Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package kf6-kwallet for openSUSE:Factory checked in at 2026-07-15 16:32:01 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/kf6-kwallet (Old) and /work/SRC/openSUSE:Factory/.kf6-kwallet.new.1991 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "kf6-kwallet" Wed Jul 15 16:32:01 2026 rev:31 rq:1365137 version:6.28.0 Changes: -------- --- /work/SRC/openSUSE:Factory/kf6-kwallet/kf6-kwallet.changes 2026-06-16 13:57:21.335090276 +0200 +++ /work/SRC/openSUSE:Factory/.kf6-kwallet.new.1991/kf6-kwallet.changes 2026-07-15 16:41:43.162718132 +0200 @@ -1,0 +2,12 @@ +Fri Jul 10 12:16:06 UTC 2026 - Christophe Marin <[email protected]> + +- Update to 6.28.0 + * New feature release + * For more details please see: + * https://kde.org/announcements/frameworks/6/6.28.0 +- Changes since 6.27.0: + * Update dependency version to 6.28.0 + * fix(ksecretd): reject invalid UTF-8 in `SetSecret`/`CreateItem` instead of silent corruption + * Update version to 6.28.0 + +------------------------------------------------------------------- Old: ---- kwallet-6.27.0.tar.xz kwallet-6.27.0.tar.xz.sig New: ---- kwallet-6.28.0.tar.xz kwallet-6.28.0.tar.xz.sig ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ kf6-kwallet.spec ++++++ --- /var/tmp/diff_new_pack.4CiLqk/_old 2026-07-15 16:41:46.530832651 +0200 +++ /var/tmp/diff_new_pack.4CiLqk/_new 2026-07-15 16:41:46.530832651 +0200 @@ -19,11 +19,11 @@ %define qt6_version 6.9.0 %define rname kwallet -# Full KF6 version (e.g. 6.27.0) +# Full KF6 version (e.g. 6.28.0) %{!?_kf6_version: %global _kf6_version %{version}} %bcond_without released Name: kf6-kwallet -Version: 6.27.0 +Version: 6.28.0 Release: 0 Summary: Safe desktop-wide storage for passwords License: LGPL-2.1-or-later ++++++ kwallet-6.27.0.tar.xz -> kwallet-6.28.0.tar.xz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/kwallet-6.27.0/CMakeLists.txt new/kwallet-6.28.0/CMakeLists.txt --- old/kwallet-6.27.0/CMakeLists.txt 2026-06-05 17:49:50.000000000 +0200 +++ new/kwallet-6.28.0/CMakeLists.txt 2026-07-03 13:00:56.000000000 +0200 @@ -1,12 +1,12 @@ cmake_minimum_required(VERSION 3.29) -set(KF_VERSION "6.27.0") # handled by release scripts -set(KF_DEP_VERSION "6.27.0") # handled by release scripts +set(KF_VERSION "6.28.0") # handled by release scripts +set(KF_DEP_VERSION "6.28.0") # handled by release scripts project(KWallet VERSION ${KF_VERSION}) set(CMAKE_EXPORT_COMPILE_COMMANDS 1) include(FeatureSummary) -find_package(ECM 6.27.0 NO_MODULE) +find_package(ECM 6.28.0 NO_MODULE) set_package_properties(ECM PROPERTIES TYPE REQUIRED DESCRIPTION "Extra CMake Modules." URL "https://invent.kde.org/frameworks/extra-cmake-modules";) feature_summary(WHAT REQUIRED_PACKAGES_NOT_FOUND FATAL_ON_MISSING_REQUIRED_PACKAGES) @@ -57,7 +57,7 @@ ecm_set_disabled_deprecation_versions( QT 6.11.0 - KF 6.26.0 + KF 6.27.0 ) if (WIN32) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/kwallet-6.27.0/po/nb/kwalletd6.po new/kwallet-6.28.0/po/nb/kwalletd6.po --- old/kwallet-6.27.0/po/nb/kwalletd6.po 2026-06-05 17:49:50.000000000 +0200 +++ new/kwallet-6.28.0/po/nb/kwalletd6.po 2026-07-03 13:00:56.000000000 +0200 @@ -8,7 +8,7 @@ "POT-Creation-Date: 2026-02-18 00:41+0000\n" "PO-Revision-Date: 2015-04-27 19:45+0200\n" "Last-Translator: Bjørn Steensrud <[email protected]>\n" -"Language-Team: Norwegian Bokmål <[email protected]>\n" +"Language-Team: Norwegian Bokmål <[email protected]>\n" "Language: