/[smeserver]/rpms/openssl/sme8/openssl.spec
ViewVC logotype

Annotation of /rpms/openssl/sme8/openssl.spec

Parent Directory Parent Directory | Revision Log Revision Log | View Revision Graph Revision Graph


Revision 1.8 - (hide annotations) (download)
Wed Apr 15 14:21:07 2015 UTC (9 years, 6 months ago) by vip-ire
Branch: MAIN
CVS Tags: openssl-0_9_8e-33_1_el5_sme, HEAD
Changes since 1.7: +29 -3 lines
* Wed Apr 15 2015 Daniel Berteaud <daniel@firewall-services.com 0.9.8e-33.1.sme
- update with ca-bundle.crt from SME 9 [SME: 8909]

1 wellsi 1.1 # For the curious:
2     # 0.9.5a soversion = 0
3     # 0.9.6 soversion = 1
4     # 0.9.6a soversion = 2
5     # 0.9.6c soversion = 3
6     # 0.9.7a soversion = 4
7     # 0.9.7ef soversion = 5
8     # 0.9.8abe soversion = 6
9     %define soversion 6
10    
11     # Number of threads to spawn when testing some threading fixes.
12     %define thread_test_threads %{?threads:%{threads}}%{!?threads:1}
13    
14     # Arches on which we need to prevent arch conflicts on opensslconf.h, must
15     # also be handled in opensslconf-new.h.
16     %define multilib_arches %{ix86} ia64 ppc ppc64 s390 s390x x86_64
17    
18     # Arches for which we don't build subpackages.
19     %define optimize_arches i686
20    
21     Summary: The OpenSSL toolkit
22     Name: openssl
23     Version: 0.9.8e
24 vip-ire 1.8 Release: 33.1%{?dist}
25 wellsi 1.1 # The tarball is based on the openssl-fips-1.2.0-test.tar.gz tarball
26     Source: openssl-fips-%{version}-usa.tar.bz2
27     Source1: hobble-openssl
28     Source2: Makefile.certificate
29     Source3: ca-bundle.crt
30     Source4: https://rhn.redhat.com/help/RHNS-CA-CERT
31     Source5: https://rhn.redhat.com/help/RHNS-CA-CERT.asc
32     Source6: make-dummy-cert
33     Source8: openssl-thread-test.c
34     Source9: opensslconf-new.h
35     Source10: opensslconf-new-warning.h
36     Source11: README.FIPS
37     # Build changes
38     Patch0: openssl-fips-0.9.8e-redhat.patch
39     Patch1: openssl-0.9.8a-defaults.patch
40     Patch2: openssl-0.9.8a-link-krb5.patch
41     Patch3: openssl-0.9.8b-soversion.patch
42     Patch4: openssl-0.9.8a-enginesdir.patch
43     Patch5: openssl-0.9.8a-no-rpath.patch
44     # Functionality changes
45     Patch32: openssl-0.9.7-beta6-ia64.patch
46     Patch33: openssl-0.9.7f-ca-dir.patch
47     Patch34: openssl-0.9.6-x509.patch
48     Patch35: openssl-0.9.7-beta5-version-add-engines.patch
49     Patch38: openssl-0.9.8a-reuse-cipher-change.patch
50     Patch39: openssl-0.9.8b-ipv6-apps.patch
51     # Backported fixes including security fixes
52     Patch61: openssl-0.9.8b-aliasing-bug.patch
53     Patch62: openssl-0.9.8b-x509-name-cmp.patch
54     Patch64: openssl-fips-0.9.8e-dtls-fixes.patch
55     Patch65: openssl-0.9.8b-cve-2007-5135.patch
56     Patch67: openssl-fips-0.9.8e-aescfb.patch
57     Patch68: openssl-fips-0.9.8e-abi.patch
58     Patch69: openssl-fips-0.9.8e-fipsmode.patch
59     Patch70: openssl-fips-0.9.8e-bn-fixes.patch
60     Patch71: openssl-fips-0.9.8e-use-fipscheck.patch
61     Patch72: openssl-fips-0.9.8e-env-zlib.patch
62     Patch73: openssl-fips-0.9.8e-default-paths.patch
63     Patch74: openssl-fips-0.9.8e-evp-nonfips.patch
64     Patch75: openssl-fips-0.9.8e-cve-2008-5077.patch
65     Patch76: openssl-fips-0.9.8e-multi-crl.patch
66     Patch77: openssl-fips-0.9.8e-no-pairwise.patch
67     Patch78: openssl-fips-0.9.8e-rng-seed.patch
68     Patch79: openssl-fips-0.9.8e-bad-mime.patch
69     Patch80: openssl-fips-0.9.8e-cve-2009-0590.patch
70     Patch81: openssl-fips-0.9.8e-dtls-dos.patch
71     Patch82: openssl-fips-0.9.8e-algo-doc.patch
72     Patch83: openssl-fips-0.9.8e-cve-2009-2409.patch
73     Patch84: openssl-fips-0.9.8e-cve-2009-4355.patch
74     Patch85: openssl-fips-0.9.8e-cve-2009-3555.patch
75     Patch86: openssl-fips-0.9.8e-cve-2010-0433.patch
76     Patch87: openssl-fips-0.9.8e-cve-2009-3245.patch
77     Patch88: openssl-fips-0.9.8e-cve-2010-4180.patch
78     Patch89: openssl-fips-0.9.8e-ssl-sha256.patch
79     Patch90: openssl-fips-0.9.8e-ciph-sort.patch
80     Patch91: openssl-fips-0.9.8e-apps-dgst.patch
81     Patch92: openssl-fips-0.9.8e-tls-version.patch
82     Patch93: openssl-fips-0.9.8e-chil-fixes.patch
83     Patch94: openssl-fips-0.9.8e-dh-check.patch
84     Patch95: openssl-fips-0.9.8e-sha2test.patch
85     Patch96: openssl-fips-0.9.8e-apps-yesno.patch
86     Patch97: openssl-fips-0.9.8e-dtls-fixes2.patch
87     Patch98: openssl-fips-0.9.8e-cve-2011-4109.patch
88     Patch99: openssl-fips-0.9.8e-cve-2011-4576.patch
89     Patch100: openssl-fips-0.9.8e-cve-2011-4619.patch
90     Patch101: openssl-fips-0.9.8e-cve-2012-0884.patch
91     Patch102: openssl-fips-0.9.8e-cve-2012-1165.patch
92     Patch103: openssl-fips-0.9.8e-cve-2012-2110.patch
93     Patch104: openssl-fips-0.9.8e-cve-2012-2333.patch
94     Patch105: openssl-fips-0.9.8e-secure-getenv.patch
95     Patch106: openssl-fips-0.9.8e-cve-2013-0166.patch
96     Patch107: openssl-fips-0.9.8e-cve-2013-0169.patch
97 charliebrady 1.3 Patch108: openssl-fips-0.9.8e-cve-2014-0224.patch
98     Patch109: openssl-fips-0.9.8e-cve-2014-0221.patch
99     Patch110: openssl-fips-0.9.8e-cve-2014-3505.patch
100     Patch111: openssl-fips-0.9.8e-cve-2014-3506.patch
101     Patch112: openssl-fips-0.9.8e-cve-2014-3508.patch
102     Patch113: openssl-fips-0.9.8e-cve-2014-3510.patch
103 vip-ire 1.5 Patch114: openssl-fips-0.9.8e-fallback-scsv.patch
104 vip-ire 1.6 Patch115: openssl-fips-0.9.8e-x509-store-lock.patch
105 vip-ire 1.8 # This patch includes the CVE-2015-0286 fix
106     Patch116: openssl-fips-0.9.8e-cve-2014-8275.patch
107     Patch117: openssl-fips-0.9.8e-cve-2015-0204.patch
108     Patch118: openssl-fips-0.9.8e-cve-2015-0287.patch
109     Patch119: openssl-fips-0.9.8e-cve-2015-0288.patch
110     Patch120: openssl-fips-0.9.8e-cve-2015-0289.patch
111     Patch121: openssl-fips-0.9.8e-cve-2015-0292.patch
112     Patch122: openssl-fips-0.9.8e-cve-2015-0293.patch
113 wellsi 1.1
114     License: BSDish
115     Group: System Environment/Libraries
116     URL: http://www.openssl.org/
117     BuildRoot: %{_tmppath}/%{name}-%{version}-root
118     BuildRequires: mktemp, krb5-devel, perl, sed, zlib-devel, /usr/bin/cmp
119     Requires: mktemp
120    
121     %description
122     The OpenSSL toolkit provides support for secure communications between
123     machines. OpenSSL includes a certificate management tool and shared
124     libraries which provide various cryptographic algorithms and
125     protocols.
