Removed rpms ============ - apache2-mod_php7 - libpoppler126 - libraw20 - libsemanage1 - libsepol1 - noto-sans-jp-bold-fonts - noto-sans-jp-fonts - noto-sans-jp-regular-fonts - noto-sans-kr-bold-fonts - noto-sans-kr-fonts - noto-sans-kr-regular-fonts - noto-sans-sc-bold-fonts - noto-sans-sc-fonts - noto-sans-sc-regular-fonts - noto-sans-tc-bold-fonts - noto-sans-tc-fonts - noto-sans-tc-regular-fonts - noto-serif-jp-bold-fonts - noto-serif-jp-fonts - noto-serif-jp-regular-fonts - noto-serif-kr-bold-fonts - noto-serif-kr-fonts - noto-serif-kr-regular-fonts - noto-serif-sc-bold-fonts - noto-serif-sc-fonts - noto-serif-sc-regular-fonts - noto-serif-tc-bold-fonts - noto-serif-tc-fonts - noto-serif-tc-regular-fonts - php7 - php7-cli - php7-ctype - php7-dom - php7-iconv - php7-json - php7-mysql - php7-openssl - php7-pdo - php7-pgsql - php7-sqlite - php7-tokenizer - php7-xmlreader - php7-xmlwriter Added rpms ========== - apache2-mod_php8 - libgpgmepp6 - libpoppler132 - libraw23 - libsemanage-conf - libsemanage2 - libsepol2 - php8 - php8-cli - php8-ctype - php8-dom - php8-iconv - php8-mysql - php8-openssl - php8-pdo - php8-pgsql - php8-sqlite - php8-tokenizer - php8-xmlreader - php8-xmlwriter Package Source Changes ====================== MozillaFirefox +- Firefox Extended Support Release 115.6.0 ESR + Placeholder changelog-entry (bsc#1217974) + - Placeholder changelog-entry (bsc#1217230) + * Fixed: Various security fixes and other quality improvements. + MFSA 2023-50 (bsc#1217230) + * CVE-2023-6204 (bmo#1841050) + Out-of-bound memory access in WebGL2 blitFramebuffer + * CVE-2023-6205 (bmo#1854076) + Use-after-free in MessagePort::Entangled + * CVE-2023-6206 (bmo#1857430) + Clickjacking permission prompts using the fullscreen + transition + * CVE-2023-6207 (bmo#1861344) + Use-after-free in ReadableByteStreamQueueEntry::Buffer + * CVE-2023-6208 (bmo#1855345) + Using Selection API would copy contents into X11 primary + selection. + * CVE-2023-6209 (bmo#1858570) + Incorrect parsing of relative URLs starting with "///" + * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252, + bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943, + bmo#1862782) + Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5, + and Thunderbird 115.5 avahi +- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in + avahi_rdata_parse (bsc#1216853, CVE-2023-38472). + curl +- Fix: libssh: Implement SFTP packet size limit (bsc#1216987) + * Add curl-libssh_Implement_SFTP_packet_size_limit.patch + ghostscript +- CVE-2023-46751.patch is derived for Ghostscript-9.52 from + https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=dcdbc595c13 + (there is no "device initialization redesign" in Ghostscript-9.52) + that fixes CVE-2023-46751 + "dangling pointer in gdev_prn_open_printer_seekable()" + see https://bugs.ghostscript.com/show_bug.cgi?id=707264 + (bsc#1217871) + glibc +- aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr + (bsc#1217445, BZ #31113) + +- Remove systemd from shadow and gshadow lookups (bsc#1217220) + gnutls -- FIPS: PBKDF2 additional requirements [bsc#1209001] - * Set the minimum output key length to 112 bits (FIPS 140-3 IG D.N) - * Set the minimum salt length to 128 bits (SP 800-132 sec. 5.1) - * Set the minimum iterations count to 1000 (SP 800-132 sec 5.2) - * Set the minimum passlen of 20 characters (SP SP800-132 sec 5) - * Add regression tests for the new PBKDF2 requirements. - * Add gnutls-FIPS-pbkdf2-additional-requirements.patch - -- libgnutls: Increase the limit of TLS PSK usernames from 128 to - 65535 characters. [bsc#1208237, jsc#PED-1562] - * Upstream: https://gitlab.com/gnutls/gnutls/commit/f032324a - * Add gnutls-increase-TLS-PSK-username-limit.patch - -- FIPS: Fix pct_test() return code in case of error [bsc#1207183] - * Rebase with the upstream version: gnutls-FIPS-PCT-DH.patch +- Fix missing GNUTLS_NO_EXTENSIONS compatibility. + * Upstream: gitlab.com/gnutls/gnutls/commit/abfa8634 + * Add gnutls-GNUTLS_NO_EXTENSIONS-compatibility.patch + +- tests: Fix the SRP test that fails with SIGPIPE signal return due + to a socket being closed before using it. + * Add gnutls-srp-test-SIGPIPE.patch + +- Update to version 3.8.1: + * libgnutls: ClientHello extensions are randomized by default + To make fingerprinting harder, TLS extensions in ClientHello + messages are shuffled. As this behavior may cause compatibility + issue with legacy applications that do not accept the last + extension without payload, the behavior can be reverted with the + %NO_SHUFFLE_EXTENSIONS priority keyword. + * libgnutls: Add support for RFC 9258 external PSK importer. + This enables to deploy the same PSK across multiple TLS versions + (TLS 1.2 and TLS 1.3) in a secure manner. To use, the application + needs to set up a callback that formats the PSK identity using + gnutls_psk_format_imported_identity(). + * libgnutls: %GNUTLS_NO_EXTENSIONS has been renamed to + %GNUTLS_NO_DEFAULT_EXTENSIONS. + * libgnutls: Add additional PBKDF limit checks in FIPS mode as + defined in SP 800-132. Minimum salt length is 128 bits and + minimum iterations bound is 1000 for PBKDF in FIPS mode. + * libgnutls: Add a mechanism to control whether to enforce extended + master secret (RFC 7627). FIPS 140-3 mandates the use of TLS + session hash (extended master secret, EMS) in TLS 1.2. To enforce + this, a new priority keyword %FORCE_SESSION_HASH is added and if + it is set and EMS is not set, the peer aborts the connection. This + behavior is the default in FIPS mode, though it can be overridden + through the configuration file with the "tls-session-hash" option. + In either case non-EMS PRF is reported as a non-approved operation + through the FIPS service indicator. + * New option --attime to specify current time. + To make testing with different timestamp to the system easier, the + tools doing certificate verification now provide a new option + - -attime, which takes an arbitrary time. + * API and ABI modifications: + gnutls_psk_client_credentials_function3: New typedef + gnutls_psk_server_credentials_function3: New typedef + gnutls_psk_set_server_credentials_function3: New function + gnutls_psk_set_client_credentials_function3: New function + gnutls_psk_format_imported_identity: New function + GNUTLS_PSK_KEY_EXT: New enum member of gnutls_psk_key_flags + * Rebase patches: + - gnutls-FIPS-140-3-references.patch + - gnutls-FIPS-jitterentropy.patch + * Remove patches merged/fixed upstream: + - gnutls-FIPS-PCT-DH.patch + - gnutls-FIPS-PCT-ECDH.patch + +- FIPS: Fix baselibs.conf to mention libgnutls30-hmac [bsc#1211476] + Extend also the checks in gnutls-FIPS-HMAC-nettle-hogweed-gmp.patch + +- FIPS: Skip the fixed HMAC verification for nettle, hogweed and + gmp libraries. These calculated HMACs change for every build of + each of these packages, we only have to verify that for gnutls. + * Add gnutls-FIPS-HMAC-nettle-hogweed-gmp.patch [bsc#1211476] + +- FIPS: Merge libgnutls30-hmac package into the library [bsc#1185116] + +- Disable GNULIB's year2038 also for 32-bit arm - boo#1211394 + +- Temporarily disable GNULIB's year2038 support for 64bit time_t + by using the --disable-year2038 flag. This omits support for + timestamps past the year 2038: + * Fixes the public API on 32-bit architectures avoiding to + change the size of time_t as it cannot be changed without + breaking the ABI compatibility. + * Upstream issue: https://gitlab.com/gnutls/gnutls/-/issues/1466 + +- Update to 3.8.0: [bsc#1205763, bsc#1209627] + * libgnutls: Fix a Bleichenbacher oracle in the TLS RSA key + exchange. Reported by Hubert Kario (#1050). Fix developed by + Alexander Sosedkin. [GNUTLS-SA-2020-07-14, CVSS: medium] + [CVE-2023-0361] + * libgnutls: C++ library is now header only. All definitions + from gnutlsxx.c have been moved into gnutlsxx.h. Users of the + C++ interface have two options: + 1. include gnutlsxx.h in their application and link against + the C library. (default) + 2. include gnutlsxx.h in their application, compile with + GNUTLS_GNUTLSXX_NO_HEADERONLY macro defined and link + against the C++ library. + * libgnutls: GNUTLS_NO_STATUS_REQUEST flag and %NO_STATUS_REQUEST + priority modifier have been added to allow disabling of the + status_request TLS extension in the client side. + * libgnutls: TLS heartbeat is disabled by default. + The heartbeat extension in TLS (RFC 6520) is not widely used + given other implementations dropped support for it. To enable + back support for it, supply --enable-heartbeat-support to + configure script. + * libgnutls: SRP authentication is now disabled by default. + It is disabled because the SRP authentication in TLS is not + up to date with the latest TLS standards and its ciphersuites + are based on the CBC mode and SHA-1. To enable it back, supply + - -enable-srp-authentication option to configure script. + * libgnutls: All code has been indented using "indent -ppi1 -linux". + CI/CD has been adjusted to catch regressions. This is implemented + through devel/indent-gnutls, devel/indent-maybe and .gitlab-ci.yml’s + commit-check. You may run devel/indent-gnutls to fix any + indentation issues if you make code modifications. + * guile: Guile-bindings removed. They have been extracted into a + separate project to reduce complexity and to simplify maintenance, + see . + * minitasn1: Upgraded to libtasn1 version 4.19. + * API and ABI modifications: + GNUTLS_NO_STATUS_REQUEST: New flag + GNUTLS_SRTP_AEAD_AES_128_GCM: New gnutls_srtp_profile_t enum member + GNUTLS_SRTP_AEAD_AES_256_GCM: New gnutls_srtp_profile_t enum member + * Merge gnutls-FIPS-Set-error-state-when-jent-init-failed.patch + and gnutls-FIPS-jitterentropy-threadsafe.patch into the main + patch gnutls-FIPS-jitterentropy.patch + * Rebase gnutls-FIPS-140-3-references.patch + * Rebase patches with upstream version: + - gnutls-FIPS-PCT-DH.patch gnutls-FIPS-PCT-ECDH.patch + * Remove patches merged/fixed upstream: + - gnutls-FIPS-disable-failing-tests.patch + - gnutls-verify-library-HMAC.patch + - gnutls_ECDSA_signing.patch + - gnutls-Make-XTS-key-check-failure-not-fatal.patch + - gnutls-FIPS-SLI-pbkdf2-verify-keylengths-only-SHA.patch + * Update keyring with https://gnutls.org/gnutls-release-keyring.gpg -- Security Fix: [bsc#1208143, CVE-2023-0361] - * Bleichenbacher oracle in TLS RSA key exchange - * Add gnutls-CVE-2023-0361.patch +- Update to 3.7.9: [bsc#1208143, CVE-2023-0361] + * libgnutls: Fix a Bleichenbacher oracle in the TLS RSA key + exchange. [GNUTLS-SA-2020-07-14, CVSS: medium][CVE-2023-0361] + * Rebase gnutls-FIPS-140-3-references.patch -- Fix AVX CPU feature detection for OSXSAVE [bsc#1203299] - * Fixes a SIGILL termination at the verzoupper instruction when - trying to run GnuTLS on a Linux kernel with the noxsave command - line parameter set. Relevant mostly for virutal systems. - * Upstream bug: https://gitlab.com/gnutls/gnutls/issues/1282 - * Add gnutls-clear-AVX-bits-if-it-cannot-be-queried-XSAVE.patch +- switch to pkgconfig(zlib) so that alternative providers can be + used + +- Verify only the libgnutls library HMAC [bsc#1199881] + * Do not use the brp-50-generate-fips-hmac script as this + is now calculated with the internal fipshmac tool. + * Add gnutls-verify-library-HMAC.patch + +- Temporarily revert the jitterentropy patches in s390 and s390x + architectures until a fix is provided [bsc#1204937] +- Disable flaky test that fails in s390x architecture: + * Add gnutls-disable-flaky-test-dtls-resume.patch + +- Consolidate the FIPS hmac files [bsc#1203245] + * Use the gnutls fipshmac tool instead of the brp-check-suse + and rename it to reflect on the library version. + * Remove not needed gnutls-FIPS-Run-CFB8-without-offset.patch +- Add a gnutls.rpmlintrc file to remove a hidden-file-or-dir false + positive for the FIPS hmac calculation. + +- Update to 3.7.8: + * libgnutls: In FIPS140 mode, RSA signature verification is an + approved operation if the key has modulus with known sizes + (1024, 1280, 1536, and 1792 bits), in addition to any modulus + sizes larger than 2048 bits, according to SP800-131A rev2. + * libgnutls: gnutls_session_channel_binding performs additional + checks when GNUTLS_CB_TLS_EXPORTER is requested. According to + RFC9622 4.2, the "tls-exporter" channel binding is only usable + when the handshake is bound to a unique master secret (i.e., + either TLS 1.3 or extended master secret extension is + negotiated). Otherwise the function now returns error. + * libgnutls: usage of the following functions, which are designed + to loosen restrictions imposed by allowlisting mode of + configuration, has been additionally restricted. Invoking + them is now only allowed if system-wide TLS priority string + has not been initialized yet: + - gnutls_digest_set_secure + - gnutls_sign_set_secure + - gnutls_sign_set_secure_for_certs + - gnutls_protocol_set_enabled + * Delete gnutls-3.6.6-set_guile_site_dir.patch and use the + - -with-guile-extension-dir configure option to properly + handle the guile extension directory. + * Rebase gnutls-Make-XTS-key-check-failure-not-fatal.patch + * Update gnutls.keyring + * Add a build depencency on gtk-doc required by autoreconf -- FIPS: Zeroize the calculated hmac and new_hmac in the - check_binary_integrity() function. [bsc#1191021] - * Add gnutls-FIPS-Zeroize-check_binary_integrity.patch +- FIPS: Run the CFB8 cipher selftest without offset [bsc#1203245] + * CFB8 list of ciphers: GNUTLS_CIPHER_AES_{128,192,256}_CFB8 + * Add gnutls-FIPS-Run-CFB8-without-offset.patch + +- provide a libgnutls30-hmac-32bit to avoid uninstallable wine + when pattern-base-fips is installed [boo#1203353] -- Security fix: [bsc#1202020, CVE-2022-2509] - * Fixed double free during verification of pkcs7 signatures - * Add gnutls-CVE-2022-2509.patch - -- FIPS: - * Modify gnutls-FIPS-force-self-test.patch [bsc#1198979] - - gnutls_fips140_run_self_tests now properly releases fips_context +- Update to 3.7.7: [bsc#1202020, CVE-2022-2509] + * libgnutls: Fixed double free during verification of pkcs7 + signatures. CVE-2022-2509 + * libgnutls: gnutls_hkdf_expand now only accepts LENGTH argument + less than or equal to 255 times hash digest size, to comply with + RFC 5869 2.3. + * libgnutls: Length limit for TLS PSK usernames has been increased + from 128 to 65535 characters + * libgnutls: AES-GCM encryption function now limits plaintext + length to 2^39-256 bits, according to SP800-38D 5.2.1.1. + * libgnutls: New block cipher functions have been added to + transparently handle padding. gnutls_cipher_encrypt3 and + gnutls_cipher_decrypt3 can be used in combination of + GNUTLS_CIPHER_PADDING_PKCS7 flag to automatically add/remove + padding if the length of the original plaintext is not a multiple + of the block size. + * libgnutls: New function for manual FIPS self-testing. + * API and ABI modifications: + - gnutls_fips140_run_self_tests: New function + - gnutls_cipher_encrypt3: New function + - gnutls_cipher_decrypt3: New function + - gnutls_cipher_padding_flags_t: New enum + * guile: Guile 1.8 is no longer supported + * guile: Session record port treats premature termination as EOF Previously, + a 'gnutls-error' exception with the 'error/premature-termination' value + would be thrown while reading from a session record port when the + underlying session was terminated prematurely. This was inconvenient + since users of the port may not be prepared to handle such an exception. + Reading from the session record port now returns the end-of-file object + instead of throwing an exception, just like it would for a proper + session termination. + * guile: Session record ports can have a 'close' procedure. The + 'session-record-port' procedure now takes an optional second parameter, + and a new 'set-session-record-port-close!' procedure is provided to + specify a 'close' procedure for a session record port. This 'close' + procedure lets users specify cleanup operations for when the port is + closed, such as closing the file descriptor or port that backs the + underlying session. + * Rebase patches: + - gnutls-3.6.6-set_guile_site_dir.patch + - gnutls-FIPS-TLS_KDF_selftest.patch + - gnutls-FIPS-disable-failing-tests.patch + * Remove patch merged upstream: + - gnutls-FIPS-PBKDF2-KAT-requirements.patch + - https://gitlab.com/gnutls/gnutls/merge_requests/1561 - * Add