nb\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/kwallet-6.27.0/po/nn/kwallet6-query.po new/kwallet-6.28.0/po/nn/kwallet6-query.po --- old/kwallet-6.27.0/po/nn/kwallet6-query.po 2026-06-05 17:49:50.000000000 +0200 +++ new/kwallet-6.28.0/po/nn/kwallet6-query.po 2026-07-03 13:00:56.000000000 +0200 @@ -8,7 +8,7 @@ "POT-Creation-Date: 2025-11-17 11:49+0000\n" "PO-Revision-Date: 2015-08-28 20:25+0100\n" "Last-Translator: Karl Ove Hufthammer <[email protected]>\n" -"Language-Team: Norwegian Nynorsk <[email protected]>\n" +"Language-Team: Norwegian Nynorsk <[email protected]>\n" "Language: nn\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/kwallet-6.27.0/po/nn/kwalletd6.po new/kwallet-6.28.0/po/nn/kwalletd6.po --- old/kwallet-6.27.0/po/nn/kwalletd6.po 2026-06-05 17:49:50.000000000 +0200 +++ new/kwallet-6.28.0/po/nn/kwalletd6.po 2026-07-03 13:00:56.000000000 +0200 @@ -8,7 +8,7 @@ "POT-Creation-Date: 2026-02-18 00:41+0000\n" "PO-Revision-Date: 2026-04-18 15:27+0200\n" "Last-Translator: Karl Ove Hufthammer <[email protected]>\n" -"Language-Team: Norwegian Nynorsk <[email protected]>\n" +"Language-Team: Norwegian Nynorsk <[email protected]>\n" "Language: nn\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/kwallet-6.27.0/src/runtime/ksecretd/autotests/fdo_secrets_test.cpp new/kwallet-6.28.0/src/runtime/ksecretd/autotests/fdo_secrets_test.cpp --- old/kwallet-6.27.0/src/runtime/ksecretd/autotests/fdo_secrets_test.cpp 2026-06-05 17:49:50.000000000 +0200 +++ new/kwallet-6.28.0/src/runtime/ksecretd/autotests/fdo_secrets_test.cpp 2026-07-03 13:00:56.000000000 +0200 @@ -606,6 +606,82 @@ QCOMPARE(attribs.getStringParam({"dir1", "name1"}, "param1", "default"), "default"); } +void FdoSecretsTest::invalidUtf8Rejected() +{ + const QStringList wallets = {"wallet1"}; + const QStringList folders = {FDO_SECRETS_DEFAULT_DIR}; + const QStringList entries = {"item1"}; + SET_FUNCTION_RESULT(KSecretD::wallets, wallets); + SET_FUNCTION_RESULT(KSecretD::folderList, folders); + SET_FUNCTION_RESULT(KSecretD::entryList, entries); + + SET_FUNCTION_IMPL(KSecretD::entryType, [](int, const QString &, const QString &, const QString &) -> int { + return KWallet::Wallet::Password; + }); + + SET_FUNCTION_IMPL(KSecretD::readPassword, [](int, const QString &, const QString &, const QString &) -> QString { + return QStringLiteral("valid-password"); + }); + + bool writePasswordCalled = false; + SET_FUNCTION_IMPL(KSecretD::writePassword, [&](int, const QString &, const QString &, const QString &, const QString &) -> int { + writePasswordCalled = true; + return 0; + }); + + std::unique_ptr<KSecretD> kwalletd{new KSecretD}; + std::unique_ptr<KWalletFreedesktopService> service{new KWalletFreedesktopService(kwalletd.get())}; + + auto collection = service->getCollectionByWalletName("wallet1"); + QVERIFY(collection); + + collection->itemAttributes().newItem({FDO_SECRETS_DEFAULT_DIR, "item1"}); + + using OpenAsyncT = int (KSecretD::*)(const QString &, qlonglong, const QString &, bool, const QDBusConnection &, const QDBusMessage &); + SET_FUNCTION_IMPL_OVERLOADED(KSecretD::openAsync, + OpenAsyncT, + [](const QString &, qlonglong, const QString &, bool, const QDBusConnection &, const QDBusMessage &) -> int { + return 0; + }); + + QDBusObjectPath promptPath; + service->Unlock({collection->fdoObjectPath()}, promptPath); + auto prompt = service->getPromptByObjectPath(promptPath); + QVERIFY(prompt); + prompt->Prompt("wndid"); + Q_EMIT