126    
127     %package devel
128     Summary: Files for development of applications which will use OpenSSL
129     Group: Development/Libraries
130     Requires: %{name} = %{version}-%{release}, krb5-devel, zlib-devel
131    
132     %description devel
133     OpenSSL is a toolkit for supporting cryptography. The openssl-devel
134     package contains static libraries and include files needed to develop
135     applications which support various cryptographic algorithms and
136     protocols.
137    
138     %package perl
139     Summary: Perl scripts provided with OpenSSL
140     Group: Applications/Internet
141     Requires: perl
142     Requires: %{name} = %{version}-%{release}
143    
144     %description perl
145     OpenSSL is a toolkit for supporting cryptography. The openssl-perl
146     package provides Perl scripts for converting certificates and keys
147     from other formats to the formats used by the OpenSSL toolkit.
148    
149     %prep
150     %setup -q -n %{name}-fips-%{version}
151    
152     %{SOURCE1} > /dev/null
153     %patch0 -p1 -b .redhat
154     %patch1 -p1 -b .defaults
155     # Fix link line for libssl (bug #111154).
156     %patch2 -p1 -b .krb5
157     %patch3 -p1 -b .soversion
158     %patch4 -p1 -b .enginesdir
159     %patch5 -p1 -b .no-rpath
160    
161    
162     %patch32 -p1 -b .ia64
163     #patch33 is applied after make test
164     %patch34 -p1 -b .x509
165     %patch35 -p1 -b .version-add-engines
166     %patch38 -p1 -b .cipher-change
167     %patch39 -p1 -b .ipv6-apps
168    
169     %patch61 -p1 -b .aliasing-bug
170     %patch62 -p1 -b .name-cmp
171     %patch64 -p1 -b .dtls-fixes
172     %patch65 -p1 -b .shciphers
173     %patch67 -p1 -b .aescfb
174     %patch68 -p1 -b .abi
175     %patch69 -p1 -b .fipsmode
176     %patch70 -p1 -b .bn-fixes
177     %patch71 -p1 -b .use-fipscheck
178     %patch72 -p1 -b .env-zlib
179     %patch73 -p1 -b .default-paths
180     %patch74 -p1 -b .nonfips
181     %patch75 -p1 -b .verifysig
182     %patch76 -p1 -b .multi-crl
183     %patch77 -p1 -b .no-pairwise
184     %patch78 -p1 -b .rng-seed
185     %patch79 -p1 -b .bad-mime
186     %patch80 -p1 -b .bad-string
187     %patch81 -p1 -b .dtls-dos
188     %patch82 -p1 -b .algo-doc
189     %patch83 -p1 -b .nomd2
190     %patch84 -p1 -b .compleak
191     %patch85 -p1 -b .reneg
192     %patch86 -p1 -b .nullprinc
193     %patch87 -p1 -b .wexpand
194     %patch88 -p1 -b .disable-nsbug
195     %patch89 -p1 -b .sha256
196     %patch90 -p1 -b .sort
197     %patch91 -p1 -b .dgst
198     %patch92 -p1 -b .tlsver
199     %patch93 -p1 -b .chil
200     %patch94 -p1 -b .dh-check
201     %patch95 -p1 -b .sha2test
202     %patch96 -p1 -b .yesno
203     %patch97 -p1 -b .dtls-fixes2
204     %patch98 -p1 -b .doublefree
205     %patch99 -p1 -b .padding
206     %patch100 -p1 -b .sgc-dos
207     %patch101 -p1 -b .cms-mma
208     %patch102 -p1 -b .bad-mime2
209     %patch103 -p1 -b .biobuf
210     %patch104 -p1 -b .reclen
211     %patch105 -p1 -b .secure-getenv
212     %patch106 -p1 -b .ocsp-dos
213     %patch107 -p1 -b .lucky13
214 charliebrady 1.3 %patch108 -p1 -b .keying-mitm
215     %patch109 -p1 -b .dtls-recursion
216     %patch110 -p1 -b .dtls-doublefree
217     %patch111 -p1 -b .dtls-sizechecks
218     %patch112 -p1 -b .oid-handling
219     %patch113 -p1 -b .adh-dos
220 vip-ire 1.5 %patch114 -p1 -b .fallback-scsv
221 vip-ire 1.6 %patch115 -p1 -b .lock
222 vip-ire 1.8 %patch116 -p1 -b .cert-fingerprint
223     %patch117 -p1 -b .rsa-ephemeral
224     %patch118 -p1 -b .item-reuse
225     %patch119 -p1 -b .req-null-deref
226     %patch120 -p1 -b .pkcs7-null-deref
227     %patch121 -p1 -b .b64-underflow
228     %patch122 -p1 -b .ssl2-assert
229 wellsi 1.1
230     # Modify the various perl scripts to reference perl in the right location.
231     perl util/perlpath.pl `dirname %{__perl}`
232    
233     # Generate a table with the compile settings for my perusal.
234     touch Makefile
235     make TABLE PERL=%{__perl}
236    
237     %build
238     # Figure out which flags we want to use.
239     # default
240     sslarch=%{_os}-%{_arch}
241     %ifarch %ix86
242     sslarch=linux-elf
243     if ! echo %{_target} | grep -q i686 ; then
244     sslflags="no-asm 386"
245     fi
246     %endif
247     %ifarch sparc
248     sslarch=linux-sparcv9
249     sslflags=no-asm
250     %endif
251     %ifarch alpha
252     sslarch=linux-alpha-gcc
253     %endif
254     %ifarch s390
255     # The -fno-regmove is a workaround for bug #199604
256     sslarch="linux-generic32 -DB_ENDIAN -DNO_ASM -march=z900 -fno-regmove"
257     %endif
258     %ifarch s390x
259     sslarch="linux-generic64 -DB_ENDIAN -DNO_ASM"
260     %endif
261     # ia64, x86_64, ppc, ppc64 are OK by default
262     # Configure the build tree. Override OpenSSL defaults with known-good defaults
263     # usable on all platforms. The Configure script already knows to use -fPIC and
264     # RPM_OPT_FLAGS, so we can skip specifiying them here.
265     ./Configure \
266     --prefix=%{_prefix} --openssldir=%{_sysconfdir}/pki/tls ${sslflags} \
267     zlib no-idea no-mdc2 no-rc5 no-ec no-ecdh no-ecdsa shared \
268     --with-krb5-flavor=MIT --enginesdir=%{_libdir}/openssl/engines \
269     -I%{_prefix}/kerberos/include -L%{_prefix}/kerberos/%{_lib} \
270     ${sslarch} fipscanisterbuild
271    
272     # Add -Wa,--noexecstack here so that libcrypto's assembler modules will be
273     # marked as not requiring an executable stack.
274     RPM_OPT_FLAGS="$RPM_OPT_FLAGS -Wa,--noexecstack -DOPENSSL_USE_NEW_FUNCTIONS -fno-strict-aliasing"
275     make depend
276     make all
277    
278     # Generate hashes for the included certs.
279     make rehash
280    
281     # Overwrite FIPS README
282     cp -f %{SOURCE11} .
283    
284     # Verify that what was compiled actually works.
285     LD_LIBRARY_PATH=`pwd`${LD_LIBRARY_PATH:+:${LD_LIBRARY_PATH}}
286     export LD_LIBRARY_PATH
287     make -C test apps tests
288     %{__cc} -o openssl-thread-test \
289     `krb5-config --cflags` \
290     -I./include \
291     $RPM_OPT_FLAGS \
292     %{SOURCE8} \
293     -L. \
294     -lssl -lcrypto \
295     `krb5-config --libs` \
296     -lpthread -lz -ldl
297     ./openssl-thread-test --threads %{thread_test_threads}
298    
299     # Patch33 must be patched after tests otherwise they will fail
300     patch -p1 -b -z .ca-dir < %{PATCH33}
301    
302     # Add generation of HMAC checksum of the final stripped library
303     %define __spec_install_post \
304     %{?__debug_package:%{__debug_install_post}} \
305     %{__arch_install_post} \
306     %{__os_install_post} \
307     fips/fips_standalone_sha1 $RPM_BUILD_ROOT/%{_lib}/libcrypto.so.%{version} >$RPM_BUILD_ROOT/%{_lib}/.libcrypto.so.%{version}.hmac \
308     ln -sf .libcrypto.so.%{version}.hmac $RPM_BUILD_ROOT/%{_lib}/.libcrypto.so.%{soversion}.hmac \
309     fips/fips_standalone_sha1 $RPM_BUILD_ROOT/%{_lib}/libssl.so.%{version} >$RPM_BUILD_ROOT/%{_lib}/.libssl.so.%{version}.hmac \
310     ln -sf .libssl.so.%{version}.hmac $RPM_BUILD_ROOT/%{_lib}/.libssl.so.%{soversion}.hmac \
311     %{nil}
312    
313     %install
314     [ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT
315     # Install OpenSSL.
