/[smeserver]/rpms/openssl/sme8/openssl.spec
ViewVC logotype

Contents of /rpms/openssl/sme8/openssl.spec

Parent Directory Parent Directory | Revision Log Revision Log | View Revision Graph Revision Graph


Revision 1.1 - (show annotations) (download)
Tue Feb 18 03:03:10 2014 UTC (10 years, 8 months ago) by wellsi
Branch: MAIN
CVS Tags: openssl-0_9_8e-27_el5_10_1
Branch point for: upstream
Initial import

1 # For the curious:
2 # 0.9.5a soversion = 0
3 # 0.9.6 soversion = 1
4 # 0.9.6a soversion = 2
5 # 0.9.6c soversion = 3
6 # 0.9.7a soversion = 4
7 # 0.9.7ef soversion = 5
8 # 0.9.8abe soversion = 6
9 %define soversion 6
10
11 # Number of threads to spawn when testing some threading fixes.
12 %define thread_test_threads %{?threads:%{threads}}%{!?threads:1}
13
14 # Arches on which we need to prevent arch conflicts on opensslconf.h, must
15 # also be handled in opensslconf-new.h.
16 %define multilib_arches %{ix86} ia64 ppc ppc64 s390 s390x x86_64
17
18 # Arches for which we don't build subpackages.
19 %define optimize_arches i686
20
21 Summary: The OpenSSL toolkit
22 Name: openssl
23 Version: 0.9.8e
24 Release: 27%{?dist}.1
25 # The tarball is based on the openssl-fips-1.2.0-test.tar.gz tarball
26 Source: openssl-fips-%{version}-usa.tar.bz2
27 Source1: hobble-openssl
28 Source2: Makefile.certificate
29 Source3: ca-bundle.crt
30 Source4: https://rhn.redhat.com/help/RHNS-CA-CERT
31 Source5: https://rhn.redhat.com/help/RHNS-CA-CERT.asc
32 Source6: make-dummy-cert
33 Source8: openssl-thread-test.c
34 Source9: opensslconf-new.h
35 Source10: opensslconf-new-warning.h
36 Source11: README.FIPS
37 # Build changes
38 Patch0: openssl-fips-0.9.8e-redhat.patch
39 Patch1: openssl-0.9.8a-defaults.patch
40 Patch2: openssl-0.9.8a-link-krb5.patch
41 Patch3: openssl-0.9.8b-soversion.patch
42 Patch4: openssl-0.9.8a-enginesdir.patch
43 Patch5: openssl-0.9.8a-no-rpath.patch
44 # Functionality changes
45 Patch32: openssl-0.9.7-beta6-ia64.patch
46 Patch33: openssl-0.9.7f-ca-dir.patch
47 Patch34: openssl-0.9.6-x509.patch
48 Patch35: openssl-0.9.7-beta5-version-add-engines.patch
49 Patch38: openssl-0.9.8a-reuse-cipher-change.patch
50 Patch39: openssl-0.9.8b-ipv6-apps.patch
51 # Backported fixes including security fixes
52 Patch61: openssl-0.9.8b-aliasing-bug.patch
53 Patch62: openssl-0.9.8b-x509-name-cmp.patch
54 Patch64: openssl-fips-0.9.8e-dtls-fixes.patch
55 Patch65: openssl-0.9.8b-cve-2007-5135.patch
56 Patch67: openssl-fips-0.9.8e-aescfb.patch
57 Patch68: openssl-fips-0.9.8e-abi.patch
58 Patch69: openssl-fips-0.9.8e-fipsmode.patch
59 Patch70: openssl-fips-0.9.8e-bn-fixes.patch
60 Patch71: openssl-fips-0.9.8e-use-fipscheck.patch
61 Patch72: openssl-fips-0.9.8e-env-zlib.patch
62 Patch73: openssl-fips-0.9.8e-default-paths.patch
63 Patch74: openssl-fips-0.9.8e-evp-nonfips.patch
64 Patch75: openssl-fips-0.9.8e-cve-2008-5077.patch
65 Patch76: openssl-fips-0.9.8e-multi-crl.patch
66 Patch77: openssl-fips-0.9.8e-no-pairwise.patch
67 Patch78: openssl-fips-0.9.8e-rng-seed.patch
68 Patch79: openssl-fips-0.9.8e-bad-mime.patch
69 Patch80: openssl-fips-0.9.8e-cve-2009-0590.patch
70 Patch81: openssl-fips-0.9.8e-dtls-dos.patch
71 Patch82: openssl-fips-0.9.8e-algo-doc.patch
72 Patch83: openssl-fips-0.9.8e-cve-2009-2409.patch
73 Patch84: openssl-fips-0.9.8e-cve-2009-4355.patch
74 Patch85: openssl-fips-0.9.8e-cve-2009-3555.patch
75 Patch86: openssl-fips-0.9.8e-cve-2010-0433.patch
76 Patch87: openssl-fips-0.9.8e-cve-2009-3245.patch
77 Patch88: openssl-fips-0.9.8e-cve-2010-4180.patch
78 Patch89: openssl-fips-0.9.8e-ssl-sha256.patch
79 Patch90: openssl-fips-0.9.8e-ciph-sort.patch
80 Patch91: openssl-fips-0.9.8e-apps-dgst.patch
81 Patch92: openssl-fips-0.9.8e-tls-version.patch
82 Patch93: openssl-fips-0.9.8e-chil-fixes.patch
83 Patch94: openssl-fips-0.9.8e-dh-check.patch
84 Patch95: openssl-fips-0.9.8e-sha2test.patch
85 Patch96: openssl-fips-0.9.8e-apps-yesno.patch
86 Patch97: openssl-fips-0.9.8e-dtls-fixes2.patch
87 Patch98: openssl-fips-0.9.8e-cve-2011-4109.patch
88 Patch99: openssl-fips-0.9.8e-cve-2011-4576.patch
89 Patch100: openssl-fips-0.9.8e-cve-2011-4619.patch
90 Patch101: openssl-fips-0.9.8e-cve-2012-0884.patch
91 Patch102: openssl-fips-0.9.8e-cve-2012-1165.patch
92 Patch103: openssl-fips-0.9.8e-cve-2012-2110.patch
93 Patch104: openssl-fips-0.9.8e-cve-2012-2333.patch
94 Patch105: openssl-fips-0.9.8e-secure-getenv.patch
95 Patch106: openssl-fips-0.9.8e-cve-2013-0166.patch
96 Patch107: openssl-fips-0.9.8e-cve-2013-0169.patch
97
98 License: BSDish
99 Group: System Environment/Libraries
100 URL: http://www.openssl.org/
101 BuildRoot: %{_tmppath}/%{name}-%{version}-root
102 BuildRequires: mktemp, krb5-devel, perl, sed, zlib-devel, /usr/bin/cmp
103 Requires: mktemp
104
105 %description
106 The OpenSSL toolkit provides support for secure communications between
107 machines. OpenSSL includes a certificate management tool and shared
108 libraries which provide various cryptographic algorithms and
109 protocols.
110
111 %package devel
112 Summary: Files for development of applications which will use OpenSSL
113 Group: Development/Libraries
114 Requires: %{name} = %{version}-%{release}, krb5-devel, zlib-devel
115
116 %description devel
117 OpenSSL is a toolkit for supporting cryptography. The openssl-devel
118 package contains static libraries and include files needed to develop
119 applications which support various cryptographic algorithms and
120 protocols.
121
122 %package perl
123 Summary: Perl scripts provided with OpenSSL
124 Group: Applications/Internet
125 Requires: perl
126 Requires: %{name} = %{version}-%{release}
127
128 %description perl
129 OpenSSL is a toolkit for supporting cryptography. The openssl-perl
130 package provides Perl scripts for converting certificates and keys
131 from other formats to the formats used by the OpenSSL toolkit.