gnutls-FIPS-force-self-test.patch [bsc#1198979] - - Provides interface for running library self tests on-demand - - Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1598 - -- FIPS: Make sure zeroization is performed in all API functions - * Add gnutls-zeroization-API-functions.patch [bsc#1191021] - * Upsream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1573 - -- FIPS: Add missing requirements for the SLI [bsc#1190698] - * Remove 3DES from FIPS approved algorithms: - - gnutls-Remove-3DES-from-FIPS-approved-algos.patch - - Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1570 - * DRBG service (gnutls_rnd) should be considered approved: - - gnutls-Add-missing-FIPS-service-indicator-transitions.patch - - gnutls-Add-missing-FIPS-service-indicator-transitions-tests.patch - - gnutls-pkcs12-tighten-algorithm-checks-under-FIPS.patch - - Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1569 - -- FIPS: Mark AES-GCM as approved in the TLS context [bsc#1194907] - * Add gnutls-FIPS-Mark-HKDF-and-AES-GCM-as-approved-when-used-in-TLS.patch - * Upstream issue: https://gitlab.com/gnutls/gnutls/issues/1311 + +- Update to version 3.7.6: + * libgnutls: Fixed invalid write when gnutls_realloc_zero() is + called with new_size < old_size. This bug caused heap + corruption when gnutls_realloc_zero() has been set as gmp + reallocfunc. + * Remove gnutls-3.7.5-fix-gnutls_realloc_zero.patch: Fixed + upstream. + +- Add gnutls-3.7.5-fix-gnutls_realloc_zero.patch: Fix memory + corruption in gnutls_realloc_zero (gl#gnutls/gnutls#1367, + boo#1199929). + +- update to 3.7.5: + * add options disable session ticket usage in TLS 1.2 because + it does not provide forward secrecy + * For TLS 1.3 where session tickets do provide forward secrecy, + the PFS priority string now only disables session tickets in + TLS 1.2. + * Future backward incompatibility: in the next major release of + GnuTLS those flag and modifier are planned to be removed + * gnutls-cli, gnutls-serv: Channel binding for printing + information has been changed from tls-unique to tls-exporter + as tls-unique is not supported in TLS 1.3. + * Certificate sanity checks has been enhanced to make gnutls + more RFC 5280 compliant: + * Removed 3DES from FIPS approved algorithms + * Optimized support for AES-SIV-CMAC algorithms + * libgnutls: HKDF and AES-GCM algorithms are now approved in + FIPS-140 mode when used in TLS + +- disable kcapi usage for now, as kernel-obs-build not adjusted + to contain the algorithms. bsc#1189283 - * Upstream: https://gitlab.com/gnutls/gnutls/merge_requests/1561 +- Update to 3.7.4: + * libgnutls: Added support for certificate compression as defined + in RFC8879. + * certtool: Added option --compress-cert that allows user to + specify compression methods for certificate compression. + * libgnutls: GnuTLS can now be compiled with --enable-strict-x509 + configure option to enforce stricter certificate sanity checks + that are compliant with RFC5280. + * libgnutls: Removed IA5String type from DirectoryString within + issuer and subject name to make DirectoryString RFC5280 compliant. + * libgnutls: Added function to retrieve the name of current + ciphersuite from session. + * Bump libgnutlsxx soname due to ABI break + * API and ABI modifications: + - GNUTLS_COMP_BROTLI: New gnutls_compression_method_t enum member + - GNUTLS_COMP_ZSTD: New gnutls_compression_method_t enum member + - gnutls_compress_certificate_get_selected_method: Added + - gnutls_compress_certificate_set_methods: Added + * Update gnutls.keyring + +- build with lto +- build with -Wl,-z,now -Wl,-z,relro +- build without -fanalyzer, which cuts build time in ~ half + - - gnutls-3.6.0-disable-flaky-dtls_resume-test.patch -- Add crypto-policies support in SLE-15-SP4 [jsc#SLE-20287] - -- Account for the libnettle soname bump [jsc#SLE-19765] +- Add crypto-policies support for Leap and SLE 15.4 [jsc#SLE-20287] +- Add DANE guards -- Update to 3.7.2 in SLE-15-SP4: [jsc#SLE-19765, jsc#SLE-18139] - - Add gnutls-temporarily_disable_broken_guile_reauth_test.patch - - Rebased patches: - * disable-psk-file-test.patch - * gnutls-3.6.0-disable-flaky-dtls_resume-test.patch - * gnutls-fips_mode_enabled.patch - - Remove patches merged upstream: - * gnutls-CVE-2020-11501.patch - * gnutls-CVE-2020-13777.patch - * gnutls-CVE-2020-24659.patch - * gnutls-CVE-2021-20231.patch - * gnutls-CVE-2021-20232.patch - * gnutls-3.6.7-fips-backport_dont_truncate_output_IV.patch - * gnutls-fips_XTS_key_check.patch - * 0001-_gnutls_verify_crt_status-apply-algorithm-checks-to-.patch - * 0002-_gnutls_pkcs11_verify_crt_status-check-validity-agai.patch - * 0003-x509-trigger-fallback-verification-path-when-cert-is.patch - * 0004-tests-add-test-case-for-certificate-chain-supersedin.patch - * 0001-Add-Full-Public-Key-Check-for-DH.patch - * 0001-Add-test-to-ensure-DH-exchange-behaves-correctly.patch - * 0002-Add-test-to-ensure-ECDH-exchange-behaves-correctly.patch - * 0003-Add-plumbing-to-handle-Q-parameter-in-DH-exchanges.patch - * 0004-Always-pass-in-and-check-Q-in-TLS-1.3.patch - * 0005-Check-Q-for-FFDHE-primes-in-prime-check.patch - * 0006-Pass-down-Q-for-FFDHE-in-al-pre-TLS1.3-as-well.patch - * 0001-dh-primes-add-MODP-primes-from-RFC-3526.patch - * 0002-dhe-check-if-DH-params-in-SKE-match-the-FIPS-approve.patch - * 0001-dh-check-validity-of-Z-before-export.patch - * 0002-ecdh-check-validity-of-P-before-export.patch - * 0003-dh-primes-make-the-FIPS-approved-check-return-Q-valu.patch - * 0004-dh-perform-SP800-56A-rev3-full-pubkey-validation-on-.patch - * 0005-ecdh-perform-SP800-56A-rev3-full-pubkey-validation-o.patch - * 0001-Vendor-in-XTS-functionality-from-Nettle.patch - * 0001-pubkey-avoid-spurious-audit-messages-from-_gnutls_pu.patch - * gnutls-FIPS-use_2048_bit_prime_in_DH_selftest.patch - * gnutls-3.6.7-fix-FTBFS-2024.patch - * gnutls-3.6.7-reproducible-date.patch +- Remove gnutls-temporarily_disable_broken_guile_reauth_test.patch + since its already working. -- Add gnutls-3.6.7-fix-FTBFS-2024.patch to let tests pass after 2024 (boo#1186579) -- Add gnutls-3.6.7-reproducible-date.patch to override build date (boo#1047218) +- Rework the crypto-policies dependencies in libraries [bsc#1186385] + +- Compute the FIPS hmac file without re-defining the + __os_install_post macro, use the brp-50-generate-fips-hmac + script instead. [bsc#1184555] -- Security fix: [bsc#1183456, CVE-2021-20232] - * A use after free issue in client_send_params - in lib/ext/pre_shared_key.c may lead to memory - corruption and other potential consequences. -- Add gnutls-CVE-2021-20232.patch - -- Security fix: [bsc#1183457, CVE-2021-20231] - * A use after free issue in client sending key_share extension - may lead to memory corruption and other consequences. -- Add gnutls-CVE-2021-20231.patch +- Require the main package in devel and lib packages as the default + priorities are now set via crypto-policies. [bsc#1183082] - verification + verification +- Add version guards for the crypto-policies package -- Avoid spurious audit messages about incompatible signature algorithms - (bsc#1172695) - * add 0001-pubkey-avoid-spurious-audit-messages-from-_gnutls_pu.patch +- Require the crypto-policies package [bsc#1180051] -- FIPS: Use 2048 bit prime in DH selftest (bsc#1176086) - * add gnutls-FIPS-use_2048_bit_prime_in_DH_selftest.patch -- FIPS: Add TLS KDF selftest (bsc#1176671) - * add gnutls-FIPS-TLS_KDF_selftest.patch - -- Escape rpm command %%expand when used in comment. +- Use the centralized crypto policy profile (jsc#SLE-15832) - -- Fix heap buffer overflow in handshake with no_renegotiation alert sent - * CVE-2020-24659 (bsc#1176181) -- add gnutls-CVE-2020-24659.patch - -- FIPS: Implement (EC)DH requirements from SP800-56Arev3 (bsc#1176086) -- add patches - * 0001-Add-Full-Public-Key-Check-for-DH.patch - * 0001-Add-test-to-ensure-DH-exchange-behaves-correctly.patch - * 0002-Add-test-to-ensure-ECDH-exchange-behaves-correctly.patch - * 0003-Add-plumbing-to-handle-Q-parameter-in-DH-exchanges.patch - * 0004-Always-pass-in-and-check-Q-in-TLS-1.3.patch - * 0005-Check-Q-for-FFDHE-primes-in-prime-check.patch - * 0006-Pass-down-Q-for-FFDHE-in-al-pre-TLS1.3-as-well.patch - * 0001-dh-primes-add-MODP-primes-from-RFC-3526.patch - * 0002-dhe-check-if-DH-params-in-SKE-match-the-FIPS-approve.patch - * 0001-dh-check-validity-of-Z-before-export.patch - * 0002-ecdh-check-validity-of-P-before-export.patch - * 0003-dh-primes-make-the-FIPS-approved-check-return-Q-valu.patch - * 0004-dh-perform-SP800-56A-rev3-full-pubkey-validation-on-.patch - * 0005-ecdh-perform-SP800-56A-rev3-full-pubkey-validation-o.patch -- drop obsolete gnutls-3.6.7-fips_DH_ECDH_key_tests.patch +- Escape rpm command %%expand when used in comment. -- GNUTLS-SA-2020-06-03 (Fixed insecure session ticket key construction) - The TLS server would not bind the session ticket encryption key with a - value supplied by the application until the initial key rotation, allowing - attacker to bypass authentication in TLS 1.3 and recover previous - conversations in TLS 1.2 (#1011). (bsc#1172506, CVE-2020-13777) - * add patches: - + gnutls-CVE-2020-13777.patch -- Fixed handling of certificate chain with cross-signed intermediate - CA certificates (#1008). (bsc#1172461) - * add patches: - + 0001-_gnutls_verify_crt_status-apply-algorithm-checks-to-.patch - + 0002-_gnutls_pkcs11_verify_crt_status-check-validity-agai.patch - + 0003-x509-trigger-fallback-verification-path-when-cert-is.patch - + 0004-tests-add-test-case-for-certificate-chain-supersedin.patch - -- Add RSA 4096 key generation support in FIPS mode (bsc#1171422) - * add gnutls-3.6.7-fips-rsa-4096.patch - -- Don't check for /etc/system-fips which we don't have (bsc#1169992) - * add gnutls-fips_mode_enabled.patch - -- Backport AES XTS support (bsc#1168835) - * add 0001-Vendor-in-XTS-functionality-from-Nettle.patch - * add gnutls-fips_XTS_key_check.patch - - * libgnutls: Fix a DTLS-protocol regression (caused by TLS1.3 support) + * libgnutls: Fix a DTLS-protocol regression (caused by TLS1.3 + support) -- Fix zero random value in DTLS client hello - (CVE-2020-11501, bsc#1168345) - * add gnutls-CVE-2020-11501.patch - - * update baselibs.conf - -- bsc#1166881 - FIPS: gnutls: cfb8 decryption issue - * No longer truncate output IV if input is shorter than block size. - * Added gnutls-3.6.7-fips-backport_dont_truncate_output_IV.patch - -- bsc#1155327 jira#SLE-9518 - FIPS: add DH key test - * Added Diffie Hellman public key verification test. - * gnutls-3.6.7-fips_DH_ECDH_key_tests.patch -- Explicitly require libnettle 3.4.1 (bsc#1134856) - * The RSA decryption code was rewritten in GnuTLS 3.6.5 in order - to fix CVE-2018-16868, the new implementation makes use of a new - rsa_sec_decrypt() function introduced in libnettle 3.4.1 - * libnettle was recently updated to the 3.4.1 version but we need - to add explicit dependency on it to prevent missing symbol errors - with the older versions - -- Restored autoreconf in build. -- Removed gnutls-3.6.6-SUSE_SLE15_congruent_version_requirements.patch - since the version requirements of required libraries are once again - automatically determined. -- Added gnutls-3.6.7-SUSE_SLE15_guile_site_directory.patch because it is a - better patch name for handling the '--with-guile-site-dir=' problem in - 3.6.7. - -- Disabled dane support since dane is not shipped with SLE-15 +- Disabled dane support in SLE since dane is not shipped there - option '--with-guile-site-dir=' was removed from the configure script in 3.6.7. - * * Modified gnutls-3.6.6-SUSE_SLE15_congruent_version_requirements.patch + option '--with-guile-site-dir=' was removed from the configure script. + * * Added gnutls-3.6.6-set_guile_site_dir.patch -- Fixed Bleichenbacher-like side channel leakage in PKCS#1 v1.5 verification - and padding oracle verification (in 3.6.5) [bsc#1118087] (CVE-2018-16868) -- FATE#327114 - Update gnutls to 3.6.6 to support TLS 1.3 +- Update to 3.6.6 - * Removed patches: - 0001-dummy_wait-correctly-account-the-length-field-in-SHA.patch - 0002-dummy_wait-always-hash-the-same-amount-of-blocks-tha.patch - 0003-cbc_mac_verify-require-minimum-padding-under-SSL3.0.patch - 0004-hmac-sha384-and-sha256-ciphersuites-were-removed-fro.patch - * Added Patches: - * * disable failing psk-file test (race condition): - disable-psk-file-test.patch - * * Patch configure script to accept specific versions of autotools and guile - that are present in SUSE-SLE15. (A bug prevents configure from accepting - a range of compatible versions. Upstream's solution is to hardwire for - the most current versions.) - gnutls-3.6.6-SUSE_SLE15_congruent_version_requirements.patch - * Modified: - * * gnutls-3.6.0-disable-flaky-dtls_resume-test.patch -- Security update - Improve mitigations against Lucky 13 class of attacks - * "Just in Time" PRIME + PROBE cache-based side channel attack - can lead to plaintext recovery (CVE-2018-10846, bsc#1105460) - * HMAC-SHA-384 vulnerable to Lucky thirteen attack due to use of - wrong constant (CVE-2018-10845, bsc#1105459) - * HMAC-SHA-256 vulnerable to Lucky thirteen attack due to not - enough dummy function calls (CVE-2018-10844, bsc#1105437) - * add patches: - 0001-dummy_wait-correctly-account-the-length-field-in-SHA.patch - 0002-dummy_wait-always-hash-the-same-amount-of-blocks-tha.patch - 0003-cbc_mac_verify-require-minimum-padding-under-SSL3.0.patch - 0004-hmac-sha384-and-sha256-ciphersuites-were-removed-fro.patch - google-noto-sans-cjk-fonts +- use synthetic version 20201202.2.2004, as maintenance updates cannot + do version downgrades. + +feat!: rename noto-*-cjk-fonts -> google-noto-*-cjk-fonts +- The Noto Coloremoji fonts have already been renamed by now +- The other Noto fonts will be renamed once upstream finishes migrating them to the new website + * https://github.com/notofonts/notofonts.github.io + fix: move zh_MO obsoletes and provides to Hong Kong TC fonts +- Macau is physically and culturally closer to Hong Kong than Taiwan + fix: summary and description for Hong Kong TC fonts + +- Move google-noto-serif-cjk-fonts into its own repository again + +- Update version to 2.004 +- Follow upstream versioning: use version numbers instead of dates + +- Fix the source URL to be properly downloadable + +- Update version to 2.002(20201202) + * The copyright year was changed from “2014–2019” to “2014–2020.” + * Addressed Issue #207 including glyph changes to U+4E08 and U+5C83. + Extension G encodings were added for U+30729, U+30EDD, U+30EDE, + and U+3106C and the previous GSUB rules were removed. + * Updated Korean glyph for U+58C4 as reported in Source Han Serif Issue #87 + * Addressed Issue #204 for U+50E7, U+89E6, U+8FD0, U+9EA4, U+25C4A + * Mapped HK U+5C13 尓 to JP glyph + * Fixed U+21B9 as reported in Issue #260 + * Changed Korean mapping for U+51A4 as reported in Issue #202 + * The weights for Kanbun glyphs U+3191–U+319F have been adjusted + as mentioned in the table at the beginning of Issue #205. + * Fixed Korean IVS mapping for U+8ACB as reported in Issue #276 +- Fix descriptions for *-full packages + +- Update version to 2.001(20190410) + * A second flavor of Traditional Chinese, for Hong Kong and supporting the + HKSCS-2016 standard, was add- ed, which increased the total number of font + resources by 16, from 72 to 88. + * 155 new mappings have been added to the CMap resources. 