316     install -d $RPM_BUILD_ROOT/{%{_lib},%{_bindir},%{_includedir},%{_libdir},%{_mandir},%{_libdir}/openssl}
317     make INSTALL_PREFIX=$RPM_BUILD_ROOT install
318     make INSTALL_PREFIX=$RPM_BUILD_ROOT install_docs
319     # OpenSSL install doesn't use correct _libdir
320     mv $RPM_BUILD_ROOT/usr/lib/lib*.so.%{soversion} $RPM_BUILD_ROOT/%{_lib}/
321     mv $RPM_BUILD_ROOT/usr/lib/engines $RPM_BUILD_ROOT/%{_libdir}/openssl
322     mv $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/man/* $RPM_BUILD_ROOT%{_mandir}/
323     rmdir $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/man
324     mv $RPM_BUILD_ROOT/usr/lib/* $RPM_BUILD_ROOT%{_libdir}/ || :
325     rename so.%{soversion} so.%{version} $RPM_BUILD_ROOT/%{_lib}/*.so.%{soversion}
326     for lib in $RPM_BUILD_ROOT/%{_lib}/*.so.%{version} ; do
327     chmod 755 ${lib}
328     ln -s -f ../../%{_lib}/`basename ${lib}` $RPM_BUILD_ROOT%{_libdir}/`basename ${lib} .%{version}`
329     ln -s -f `basename ${lib}` $RPM_BUILD_ROOT/%{_lib}/`basename ${lib} .%{version}`.%{soversion}
330     rm -f $RPM_BUILD_ROOT%{_libdir}/`basename ${lib} .%{version}`.%{soversion}
331     done
332    
333     # Install a makefile for generating keys and self-signed certs, and a script
334     # for generating them on the fly.
335     mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/certs
336     install -m644 %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/certs/Makefile
337     install -m755 %{SOURCE6} $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/certs/make-dummy-cert
338    
339     # Make sure we actually include the headers we built against.
340     for header in $RPM_BUILD_ROOT%{_includedir}/openssl/* ; do
341     if [ -f ${header} -a -f include/openssl/$(basename ${header}) ] ; then
342     install -m644 include/openssl/`basename ${header}` ${header}
343     fi
344     done
345    
346     # Rename man pages so that they don't conflict with other system man pages.
347     pushd $RPM_BUILD_ROOT%{_mandir}
348     for manpage in man*/* ; do
349     if [ -L ${manpage} ]; then
350     TARGET=`ls -l ${manpage} | awk '{ print $NF }'`
351     ln -snf ${TARGET}ssl ${manpage}ssl
352     rm -f ${manpage}
353     else
354     mv ${manpage} ${manpage}ssl
355     fi
356     done
357     for conflict in passwd rand ; do
358     rename ${conflict} ssl${conflict} man*/${conflict}*
359     done
360     popd
361    
362     # Pick a CA script.
363     pushd $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/misc
364     mv CA.sh CA
365     popd
366    
367     mkdir -m700 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA
368     mkdir -m700 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA/private
369    
370     # Install root CA stuffs.
371     cat << EOF > RHNS-blurb.txt
372     #
373     # RHNS CA certificate. Appended to the ca-bundle at package build-time.
374     #
375     EOF
376     cat %{SOURCE3} RHNS-blurb.txt %{SOURCE4} > ca-bundle.crt
377     install -m644 ca-bundle.crt $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/certs/
378     ln -s certs/ca-bundle.crt $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/cert.pem
379    
380     # Fix libdir.
381     pushd $RPM_BUILD_ROOT/%{_libdir}/pkgconfig
382     for i in *.pc ; do
383     sed 's,^libdir=${exec_prefix}/lib,libdir=${exec_prefix}/%{_lib},g' \
384     $i >$i.tmp && \
385     cat $i.tmp >$i && \
386     rm -f $i.tmp
387     done
388     popd
389    
390     # Determine which arch opensslconf.h is going to try to #include.
391     basearch=%{_arch}
392     %ifarch %{ix86}
393     basearch=i386
394     %endif
395    
396     %ifarch %{multilib_arches}
397     # Do an opensslconf.h switcheroo to avoid file conflicts on systems where you
398     # can have both a 32- and 64-bit version of the library, and they each need
399     # their own correct-but-different versions of opensslconf.h to be usable.
400     install -m644 %{SOURCE10} \
401     $RPM_BUILD_ROOT/%{_prefix}/include/openssl/opensslconf-${basearch}.h
402     cat $RPM_BUILD_ROOT/%{_prefix}/include/openssl/opensslconf.h >> \
403     $RPM_BUILD_ROOT/%{_prefix}/include/openssl/opensslconf-${basearch}.h
404     install -m644 %{SOURCE9} \
405     $RPM_BUILD_ROOT/%{_prefix}/include/openssl/opensslconf.h
406     %endif
407    
408     %ifarch %{optimize_arches}
409     # Remove bits which belong in subpackages.
410     rm -rf $RPM_BUILD_ROOT/%{_prefix}/include/openssl
411     rm -rf $RPM_BUILD_ROOT/%{_libdir}/*.a
412     rm -rf $RPM_BUILD_ROOT/%{_libdir}/*.so
413     rm -rf $RPM_BUILD_ROOT/%{_libdir}/pkgconfig
414     rm -rf $RPM_BUILD_ROOT/%{_mandir}/man3/*
415    
416     rm -rf $RPM_BUILD_ROOT/%{_bindir}/c_rehash
417     rm -rf $RPM_BUILD_ROOT/%{_mandir}/man1*/*.pl*
418     rm -rf $RPM_BUILD_ROOT/%{_sysconfdir}/pki/tls/misc/*.pl
419     %endif
420    
421     # Remove fips fingerprint script
422     rm -rf $RPM_BUILD_ROOT/%{_bindir}/openssl_fips_fingerprint
423    
424     %clean
425     [ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT
426    
427     %files
428     %defattr(-,root,root)
429     %doc FAQ LICENSE CHANGES NEWS INSTALL README
430     %doc doc/c-indentation.el doc/openssl.txt
431     %doc doc/openssl_button.html doc/openssl_button.gif
432     %doc doc/ssleay.txt
433     %doc README.FIPS
434     %dir %{_sysconfdir}/pki/tls
435     %dir %{_sysconfdir}/pki/tls/certs
436     %{_sysconfdir}/pki/tls/certs/make-dummy-cert
437     %{_sysconfdir}/pki/tls/certs/Makefile
438     %{_sysconfdir}/pki/tls/cert.pem
439     %dir %{_sysconfdir}/pki/tls/misc
440     %{_sysconfdir}/pki/tls/misc/CA
441     %dir %{_sysconfdir}/pki/CA
442     %dir %{_sysconfdir}/pki/CA/private
443     %{_sysconfdir}/pki/tls/misc/c_*
444     %{_sysconfdir}/pki/tls/private
445    
446     %config(noreplace) %{_sysconfdir}/pki/tls/openssl.cnf
447     %config(noreplace) %{_sysconfdir}/pki/tls/certs/ca-bundle.crt
448    
449     %attr(0755,root,root) %{_bindir}/openssl
450     %attr(0755,root,root) /%{_lib}/*.so.%{version}
451     %attr(0755,root,root) /%{_lib}/*.so.%{soversion}
452     %attr(0644,root,root) /%{_lib}/.libcrypto.so.*.hmac
453     %attr(0644,root,root) /%{_lib}/.libssl.so.*.hmac
454     %dir %{_libdir}/openssl
455     %attr(0755,root,root) %{_libdir}/openssl/engines
456     %attr(0644,root,root) %{_mandir}/man1*/[ABD-Zabcd-z]*
457     %attr(0644,root,root) %{_mandir}/man5*/*
458     %attr(0644,root,root) %{_mandir}/man7*/*
459    
460     %ifnarch %{optimize_arches}
461     %files devel
462     %defattr(-,root,root)
463     %{_prefix}/include/openssl
464     %attr(0644,root,root) %{_libdir}/*.a
465     %attr(0755,root,root) %{_libdir}/*.so
466     %attr(0644,root,root) %{_mandir}/man3*/*
467     %attr(0644,root,root) %{_libdir}/pkgconfig/*.pc
468    
469     %files perl
470     %defattr(-,root,root)
471     %attr(0755,root,root) %{_bindir}/c_rehash
472     %attr(0644,root,root) %{_mandir}/man1*/*.pl*
473     %dir %{_sysconfdir}/pki/tls/misc