132
133 %prep
134 %setup -q -n %{name}-fips-%{version}
135
136 %{SOURCE1} > /dev/null
137 %patch0 -p1 -b .redhat
138 %patch1 -p1 -b .defaults
139 # Fix link line for libssl (bug #111154).
140 %patch2 -p1 -b .krb5
141 %patch3 -p1 -b .soversion
142 %patch4 -p1 -b .enginesdir
143 %patch5 -p1 -b .no-rpath
144
145
146 %patch32 -p1 -b .ia64
147 #patch33 is applied after make test
148 %patch34 -p1 -b .x509
149 %patch35 -p1 -b .version-add-engines
150 %patch38 -p1 -b .cipher-change
151 %patch39 -p1 -b .ipv6-apps
152
153 %patch61 -p1 -b .aliasing-bug
154 %patch62 -p1 -b .name-cmp
155 %patch64 -p1 -b .dtls-fixes
156 %patch65 -p1 -b .shciphers
157 %patch67 -p1 -b .aescfb
158 %patch68 -p1 -b .abi
159 %patch69 -p1 -b .fipsmode
160 %patch70 -p1 -b .bn-fixes
161 %patch71 -p1 -b .use-fipscheck
162 %patch72 -p1 -b .env-zlib
163 %patch73 -p1 -b .default-paths
164 %patch74 -p1 -b .nonfips
165 %patch75 -p1 -b .verifysig
166 %patch76 -p1 -b .multi-crl
167 %patch77 -p1 -b .no-pairwise
168 %patch78 -p1 -b .rng-seed
169 %patch79 -p1 -b .bad-mime
170 %patch80 -p1 -b .bad-string
171 %patch81 -p1 -b .dtls-dos
172 %patch82 -p1 -b .algo-doc
173 %patch83 -p1 -b .nomd2
174 %patch84 -p1 -b .compleak
175 %patch85 -p1 -b .reneg
176 %patch86 -p1 -b .nullprinc
177 %patch87 -p1 -b .wexpand
178 %patch88 -p1 -b .disable-nsbug
179 %patch89 -p1 -b .sha256
180 %patch90 -p1 -b .sort
181 %patch91 -p1 -b .dgst
182 %patch92 -p1 -b .tlsver
183 %patch93 -p1 -b .chil
184 %patch94 -p1 -b .dh-check
185 %patch95 -p1 -b .sha2test
186 %patch96 -p1 -b .yesno
187 %patch97 -p1 -b .dtls-fixes2
188 %patch98 -p1 -b .doublefree
189 %patch99 -p1 -b .padding
190 %patch100 -p1 -b .sgc-dos
191 %patch101 -p1 -b .cms-mma
192 %patch102 -p1 -b .bad-mime2
193 %patch103 -p1 -b .biobuf
194 %patch104 -p1 -b .reclen
195 %patch105 -p1 -b .secure-getenv
196 %patch106 -p1 -b .ocsp-dos
197 %patch107 -p1 -b .lucky13
198
199 # Modify the various perl scripts to reference perl in the right location.
200 perl util/perlpath.pl `dirname %{__perl}`
201
202 # Generate a table with the compile settings for my perusal.
203 touch Makefile
204 make TABLE PERL=%{__perl}
205
206 %build
207 # Figure out which flags we want to use.
208 # default
209 sslarch=%{_os}-%{_arch}
210 %ifarch %ix86
211 sslarch=linux-elf
212 if ! echo %{_target} | grep -q i686 ; then
213 sslflags="no-asm 386"
214 fi
215 %endif
216 %ifarch sparc
217 sslarch=linux-sparcv9
218 sslflags=no-asm
219 %endif
220 %ifarch alpha
221 sslarch=linux-alpha-gcc
222 %endif
223 %ifarch s390
224 # The -fno-regmove is a workaround for bug #199604
225 sslarch="linux-generic32 -DB_ENDIAN -DNO_ASM -march=z900 -fno-regmove"
226 %endif
227 %ifarch s390x
228 sslarch="linux-generic64 -DB_ENDIAN -DNO_ASM"
229 %endif
230 # ia64, x86_64, ppc, ppc64 are OK by default
231 # Configure the build tree. Override OpenSSL defaults with known-good defaults
232 # usable on all platforms. The Configure script already knows to use -fPIC and
233 # RPM_OPT_FLAGS, so we can skip specifiying them here.
234 ./Configure \
235 --prefix=%{_prefix} --openssldir=%{_sysconfdir}/pki/tls ${sslflags} \
236 zlib no-idea no-mdc2 no-rc5 no-ec no-ecdh no-ecdsa shared \
237 --with-krb5-flavor=MIT --enginesdir=%{_libdir}/openssl/engines \
238 -I%{_prefix}/kerberos/include -L%{_prefix}/kerberos/%{_lib} \
239 ${sslarch} fipscanisterbuild
240
241 # Add -Wa,--noexecstack here so that libcrypto's assembler modules will be
242 # marked as not requiring an executable stack.
243 RPM_OPT_FLAGS="$RPM_OPT_FLAGS -Wa,--noexecstack -DOPENSSL_USE_NEW_FUNCTIONS -fno-strict-aliasing"
244 make depend
245 make all
246
247 # Generate hashes for the included certs.
248 make rehash
249
250 # Overwrite FIPS README
251 cp -f %{SOURCE11} .
252
253 # Verify that what was compiled actually works.
254 LD_LIBRARY_PATH=`pwd`${LD_LIBRARY_PATH:+:${LD_LIBRARY_PATH}}
255 export LD_LIBRARY_PATH
256 make -C test apps tests
257 %{__cc} -o openssl-thread-test \
258 `krb5-config --cflags` \
259 -I./include \
260 $RPM_OPT_FLAGS \
261 %{SOURCE8} \
262 -L. \
263 -lssl -lcrypto \
264 `krb5-config --libs` \
265 -lpthread -lz -ldl
266 ./openssl-thread-test --threads %{thread_test_threads}
267
268 # Patch33 must be patched after tests otherwise they will fail
269 patch -p1 -b -z .ca-dir < %{PATCH33}
270
271 # Add generation of HMAC checksum of the final stripped library
272 %define __spec_install_post \
273 %{?__debug_package:%{__debug_install_post}} \
274 %{__arch_install_post} \
275 %{__os_install_post} \
276 fips/fips_standalone_sha1 $RPM_BUILD_ROOT/%{_lib}/libcrypto.so.%{version} >$RPM_BUILD_ROOT/%{_lib}/.libcrypto.so.%{version}.hmac \
277 ln -sf .libcrypto.so.%{version}.hmac $RPM_BUILD_ROOT/%{_lib}/.libcrypto.so.%{soversion}.hmac \
278 fips/fips_standalone_sha1 $RPM_BUILD_ROOT/%{_lib}/libssl.so.%{version} >$RPM_BUILD_ROOT/%{_lib}/.libssl.so.%{version}.hmac \
279 ln -sf .libssl.so.%{version}.hmac $RPM_BUILD_ROOT/%{_lib}/.libssl.so.%{soversion}.hmac \
280 %{nil}
281
282 %install
283 [ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT
284 # Install OpenSSL.
