/[smeserver]/rpms/openssl/sme8/openssl.spec
ViewVC logotype

Annotation of /rpms/openssl/sme8/openssl.spec

Parent Directory Parent Directory | Revision Log Revision Log | View Revision Graph Revision Graph


Revision 1.6 - (hide annotations) (download)
Thu Jan 15 07:29:00 2015 UTC (9 years, 9 months ago) by vip-ire
Branch: MAIN
Changes since 1.5: +11 -6 lines
* Thu Jan 15 2015 Daniel Berteaud <daniel@firewall-services.com 0.9.8e-32.1
- update with ca-bundle.crt from SME 9 [SME: 8799]

1 wellsi 1.1 # For the curious:
2     # 0.9.5a soversion = 0
3     # 0.9.6 soversion = 1
4     # 0.9.6a soversion = 2
5     # 0.9.6c soversion = 3
6     # 0.9.7a soversion = 4
7     # 0.9.7ef soversion = 5
8     # 0.9.8abe soversion = 6
9     %define soversion 6
10    
11     # Number of threads to spawn when testing some threading fixes.
12     %define thread_test_threads %{?threads:%{threads}}%{!?threads:1}
13    
14     # Arches on which we need to prevent arch conflicts on opensslconf.h, must
15     # also be handled in opensslconf-new.h.
16     %define multilib_arches %{ix86} ia64 ppc ppc64 s390 s390x x86_64
17    
18     # Arches for which we don't build subpackages.
19     %define optimize_arches i686
20    
21     Summary: The OpenSSL toolkit
22     Name: openssl
23     Version: 0.9.8e
24 vip-ire 1.6 Release: 32.1%{?dist}
25 wellsi 1.1 # The tarball is based on the openssl-fips-1.2.0-test.tar.gz tarball
26     Source: openssl-fips-%{version}-usa.tar.bz2
27     Source1: hobble-openssl
28     Source2: Makefile.certificate
29     Source3: ca-bundle.crt
30     Source4: https://rhn.redhat.com/help/RHNS-CA-CERT
31     Source5: https://rhn.redhat.com/help/RHNS-CA-CERT.asc
32     Source6: make-dummy-cert
33     Source8: openssl-thread-test.c
34     Source9: opensslconf-new.h
35     Source10: opensslconf-new-warning.h
36     Source11: README.FIPS
37     # Build changes
38     Patch0: openssl-fips-0.9.8e-redhat.patch
39     Patch1: openssl-0.9.8a-defaults.patch
40     Patch2: openssl-0.9.8a-link-krb5.patch
41     Patch3: openssl-0.9.8b-soversion.patch
42     Patch4: openssl-0.9.8a-enginesdir.patch
43     Patch5: openssl-0.9.8a-no-rpath.patch
44     # Functionality changes
45     Patch32: openssl-0.9.7-beta6-ia64.patch
46     Patch33: openssl-0.9.7f-ca-dir.patch
47     Patch34: openssl-0.9.6-x509.patch
48     Patch35: openssl-0.9.7-beta5-version-add-engines.patch
49     Patch38: openssl-0.9.8a-reuse-cipher-change.patch
50     Patch39: openssl-0.9.8b-ipv6-apps.patch
51     # Backported fixes including security fixes
52     Patch61: openssl-0.9.8b-aliasing-bug.patch
53     Patch62: openssl-0.9.8b-x509-name-cmp.patch
54     Patch64: openssl-fips-0.9.8e-dtls-fixes.patch
55     Patch65: openssl-0.9.8b-cve-2007-5135.patch
56     Patch67: openssl-fips-0.9.8e-aescfb.patch
57     Patch68: openssl-fips-0.9.8e-abi.patch
58     Patch69: openssl-fips-0.9.8e-fipsmode.patch
59     Patch70: openssl-fips-0.9.8e-bn-fixes.patch
60     Patch71: openssl-fips-0.9.8e-use-fipscheck.patch
61     Patch72: openssl-fips-0.9.8e-env-zlib.patch
62     Patch73: openssl-fips-0.9.8e-default-paths.patch
63     Patch74: openssl-fips-0.9.8e-evp-nonfips.patch
64     Patch75: openssl-fips-0.9.8e-cve-2008-5077.patch
65     Patch76: openssl-fips-0.9.8e-multi-crl.patch
66     Patch77: openssl-fips-0.9.8e-no-pairwise.patch
67     Patch78: openssl-fips-0.9.8e-rng-seed.patch
68     Patch79: openssl-fips-0.9.8e-bad-mime.patch
69     Patch80: openssl-fips-0.9.8e-cve-2009-0590.patch
70     Patch81: openssl-fips-0.9.8e-dtls-dos.patch
71     Patch82: openssl-fips-0.9.8e-algo-doc.patch
72     Patch83: openssl-fips-0.9.8e-cve-2009-2409.patch
73     Patch84: openssl-fips-0.9.8e-cve-2009-4355.patch
74     Patch85: openssl-fips-0.9.8e-cve-2009-3555.patch
75     Patch86: openssl-fips-0.9.8e-cve-2010-0433.patch
76     Patch87: openssl-fips-0.9.8e-cve-2009-3245.patch
77     Patch88: openssl-fips-0.9.8e-cve-2010-4180.patch
78     Patch89: openssl-fips-0.9.8e-ssl-sha256.patch
79     Patch90: openssl-fips-0.9.8e-ciph-sort.patch
80     Patch91: openssl-fips-0.9.8e-apps-dgst.patch
81     Patch92: openssl-fips-0.9.8e-tls-version.patch
82     Patch93: openssl-fips-0.9.8e-chil-fixes.patch
83     Patch94: openssl-fips-0.9.8e-dh-check.patch
84     Patch95: openssl-fips-0.9.8e-sha2test.patch
85     Patch96: openssl-fips-0.9.8e-apps-yesno.patch
86     Patch97: openssl-fips-0.9.8e-dtls-fixes2.patch
87     Patch98: openssl-fips-0.9.8e-cve-2011-4109.patch
88     Patch99: openssl-fips-0.9.8e-cve-2011-4576.patch
89     Patch100: openssl-fips-0.9.8e-cve-2011-4619.patch
90     Patch101: openssl-fips-0.9.8e-cve-2012-0884.patch
91     Patch102: openssl-fips-0.9.8e-cve-2012-1165.patch
92     Patch103: openssl-fips-0.9.8e-cve-2012-2110.patch
93     Patch104: openssl-fips-0.9.8e-cve-2012-2333.patch
94     Patch105: openssl-fips-0.9.8e-secure-getenv.patch
95     Patch106: openssl-fips-0.9.8e-cve-2013-0166.patch
96     Patch107: openssl-fips-0.9.8e-cve-2013-0169.patch
97 charliebrady 1.3 Patch108: openssl-fips-0.9.8e-cve-2014-0224.patch
98     Patch109: openssl-fips-0.9.8e-cve-2014-0221.patch
99     Patch110: openssl-fips-0.9.8e-cve-2014-3505.patch
100     Patch111: openssl-fips-0.9.8e-cve-2014-3506.patch
101     Patch112: openssl-fips-0.9.8e-cve-2014-3508.patch
102     Patch113: openssl-fips-0.9.8e-cve-2014-3510.patch
103 vip-ire 1.5 Patch114: openssl-fips-0.9.8e-fallback-scsv.patch
104 vip-ire 1.6 Patch115: openssl-fips-0.9.8e-x509-store-lock.patch
105 wellsi 1.1
106     License: BSDish
107     Group: System Environment/Libraries
108     URL: http://www.openssl.org/
109     BuildRoot: %{_tmppath}/%{name}-%{version}-root
110     BuildRequires: mktemp, krb5-devel, perl, sed, zlib-devel, /usr/bin/cmp
111     Requires: mktemp
112    
113     %description
114     The OpenSSL toolkit provides support for secure communications between
115     machines. OpenSSL includes a certificate management tool and shared
116     libraries which provide various cryptographic algorithms and
117     protocols.
118    
119     %package devel
120     Summary: Files for development of applications which will use OpenSSL
121     Group: Development/Libraries
122     Requires: %{name} = %{version}-%{release}, krb5-devel, zlib-devel
123    
124     %description devel
125     OpenSSL is a toolkit for supporting cryptography. The openssl-devel
126     package contains static libraries and include files needed to develop
127     applications which support various cryptographic algorithms and
128     protocols.