474     %{_sysconfdir}/pki/tls/misc/*.pl
475     %endif
476    
477     %post -p /sbin/ldconfig
478    
479     %postun -p /sbin/ldconfig
480    
481     %changelog
482 vip-ire 1.8 * Wed Apr 15 2015 Daniel Berteaud <daniel@firewall-services.com 0.9.8e-33.1.sme
483     - update with ca-bundle.crt from SME 9 [SME: 8909]
484    
485     * Thu Apr 2 2015 Tomas Mraz <tmraz@redhat.com> 0.9.8e-33
486     - fix CVE-2014-8275 (without introduction of CVE-2015-0286) - various
487     certificate fingerprint issues
488     - fix CVE-2015-0204 - remove support for RSA ephemeral keys for non-export
489     ciphersuites and on server
490     - fix CVE-2015-0287 - ASN.1 structure reuse decoding memory corruption
491     - fix CVE-2015-0288 - X509_to_X509_REQ NULL pointer dereference
492     - fix CVE-2015-0289 - NULL dereference decoding invalid PKCS#7 data
493     - fix CVE-2015-0292 - integer underflow in base64 decoder
494     - fix CVE-2015-0293 - triggerable assert in SSLv2 server
495 vip-ire 1.6
496     * Wed Dec 17 2014 Tomas Mraz <tmraz@redhat.com> 0.9.8e-32
497     - properly lock X509_STORE accesses (#1168938)
498 charliebrady 1.4
499 vip-ire 1.5 * Wed Oct 15 2014 Tomas Mraz <tmraz@redhat.com> 0.9.8e-31
500     - add support for fallback SCSV to partially mitigate CVE-2014-3566
501     (padding attack on SSL3)
502    
503 vip-ire 1.6 * Fri Aug 8 2014 Tomas Mraz <tmraz@redhat.com> 0.9.8e-30
504 charliebrady 1.3 - fix CVE-2014-0221 - recursion in DTLS code leading to DoS
505     - fix CVE-2014-3505 - doublefree in DTLS packet processing
506     - fix CVE-2014-3506 - avoid memory exhaustion in DTLS
507     - fix CVE-2014-3508 - fix OID handling to avoid information leak
508     - fix CVE-2014-3510 - fix DoS in anonymous (EC)DH handling in DTLS
509    
510 vip-ire 1.6 * Mon Jun 2 2014 Tomas Mraz <tmraz@redhat.com> 0.9.8e-29
511 charliebrady 1.3 - fix for CVE-2014-0224 - SSL/TLS MITM vulnerability
512 wellsi 1.2
513 vip-ire 1.6 * Tue Jan 28 2014 Tomas Mraz <tmraz@redhat.com> 0.9.8e-28
514 wellsi 1.1 - replace expired GlobalSign Root CA certificate in ca-bundle.crt
515    
516     * Mon Feb 25 2013 Tomas Mraz <tmraz@redhat.com> 0.9.8e-27
517     - fix for CVE-2013-0169 - SSL/TLS CBC timing attack (#907589)
518     - fix for CVE-2013-0166 - DoS in OCSP signatures checking (#908052)
519     - enable compression only if explicitly asked for or OPENSSL_DEFAULT_ZLIB
520     environment variable is set (fixes CVE-2012-4929 #857051)
521     - use __secure_getenv() everywhere instead of getenv() (#839735)
522    
523     * Tue May 15 2012 Tomas Mraz <tmraz@redhat.com> 0.9.8e-26
524     - fix for CVE-2012-2333 - improper checking for record length in DTLS (#820686)
525    
526     * Mon Apr 23 2012 Tomas Mraz <tmraz@redhat.com> 0.9.8e-25
527     - fix for CVE-2012-2110 - memory corruption in asn1_d2i_read_bio() (#814185)
528    
529     * Mon Mar 19 2012 Tomas Mraz <tmraz@redhat.com> 0.9.8e-23
530     - fix problem with the SGC restart patch that might terminate handshake
531     incorrectly
532     - fix for CVE-2012-0884 - MMA weakness in CMS and PKCS#7 code (#802725)
533     - fix for CVE-2012-1165 - NULL read dereference on bad MIME headers (#802489)
534    
535     * Wed Jan 18 2012 Tomas Mraz <tmraz@redhat.com> 0.9.8e-22
536     - fix for CVE-2011-4108 & CVE-2012-0050 - DTLS plaintext recovery
537     vulnerability and additional DTLS fixes (#771770)
538     - fix for CVE-2011-4109 - double free in policy checks (#771771)
539     - fix for CVE-2011-4576 - uninitialized SSL 3.0 padding (#771775)
540     - fix for CVE-2011-4619 - SGC restart DoS attack (#771780)
541    
542     * Tue Oct 18 2011 Tomas Mraz <tmraz@redhat.com> 0.9.8e-21
543     - add known answer test for SHA2 algorithms (#740866)
544     - make default private key length in certificate Makefile 2048 bits
545     (can be changed with PRIVATE_KEY_BITS setting) (#745410)
546     - fix incorrect return value in parse_yesno() (#726593)
547     - added DigiCert CA certificates to ca-bundle (#735819)
548     - added a new section about error states to README.FIPS (#628976)
549    
550     * Wed May 4 2011 Tomas Mraz <tmraz@redhat.com> 0.9.8e-20
551     - add missing DH_check_pub_key() call when DH key is computed (#698175)
552    
553     * Mon Apr 4 2011 Tomas Mraz <tmraz@redhat.com> 0.9.8e-19
554     - presort list of ciphers available in SSL (#688901)
555     - accept connection in s_server even if getaddrinfo() fails (#561260)
556     - point to openssl dgst for list of supported digests (#608639)
557     - fix handling of future TLS versions (#599112)
558     - added VeriSign Class 3 Public Primary Certification Authority - G5
559     and StartCom Certification Authority certs to ca-bundle (#675671, #617856)
560     - upstream fixes for the CHIL engine (#622003, #671484)
561    
562     * Wed Mar 9 2011 Tomas Mraz <tmraz@redhat.com> 0.9.8e-18
563     - add SHA-2 hashes in SSL_library_init() (#676384)
564    
565     * Tue Dec 7 2010 Tomas Mraz <tmraz@redhat.com> 0.9.8e-17
566     - fix CVE-2010-4180 - completely disable code for
567     SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG (#659462)
568    
569     * Fri Mar 12 2010 Tomas Mraz <tmraz@redhat.com> 0.9.8e-16
570     - fix CVE-2009-3245 - add missing bn_wexpand return checks (#570924)
571    
572     * Thu Mar 4 2010 Tomas Mraz <tmraz@redhat.com> 0.9.8e-15
573     - fix CVE-2010-0433 - do not pass NULL princ to krb5_kt_get_entry which
574     in the RHEL-5 and newer versions will crash in such case (#569774)
575    
576     * Thu Feb 18 2010 Tomas Mraz <tmraz@redhat.com> 0.9.8e-14
577     - fix CVE-2009-3555 - support the safe renegotiation extension and
578     do not allow legacy renegotiation on the server by default (#533125)
579    
580     * Thu Jan 14 2010 Tomas Mraz <tmraz@redhat.com> 0.9.8e-13
581     - fix CVE-2009-2409 - drop MD2 algorithm from EVP tables (#510197)
582     - fix CVE-2009-4355 - do not leak memory when CRYPTO_cleanup_all_ex_data()
583     is called prematurely by application (#546707)
584    
585     * Mon Jun 29 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8e-12
586     - abort if selftests failed and random number generator is polled
587     - mention EVP_aes and EVP_sha2xx routines in the manpages
588     - add README.FIPS
589    
590     * Thu May 21 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8e-10
591     - fix CVE-2009-1386 CVE-2009-1387 (DTLS DoS problems)
592     (#503685, #503688)
593    
594     * Thu May 21 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8e-9
595     - fix CVE-2009-1377 CVE-2009-1378 CVE-2009-1379
596     (DTLS DoS problems) (#501253, #501254, #501572)
597    
598     * Wed Apr 15 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8e-8
599     - support multiple CRLs with same subject in a store (#457134)
600     - fix CVE-2009-0590 - reject incorrectly encoded ASN.1 strings (#492304)
601     - seed FIPS rng directly from kernel random device