66 are from BMP code + points, 22 are from Plane 1 code points, and the remaining 67 are from + Plane 2 code points. Among the 67 new Plane 2 code points, 57 are from + Extension B, two are from Extension C, three are from Extension E, and the + remaining five are from Extension F. + * As a result of removing approximately 1,750 glyphs in order to make room for + approximately 1,750 new glyphs, the CID assignments of the glyphs + necessarily—and drastically—changed. The CID assignments of exactly 200 + glyphs are unchanged from Version 1.004: 0–107, 2570–2633, 47223–47232, + 47262–47272, 47281–47286, and 65484. + * The Traditional Chinese form of the Radical #162 辶 component was improved. + * The URO is complete up through U+9FEF (Unicode Version 11.0). + * The glyphs for some of the kana were tweaked. + * The glyphs and support for bopomofo, along with their tone marks, were + improved. This involved adding the 'GDEF' (Glyph Definition) table, the + 'mark' (Mark Positioning) GPOS feature, and the 'ruby' (Ruby Nota- tion + Forms) GSUB feature. + * The language and script declarations in the 'locl' and 'vert' GSUB features + were improved. + * The 13-page glyph synopsis PDFs for the 500 pre-composed high-frequency + hangul syllables have been incorporated into the Unicode-base glyph synopsis + PDFs, and are bookmarked under the “Korean” book- mark. + * Placeholder glyphs for U+32FF, uni32FF (CID+2184) and uni32FF-V (CID+65359), + are included. This character has been reserved for the two-ideograph square + ligature that represents the name of Japan’s forthcoming new era which + starts on 2019-05-01, and will be the only character added in Unicode + Version 12.1. + * Like Source Han Serif, the CIDFont and CMap resources do not include XUID + arrays. + * Like Source Han Serif, there are no mappings for the range U+0000 through + U+001F. + * Like Source Han Serif, the code points that correspond to Halfwidth Jamo + variants map to glyphs that cor- respond to code points in the Hangul + Compatibility Jamo block. In other words, the glyphs for half-width jamo + have been removed. + * Like Source Han Serif, the 'name' table does not includes any Macintosh + (PlatformID=1) strings. + * Like Source Han Serif, the Regular weight is now style-linked to the Bold + weight. This means that the Bold weight may not appear in the font menu, + particularly when using applications that support style-linking as a way to + make text bold. + * Like Source Han Serif, the 'vert' GPOS feature is included. + * Like Source Han Serif, the deprecated 'hngl' (Hangul) GSUB feature is not + included in the Korean fonts and font instances. +- Split HongKong Fonts for NotoSans. + google-noto-serif-cjk-fonts +- use 20201202.2.002 to still have linear increase in versions + +feat!: rename noto-*-cjk-fonts -> google-noto-*-cjk-fonts +- The Noto Coloremoji fonts have already been renamed by now +- The other Noto fonts will be renamed once upstream finishes migrating them to the new website + * https://github.com/notofonts/notofonts.github.io + fix: move zh_MO obsoletes and provides to Hong Kong TC fonts +- Macau is physically and culturally closer to Hong Kong than Taiwan + +- Move google-noto-serif-cjk-fonts into its own repository again + +- Update version to 2.001 +- Follow upstream versioning: use version numbers instead of dates + +- Fix the source URL to be properly downloadable + +- Update version to 2.002(20201202) + * The copyright year was changed from “2014–2019” to “2014–2020.” + * Addressed Issue #207 including glyph changes to U+4E08 and U+5C83. + Extension G encodings were added for U+30729, U+30EDD, U+30EDE, + and U+3106C and the previous GSUB rules were removed. + * Updated Korean glyph for U+58C4 as reported in Source Han Serif Issue #87 + * Addressed Issue #204 for U+50E7, U+89E6, U+8FD0, U+9EA4, U+25C4A + * Mapped HK U+5C13 尓 to JP glyph + * Fixed U+21B9 as reported in Issue #260 + * Changed Korean mapping for U+51A4 as reported in Issue #202 + * The weights for Kanbun glyphs U+3191–U+319F have been adjusted + as mentioned in the table at the beginning of Issue #205. + * Fixed Korean IVS mapping for U+8ACB as reported in Issue #276 + +- Update version to 2.001(20190410) + * A second flavor of Traditional Chinese, for Hong Kong and supporting the + HKSCS-2016 standard, was add- ed, which increased the total number of font + resources by 16, from 72 to 88. + * 155 new mappings have been added to the CMap resources. 66 are from BMP code + points, 22 are from Plane 1 code points, and the remaining 67 are from + Plane 2 code points. Among the 67 new Plane 2 code points, 57 are from + Extension B, two are from Extension C, three are from Extension E, and the + remaining five are from Extension F. + * As a result of removing approximately 1,750 glyphs in order to make room for + approximately 1,750 new glyphs, the CID assignments of the glyphs + necessarily—and drastically—changed. The CID assignments of exactly 200 + glyphs are unchanged from Version 1.004: 0–107, 2570–2633, 47223–47232, + 47262–47272, 47281–47286, and 65484. + * The Traditional Chinese form of the Radical #162 辶 component was improved. + * The URO is complete up through U+9FEF (Unicode Version 11.0). + * The glyphs for some of the kana were tweaked. + * The glyphs and support for bopomofo, along with their tone marks, were + improved. This involved adding the 'GDEF' (Glyph Definition) table, the + 'mark' (Mark Positioning) GPOS feature, and the 'ruby' (Ruby Nota- tion + Forms) GSUB feature. + * The language and script declarations in the 'locl' and 'vert' GSUB features + were improved. + * The 13-page glyph synopsis PDFs for the 500 pre-composed high-frequency + hangul syllables have been incorporated into the Unicode-base glyph synopsis + PDFs, and are bookmarked under the “Korean” book- mark. + * Placeholder glyphs for U+32FF, uni32FF (CID+2184) and uni32FF-V (CID+65359), + are included. This character has been reserved for the two-ideograph square + ligature that represents the name of Japan’s forthcoming new era which + starts on 2019-05-01, and will be the only character added in Unicode + Version 12.1. + * Like Source Han Serif, the CIDFont and CMap resources do not include XUID + arrays. + * Like Source Han Serif, there are no mappings for the range U+0000 through + U+001F. + * Like Source Han Serif, the code points that correspond to Halfwidth Jamo + variants map to glyphs that cor- respond to code points in the Hangul + Compatibility Jamo block. In other words, the glyphs for half-width jamo + have been removed. + * Like Source Han Serif, the 'name' table does not includes any Macintosh + (PlatformID=1) strings. + * Like Source Han Serif, the Regular weight is now style-linked to the Bold + weight. This means that the Bold weight may not appear in the font menu, + particularly when using applications that support style-linking as a way to + make text bold. + * Like Source Han Serif, the 'vert' GPOS feature is included. + * Like Source Han Serif, the deprecated 'hngl' (Hangul) GSUB feature is not + included in the Korean fonts and font instances. +- Split HongKong Fonts for NotoSans. + gpg2 -- Security fix [CVE-2022-34903, bsc#1201225] - - Vulnerable to status injection - - Added patch gnupg-CVE-2022-34903.patch - -- gnupg-detect_FIPS_mode.patch: use AES as default cipher instead - of 3DES if we are in FIPS mode. (bsc#1196125) - -- Update gpg2 for SLE15-SP3 [jsc#SLE-17559, bsc#1182572] -- Remove patches fixed upstream: - * gnupg-gpg-agent-ssh-agent.patch - * gnupg-2.2.22-fix-segv-import-keys.patch - * gnupg-Allow-redirection-from-https-to-http-for-CRLs.patch - * gnupg-CRL-fetching-via-https.patch - * gnupg-CVE-2018-1000858.patch - * gnupg-CVE-2018-12020.patch - * gnupg-CVE-2019-13050_0_of_5.patch - * gnupg-CVE-2019-13050_1_of_5.patch - * gnupg-CVE-2019-13050_2_of_5.patch - * gnupg-CVE-2019-13050_3_of_5.patch - * gnupg-CVE-2019-13050_4_of_5.patch - * gnupg-CVE-2019-13050_5_of_5.patch - * gnupg-CVE-2019-14855.patch -- Update gpg2.keyring +- Fix the build in SLE and Leap by adding an exclude in the files + section for the dirmngr's systemd user units. [jsc#PED-7093] + +- Do not pull revision info from GIT when autoconf is run. This + removes the -unknown suffix after the version number. + * Add gnupg-nobetasuffix.patch [bsc#1216334] + +- Fix Emacs EasyPG behavior when parsing output: + * gpg: Report BEGIN_* status before examining the input. + * Upstream task: https://dev.gnupg.org/T6481 + * Add gnupg-Report-BEGIN_-status-before-examining-the-input.patch + +- Install the internal executables in the /usr/libexec dir instead + of /usr/lib64. These files are keyboxd, scdaemon, gpg-auth + gpg-check-pattern, gpg-pair-tool, gpg-preset-passphrase, + gpg-protect-tool, gpg-wks-client, dirmngr_ldap and tpm2daemon. + +- Provide the systemd-user files since they have been removed + upstream since version 2.4.1. [bsc#1201564] + * Add gpg2-systemd-user.tar.xz + +- Install the systemd user units in the _userunitdir [bsc#1201564] + * Note that, there is no activation by default. + * Rework excludes in the spec's files section. + +- Revert back to use the IBM TPM Software stack. + +- Update to 2.4.3: + * gpg: Set default expiration date to 3 years. [T2701] + * gpg: Add --list-filter properties "key_expires" and + "key_expires_d". [T6529] + * gpg: Emit status line and proper diagnostics for write errors. [T6528] + * gpg: Make progress work for large files on Windows. [T6534] + * gpg: New option --no-compress as alias for -z0. + * gpgsm: Print PROGRESS status lines. Add new --input-size-hint. [T6534] + * gpgsm: Support SENDCERT_SKI for --call-dirmngr. [rG701a8b30f0] + * gpgsm: Major rewrite of the PKCS#12 parser. [T6536] + * gpgtar: New option --no-compress. + * dirmngr: Extend the AD_QUERY command. [rG207c99567c] + * dirmngr: Disable the HTTP redirect rewriting. [T6477] + * dirmngr: New option --compatibility-flags. [rGbf04b07327] + * dirmngr: New option --ignore-crl-extensions. [T6545] + * wkd: Use export-clean for gpg-wks-client's --mirror and --create + commands. [rG2c7f7a5a27] + * wkd: Make --add-revocs the default in gpg-wks-client. New option + - -no-add-revocs. [rG10c937ee68] + * scd: Make signing work for Nexus cards. [rGb83d86b988] + * scd: Fix authentication with Administration Key for PIV. [rG25b59cf6ce] + +- Update to 2.4.2: + * gpg: Print a warning if no more encryption subkeys are left over + after changing the expiration date. [rGef2c3d50fa] + * gpg: Fix searching for the ADSK key when adding an ADSK. [T6504] + * gpgsm: Speed up key listings on Windows. [rG08ff55bd44] + * gpgsm: Reduce the number of "failed to open policy file" + diagnostics. [rG68613a6a9d] + * agent: Make updating of private key files more robust and track + display S/N. [T6135] + * keyboxd: Avoid longish delays on Windows when listing keys. + [rG6944aefa3c] + * gpgtar: Emit extra status lines to help GPGME. [T6497] + * w32: Avoid using the VirtualStore. [T6403] + * Rebase gnupg-add_legacy_FIPS_mode_option.patch + +- Update to 2.4.1: + * If the ~/.gnupg directory does not exist, the keyboxd is now + automagically enabled. [rGd9e7488b17] + * gpg: New option --add-desig-revoker. [rG3d094e2bcf] + * gpg: New option --assert-signer. [rGc9e95b8dee] + * gpg: New command --quick-add-adsk and other ADSK features. + [T6395, https://gnupg.org/blog/20230321-adsk.html] + * gpg: New list-option "show-unusable-sigs". Also show "[self-signature]" + instead of the user-id in key signature listings. [rG103acfe9ca] + * gpg: For symmetric encryption the default S2K hash is now SHA256. [T6367] + * gpg: Detect already compressed data also when using a pipe. Also + detect JPEG and PNG file formats. [T6332] + * gpg: New subcommand "openpgp" for --card-edit. [T6462] + * gpgsm: Verification of detached signatures does now strip trailing + zeroes from the input if --assume-binary is used. [rG2a13f7f9dc] + * gpgsm: Non-armored detached signature are now created without + using indefinite form length octets. This improves compatibility + with some PDF signature verification software. [rG8996b0b655] + * gpgtar: Emit progress status lines in create mode. [T6363] + * dirmngr: The LDAP modifyTimestamp is now returned by some + keyserver commands. [rG56d309133f] + * ssh: Allow specification of the order keys are presented to ssh. + See the man page entry for --enable-ssh-support. [T5996, T6212] + * gpg: Make list-options "show-sig-subpackets" work again. + Fixes regression in 2.4.0. [rG5a223303d7] + * gpg: Fix the keytocard command for Yubikeys. [T6378] + * gpg: Do not continue an export after a cancel for the primary key. [T6093] + * gpg: Replace the --override-compliance-check hack by a real fix. [T5655] + * gpgtar: Fix decryption with input taken from stdin. [T6355] + * Rebase patches: + - gnupg-revert-rfc4880bis.patch + - gnupg-add_legacy_FIPS_mode_option.patch + * Remove patch fixed upstream: + - gnupg-tests-Fix-tests-gpgme-for-in-source-tree-builds.patch + +- Temporarily revert back to the pre-2.4 default for key generation. + The new rfc4880bis has been set as the default in 2.4 version and + might create incompatible keys. Note that, rfc4880bis can still + be used with the option flag --rfc4880bis as in previous versions. + * More info in the gnupg-devel ML: + https://lists.gnupg.org/pipermail/gnupg-devel/2022-December/035183.html + * Reverted commit https://dev.gnupg.org/rGcaf4b3fc16e9 + * Add gnupg-revert-rfc4880bis.patch + +- Allow 8192 bit RSA keys in keygen UI when large_rsa is set + * Add gnupg-allow-large-rsa.patch + +- Fix the regression test suite fails with the IBM TPM Software + stack. Builds fine using the Intel TPM; use the swtpm and + tpm2-0-tss-devel packages instead of ibmswtpm2 and ibmtss-devel. + +- Fix broken GPGME QT tests: Upstram dev task dev.gnupg.org/T6313 + * The original patch has been modified to expand the changes + also to the tests/gpgme/Makefile.in file. + * Add gnupg-tests-Fix-tests-gpgme-for-in-source-tree-builds.patch + +- Updated to require libgpg-error-devel >= 1.46 +- Rebased patches: + * gnupg-allow-import-of-previously-known-keys-even-without-UIDs.patch + * gnupg-add_legacy_FIPS_mode_option.patch +- GnuPG 2.4.0: + * common: Fix translations in --help for gpgrt < 1.47. + * gpg: Do not continue the export after a cancel for the primary key. + * gpg: Replace use of PRIu64 in log_debug. + * Update NEWS for 2.4.0. + * tests: Fix make check with GPGME. + * agent: Allow arguments to "scd serialno" in restricted mode. + * scd:p15: Skip deleted records. + * build: Remove Windows CE support. + * wkd: Do not send/install/mirror expired user ids. + * gpgsm: Print the revocation time also with --verify. + * gpgsm: Fix "problem re-searching certificate" case. + * gpgsm: Print revocation date and reason in cert listings. + * gpgsm: Silence the "non-critical certificate policy not allowed". + * gpgsm: Always use the chain model if the root-CA requests this. + * gpg: New export option "mode1003". + * gpg: Remove a mostly duplicated function. + * tests: Simplify fake-pinentry to use the option only. + * tests: Fix fake-pinentry for Windows. + * tests: Fix make check-all. + * agent: Fix import of protected v5 keys. + * gpgsm: Change default algo to AES-256. + * tests: Put a workaround for semihosted environment. + * tests: More fix for semihosted environment. + * tests: Support semihosted environment. + * tests: Fix tests under cms. + * tests,w32: Fix for semihosted environment. + * w32: Fix for tests on semihosted environment. + * w32: Fix gnupg_unsetenv. + * wkd: New option --add-revocs and some fixes. + * wkd: Make use of --debug extprog. + * gpg: New export-filter export-revocs. + * gpg: Fix double-free in gpg --card-edit. + * gpg: Make --require-compliance work with out --status-fd. + * gpg: New option --list-filter. + * dirmngr: Silence ocsp debug output. + * tests: Fix to support --enable-all-tests and variants. + * tests:w32: Fix for non-dot file name for Windows. + * tests:gpgscm:w32: Fix for GetTempPath. + * tests: Keep .log files in objdir. + * tests: Use 233 for invalid value of FD. + * w32: Fix gnupg_tmpfile for possible failure. + * scd: Redact --debug cardio output of a VERIFY APDU. + * common: Remove Windows CE support in common. + * gpgsm: Fix colon outout of ECC encryption certificates. + * scd:nks: Fix ECC signing if key not given by keygrip. + * dirmngr: Fix verification of ECDSA signed CRLs. + * agent: Allow trustlist on Windows in Unicode homedirs. + * gpg: Fix verification of cleartext signatures with overlong lines. + * gpg: Move w32_system function. + * gpg: New option --quick-update-pref. + * gpg: New list-options show-pref and show-pref-verbose. + * tests: Add tests to check that OCB is only used for capable keys. + * gpg: Make --list-packets work w/o --no-armor for plain OCB packets. + * tests: Add symmetric decryption tests. + * tests: Add tr:assert-same function. + * agent: Avoid blanks in the ssh key's comment. + * build: Update m4 files. + * gpg: Merge --rfc4880bis features into --gnupg. + * gpg: Allow only OCB for AEAD encryption. + * gpg: New option --compatibility-flags. + * gpgsm: Also announce AES256-CBC in signatures. + * gpg: Fix trusted introducer for user-ids with only the mbox. + * gpg: Import stray revocation