kwalletd->walletAsyncOpened(0, 0); + SET_FUNCTION_RESULT_OVERLOADED(KSecretD::isOpen, true, bool(KSecretD::*)(int)); + QVERIFY(!collection->locked()); + + auto item = collection->findItemByEntryLocation({FDO_SECRETS_DEFAULT_DIR, "item1"}); + QVERIFY(item); + + auto message = QDBusMessage::createSignal("dummy", "dummy", "dummy"); + auto [sessionPath, symmetricKey, commonSecretSize, errorStr] = setupSession(service.get()); + QVERIFY2(errorStr.isEmpty(), errorStr.constData()); + Q_UNUSED(commonSecretSize); + Q_UNUSED(symmetricKey); + + /* Invalid UTF-8 bytes (gzip magic + random binary) with text/plain must be rejected */ + QByteArray invalidUtf8("\x1f\x8b\x08\x00\xff\xfe\xfd\xfc\xfb\xfa", 10); + QVERIFY(!invalidUtf8.isValidUtf8()); + + FreedesktopSecret invalidSecret(sessionPath, invalidUtf8, "text/plain; charset=utf8"); + service->ensecret(message, invalidSecret); + + writePasswordCalled = false; + item->SetSecret(invalidSecret); + QVERIFY2(!writePasswordCalled, "writePassword must not be called for invalid UTF-8 with text/ content_type"); + + /* Valid UTF-8 with text/plain must still be accepted */ + FreedesktopSecret validSecret(sessionPath, QByteArray("Hello, valid UTF-8!"), "text/plain; charset=utf8"); + service->ensecret(message, validSecret); + + writePasswordCalled = false; + item->SetSecret(validSecret); + QVERIFY2(writePasswordCalled, "writePassword must be called for valid UTF-8 with text/ content_type"); +} + void FdoSecretsTest::walletNameEncodeDecode() { #define ENCODE_DECODE_CHECK(DECODED, ENCODED) \ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/kwallet-6.27.0/src/runtime/ksecretd/autotests/fdo_secrets_test.h new/kwallet-6.28.0/src/runtime/ksecretd/autotests/fdo_secrets_test.h --- old/kwallet-6.27.0/src/runtime/ksecretd/autotests/fdo_secrets_test.h 2026-06-05 17:49:50.000000000 +0200 +++ new/kwallet-6.28.0/src/runtime/ksecretd/autotests/fdo_secrets_test.h 2026-07-03 13:00:56.000000000 +0200 @@ -32,6 +32,7 @@ void sessionWithShortClientPublicKey(); void sessionWithMsbSetClientPublicKey(); void attributes(); + void invalidUtf8Rejected(); void walletNameEncodeDecode(); }; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/kwallet-6.27.0/src/runtime/ksecretd/ksecretd.notifyrc new/kwallet-6.28.0/src/runtime/ksecretd/ksecretd.notifyrc --- old/kwallet-6.27.0/src/runtime/ksecretd/ksecretd.notifyrc 2026-06-05 17:49:50.000000000 +0200 +++ new/kwallet-6.28.0/src/runtime/ksecretd/ksecretd.notifyrc 2026-07-03 13:00:56.000000000 +0200 @@ -24,6 +24,7 @@ Comment[ia]=KDE Wallet (Portafolio de KDE) Comment[is]=KDE Wallet Comment[it]=Portafoglio di KDE +Comment[ja]=KDE Wallet Comment[ka]=KDE-ის საფულე Comment[ko]=KDE 지갑 Comment[lt]=KDE slaptažodinė @@ -117,6 +118,7 @@ Name[ia]=Il necessita de un contrasigno Name[is]=Þarf lykilorð Name[it]=Richiede password +Name[ja]=パスワードの要求時 Name[ka]=სჭირდება პაროლი Name[ko]=암호 필요함 Name[lt]=Reikalauja slaptažodžio @@ -173,7 +175,7 @@ Comment[id]=Daemon Wallet KDE meminta sandi Comment[is]=KDE Wallet-miðlarinn biður um lykilorð Comment[it]=Il demone dei portafogli di KDE richiede una password -Comment[ja]=KDE ウォレットデーモンがパスワードを要求しています +Comment[ja]=KDE ウォレットデーモンがパスワードを要求したとき Comment[ka]=KDE-ის საფულის დემონი პაროლს ითხოვს Comment[kk]=KDE әмиян қызметі паролін қажет етеді Comment[km]=ដេមិនកាបូបរបស់ KDE ស្នើពាក្យសម្ងាត់ @@ -242,6 +244,7 @@ Name[id]=Sinkronisasi Gagal Name[is]=Samstilling mistókst Name[it]=Sincronizzazione non riuscita +Name[ja]=同期失敗 