602     - do not require fipscheck to build the package (#475798)
603     - call pairwise key tests in FIPS mode only (#479817)
604     - do not crash when parsing bad mime data (#472440)
605    
606     * Tue Dec 16 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8e-7
607     - fix CVE-2008-5077 - incorrect checks for malformed signatures (#476671)
608    
609     * Fri Oct 31 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8e-6
610     - allow lookup of algorithms in engine
611    
612     * Fri Oct 24 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8e-5
613     - implement the integrity checking inside libcrypto so OpenSSL
614     can be used in FIPS mode by the fipscheck library
615    
616     * Thu Oct 9 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8e-4
617     - FIPS mode kernel flag is /proc/sys/crypto/fips_enabled
618    
619     * Wed Sep 10 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8e-3
620     - disable strict aliasing
621    
622     * Tue Sep 9 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8e-2
623     - more changes for FIPS validation (#444800)
624     - correctly initialize default CA paths (#450987)
625     - allow disabling zlib support through environment (#442624)
626    
627     * Tue Jul 15 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8e-1
628     - rebase to version undergoing FIPS validation (#455634)
629    
630     * Tue Jan 15 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8b-10
631     - compile with -march=z900 on s390 for performance improvements (#250818)
632     - make ssl session ID matching strict (#233599)
633    
634     * Mon Oct 8 2007 Tomas Mraz <tmraz@redhat.com> 0.9.8b-9
635     - fix CVE-2007-3108 - side channel attack on private keys (#250581)
636     - fix CVE-2007-5135 - off-by-one in SSL_get_shared_ciphers (#309881)
637     - fix CVE-2007-4995 - out of order DTLS fragments buffer overflow (#321221)
638    
639     * Thu Nov 30 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-8.3
640     - the previous change still didn't make X509_NAME_cmp transitive
641    
642     * Thu Nov 23 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-8.2
643     - make X509_NAME_cmp transitive otherwise certificate lookup
644     is broken (#216050)
645    
646     * Fri Nov 3 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-8.1
647     - aliasing bug in engine loading, patch by IBM (#213216)
648    
649     * Mon Oct 2 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-8
650     - CVE-2006-2940 fix was incorrect (#208744)
651    
652     * Mon Sep 25 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-7
653     - fix CVE-2006-2937 - mishandled error on ASN.1 parsing (#207276)
654     - fix CVE-2006-2940 - parasitic public keys DoS (#207274)
655     - fix CVE-2006-3738 - buffer overflow in SSL_get_shared_ciphers (#206940)
656     - fix CVE-2006-4343 - sslv2 client DoS (#206940)
657    
658     * Tue Sep 5 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-6
659     - fix CVE-2006-4339 - prevent attack on PKCS#1 v1.5 signatures (#205180)
660    
661     * Wed Aug 2 2006 Tomas Mraz <tmraz@redhat.com> - 0.9.8b-5
662     - set buffering to none on stdio/stdout FILE when bufsize is set (#200580)
663     patch by IBM
664    
665     * Fri Jul 28 2006 Alexandre Oliva <aoliva@redhat.com> - 0.9.8b-4.1
666     - rebuild with new binutils (#200330)
667    
668     * Fri Jul 21 2006 Tomas Mraz <tmraz@redhat.com> - 0.9.8b-4
669     - add a temporary workaround for sha512 test failure on s390 (#199604)
670    
671     * Thu Jul 20 2006 Tomas Mraz <tmraz@redhat.com>
672     - add ipv6 support to s_client and s_server (by Jan Pazdziora) (#198737)
673     - add patches for BN threadsafety, AES cache collision attack hazard fix and
674     pkcs7 code memleak fix from upstream CVS
675    
676     * Wed Jul 12 2006 Jesse Keating <jkeating@redhat.com> - 0.9.8b-3.1
677     - rebuild
678    
679     * Wed Jun 21 2006 Tomas Mraz <tmraz@redhat.com> - 0.9.8b-3
680     - dropped libica and ica engine from build
681    
682     * Wed Jun 21 2006 Joe Orton <jorton@redhat.com>
683     - update to new CA bundle from mozilla.org; adds CA certificates
684     from netlock.hu and startcom.org
685    
686     * Mon Jun 5 2006 Tomas Mraz <tmraz@redhat.com> - 0.9.8b-2
687     - fixed a few rpmlint warnings
688     - better fix for #173399 from upstream
689     - upstream fix for pkcs12
690    
691     * Thu May 11 2006 Tomas Mraz <tmraz@redhat.com> - 0.9.8b-1
692     - upgrade to new version, stays ABI compatible
693     - there is no more linux/config.h (it was empty anyway)
694    
695     * Tue Apr 4 2006 Tomas Mraz <tmraz@redhat.com> - 0.9.8a-6
696     - fix stale open handles in libica (#177155)
697     - fix build if 'rand' or 'passwd' in buildroot path (#178782)
698     - initialize VIA Padlock engine (#186857)
699    
700     * Fri Feb 10 2006 Jesse Keating <jkeating@redhat.com> - 0.9.8a-5.2
701     - bump again for double-long bug on ppc(64)
702    
703     * Tue Feb 07 2006 Jesse Keating <jkeating@redhat.com> - 0.9.8a-5.1
704     - rebuilt for new gcc4.1 snapshot and glibc changes
705    
706     * Thu Dec 15 2005 Tomas Mraz <tmraz@redhat.com> 0.9.8a-5
707     - don't include SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
708     in SSL_OP_ALL (#175779)
709    
710     * Fri Dec 09 2005 Jesse Keating <jkeating@redhat.com>
711     - rebuilt
712    
713     * Tue Nov 29 2005 Tomas Mraz <tmraz@redhat.com> 0.9.8a-4
714     - fix build (-lcrypto was erroneusly dropped) of the updated libica
715     - updated ICA engine to 1.3.6-rc3
716    
717     * Tue Nov 22 2005 Tomas Mraz <tmraz@redhat.com> 0.9.8a-3
718     - disable builtin compression methods for now until they work
719     properly (#173399)
720    
721     * Wed Nov 16 2005 Tomas Mraz <tmraz@redhat.com> 0.9.8a-2
722     - don't set -rpath for openssl binary
723    
724     * Tue Nov 8 2005 Tomas Mraz <tmraz@redhat.com> 0.9.8a-1
725     - new upstream version
726     - patches partially renumbered
727    
728     * Fri Oct 21 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-11
729     - updated IBM ICA engine library and patch to latest upstream version
730    
731     * Wed Oct 12 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-10
732     - fix CAN-2005-2969 - remove SSL_OP_MSIE_SSLV2_RSA_PADDING which
733     disables the countermeasure against man in the middle attack in SSLv2
734     (#169863)
735     - use sha1 as default for CA and cert requests - CAN-2005-2946 (#169803)
736    
737     * Tue Aug 23 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-9
738     - add *.so.soversion as symlinks in /lib (#165264)
739     - remove unpackaged symlinks (#159595)
740     - fixes from upstream (constant time fixes for DSA,
741     bn assembler div on ppc arch, initialize memory on realloc)
742    
743     * Thu Aug 11 2005 Phil Knirsch <pknirsch@redhat.com> 0.9.7f-8
744     - Updated ICA engine IBM patch to latest upstream version.