285 install -d $RPM_BUILD_ROOT/{%{_lib},%{_bindir},%{_includedir},%{_libdir},%{_mandir},%{_libdir}/openssl}
286 make INSTALL_PREFIX=$RPM_BUILD_ROOT install
287 make INSTALL_PREFIX=$RPM_BUILD_ROOT install_docs
288 # OpenSSL install doesn't use correct _libdir
289 mv $RPM_BUILD_ROOT/usr/lib/lib*.so.%{soversion} $RPM_BUILD_ROOT/%{_lib}/
290 mv $RPM_BUILD_ROOT/usr/lib/engines $RPM_BUILD_ROOT/%{_libdir}/openssl
291 mv $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/man/* $RPM_BUILD_ROOT%{_mandir}/
292 rmdir $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/man
293 mv $RPM_BUILD_ROOT/usr/lib/* $RPM_BUILD_ROOT%{_libdir}/ || :
294 rename so.%{soversion} so.%{version} $RPM_BUILD_ROOT/%{_lib}/*.so.%{soversion}
295 for lib in $RPM_BUILD_ROOT/%{_lib}/*.so.%{version} ; do
296 chmod 755 ${lib}
297 ln -s -f ../../%{_lib}/`basename ${lib}` $RPM_BUILD_ROOT%{_libdir}/`basename ${lib} .%{version}`
298 ln -s -f `basename ${lib}` $RPM_BUILD_ROOT/%{_lib}/`basename ${lib} .%{version}`.%{soversion}
299 rm -f $RPM_BUILD_ROOT%{_libdir}/`basename ${lib} .%{version}`.%{soversion}
300 done
301
302 # Install a makefile for generating keys and self-signed certs, and a script
303 # for generating them on the fly.
304 mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/certs
305 install -m644 %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/certs/Makefile
306 install -m755 %{SOURCE6} $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/certs/make-dummy-cert
307
308 # Make sure we actually include the headers we built against.
309 for header in $RPM_BUILD_ROOT%{_includedir}/openssl/* ; do
310 if [ -f ${header} -a -f include/openssl/$(basename ${header}) ] ; then
311 install -m644 include/openssl/`basename ${header}` ${header}
312 fi
313 done
314
315 # Rename man pages so that they don't conflict with other system man pages.
316 pushd $RPM_BUILD_ROOT%{_mandir}
317 for manpage in man*/* ; do
318 if [ -L ${manpage} ]; then
319 TARGET=`ls -l ${manpage} | awk '{ print $NF }'`
320 ln -snf ${TARGET}ssl ${manpage}ssl
321 rm -f ${manpage}
322 else
323 mv ${manpage} ${manpage}ssl
324 fi
325 done
326 for conflict in passwd rand ; do
327 rename ${conflict} ssl${conflict} man*/${conflict}*
328 done
329 popd
330
331 # Pick a CA script.
332 pushd $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/misc
333 mv CA.sh CA
334 popd
335
336 mkdir -m700 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA
337 mkdir -m700 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA/private
338
339 # Install root CA stuffs.
340 cat << EOF > RHNS-blurb.txt
341 #
342 # RHNS CA certificate. Appended to the ca-bundle at package build-time.
343 #
344 EOF
345 cat %{SOURCE3} RHNS-blurb.txt %{SOURCE4} > ca-bundle.crt
346 install -m644 ca-bundle.crt $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/certs/
347 ln -s certs/ca-bundle.crt $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/cert.pem
348
349 # Fix libdir.
350 pushd $RPM_BUILD_ROOT/%{_libdir}/pkgconfig
351 for i in *.pc ; do
352 sed 's,^libdir=${exec_prefix}/lib,libdir=${exec_prefix}/%{_lib},g' \
353 $i >$i.tmp && \
354 cat $i.tmp >$i && \
355 rm -f $i.tmp
356 done
357 popd
358
359 # Determine which arch opensslconf.h is going to try to #include.
360 basearch=%{_arch}
361 %ifarch %{ix86}
362 basearch=i386
363 %endif
364
365 %ifarch %{multilib_arches}
366 # Do an opensslconf.h switcheroo to avoid file conflicts on systems where you
367 # can have both a 32- and 64-bit version of the library, and they each need
368 # their own correct-but-different versions of opensslconf.h to be usable.
369 install -m644 %{SOURCE10} \
370 $RPM_BUILD_ROOT/%{_prefix}/include/openssl/opensslconf-${basearch}.h
371 cat $RPM_BUILD_ROOT/%{_prefix}/include/openssl/opensslconf.h >> \
372 $RPM_BUILD_ROOT/%{_prefix}/include/openssl/opensslconf-${basearch}.h
373 install -m644 %{SOURCE9} \
374 $RPM_BUILD_ROOT/%{_prefix}/include/openssl/opensslconf.h
375 %endif
376
377 %ifarch %{optimize_arches}
378 # Remove bits which belong in subpackages.
379 rm -rf $RPM_BUILD_ROOT/%{_prefix}/include/openssl
380 rm -rf $RPM_BUILD_ROOT/%{_libdir}/*.a
381 rm -rf $RPM_BUILD_ROOT/%{_libdir}/*.so
382 rm -rf $RPM_BUILD_ROOT/%{_libdir}/pkgconfig
383 rm -rf $RPM_BUILD_ROOT/%{_mandir}/man3/*
384
385 rm -rf $RPM_BUILD_ROOT/%{_bindir}/c_rehash
386 rm -rf $RPM_BUILD_ROOT/%{_mandir}/man1*/*.pl*
387 rm -rf $RPM_BUILD_ROOT/%{_sysconfdir}/pki/tls/misc/*.pl
388 %endif
389
390 # Remove fips fingerprint script
391 rm -rf $RPM_BUILD_ROOT/%{_bindir}/openssl_fips_fingerprint
392
393 %clean
394 [ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT
395
396 %files
397 %defattr(-,root,root)
398 %doc FAQ LICENSE CHANGES NEWS INSTALL README
399 %doc doc/c-indentation.el doc/openssl.txt
400 %doc doc/openssl_button.html doc/openssl_button.gif
401 %doc doc/ssleay.txt
402 %doc README.FIPS
403 %dir %{_sysconfdir}/pki/tls
404 %dir %{_sysconfdir}/pki/tls/certs
405 %{_sysconfdir}/pki/tls/certs/make-dummy-cert
406 %{_sysconfdir}/pki/tls/certs/Makefile
407 %{_sysconfdir}/pki/tls/cert.pem
408 %dir %{_sysconfdir}/pki/tls/misc
409 %{_sysconfdir}/pki/tls/misc/CA
410 %dir %{_sysconfdir}/pki/CA
411 %dir %{_sysconfdir}/pki/CA/private
412 %{_sysconfdir}/pki/tls/misc/c_*
413 %{_sysconfdir}/pki/tls/private
414
415 %config(noreplace) %{_sysconfdir}/pki/tls/openssl.cnf
416 %config(noreplace) %{_sysconfdir}/pki/tls/certs/ca-bundle.crt
417
418 %attr(0755,root,root) %{_bindir}/openssl
419 %attr(0755,root,root) /%{_lib}/*.so.%{version}
420 %attr(0755,root,root) /%{_lib}/*.so.%{soversion}
421 %attr(0644,root,root) /%{_lib}/.libcrypto.so.*.hmac
422 %attr(0644,root,root) /%{_lib}/.libssl.so.*.hmac
423 %dir %{_libdir}/openssl
424 %attr(0755,root,root) %{_libdir}/openssl/engines
425 %attr(0644,root,root) %{_mandir}/man1*/[ABD-Zabcd-z]*
426 %attr(0644,root,root) %{_mandir}/man5*/*
427 %attr(0644,root,root) %{_mandir}/man7*/*
428
429 %ifnarch %{optimize_arches}
430 %files devel
431 %defattr(-,root,root)
432 %{_prefix}/include/openssl
433 %attr(0644,root,root) %{_libdir}/*.a
434 %attr(0755,root,root) %{_libdir}/*.so
435 %attr(0644,root,root) %{_mandir}/man3*/*
436 %attr(0644,root,root) %{_libdir}/pkgconfig/*.pc
437
438 %files perl
439 %defattr(-,root,root)
440 %attr(0755,root,root) %{_bindir}/c_rehash
441 %attr(0644,root,root) %{_mandir}/man1*/*.pl*
442 %dir %{_sysconfdir}/pki/tls/misc
443 %{_sysconfdir}/pki/tls/misc/*.pl
444 %endif
445
446 %post -p /sbin/ldconfig
447
448 %postun -p /sbin/ldconfig
449
450 %changelog
451 * Tue Jan 28 2014 Tomas Mraz <tmraz@redhat.com> 0.9.8e-27.1
452 - replace expired GlobalSign Root CA certificate in ca-bundle.crt
453
454 * Mon Feb 25 2013 Tomas Mraz <tmraz@redhat.com> 0.9.8e-27
455 - fix for CVE-2013-0169 - SSL/TLS CBC timing attack (#907589)
456 - fix for CVE-2013-0166 - DoS in OCSP signatures checking (#908052)
457 - enable compression only if explicitly asked for or OPENSSL_DEFAULT_ZLIB
458 environment variable is set (fixes CVE-2012-4929 #857051)
459 - use __secure_getenv() everywhere instead of getenv() (#839735)
