786    
787     * Thu Feb 26 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-32
788     - Updated libica to latest upstream version 1.3.5.
789    
790     * Tue Feb 17 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-31
791     - Update ICA crypto engine patch from IBM to latest version.
792    
793     * Fri Feb 13 2004 Elliot Lee <sopwith@redhat.com>
794     - rebuilt
795    
796     * Fri Feb 13 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-29
797     - rebuilt
798    
799     * Wed Feb 11 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-28
800     - Fixed libica build.
801    
802     * Wed Feb 4 2004 Nalin Dahyabhai <nalin@redhat.com>
803     - add "-ldl" to link flags added for Linux-on-ARM (#99313)
804    
805     * Wed Feb 4 2004 Joe Orton <jorton@redhat.com> 0.9.7a-27
806     - updated ca-bundle.crt: removed expired GeoTrust roots, added
807     freessl.com root, removed trustcenter.de Class 0 root
808    
809     * Sun Nov 30 2003 Tim Waugh <twaugh@redhat.com> 0.9.7a-26
810     - Fix link line for libssl (bug #111154).
811    
812     * Fri Oct 24 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-25
813     - add dependency on zlib-devel for the -devel package, which depends on zlib
814     symbols because we enable zlib for libssl (#102962)
815    
816     * Fri Oct 24 2003 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-24
817     - Use /dev/urandom instead of PRNG for libica.
818     - Apply libica-1.3.5 fix for /dev/urandom in icalinux.c
819     - Use latest ICA engine patch from IBM.
820    
821     * Sat Oct 4 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-22.1
822     - rebuild
823    
824     * Wed Oct 1 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-22
825     - rebuild (22 wasn't actually built, fun eh?)
826    
827     * Tue Sep 30 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-23
828     - re-disable optimizations on ppc64
829    
830     * Tue Sep 30 2003 Joe Orton <jorton@redhat.com>
831     - add a_mbstr.c fix for 64-bit platforms from CVS
832    
833     * Tue Sep 30 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-22
834     - add -Wa,--noexecstack to RPM_OPT_FLAGS so that assembled modules get tagged
835     as not needing executable stacks
836    
837     * Mon Sep 29 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-21
838     - rebuild
839    
840     * Thu Sep 25 2003 Nalin Dahyabhai <nalin@redhat.com>
841     - re-enable optimizations on ppc64
842    
843     * Thu Sep 25 2003 Nalin Dahyabhai <nalin@redhat.com>
844     - remove exclusivearch
845    
846     * Wed Sep 24 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-20
847     - only parse a client cert if one was requested
848     - temporarily exclusivearch for %%{ix86}
849    
850     * Tue Sep 23 2003 Nalin Dahyabhai <nalin@redhat.com>
851     - add security fixes for protocol parsing bugs (CAN-2003-0543, CAN-2003-0544)
852     and heap corruption (CAN-2003-0545)
853     - update RHNS-CA-CERT files
854     - ease back on the number of threads used in the threading test
855    
856     * Wed Sep 17 2003 Matt Wilson <msw@redhat.com> 0.9.7a-19
857     - rebuild to fix gzipped file md5sums (#91211)
858    
859     * Mon Aug 25 2003 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-18
860     - Updated libica to version 1.3.4.
861    
862     * Thu Jul 17 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-17
863     - rebuild
864    
865     * Tue Jul 15 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-10.9
866     - free the kssl_ctx structure when we free an SSL structure (#99066)
867    
868     * Fri Jul 10 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-16
869     - rebuild
870    
871     * Thu Jul 10 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-15
872     - lower thread test count on s390x
873    
874     * Tue Jul 8 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-14
875     - rebuild
876    
877     * Thu Jun 26 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-13
878     - disable assembly on arches where it seems to conflict with threading
879    
880     * Thu Jun 26 2003 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-12
881     - Updated libica to latest upstream version 1.3.0
882    
883     * Wed Jun 11 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-9.9
884     - rebuild
885    
886     * Wed Jun 11 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-11
887     - rebuild
888    
889     * Tue Jun 10 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-10
890     - ubsec: don't stomp on output data which might also be input data
891    
892     * Tue Jun 10 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-9
893     - temporarily disable optimizations on ppc64
894    
895     * Mon Jun 9 2003 Nalin Dahyabhai <nalin@redhat.com>
896     - backport fix for engine-used-for-everything from 0.9.7b
897     - backport fix for prng not being seeded causing problems, also from 0.9.7b
898     - add a check at build-time to ensure that RSA is thread-safe
899     - keep perlpath from stomping on the libica configure scripts
900    
901     * Fri Jun 6 2003 Nalin Dahyabhai <nalin@redhat.com>
902     - thread-safety fix for RSA blinding
903    
904     * Wed Jun 04 2003 Elliot Lee <sopwith@redhat.com> 0.9.7a-8
905     - rebuilt
906    
907     * Fri May 30 2003 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-7
908     - Added libica-1.2 to openssl (featurerequest).