745    
746     * Thu May 19 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-7
747     - fix CAN-2005-0109 - use constant time/memory access mod_exp
748     so bits of private key aren't leaked by cache eviction (#157631)
749     - a few more fixes from upstream 0.9.7g
750    
751     * Wed Apr 27 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-6
752     - use poll instead of select in rand (#128285)
753     - fix Makefile.certificate to point to /etc/pki/tls
754     - change the default string mask in ASN1 to PrintableString+UTF8String
755    
756     * Mon Apr 25 2005 Joe Orton <jorton@redhat.com> 0.9.7f-5
757     - update to revision 1.37 of Mozilla CA bundle
758    
759     * Thu Apr 21 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-4
760     - move certificates to _sysconfdir/pki/tls (#143392)
761     - move CA directories to _sysconfdir/pki/CA
762     - patch the CA script and the default config so it points to the
763     CA directories
764    
765     * Fri Apr 1 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-3
766     - uninitialized variable mustn't be used as input in inline
767     assembly
768     - reenable the x86_64 assembly again
769    
770     * Thu Mar 31 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-2
771     - add back RC4_CHAR on ia64 and x86_64 so the ABI isn't broken
772     - disable broken bignum assembly on x86_64
773    
774     * Wed Mar 30 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-1
775     - reenable optimizations on ppc64 and assembly code on ia64
776     - upgrade to new upstream version (no soname bump needed)
777     - disable thread test - it was testing the backport of the
778     RSA blinding - no longer needed
779     - added support for changing serial number to
780     Makefile.certificate (#151188)
781     - make ca-bundle.crt a config file (#118903)
782    
783     * Tue Mar 1 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7e-3
784     - libcrypto shouldn't depend on libkrb5 (#135961)
785    
786     * Mon Feb 28 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7e-2
787     - rebuild
788    
789     * Mon Feb 28 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7e-1
790     - new upstream source, updated patches
791     - added patch so we are hopefully ABI compatible with upcoming
792     0.9.7f
793    
794     * Thu Feb 10 2005 Tomas Mraz <tmraz@redhat.com>
795     - Support UTF-8 charset in the Makefile.certificate (#134944)
796     - Added cmp to BuildPrereq
797    
798     * Thu Jan 27 2005 Joe Orton <jorton@redhat.com> 0.9.7a-46
799     - generate new ca-bundle.crt from Mozilla certdata.txt (revision 1.32)
800    
801     * Thu Dec 23 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-45
802     - Fixed and updated libica-1.3.4-urandom.patch patch (#122967)
803    
804     * Fri Nov 19 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-44
805     - rebuild
806    
807     * Fri Nov 19 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-43
808     - rebuild
809    
810     * Fri Nov 19 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-42
811     - rebuild
812    
813     * Fri Nov 19 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-41
814     - remove der_chop, as upstream cvs has done (CAN-2004-0975, #140040)
815    
816     * Tue Oct 05 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-40
817     - Include latest libica version with important bugfixes
818    
819     * Tue Jun 15 2004 Elliot Lee <sopwith@redhat.com>
820     - rebuilt
821    
822     * Mon Jun 14 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-38
823     - Updated ICA engine IBM patch to latest upstream version.
824    
825     * Mon Jun 7 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-37
826     - build for linux-alpha-gcc instead of alpha-gcc on alpha (Jeff Garzik)
827    
828     * Tue May 25 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-36
829     - handle %%{_arch}=i486/i586/i686/athlon cases in the intermediate
830     header (#124303)
831    
832     * Thu Mar 25 2004 Joe Orton <jorton@redhat.com> 0.9.7a-35
833     - add security fixes for CAN-2004-0079, CAN-2004-0112
834    
835     * Tue Mar 16 2004 Phil Knirsch <pknirsch@redhat.com>
836     - Fixed libica filespec.
837    
838     * Thu Mar 10 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-34
839     - ppc/ppc64 define __powerpc__/__powerpc64__, not __ppc__/__ppc64__, fix
840     the intermediate header
841    
842     * Wed Mar 10 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-33
843     - add an intermediate <openssl/opensslconf.h> which points to the right
844     arch-specific opensslconf.h on multilib arches
845    
846     * Tue Mar 02 2004 Elliot Lee <sopwith@redhat.com>
847     - rebuilt
848    
849     * Thu Feb 26 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-32
850     - Updated libica to latest upstream version 1.3.5.
851    
852     * Tue Feb 17 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-31
853     - Update ICA crypto engine patch from IBM to latest version.
854    
855     * Fri Feb 13 2004 Elliot Lee <sopwith@redhat.com>
856     - rebuilt
857    
858     * Fri Feb 13 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-29
859     - rebuilt
860    
861     * Wed Feb 11 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-28
862     - Fixed libica build.
863    
864     * Wed Feb 4 2004 Nalin Dahyabhai <nalin@redhat.com>
865     - add "-ldl" to link flags added for Linux-on-ARM (#99313)
866    
867     * Wed Feb 4 2004 Joe Orton <jorton@redhat.com> 0.9.7a-27
868     - updated ca-bundle.crt: removed expired GeoTrust roots, added
869     freessl.com root, removed trustcenter.de Class 0 root
870    
871     * Sun Nov 30 2003 Tim Waugh <twaugh@redhat.com> 0.9.7a-26
872     - Fix link line for libssl (bug #111154).
873    
874     * Fri Oct 24 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-25
875     - add dependency on zlib-devel for the -devel package, which depends on zlib
876     symbols because we enable zlib for libssl (#102962)
877    
878     * Fri Oct 24 2003 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-24
879     - Use /dev/urandom instead of PRNG for libica.
880     - Apply libica-1.3.5 fix for /dev/urandom in icalinux.c
881     - Use latest ICA engine patch from IBM.
882    
883     * Sat Oct 4 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-22.1
884     - rebuild
885    
886     * Wed Oct 1 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-22
887     - rebuild (22 wasn't actually built, fun eh?)
888    
889     * Tue Sep 30 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-23
890     - re-disable optimizations on ppc64
891    
892     * Tue Sep 30 2003 Joe Orton <jorton@redhat.com>
893     - add a_mbstr.c fix for 64-bit platforms from CVS
894    
895     * Tue Sep 30 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-22
896     - add -Wa,--noexecstack to RPM_OPT_FLAGS so that assembled modules get tagged
897     as not needing executable stacks
898    
899     * Mon Sep 29 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-21
900     - rebuild
901    
902     * Thu Sep 25 2003 Nalin Dahyabhai <nalin@redhat.com>
903     - re-enable optimizations on ppc64
904    
905     * Thu Sep 25 2003 Nalin Dahyabhai <nalin@redhat.com>
906     - remove exclusivearch
907    
908     * Wed Sep 24 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-20
909     - only parse a client cert if one was requested
910     - temporarily exclusivearch for %%{ix86}
911    
912     * Tue Sep 23 2003 Nalin Dahyabhai <nalin@redhat.com>
913     - add security fixes for protocol parsing bugs (CAN-2003-0543, CAN-2003-0544)
914     and heap corruption (CAN-2003-0545)
915     - update RHNS-CA-CERT files
916     - ease back on the number of threads used in the threading test
917    
918     * Wed Sep 17 2003 Matt Wilson <msw@redhat.com> 0.9.7a-19
919     - rebuild to fix gzipped file md5sums (#91211)
920    
921     * Mon Aug 25 2003 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-18
922     - Updated libica to version 1.3.4.
923    
924     * Thu Jul 17 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-17
925     - rebuild
926    
927     * Tue Jul 15 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-10.9
928     - free the kssl_ctx structure when we free an SSL structure (#99066)
929    
930     * Fri Jul 10 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-16
931     - rebuild
932    
933     * Thu Jul 10 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-15
934     - lower thread test count on s390x
935    
936     * Tue Jul 8 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-14
937     - rebuild
938    
939     * Thu Jun 26 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-13
940     - disable assembly on arches where it seems to conflict with threading
941    
942     * Thu Jun 26 2003 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-12
943     - Updated libica to latest upstream version 1.3.0
944    
945     * Wed Jun 11 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-9.9
946     - rebuild
947    
948     * Wed Jun 11 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-11
949     - rebuild
950    
951     * Tue Jun 10 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-10
952     - ubsec: don't stomp on output data which might also be input data
953    
954     * Tue Jun 10 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-9
955     - temporarily disable optimizations on ppc64
956    
957     * Mon Jun 9 2003 Nalin Dahyabhai <nalin@redhat.com>
958     - backport fix for engine-used-for-everything from 0.9.7b
959     - backport fix for prng not being seeded causing problems, also from 0.9.7b
960     - add a check at build-time to ensure that RSA is thread-safe
961     - keep perlpath from stomping on the libica configure scripts
962    
963     * Fri Jun 6 2003 Nalin Dahyabhai <nalin@redhat.com>
964     - thread-safety fix for RSA blinding
965    
966     * Wed Jun 04 2003 Elliot Lee <sopwith@redhat.com> 0.9.7a-8
967     - rebuilt
968    
969     * Fri May 30 2003 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-7
970     - Added libica-1.2 to openssl (featurerequest).