certificates. + * agent: Automatically convert to extended key format by KEYATTR. + * card: New commands "gpg" and "gpgsm". + * card: Also show fingerprints of known X.509 certificates. + * scd:nks: Support non-ESIGN signing with the Signature Card v2. + * gpgsm: Allow ECC encryption keys with just keyAgreement specified. + * gpgsm: Use macro constants for cert_usage_p. + * build: Update gpg-error.m4. + * agent,common,dirmngr,tests,tools: Remove spawn PREEXEC argument. + * gpg: Move NETLIBS after GPG_ERROR_LIBS. + * gpg: Use GCRY_KDF_ONESTEP_KDF with newer libgcrypt in future. + * common,w32: Fix struct stat on Windows. + * agent,w32: Support Win32-OpenSSH emulation by gpg-agent. + * common: Don't use FD2INT for POSIX-only code. + * dirmngr: Fix build with no LDAP support. + +- GnuPG 2.3.8: + * gpg: Do not consider unknown public keys as non-compliant while + decrypting. + * gpg: Avoid to emit a compliance mode line if Libgcrypt is + non-compliant. + * gpg: Improve --edit-key setpref command to ease c+p. + * gpg: Emit an ERROR status if --quick-set-primary-uid fails and + allow to pass the user ID by hash. + * gpg: Actually show symmetric+pubkey encrypted data as de-vs + compliant. Add extra compliance checks for symkey_enc packets. + * gpg: In de-vs mode use SHA-256 instead of SHA-1 as implicit + preference. + * gpgsm: Fix reporting of bad passphrase error during PKCS#11 + import. + * agent: Fix a regression in "READKEY --format=ssh". + * agent: New option --need-attr for KEYINFO. + * agent: New attribute "Remote-list" for use by KEYINFO. + * scd: Fix problem with Yubikey 5.4 firmware. + * dirmngr: Fix CRL Distribution Point fallback to other schemes. + * dirmngr: New LDAP server flag "areconly" (A-record-only). + * dirmngr: Fix upload of multiple keys for an LDAP server specified + using the colon format. + * dirmngr: Use LDAP schema v2 when a Base DN is specified. + * dirmngr: Avoid caching expired certificates. + * wkd: Fix path traversal attack in gpg-wks-server. Add the mail + address to the pending request data. + * wkd: New command --mirror for gpg-wks-client. + * gpg-auth: New tool for authentication. + * New common.conf option no-autostart. + * Silence warnings from AllowSetForegroundWindow unless + GNUPG_EXEC_DEBUG_FLAGS is used. + * Rebase gnupg-detect_FIPS_mode.patch + * Remove patch upstream: + - gnupg-2.3.7-scd-openpgp-Fix-workaround-for-Yubikey-heuristics.patch + +- Fix YubiKey 5 Nano support (boo#1202201), add + gnupg-2.3.7-scd-openpgp-Fix-workaround-for-Yubikey-heuristics.patch + +- GnuPG 2.3.7: + * CVE-2022-34903: garbled status messages could trick gpgme and + other parsers to accept faked status lines [boo#1201225] + * A number of bug fixes to the gpg command line interface + * gpgsm gained a number of new options and got some rework on + the PKCS#12 parser to support DFN issues keys + * The gpg agent got some added options and UI tweaks + * smart card support got a number of bug fixes, and improved + support for Technology Nexus cards and Yubikey + * The Telesec ESIGN application is now supported + +- added tpm support, added a new subpackage gpg2-tpm + +- GnuPG 2.3.6: + * Up to five times faster verification of detached signatures, + doubled detached signing speed, threefold decryption speedup + for large files, nearly double the AES256.OCB encryption speed + * Add support for GeNUA cards + * Added and improved options for crypto options, and all-around + bug fixes + +- GnuPG 2.3.4: + * gpg: New option --min-rsa-length + * gpg: New option --forbid-gen-key + * gpg: New option --override-compliance-check + * gpgconf: New command --show-configs + * agent,dirmngr,keyboxd: New option --steal-socket + * gpg: Fix printing of binary notations + * gpg: Remove stale ultimately trusted keys from the trustdb + * gpg: Fix indentation of --print-mds and --print-md sha512 + * gpg: Emit gpg 2.2 compatible Ed25519 signature + * gpgsm: Detect circular chains in --list-chain + * dirmngr: Make reading resolv.conf more robust + * dirmngr: Ask keyservers to provide the key fingerprints + * gpgconf: Allow changing gpg's deprecated keyserver option + * gpg-wks-server: Fix created file permissions + * scd: Support longer data for ssh-agent authentication with + openpgp cards + * scd: Modify DEVINFO behavior to support looping forever + * Silence warning about the rootdir under Unices w/o a mounted + /proc file system + * Fix possible build problems about missing include files + +- GnuPG 2.3.3: + * agent: Fix segv in GET_PASSPHRASE (regression) + * dirmngr: Fix Let's Encrypt certificate chain validation + * gpg: Change default and maximum AEAD chunk size to 4 MiB + * gpg: Print a warning when importing a bad cv25519 secret key + * gpg: Fix --list-packets for undecryptable AEAD packets + * gpg: Verify backsigs for v5 keys correctly + * keyboxd: Fix checksum computation for no UBID entry on disk + * keyboxd: Fix "invalid object" error with cv448 keys + * dirmngr: New option --ignore-cert + * agent: Fix calibrate_get_time use of clock_gettime + * Support a gpgconf.ctl file under Unix and use this for the + regression tests + +- GnuPG 2.3.2: + * gpg: Allow fingerprint based lookup with --locate-external-key. + * gpg: Allow decryption w/o public key but with correct card inserted. + * gpg: Auto import keys specified with --trusted-keys. + * gpg: Do not use import-clean for LDAP keyserver imports. + * gpg: Fix mailbox based search via AKL keyserver method. + * gpg: Fix memory corruption with --clearsign introduced with 2.3.1. + * gpg: Use a more descriptive prompt for symmetric decryption. + * gpg: Improve speed of secret key listing. + * gpg: Support keygrip search with traditional keyring. + * gpg: Let --fetch-key return an exit code on failure. + * gpg: Emit the NO_SECKEY status again for decryption. + * gpgsm: Support decryption of password based encryption (pwri). + * gpgsm: Support AES-GCM decryption. + * gpgsm: Let --dump-cert --show-cert also print an OpenPGP fingerprint. + * gpgsm: Fix finding of issuer in use-keyboxd mode. + * gpgsm: New option --ldapserver as an alias for --keyserver. + * agent: Use SHA-256 for SSH fingerprint by default. + * agent: Fix calling handle_pincache_put. + * agent: Fix importing protected secret key. + * agent: Fix a regression in agent_get_shadow_info_type. + * agent: Add translatable text for Caps Lock hint. + * agent: New option --pinentry-formatted-passphrase. + * agent: Add checkpin inquiry for pinentry. + * agent: New option --check-sym-passphrase-pattern. + * agent: Use the sysconfdir for a pattern file. + * agent: Make QT_QPA_PLATFORMTHEME=qt5ct work for the pinentry. + * dirmngr: LDAP search by a mailbox now ignores revoked keys. + * dirmngr: For KS_SEARCH return the fingerprint also with LDAP. + * dirmngr: Allow for non-URL specified ldap keyservers. + * dirmngr: New option --ldapserver. + * dirmngr: Fix regression in KS_GET for mail address pattern. + * card: New option --shadow for the list command. + * tests: Make sure the built keyboxd is used. + * scd: Fix computing shared secrets for 512 bit curves. + * scd: Fix unblock PIN by a Reset Code with KDF. + * scd: Fix PC/SC removed card problem. + * scd: Recover the partial match for PORTSTR for PC/SC. + * scd: Make sure to release the PC/SC context. + * scd: Fix zero-byte handling in ECC. + * scd: Fix serial number detection for Yubikey 5. + * scd: Add basic support for AET JCOP cards. + * scd: Detect external interference when --pcsc-shared is in use. + * scd: Fix access to the list of cards. + * gpgconf: Do not list a disabled tpm2d. + * gpgconf: Make runtime changes with different homedir work. + * keyboxd: Fix searching for exact mail adddress. + * keyboxd: Fix searching with multiple patterns. + * tools: Extend gpg-check-pattern. + * wkd: Fix client issue with leading or trailing spaces in user-ids. + * Pass XDG_SESSION_TYPE and QT_QPA_PLATFORM envvars to Pinentry. + * Change the default keyserver to keyserver.ubuntu.com. This is a + temporary change due to the shutdown of the SKS keyserver pools. + +- GnuPG 2.3.1: + * The new configuration file common.conf is now used to enable + the use of the key database daemon with "use-keyboxd". Using + this option in gpg.conf and gpgsm.conf is supported for a + transitional period. See doc/example/common.conf for more. + * gpg: Force version 5 key creation for ed448 and cv448 algorithms. + * gpg: By default do not use the self-sigs-only option when + importing from an LDAP keyserver. + * gpg: Lookup a missing public key of the active card via LDAP. + * gpgsm: New command --show-certs. + * scd: Fix CCID driver for SCM SPR332/SPR532. + * scd: Further improvements for PKCS#15 cards. + * New configure option --with-tss to allow the selection of the + TSS library. +- Rebase patches: + * gnupg-add_legacy_FIPS_mode_option.patch + * gnupg-allow-import-of-previously-known-keys-even-without-UIDs.patch + * gnupg-dont-fail-with-seahorse-agent.patch + * gnupg-set_umask_before_open_outfile.patch + +- GnuPG 2.3.0: + * A new experimental key database daemon is provided. To enable + it put "use-keyboxd" into gpg.conf and gpgsm.conf. Keys are stored + in a SQLite database and make key lookup much faster. + * New tool gpg-card as a flexible frontend for all types of + supported smartcards. + * New option --chuid for gpg, gpgsm, gpgconf, gpg-card, and + gpg-connect-agent. + * The gpg-wks-client tool is now installed under bin; a wrapper for + its old location at libexec is also installed. + * tpm2d: New daemon to physically bind keys to the local machine. + * gpg: Switch to ed25519/cv25519 as default public key algorithms. + * gpg: Verification results now depend on the --sender option and + the signer's UID subpacket. + * gpg: Do not use any 64-bit block size cipher algorithm for + encryption. Use AES as last resort cipher preference instead of + 3DES. This can be reverted using --allow-old-cipher-algos. + * gpg: Support AEAD encryption mode using OCB or EAX. + * gpg: Support v5 keys and signatures. + * gpg: Support curve X448 (ed448, cv448). + * gpg: Allow use of group names in key listings. + * gpg: New option --full-timestrings to print date and time. + * gpg: New option --force-sign-key. + * gpg: New option --no-auto-trust-new-key. + * gpg: The legacy key discovery method PKA is no longer supported. + The command --print-pka-records and the PKA related import and + export options have been removed. + * gpg: Support export of Ed448 Secure Shell keys. + * gpgsm: Add basic ECC support. + * gpgsm: Support creation of EdDSA certificates. [#4888] + * agent: Allow the use of "Label:" in a key file to customize the + pinentry prompt. + * agent: Support ssh-agent extensions for environment variables. + With a patched version of OpenSSH this avoids the need for the + "updatestartuptty" kludge. + * scd: Improve support for multiple card readers and tokens. + * scd: Support PIV cards. + * scd: Support for Rohde&Schwarz Cybersecurity cards. + * scd: Support Telesec Signature Cards v2.0 + * scd: Support multiple application on certain smartcard. + * scd: New option --application-priority. + * scd: New option --pcsc-shared; see man page for important notes. + * dirmngr: Support a gpgNtds parameter in LDAP keyserver URLs. + * The symcryptrun tool, a wrapper for the now obsolete external + Chiasmus tool, has been removed. + * Full Unicode support for the command line. +- dropped legacy commands: gpg-zip + +- Remove the "files-are-digests" option from the openSUSE package. + This feature was not upstream and only used in the OBS signing + daemon. The recommended upstream feature for separating the data + to be signed from the private keys is gpg agent forwarding, + available from 2.1. Drop gnupg-2.2.8-files-are-digests.patch -- Fix segv importing certain keys (e.g. ed25519). [bsc#1176034] -- Add gnupg-2.2.22-fix-segv-import-keys.patch - -- Fix warning: agent returned different signature type ssh-rsa - * The gpg-agent's ssh-agent does not handle flags in signing - requests properly [bsc#1161268, bsc#1172308] - * Add gnupg-gpg-agent-ssh-agent.patch - -- Security fix: [bsc#1157900, CVE-2019-14855, jsc#SLE-16534] - * Web of Trust forgeries using collisions in SHA-1 signatures - * Ignore all SHA-1 signatures in 3rd party key signatures. - * Forbid the creation of SHA-1 third-party key signatures. - * Add option --allow-weak-key-signatures -- Add gnupg-CVE-2019-14855.patch - -- Remove self-buildrequire [bsc#1152755] - -- Security fix: [bsc#1141093, CVE-2019-13050] - * Denial of service attacks via big keys - * Added patches: - - gnupg-CVE-2019-13050_0_of_5.patch - - gnupg-CVE-2019-13050_1_of_5.patch - - gnupg-CVE-2019-13050_2_of_5.patch - - gnupg-CVE-2019-13050_3_of_5.patch - - gnupg-CVE-2019-13050_4_of_5.patch - - gnupg-CVE-2019-13050_5_of_5.patch - -- Allow coredumps in X11 desktop sessions (bsc#1124847) - gpg-agent unconditionally disables coredumps, which is not - supposed to happen in the code path that does just exec(argv[]) - * Added gnupg-gpg-agent-ulimit.patch - +- Allow coredumps in X11 desktop sessions (bsc#1124847) + gpg-agent unconditionally disables coredumps, which is not + supposed to happen in the code path that does just exec(argv[]) + gnupg-gpg-agent-ulimit.patch + -- Security fix: [bsc#1120346, CVE-2018-1000858] - * Cross Site Request Forgery (CSRF) vulnerability in dirmngr that - can result in Attacker controlled CSRF. - * Added patches: - - gnupg-CRL-fetching-via-https.patch - - gnupg-Allow-redirection-from-https-to-http-for-CRLs.patch - - gnupg-CVE-2018-1000858.patch - -- Added gnupg-CVE-2018-12020.patch: Sanitize the diagnostic output of the - original file name in verbose mode (bsc#1096745, CVE-2018-12020). - gpgme -- Update to 1.16.0 in SLE-15-SP4: [jsc#SLE-20014, jsc#SLE-21114] - * Remove gpgme-test-json.patch fixed upstream +- Update to 1.23.0: + * Support GPGME_ENCRYPT_ALWAYS_TRUST also for S/MIME. [T6559] + * New keylist mode GPGME_KEYLIST_MODE_WITH_V5FPR. [T6705] + * New key capability flags has_*. [T6748] + * gpgme-tool: Support use of Windows HANDLE. [T6634] + * qt: Support refreshing keys via WKD. [T6672] + * qt: Handle cancel in changeexpiryjob. [T6754] + * Remove patches fixed upstream: + - gpgme-qt-tests-Fix-build-in-source-directory.patch + - gpgme-build-Suggest-out-of-source-build.patch + +- Use GCC 12 for building the Qt6 library on Leap 15. The + default compiler is too old. +- Use '%{without xxx}' rather than '!%{with xxx}' in spec file + +- Use GCC 12 for building the Qt6 library. The default compiler + is too old. +- Use '%{without xxx}' rather than '!