460
461 * Tue May 15 2012 Tomas Mraz <tmraz@redhat.com> 0.9.8e-26
462 - fix for CVE-2012-2333 - improper checking for record length in DTLS (#820686)
463
464 * Mon Apr 23 2012 Tomas Mraz <tmraz@redhat.com> 0.9.8e-25
465 - fix for CVE-2012-2110 - memory corruption in asn1_d2i_read_bio() (#814185)
466
467 * Mon Mar 19 2012 Tomas Mraz <tmraz@redhat.com> 0.9.8e-23
468 - fix problem with the SGC restart patch that might terminate handshake
469 incorrectly
470 - fix for CVE-2012-0884 - MMA weakness in CMS and PKCS#7 code (#802725)
471 - fix for CVE-2012-1165 - NULL read dereference on bad MIME headers (#802489)
472
473 * Wed Jan 18 2012 Tomas Mraz <tmraz@redhat.com> 0.9.8e-22
474 - fix for CVE-2011-4108 & CVE-2012-0050 - DTLS plaintext recovery
475 vulnerability and additional DTLS fixes (#771770)
476 - fix for CVE-2011-4109 - double free in policy checks (#771771)
477 - fix for CVE-2011-4576 - uninitialized SSL 3.0 padding (#771775)
478 - fix for CVE-2011-4619 - SGC restart DoS attack (#771780)
479
480 * Tue Oct 18 2011 Tomas Mraz <tmraz@redhat.com> 0.9.8e-21
481 - add known answer test for SHA2 algorithms (#740866)
482 - make default private key length in certificate Makefile 2048 bits
483 (can be changed with PRIVATE_KEY_BITS setting) (#745410)
484 - fix incorrect return value in parse_yesno() (#726593)
485 - added DigiCert CA certificates to ca-bundle (#735819)
486 - added a new section about error states to README.FIPS (#628976)
487
488 * Wed May 4 2011 Tomas Mraz <tmraz@redhat.com> 0.9.8e-20
489 - add missing DH_check_pub_key() call when DH key is computed (#698175)
490
491 * Mon Apr 4 2011 Tomas Mraz <tmraz@redhat.com> 0.9.8e-19
492 - presort list of ciphers available in SSL (#688901)
493 - accept connection in s_server even if getaddrinfo() fails (#561260)
494 - point to openssl dgst for list of supported digests (#608639)
495 - fix handling of future TLS versions (#599112)
496 - added VeriSign Class 3 Public Primary Certification Authority - G5
497 and StartCom Certification Authority certs to ca-bundle (#675671, #617856)
498 - upstream fixes for the CHIL engine (#622003, #671484)
499
500 * Wed Mar 9 2011 Tomas Mraz <tmraz@redhat.com> 0.9.8e-18
501 - add SHA-2 hashes in SSL_library_init() (#676384)
502
503 * Tue Dec 7 2010 Tomas Mraz <tmraz@redhat.com> 0.9.8e-17
504 - fix CVE-2010-4180 - completely disable code for
505 SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG (#659462)
506
507 * Fri Mar 12 2010 Tomas Mraz <tmraz@redhat.com> 0.9.8e-16
508 - fix CVE-2009-3245 - add missing bn_wexpand return checks (#570924)
509
510 * Thu Mar 4 2010 Tomas Mraz <tmraz@redhat.com> 0.9.8e-15
511 - fix CVE-2010-0433 - do not pass NULL princ to krb5_kt_get_entry which
512 in the RHEL-5 and newer versions will crash in such case (#569774)
513
514 * Thu Feb 18 2010 Tomas Mraz <tmraz@redhat.com> 0.9.8e-14
515 - fix CVE-2009-3555 - support the safe renegotiation extension and
516 do not allow legacy renegotiation on the server by default (#533125)
517
518 * Thu Jan 14 2010 Tomas Mraz <tmraz@redhat.com> 0.9.8e-13
519 - fix CVE-2009-2409 - drop MD2 algorithm from EVP tables (#510197)
520 - fix CVE-2009-4355 - do not leak memory when CRYPTO_cleanup_all_ex_data()
521 is called prematurely by application (#546707)
522
523 * Mon Jun 29 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8e-12
524 - abort if selftests failed and random number generator is polled
525 - mention EVP_aes and EVP_sha2xx routines in the manpages
526 - add README.FIPS
527
528 * Thu May 21 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8e-10
529 - fix CVE-2009-1386 CVE-2009-1387 (DTLS DoS problems)
530 (#503685, #503688)
531
532 * Thu May 21 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8e-9
533 - fix CVE-2009-1377 CVE-2009-1378 CVE-2009-1379
534 (DTLS DoS problems) (#501253, #501254, #501572)
535
536 * Wed Apr 15 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8e-8
537 - support multiple CRLs with same subject in a store (#457134)
538 - fix CVE-2009-0590 - reject incorrectly encoded ASN.1 strings (#492304)
539 - seed FIPS rng directly from kernel random device
540 - do not require fipscheck to build the package (#475798)
541 - call pairwise key tests in FIPS mode only (#479817)
542 - do not crash when parsing bad mime data (#472440)
543
544 * Tue Dec 16 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8e-7
545 - fix CVE-2008-5077 - incorrect checks for malformed signatures (#476671)
546
547 * Fri Oct 31 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8e-6
548 - allow lookup of algorithms in engine
549
550 * Fri Oct 24 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8e-5
551 - implement the integrity checking inside libcrypto so OpenSSL
552 can be used in FIPS mode by the fipscheck library
553
554 * Thu Oct 9 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8e-4
555 - FIPS mode kernel flag is /proc/sys/crypto/fips_enabled
556
557 * Wed Sep 10 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8e-3
558 - disable strict aliasing
559
560 * Tue Sep 9 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8e-2
561 - more changes for FIPS validation (#444800)
562 - correctly initialize default CA paths (#450987)
563 - allow disabling zlib support through environment (#442624)
564
565 * Tue Jul 15 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8e-1
566 - rebase to version undergoing FIPS validation (#455634)
567
568 * Tue Jan 15 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8b-10
569 - compile with -march=z900 on s390 for performance improvements (#250818)
570 - make ssl session ID matching strict (#233599)
571
572 * Mon Oct 8 2007 Tomas Mraz <tmraz@redhat.com> 0.9.8b-9
573 - fix CVE-2007-3108 - side channel attack on private keys (#250581)
574 - fix CVE-2007-5135 - off-by-one in SSL_get_shared_ciphers (#309881)
575 - fix CVE-2007-4995 - out of order DTLS fragments buffer overflow (#321221)
576
577 * Thu Nov 30 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-8.3
578 - the previous change still didn't make X509_NAME_cmp transitive
579
580 * Thu Nov 23 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-8.2
581 - make X509_NAME_cmp transitive otherwise certificate lookup
582 is broken (#216050)
583
584 * Fri Nov 3 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-8.1
585 - aliasing bug in engine loading, patch by IBM (#213216)
586
587 * Mon Oct 2 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-8
588 - CVE-2006-2940 fix was incorrect (#208744)
589
590 * Mon Sep 25 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-7
591 - fix CVE-2006-2937 - mishandled error on ASN.1 parsing (#207276)
592 - fix CVE-2006-2940 - parasitic public keys DoS (#207274)
593 - fix CVE-2006-3738 - buffer overflow in SSL_get_shared_ciphers (#206940)
594 - fix CVE-2006-4343 - sslv2 client DoS (#206940)
595
596 * Tue Sep 5 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-6
597 - fix CVE-2006-4339 - prevent attack on PKCS#1 v1.5 signatures (#205180)