129    
130     %package perl
131     Summary: Perl scripts provided with OpenSSL
132     Group: Applications/Internet
133     Requires: perl
134     Requires: %{name} = %{version}-%{release}
135    
136     %description perl
137     OpenSSL is a toolkit for supporting cryptography. The openssl-perl
138     package provides Perl scripts for converting certificates and keys
139     from other formats to the formats used by the OpenSSL toolkit.
140    
141     %prep
142     %setup -q -n %{name}-fips-%{version}
143    
144     %{SOURCE1} > /dev/null
145     %patch0 -p1 -b .redhat
146     %patch1 -p1 -b .defaults
147     # Fix link line for libssl (bug #111154).
148     %patch2 -p1 -b .krb5
149     %patch3 -p1 -b .soversion
150     %patch4 -p1 -b .enginesdir
151     %patch5 -p1 -b .no-rpath
152    
153    
154     %patch32 -p1 -b .ia64
155     #patch33 is applied after make test
156     %patch34 -p1 -b .x509
157     %patch35 -p1 -b .version-add-engines
158     %patch38 -p1 -b .cipher-change
159     %patch39 -p1 -b .ipv6-apps
160    
161     %patch61 -p1 -b .aliasing-bug
162     %patch62 -p1 -b .name-cmp
163     %patch64 -p1 -b .dtls-fixes
164     %patch65 -p1 -b .shciphers
165     %patch67 -p1 -b .aescfb
166     %patch68 -p1 -b .abi
167     %patch69 -p1 -b .fipsmode
168     %patch70 -p1 -b .bn-fixes
169     %patch71 -p1 -b .use-fipscheck
170     %patch72 -p1 -b .env-zlib
171     %patch73 -p1 -b .default-paths
172     %patch74 -p1 -b .nonfips
173     %patch75 -p1 -b .verifysig
174     %patch76 -p1 -b .multi-crl
175     %patch77 -p1 -b .no-pairwise
176     %patch78 -p1 -b .rng-seed
177     %patch79 -p1 -b .bad-mime
178     %patch80 -p1 -b .bad-string
179     %patch81 -p1 -b .dtls-dos
180     %patch82 -p1 -b .algo-doc
181     %patch83 -p1 -b .nomd2
182     %patch84 -p1 -b .compleak
183     %patch85 -p1 -b .reneg
184     %patch86 -p1 -b .nullprinc
185     %patch87 -p1 -b .wexpand
186     %patch88 -p1 -b .disable-nsbug
187     %patch89 -p1 -b .sha256
188     %patch90 -p1 -b .sort
189     %patch91 -p1 -b .dgst
190     %patch92 -p1 -b .tlsver
191     %patch93 -p1 -b .chil
192     %patch94 -p1 -b .dh-check
193     %patch95 -p1 -b .sha2test
194     %patch96 -p1 -b .yesno
195     %patch97 -p1 -b .dtls-fixes2
196     %patch98 -p1 -b .doublefree
197     %patch99 -p1 -b .padding
198     %patch100 -p1 -b .sgc-dos
199     %patch101 -p1 -b .cms-mma
200     %patch102 -p1 -b .bad-mime2
201     %patch103 -p1 -b .biobuf
202     %patch104 -p1 -b .reclen
203     %patch105 -p1 -b .secure-getenv
204     %patch106 -p1 -b .ocsp-dos
205     %patch107 -p1 -b .lucky13
206 charliebrady 1.3 %patch108 -p1 -b .keying-mitm
207     %patch109 -p1 -b .dtls-recursion
208     %patch110 -p1 -b .dtls-doublefree
209     %patch111 -p1 -b .dtls-sizechecks
210     %patch112 -p1 -b .oid-handling
211     %patch113 -p1 -b .adh-dos
212 vip-ire 1.5 %patch114 -p1 -b .fallback-scsv
213 vip-ire 1.6 %patch115 -p1 -b .lock
214 wellsi 1.1
215     # Modify the various perl scripts to reference perl in the right location.
216     perl util/perlpath.pl `dirname %{__perl}`
217    
218     # Generate a table with the compile settings for my perusal.
219     touch Makefile
220     make TABLE PERL=%{__perl}
221    
222     %build
223     # Figure out which flags we want to use.
224     # default
225     sslarch=%{_os}-%{_arch}
226     %ifarch %ix86
227     sslarch=linux-elf
228     if ! echo %{_target} | grep -q i686 ; then
229     sslflags="no-asm 386"
230     fi
231     %endif
232     %ifarch sparc
233     sslarch=linux-sparcv9
234     sslflags=no-asm
235     %endif
236     %ifarch alpha
237     sslarch=linux-alpha-gcc
238     %endif
239     %ifarch s390
240     # The -fno-regmove is a workaround for bug #199604
241     sslarch="linux-generic32 -DB_ENDIAN -DNO_ASM -march=z900 -fno-regmove"
242     %endif
243     %ifarch s390x
244     sslarch="linux-generic64 -DB_ENDIAN -DNO_ASM"
245     %endif
246     # ia64, x86_64, ppc, ppc64 are OK by default
247     # Configure the build tree. Override OpenSSL defaults with known-good defaults
248     # usable on all platforms. The Configure script already knows to use -fPIC and
249     # RPM_OPT_FLAGS, so we can skip specifiying them here.
250     ./Configure \
251     --prefix=%{_prefix} --openssldir=%{_sysconfdir}/pki/tls ${sslflags} \
252     zlib no-idea no-mdc2 no-rc5 no-ec no-ecdh no-ecdsa shared \
253     --with-krb5-flavor=MIT --enginesdir=%{_libdir}/openssl/engines \
254     -I%{_prefix}/kerberos/include -L%{_prefix}/kerberos/%{_lib} \
255     ${sslarch} fipscanisterbuild
256    
257     # Add -Wa,--noexecstack here so that libcrypto's assembler modules will be
258     # marked as not requiring an executable stack.
259     RPM_OPT_FLAGS="$RPM_OPT_FLAGS -Wa,--noexecstack -DOPENSSL_USE_NEW_FUNCTIONS -fno-strict-aliasing"
260     make depend
261     make all
262    
263     # Generate hashes for the included certs.
264     make rehash
265    
266     # Overwrite FIPS README
267     cp -f %{SOURCE11} .
268    
269     # Verify that what was compiled actually works.
270     LD_LIBRARY_PATH=`pwd`${LD_LIBRARY_PATH:+:${LD_LIBRARY_PATH}}
271     export LD_LIBRARY_PATH
272     make -C test apps tests
273     %{__cc} -o openssl-thread-test \
274     `krb5-config --cflags` \
275     -I./include \
276     $RPM_OPT_FLAGS \
277     %{SOURCE8} \
278     -L. \
279     -lssl -lcrypto \
280     `krb5-config --libs` \
281     -lpthread -lz -ldl
282     ./openssl-thread-test --threads %{thread_test_threads}
283    
284     # Patch33 must be patched after tests otherwise they will fail
285     patch -p1 -b -z .ca-dir < %{PATCH33}
286    
287     # Add generation of HMAC checksum of the final stripped library
288     %define __spec_install_post \
289     %{?__debug_package:%{__debug_install_post}} \
290     %{__arch_install_post} \
291     %{__os_install_post} \
292     fips/fips_standalone_sha1 $RPM_BUILD_ROOT/%{_lib}/libcrypto.so.%{version} >$RPM_BUILD_ROOT/%{_lib}/.libcrypto.so.%{version}.hmac \
293     ln -sf .libcrypto.so.%{version}.hmac $RPM_BUILD_ROOT/%{_lib}/.libcrypto.so.%{soversion}.hmac \
294     fips/fips_standalone_sha1 $RPM_BUILD_ROOT/%{_lib}/libssl.so.%{version} >$RPM_BUILD_ROOT/%{_lib}/.libssl.so.%{version}.hmac \
295     ln -sf .libssl.so.%{version}.hmac $RPM_BUILD_ROOT/%{_lib}/.libssl.so.%{soversion}.hmac \
296     %{nil}
297    
298     %install
299     [ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT
300     # Install OpenSSL.