Name[ka]=სინქრონიზაცია ჩავარდა Name[kk]=Қадамдастыру жаңылды Name[ko]=동기화 실패 @@ -298,6 +301,7 @@ Comment[id]=Sistem Wallet KDE gagal sinkronisasi file wallet ke cakram Comment[is]=KDE Wallet-kerfið náði ekki að samstilla veskisskrá á disk Comment[it]=Il sistema di portafogli di KDE non è riuscito a sincronizzare il file del portafogli sul disco +Comment[ja]=KDE ウォレットシステムがウォレットファイルのディスク同期に失敗したとき Comment[ka]=KDE-ის საფულის სისტემის დისკთან სინქრონიზაციის შეცდომა Comment[kk]=KDE әмиян жүйесінің дискідегі әмиян файлымен қадамдастыру жаңылысы Comment[ko]=KDE 지갑 시스템과 디스크의 지갑 상태를 동기화할 수 없음 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/kwallet-6.27.0/src/runtime/ksecretd/kwalletdbuscontext.h new/kwallet-6.28.0/src/runtime/ksecretd/kwalletdbuscontext.h --- old/kwallet-6.27.0/src/runtime/ksecretd/kwalletdbuscontext.h 2026-06-05 17:49:50.000000000 +0200 +++ new/kwallet-6.28.0/src/runtime/ksecretd/kwalletdbuscontext.h 2026-07-03 13:00:56.000000000 +0200 @@ -41,6 +41,12 @@ { return QDBusConnection::sessionBus(); } + void sendErrorReply(QDBusError::ErrorType, const QString & = {}) const + { + } + void sendErrorReply(const QString &, const QString & = {}) const + { + } }; #define FDO_DBUS_CONTEXT KWalletDBusContextDummy diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/kwallet-6.27.0/src/runtime/ksecretd/kwalletfreedesktopcollection.cpp new/kwallet-6.28.0/src/runtime/ksecretd/kwalletfreedesktopcollection.cpp --- old/kwallet-6.27.0/src/runtime/ksecretd/kwalletfreedesktopcollection.cpp 2026-06-05 17:49:50.000000000 +0200 +++ new/kwallet-6.28.0/src/runtime/ksecretd/kwalletfreedesktopcollection.cpp 2026-07-03 13:00:56.000000000 +0200 @@ -197,6 +197,14 @@ explicit_zero_mem(bytes.data(), bytes.size()); } else if (xdgSchema == QStringLiteral("org.kde.KWallet.Password") || secret.mimeType.startsWith(QStringLiteral("text/"))) { auto bytes = decrypted.value.toByteArray(); + if (!bytes.isValidUtf8()) { + explicit_zero_mem(bytes.data(), bytes.size()); + sendErrorReply(QDBusError::ErrorType::InvalidArgs, + QStringLiteral("Secret value contains invalid UTF-8 sequences but content_type declares text encoding; " + "use application/octet-stream for binary data")); + return QDBusObjectPath("/"); + } + auto str = QString::fromUtf8(bytes); backend()->writePassword(walletHandle(), dir, label, str, FDO_APPID); explicit_zero_mem(bytes.data(), bytes.size()); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/kwallet-6.27.0/src/runtime/ksecretd/kwalletfreedesktopitem.cpp new/kwallet-6.28.0/src/runtime/ksecretd/kwalletfreedesktopitem.cpp --- old/kwallet-6.27.0/src/runtime/ksecretd/kwalletfreedesktopitem.cpp 2026-06-05 17:49:50.000000000 +0200 +++ new/kwallet-6.28.0/src/runtime/ksecretd/kwalletfreedesktopitem.cpp 2026-07-03 13:00:56.000000000 +0200 @@ -178,6 +178,14 @@ if (xdgSchema == QStringLiteral("org.kde.KWallet.Password") || secret.mimeType.startsWith(QStringLiteral("text/"))) { auto bytes = decrypted.value.toByteArray(); + if (!bytes.isValidUtf8()) { + explicit_zero_mem(bytes.data(), bytes.size()); + sendErrorReply(QDBusError::ErrorType::InvalidArgs, + QStringLiteral("Secret value contains invalid UTF-8 sequences but content_type declares text encoding; " + "use application/octet-stream for binary data")); + return; + } + auto str = QString::fromUtf8(bytes); backend()->writePassword(fdoCollection()->walletHandle(), entryLocation.folder, entryLocation.key, str, FDO_APPID); explicit_zero_mem(bytes.data(), bytes.size());