971    
972     * Wed Apr 16 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-6
973     - fix building with incorrect flags on ppc64
974    
975     * Wed Mar 19 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-5
976     - add patch to harden against Klima-Pokorny-Rosa extension of Bleichenbacher's
977     attack (CAN-2003-0131)
978    
979     * Mon Mar 17 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-4
980     - add patch to enable RSA blinding by default, closing a timing attack
981     (CAN-2003-0147)
982    
983     * Wed Mar 5 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-3
984     - disable use of BN assembly module on x86_64, but continue to allow inline
985     assembly (#83403)
986    
987     * Thu Feb 27 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-2
988     - disable EC algorithms
989    
990     * Wed Feb 19 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-1
991     - update to 0.9.7a
992    
993     * Wed Feb 19 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7-8
994     - add fix to guard against attempts to allocate negative amounts of memory
995     - add patch for CAN-2003-0078, fixing a timing attack
996    
997     * Thu Feb 13 2003 Elliot Lee <sopwith@redhat.com> 0.9.7-7
998     - Add openssl-ppc64.patch
999    
1000     * Mon Feb 10 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7-6
1001     - EVP_DecryptInit should call EVP_CipherInit() instead of EVP_CipherInit_ex(),
1002     to get the right behavior when passed uninitialized context structures
1003     (#83766)
1004     - build with -mcpu=ev5 on alpha family (#83828)
1005    
1006     * Wed Jan 22 2003 Tim Powers <timp@redhat.com>
1007     - rebuilt
1008    
1009     * Fri Jan 17 2003 Phil Knirsch <pknirsch@redhat.com> 0.9.7-4
1010     - Added IBM hw crypto support patch.
1011    
1012     * Wed Jan 15 2003 Nalin Dahyabhai <nalin@redhat.com>
1013     - add missing builddep on sed
1014    
1015     * Thu Jan 9 2003 Bill Nottingham <notting@redhat.com> 0.9.7-3
1016     - debloat
1017     - fix broken manpage symlinks
1018    
1019     * Wed Jan 8 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7-2
1020     - fix double-free in 'openssl ca'
1021    
1022     * Fri Jan 3 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7-1
1023     - update to 0.9.7 final
1024    
1025     * Tue Dec 17 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.7-0
1026     - update to 0.9.7 beta6 (DO NOT USE UNTIL UPDATED TO FINAL 0.9.7)
1027    
1028     * Wed Dec 11 2002 Nalin Dahyabhai <nalin@redhat.com>
1029     - update to 0.9.7 beta5 (DO NOT USE UNTIL UPDATED TO FINAL 0.9.7)
1030    
1031     * Tue Oct 22 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-30
1032     - add configuration stanza for x86_64 and use it on x86_64
1033     - build for linux-ppc on ppc
1034     - start running the self-tests again
1035    
1036     * Wed Oct 02 2002 Elliot Lee <sopwith@redhat.com> 0.9.6b-29hammer.3
1037     - Merge fixes from previous hammer packages, including general x86-64 and
1038     multilib
1039    
1040     * Tue Aug 6 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-29
1041     - rebuild
1042    
1043     * Thu Aug 1 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-28
1044     - update asn patch to fix accidental reversal of a logic check
1045    
1046     * Wed Jul 31 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-27
1047     - update asn patch to reduce chance that compiler optimization will remove
1048     one of the added tests
1049    
1050     * Wed Jul 31 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-26
1051     - rebuild
1052    
1053     * Mon Jul 29 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-25
1054     - add patch to fix ASN.1 vulnerabilities
1055    
1056     * Thu Jul 25 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-24
1057     - add backport of Ben Laurie's patches for OpenSSL 0.9.6d
1058    
1059     * Wed Jul 17 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-23
1060     - own %{_datadir}/ssl/misc
1061    
1062     * Fri Jun 21 2002 Tim Powers <timp@redhat.com>
1063     - automated rebuild
1064    
1065     * Sun May 26 2002 Tim Powers <timp@redhat.com>
1066     - automated rebuild
1067    
1068     * Fri May 17 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-20
1069     - free ride through the build system (whee!)
1070    
1071     * Thu May 16 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-19
1072     - rebuild in new environment
1073    
1074     * Thu Apr 4 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-17, 0.9.6b-18
1075     - merge RHL-specific bits into stronghold package, rename
1076    
1077     * Tue Apr 02 2002 Gary Benson <gbenson@redhat.com> stronghold-0.9.6c-2
1078     - add support for Chrysalis Luna token
1079    
1080     * Tue Mar 26 2002 Gary Benson <gbenson@redhat.com>
1081     - disable AEP random number generation, other AEP fixes
1082    
1083     * Fri Mar 15 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-15
1084     - only build subpackages on primary arches
1085    
1086     * Thu Mar 14 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-13
1087     - on ia32, only disable use of assembler on i386
1088     - enable assembly on ia64
1089    
1090     * Mon Jan 7 2002 Florian La Roche <Florian.LaRoche@redhat.de> 0.9.6b-11
1091     - fix sparcv9 entry
1092    
1093     * Mon Jan 7 2002 Gary Benson <gbenson@redhat.com> stronghold-0.9.6c-1
1094     - upgrade to 0.9.6c
1095     - bump BuildArch to i686 and enable assembler on all platforms
1096     - synchronise with shrimpy and rawhide
1097     - bump soversion to 3
1098    
1099     * Wed Oct 10 2001 Florian La Roche <Florian.LaRoche@redhat.de>
1100     - delete BN_LLONG for s390x, patch from Oliver Paukstadt
1101    
1102     * Mon Sep 17 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-9
1103     - update AEP driver patch
1104    
1105     * Mon Sep 10 2001 Nalin Dahyabhai <nalin@redhat.com>
1106     - adjust RNG disabling patch to match version of patch from Broadcom
1107    
1108     * Fri Sep 7 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-8
1109     - disable the RNG in the ubsec engine driver
1110    
1111     * Tue Aug 28 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-7
1112     - tweaks to the ubsec engine driver
1113    
1114     * Fri Aug 24 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-6
1115     - tweaks to the ubsec engine driver
1116    
1117     * Thu Aug 23 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-5
1118     - update ubsec engine driver from Broadcom
1119    
1120     * Fri Aug 10 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-4
1121     - move man pages back to %%{_mandir}/man?/foo.?ssl from
1122     %%{_mandir}/man?ssl/foo.?
1123     - add an [ engine ] section to the default configuration file
1124    
1125     * Thu Aug 9 2001 Nalin Dahyabhai <nalin@redhat.com>
1126     - add a patch for selecting a default engine in SSL_library_init()
1127    
1128     * Mon Jul 23 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-3
1129     - add patches for AEP hardware support
1130     - add patch to keep trying when we fail to load a cert from a file and
1131     there are more in the file
1132     - add missing prototype for ENGINE_ubsec() in engine_int.h
1133    
1134     * Wed Jul 18 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-2
1135     - actually add hw_ubsec to the engine list
1136    
1137     * Tue Jul 17 2001 Nalin Dahyabhai <nalin@redhat.com>
1138     - add in the hw_ubsec driver from CVS
1139    
1140     * Wed Jul 11 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-1
1141     - update to 0.9.6b
1142    
1143     * Thu Jul 5 2001 Nalin Dahyabhai <nalin@redhat.com>
1144     - move .so symlinks back to %%{_libdir}
1145    
1146     * Tue Jul 3 2001 Nalin Dahyabhai <nalin@redhat.com>
1147     - move shared libraries to /lib (#38410)
1148    
1149     * Mon Jun 25 2001 Nalin Dahyabhai <nalin@redhat.com>
1150     - switch to engine code base
1151    
1152     * Mon Jun 18 2001 Nalin Dahyabhai <nalin@redhat.com>
1153     - add a script for creating dummy certificates
1154     - move man pages from %%{_mandir}/man?/foo.?ssl to %%{_mandir}/man?ssl/foo.?
1155    
1156     * Thu Jun 07 2001 Florian La Roche <Florian.LaRoche@redhat.de>
1157     - add s390x support
1158    
1159     * Fri Jun 1 2001 Nalin Dahyabhai <nalin@redhat.com>
1160     - change two memcpy() calls to memmove()
1161     - don't define L_ENDIAN on alpha
1162    
1163     * Wed May 23 2001 Joe Orton <jorton@redhat.com> stronghold-0.9.6a-1
1164     - Add 'stronghold-' prefix to package names.
1165     - Obsolete standard openssl packages.
