Skip to Content.
Sympa Menu

sm-commit - [SM-Commit] GIT changes to master grimoire by Ismael Luceno (4b187be27a87b907611961c53febe8520e6a35d8)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Ismael Luceno <scm AT sourcemage.org>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: [SM-Commit] GIT changes to master grimoire by Ismael Luceno (4b187be27a87b907611961c53febe8520e6a35d8)
  • Date: Sun, 1 Nov 2020 15:34:40 +0000

GIT changes to master grimoire by Ismael Luceno <ismael AT sourcemage.org>:

crypto/libressl/DETAILS
| 14 +++-
crypto/libressl/HISTORY
| 7 ++
crypto/libressl/PREPARE
| 9 ++-
crypto/libressl/PRE_BUILD
| 9 +--
crypto/libressl/patches-2.9/001-non_glibc.patch
| 28 +++++++++

crypto/libressl/patches-2.9/fix-compatibility-with-pre-rfc-5280-certificates.patch
| 29 ++++++++++

crypto/libressl/patches-3.2/fix-compatibility-with-pre-rfc-5280-certificates.patch
| 29 ++++++++++
crypto/libressl/patches/001-non_glibc.patch
| 28 ---------
8 files changed, 115 insertions(+), 38 deletions(-)

New commits:
commit 4b187be27a87b907611961c53febe8520e6a35d8
Author: Ismael Luceno <ismael AT sourcemage.org>
Commit: Ismael Luceno <ismael AT sourcemage.org>

libressl: Fix verification of odd but valid certs

Allow GENERALIZEDTIME for dates before 2050, it isn't a security issue,
and enables interoperability with older (pre-RFC-5280) software.

commit 182c40e49025caadbbd1b96574d821dcb1e5422c
Author: Ismael Luceno <ismael AT sourcemage.org>
Commit: Ismael Luceno <ismael AT sourcemage.org>

libressl 3.2.2

diff --git a/crypto/libressl/DETAILS b/crypto/libressl/DETAILS
index 3bd8470..0826e18 100755
--- a/crypto/libressl/DETAILS
+++ b/crypto/libressl/DETAILS
@@ -1,14 +1,18 @@
SPELL=libressl
-if [[ "$LIBRESSL_BRANCH" == "devel" ]]; then
- VERSION=3.1.0
+case "$LIBRESSL_BRANCH"
+in devel|stable|3.2)
+ VERSION=3.2.2
SECURITY_PATCH=10
-elif [[ "$LIBRESSL_BRANCH" == "stable" ]]; then
+;; 3.1)
+ VERSION=3.1.4
+ SECURITY_PATCH=10
+;; 2.9)
VERSION=2.9.2
SECURITY_PATCH=8
-else
+;; *)
VERSION=2.8.3
SECURITY_PATCH=8
-fi
+;; esac
SOURCE=$SPELL-$VERSION.tar.gz
SOURCE2=$SOURCE.asc
SOURCE_URL[0]=http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/$SOURCE
diff --git a/crypto/libressl/HISTORY b/crypto/libressl/HISTORY
index 09d5c31..7b721f8 100644
--- a/crypto/libressl/HISTORY
+++ b/crypto/libressl/HISTORY
@@ -1,3 +1,10 @@
+2020-11-01 Ismael Luceno <ismael AT sourcemage.org>
+ * DETAILS: updates devel & stable to 3.2.2
+ * DETAILS, PREPARE, PRE_BUILD: updated branches
+ * patches-2.9/fix-compatibility-with-pre-rfc-5280-certificates.patch,
+ * patches-3.2/fix-compatibility-with-pre-rfc-5280-certificates.patch:
+ Fix verification of odd but valid certificates
+
2020-04-17 Treeve Jelbert <treeve AT sourcemage.org>
* DETAILS: version 3.1.0