598
599 * Wed Aug 2 2006 Tomas Mraz <tmraz@redhat.com> - 0.9.8b-5
600 - set buffering to none on stdio/stdout FILE when bufsize is set (#200580)
601 patch by IBM
602
603 * Fri Jul 28 2006 Alexandre Oliva <aoliva@redhat.com> - 0.9.8b-4.1
604 - rebuild with new binutils (#200330)
605
606 * Fri Jul 21 2006 Tomas Mraz <tmraz@redhat.com> - 0.9.8b-4
607 - add a temporary workaround for sha512 test failure on s390 (#199604)
608
609 * Thu Jul 20 2006 Tomas Mraz <tmraz@redhat.com>
610 - add ipv6 support to s_client and s_server (by Jan Pazdziora) (#198737)
611 - add patches for BN threadsafety, AES cache collision attack hazard fix and
612 pkcs7 code memleak fix from upstream CVS
613
614 * Wed Jul 12 2006 Jesse Keating <jkeating@redhat.com> - 0.9.8b-3.1
615 - rebuild
616
617 * Wed Jun 21 2006 Tomas Mraz <tmraz@redhat.com> - 0.9.8b-3
618 - dropped libica and ica engine from build
619
620 * Wed Jun 21 2006 Joe Orton <jorton@redhat.com>
621 - update to new CA bundle from mozilla.org; adds CA certificates
622 from netlock.hu and startcom.org
623
624 * Mon Jun 5 2006 Tomas Mraz <tmraz@redhat.com> - 0.9.8b-2
625 - fixed a few rpmlint warnings
626 - better fix for #173399 from upstream
627 - upstream fix for pkcs12
628
629 * Thu May 11 2006 Tomas Mraz <tmraz@redhat.com> - 0.9.8b-1
630 - upgrade to new version, stays ABI compatible
631 - there is no more linux/config.h (it was empty anyway)
632
633 * Tue Apr 4 2006 Tomas Mraz <tmraz@redhat.com> - 0.9.8a-6
634 - fix stale open handles in libica (#177155)
635 - fix build if 'rand' or 'passwd' in buildroot path (#178782)
636 - initialize VIA Padlock engine (#186857)
637
638 * Fri Feb 10 2006 Jesse Keating <jkeating@redhat.com> - 0.9.8a-5.2
639 - bump again for double-long bug on ppc(64)
640
641 * Tue Feb 07 2006 Jesse Keating <jkeating@redhat.com> - 0.9.8a-5.1
642 - rebuilt for new gcc4.1 snapshot and glibc changes
643
644 * Thu Dec 15 2005 Tomas Mraz <tmraz@redhat.com> 0.9.8a-5
645 - don't include SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
646 in SSL_OP_ALL (#175779)
647
648 * Fri Dec 09 2005 Jesse Keating <jkeating@redhat.com>
649 - rebuilt
650
651 * Tue Nov 29 2005 Tomas Mraz <tmraz@redhat.com> 0.9.8a-4
652 - fix build (-lcrypto was erroneusly dropped) of the updated libica
653 - updated ICA engine to 1.3.6-rc3
654
655 * Tue Nov 22 2005 Tomas Mraz <tmraz@redhat.com> 0.9.8a-3
656 - disable builtin compression methods for now until they work
657 properly (#173399)
658
659 * Wed Nov 16 2005 Tomas Mraz <tmraz@redhat.com> 0.9.8a-2
660 - don't set -rpath for openssl binary
661
662 * Tue Nov 8 2005 Tomas Mraz <tmraz@redhat.com> 0.9.8a-1
663 - new upstream version
664 - patches partially renumbered
665
666 * Fri Oct 21 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-11
667 - updated IBM ICA engine library and patch to latest upstream version
668
669 * Wed Oct 12 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-10
670 - fix CAN-2005-2969 - remove SSL_OP_MSIE_SSLV2_RSA_PADDING which
671 disables the countermeasure against man in the middle attack in SSLv2
672 (#169863)
673 - use sha1 as default for CA and cert requests - CAN-2005-2946 (#169803)
674
675 * Tue Aug 23 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-9
676 - add *.so.soversion as symlinks in /lib (#165264)
677 - remove unpackaged symlinks (#159595)
678 - fixes from upstream (constant time fixes for DSA,
679 bn assembler div on ppc arch, initialize memory on realloc)
680
681 * Thu Aug 11 2005 Phil Knirsch <pknirsch@redhat.com> 0.9.7f-8
682 - Updated ICA engine IBM patch to latest upstream version.
683
684 * Thu May 19 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-7
685 - fix CAN-2005-0109 - use constant time/memory access mod_exp
686 so bits of private key aren't leaked by cache eviction (#157631)
687 - a few more fixes from upstream 0.9.7g
688
689 * Wed Apr 27 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-6
690 - use poll instead of select in rand (#128285)
691 - fix Makefile.certificate to point to /etc/pki/tls
692 - change the default string mask in ASN1 to PrintableString+UTF8String
693
694 * Mon Apr 25 2005 Joe Orton <jorton@redhat.com> 0.9.7f-5
695 - update to revision 1.37 of Mozilla CA bundle
696
697 * Thu Apr 21 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-4
698 - move certificates to _sysconfdir/pki/tls (#143392)
699 - move CA directories to _sysconfdir/pki/CA
700 - patch the CA script and the default config so it points to the
701 CA directories
702
703 * Fri Apr 1 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-3
704 - uninitialized variable mustn't be used as input in inline
705 assembly
706 - reenable the x86_64 assembly again
707
708 * Thu Mar 31 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-2
709 - add back RC4_CHAR on ia64 and x86_64 so the ABI isn't broken
710 - disable broken bignum assembly on x86_64
711
712 * Wed Mar 30 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-1
713 - reenable optimizations on ppc64 and assembly code on ia64
714 - upgrade to new upstream version (no soname bump needed)
715 - disable thread test - it was testing the backport of the
716 RSA blinding - no longer needed
717 - added support for changing serial number to
718 Makefile.certificate (#151188)
719 - make ca-bundle.crt a config file (#118903)
720
721 * Tue Mar 1 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7e-3
722 - libcrypto shouldn't depend on libkrb5 (#135961)
723
724 * Mon Feb 28 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7e-2
725 - rebuild
726
727 * Mon Feb 28 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7e-1
728 - new upstream source, updated patches
729 - added patch so we are hopefully ABI compatible with upcoming
730 0.9.7f
731
732 * Thu Feb 10 2005 Tomas Mraz <tmraz@redhat.com>
733 - Support UTF-8 charset in the Makefile.certificate (#134944)
734 - Added cmp to BuildPrereq
735
736 * Thu Jan 27 2005 Joe Orton <jorton@redhat.com> 0.9.7a-46
737 - generate new ca-bundle.crt from Mozilla certdata.txt (revision 1.32)
738
739 * Thu Dec 23 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-45
740 - Fixed and updated libica-1.3.4-urandom.patch patch (#122967)
741
742 * Fri Nov 19 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-44
743 - rebuild
744
745 * Fri Nov 19 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-43
746 - rebuild
747
748 * Fri Nov 19 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-42
749 - rebuild
750
751 * Fri Nov 19 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-41
752 - remove der_chop, as upstream cvs has done (CAN-2004-0975, #140040)
753
754 * Tue Oct 05 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-40
755 - Include latest libica version with important bugfixes
756
757 * Tue Jun 15 2004 Elliot Lee <sopwith@redhat.com>
758 - rebuilt
759
760 * Mon Jun 14 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-38
761 - Updated ICA engine IBM patch to latest upstream version.