%{with xxx}' in spec file + +- Fix builds with qt and qt6 [T6673]: + * qt,tests: Fix build in source directory. Include Qt binding + sources before C++ binding sources and C sources. This fixes + the problem that the debug.h in the C sources was found before + the one in the Qt bindings. + * build: Suggest out-of-source build. Suggest to run configure + from a build subdirectory. + * Add patches: + - gpgme-qt-tests-Fix-build-in-source-directory.patch + - gpgme-build-Suggest-out-of-source-build.patch + +- Update to 1.22.0: + * Prevent wrong plaintext when verifying clearsigned signature. + * Return bad data error instead of general error on unexpected data. + * Take care of offline mode for all operations of gpgsm engine. + * Prepare the use of the forthcoming libassuan version 3. + * New configure option --with-libtool-modification. + * cpp: Expose gpgme_decrypt_result_t.is_mime. + * qt: Clean up after failure or cancel of sign/encrypt archive operation. + * qt: Add setInputEncoding to QGpgMe::EncryptJob. + * qt: Make toLogString helper public. + * Interface changes relative to the 1.21.0 release: + - qt: EncryptJob::setInputEncoding NEW. + - qt: DecryptionResult::isMime NEW. + - qt: toLogString NEW. + +- Run testsuite in qemu build + +- Update to 1.21.0 + * Extended gpgme_op_encrypt, gpgme_op_encrypt_sign, and gpgme_op_sign + to allow writing the output directly to a file. [T6530] + * Extended gpgme_op_decrypt and gpgme_op_verify to allow reading the + input data directly from files. [T6530] + * For key signing and uid revoking allow an empty user id. [rMfbc3963d62] + * Pass an input-size-hint also to the gpgsm engine. [T6534] + * qt: Allow writing the created archives directly to a file. [T6530] + * qt: Allow reading the signed/encrypted archive to decrypt + or verify directly from a file. [T6530] + * qt: Qt Jobs working with QIODeviceDataProvider now properly + handle input-size hints and progress for files larger. + 2^32 bytes in 32 bit builds. [T6534] + * cpp: Error::isCanceled now also returns true for error code + GPG_ERR_FULLY_CANCELED. [T6510] + * python: Fix wrong use of write. [T6501] + * Interface changes relative to the 1.20.0 release: + - cpp: Data::setFlag NEW. + - cpp: Data::setSizeHint NEW. + - qt: Job::startIt NEW. + - qt: DecryptVerifyArchiveJob::setInputFile NEW. + - qt: DecryptVerifyArchiveJob::inputFile NEW. + - qt: EncryptArchiveJob::setRecipients NEW. + - qt: EncryptArchiveJob::recipients NEW. + - qt: EncryptArchiveJob::setInputPaths NEW. + - qt: EncryptArchiveJob::inputPaths NEW. + - qt: EncryptArchiveJob::setOutputFile NEW. + - qt: EncryptArchiveJob::outputFile NEW. + - qt: EncryptArchiveJob::setEncryptionFlags NEW. + - qt: EncryptArchiveJob::encryptionFlags NEW. + - qt: SignArchiveJob::setSigners NEW. + - qt: SignArchiveJob::signers NEW. + - qt: SignArchiveJob::setInputPaths NEW. + - qt: SignArchiveJob::inputPaths NEW. + - qt: SignArchiveJob::setOutputFile NEW. + - qt: SignArchiveJob::outputFile NEW. + - qt: SignEncryptArchiveJob::setSigners NEW. + - qt: SignEncryptArchiveJob::signers NEW. + - qt: SignEncryptArchiveJob::setRecipients NEW. + - qt: SignEncryptArchiveJob::recipients NEW. + - qt: SignEncryptArchiveJob::setInputPaths NEW. + - qt: SignEncryptArchiveJob::inputPaths NEW. + - qt: SignEncryptArchiveJob::setOutputFile NEW. + - qt: SignEncryptArchiveJob::outputFile NEW. + - qt: SignEncryptArchiveJob::setEncryptionFlags NEW. + - qt: SignEncryptArchiveJob::encryptionFlags NEW. + +- Update to 1.20.0: + * On Windows, the gettext functions provided by gpgrt are switched + into utf8 mode, so that all localized texts returned by GpgME or + gpgrt, e.g. the texts for error codes are now UTF-8 encoded. [T5960] + * Key::canSign now returns false for OpenPGP keys without signing + (sub)key. [T6456] + * The new macOS Homebrew location is now by default supported. [T6440] + * Fix regression in 1.19.0. + * Fix invocation of gpgtar on Windows. + * Interface changes relative to the 1.19.0 release: + - gpgme_subkey_t EXTENDED: New field 'can_renc'. + - gpgme_subkey_t EXTENDED: New field 'can_timestamp'. + - gpgme_subkey_t EXTENDED: New field 'is_group_owned'. + - cpp: Subkey::canRenc NEW. + - cpp: Subkey::canTimestamp NEW. + - cpp: Subkey::isGroupOwned NEW. + - cpp: Key::canReallySign DEPRECATED. + * Release-info: https://dev.gnupg.org/T6463 + +- Add a Qt6 flavor to build Qt6 bindings +- Use %ldconfig_scriptlets + +- Update to 1.19.0: + * New context flag "no-auto-check-trustdb". [T6261] + * Optionally, build QGpgME for Qt 6 + * Support component "gpgtar-name" in gpgme_get_dirinfo. [T6342] + * Extended gpgme_op_encrypt*, gpgme_op_encrypt_sign*, and + gpgme_op_sign* to allow creating an encrypted and/or signed + archive. [T6342] + * Extended gpgme_op_decrypt*, gpgme_op_decrypt_verify*, + and gpgme_op_verify* to allow extracting an encrypted and/or + signed archive. [T6342] + * cpp: Handle error when trying to sign expired keys. [T6155] + * cpp: Support encryption flags ThrowKeyIds, EncryptWrap, and + WantAddress. [T6359] + * cpp, qt: Fix building with C++11. [T6141] + * qt: Fix problem with expiration dates after 2038-01-19 on 32-bit + systems when adding an existing subkey to another key. [T6137] + * cpp: Allow setting the curve to use when generating ECC keys + for smart cards. [T4429] + * qt: Extend ListAllKeysJob to allow disabling the automatic + trust database check when listing all keys. [T6261] + * qt: Allow deferred start of import jobs. [T6323] + * qt: Support creating and extracting signed and encrypted + archives. [T6342] + * Rebase gpgme-suse-nobetasuffix.patch + * Remove patches upstream: + - gpgme-D546-python310.patch + - gpgme-1.18.0-T6137-qt_test.patch + - python311.patch + +- drop python2 subpackage handling. we do not support python 2.x + anymore, and if we would it would happen via singlespec + +- Update upstream keyring: https://gnupg.org/signature_key.asc + +- add python311.patch to build language bindings for python 3.11 + +- Add gpgme-suse-nobetasuffix.patch + * remove "-unknown" suffix from version string + * boo#1205197 + +- gpgme 1.18.0 + * New keylist mode to force refresh via external methods + * The keylist operations now create an import result to report the + result of the locate keylist modes + * core: Return BAD_PASSPHRASE error code on symmetric decryption + failure + * cpp, qt: Do not export internal symbols anymore + * cpp, qt: Support revocation of own OpenPGP keys + * qt: The file name of (signed and) encrypted data can now be set + * cpp, qt: Support setting the primary user ID + * python: Fix segv(NULL) when inspecting contect after exeception +- includes changes from version 1.17.1: + * qt: Fix a bug in the ABI compatibility of 1.17.0 +- includes changes from 1.17.0: + * New context flag "key-origin" + * New context flag "import-filter" + * New export mode to export secret subkeys + * Detect errors during the export of secret keys + * New function gpgme_op_receive_keys to import keys from a keyserver + without first running a key listing + * Detect bad passphrase error in certificate import + * Allow setting --key-origin when importing keys + * Support components "keyboxd", "gpg-agent", "scdaemon", "dirmngr", + "pinentry", and "socketdir" in gpgme_get_dirinfo + * Under Unix use poll(2) instead of select(2), when available. + * Fix results returned by gpgme_data_* functions + * Support closefrom also for glibc + (drop upstream gpgme-use-glibc-closefrom.patch + * cpp,qt: Add support for export of secret keys and secret subkeys. + * cpp,qt: Support for adding existing subkeys to other keys + * qt: Extend ChangeExpiryJob to change expiration of primary key + and of subkeys at the same time + * qt: Support WKD lookup without implicit import + * qt: Allow specifying an import filter when importing keys + * qt: Allow retrieving the default value of a config entry +- drop patches included upstream + * gpgme-1.16.0-Use-after-free-in-t-edit-sign-test.patch + * gpgme-1.16.0-t-various-testSignKeyWithExpiration-32-bit.patch +- add patches to fix tests: + * gpgme-1.18.0-T6137-qt_test.patch + +- Add patches to support building bindings packages for + Python 3.10 + * gpgme-D545-python310.patch -- https://dev.gnupg.org/D545 + * gpgme-D546-python310.patch -- https://dev.gnupg.org/D546 -- Fix t-json test in SP3: https://dev.gnupg.org/T4820 [bsc#1183801] - * tests/json: Bravo key does not have secret key material - * tests/json: Do not check for keygrip of pubkeys - * core: Make sure the keygrip is available in WITH_SECRET mode -- Add gpgme-test-json.patch - gstreamer-plugins-bad +- Add gstreamer-plugins-bad-CVE-2023-44429.patch: + Backporting 1db83d3f from upstream, Clip tile rows and cols to 64 + as describe in AV1 specification. + (CVE-2023-44429 bsc#1217211) + - from upstream to fix a heap overwrite in PGS subtitle - overlay decoder which might trigger a crash or remote code - execution (CVE-2023-37329 bsc#1213126). + Backport 7ed446dc,0dabf0eb from upstream to fix a heap overwrite + in PGS subtitle overlay decoder which might trigger a crash or + remote code execution (CVE-2023-37329 bsc#1213126). -- Add patch to support building with srt 1.3.4 in SLE - * fix-build-with-srt-1.3.4.patch +- Add fix-build-with-srt-1.3.4.patch: + To support building with srt 1.3.4 in SLE. +- Update to version 1.16.3 (bsc#1181255 CVE-2021-3185): + - amcvideodec: fix sync meta copying not taking a reference + - audiobuffersplit: Perform discont tracking on running time + - audiobuffersplit: Specify in the template caps that only interleaved audio is supported + - audiobuffersplit: Unset DISCONT flag if not discontinuous + - autoconvert: Fix lock-less exchange or free condition + - autoconvert: fix compiler warnings with g_atomic on recent GLib versions + - avfvideosrc: element requests camera permissions even with capture-screen property is true + - codecparsers: h264parser: guard against ref_pic_markings overflow + - dtlsconnection: Avoid segmentation fault when no srtp capabilities are negotiated + - dtls/connection: fix EOF handling with openssl 1.1.1e + - fdkaacdec: add support for mpegversion=2 + - hls: Check nettle version to ensure AES128 support + - ipcpipeline: Rework compiler checks + - interlace: Increment phase_index before checking if we're at the end of the phase + - lv2: Make it build with -fno-common + - h264parser: Do not allocate too large size of memory for registered user data SEI + - ladspa: fix unbounded integer properties + - modplug: avoid division by zero + - msdkdec: Fix GstMsdkContext leak + - msdkenc: fix leaks on windows + - musepackdec: Don't fail all queries if no sample rate is known yet + - openslessink: Allow openslessink to handle 48kHz streams. + - opencv: allow compilation against 4.2.x + - proxysink: event_function needs to handle the event when it is disconnecetd from proxysrc + - vulkan: Drop use of VK_RESULT_BEGIN_RANGE + - wasapi: added missing lock release in case of error in gst_wasapi_xxx_reset + - wasapi: Fix possible deadlock while downwards state change + - waylandsink: Clear window when pipeline is stopped + - webrtc: Support non-trickle ICE candidates in the SDP + - webrtc: Unmap all non-binary buffers received via the datachannel + - meson: build with neon 0.31 +- Drop upstream fixed patch: gstreamer-h264parser-fix-overflow.patch + +- Drop gstreamer-plugins-bad-patch-source.sh +- Drop pre_checkin.sh haveged +- Remove haveged-switch-root.service because it's implemented incorrectly and + neither upstream don't know how to fix it (#77). On the other hand, without + this service haveged will be started from scratch after switch root so it's + hopefully no big deal. Also remove patch for bsc#1203079 as it's considered + as a security threat because of creating fixed name file in world-writable + directory. [jsc#PED-6184, bsc#1206699] + * Remove + - haveged-switch-root.service + - haveged-switch-root.patch + icu73_2 +- icu4c-73_c-ICU-22512-Fix-broken-TestHebrewCalendarInTemporalLeapYear.patch + Fix testsuite issue in hebrew calendar (bsc#1217479) + jbigkit +- security update +- added patches + fix CVE-2022-1210 [bsc#1198146], Malicious file leads to a denial of service in TIFF File Handler + + jbigkit-CVE-2022-1210.patch + kernel-firmware +- Update to version 20231214 (git commit b80907ec3a81): + * qcom: Add Audio firmware for SM8650 QRD + * qcom: Add Audio firmware for SM8550 QRD + * Add rdfind for deb/rpm build jobs + * wfx: update to firmware 3.17 + * wfx: fix broken firmware + +- Update to version 20231205 (git commit bfc33c1e308e): + * linux-firmware: Update AMD cpu microcode + * cxgb4: Update firmware to revision 1.27.5.0 + * linux-firmware: add firmware for en8811h 2.5G ethernet phy + * s5p-mfc: Add MFC v12 Firmware + * qcom: update qrb4210 firmware + * qcom: update qcm2290 firmware + * qcom: update qcm2290/qrb4210 WiFi firmware file + * qcom: update Venus firmware file for v6.0 + +- Update to version 20231128 (git commit d9f6088f7e91): + * Add a COPYOPTS variable + * rtl_bt: Update RTL8852A BT USB firmware to 0xDFC8_145F + +- Update to version 20231127 (git commit 4124f8f928d5): + * Make rdfind optional + * ice: update ice DDP wireless_edge package to 1.3.13.0 + * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) + * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) + * linux-firmware: update firmware for MT7922 WiFi device + * linux-firmware: update firmware for MT7921 WiFi device + * Makefile, copy-firmware: Use portable "command -v" to detect installed programs + * amdgpu: update DMCUB firmware to 0.0.194.0 for DCN321 and DCN32 + * powervr: add firmware for Imagination Technologies AXE-1-16M GPU + * ice: update ice DDP comms package to 1.3.45.0 + * ice: update ice DDP package to 1.3.35.0 + * mediatek: Remove an unused packed library + * amdgpu: update DMCUB firmware to 0.0.193.0 for DCN31 and DCN314 +- Drop obsoleted copy-file-skip-rdfind.patch; use --ignore-duplicates + +- Update to version 20231120 (git commit 9552083a783e): + * mediatek: Sync shared memory structure changes + * Intel Bluetooth: Update firmware file for Intel Bluetooth BE200 + * i915: Update MTL DMC to v2.19 + * Make email replies more resilient + * Try both utf-8 and windows-1252 for decoding email + +- Update to version 20231116 (git commit 6723a8d90923): + * iwlwifi: fix for the new FWs from core83-55 release + * Enable deb and rpm builds on tags + * linux-firmware: Add firmware for Cirrus CS35L41 on HP G11 Laptops + * linux-firmware: Add firmware for Cirrus CS35L41 on 2024 ASUS Zenbook Laptops + +- Update to version 20231115 (git commit a07fd0b96b5a): + * iwlwifi: add new FWs from core83-55 release + * iwlwifi: update cc/Qu/QuZ firmwares for core83-55 release + * Add a workaround for gitlab.freedesktop.org pull requests + * Add extra debugging output when processing pull requests + * Process pull requets directly from mbox + * linux-firmware: add firmware for mt7988 internal 2.5G ethernet phy + * Intel Bluetooth: Update firmware file for Magnetor Intel Bluetooth AX101 + * Intel Bluetooth: Update firmware file for Magnetor Intel Bluetooth AX203 + * Intel Bluetooth: Update firmware file for Magnetor Intel Bluetooth AX211 + * Intel Bluetooth: Update firmware file for SolarF Intel Bluetooth AX101 + * Intel Bluetooth: Update firmware file for Solar Intel Bluetooth AX101 + * Intel Bluetooth: Update firmware file for SolarF Intel Bluetooth AX203 + * Intel Bluetooth: Update firmware file for Solar Intel Bluetooth AX203 + * Intel Bluetooth: Update firmware file for SolarF Intel Bluetooth AX211 + * Intel Bluetooth: Update firmware file for Solar Intel Bluetooth AX211 + * Intel Bluetooth: Update firmware file for Solar Intel Bluetooth AX210 + +- Update to version 20231110 (git commit 74158e7ac86d): + * amdgpu: DMCUB updates for various AMDGPU ASICs + * Ensure rdfind is installed + * Add checks for destination directory being specified + * Fix symlink creation for some files + * Fix classification of some pull requests + * nvidia: add GSP-RM version 535.113.01 firmware images +- Skip rdfind (not included in our distro as default): + copy-file-skip-rdfind.patch +- Fix make-files.sh to handle symlinked directories + -- Update to version 20231019 (git commit d983107a2dfa): +- Update to version 20231019 (git commit d983107a2dfa) + (bsc#1215823, CVE-2023-20592): + (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, + CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, + CVE-2023-20526, CVE-2023-20533, CVE-2023-20566): krb5 +- Update patch 0007-SELinux-integration.patch for SELinux 3.5 + libgpg-error +- Do not pull revision info from GIT when autoconf is run. This + removes the -unknown suffix after the version number. + * Add libgpg-error-nobetasuffix.patch [bsc#1216334] + +- Update to 1.47: + * New error codes for PUKs and reset codes. [T6421] + * Avoid segv in logging with improper use of the "socket://". + * Fixed translation of argparse's internal option --help. + * Interface changes relative to the 1.46 release: + - GPG_ERR_SOURCE_TKD NEW. + - GPG_ERR_BAD_PUK NEW. + - GPG_ERR_NO_RESET_CODE NEW. + - GPG_ERR_BAD_RESET_CODE NEW. + - GPGRT_SPAWN_KEEP_STDIN NEW. + - GPGRT_SPAWN_KEEP_STDOUT NEW. + - GPGRT_SPAWN_KEEP_STDERR NEW. + - GPGRT_SPAWN_INHERIT_FILE NEW. + * Release-info: https://dev.gnupg.org/T6231 + +- Update to 1.46: + * Support for bidirectional pipes under Windows. + * REG_DWORD types are now support in the Windows Registry. + * Added ES_SYSHD_SOCK support for gpgrt_sysopen under Windows. + * Fixed gpgrt_log_get_fd for the file case. + * Avoids header problem with C11 and "noreturn". + * The gpg-error-config command is not installed by default, because + it is now replaced by use of pkg-config/gpgrt-config with + gpg-error.pc. Supply --enable-install-gpg-error-config configure + option, if it's really needed. + * Fixed support of posix-lock for FreeBSD. + * Build fixes for some Mingw tool chain versions. + * Removed remaining support for WindowsCE. + * Updated config.guess, config.sub, and config.rpath. + * gpg-error-config is now only installed when