301     install -d $RPM_BUILD_ROOT/{%{_lib},%{_bindir},%{_includedir},%{_libdir},%{_mandir},%{_libdir}/openssl}
302     make INSTALL_PREFIX=$RPM_BUILD_ROOT install
303     make INSTALL_PREFIX=$RPM_BUILD_ROOT install_docs
304     # OpenSSL install doesn't use correct _libdir
305     mv $RPM_BUILD_ROOT/usr/lib/lib*.so.%{soversion} $RPM_BUILD_ROOT/%{_lib}/
306     mv $RPM_BUILD_ROOT/usr/lib/engines $RPM_BUILD_ROOT/%{_libdir}/openssl
307     mv $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/man/* $RPM_BUILD_ROOT%{_mandir}/
308     rmdir $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/man
309     mv $RPM_BUILD_ROOT/usr/lib/* $RPM_BUILD_ROOT%{_libdir}/ || :
310     rename so.%{soversion} so.%{version} $RPM_BUILD_ROOT/%{_lib}/*.so.%{soversion}
311     for lib in $RPM_BUILD_ROOT/%{_lib}/*.so.%{version} ; do
312     chmod 755 ${lib}
313     ln -s -f ../../%{_lib}/`basename ${lib}` $RPM_BUILD_ROOT%{_libdir}/`basename ${lib} .%{version}`
314     ln -s -f `basename ${lib}` $RPM_BUILD_ROOT/%{_lib}/`basename ${lib} .%{version}`.%{soversion}
315     rm -f $RPM_BUILD_ROOT%{_libdir}/`basename ${lib} .%{version}`.%{soversion}
316     done
317    
318     # Install a makefile for generating keys and self-signed certs, and a script
319     # for generating them on the fly.
320     mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/certs
321     install -m644 %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/certs/Makefile
322     install -m755 %{SOURCE6} $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/certs/make-dummy-cert
323    
324     # Make sure we actually include the headers we built against.
325     for header in $RPM_BUILD_ROOT%{_includedir}/openssl/* ; do
326     if [ -f ${header} -a -f include/openssl/$(basename ${header}) ] ; then
327     install -m644 include/openssl/`basename ${header}` ${header}
328     fi
329     done
330    
331     # Rename man pages so that they don't conflict with other system man pages.
332     pushd $RPM_BUILD_ROOT%{_mandir}
333     for manpage in man*/* ; do
334     if [ -L ${manpage} ]; then
335     TARGET=`ls -l ${manpage} | awk '{ print $NF }'`
336     ln -snf ${TARGET}ssl ${manpage}ssl
337     rm -f ${manpage}
338     else
339     mv ${manpage} ${manpage}ssl
340     fi
341     done
342     for conflict in passwd rand ; do
343     rename ${conflict} ssl${conflict} man*/${conflict}*
344     done
345     popd
346    
347     # Pick a CA script.
348     pushd $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/misc
349     mv CA.sh CA
350     popd
351    
352     mkdir -m700 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA
353     mkdir -m700 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA/private
354    
355     # Install root CA stuffs.
356     cat << EOF > RHNS-blurb.txt
357     #
358     # RHNS CA certificate. Appended to the ca-bundle at package build-time.
359     #
360     EOF
361     cat %{SOURCE3} RHNS-blurb.txt %{SOURCE4} > ca-bundle.crt
362     install -m644 ca-bundle.crt $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/certs/
363     ln -s certs/ca-bundle.crt $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/cert.pem
364    
365     # Fix libdir.
366     pushd $RPM_BUILD_ROOT/%{_libdir}/pkgconfig
367     for i in *.pc ; do
368     sed 's,^libdir=${exec_prefix}/lib,libdir=${exec_prefix}/%{_lib},g' \
369     $i >$i.tmp && \
370     cat $i.tmp >$i && \
371     rm -f $i.tmp
372     done
373     popd
374    
375     # Determine which arch opensslconf.h is going to try to #include.
376     basearch=%{_arch}
377     %ifarch %{ix86}
378     basearch=i386
379     %endif
380    
381     %ifarch %{multilib_arches}
382     # Do an opensslconf.h switcheroo to avoid file conflicts on systems where you
383     # can have both a 32- and 64-bit version of the library, and they each need
384     # their own correct-but-different versions of opensslconf.h to be usable.
385     install -m644 %{SOURCE10} \
386     $RPM_BUILD_ROOT/%{_prefix}/include/openssl/opensslconf-${basearch}.h
387     cat $RPM_BUILD_ROOT/%{_prefix}/include/openssl/opensslconf.h >> \
388     $RPM_BUILD_ROOT/%{_prefix}/include/openssl/opensslconf-${basearch}.h
389     install -m644 %{SOURCE9} \
390     $RPM_BUILD_ROOT/%{_prefix}/include/openssl/opensslconf.h
391     %endif
392    
393     %ifarch %{optimize_arches}
394     # Remove bits which belong in subpackages.
395     rm -rf $RPM_BUILD_ROOT/%{_prefix}/include/openssl
396     rm -rf $RPM_BUILD_ROOT/%{_libdir}/*.a
397     rm -rf $RPM_BUILD_ROOT/%{_libdir}/*.so
398     rm -rf $RPM_BUILD_ROOT/%{_libdir}/pkgconfig
399     rm -rf $RPM_BUILD_ROOT/%{_mandir}/man3/*
400    
401     rm -rf $RPM_BUILD_ROOT/%{_bindir}/c_rehash
402     rm -rf $RPM_BUILD_ROOT/%{_mandir}/man1*/*.pl*
403     rm -rf $RPM_BUILD_ROOT/%{_sysconfdir}/pki/tls/misc/*.pl
404     %endif
405    
406     # Remove fips fingerprint script
407     rm -rf $RPM_BUILD_ROOT/%{_bindir}/openssl_fips_fingerprint
408    
409     %clean
410     [ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT
411    
412     %files
413     %defattr(-,root,root)
414     %doc FAQ LICENSE CHANGES NEWS INSTALL README
415     %doc doc/c-indentation.el doc/openssl.txt
416     %doc doc/openssl_button.html doc/openssl_button.gif
417     %doc doc/ssleay.txt
418     %doc README.FIPS
419     %dir %{_sysconfdir}/pki/tls
420     %dir %{_sysconfdir}/pki/tls/certs
421     %{_sysconfdir}/pki/tls/certs/make-dummy-cert
422     %{_sysconfdir}/pki/tls/certs/Makefile
423     %{_sysconfdir}/pki/tls/cert.pem
424     %dir %{_sysconfdir}/pki/tls/misc
425     %{_sysconfdir}/pki/tls/misc/CA
426     %dir %{_sysconfdir}/pki/CA
427     %dir %{_sysconfdir}/pki/CA/private
428     %{_sysconfdir}/pki/tls/misc/c_*
429     %{_sysconfdir}/pki/tls/private
430    
431     %config(noreplace) %{_sysconfdir}/pki/tls/openssl.cnf
432     %config(noreplace) %{_sysconfdir}/pki/tls/certs/ca-bundle.crt
433    
434     %attr(0755,root,root) %{_bindir}/openssl
435     %attr(0755,root,root) /%{_lib}/*.so.%{version}
436     %attr(0755,root,root) /%{_lib}/*.so.%{soversion}
437     %attr(0644,root,root) /%{_lib}/.libcrypto.so.*.hmac
438     %attr(0644,root,root) /%{_lib}/.libssl.so.*.hmac
439     %dir %{_libdir}/openssl
440     %attr(0755,root,root) %{_libdir}/openssl/engines
441     %attr(0644,root,root) %{_mandir}/man1*/[ABD-Zabcd-z]*
442     %attr(0644,root,root) %{_mandir}/man5*/*
443     %attr(0644,root,root) %{_mandir}/man7*/*
444    
445     %ifnarch %{optimize_arches}
446     %files devel
447     %defattr(-,root,root)
448     %{_prefix}/include/openssl
449     %attr(0644,root,root) %{_libdir}/*.a
450     %attr(0755,root,root) %{_libdir}/*.so
451     %attr(0644,root,root) %{_mandir}/man3*/*
452     %attr(0644,root,root) %{_libdir}/pkgconfig/*.pc