762
763 * Mon Jun 7 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-37
764 - build for linux-alpha-gcc instead of alpha-gcc on alpha (Jeff Garzik)
765
766 * Tue May 25 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-36
767 - handle %%{_arch}=i486/i586/i686/athlon cases in the intermediate
768 header (#124303)
769
770 * Thu Mar 25 2004 Joe Orton <jorton@redhat.com> 0.9.7a-35
771 - add security fixes for CAN-2004-0079, CAN-2004-0112
772
773 * Tue Mar 16 2004 Phil Knirsch <pknirsch@redhat.com>
774 - Fixed libica filespec.
775
776 * Thu Mar 10 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-34
777 - ppc/ppc64 define __powerpc__/__powerpc64__, not __ppc__/__ppc64__, fix
778 the intermediate header
779
780 * Wed Mar 10 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-33
781 - add an intermediate <openssl/opensslconf.h> which points to the right
782 arch-specific opensslconf.h on multilib arches
783
784 * Tue Mar 02 2004 Elliot Lee <sopwith@redhat.com>
785 - rebuilt
786
787 * Thu Feb 26 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-32
788 - Updated libica to latest upstream version 1.3.5.
789
790 * Tue Feb 17 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-31
791 - Update ICA crypto engine patch from IBM to latest version.
792
793 * Fri Feb 13 2004 Elliot Lee <sopwith@redhat.com>
794 - rebuilt
795
796 * Fri Feb 13 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-29
797 - rebuilt
798
799 * Wed Feb 11 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-28
800 - Fixed libica build.
801
802 * Wed Feb 4 2004 Nalin Dahyabhai <nalin@redhat.com>
803 - add "-ldl" to link flags added for Linux-on-ARM (#99313)
804
805 * Wed Feb 4 2004 Joe Orton <jorton@redhat.com> 0.9.7a-27
806 - updated ca-bundle.crt: removed expired GeoTrust roots, added
807 freessl.com root, removed trustcenter.de Class 0 root
808
809 * Sun Nov 30 2003 Tim Waugh <twaugh@redhat.com> 0.9.7a-26
810 - Fix link line for libssl (bug #111154).
811
812 * Fri Oct 24 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-25
813 - add dependency on zlib-devel for the -devel package, which depends on zlib
814 symbols because we enable zlib for libssl (#102962)
815
816 * Fri Oct 24 2003 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-24
817 - Use /dev/urandom instead of PRNG for libica.
818 - Apply libica-1.3.5 fix for /dev/urandom in icalinux.c
819 - Use latest ICA engine patch from IBM.
820
821 * Sat Oct 4 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-22.1
822 - rebuild
823
824 * Wed Oct 1 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-22
825 - rebuild (22 wasn't actually built, fun eh?)
826
827 * Tue Sep 30 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-23
828 - re-disable optimizations on ppc64
829
830 * Tue Sep 30 2003 Joe Orton <jorton@redhat.com>
831 - add a_mbstr.c fix for 64-bit platforms from CVS
832
833 * Tue Sep 30 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-22
834 - add -Wa,--noexecstack to RPM_OPT_FLAGS so that assembled modules get tagged
835 as not needing executable stacks
836
837 * Mon Sep 29 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-21
838 - rebuild
839
840 * Thu Sep 25 2003 Nalin Dahyabhai <nalin@redhat.com>
841 - re-enable optimizations on ppc64
842
843 * Thu Sep 25 2003 Nalin Dahyabhai <nalin@redhat.com>
844 - remove exclusivearch
845
846 * Wed Sep 24 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-20
847 - only parse a client cert if one was requested
848 - temporarily exclusivearch for %%{ix86}
849
850 * Tue Sep 23 2003 Nalin Dahyabhai <nalin@redhat.com>
851 - add security fixes for protocol parsing bugs (CAN-2003-0543, CAN-2003-0544)
852 and heap corruption (CAN-2003-0545)
853 - update RHNS-CA-CERT files
854 - ease back on the number of threads used in the threading test
855
856 * Wed Sep 17 2003 Matt Wilson <msw@redhat.com> 0.9.7a-19
857 - rebuild to fix gzipped file md5sums (#91211)
858
859 * Mon Aug 25 2003 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-18
860 - Updated libica to version 1.3.4.
861
862 * Thu Jul 17 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-17
863 - rebuild
864
865 * Tue Jul 15 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-10.9
866 - free the kssl_ctx structure when we free an SSL structure (#99066)
867
868 * Fri Jul 10 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-16
869 - rebuild
870
871 * Thu Jul 10 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-15
872 - lower thread test count on s390x
873
874 * Tue Jul 8 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-14
875 - rebuild
876
877 * Thu Jun 26 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-13
878 - disable assembly on arches where it seems to conflict with threading
879
880 * Thu Jun 26 2003 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-12
881 - Updated libica to latest upstream version 1.3.0
882
883 * Wed Jun 11 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-9.9
884 - rebuild
885
886 * Wed Jun 11 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-11
887 - rebuild
888
889 * Tue Jun 10 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-10
890 - ubsec: don't stomp on output data which might also be input data
891
892 * Tue Jun 10 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-9
893 - temporarily disable optimizations on ppc64
894
895 * Mon Jun 9 2003 Nalin Dahyabhai <nalin@redhat.com>
896 - backport fix for engine-used-for-everything from 0.9.7b
897 - backport fix for prng not being seeded causing problems, also from 0.9.7b
898 - add a check at build-time to ensure that RSA is thread-safe
899 - keep perlpath from stomping on the libica configure scripts
900
901 * Fri Jun 6 2003 Nalin Dahyabhai <nalin@redhat.com>
902 - thread-safety fix for RSA blinding
903
904 * Wed Jun 04 2003 Elliot Lee <sopwith@redhat.com> 0.9.7a-8
905 - rebuilt
906
907 * Fri May 30 2003 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-7
908 - Added libica-1.2 to openssl (featurerequest).
909
910 * Wed Apr 16 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-6
911 - fix building with incorrect flags on ppc64
912
913 * Wed Mar 19 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-5
914 - add patch to harden against Klima-Pokorny-Rosa extension of Bleichenbacher's
915 attack (CAN-2003-0131)
916
917 * Mon Mar 17 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-4
918 - add patch to enable RSA blinding by default, closing a timing attack
919 (CAN-2003-0147)
920
921 * Wed Mar 5 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-3
922 - disable use of BN assembly module on x86_64, but continue to allow inline
923 assembly (#83403)
924
925 * Thu Feb 27 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-2
926 - disable EC algorithms
927
928 * Wed Feb 19 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-1
929 - update to 0.9.7a
930
931 * Wed Feb 19 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7-8
932 - add fix to guard against attempts to allocate negative amounts of memory
933 - add patch for CAN-2003-0078, fixing a timing attack
934
935 * Thu Feb 13 2003 Elliot Lee <sopwith@redhat.com> 0.9.7-7
936 - Add openssl-ppc64.patch
937
938 * Mon Feb 10 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7-6
939 - EVP_DecryptInit should call EVP_CipherInit() instead of EVP_CipherInit_ex(),
940 to get the right behavior when passed uninitialized context structures
941 (#83766)
942 - build with -mcpu=ev5 on alpha family (#83828)
943
944 * Wed Jan 22 2003 Tim Powers <timp@redhat.com>
945 - rebuilt
946
947 * Fri Jan 17 2003 Phil Knirsch <pknirsch@redhat.com> 0.9.7-4
948 - Added IBM hw crypto support patch.