enabled. + * System paths are now stripped from --cflags --and --libs. + +- update to 1.45: + * gpgrt_access and gpgrt_mkdir now support file names longer than + MAX_PATH + +- Update to 1.44: + * Fix dependency to gpg-error-config-test.sh. + * Run the posix locking test only on supported platforms. + * Detect Linux systems using musl. + * Fix gpg-error-config-test for PKG_CONFIG_LIBDIR. + * Fix returning of option attributes for options with args. + * Add Turkish translations. + +- Update to 1.43: + * Fix for building against GNU libc 2.34. + * Fix gpgrt-config problems. + * Fix gpgrt_free for legacy platforms. + * Fix truncation of error message in the middle of a character. + * Fix the --disable-threads configure options. + * Improve lock-obj generation for cross-builds. + * Improve cross-builds. + * Improve gpgrt_wait_processes. + libksba -- Security fix: [bsc#1206579, CVE-2022-47629] - * Integer overflow in the CRL signature parser. - * Add libksba-CVE-2022-47629.patch - -- Security fix: [bsc#1204357, CVE-2022-3515] - * Detect a possible overflow directly in the TLV parser. - * Add libksba-CVE-2022-3515.patch +- Do not pull revision info from GIT when autoconf is run. This + removes the -unknown suffix after the version number. + * Run autoreconf for the added patch and add the build + dependecies on autoconf, automake and libtool. + * Add libksba-nobetasuffix.patch [bsc#1216334] + +- Update to 1.6.4: + * Correctly detect CMS write errors. [rK9ced7706f2] + * Release-info: https://dev.gnupg.org/T6543 + +- update to 1.6.3 (bsc#1206579, CVE-2022-47629): + * Fix another integer overflow in the CRL parser. + Release-info: https://dev.gnupg.org/T6304 + +- libksba 1.6.2: [bsc#1204357, CVE-2022-3515] + * Fix integer overflow in the CRL parser. + +- libksba 1.6.1: + * Allow an OCSP server not to return the sent nonce +- fix rpmlint warnings + +- libksba 1.6.0: + * Limited support for the Authenticated-Enveloped-Data + content type. + * Support password based decryption. + * Silence warnings from static analyzers. + * Interface changes relative to the 1.5.0 release: + - KSBA_CT_AUTHENVELOPED_DATA NEW. + +- libksba 1.5.1: + * Support Brainpool curves specified by ECDomainParameters + +- libksba 1.5.0: + * ksba_cms_identify now identifies OpenPGP keyblock content + * Supports TR-03111 plain format ECDSA signature verification + * Fixes a CMS signed data parser bug exhibited by a somewhat + strange CMS message +- remove deprecated texinfo macros and update signing keyring + +- libksba 1.4.0: + * Supports ECDSA and EdDSA certificate creation and parsing. + * Supports ECDH enveloped data. + * Supports ECDSA and EdDSA signed data. + * Supports rsaPSS signature verification. + * Supports standard file descriptors in ksba_reader_read. + * Allows for optional elements in keyinfo objects. + * Fixes error detection in the CMS parser. + * Fixes memory leak in ksba_cms_identify. + * New constants KSBA_VERSION and KSBA_VERSION_NUMBER. + * New API to make creation of DER objects easy. + * Interface changes relative to the 1.3.5 release: + KSBA_VERSION NEW. + KSBA_VERSION_NUMBER NEW. + KSBA_CT_SPC_IND_DATA_CTX NEW. + KSBA_CLASS_* NEW. + KSBA_TYPE_* NEW. + ksba_der_t NEW. + ksba_der_release NEW. + ksba_der_builder_new NEW. + ksba_der_builder_reset NEW. + ksba_der_add_ptr NEW. + ksba_der_add_val NEW. + ksba_der_add_int NEW. + ksba_der_add_oid NEW. + ksba_der_add_bts NEW. + ksba_der_add_der NEW. + ksba_der_add_tag NEW. + ksba_der_add_end NEW. + ksba_der_builder_get NEW. -- libksba 1.3.1: - * Fixed memory leak in CRL parsing - * Build fixes for ppc64el - -- Use URL for source - libnvme +- Update to version 1.6+5.g68c6ffb: + * avoid stack corruption by unaligned DMA to user space buffers + (bsc#1216344, gh#linux-nvme/libnvme#727) + libpwquality +- Update to version 1.4.5: + + Minor bug fixes and documentation enhancements. + + Updated translations. + libqt5-qtbase +- buildrequire pkconfig(icu-i18n) instead of libicu-devel to get + prefered libicuu + +- Add patch from upstream that fixes a buffer overflow in + QXmlStreamReader (bsc#1214327, CVE-2023-37369): + * CVE-2023-37369-qtbase-5.15.diff + libraw -- security update -- added patches - fix CVE-2021-32142 [bsc#1208470], Buffer Overflow in the LibRaw_buffer_datastream:gets function - + libraw-CVE-2021-32142.patch +- update to 0.21.1: + * fixed typo in panasonic metadata parser + * Multiple fixes inspired by oss-fuzz project + * Phase One/Leaf IIQ-S v2 support + * Canon CR3 filmrolls + * Canon CRM (movie) files + * Tiled bit-packed (and 16-bit unpacked) DNGs + * (non-standard) Deflate-compressed integer DNG files are allowed + * Canon EOS R3, R7 and R10 + * Fujifilm X-H2S, X-T30 II + * OM System OM-1 + * Leica M11 + * Sony A7-IV (ILCE-7M4) + * DJI Mavic 3 + * Nikon Z9: standard compression formats only + +- Update to 0.21.0: + * Camera format support: + + Phase One/Leaf IIQ-S v2 support + + Canon CR3 filmrolls/RawBurst + + Canon CRM (movie) files + + Tiled bit-packed (and 16-bit unpacked) DNGs + + (non-standard) Deflate-compressed integer DNG files are allowed + * Camera support: + + Canon EOS R3, R7 and R10 + + Fujifilm X-H2S, X-T30 II + + OM System OM-1 + + Leica M11 + + Sony A7-IV (ILCE-7M4) + + DJI Mavic 3 + + Nikon Z9: standard compression formats only + * Multiple (resultion) thumbnails support + * Misc: + + Nikon makernotes: read NEFCompression tag for HE/HE* files + + Nikon orientation tag: more fixed offsets for known cameras + + Adobe DNG SDK 1.6 support (meaning, just an additional patch for GPR SDK) + * Bugs fixed: + + Fixed possible out-of-buffer read in Nikon orientation tag parser + + Out-of-range read-only array access in postprocessing if output_color is set to 0 (raw color) + + Minolta Z2 was not recognized correctly on 32-bit systems + + Fixed possible buffer overflow in Kodak C330 decoder + + dcraw_process(): check for buffer allocation results to avoid NULL deref + + Multiple bugfixes inspired by oss-fuzz project - CVE-2018-5819 + CVE-2018-5819,CVE-2021-32142 - bsc#1120515,bsc#1120516,bsc#1120517,bsc#1120519) + bsc#1120515,bsc#1120516,bsc#1120517,bsc#1120519,bsc#1208470) libselinux +- Repair initrd libselinux check in selinux-ready + +- Do not BuildRequire swig and ruby-devel in the main build phase: + those are only needed for the bindings. + +- (bsc#1212618) Divide libselinux and libselinux-bindings again. + libselinux itself is in Ring0 so it has to have absolutely + minimal dependencies, so it is better to separate + libselinux-bindings into a separate pacakge. + +- Fix python packaging by setting the name to a fixed value + +- Remove separate libselinux-bindings SPEC file (bsc#1212618). + +- Add explicit BuildRequires for python3-pip and python3-wheel on + 15.5, currently the macros don't do the right thing + +- allow building this with different python versions, to make this + usable for the new sle15 macro (using python3.11) + +- Add python-wheel build dependency to build correctly with latest + python-pip version. + +- Add _multibuild to define additional spec files as additional + flavors. + Eliminates the need for source package links in OBS. + +- Add -ffat-lto-objects to CFLAGS to prevent rpmlint errors because + of LTO + +- Enable LTO as it works fine now. + +- Update to version 3.5: + * check for truncations + * avoid newline in avc message + * bail out on path truncations + * add getpidprevcon to gather the previous context before the last + exec of a given process + * Workaround for heap overhead of pcre + * fix memory leaks on the audit2why module init + * ignore invalid class name lookup +- Drop restorecon_pin_file.patch, is upstream +- Refreshed python3.8-compat.patch +- Added additional developer key (Jason Zaman) + +- Fixed initrd check in selinux-ready (bnc#1186127) + +- Added restorecon_pin_file.patch. Fixes issus when running + fixfiles/restorecon + +- Update to version 3.4: + * Use PCRE2 by default + * Make selinux_log() and is_context_customizable() thread-safe + * Prevent leakeing file descriptors + * Correctly hash specfiles larger than 4G +- Refreshed skip_cycles.patch + +- Add Requires for exact libselinux1 version for selinux-tools +- Simplyfied check for correct boot paramaters in selinux-ready + (bsc#1195361) + +- Update to version 3.3: + * Lots of smaller issues fixed found by fuzzing + +- Add missing libselinux-utils Provides to selinux-tools so that + %selinux_requires works + +- Remove Recommends for selinux-autorelabel. It's better to have this + in the policy package itself (bsc#1181837) + +- Switch to pcre2: + + Replace pcre-devel BuildRequires with pkgconfig(libpcre2-8) + + Pass USE_PCRE2=y to make. + + Replace pkgconfig(libpcre) Requires in -devel static with + pkgconfig(libpcre2-8). + +- Update to version 3.2: + * Use mmap()'ed kernel status page instead of netlink by default. + See "KERNEL STATUS PAGE" section in avc_init(3) for more details. + * New log callback levels for enforcing and policy load notices - + SELINUX_POLICYLOAD, SELINUX_SETENFORCE + * Changed userspace AVC setenforce and policy load messages to audit + format. + +- Add Recommends: selinux-autorelabel, which is very important + for healthy use of the SELinux on the system (/.autorelabel + mechanism) (bsc#1181837). + +- install to /usr (boo#1029961) + + * Refreshed python3.8-compat.patch +- Added swig4_moduleimport.patch to prevent import errors due to + SWIG 4 + +- Add python3.8-compat.patch which makes build possible even with + Python 3.8, which doesn’t automatically adds -lpython + +- Disable LTO (boo#1133244). + +- Updated spec file to use python3. Added python3.patch to fix + build + +- Update libselinux-2.2-ruby.patch: use RbConfig instead of + deprecated Config. + libsemanage +- Remove build counter syncing for real + +- Add _multibuild to define additional spec files as additional + flavors. + Eliminates the need for source package links in OBS. + +- Add -ffat-lto-objects to CFLAGS to prevent rpmlint errors because + of LTO + +- Enable LTO now (boo#1138812). + +- Update to version 3.5 + * Allow user to set SYSCONFDIR + * always write kernel policy when check_ext_changes is specified +- Added additional developer key (Jason Zaman) + +- Update to version 3.4 + * Optionally rebuild policy when modules are changed externally + * Fix USE_AFTER_FREE (CWE-672) in semanage_direct_get_module_info() + * Allow spaces in user/group names + +- Drop Buildrequires for libustr-devel, not needed anymore + +- Update to version 3.3 + * Fixed use-after-free in parse_module_store() + * Fixed use_after_free in semanage_direct_write_langext() + +- Link to correct so version +- Minor spec file cleanups + +- Move configuration file to separate libsemanage-conf package to allow + for parallel installation in future versions + +- Update to version 3.2 + * dropped old and deprecated symbols and functions + libsemanage version was bumped to libsemanage.so.2 + * libsemanage tries to sync data to prevent empty files in SELinux module + store + libsepol +- Enable LTO now (boo#1138813). + +- Update to version 3.5 + * Stricter policy validation + * do not write empty class definitions to allow simpler round-trip tests + * reject attributes in type av rules for kernel policies +- Added additional developer key (Jason Zaman) + +- Update to version 3.4 + * Add 'ioctl_skip_cloexec' policy capability + * Add sepol_av_perm_to_string + * Add policy utilities + * Support IPv4/IPv6 address embedding + * Hardened/added many validations + * Add support for file types in writing out policy.conf + * Allow optional file type in genfscon rules + +- Update to version 3.3 + * Dropped CVE-2021-36085.patch, CVE-2021-36086.patch, CVE-2021-36087.patch + are all included + * Lot of smaller fixes identified by fuzzing + +- Fix heap-based buffer over-read in ebitmap_match_any (CVE-2021-36087, 1187928. + Added CVE-2021-36087.patch + +- Fix use-after-free in __cil_verify_classperms (CVE-2021-36085, 1187965). + Added CVE-2021-36085.patch +- Fix use-after-free in cil_reset_classpermission (CVE-2021-36086, 1187964). + Added CVE-2021-36086.patch + +- Update to version 3.2 + * more space-efficient form of storing filename transitions in the binary + policy and reduced the size of the binary policy + * dropped old and deprecated symbols and functions. Version was bumped to + libsepol.so.2 + +- install to /usr (boo#1029961) + libssh2_org +- Security fix: [bsc#1218127, CVE-2023-48795] + * Add 'strict KEX' to fix CVE-2023-48795 "Terrapin Attack" + * Add libssh2_org-CVE-2023-48795.patch + libstorage-ng +- merge gh#openSUSE/libstorage-ng#968 +- make more use of new SystemCmd interface +- 4.5.161 + +- merge gh#openSUSE/libstorage-ng#967 +- block more udev by-id links (bsc#1217459) +- adapted testsuite +- 4.5.160 + +- Translated using Weblate (Portuguese (Brazil)) (bsc#1149754) +- 4.5.159 + +- merge gh#openSUSE/libstorage-ng#966 +- fixed build with libxml 2.12.0 +- 4.5.158 + +- merge gh#openSUSE/libstorage-ng#965 +- refactored class SystemCmd +- fixed passing huge amount of data to stdin +- coding style +- 4.5.157 + +- merge gh#openSUSE/libstorage-ng#964 +- extended testsuite +- 4.5.156 + +- merge gh#openSUSE/libstorage-ng#963 +- extended testsuite +- 4.5.155 + +- merge gh#openSUSE/libstorage-ng#962 +- improved error reporting in SystemCmd +- 4.5.154 + +- merge gh#openSUSE/libstorage-ng#961 +- added testcase +- 4.5.153 + +- merge gh#openSUSE/libstorage-ng#960 +- make more use of new SystemCmd interface +- added const +- 4.5.152 + +- merge gh#openSUSE/libstorage-ng#959 +- removed unused function + +- merge gh#openSUSE/libstorage-ng#958 +- make more use of new SystemCmd interface +- prefer make_unique over new +- fixed compound action generation for removing btrfs qgroup + relations + libtirpc +- fix sed parsing for libtirpc.pc.in in specfile (boo#1216862) + lsof +- lsof 4.99.0: + * Do not hard-code fd numbers in epoll test + * --with-selinux configure option. + * Improve performance by using closefrom() + * Introduce liblsof for programmatic access over spawning lsof + in a subprocess +- build with libtirpc +- switch to upstream tarball again as it dropped proprietary code + +- Repacked tarball to remove proprietary code in dialects/uw/uw7/sys/fs + +- lsof 4.98.0: + * Fix two potential null pointer access bug when gethostbyname2() + returns an empty address list + * Fix handling of empty command name + * Add -H switch to print human readable size, e.g. 123.4K + +- update to 4.97.0: + * Remove support because the os is no longer updated for + more than 10 years + * Remove support because the os is no longer updated + for more than 20 years + * Add experimental build system based on Autotools + * Fixed LTsock testing on darwin + * Remove NEW and OLD folders + * Fix FreeBSD testcases + * Rewrite documentation and publish at https://lsof.readthedocs.io/ + +- update to 4.96.5: + * Avoid C89-only constructs is Configure +- drop format.patch, now upstream + +- format.patch: Use correct scanf/printf format for uint64_t +- Build with %{optflags} + +- update to 4.96.4 + * fix hash functions used for finding local tcp/udp IPCs + * Show copyright notice in --version output. + * Avoid some easy collissions for udp/udp6 sockets when hashing + * Changing the number of ipcbuckets to 4096 + * obtain correct information of memory-mapped file. +- drop remove-hostname.patch now upstream + +- Update remove-hostname.patch with the upstream version + +- Fix hostname in reproducible builds, bsc#1199709 + * remove-hostname.patch + +- update to 4.95.0: + * Update perl scripts for the past few decades of progress + * Drop LSOF_CCDATE across all dialects to ensure reproducible builds + * Fix FD field description. + * Adjust alignment of buffer passed to stat(). + * Clean up source code and documents. + - remove trailing whitespace, + - fix some issues in scripts found through shellcheck, and + - fix spelling + * man page: fix hyphen issues + * Fix broken LSOF_CFLAGS_OVERRIDE. + * [linux] Remove sysvlegacy function. + * [linux] use close_range instead of calling close repeatedly + * Add -Q option for adjusting exit status when failed to find a + search item (#129) +- drop lsof-no-build-date-etc.patch (obsolete) + +- Update to 4.94.0: + * Fix various bugs + * Display more information for eventfd and other objects +- Remove lsof-glibc-linux-5.0.patch