453    
454     %files perl
455     %defattr(-,root,root)
456     %attr(0755,root,root) %{_bindir}/c_rehash
457     %attr(0644,root,root) %{_mandir}/man1*/*.pl*
458     %dir %{_sysconfdir}/pki/tls/misc
459     %{_sysconfdir}/pki/tls/misc/*.pl
460     %endif
461    
462     %post -p /sbin/ldconfig
463    
464     %postun -p /sbin/ldconfig
465    
466     %changelog
467 vip-ire 1.6 * Thu Jan 15 2015 Daniel Berteaud <daniel@firewall-services.com 0.9.8e-32.1
468     - update with ca-bundle.crt from SME 9 [SME: 8799]
469    
470     * Wed Dec 17 2014 Tomas Mraz <tmraz@redhat.com> 0.9.8e-32
471     - properly lock X509_STORE accesses (#1168938)
472 charliebrady 1.4
473 vip-ire 1.5 * Wed Oct 15 2014 Tomas Mraz <tmraz@redhat.com> 0.9.8e-31
474     - add support for fallback SCSV to partially mitigate CVE-2014-3566
475     (padding attack on SSL3)
476    
477 vip-ire 1.6 * Fri Aug 8 2014 Tomas Mraz <tmraz@redhat.com> 0.9.8e-30
478 charliebrady 1.3 - fix CVE-2014-0221 - recursion in DTLS code leading to DoS
479     - fix CVE-2014-3505 - doublefree in DTLS packet processing
480     - fix CVE-2014-3506 - avoid memory exhaustion in DTLS
481     - fix CVE-2014-3508 - fix OID handling to avoid information leak
482     - fix CVE-2014-3510 - fix DoS in anonymous (EC)DH handling in DTLS
483    
484 vip-ire 1.6 * Mon Jun 2 2014 Tomas Mraz <tmraz@redhat.com> 0.9.8e-29
485 charliebrady 1.3 - fix for CVE-2014-0224 - SSL/TLS MITM vulnerability
486 wellsi 1.2
487 vip-ire 1.6 * Tue Jan 28 2014 Tomas Mraz <tmraz@redhat.com> 0.9.8e-28
488 wellsi 1.1 - replace expired GlobalSign Root CA certificate in ca-bundle.crt
489    
490     * Mon Feb 25 2013 Tomas Mraz <tmraz@redhat.com> 0.9.8e-27
491     - fix for CVE-2013-0169 - SSL/TLS CBC timing attack (#907589)
492     - fix for CVE-2013-0166 - DoS in OCSP signatures checking (#908052)
493     - enable compression only if explicitly asked for or OPENSSL_DEFAULT_ZLIB
494     environment variable is set (fixes CVE-2012-4929 #857051)
495     - use __secure_getenv() everywhere instead of getenv() (#839735)
496    
497     * Tue May 15 2012 Tomas Mraz <tmraz@redhat.com> 0.9.8e-26
498     - fix for CVE-2012-2333 - improper checking for record length in DTLS (#820686)
499    
500     * Mon Apr 23 2012 Tomas Mraz <tmraz@redhat.com> 0.9.8e-25
501     - fix for CVE-2012-2110 - memory corruption in asn1_d2i_read_bio() (#814185)
502    
503     * Mon Mar 19 2012 Tomas Mraz <tmraz@redhat.com> 0.9.8e-23
504     - fix problem with the SGC restart patch that might terminate handshake
505     incorrectly
506     - fix for CVE-2012-0884 - MMA weakness in CMS and PKCS#7 code (#802725)
507     - fix for CVE-2012-1165 - NULL read dereference on bad MIME headers (#802489)
508    
509     * Wed Jan 18 2012 Tomas Mraz <tmraz@redhat.com> 0.9.8e-22
510     - fix for CVE-2011-4108 & CVE-2012-0050 - DTLS plaintext recovery
511     vulnerability and additional DTLS fixes (#771770)
512     - fix for CVE-2011-4109 - double free in policy checks (#771771)
513     - fix for CVE-2011-4576 - uninitialized SSL 3.0 padding (#771775)
514     - fix for CVE-2011-4619 - SGC restart DoS attack (#771780)
515    
516     * Tue Oct 18 2011 Tomas Mraz <tmraz@redhat.com> 0.9.8e-21
517     - add known answer test for SHA2 algorithms (#740866)
518     - make default private key length in certificate Makefile 2048 bits
519     (can be changed with PRIVATE_KEY_BITS setting) (#745410)
520     - fix incorrect return value in parse_yesno() (#726593)
521     - added DigiCert CA certificates to ca-bundle (#735819)
522     - added a new section about error states to README.FIPS (#628976)
523    
524     * Wed May 4 2011 Tomas Mraz <tmraz@redhat.com> 0.9.8e-20
525     - add missing DH_check_pub_key() call when DH key is computed (#698175)
526    
527     * Mon Apr 4 2011 Tomas Mraz <tmraz@redhat.com> 0.9.8e-19
528     - presort list of ciphers available in SSL (#688901)
529     - accept connection in s_server even if getaddrinfo() fails (#561260)
530     - point to openssl dgst for list of supported digests (#608639)
531     - fix handling of future TLS versions (#599112)
532     - added VeriSign Class 3 Public Primary Certification Authority - G5
533     and StartCom Certification Authority certs to ca-bundle (#675671, #617856)
534     - upstream fixes for the CHIL engine (#622003, #671484)
535    
536     * Wed Mar 9 2011 Tomas Mraz <tmraz@redhat.com> 0.9.8e-18
537     - add SHA-2 hashes in SSL_library_init() (#676384)
538    
539     * Tue Dec 7 2010 Tomas Mraz <tmraz@redhat.com> 0.9.8e-17
540     - fix CVE-2010-4180 - completely disable code for
541     SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG (#659462)
542    
543     * Fri Mar 12 2010 Tomas Mraz <tmraz@redhat.com> 0.9.8e-16
544     - fix CVE-2009-3245 - add missing bn_wexpand return checks (#570924)
545    
546     * Thu Mar 4 2010 Tomas Mraz <tmraz@redhat.com> 0.9.8e-15
547     - fix CVE-2010-0433 - do not pass NULL princ to krb5_kt_get_entry which
548     in the RHEL-5 and newer versions will crash in such case (#569774)
549    
550     * Thu Feb 18 2010 Tomas Mraz <tmraz@redhat.com> 0.9.8e-14
551     - fix CVE-2009-3555 - support the safe renegotiation extension and
552     do not allow legacy renegotiation on the server by default (#533125)
553    
554     * Thu Jan 14 2010 Tomas Mraz <tmraz@redhat.com> 0.9.8e-13
555     - fix CVE-2009-2409 - drop MD2 algorithm from EVP tables (#510197)
556     - fix CVE-2009-4355 - do not leak memory when CRYPTO_cleanup_all_ex_data()
557     is called prematurely by application (#546707)
558    
559     * Mon Jun 29 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8e-12
560     - abort if selftests failed and random number generator is polled
561     - mention EVP_aes and EVP_sha2xx routines in the manpages
562     - add README.FIPS
563    
564     * Thu May 21 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8e-10
565     - fix CVE-2009-1386 CVE-2009-1387 (DTLS DoS problems)
566     (#503685, #503688)
567    
568     * Thu May 21 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8e-9
569     - fix CVE-2009-1377 CVE-2009-1378 CVE-2009-1379
570     (DTLS DoS problems) (#501253, #501254, #501572)
571    
572     * Wed Apr 15 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8e-8
573     - support multiple CRLs with same subject in a store (#457134)
574     - fix CVE-2009-0590 - reject incorrectly encoded ASN.1 strings (#492304)
575     - seed FIPS rng directly from kernel random device
576     - do not require fipscheck to build the package (#475798)
577     - call pairwise key tests in FIPS mode only (#479817)
578     - do not crash when parsing bad mime data (#472440)
579    
580     * Tue Dec 16 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8e-7