949
950 * Wed Jan 15 2003 Nalin Dahyabhai <nalin@redhat.com>
951 - add missing builddep on sed
952
953 * Thu Jan 9 2003 Bill Nottingham <notting@redhat.com> 0.9.7-3
954 - debloat
955 - fix broken manpage symlinks
956
957 * Wed Jan 8 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7-2
958 - fix double-free in 'openssl ca'
959
960 * Fri Jan 3 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7-1
961 - update to 0.9.7 final
962
963 * Tue Dec 17 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.7-0
964 - update to 0.9.7 beta6 (DO NOT USE UNTIL UPDATED TO FINAL 0.9.7)
965
966 * Wed Dec 11 2002 Nalin Dahyabhai <nalin@redhat.com>
967 - update to 0.9.7 beta5 (DO NOT USE UNTIL UPDATED TO FINAL 0.9.7)
968
969 * Tue Oct 22 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-30
970 - add configuration stanza for x86_64 and use it on x86_64
971 - build for linux-ppc on ppc
972 - start running the self-tests again
973
974 * Wed Oct 02 2002 Elliot Lee <sopwith@redhat.com> 0.9.6b-29hammer.3
975 - Merge fixes from previous hammer packages, including general x86-64 and
976 multilib
977
978 * Tue Aug 6 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-29
979 - rebuild
980
981 * Thu Aug 1 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-28
982 - update asn patch to fix accidental reversal of a logic check
983
984 * Wed Jul 31 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-27
985 - update asn patch to reduce chance that compiler optimization will remove
986 one of the added tests
987
988 * Wed Jul 31 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-26
989 - rebuild
990
991 * Mon Jul 29 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-25
992 - add patch to fix ASN.1 vulnerabilities
993
994 * Thu Jul 25 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-24
995 - add backport of Ben Laurie's patches for OpenSSL 0.9.6d
996
997 * Wed Jul 17 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-23
998 - own %{_datadir}/ssl/misc
999
1000 * Fri Jun 21 2002 Tim Powers <timp@redhat.com>
1001 - automated rebuild
1002
1003 * Sun May 26 2002 Tim Powers <timp@redhat.com>
1004 - automated rebuild
1005
1006 * Fri May 17 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-20
1007 - free ride through the build system (whee!)
1008
1009 * Thu May 16 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-19
1010 - rebuild in new environment
1011
1012 * Thu Apr 4 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-17, 0.9.6b-18
1013 - merge RHL-specific bits into stronghold package, rename
1014
1015 * Tue Apr 02 2002 Gary Benson <gbenson@redhat.com> stronghold-0.9.6c-2
1016 - add support for Chrysalis Luna token
1017
1018 * Tue Mar 26 2002 Gary Benson <gbenson@redhat.com>
1019 - disable AEP random number generation, other AEP fixes
1020
1021 * Fri Mar 15 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-15
1022 - only build subpackages on primary arches
1023
1024 * Thu Mar 14 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-13
1025 - on ia32, only disable use of assembler on i386
1026 - enable assembly on ia64
1027
1028 * Mon Jan 7 2002 Florian La Roche <Florian.LaRoche@redhat.de> 0.9.6b-11
1029 - fix sparcv9 entry
1030
1031 * Mon Jan 7 2002 Gary Benson <gbenson@redhat.com> stronghold-0.9.6c-1
1032 - upgrade to 0.9.6c
1033 - bump BuildArch to i686 and enable assembler on all platforms
1034 - synchronise with shrimpy and rawhide
1035 - bump soversion to 3
1036
1037 * Wed Oct 10 2001 Florian La Roche <Florian.LaRoche@redhat.de>
1038 - delete BN_LLONG for s390x, patch from Oliver Paukstadt
1039
1040 * Mon Sep 17 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-9
1041 - update AEP driver patch
1042
1043 * Mon Sep 10 2001 Nalin Dahyabhai <nalin@redhat.com>
1044 - adjust RNG disabling patch to match version of patch from Broadcom
1045
1046 * Fri Sep 7 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-8
1047 - disable the RNG in the ubsec engine driver
1048
1049 * Tue Aug 28 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-7
1050 - tweaks to the ubsec engine driver
1051
1052 * Fri Aug 24 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-6
1053 - tweaks to the ubsec engine driver
1054
1055 * Thu Aug 23 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-5
1056 - update ubsec engine driver from Broadcom
1057
1058 * Fri Aug 10 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-4
1059 - move man pages back to %%{_mandir}/man?/foo.?ssl from
1060 %%{_mandir}/man?ssl/foo.?
1061 - add an [ engine ] section to the default configuration file
1062
1063 * Thu Aug 9 2001 Nalin Dahyabhai <nalin@redhat.com>
1064 - add a patch for selecting a default engine in SSL_library_init()
1065
1066 * Mon Jul 23 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-3
1067 - add patches for AEP hardware support
1068 - add patch to keep trying when we fail to load a cert from a file and
1069 there are more in the file
1070 - add missing prototype for ENGINE_ubsec() in engine_int.h
1071
1072 * Wed Jul 18 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-2
1073 - actually add hw_ubsec to the engine list
1074
1075 * Tue Jul 17 2001 Nalin Dahyabhai <nalin@redhat.com>
1076 - add in the hw_ubsec driver from CVS
1077
1078 * Wed Jul 11 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-1
1079 - update to 0.9.6b
1080
1081 * Thu Jul 5 2001 Nalin Dahyabhai <nalin@redhat.com>
1082 - move .so symlinks back to %%{_libdir}
1083
1084 * Tue Jul 3 2001 Nalin Dahyabhai <nalin@redhat.com>
1085 - move shared libraries to /lib (#38410)
1086
1087 * Mon Jun 25 2001 Nalin Dahyabhai <nalin@redhat.com>
1088 - switch to engine code base
1089
1090 * Mon Jun 18 2001 Nalin Dahyabhai <nalin@redhat.com>
1091 - add a script for creating dummy certificates
1092 - move man pages from %%{_mandir}/man?/foo.?ssl to %%{_mandir}/man?ssl/foo.?
1093
1094 * Thu Jun 07 2001 Florian La Roche <Florian.LaRoche@redhat.de>
1095 - add s390x support
1096
1097 * Fri Jun 1 2001 Nalin Dahyabhai <nalin@redhat.com>
1098 - change two memcpy() calls to memmove()
1099 - don't define L_ENDIAN on alpha
1100
1101 * Wed May 23 2001 Joe Orton <jorton@redhat.com> stronghold-0.9.6a-1
1102 - Add 'stronghold-' prefix to package names.
1103 - Obsolete standard openssl packages.
1104
1105 * Wed May 16 2001 Joe Orton <jorton@redhat.com>
1106 - Add BuildArch: i586 as per Nalin's advice.
1107
1108 * Tue May 15 2001 Joe Orton <jorton@redhat.com>
1109 - Enable assembler on ix86 (using new .tar.bz2 which does
1110 include the asm directories).