as it has been fixed upstream +- Remove lsof_4.81-include.patch as it is not needed anymore +- Remove lsof_4.81-perl.patch as this change is now done inside the spec file +- Remove lsof_4.81-fmt.patch as it is not needed anymore + +- update to 4.93.2: + The maintainership is switched from Vic to lsof-org + Made FreeBSD 13 adjustment. + Fix a typo causing a build error. + Fix a potential memory leak. + [linux] use tirpc for rpc if libc doesn't provide rpc.h. + Fix a typo in man page. + fix memory leaks detected by valgrind about unix endpoint + information. + Update the description about -fg and -fG options on linux. + Fix a broken symbolic link. + Update the version number embedded in lsof executable. +- lsof-no-build-date-etc.patch: refreshed against newer base + +- Add lsof-glibc-linux-5.0.patch: Fix build with + linux-glibc-devel-5.0 by including sysmacros.h as needed (bsc#1181571) + -- license update: Zlib - lsof license is most similar to Zlib (also use SPDX format) - -- repack the tarball to remove legally problematic files - (bnc#705143) - -- change perl reference to /usr/bin/perl which actually exists - -- perl4 refference causes missing perl4 dependency - -- portability fixes (by Pascal) - -- Do not include build host specific information including - date and compilation time to make build-compare happy - -- update to lsof 4.84 - * corrects a man page nroff command error - * recognizes FreeBSD 7.3 - * adds improved task support, initially for Linux - -- update to lsof 4.83 - * corrects an over-zealous test that causes lsof to produce no - ouput when the HASSECURITY and HASNOSOCKSECURITTY have been - specified at lsof build time - * fixes a typo with the LINUX_HASSELUNIX Configure variable - * accepts LSOF_RANLIB from the environment - * added Linux test for __UCLIBC__ - -- fix 64bit issue (gcc 4.5) - -- enable parallel build - lvm2 +- Update lvm2 from LVM2.2.03.16 to LVM2.2.03.22 (jsc#PED-6339) + * 2.03.22: + * Fix pv_major/pv_minor report field types so they are integers, not strings. + * Add lvmdevices --delnotfound to delete entries for missing devices. + * Always use cachepool name for metadata backup LV for lvconvert --repair. + * Make metadata backup LVs read-only after pool's lvconvert --repair. + * Handle 'lvextend --usepolicies' for pools for all activation variants. + * Fix memleak in vgchange autoactivation setup. + * Support conversion from thick to fully provisioned thin LV. + * Cache/Thin-pool can use error and zero volumes for testing. + * Individual thin volume can be cached, but cannot take snapshot. + * internal support for handling error and zero target (for testing). + * COW above trimmed maximal size is does not return error. + * Add lvm.conf thin_restore and cache_restore settings. + * Handle multiple mounts while resizing volume with a FS. + * Handle leading/trailing spaces in sys_wwid and sys_serial used by deivce_id. + * Fix failing -S|--select for non-reporting cmds if using LV info/status fields. + * Allow snapshots of raid+integrity LV. + * Fix multisegment RAID1 allocator to prevent using single disk for more legs. + * 2.03.21: + * Allow (write)cache over raid+integrity LV. + * 2.03.20: + * Fix segfault if using -S|--select with log/report_command_log=1 setting. + * 2.03.19: + * Do not reset SYSTEMD_READY variable in udev for PVs on MD and loop devices. + * Ensure udev is processing origin LV before its thick snapshots LVs. + * 2.03.18: + * Fix warning for thin pool overprovisioning on lvextend. + * Add support for writecache metadata_only and pause_writeback settings. + * Fix missing error messages in lvmdbusd. + * 2.03.17: + * Add new options (--fs, --fsmode) for FS handling when resizing LVs (btrfs is unsupported). + * Fix 'lvremove -S|--select LV' to not also remove its historical LV right away. + * Fix lv_active field type to binary so --select and --binary applies properly. + * Error out in lvm shell if using a cmd argument not supported in the shell. + * Fix lvm shell's lastlog command to report previous pre-command failures. + * Add --valuesonly option to lvmconfig to print only values without keys. + * Add json_std output format for more JSON standard compliant version of output. + * Fix many corner cases in device_id, including handling of S/N duplicates. + * Fix various issues in lvmdbusd. +- device-mapper version upgrade to 1.02.196 + * Improve parallel creation of /dev/mapper/control device node. + * Import previous ID_FS_* udev records in 13-dm-disk.rules for suspended DM dev. + * Remove NAME="mapper/control" rule from 10-dm.rules to avoid udev warnings. + * Improve 'dmsetup create' without given table line with new kernels. + * Add DM_REPORT_GROUP_JSON_STD for more JSON standard compliant output format. +- Drop patches that have been merged into upstream + - 0001-devices-file-move-clean-up-after-command-is-run.patch + - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch + - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch + - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch + - 0005-pvdisplay-restore-reportformat-option.patch + - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch + - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch + - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch + - 0009-mm-remove-libaio-from-being-skipped.patch + - 0010-dmsetup-check-also-for-ouf-of-range-value.patch + - 0011-devices-drop-double-from-sysfs-path.patch + - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch + - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch + - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch + - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch + - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch +- Add upstream patch + + 0001-lvconvert-swapmetadata-fix-lvmlockd-locking.patch + + 0002-lvconvert-fix-ret-values-fro-integrity-remove.patch + + 0003-lvconvert-fix-regresion-from-integrity-check.patch + + 0004-gcc-cleanup-warnings.patch + + 0005-lvmlockd-fix-thick-to-thin-lv-conversion.patch + + 0006-lvmlockd-let-lockd_init_lv_args-set-lock_args.patch + + 0007-lvmlockd-fix-lvconvert-to-thin-pool.patch + + 0008-lvconvert-run-error-path-code-only-for-shared-VG.patch + + 0009-vgchange-acquire-an-exclusive-VG-lock-for-refresh.patch + + 0010-lvmlockd-client-mutex-ordering.patch + + 0011-filesystem-move-stat-after-open-check.patch + + 0012-tests-check-for-writecache.patch + + 0013-lvresize-fix-32-bit-overflow-in-size-calculation.patch + + 0014-gcc-fix-warnings-for-x32-architecture.patch + + 0015-gcc-warning-missing-braces-around-initializer.patch + + 0016-test-improve-aux-teardown.patch + + 0017-tests-aux-try-with-extra-sleep.patch + + 0018-tests-aux-using-singl-lvmconf-call.patch + + 0019-tests-missing-to-check-for-writecache-support.patch + + 0020-tests-pvmove-large-disk-area.patch + + 0021-tests-enforce-full-fs-check.patch + + 0022-tests-update-for-work-in-fake-dev-environment.patch + + 0023-tests-skip-test-when-lvmdbusd-runs-on-the-system.patch + + 0024-tests-better-slowdown.patch +- Update patch + - bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch + - bug-1184124-link-tests-as-PIE.patch + - bug-1184687_Add-nolvm-for-kernel-cmdline.patch + - fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch +- Rename & Update patch + - bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch + + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch +- update lvm2.spec + - change upstream_device_mapper_version to 1.02.196 + - change device_mapper_version to %{lvm2_version}_1.02.196 + - add config item "-with-libexecdir=%{_libexecdir}" to fix libexec path since commit a2d33cdf + - add new binary "%{_libexecdir}/lvresize_fs_helper" to lvm2 package + lvm2:devicemapper +- Update lvm2 from LVM2.2.03.16 to LVM2.2.03.22 (jsc#PED-6339) + * 2.03.22: + * Fix pv_major/pv_minor report field types so they are integers, not strings. + * Add lvmdevices --delnotfound to delete entries for missing devices. + * Always use cachepool name for metadata backup LV for lvconvert --repair. + * Make metadata backup LVs read-only after pool's lvconvert --repair. + * Handle 'lvextend --usepolicies' for pools for all activation variants. + * Fix memleak in vgchange autoactivation setup. + * Support conversion from thick to fully provisioned thin LV. + * Cache/Thin-pool can use error and zero volumes for testing. + * Individual thin volume can be cached, but cannot take snapshot. + * internal support for handling error and zero target (for testing). + * COW above trimmed maximal size is does not return error. + * Add lvm.conf thin_restore and cache_restore settings. + * Handle multiple mounts while resizing volume with a FS. + * Handle leading/trailing spaces in sys_wwid and sys_serial used by deivce_id. + * Fix failing -S|--select for non-reporting cmds if using LV info/status fields. + * Allow snapshots of raid+integrity LV. + * Fix multisegment RAID1 allocator to prevent using single disk for more legs. + * 2.03.21: + * Allow (write)cache over raid+integrity LV. + * 2.03.20: + * Fix segfault if using -S|--select with log/report_command_log=1 setting. + * 2.03.19: + * Do not reset SYSTEMD_READY variable in udev for PVs on MD and loop devices. + * Ensure udev is processing origin LV before its thick snapshots LVs. + * 2.03.18: + * Fix warning for thin pool overprovisioning on lvextend. + * Add support for writecache metadata_only and pause_writeback settings. + * Fix missing error messages in lvmdbusd. + * 2.03.17: + * Add new options (--fs, --fsmode) for FS handling when resizing LVs (btrfs is unsupported). + * Fix 'lvremove -S|--select LV' to not also remove its historical LV right away. + * Fix lv_active field type to binary so --select and --binary applies properly. + * Error out in lvm shell if using a cmd argument not supported in the shell. + * Fix lvm shell's lastlog command to report previous pre-command failures. + * Add --valuesonly option to lvmconfig to print only values without keys. + * Add json_std output format for more JSON standard compliant version of output. + * Fix many corner cases in device_id, including handling of S/N duplicates. + * Fix various issues in lvmdbusd. +- device-mapper version upgrade to 1.02.196 + * Improve parallel creation of /dev/mapper/control device node. + * Import previous ID_FS_* udev records in 13-dm-disk.rules for suspended DM dev. + * Remove NAME="mapper/control" rule from 10-dm.rules to avoid udev warnings. + * Improve 'dmsetup create' without given table line with new kernels. + * Add DM_REPORT_GROUP_JSON_STD for more JSON standard compliant output format. +- Drop patches that have been merged into upstream + - 0001-devices-file-move-clean-up-after-command-is-run.patch + - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch + - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch + - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch + - 0005-pvdisplay-restore-reportformat-option.patch + - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch + - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch + - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch + - 0009-mm-remove-libaio-from-being-skipped.patch + - 0010-dmsetup-check-also-for-ouf-of-range-value.patch + - 0011-devices-drop-double-from-sysfs-path.patch + - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch + - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch + - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch + - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch + - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch +- Add upstream patch + + 0001-lvconvert-swapmetadata-fix-lvmlockd-locking.patch + + 0002-lvconvert-fix-ret-values-fro-integrity-remove.patch + + 0003-lvconvert-fix-regresion-from-integrity-check.patch + + 0004-gcc-cleanup-warnings.patch + + 0005-lvmlockd-fix-thick-to-thin-lv-conversion.patch + + 0006-lvmlockd-let-lockd_init_lv_args-set-lock_args.patch + + 0007-lvmlockd-fix-lvconvert-to-thin-pool.patch + + 0008-lvconvert-run-error-path-code-only-for-shared-VG.patch + + 0009-vgchange-acquire-an-exclusive-VG-lock-for-refresh.patch + + 0010-lvmlockd-client-mutex-ordering.patch + + 0011-filesystem-move-stat-after-open-check.patch + + 0012-tests-check-for-writecache.patch + + 0013-lvresize-fix-32-bit-overflow-in-size-calculation.patch + + 0014-gcc-fix-warnings-for-x32-architecture.patch + + 0015-gcc-warning-missing-braces-around-initializer.patch + + 0016-test-improve-aux-teardown.patch + + 0017-tests-aux-try-with-extra-sleep.patch + + 0018-tests-aux-using-singl-lvmconf-call.patch + + 0019-tests-missing-to-check-for-writecache-support.patch + + 0020-tests-pvmove-large-disk-area.patch + + 0021-tests-enforce-full-fs-check.patch + + 0022-tests-update-for-work-in-fake-dev-environment.patch + + 0023-tests-skip-test-when-lvmdbusd-runs-on-the-system.patch + + 0024-tests-better-slowdown.patch +- Update patch + - bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch + - bug-1184124-link-tests-as-PIE.patch + - bug-1184687_Add-nolvm-for-kernel-cmdline.patch + - fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch +- Rename & Update patch + - bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch + + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch +- update lvm2.spec + - change upstream_device_mapper_version to 1.02.196 + - change device_mapper_version to %{lvm2_version}_1.02.196 + - add config item "-with-libexecdir=%{_libexecdir}" to fix libexec path since commit a2d33cdf + - add new binary "%{_libexecdir}/lvresize_fs_helper" to lvm2 package + mariadb-connector-c +- Update to release 3.1.22: + * https://mariadb.com/kb/en/mariadb-connector-c-3-1-22-release-notes/ + ncurses +- Add patch bsc1218014-cve-2023-50495.patch + * Fix CVE-2023-50495: segmentation fault via _nc_wrap_entry() + +- Add patch boo1201384.patch + * Do not fully reset serial lines + openssh +- Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). + This mitigates a prefix truncation attack that could be used to + undermine channel security. + +- Enhanced SELinux functionality. Added + * openssh-7.8p1-role-mls.patch + Proper handling of MLS systems and basis for other SELinux + improvements + * openssh-6.6p1-privsep-selinux.patch + Properly set contexts during privilege separation + * openssh-6.6p1-keycat.patch + Add ssh-keycat command to allow retrival of authorized_keys + on MLS setups with polyinstantiation + * openssh-6.6.1p1-selinux-contexts.patch + Additional changes to set the proper context during privilege + separation + * openssh-7.6p1-cleanup-selinux.patch + Various changes and putting the pieces together + For now we don't ship the ssh-keycat command, but we need the patch + for the other SELinux infrastructure + This change fixes issues like bsc#1214788, where the ssh daemon + needs to act on behalf of a user and needs a proper context for this + p11-kit +- Ensure that programs using can be compiled + with CRYPTOKI_GNU. Fixes GnuTLS builds. [jsc#PED-6705] + * Add p11-kit-pkcs11-gnu-Enable-testing-with-p11-kit-pkcs11x.h.patch + -- new version 0.20.3 - * Fix problems reinitializing managed modules after fork - * Fix bad bookeeping when fail initializing one of the modules - * Fix case where module would be unloaded while in use [#74919] - * Remove assertions when module used before initialized [#74919] - * Fix handling of mmap failure and mapping empty files [#74773] - * Stable p11_kit_be_quiet() and p11_kit_be_loud() functions - * Require automake 1.12 or later - * Build fixes for Windows [#76594 #74149] -- apply patches to avoid errors from certificates with invalid public key - (fdo#82328, bnc#890908, - trust-Dont-use-invalid-public-keys-for-looking-up-.patch, - trust-Print-label-of-certificate-when-complaining-.patch) - perl-Cpanel-JSON-XS +- updated to 4.37 + see /usr/share/doc/packages/perl-Cpanel-JSON-XS/Changes + 4.37 2023-07-04 (rurban) + - Fix NAN/INF for AIX (Tux: AIX-5.3, tested by XSven on AIX-7.3) GH #165 + - Fix empty string result in object stringification (PR #221 jixam) + - Allow \' in strings when allow_singlequote is enabled (PR #217 warpspin) + poppler -- security update -- added patches - fix CVE-2023-34872 [bsc#1213888], remote denial-of-service in OutlineItem::open in Outline.cc - + poppler-CVE-2023-34872.patch +- Add patch to let it build with the heavily