909    
910     * Wed Apr 16 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-6
911     - fix building with incorrect flags on ppc64
912    
913     * Wed Mar 19 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-5
914     - add patch to harden against Klima-Pokorny-Rosa extension of Bleichenbacher's
915     attack (CAN-2003-0131)
916    
917     * Mon Mar 17 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-4
918     - add patch to enable RSA blinding by default, closing a timing attack
919     (CAN-2003-0147)
920    
921     * Wed Mar 5 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-3
922     - disable use of BN assembly module on x86_64, but continue to allow inline
923     assembly (#83403)
924    
925     * Thu Feb 27 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-2
926     - disable EC algorithms
927    
928     * Wed Feb 19 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-1
929     - update to 0.9.7a
930    
931     * Wed Feb 19 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7-8
932     - add fix to guard against attempts to allocate negative amounts of memory
933     - add patch for CAN-2003-0078, fixing a timing attack
934    
935     * Thu Feb 13 2003 Elliot Lee <sopwith@redhat.com> 0.9.7-7
936     - Add openssl-ppc64.patch
937    
938     * Mon Feb 10 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7-6
939     - EVP_DecryptInit should call EVP_CipherInit() instead of EVP_CipherInit_ex(),
940     to get the right behavior when passed uninitialized context structures
941     (#83766)
942     - build with -mcpu=ev5 on alpha family (#83828)
943    
944     * Wed Jan 22 2003 Tim Powers <timp@redhat.com>
945     - rebuilt
946    
947     * Fri Jan 17 2003 Phil Knirsch <pknirsch@redhat.com> 0.9.7-4
948     - Added IBM hw crypto support patch.
949    
950     * Wed Jan 15 2003 Nalin Dahyabhai <nalin@redhat.com>
951     - add missing builddep on sed
952    
953     * Thu Jan 9 2003 Bill Nottingham <notting@redhat.com> 0.9.7-3
954     - debloat
955     - fix broken manpage symlinks
956    
957     * Wed Jan 8 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7-2
958     - fix double-free in 'openssl ca'
959    
960     * Fri Jan 3 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7-1
961     - update to 0.9.7 final
962    
963     * Tue Dec 17 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.7-0
964     - update to 0.9.7 beta6 (DO NOT USE UNTIL UPDATED TO FINAL 0.9.7)
965    
966     * Wed Dec 11 2002 Nalin Dahyabhai <nalin@redhat.com>
967     - update to 0.9.7 beta5 (DO NOT USE UNTIL UPDATED TO FINAL 0.9.7)
968    
969     * Tue Oct 22 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-30
970     - add configuration stanza for x86_64 and use it on x86_64
971     - build for linux-ppc on ppc
972     - start running the self-tests again
973    
974     * Wed Oct 02 2002 Elliot Lee <sopwith@redhat.com> 0.9.6b-29hammer.3
975     - Merge fixes from previous hammer packages, including general x86-64 and
976     multilib
977    
978     * Tue Aug 6 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-29
979     - rebuild
980    
981     * Thu Aug 1 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-28
982     - update asn patch to fix accidental reversal of a logic check
983    
984     * Wed Jul 31 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-27
985     - update asn patch to reduce chance that compiler optimization will remove
986     one of the added tests
987    
988     * Wed Jul 31 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-26
989     - rebuild
990    
991     * Mon Jul 29 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-25
992     - add patch to fix ASN.1 vulnerabilities
993    
994     * Thu Jul 25 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-24
995     - add backport of Ben Laurie's patches for OpenSSL 0.9.6d
996    
997     * Wed Jul 17 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-23
998     - own %{_datadir}/ssl/misc
999    
1000     * Fri Jun 21 2002 Tim Powers <timp@redhat.com>
1001     - automated rebuild
1002    
1003     * Sun May 26 2002 Tim Powers <timp@redhat.com>
1004     - automated rebuild
1005    
1006     * Fri May 17 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-20
1007     - free ride through the build system (whee!)