581     - fix CVE-2008-5077 - incorrect checks for malformed signatures (#476671)
582    
583     * Fri Oct 31 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8e-6
584     - allow lookup of algorithms in engine
585    
586     * Fri Oct 24 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8e-5
587     - implement the integrity checking inside libcrypto so OpenSSL
588     can be used in FIPS mode by the fipscheck library
589    
590     * Thu Oct 9 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8e-4
591     - FIPS mode kernel flag is /proc/sys/crypto/fips_enabled
592    
593     * Wed Sep 10 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8e-3
594     - disable strict aliasing
595    
596     * Tue Sep 9 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8e-2
597     - more changes for FIPS validation (#444800)
598     - correctly initialize default CA paths (#450987)
599     - allow disabling zlib support through environment (#442624)
600    
601     * Tue Jul 15 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8e-1
602     - rebase to version undergoing FIPS validation (#455634)
603    
604     * Tue Jan 15 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8b-10
605     - compile with -march=z900 on s390 for performance improvements (#250818)
606     - make ssl session ID matching strict (#233599)
607    
608     * Mon Oct 8 2007 Tomas Mraz <tmraz@redhat.com> 0.9.8b-9
609     - fix CVE-2007-3108 - side channel attack on private keys (#250581)
610     - fix CVE-2007-5135 - off-by-one in SSL_get_shared_ciphers (#309881)
611     - fix CVE-2007-4995 - out of order DTLS fragments buffer overflow (#321221)
612    
613     * Thu Nov 30 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-8.3
614     - the previous change still didn't make X509_NAME_cmp transitive
615    
616     * Thu Nov 23 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-8.2
617     - make X509_NAME_cmp transitive otherwise certificate lookup
618     is broken (#216050)
619    
620     * Fri Nov 3 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-8.1
621     - aliasing bug in engine loading, patch by IBM (#213216)
622    
623     * Mon Oct 2 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-8
624     - CVE-2006-2940 fix was incorrect (#208744)
625    
626     * Mon Sep 25 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-7
627     - fix CVE-2006-2937 - mishandled error on ASN.1 parsing (#207276)
628     - fix CVE-2006-2940 - parasitic public keys DoS (#207274)
629     - fix CVE-2006-3738 - buffer overflow in SSL_get_shared_ciphers (#206940)
630     - fix CVE-2006-4343 - sslv2 client DoS (#206940)
631    
632     * Tue Sep 5 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-6
633     - fix CVE-2006-4339 - prevent attack on PKCS#1 v1.5 signatures (#205180)
634    
635     * Wed Aug 2 2006 Tomas Mraz <tmraz@redhat.com> - 0.9.8b-5
636     - set buffering to none on stdio/stdout FILE when bufsize is set (#200580)
637     patch by IBM
638    
639     * Fri Jul 28 2006 Alexandre Oliva <aoliva@redhat.com> - 0.9.8b-4.1
640     - rebuild with new binutils (#200330)
641    
642     * Fri Jul 21 2006 Tomas Mraz <tmraz@redhat.com> - 0.9.8b-4
643     - add a temporary workaround for sha512 test failure on s390 (#199604)
644    
645     * Thu Jul 20 2006 Tomas Mraz <tmraz@redhat.com>
646     - add ipv6 support to s_client and s_server (by Jan Pazdziora) (#198737)
647     - add patches for BN threadsafety, AES cache collision attack hazard fix and
648     pkcs7 code memleak fix from upstream CVS
649    
650     * Wed Jul 12 2006 Jesse Keating <jkeating@redhat.com> - 0.9.8b-3.1
651     - rebuild
652    
653     * Wed Jun 21 2006 Tomas Mraz <tmraz@redhat.com> - 0.9.8b-3
654     - dropped libica and ica engine from build
655    
656     * Wed Jun 21 2006 Joe Orton <jorton@redhat.com>
657     - update to new CA bundle from mozilla.org; adds CA certificates
658     from netlock.hu and startcom.org
659    
660     * Mon Jun 5 2006 Tomas Mraz <tmraz@redhat.com> - 0.9.8b-2
661     - fixed a few rpmlint warnings
662     - better fix for #173399 from upstream
663     - upstream fix for pkcs12
664    
665     * Thu May 11 2006 Tomas Mraz <tmraz@redhat.com> - 0.9.8b-1
666     - upgrade to new version, stays ABI compatible
667     - there is no more linux/config.h (it was empty anyway)
668    
669     * Tue Apr 4 2006 Tomas Mraz <tmraz@redhat.com> - 0.9.8a-6
670     - fix stale open handles in libica (#177155)
671     - fix build if 'rand' or 'passwd' in buildroot path (#178782)
672     - initialize VIA Padlock engine (#186857)
673    
674     * Fri Feb 10 2006 Jesse Keating <jkeating@redhat.com> - 0.9.8a-5.2
675     - bump again for double-long bug on ppc(64)
676    
677     * Tue Feb 07 2006 Jesse Keating <jkeating@redhat.com> - 0.9.8a-5.1
678     - rebuilt for new gcc4.1 snapshot and glibc changes
679    
680     * Thu Dec 15 2005 Tomas Mraz <tmraz@redhat.com> 0.9.8a-5
681     - don't include SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
682     in SSL_OP_ALL (#175779)
683    
684     * Fri Dec 09 2005 Jesse Keating <jkeating@redhat.com>
685     - rebuilt
686    
687     * Tue Nov 29 2005 Tomas Mraz <tmraz@redhat.com> 0.9.8a-4
688     - fix build (-lcrypto was erroneusly dropped) of the updated libica
689     - updated ICA engine to 1.3.6-rc3
690    
691     * Tue Nov 22 2005 Tomas Mraz <tmraz@redhat.com> 0.9.8a-3
692     - disable builtin compression methods for now until they work
693     properly (#173399)
694    
695     * Wed Nov 16 2005 Tomas Mraz <tmraz@redhat.com> 0.9.8a-2
696     - don't set -rpath for openssl binary
697    
698     * Tue Nov 8 2005 Tomas Mraz <tmraz@redhat.com> 0.9.8a-1
699     - new upstream version
700     - patches partially renumbered
701    
702     * Fri Oct 21 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-11
703     - updated IBM ICA engine library and patch to latest upstream version
704    
705     * Wed Oct 12 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-10
706     - fix CAN-2005-2969 - remove SSL_OP_MSIE_SSLV2_RSA_PADDING which
707     disables the countermeasure against man in the middle attack in SSLv2
708     (#169863)
709     - use sha1 as default for CA and cert requests - CAN-2005-2946 (#169803)
710    
711     * Tue Aug 23 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-9
712     - add *.so.soversion as symlinks in /lib (#165264)
713     - remove unpackaged symlinks (#159595)
714     - fixes from upstream (constant time fixes for DSA,
715     bn assembler div on ppc arch, initialize memory on realloc)
716    
717     * Thu Aug 11 2005 Phil Knirsch <pknirsch@redhat.com> 0.9.7f-8
718     - Updated ICA engine IBM patch to latest upstream version.