patched tiff 4.0.9 + we have in SLE 15: + * reduce-libtiff-required-version.patch + +- version update to 23.10.0 + core: + * cairo: update type 3 fonts for cairo 1.18 api + * Fix crash on malformed files + build system: + * Make a few more dependencies soft-mandatory + * Add more supported gnupg releases + * Check if linker supports version scripts +- modified patches + % reduce-boost-required-version.patch (refreshed) + +- build with gpgmepp for signing documents (bsc#1215632) + +- Update to version 23.09.0: + * core: + - Add Android-specific font matching functionality + - Fix digital signatures for NeedAppearance=true + - Forms: Don't look up same glyph multiple times + - Provide the key location for certificates you can sign with + - Add ToUnicode support for similarequal + - Fix crash on malformed files + * qt5: + - Provide the key location for certificates you can sign with + - Allow to force a rasterized overprint preview during PS + conversion + * qt6: + - Provide the key location for certificates you can sign with + - Allow to force a rasterized overprint preview during PS + conversion + * pdfsig: + - Provide the key location for certificates you can sign with +- Changes from version 23.08.0: + * core: + - Fix GWG 19.2 - DeviceN Overprint (White) + - Splash: avoid bogus memory allocation size in + doTilingPatternFill + - Fix use-of-uninitialized-value in XRef + - Fix float-cast-overflow error in Catalog + - Cleanup gpgme backend code + - Version symbols in poppler core + * glib: + - Improve poppler_get_available_signing_certificates + - Add new members to PopplerCertificateInfo + * utils: + - pdftotext: small improvement to man page +- Bump poppler_sover to 131 following upstream changes. + +- update to 23.07.0: + core: + * Fix reading of utf8-with-bom files + * Fix crash if CERT_ExtractPublicKey doesn't return a public + key + * Fix rendering of some malformed documents. Issue #1395 + * Allow for stream compression and compress font streams in + forms Remove method Hints::getPageRanges + qt5: + * Fix crash when overprint preview is enabled + * Don't fail signature basics tests if backend is not + configured + qt6: + * Fix crash when overprint preview is enabled + * Don't fail signature basics tests if backend is not + configured + utils: + * pdfsig: Allow showung and selecting signature backend + * pdfsig: Describe signature dump format in manual page + +- update to 23.06.0 (bsc#1212255): + * CairoOutputDev: Fix crash when doing type3 rendering + * Fix crash with unknown signature hashing algorithms + * Add gpgme backend for signature handling + * FontInfo: Make it return proper information about font + substitution + * FontInfo: Try harder to get Type 3 font name + * Store embedded fonts widths table in a more effective manner + * Skip font lookup for nonprintable characters + * Fix crash on malformed files + * Add API to allow selecting signature backend (nss or gpgme) + * Convert embedded files to bytearray a bit smarter + +- update to 23.05.0: + * Fix crash when filling some forms + * Set SigFlags when signing unsigned signature + * Add some infrastructure code to support multiple signing + backends + * Fix potential stack overflow in PostScriptFunction::parseCode + * Fix some minor uninitialised memory reads + +- update to 23.04.0: + * Fix memory issue when signing fails. Issue #1372 + * Internal improvements of signature related code + * CairoOutputDev: improve type3 font rendering + * Fix memory leak in + GlobalParams::findSystemFontFileForFamilyAndStyle + * pdftocairo: Fix crash in some special situations + * pdfsig: allow holes in -dump signature list + * pdfsig: Support --help + +- update to 23.03.0: + core: + * PngWriter: Fix potential uninitialized memory use + +- Update to version 23.02.0: + + core: + * CairoOutputDev: + . Fix rendering of color type 3 fonts + . Add handling matte entry + * Fix segfault on wrong nssdir + * Fix "NSS could not shutdown" + + utils: pdfsig: Point out supports PKCS#11 URIs as nickname postfix +- (bsc#1218304) VUL-0: postfix: new SMTP smuggling attack + (bsc#1218314) SMTP Smuggling - Spoofing E-Mails Worldwide + Apply patch containing the feature smtpd_forbid_unauth_pipelining + as default yes. + add patch: + postfix-3.7-patch06 +- Security: the Postfix SMTP server optionally disconnects remote + SMTP clients that violate RFC 2920 (or 5321) command pipelining + constraints. The server replies with "554 5.5.0 Error: SMTP protocol + synchronization" and logs the unexpected remote SMTP client input. + Specify "smtpd_forbid_unauth_pipelining = yes" to enable. +- Workaround to limit collateral damage from OS distributions that + crank up security to 11, increasing the number of plaintext email + deliveries. This introduces basic OpenSSL configuration file support, + with two new parameters "tls_config_file" and "tls_config_name". + Details are in the postconf(5) manpage under "tls_config_file" and + "tls_config_name". + python-pip +- Add CVE-2023-5752-r-param-hg.patch to fix bsc#1217353 + (CVE-2023-5752) avoiding injection of arbitrary configuration + through Mercurial parameter. + python3-cryptography +- Add CVE-2023-49083.patch to fix A null-pointer-dereference and + segfault could occur when loading certificates from a PKCS#7 bundle. + bsc#1217592 + sg3_utils +- Make sure initrd is rebuilt when sg3_utils is updated + (bsc#1215772) + +- Update to version 1.47+15.b6898b8: + * rescan-scsi-bus.sh: remove /tmp/rescan-scsi-mpath-info.txt + (gh#doug-gilbert/sg3_utils#44) + * rescan_scsi_bus.sh: fix multipath issue when called with -s and + without -u (bsc#1215720, bsc#1216355) + webkit2gtk3 +- Update to version 2.42.4 (boo#1218032): + + Fix incorrect random images incorrectly displayed as + backgrounds of
elements. + + Fix videos displayed aliased after being resized e.g. in + YouTube. + + Fix several crashes and rendering issues. + + Security fixes: CVE-2023-42883. + +- Update to version 2.42.3 (boo#1217844): + + Fix flickering while playing videos with DMA-BUF sink. + + Fix color picker being triggered in the inspector when typing + "tan". + + Do not special case the "sans" font family name. + + Fix build failure with libxml2 version 2.12.0 due to an API + change. + + Fix several crashes and rendering issues. + + Security fixes: CVE-2023-42916, CVE-2023-42917. + - boo#1215868 boo#1215869 boo#1215870): + boo#1215868 boo#1215869 boo#1215870 boo#1218033): - + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359. + + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359, + CVE-2023-42890. wireless-regdb +- Define %{_firmwaredir} if not defined. This fixes RPM build errors. + +- Update to version 20230901: + * wireless-regdb: update regulatory database based on preceding changes + * wireless-regdb: Update regulatory rules for Australia (AU) for June 2023 + +- Update to version 20230721: + * wireless-regdb: Update regulatory info for Türkiye (TR) + * wireless-regdb: Update regulatory rules for Egypt (EG) from March 2022 guidelines + +- Update to version 20230601: + * wireless-regdb: Update regulatory rules for Philippines (PH) + +- Update to version 20230503: + * wireless-regdb: update regulatory database based on preceding changes + * wireless-regdb: Update regulatory rules for Hong Kong (HK) + * wireless-regdb: update regulatory rules for India (IN) + * wireless-regdb: Update regulatory rules for Russia (RU). Remove DFS requirement. + * Update regulatory info for Russia (RU) on 6GHz + +- Update to version 20230213: + * wireless-regdb: update regulatory database based on preceding changes + * wireless-regdb: Update regulatory info for Russia (RU) on 5GHz + +- Update to version 20221205: + * wireless-regdb: Update regulatory rules for Japan (JP) on 6GHz + * wireless-regdb: Update regulatory rules for Japan (JP) on 5GHz + +- Update to version 20221012: + * wireless-regdb: update regulatory rules for Switzerland (CH) + * wireless-regdb: Update regulatory rules for Brazil (BR) + +- Update to version 20220812: + * wireless-regdb: update regulatory database based on preceding changes + * wireless-regdb: update 5 GHz rules for PK and add 60 GHz rule + * wireless-regdb: add 5 GHz rules for GY + * wireless-regdb: update regulatory database based on preceding changes + * wireless-regdb: Unify 6 GHz rules for EU contries + * wireless-regdb: Remove AUTO-BW from 6 GHz rules + * wireless-regdb: update regulatory rules for Bulgaria (BG) on 6GHz + * Regulatory update for 6 GHz operation in FI + * Regulatory update for 6 GHz operation in United States (US) + * Regulatory update for 6 GHz operation in Canada (CA) + +- Update to version 20220606: + * wireless-regdb: update regulatory database based on preceding changes + * wireless-regdb: Unify 6 GHz rules for EU contries + * wireless-regdb: Remove AUTO-BW from 6 GHz rules + +- Update to version 20220527: + * wireless-regdb: update regulatory rules for Bulgaria (BG) on 6GHz + * Regulatory update for 6 GHz operation in FI + * Regulatory update for 6 GHz operation in United States (US) + * Regulatory update for 6 GHz operation in Canada (CA) + +- Update to version 20220408: + * wireless-regdb: add db files missing from previous commit + * wireless-regdb: update regulatory database based on preceding changes + * wireless-regdb: Update regulatory rules for Australia (AU) + * wireless-regdb: add missing spaces for US S1G rules + +- Update to version 20220324: + * wireless-regdb: Update regulatory rules for Israel (IL) + +- Update to version 20220218: + * wireless-regdb: update regulatory database based on preceding changes + * wireless-regdb: Update regulatory rules for the Netherlands (NL) on 6GHz + * wireless-regdb: Update regulatory rules for China (CN) + * wireless-regdb: Update regulatory rules for South Korea (KR) + * Revert "wireless-regdb: Update regulatory rules for South Korea (KR)" + * wireless-regdb: Update regulatory rules for Spain (ES) on 6GHz + * wireless-regdb: add 802.11ah bands to world regulatory domain + * wireless-regdb: add support for US S1G channels + * wireless-regdb: Update regulatory rules for France (FR) on 6 and 60 GHz + * wireless-regdb: Update regulatory rules for South Korea (KR) + +- Update to version 20220108: + * wireless-regdb: Update regulatory rules for Croatia (HR) on 6GHz + +- Update to version 20211209: + * wireless-regdb: Raise DFS TX power limit to 250 mW (24 dBm) for the US + +- Update to version 20210828: + * wireless-regdb: update regulatory database based on preceding changes + * Update regulatory rules for Ecuador (EC) + * wireless-regdb: Update regulatory rules for Norway (NO) on 6 and 60 GHz + * wireless-regdb: Update regulatory rules for Germany (DE) on 6GHz + * wireless-regdb: update regulatory database based on preceding changes + * wireless-regdb: reduce bandwidth for 5730-5850 and 5850-5895 MHz in US + * wireless-regdb: remove PTMP-ONLY from 5850-5895 MHz for US + * wireless-regdb: recent FCC report and order allows 5850-5895 immediately + * wireless-regdb: update 5725-5850 MHz rule for GB + +- Update to version 20210421: + * wireless-regdb: update regulatory database based on preceding changes + * wireless-regdb: re-add source url and info for CU + +- Update to version 20210407: + * wireless-regdb: Update regulatory rules for Cuba (CU) on 5GHz + * wireless-regdb: Do not hardcode 'sforshee' in the certificate commonName + +- Update to version 20210129: + * wireless-regdb: Update regulatory rules for Ukraine (UA) + * wireless-regdb: update CNAF regulation url for ES + +- leverage %{_firmwaredir} to install firmware into correct location (boo#1029961) + +- Update to version 20201120: + * wireless-regdb: update regulatory database based on preceding changes + * wireless-regdb: Update regulatory rules for Kazakhstan (KZ) + * wireless-regdb: update 5.8 GHz regulatory rule for GB + * wireless-regdb: Update regulatory rules for Pakistan (PK) on 5GHz + * wireless-regdb: Update regulatory rules for Croatia (HR) + * wireless-regdb: restore channel 12 & 13 limitation in the US + * wireless-regdb: update regulatory rules for Egypt (EG) + +- Fixes for %_libexecdir changing to /usr/libexec + +- Update to version 20200429: + * wireless-regdb: update regulatory database based on preceding changes + * wireless-regdb: update rules for US on 2.4/5G + * GB: Extend to cover DMG channels 5 & 6 + * wireless-regdb: Update regulatory rules for Singapore (SG) + * wireless-regdb: Update regulatory rules for Indonesia (ID) + +- Update to version 20191029: + * regdb: fix compatibility with python2 + * wireless-regdb: Update regulatory rules for Russia (RU) + * wireless-regdb: Harmonize ranges of CEPT countries (stand of July 2019) + * wireless-regdb: Fix ranges of EU countries as they are harmonized since 2014 + * wireless-regdb: Extend 5470-5725 MHz range to 5730 MHz for Taiwan (TW) + * wireless-regdb: Fix overlapping ranges for Switzerland and Liechtenstein + * wireless-regdb: update regulatory database based on preceding changes +- Switch to _service +- Update project url + xfsprogs +- update to v6.5.0 (bsc#1217575, bsc#1217576): + - libxfs: fix atomic64_t detection on x86_32 + - libxfs: use XFS_IGET_CREATE when creating new files + - libfrog: fix overly sleep workqueues + - xfs_db: use directio for device access + - libxfs: make platform_set_blocksize optional with directio + - mkfs: add a config file for 6.6 LTS kernels + - mkfs: enable reverse mapping by default + - mkfs: enable large extent counts by default + - xfs_db: create unlinked inodes + - xfs_db: dump unlinked buckets + - xfsprogs: don't allow udisks to automount XFS filesystems with no prompt + - xfs_repair: fix repair failure caused by dirty flag being abnormally set on buffer +- drop: + - 0001-repair-shift-inode-back-into-place-if-corrupted-by-b.patch + - xfsprogs-mkfs-disable-reflink-support-by-default.patch + - xfsprogs-mkfs-don-t-trample-the-gid-set-in-the-protofile.patch + - xfsprogs-mkfs-enable-bigtime-by-default.patch + - xfsprogs-mkfs-prevent-corruption-of-passed-in-suboption-strin.patch + - xfsprogs-mkfs-terminate-getsubopt-arrays-properly.patch + - xfsprogs-xfs_repair-ignore-empty-xattr-leaf-blocks.patch +- mkfs: disable inobtcnt and nrext64 features by default + - add xfsprogs-mkfs-disable-inobtcnt-and-nrext64-features-by-defaul.patch + xorg-x11-server +- Add missing fixes on U_bsc1217765-Xi-allocate-enough-XkbActions-for-our-buttons.patch + (bsc#1217765). + +- U_bsc1217765-Xi-allocate-enough-XkbActions-for-our-buttons.patch + * Out-of-bounds memory write in XKB button actions (CVE-2023-6377, + ZDI-CAN-22412, ZDI-CAN-22413, bsc#1217765) +- U_bsc1217766-randr-avoid-integer-truncation-in-length-check-of-Pr.patch + * Out-of-bounds memory read in RRChangeOutputProperty and + RRChangeProviderProperty (CVE-2023-6478, ZDI-CAN-22561, + bsc#1217766) + xscreensaver +- Update xscreensaver-disable-upgrade-nagging-message.patch to + cover new messages. (boo#1206345, bsc#1217318) + yast2-bootloader -- support 32 bit UEFI firmware on x86_64/i386 architecture (bsc#1208003, - jsc#PED-2569) -- 4.6.3 +- Backport: +-- support 32 bit UEFI firmware on x86_64/i386 architecture + (bsc#1208003, jsc#PED-2569) +- 4.6.4 -- Persist zfcp.allow_lun_scan kernel option for s390 arch - (needed for gh#openSUSE/agama#626). -- 4.6.2 +- Branch package for SP6 (bsc#1208913) -- 4.6.1 - -- Bump version to 4.6.0 (bsc#1208913) +- 4.5.9 yast2-network +- Read all the driver modules from hwinfo instead of just the first + driver ones (bsc#1217652). +- 4.6.7 + yast2-s390 -- Fix detection of the zFCP controller running mode to check - whether the controller is doing auto LUN scan (related to - gh#openSUSE/agama#634). -- 4.6.4 +- onpanic: add support for multipathed zfcp-attached SCSI disks + (bsc#1020336, also related to bsc#1216257). +- 4.6.5 -- Add info about allow_lun_scan option (related to - gh#openSUSE/agama#626). -- 4.6.3 - -- Expose zFCP core functionallity (related to - gh#openSUSUE/agama#594) -- 4.6.2 +- Branch package for SP6 (bsc#1208913) -- 4.6.1 - -- Bump version to 4.6.0 (bsc#1208913) +- 4.5.3 zbar +- security update: + * CVE-2023-40889 [bsc#1214770] + Fix heap based buffer overflow in qr_reader_match_centers() + + zbar-CVE-2023-40889.patch + * CVE-2023-40890 [bsc#1214771] + Fix stack based buffer overflow in lookup_sequence() + + zbar-CVE-2023-40890.patch +