1166    
1167     * Wed May 16 2001 Joe Orton <jorton@redhat.com>
1168     - Add BuildArch: i586 as per Nalin's advice.
1169    
1170     * Tue May 15 2001 Joe Orton <jorton@redhat.com>
1171     - Enable assembler on ix86 (using new .tar.bz2 which does
1172     include the asm directories).
1173    
1174     * Tue May 15 2001 Nalin Dahyabhai <nalin@redhat.com>
1175     - make subpackages depend on the main package
1176    
1177     * Tue May 1 2001 Nalin Dahyabhai <nalin@redhat.com>
1178     - adjust the hobble script to not disturb symlinks in include/ (fix from
1179     Joe Orton)
1180    
1181     * Fri Apr 26 2001 Nalin Dahyabhai <nalin@redhat.com>
1182     - drop the m2crypo patch we weren't using
1183    
1184     * Tue Apr 24 2001 Nalin Dahyabhai <nalin@redhat.com>
1185     - configure using "shared" as well
1186    
1187     * Sun Apr 8 2001 Nalin Dahyabhai <nalin@redhat.com>
1188     - update to 0.9.6a
1189     - use the build-shared target to build shared libraries
1190     - bump the soversion to 2 because we're no longer compatible with
1191     our 0.9.5a packages or our 0.9.6 packages
1192     - drop the patch for making rsatest a no-op when rsa null support is used
1193     - put all man pages into <section>ssl instead of <section>
1194     - break the m2crypto modules into a separate package
1195    
1196     * Tue Mar 13 2001 Nalin Dahyabhai <nalin@redhat.com>
1197     - use BN_LLONG on s390
1198    
1199     * Mon Mar 12 2001 Nalin Dahyabhai <nalin@redhat.com>
1200     - fix the s390 changes for 0.9.6 (isn't supposed to be marked as 64-bit)
1201    
1202     * Sat Mar 3 2001 Nalin Dahyabhai <nalin@redhat.com>
1203     - move c_rehash to the perl subpackage, because it's a perl script now
1204    
1205     * Fri Mar 2 2001 Nalin Dahyabhai <nalin@redhat.com>
1206     - update to 0.9.6
1207     - enable MD2
1208     - use the libcrypto.so and libssl.so targets to build shared libs with
1209     - bump the soversion to 1 because we're no longer compatible with any of
1210     the various 0.9.5a packages circulating around, which provide lib*.so.0
1211    
1212     * Wed Feb 28 2001 Florian La Roche <Florian.LaRoche@redhat.de>
1213     - change hobble-openssl for disabling MD2 again
1214    
1215     * Tue Feb 27 2001 Nalin Dahyabhai <nalin@redhat.com>
1216     - re-disable MD2 -- the EVP_MD_CTX structure would grow from 100 to 152
1217     bytes or so, causing EVP_DigestInit() to zero out stack variables in
1218     apps built against a version of the library without it
1219    
1220     * Mon Feb 26 2001 Nalin Dahyabhai <nalin@redhat.com>
1221     - disable some inline assembly, which on x86 is Pentium-specific
1222     - re-enable MD2 (see http://www.ietf.org/ietf/IPR/RSA-MD-all)
1223    
1224     * Thu Feb 08 2001 Florian La Roche <Florian.LaRoche@redhat.de>
1225     - fix s390 patch
1226    
1227     * Fri Dec 8 2000 Than Ngo <than@redhat.com>
1228     - added support s390
1229    
1230     * Mon Nov 20 2000 Nalin Dahyabhai <nalin@redhat.com>
1231     - remove -Wa,* and -m* compiler flags from the default Configure file (#20656)
1232     - add the CA.pl man page to the perl subpackage
1233    
1234     * Thu Nov 2 2000 Nalin Dahyabhai <nalin@redhat.com>
1235     - always build with -mcpu=ev5 on alpha
1236    
1237     * Tue Oct 31 2000 Nalin Dahyabhai <nalin@redhat.com>
1238     - add a symlink from cert.pem to ca-bundle.crt
1239    
1240     * Wed Oct 25 2000 Nalin Dahyabhai <nalin@redhat.com>
1241     - add a ca-bundle file for packages like Samba to reference for CA certificates
1242    
1243     * Tue Oct 24 2000 Nalin Dahyabhai <nalin@redhat.com>
1244     - remove libcrypto's crypt(), which doesn't handle md5crypt (#19295)
1245    
1246     * Mon Oct 2 2000 Nalin Dahyabhai <nalin@redhat.com>
1247     - add unzip as a buildprereq (#17662)
1248     - update m2crypto to 0.05-snap4
1249    
1250     * Tue Sep 26 2000 Bill Nottingham <notting@redhat.com>
1251     - fix some issues in building when it's not installed
1252    
1253     * Wed Sep 6 2000 Nalin Dahyabhai <nalin@redhat.com>
1254     - make sure the headers we include are the ones we built with (aaaaarrgh!)
1255    
1256     * Fri Sep 1 2000 Nalin Dahyabhai <nalin@redhat.com>
1257     - add Richard Henderson's patch for BN on ia64
1258     - clean up the changelog
1259    
1260     * Tue Aug 29 2000 Nalin Dahyabhai <nalin@redhat.com>
1261     - fix the building of python modules without openssl-devel already installed
1262    
1263     * Wed Aug 23 2000 Nalin Dahyabhai <nalin@redhat.com>
1264     - byte-compile python extensions without the build-root
1265     - adjust the makefile to not remove temporary files (like .key files when
1266     building .csr files) by marking them as .PRECIOUS
1267    
1268     * Sat Aug 19 2000 Nalin Dahyabhai <nalin@redhat.com>
1269     - break out python extensions into a subpackage
1270    
1271     * Mon Jul 17 2000 Nalin Dahyabhai <nalin@redhat.com>
1272     - tweak the makefile some more
1273    
1274     * Tue Jul 11 2000 Nalin Dahyabhai <nalin@redhat.com>
1275     - disable MD2 support
1276    
1277     * Thu Jul 6 2000 Nalin Dahyabhai <nalin@redhat.com>
1278     - disable MDC2 support
1279    
1280     * Sun Jul 2 2000 Nalin Dahyabhai <nalin@redhat.com>
1281     - tweak the disabling of RC5, IDEA support
1282     - tweak the makefile
1283    
1284     * Thu Jun 29 2000 Nalin Dahyabhai <nalin@redhat.com>
1285     - strip binaries and libraries
1286     - rework certificate makefile to have the right parts for Apache
1287    
1288     * Wed Jun 28 2000 Nalin Dahyabhai <nalin@redhat.com>
1289     - use %%{_perl} instead of /usr/bin/perl
1290     - disable alpha until it passes its own test suite
1291    
1292     * Fri Jun 9 2000 Nalin Dahyabhai <nalin@redhat.com>
1293     - move the passwd.1 man page out of the passwd package's way
1294    
1295     * Fri Jun 2 2000 Nalin Dahyabhai <nalin@redhat.com>
1296     - update to 0.9.5a, modified for U.S.
1297     - add perl as a build-time requirement
1298     - move certificate makefile to another package
1299     - disable RC5, IDEA, RSA support
1300     - remove optimizations for now
1301    
1302     * Wed Mar 1 2000 Florian La Roche <Florian.LaRoche@redhat.de>
1303     - Bero told me to move the Makefile into this package
1304    
1305     * Wed Mar 1 2000 Florian La Roche <Florian.LaRoche@redhat.de>
1306     - add lib*.so symlinks to link dynamically against shared libs
1307    
1308     * Tue Feb 29 2000 Florian La Roche <Florian.LaRoche@redhat.de>
1309     - update to 0.9.5
1310     - run ldconfig directly in post/postun
1311     - add FAQ
1312    
1313     * Sat Dec 18 1999 Bernhard Rosenkrdnzer <bero@redhat.de>
1314     - Fix build on non-x86 platforms
1315    
1316     * Fri Nov 12 1999 Bernhard Rosenkrdnzer <bero@redhat.de>
1317     - move /usr/share/ssl/* from -devel to main package
1318    
1319     * Tue Oct 26 1999 Bernhard Rosenkrdnzer <bero@redhat.de>
1320     - inital packaging
1321     - changes from base:
1322     - Move /usr/local/ssl to /usr/share/ssl for FHS compliance
1323     - handle RPM_OPT_FLAGS

admin@koozali.org
ViewVC Help
Powered by ViewVC 1.2.1 RSS 2.0 feed