1008    
1009     * Thu May 16 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-19
1010     - rebuild in new environment
1011    
1012     * Thu Apr 4 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-17, 0.9.6b-18
1013     - merge RHL-specific bits into stronghold package, rename
1014    
1015     * Tue Apr 02 2002 Gary Benson <gbenson@redhat.com> stronghold-0.9.6c-2
1016     - add support for Chrysalis Luna token
1017    
1018     * Tue Mar 26 2002 Gary Benson <gbenson@redhat.com>
1019     - disable AEP random number generation, other AEP fixes
1020    
1021     * Fri Mar 15 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-15
1022     - only build subpackages on primary arches
1023    
1024     * Thu Mar 14 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-13
1025     - on ia32, only disable use of assembler on i386
1026     - enable assembly on ia64
1027    
1028     * Mon Jan 7 2002 Florian La Roche <Florian.LaRoche@redhat.de> 0.9.6b-11
1029     - fix sparcv9 entry
1030    
1031     * Mon Jan 7 2002 Gary Benson <gbenson@redhat.com> stronghold-0.9.6c-1
1032     - upgrade to 0.9.6c
1033     - bump BuildArch to i686 and enable assembler on all platforms
1034     - synchronise with shrimpy and rawhide
1035     - bump soversion to 3
1036    
1037     * Wed Oct 10 2001 Florian La Roche <Florian.LaRoche@redhat.de>
1038     - delete BN_LLONG for s390x, patch from Oliver Paukstadt
1039    
1040     * Mon Sep 17 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-9
1041     - update AEP driver patch
1042    
1043     * Mon Sep 10 2001 Nalin Dahyabhai <nalin@redhat.com>
1044     - adjust RNG disabling patch to match version of patch from Broadcom
1045    
1046     * Fri Sep 7 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-8
1047     - disable the RNG in the ubsec engine driver
1048    
1049     * Tue Aug 28 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-7
1050     - tweaks to the ubsec engine driver
1051    
1052     * Fri Aug 24 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-6
1053     - tweaks to the ubsec engine driver
1054    
1055     * Thu Aug 23 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-5
1056     - update ubsec engine driver from Broadcom
1057    
1058     * Fri Aug 10 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-4
1059     - move man pages back to %%{_mandir}/man?/foo.?ssl from
1060     %%{_mandir}/man?ssl/foo.?
1061     - add an [ engine ] section to the default configuration file
1062    
1063     * Thu Aug 9 2001 Nalin Dahyabhai <nalin@redhat.com>
1064     - add a patch for selecting a default engine in SSL_library_init()
1065    
1066     * Mon Jul 23 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-3
1067     - add patches for AEP hardware support
1068     - add patch to keep trying when we fail to load a cert from a file and
1069     there are more in the file
1070     - add missing prototype for ENGINE_ubsec() in engine_int.h
1071    
1072     * Wed Jul 18 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-2
1073     - actually add hw_ubsec to the engine list
1074    
1075     * Tue Jul 17 2001 Nalin Dahyabhai <nalin@redhat.com>
1076     - add in the hw_ubsec driver from CVS
1077    
1078     * Wed Jul 11 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-1
1079     - update to 0.9.6b
1080    
1081     * Thu Jul 5 2001 Nalin Dahyabhai <nalin@redhat.com>
1082     - move .so symlinks back to %%{_libdir}
1083    
1084     * Tue Jul 3 2001 Nalin Dahyabhai <nalin@redhat.com>
1085     - move shared libraries to /lib (#38410)
1086    
1087     * Mon Jun 25 2001 Nalin Dahyabhai <nalin@redhat.com>
1088     - switch to engine code base
1089    
1090     * Mon Jun 18 2001 Nalin Dahyabhai <nalin@redhat.com>
1091     - add a script for creating dummy certificates
1092     - move man pages from %%{_mandir}/man?/foo.?ssl to %%{_mandir}/man?ssl/foo.?
1093    
1094     * Thu Jun 07 2001 Florian La Roche <Florian.LaRoche@redhat.de>
1095     - add s390x support
1096    
1097     * Fri Jun 1 2001 Nalin Dahyabhai <nalin@redhat.com>
1098     - change two memcpy() calls to memmove()
1099     - don't define L_ENDIAN on alpha
1100    
1101     * Wed May 23 2001 Joe Orton <jorton@redhat.com> stronghold-0.9.6a-1
1102     - Add 'stronghold-' prefix to package names.