719    
720     * Thu May 19 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-7
721     - fix CAN-2005-0109 - use constant time/memory access mod_exp
722     so bits of private key aren't leaked by cache eviction (#157631)
723     - a few more fixes from upstream 0.9.7g
724    
725     * Wed Apr 27 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-6
726     - use poll instead of select in rand (#128285)
727     - fix Makefile.certificate to point to /etc/pki/tls
728     - change the default string mask in ASN1 to PrintableString+UTF8String
729    
730     * Mon Apr 25 2005 Joe Orton <jorton@redhat.com> 0.9.7f-5
731     - update to revision 1.37 of Mozilla CA bundle
732    
733     * Thu Apr 21 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-4
734     - move certificates to _sysconfdir/pki/tls (#143392)
735     - move CA directories to _sysconfdir/pki/CA
736     - patch the CA script and the default config so it points to the
737     CA directories
738    
739     * Fri Apr 1 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-3
740     - uninitialized variable mustn't be used as input in inline
741     assembly
742     - reenable the x86_64 assembly again
743    
744     * Thu Mar 31 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-2
745     - add back RC4_CHAR on ia64 and x86_64 so the ABI isn't broken
746     - disable broken bignum assembly on x86_64
747    
748     * Wed Mar 30 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-1
749     - reenable optimizations on ppc64 and assembly code on ia64
750     - upgrade to new upstream version (no soname bump needed)
751     - disable thread test - it was testing the backport of the
752     RSA blinding - no longer needed
753     - added support for changing serial number to
754     Makefile.certificate (#151188)
755     - make ca-bundle.crt a config file (#118903)
756    
757     * Tue Mar 1 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7e-3
758     - libcrypto shouldn't depend on libkrb5 (#135961)
759    
760     * Mon Feb 28 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7e-2
761     - rebuild
762    
763     * Mon Feb 28 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7e-1
764     - new upstream source, updated patches
765     - added patch so we are hopefully ABI compatible with upcoming
766     0.9.7f
767    
768     * Thu Feb 10 2005 Tomas Mraz <tmraz@redhat.com>
769     - Support UTF-8 charset in the Makefile.certificate (#134944)
770     - Added cmp to BuildPrereq
771    
772     * Thu Jan 27 2005 Joe Orton <jorton@redhat.com> 0.9.7a-46
773     - generate new ca-bundle.crt from Mozilla certdata.txt (revision 1.32)
774    
775     * Thu Dec 23 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-45
776     - Fixed and updated libica-1.3.4-urandom.patch patch (#122967)
777    
778     * Fri Nov 19 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-44
779     - rebuild
780    
781     * Fri Nov 19 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-43
782     - rebuild
783    
784     * Fri Nov 19 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-42
785     - rebuild
786    
787     * Fri Nov 19 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-41
788     - remove der_chop, as upstream cvs has done (CAN-2004-0975, #140040)
789    
790     * Tue Oct 05 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-40
791     - Include latest libica version with important bugfixes
792    
793     * Tue Jun 15 2004 Elliot Lee <sopwith@redhat.com>
794     - rebuilt
795    
796     * Mon Jun 14 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-38
797     - Updated ICA engine IBM patch to latest upstream version.
798    
799     * Mon Jun 7 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-37
800     - build for linux-alpha-gcc instead of alpha-gcc on alpha (Jeff Garzik)
801    
802     * Tue May 25 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-36
803     - handle %%{_arch}=i486/i586/i686/athlon cases in the intermediate
804     header (#124303)
805    
806     * Thu Mar 25 2004 Joe Orton <jorton@redhat.com> 0.9.7a-35
807     - add security fixes for CAN-2004-0079, CAN-2004-0112
808    
809     * Tue Mar 16 2004 Phil Knirsch <pknirsch@redhat.com>
810     - Fixed libica filespec.
811    
812     * Thu Mar 10 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-34
813     - ppc/ppc64 define __powerpc__/__powerpc64__, not __ppc__/__ppc64__, fix
814     the intermediate header
815    
816     * Wed Mar 10 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-33
817     - add an intermediate <openssl/opensslconf.h> which points to the right
818     arch-specific opensslconf.h on multilib arches
819    
820     * Tue Mar 02 2004 Elliot Lee <sopwith@redhat.com>
821     - rebuilt
822    
823     * Thu Feb 26 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-32
824     - Updated libica to latest upstream version 1.3.5.
825    
826     * Tue Feb 17 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-31
827     - Update ICA crypto engine patch from IBM to latest version.
828    
829     * Fri Feb 13 2004 Elliot Lee <sopwith@redhat.com>
830     - rebuilt
831    
832     * Fri Feb 13 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-29
833     - rebuilt
834    
835     * Wed Feb 11 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-28
836     - Fixed libica build.
837    
838     * Wed Feb 4 2004 Nalin Dahyabhai <nalin@redhat.com>
839     - add "-ldl" to link flags added for Linux-on-ARM (#99313)
840    
841     * Wed Feb 4 2004 Joe Orton <jorton@redhat.com> 0.9.7a-27
842     - updated ca-bundle.crt: removed expired GeoTrust roots, added
843     freessl.com root, removed trustcenter.de Class 0 root
844    
845     * Sun Nov 30 2003 Tim Waugh <twaugh@redhat.com> 0.9.7a-26
846     - Fix link line for libssl (bug #111154).
847    
848     * Fri Oct 24 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-25
849     - add dependency on zlib-devel for the -devel package, which depends on zlib
850     symbols because we enable zlib for libssl (#102962)
851    
852     * Fri Oct 24 2003 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-24
853     - Use /dev/urandom instead of PRNG for libica.
854     - Apply libica-1.3.5 fix for /dev/urandom in icalinux.c
855     - Use latest ICA engine patch from IBM.
856    
857     * Sat Oct 4 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-22.1
858     - rebuild
859    
860     * Wed Oct 1 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-22
861     - rebuild (22 wasn't actually built, fun eh?)
862    
863     * Tue Sep 30 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-23
864     - re-disable optimizations on ppc64
865    
866     * Tue Sep 30 2003 Joe Orton <jorton@redhat.com>
867     - add a_mbstr.c fix for 64-bit platforms from CVS
868    
869     * Tue Sep 30 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-22
870     - add -Wa,--noexecstack to RPM_OPT_FLAGS so that assembled modules get tagged
871     as not needing executable stacks
872    
873     * Mon Sep 29 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-21
874     - rebuild
875    
876     * Thu Sep 25 2003 Nalin Dahyabhai <nalin@redhat.com>
877     - re-enable optimizations on ppc64
878    
879     * Thu Sep 25 2003 Nalin Dahyabhai <nalin@redhat.com>
880     - remove exclusivearch
881    
882     * Wed Sep 24 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-20
883     - only parse a client cert if one was requested
884     - temporarily exclusivearch for %%{ix86}
885    
886     * Tue Sep 23 2003 Nalin Dahyabhai <nalin@redhat.com>
887     - add security fixes for protocol parsing bugs (CAN-2003-0543, CAN-2003-0544)
888     and heap corruption (CAN-2003-0545)
889     - update RHNS-CA-CERT files
890     - ease back on the number of threads used in the threading test
891    
892     * Wed Sep 17 2003 Matt Wilson <msw@redhat.com> 0.9.7a-19
893     - rebuild to fix gzipped file md5sums (#91211)
894    
895     * Mon Aug 25 2003 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-18
896     - Updated libica to version 1.3.4.
897    
898     * Thu Jul 17 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-17
899     - rebuild
900    
901     * Tue Jul 15 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-10.9
902     - free the kssl_ctx structure when we free an SSL structure (#99066)
903    
904     * Fri Jul 10 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-16
905     - rebuild
906    
907     * Thu Jul 10 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-15
908     - lower thread test count on s390x
909    
910     * Tue Jul 8 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-14
911     - rebuild
912    
913     * Thu Jun 26 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-13
914     - disable assembly on arches where it seems to conflict with threading
915    
916     * Thu Jun 26 2003 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-12
917     - Updated libica to latest upstream version 1.3.0
918    
919     * Wed Jun 11 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-9.9
920     - rebuild
921    
922     * Wed Jun 11 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-11
923     - rebuild
924    
925     * Tue Jun 10 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-10
926     - ubsec: don't stomp on output data which might also be input data
927    
928     * Tue Jun 10 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-9
929     - temporarily disable optimizations on ppc64
930    
931     * Mon Jun 9 2003 Nalin Dahyabhai <nalin@redhat.com>
932     - backport fix for engine-used-for-everything from 0.9.7b
933     - backport fix for prng not being seeded causing problems, also from 0.9.7b
934     - add a check at build-time to ensure that RSA is thread-safe
935     - keep perlpath from stomping on the libica configure scripts
936    
937     * Fri Jun 6 2003 Nalin Dahyabhai <nalin@redhat.com>
938     - thread-safety fix for RSA blinding
939    
940     * Wed Jun 04 2003 Elliot Lee <sopwith@redhat.com> 0.9.7a-8
941     - rebuilt
942    
943     * Fri May 30 2003 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-7
944     - Added libica-1.2 to openssl (featurerequest).