diff --git a/crypto/libressl/PREPARE b/crypto/libressl/PREPARE
index 07c703d..c8710f9 100755
--- a/crypto/libressl/PREPARE
+++ b/crypto/libressl/PREPARE
@@ -1,6 +1,13 @@
. ${GRIMOIRE}/FUNCTIONS &&
list_remove LIBRESSL_BRANCH "experimental" &&
-prepare_select_branch stable old devel &&
+prepare_select_branch \
+ stable \
+ devel \
+ 3.2 \
+ 3.1 \
+ 2.9 \
+ 2.8 \
+ &&
if spell_ok openssl; then
# should be replaced with something less hacky
export WGET_RECAST_REQUIRED="y"
diff --git a/crypto/libressl/PRE_BUILD b/crypto/libressl/PRE_BUILD
index d3b7c52..36935d5 100755
--- a/crypto/libressl/PRE_BUILD
+++ b/crypto/libressl/PRE_BUILD
@@ -1,6 +1,7 @@
default_pre_build &&
cd "${SOURCE_DIRECTORY}" &&
-
-if [[ "${LIBRESSL_BRANCH}" == "stable" ]]; then
- apply_patch_dir patches
-fi
+ver="$LIBRESSL_BRANCH" &&
+case "$ver" in
+ stable|devel) ver=3.2 ;;
+esac &&
+apply_patch_dir "patches-$ver"
diff --git a/crypto/libressl/patches-2.9/001-non_glibc.patch
b/crypto/libressl/patches-2.9/001-non_glibc.patch
new file mode 100644
index 0000000..4067b68
--- /dev/null
+++ b/crypto/libressl/patches-2.9/001-non_glibc.patch
@@ -0,0 +1,28 @@
+diff -rup a/crypto/compat/getprogname_linux.c
b/crypto/compat/getprogname_linux.c
+--- a/crypto/compat/getprogname_linux.c 2019-05-07 07:05:51.000000000
+0000
++++ b/crypto/compat/getprogname_linux.c 2019-05-22 07:06:20.780029886
+0000
+@@ -12,23 +12,14 @@ getprogname(void)
+ * Since Android is using portions of OpenBSD libc, it should have
+ * a symbol called __progname [1].
+ *
+- * Regarding program_invocation_short_name, it is a GNU libc ext [2]
and
+- * so make it conditional to __GLIBC__ [3].
+- *
+ * .. [0]
https://github.com/aosp-mirror/platform_bionic/blob/1eb6d3/libc/include/stdlib.h#L160
+ *
+ * .. [1] https://github.com/aosp-mirror/platform_bionic/commit/692207
+- *
+- * .. [2] https://linux.die.net/man/3/program_invocation_short_name
+- *
+- * .. [3]
https://android.googlesource.com/platform/system/core/+/2819c0/base/logging.cpp#65
+ */
+ #if defined(__ANDROID_API__) && __ANDROID_API__ < 21
+ extern const char *__progname;
+ return __progname;
+-#elif defined(__GLIBC__)
+- return program_invocation_short_name;
+ #else
+-#error "Cannot emulate getprogname"
++ return program_invocation_short_name;
+ #endif
+ }
diff --git
a/crypto/libressl/patches-2.9/fix-compatibility-with-pre-rfc-5280-certificates.patch

b/crypto/libressl/patches-2.9/fix-compatibility-with-pre-rfc-5280-certificates.patch
new file mode 100644
index 0000000..acaeb9d
--- /dev/null
+++
b/crypto/libressl/patches-2.9/fix-compatibility-with-pre-rfc-5280-certificates.patch
@@ -0,0 +1,29 @@
+From 405a4a7f3e60310095d7ef244e69d9acccc12322 Mon Sep 17 00:00:00 2001
+From: Ismael Luceno <ismael AT iodev.co.uk>
+Date: Sun, 1 Nov 2020 01:59:11 +0100
+Subject: [PATCH for 2.9] Fix compatibility with pre-RFC-5280 certificates
+
+Allow GENERALIZEDTIME for dates before 2050, it isn't a security issue, and
+enables interoperability with older software.
+
+Based on a patch by Johan de Vries <devries AT wivion.nl>.
+---
+ crypto/x509/x509_vfy.c | 3 +++
+ 1 files changed, 3 insertions(+)
+
+diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c
+index e98272a6c3..a3dd4e798d 100644
+--- a/crypto/x509/x509_vfy.c
++++ b/crypto/x509/x509_vfy.c
+@@ -1885,6 +1885,9 @@ X509_cmp_time_internal(const ASN1_TIME *ctm, time_t
*cmp_time, int clamp_notafte
+ if (type == -1)
+ goto out; /* invalid time */
+
++ /* Allow GENERALIZEDTIME for dates before 2050, it isn't a security
++ * issue, and enables interoperability with older software. */
++ if (type != V_ASN1_GENERALIZEDTIME)
+ /* RFC 5280 section 4.1.2.5 */
+ if (tm1.tm_year < 150 && type != V_ASN1_UTCTIME)
+ goto out;
+--
+2.28.0
diff --git
a/crypto/libressl/patches-3.2/fix-compatibility-with-pre-rfc-5280-certificates.patch