1103     - Obsolete standard openssl packages.
1104    
1105     * Wed May 16 2001 Joe Orton <jorton@redhat.com>
1106     - Add BuildArch: i586 as per Nalin's advice.
1107    
1108     * Tue May 15 2001 Joe Orton <jorton@redhat.com>
1109     - Enable assembler on ix86 (using new .tar.bz2 which does
1110     include the asm directories).
1111    
1112     * Tue May 15 2001 Nalin Dahyabhai <nalin@redhat.com>
1113     - make subpackages depend on the main package
1114    
1115     * Tue May 1 2001 Nalin Dahyabhai <nalin@redhat.com>
1116     - adjust the hobble script to not disturb symlinks in include/ (fix from
1117     Joe Orton)
1118    
1119     * Fri Apr 26 2001 Nalin Dahyabhai <nalin@redhat.com>
1120     - drop the m2crypo patch we weren't using
1121    
1122     * Tue Apr 24 2001 Nalin Dahyabhai <nalin@redhat.com>
1123     - configure using "shared" as well
1124    
1125     * Sun Apr 8 2001 Nalin Dahyabhai <nalin@redhat.com>
1126     - update to 0.9.6a
1127     - use the build-shared target to build shared libraries
1128     - bump the soversion to 2 because we're no longer compatible with
1129     our 0.9.5a packages or our 0.9.6 packages
1130     - drop the patch for making rsatest a no-op when rsa null support is used
1131     - put all man pages into <section>ssl instead of <section>
1132     - break the m2crypto modules into a separate package
1133    
1134     * Tue Mar 13 2001 Nalin Dahyabhai <nalin@redhat.com>
1135     - use BN_LLONG on s390
1136    
1137     * Mon Mar 12 2001 Nalin Dahyabhai <nalin@redhat.com>
1138     - fix the s390 changes for 0.9.6 (isn't supposed to be marked as 64-bit)
1139    
1140     * Sat Mar 3 2001 Nalin Dahyabhai <nalin@redhat.com>
1141     - move c_rehash to the perl subpackage, because it's a perl script now
1142    
1143     * Fri Mar 2 2001 Nalin Dahyabhai <nalin@redhat.com>
1144     - update to 0.9.6
1145     - enable MD2
1146     - use the libcrypto.so and libssl.so targets to build shared libs with
1147     - bump the soversion to 1 because we're no longer compatible with any of
1148     the various 0.9.5a packages circulating around, which provide lib*.so.0
1149    
1150     * Wed Feb 28 2001 Florian La Roche <Florian.LaRoche@redhat.de>
1151     - change hobble-openssl for disabling MD2 again
1152    
1153     * Tue Feb 27 2001 Nalin Dahyabhai <nalin@redhat.com>
1154     - re-disable MD2 -- the EVP_MD_CTX structure would grow from 100 to 152
1155     bytes or so, causing EVP_DigestInit() to zero out stack variables in
1156     apps built against a version of the library without it
1157    
1158     * Mon Feb 26 2001 Nalin Dahyabhai <nalin@redhat.com>
1159     - disable some inline assembly, which on x86 is Pentium-specific
1160     - re-enable MD2 (see http://www.ietf.org/ietf/IPR/RSA-MD-all)
1161    
1162     * Thu Feb 08 2001 Florian La Roche <Florian.LaRoche@redhat.de>
1163     - fix s390 patch
1164    
1165     * Fri Dec 8 2000 Than Ngo <than@redhat.com>
1166     - added support s390
1167    
1168     * Mon Nov 20 2000 Nalin Dahyabhai <nalin@redhat.com>
1169     - remove -Wa,* and -m* compiler flags from the default Configure file (#20656)
1170     - add the CA.pl man page to the perl subpackage
1171    
1172     * Thu Nov 2 2000 Nalin Dahyabhai <nalin@redhat.com>
1173     - always build with -mcpu=ev5 on alpha
1174    
1175     * Tue Oct 31 2000 Nalin Dahyabhai <nalin@redhat.com>
1176     - add a symlink from cert.pem to ca-bundle.crt
1177    
1178     * Wed Oct 25 2000 Nalin Dahyabhai <nalin@redhat.com>
1179     - add a ca-bundle file for packages like Samba to reference for CA certificates
1180    
1181     * Tue Oct 24 2000 Nalin Dahyabhai <nalin@redhat.com>
1182     - remove libcrypto's crypt(), which doesn't handle md5crypt (#19295)
1183    
1184     * Mon Oct 2 2000 Nalin Dahyabhai <nalin@redhat.com>
1185     - add unzip as a buildprereq (#17662)
1186     - update m2crypto to 0.05-snap4
1187    
1188     * Tue Sep 26 2000 Bill Nottingham <notting@redhat.com>
1189     - fix some issues in building when it's not installed
1190    
1191     * Wed Sep 6 2000 Nalin Dahyabhai <nalin@redhat.com>
1192     - make sure the headers we include are the ones we built with (aaaaarrgh!)