945    
946     * Wed Apr 16 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-6
947     - fix building with incorrect flags on ppc64
948    
949     * Wed Mar 19 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-5
950     - add patch to harden against Klima-Pokorny-Rosa extension of Bleichenbacher's
951     attack (CAN-2003-0131)
952    
953     * Mon Mar 17 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-4
954     - add patch to enable RSA blinding by default, closing a timing attack
955     (CAN-2003-0147)
956    
957     * Wed Mar 5 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-3
958     - disable use of BN assembly module on x86_64, but continue to allow inline
959     assembly (#83403)
960    
961     * Thu Feb 27 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-2
962     - disable EC algorithms
963    
964     * Wed Feb 19 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-1
965     - update to 0.9.7a
966    
967     * Wed Feb 19 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7-8
968     - add fix to guard against attempts to allocate negative amounts of memory
969     - add patch for CAN-2003-0078, fixing a timing attack
970    
971     * Thu Feb 13 2003 Elliot Lee <sopwith@redhat.com> 0.9.7-7
972     - Add openssl-ppc64.patch
973    
974     * Mon Feb 10 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7-6
975     - EVP_DecryptInit should call EVP_CipherInit() instead of EVP_CipherInit_ex(),
976     to get the right behavior when passed uninitialized context structures
977     (#83766)
978     - build with -mcpu=ev5 on alpha family (#83828)
979    
980     * Wed Jan 22 2003 Tim Powers <timp@redhat.com>
981     - rebuilt
982    
983     * Fri Jan 17 2003 Phil Knirsch <pknirsch@redhat.com> 0.9.7-4
984     - Added IBM hw crypto support patch.
985    
986     * Wed Jan 15 2003 Nalin Dahyabhai <nalin@redhat.com>
987     - add missing builddep on sed
988    
989     * Thu Jan 9 2003 Bill Nottingham <notting@redhat.com> 0.9.7-3
990     - debloat
991     - fix broken manpage symlinks
992    
993     * Wed Jan 8 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7-2
994     - fix double-free in 'openssl ca'
995    
996     * Fri Jan 3 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7-1
997     - update to 0.9.7 final
998    
999     * Tue Dec 17 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.7-0
1000     - update to 0.9.7 beta6 (DO NOT USE UNTIL UPDATED TO FINAL 0.9.7)
1001    
1002     * Wed Dec 11 2002 Nalin Dahyabhai <nalin@redhat.com>
1003     - update to 0.9.7 beta5 (DO NOT USE UNTIL UPDATED TO FINAL 0.9.7)
1004    
1005     * Tue Oct 22 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-30
1006     - add configuration stanza for x86_64 and use it on x86_64
1007     - build for linux-ppc on ppc
1008     - start running the self-tests again
1009    
1010     * Wed Oct 02 2002 Elliot Lee <sopwith@redhat.com> 0.9.6b-29hammer.3
1011     - Merge fixes from previous hammer packages, including general x86-64 and
1012     multilib
1013    
1014     * Tue Aug 6 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-29
1015     - rebuild
1016    
1017     * Thu Aug 1 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-28
1018     - update asn patch to fix accidental reversal of a logic check
1019    
1020     * Wed Jul 31 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-27
1021     - update asn patch to reduce chance that compiler optimization will remove
1022     one of the added tests
1023    
1024     * Wed Jul 31 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-26
1025     - rebuild
1026    
1027     * Mon Jul 29 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-25
1028     - add patch to fix ASN.1 vulnerabilities
1029    
1030     * Thu Jul 25 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-24
1031     - add backport of Ben Laurie's patches for OpenSSL 0.9.6d
1032    
1033     * Wed Jul 17 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-23
1034     - own %{_datadir}/ssl/misc
1035    
1036     * Fri Jun 21 2002 Tim Powers <timp@redhat.com>
1037     - automated rebuild
1038    
1039     * Sun May 26 2002 Tim Powers <timp@redhat.com>
1040     - automated rebuild
1041    
1042     * Fri May 17 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-20
1043     - free ride through the build system (whee!)
1044    
1045     * Thu May 16 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-19
1046     - rebuild in new environment
1047    
1048     * Thu Apr 4 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-17, 0.9.6b-18
1049     - merge RHL-specific bits into stronghold package, rename
1050    
1051     * Tue Apr 02 2002 Gary Benson <gbenson@redhat.com> stronghold-0.9.6c-2
1052     - add support for Chrysalis Luna token
1053    
1054     * Tue Mar 26 2002 Gary Benson <gbenson@redhat.com>
1055     - disable AEP random number generation, other AEP fixes
1056    
1057     * Fri Mar 15 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-15
1058     - only build subpackages on primary arches
1059    
1060     * Thu Mar 14 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-13
1061     - on ia32, only disable use of assembler on i386
1062     - enable assembly on ia64
1063    
1064     * Mon Jan 7 2002 Florian La Roche <Florian.LaRoche@redhat.de> 0.9.6b-11
1065     - fix sparcv9 entry
1066    
1067     * Mon Jan 7 2002 Gary Benson <gbenson@redhat.com> stronghold-0.9.6c-1
1068     - upgrade to 0.9.6c
1069     - bump BuildArch to i686 and enable assembler on all platforms
1070     - synchronise with shrimpy and rawhide
1071     - bump soversion to 3
1072    
1073     * Wed Oct 10 2001 Florian La Roche <Florian.LaRoche@redhat.de>
1074     - delete BN_LLONG for s390x, patch from Oliver Paukstadt
1075    
1076     * Mon Sep 17 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-9
1077     - update AEP driver patch
1078    
1079     * Mon Sep 10 2001 Nalin Dahyabhai <nalin@redhat.com>
1080     - adjust RNG disabling patch to match version of patch from Broadcom
1081    
1082     * Fri Sep 7 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-8
1083     - disable the RNG in the ubsec engine driver
1084    
1085     * Tue Aug 28 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-7
1086     - tweaks to the ubsec engine driver
1087    
1088     * Fri Aug 24 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-6
1089     - tweaks to the ubsec engine driver
1090    
1091     * Thu Aug 23 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-5
1092     - update ubsec engine driver from Broadcom
1093    
1094     * Fri Aug 10 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-4
1095     - move man pages back to %%{_mandir}/man?/foo.?ssl from
1096     %%{_mandir}/man?ssl/foo.?
1097     - add an [ engine ] section to the default configuration file
1098    
1099     * Thu Aug 9 2001 Nalin Dahyabhai <nalin@redhat.com>
1100     - add a patch for selecting a default engine in SSL_library_init()
1101    
1102     * Mon Jul 23 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-3
1103     - add patches for AEP hardware support
1104     - add patch to keep trying when we fail to load a cert from a file and
1105     there are more in the file
1106     - add missing prototype for ENGINE_ubsec() in engine_int.h
1107    
1108     * Wed Jul 18 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-2
1109     - actually add hw_ubsec to the engine list
1110    
1111     * Tue Jul 17 2001 Nalin Dahyabhai <nalin@redhat.com>
1112     - add in the hw_ubsec driver from CVS
1113    
1114     * Wed Jul 11 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-1
1115     - update to 0.9.6b
1116    
1117     * Thu Jul 5 2001 Nalin Dahyabhai <nalin@redhat.com>
1118     - move .so symlinks back to %%{_libdir}
1119    
1120     * Tue Jul 3 2001 Nalin Dahyabhai <nalin@redhat.com>
1121     - move shared libraries to /lib (#38410)
1122    
1123     * Mon Jun 25 2001 Nalin Dahyabhai <nalin@redhat.com>
1124     - switch to engine code base
1125    
1126     * Mon Jun 18 2001 Nalin Dahyabhai <nalin@redhat.com>
1127     - add a script for creating dummy certificates
1128     - move man pages from %%{_mandir}/man?/foo.?ssl to %%{_mandir}/man?ssl/foo.?
1129    
1130     * Thu Jun 07 2001 Florian La Roche <Florian.LaRoche@redhat.de>
1131     - add s390x support
1132    
1133     * Fri Jun 1 2001 Nalin Dahyabhai <nalin@redhat.com>
1134     - change two memcpy() calls to memmove()
1135     - don't define L_ENDIAN on alpha
1136    
1137     * Wed May 23 2001 Joe Orton <jorton@redhat.com> stronghold-0.9.6a-1
1138     - Add 'stronghold-' prefix to package names.
1139     - Obsolete standard openssl packages.
1140    
1141     * Wed May 16 2001 Joe Orton <jorton@redhat.com>
1142     - Add BuildArch: i586 as per Nalin's advice.
1143    
1144     * Tue May 15 2001 Joe Orton <jorton@redhat.com>
1145     - Enable assembler on ix86 (using new .tar.bz2 which does
1146     include the asm directories).