1111
1112 * Tue May 15 2001 Nalin Dahyabhai <nalin@redhat.com>
1113 - make subpackages depend on the main package
1114
1115 * Tue May 1 2001 Nalin Dahyabhai <nalin@redhat.com>
1116 - adjust the hobble script to not disturb symlinks in include/ (fix from
1117 Joe Orton)
1118
1119 * Fri Apr 26 2001 Nalin Dahyabhai <nalin@redhat.com>
1120 - drop the m2crypo patch we weren't using
1121
1122 * Tue Apr 24 2001 Nalin Dahyabhai <nalin@redhat.com>
1123 - configure using "shared" as well
1124
1125 * Sun Apr 8 2001 Nalin Dahyabhai <nalin@redhat.com>
1126 - update to 0.9.6a
1127 - use the build-shared target to build shared libraries
1128 - bump the soversion to 2 because we're no longer compatible with
1129 our 0.9.5a packages or our 0.9.6 packages
1130 - drop the patch for making rsatest a no-op when rsa null support is used
1131 - put all man pages into <section>ssl instead of <section>
1132 - break the m2crypto modules into a separate package
1133
1134 * Tue Mar 13 2001 Nalin Dahyabhai <nalin@redhat.com>
1135 - use BN_LLONG on s390
1136
1137 * Mon Mar 12 2001 Nalin Dahyabhai <nalin@redhat.com>
1138 - fix the s390 changes for 0.9.6 (isn't supposed to be marked as 64-bit)
1139
1140 * Sat Mar 3 2001 Nalin Dahyabhai <nalin@redhat.com>
1141 - move c_rehash to the perl subpackage, because it's a perl script now
1142
1143 * Fri Mar 2 2001 Nalin Dahyabhai <nalin@redhat.com>
1144 - update to 0.9.6
1145 - enable MD2
1146 - use the libcrypto.so and libssl.so targets to build shared libs with
1147 - bump the soversion to 1 because we're no longer compatible with any of
1148 the various 0.9.5a packages circulating around, which provide lib*.so.0
1149
1150 * Wed Feb 28 2001 Florian La Roche <Florian.LaRoche@redhat.de>
1151 - change hobble-openssl for disabling MD2 again
1152
1153 * Tue Feb 27 2001 Nalin Dahyabhai <nalin@redhat.com>
1154 - re-disable MD2 -- the EVP_MD_CTX structure would grow from 100 to 152
1155 bytes or so, causing EVP_DigestInit() to zero out stack variables in
1156 apps built against a version of the library without it
1157
1158 * Mon Feb 26 2001 Nalin Dahyabhai <nalin@redhat.com>
1159 - disable some inline assembly, which on x86 is Pentium-specific
1160 - re-enable MD2 (see http://www.ietf.org/ietf/IPR/RSA-MD-all)
1161
1162 * Thu Feb 08 2001 Florian La Roche <Florian.LaRoche@redhat.de>
1163 - fix s390 patch
1164
1165 * Fri Dec 8 2000 Than Ngo <than@redhat.com>
1166 - added support s390
1167
1168 * Mon Nov 20 2000 Nalin Dahyabhai <nalin@redhat.com>
1169 - remove -Wa,* and -m* compiler flags from the default Configure file (#20656)
1170 - add the CA.pl man page to the perl subpackage
1171
1172 * Thu Nov 2 2000 Nalin Dahyabhai <nalin@redhat.com>
1173 - always build with -mcpu=ev5 on alpha
1174
1175 * Tue Oct 31 2000 Nalin Dahyabhai <nalin@redhat.com>
1176 - add a symlink from cert.pem to ca-bundle.crt
1177
1178 * Wed Oct 25 2000 Nalin Dahyabhai <nalin@redhat.com>
1179 - add a ca-bundle file for packages like Samba to reference for CA certificates
1180
1181 * Tue Oct 24 2000 Nalin Dahyabhai <nalin@redhat.com>
1182 - remove libcrypto's crypt(), which doesn't handle md5crypt (#19295)
1183
1184 * Mon Oct 2 2000 Nalin Dahyabhai <nalin@redhat.com>
1185 - add unzip as a buildprereq (#17662)
1186 - update m2crypto to 0.05-snap4
1187
1188 * Tue Sep 26 2000 Bill Nottingham <notting@redhat.com>
1189 - fix some issues in building when it's not installed
1190
1191 * Wed Sep 6 2000 Nalin Dahyabhai <nalin@redhat.com>
1192 - make sure the headers we include are the ones we built with (aaaaarrgh!)
1193
1194 * Fri Sep 1 2000 Nalin Dahyabhai <nalin@redhat.com>
1195 - add Richard Henderson's patch for BN on ia64
1196 - clean up the changelog
1197
1198 * Tue Aug 29 2000 Nalin Dahyabhai <nalin@redhat.com>
1199 - fix the building of python modules without openssl-devel already installed
1200
1201 * Wed Aug 23 2000 Nalin Dahyabhai <nalin@redhat.com>
1202 - byte-compile python extensions without the build-root
1203 - adjust the makefile to not remove temporary files (like .key files when
1204 building .csr files) by marking them as .PRECIOUS
1205
1206 * Sat Aug 19 2000 Nalin Dahyabhai <nalin@redhat.com>
1207 - break out python extensions into a subpackage
1208
1209 * Mon Jul 17 2000 Nalin Dahyabhai <nalin@redhat.com>
1210 - tweak the makefile some more
1211
1212 * Tue Jul 11 2000 Nalin Dahyabhai <nalin@redhat.com>
1213 - disable MD2 support
1214
1215 * Thu Jul 6 2000 Nalin Dahyabhai <nalin@redhat.com>
1216 - disable MDC2 support
1217
1218 * Sun Jul 2 2000 Nalin Dahyabhai <nalin@redhat.com>
1219 - tweak the disabling of RC5, IDEA support
1220 - tweak the makefile
1221
1222 * Thu Jun 29 2000 Nalin Dahyabhai <nalin@redhat.com>
1223 - strip binaries and libraries
1224 - rework certificate makefile to have the right parts for Apache
1225
1226 * Wed Jun 28 2000 Nalin Dahyabhai <nalin@redhat.com>
1227 - use %%{_perl} instead of /usr/bin/perl
1228 - disable alpha until it passes its own test suite
1229
1230 * Fri Jun 9 2000 Nalin Dahyabhai <nalin@redhat.com>
1231 - move the passwd.1 man page out of the passwd package's way
1232
1233 * Fri Jun 2 2000 Nalin Dahyabhai <nalin@redhat.com>
1234 - update to 0.9.5a, modified for U.S.
1235 - add perl as a build-time requirement
1236 - move certificate makefile to another package
1237 - disable RC5, IDEA, RSA support
1238 - remove optimizations for now
1239
1240 * Wed Mar 1 2000 Florian La Roche <Florian.LaRoche@redhat.de>
1241 - Bero told me to move the Makefile into this package
1242
1243 * Wed Mar 1 2000 Florian La Roche <Florian.LaRoche@redhat.de>
1244 - add lib*.so symlinks to link dynamically against shared libs
1245
1246 * Tue Feb 29 2000 Florian La Roche <Florian.LaRoche@redhat.de>
1247 - update to 0.9.5
1248 - run ldconfig directly in post/postun
1249 - add FAQ
1250
1251 * Sat Dec 18 1999 Bernhard Rosenkrdnzer <bero@redhat.de>
1252 - Fix build on non-x86 platforms
1253
1254 * Fri Nov 12 1999 Bernhard Rosenkrdnzer <bero@redhat.de>
1255 - move /usr/share/ssl/* from -devel to main package
1256
1257 * Tue Oct 26 1999 Bernhard Rosenkrdnzer <bero@redhat.de>
1258 - inital packaging
1259 - changes from base:
1260 - Move /usr/local/ssl to /usr/share/ssl for FHS compliance
1261 - handle RPM_OPT_FLAGS

admin@koozali.org
ViewVC Help
Powered by ViewVC 1.2.1 RSS 2.0 feed