1193    
1194     * Fri Sep 1 2000 Nalin Dahyabhai <nalin@redhat.com>
1195     - add Richard Henderson's patch for BN on ia64
1196     - clean up the changelog
1197    
1198     * Tue Aug 29 2000 Nalin Dahyabhai <nalin@redhat.com>
1199     - fix the building of python modules without openssl-devel already installed
1200    
1201     * Wed Aug 23 2000 Nalin Dahyabhai <nalin@redhat.com>
1202     - byte-compile python extensions without the build-root
1203     - adjust the makefile to not remove temporary files (like .key files when
1204     building .csr files) by marking them as .PRECIOUS
1205    
1206     * Sat Aug 19 2000 Nalin Dahyabhai <nalin@redhat.com>
1207     - break out python extensions into a subpackage
1208    
1209     * Mon Jul 17 2000 Nalin Dahyabhai <nalin@redhat.com>
1210     - tweak the makefile some more
1211    
1212     * Tue Jul 11 2000 Nalin Dahyabhai <nalin@redhat.com>
1213     - disable MD2 support
1214    
1215     * Thu Jul 6 2000 Nalin Dahyabhai <nalin@redhat.com>
1216     - disable MDC2 support
1217    
1218     * Sun Jul 2 2000 Nalin Dahyabhai <nalin@redhat.com>
1219     - tweak the disabling of RC5, IDEA support
1220     - tweak the makefile
1221    
1222     * Thu Jun 29 2000 Nalin Dahyabhai <nalin@redhat.com>
1223     - strip binaries and libraries
1224     - rework certificate makefile to have the right parts for Apache
1225    
1226     * Wed Jun 28 2000 Nalin Dahyabhai <nalin@redhat.com>
1227     - use %%{_perl} instead of /usr/bin/perl
1228     - disable alpha until it passes its own test suite
1229    
1230     * Fri Jun 9 2000 Nalin Dahyabhai <nalin@redhat.com>
1231     - move the passwd.1 man page out of the passwd package's way
1232    
1233     * Fri Jun 2 2000 Nalin Dahyabhai <nalin@redhat.com>
1234     - update to 0.9.5a, modified for U.S.
1235     - add perl as a build-time requirement
1236     - move certificate makefile to another package
1237     - disable RC5, IDEA, RSA support
1238     - remove optimizations for now
1239    
1240     * Wed Mar 1 2000 Florian La Roche <Florian.LaRoche@redhat.de>
1241     - Bero told me to move the Makefile into this package
1242    
1243     * Wed Mar 1 2000 Florian La Roche <Florian.LaRoche@redhat.de>
1244     - add lib*.so symlinks to link dynamically against shared libs
1245    
1246     * Tue Feb 29 2000 Florian La Roche <Florian.LaRoche@redhat.de>
1247     - update to 0.9.5
1248     - run ldconfig directly in post/postun
1249     - add FAQ
1250    
1251     * Sat Dec 18 1999 Bernhard Rosenkrdnzer <bero@redhat.de>
1252     - Fix build on non-x86 platforms
1253    
1254     * Fri Nov 12 1999 Bernhard Rosenkrdnzer <bero@redhat.de>
1255     - move /usr/share/ssl/* from -devel to main package
1256    
1257     * Tue Oct 26 1999 Bernhard Rosenkrdnzer <bero@redhat.de>
1258     - inital packaging
1259     - changes from base:
1260     - Move /usr/local/ssl to /usr/share/ssl for FHS compliance
1261     - handle RPM_OPT_FLAGS

admin@koozali.org
ViewVC Help
Powered by ViewVC 1.2.1 RSS 2.0 feed