b/crypto/libressl/patches-3.2/fix-compatibility-with-pre-rfc-5280-certificates.patch
new file mode 100644
index 0000000..d4bbe02
--- /dev/null
+++
b/crypto/libressl/patches-3.2/fix-compatibility-with-pre-rfc-5280-certificates.patch
@@ -0,0 +1,29 @@
+From 405a4a7f3e60310095d7ef244e69d9acccc12322 Mon Sep 17 00:00:00 2001
+From: Ismael Luceno <ismael AT iodev.co.uk>
+Date: Sun, 1 Nov 2020 01:59:11 +0100
+Subject: [PATCH for 3.2] Fix compatibility with pre-RFC-5280 certificates
+
+Allow GENERALIZEDTIME for dates before 2050, it isn't a security issue, and
+enables interoperability with older software.
+
+Based on a patch by Johan de Vries <devries AT wivion.nl>.
+---
+ crypto/x509/x509_verify.c | 3 +++
+ 1 files changed, 3 insertions(+)
+
+diff --git a/crypto/x509/x509_verify.c b/crypto/x509/x509_verify.c
+index 0c32cd04b741..3dda41ea825f 100644
+--- a/crypto/x509/x509_verify.c
++++ b/crypto/x509/x509_verify.c
+@@ -522,6 +522,9 @@ x509_verify_asn1_time_to_tm(const ASN1_TIME *atime,
struct tm *tm, int notafter)
+ if (type == -1)
+ return 0;
+
++ /* Allow GENERALIZEDTIME for dates before 2050, it isn't a security
++ * issue, and enables interoperability with older software. */
++ if (type != V_ASN1_GENERALIZEDTIME)
+ /* RFC 5280 section 4.1.2.5 */
+ if (tm->tm_year < 150 && type != V_ASN1_UTCTIME)
+ return 0;
+--
+2.28.0
diff --git a/crypto/libressl/patches/001-non_glibc.patch
b/crypto/libressl/patches/001-non_glibc.patch
deleted file mode 100644
index 4067b68..0000000
--- a/crypto/libressl/patches/001-non_glibc.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-diff -rup a/crypto/compat/getprogname_linux.c
b/crypto/compat/getprogname_linux.c
---- a/crypto/compat/getprogname_linux.c 2019-05-07 07:05:51.000000000
+0000
-+++ b/crypto/compat/getprogname_linux.c 2019-05-22 07:06:20.780029886
+0000
-@@ -12,23 +12,14 @@ getprogname(void)
- * Since Android is using portions of OpenBSD libc, it should have
- * a symbol called __progname [1].
- *
-- * Regarding program_invocation_short_name, it is a GNU libc ext [2]
and
-- * so make it conditional to __GLIBC__ [3].
-- *
- * .. [0]
https://github.com/aosp-mirror/platform_bionic/blob/1eb6d3/libc/include/stdlib.h#L160
- *
- * .. [1] https://github.com/aosp-mirror/platform_bionic/commit/692207
-- *
-- * .. [2] https://linux.die.net/man/3/program_invocation_short_name
-- *
-- * .. [3]
https://android.googlesource.com/platform/system/core/+/2819c0/base/logging.cpp#65
- */
- #if defined(__ANDROID_API__) && __ANDROID_API__ < 21
- extern const char *__progname;
- return __progname;
--#elif defined(__GLIBC__)
-- return program_invocation_short_name;
- #else
--#error "Cannot emulate getprogname"
-+ return program_invocation_short_name;
- #endif
- }



  • [SM-Commit] GIT changes to master grimoire by Ismael Luceno (4b187be27a87b907611961c53febe8520e6a35d8), Ismael Luceno, 11/01/2020

Archive powered by MHonArc 2.6.24.

Top of Page