1147    
1148     * Tue May 15 2001 Nalin Dahyabhai <nalin@redhat.com>
1149     - make subpackages depend on the main package
1150    
1151     * Tue May 1 2001 Nalin Dahyabhai <nalin@redhat.com>
1152     - adjust the hobble script to not disturb symlinks in include/ (fix from
1153     Joe Orton)
1154    
1155     * Fri Apr 26 2001 Nalin Dahyabhai <nalin@redhat.com>
1156     - drop the m2crypo patch we weren't using
1157    
1158     * Tue Apr 24 2001 Nalin Dahyabhai <nalin@redhat.com>
1159     - configure using "shared" as well
1160    
1161     * Sun Apr 8 2001 Nalin Dahyabhai <nalin@redhat.com>
1162     - update to 0.9.6a
1163     - use the build-shared target to build shared libraries
1164     - bump the soversion to 2 because we're no longer compatible with
1165     our 0.9.5a packages or our 0.9.6 packages
1166     - drop the patch for making rsatest a no-op when rsa null support is used
1167     - put all man pages into <section>ssl instead of <section>
1168     - break the m2crypto modules into a separate package
1169    
1170     * Tue Mar 13 2001 Nalin Dahyabhai <nalin@redhat.com>
1171     - use BN_LLONG on s390
1172    
1173     * Mon Mar 12 2001 Nalin Dahyabhai <nalin@redhat.com>
1174     - fix the s390 changes for 0.9.6 (isn't supposed to be marked as 64-bit)
1175    
1176     * Sat Mar 3 2001 Nalin Dahyabhai <nalin@redhat.com>
1177     - move c_rehash to the perl subpackage, because it's a perl script now
1178    
1179     * Fri Mar 2 2001 Nalin Dahyabhai <nalin@redhat.com>
1180     - update to 0.9.6
1181     - enable MD2
1182     - use the libcrypto.so and libssl.so targets to build shared libs with
1183     - bump the soversion to 1 because we're no longer compatible with any of
1184     the various 0.9.5a packages circulating around, which provide lib*.so.0
1185    
1186     * Wed Feb 28 2001 Florian La Roche <Florian.LaRoche@redhat.de>
1187     - change hobble-openssl for disabling MD2 again
1188    
1189     * Tue Feb 27 2001 Nalin Dahyabhai <nalin@redhat.com>
1190     - re-disable MD2 -- the EVP_MD_CTX structure would grow from 100 to 152
1191     bytes or so, causing EVP_DigestInit() to zero out stack variables in
1192     apps built against a version of the library without it
1193    
1194     * Mon Feb 26 2001 Nalin Dahyabhai <nalin@redhat.com>
1195     - disable some inline assembly, which on x86 is Pentium-specific
1196     - re-enable MD2 (see http://www.ietf.org/ietf/IPR/RSA-MD-all)
1197    
1198     * Thu Feb 08 2001 Florian La Roche <Florian.LaRoche@redhat.de>
1199     - fix s390 patch
1200    
1201     * Fri Dec 8 2000 Than Ngo <than@redhat.com>
1202     - added support s390
1203    
1204     * Mon Nov 20 2000 Nalin Dahyabhai <nalin@redhat.com>
1205     - remove -Wa,* and -m* compiler flags from the default Configure file (#20656)
1206     - add the CA.pl man page to the perl subpackage
1207    
1208     * Thu Nov 2 2000 Nalin Dahyabhai <nalin@redhat.com>
1209     - always build with -mcpu=ev5 on alpha
1210    
1211     * Tue Oct 31 2000 Nalin Dahyabhai <nalin@redhat.com>
1212     - add a symlink from cert.pem to ca-bundle.crt
1213    
1214     * Wed Oct 25 2000 Nalin Dahyabhai <nalin@redhat.com>
1215     - add a ca-bundle file for packages like Samba to reference for CA certificates
1216    
1217     * Tue Oct 24 2000 Nalin Dahyabhai <nalin@redhat.com>
1218     - remove libcrypto's crypt(), which doesn't handle md5crypt (#19295)
1219    
1220     * Mon Oct 2 2000 Nalin Dahyabhai <nalin@redhat.com>
1221     - add unzip as a buildprereq (#17662)
1222     - update m2crypto to 0.05-snap4
1223    
1224     * Tue Sep 26 2000 Bill Nottingham <notting@redhat.com>
1225     - fix some issues in building when it's not installed
1226    
1227     * Wed Sep 6 2000 Nalin Dahyabhai <nalin@redhat.com>
1228     - make sure the headers we include are the ones we built with (aaaaarrgh!)
1229    
1230     * Fri Sep 1 2000 Nalin Dahyabhai <nalin@redhat.com>
1231     - add Richard Henderson's patch for BN on ia64
1232     - clean up the changelog
1233    
1234     * Tue Aug 29 2000 Nalin Dahyabhai <nalin@redhat.com>
1235     - fix the building of python modules without openssl-devel already installed
1236    
1237     * Wed Aug 23 2000 Nalin Dahyabhai <nalin@redhat.com>
1238     - byte-compile python extensions without the build-root
1239     - adjust the makefile to not remove temporary files (like .key files when
1240     building .csr files) by marking them as .PRECIOUS
1241    
1242     * Sat Aug 19 2000 Nalin Dahyabhai <nalin@redhat.com>
1243     - break out python extensions into a subpackage
1244    
1245     * Mon Jul 17 2000 Nalin Dahyabhai <nalin@redhat.com>
1246     - tweak the makefile some more
1247    
1248     * Tue Jul 11 2000 Nalin Dahyabhai <nalin@redhat.com>
1249     - disable MD2 support
1250    
1251     * Thu Jul 6 2000 Nalin Dahyabhai <nalin@redhat.com>
1252     - disable MDC2 support
1253    
1254     * Sun Jul 2 2000 Nalin Dahyabhai <nalin@redhat.com>
1255     - tweak the disabling of RC5, IDEA support
1256     - tweak the makefile
1257    
1258     * Thu Jun 29 2000 Nalin Dahyabhai <nalin@redhat.com>
1259     - strip binaries and libraries
1260     - rework certificate makefile to have the right parts for Apache
1261    
1262     * Wed Jun 28 2000 Nalin Dahyabhai <nalin@redhat.com>
1263     - use %%{_perl} instead of /usr/bin/perl
1264     - disable alpha until it passes its own test suite
1265    
1266     * Fri Jun 9 2000 Nalin Dahyabhai <nalin@redhat.com>
1267     - move the passwd.1 man page out of the passwd package's way
1268    
1269     * Fri Jun 2 2000 Nalin Dahyabhai <nalin@redhat.com>
1270     - update to 0.9.5a, modified for U.S.
1271     - add perl as a build-time requirement
1272     - move certificate makefile to another package
1273     - disable RC5, IDEA, RSA support
1274     - remove optimizations for now
1275    
1276     * Wed Mar 1 2000 Florian La Roche <Florian.LaRoche@redhat.de>
1277     - Bero told me to move the Makefile into this package
1278    
1279     * Wed Mar 1 2000 Florian La Roche <Florian.LaRoche@redhat.de>
1280     - add lib*.so symlinks to link dynamically against shared libs
1281    
1282     * Tue Feb 29 2000 Florian La Roche <Florian.LaRoche@redhat.de>
1283     - update to 0.9.5
1284     - run ldconfig directly in post/postun
1285     - add FAQ
1286    
1287     * Sat Dec 18 1999 Bernhard Rosenkrdnzer <bero@redhat.de>
1288     - Fix build on non-x86 platforms
1289    
1290     * Fri Nov 12 1999 Bernhard Rosenkrdnzer <bero@redhat.de>
1291     - move /usr/share/ssl/* from -devel to main package
1292    
1293     * Tue Oct 26 1999 Bernhard Rosenkrdnzer <bero@redhat.de>
1294     - inital packaging
1295     - changes from base:
1296     - Move /usr/local/ssl to /usr/share/ssl for FHS compliance
1297     - handle RPM_OPT_FLAGS

admin@koozali.org
ViewVC Help
Powered by ViewVC 1.2.1 RSS 2.0 feed