Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package bouncycastle for openSUSE:Factory checked in at 2026-08-04 21:28:14 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/bouncycastle (Old) and /work/SRC/openSUSE:Factory/.bouncycastle.new.16738 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "bouncycastle" Tue Aug 4 21:28:14 2026 rev:49 rq:1369237 version:1.85 Changes: -------- --- /work/SRC/openSUSE:Factory/bouncycastle/bouncycastle.changes 2026-04-18 21:34:15.084371641 +0200 +++ /work/SRC/openSUSE:Factory/.bouncycastle.new.16738/bouncycastle.changes 2026-08-04 21:28:49.044437868 +0200 @@ -1,0 +2,48 @@ +Wed Jul 15 11:27:05 UTC 2026 - Pedro Monreal <[email protected]> + +- Update to 1.85: + * Security Fixes: + - CVE-2026-12816: IESEngine stream-mode MAC forgery via length-dependent KDF split (bsc#1272704) + - CVE-2026-8763: Name Constraints bypass via trailing dot in rfc822Name and URI (bsc#1272700) + - CVE-2026-13506: Lazy ASN.1 sequence forcing resets nesting-depth guard (bsc#1272709) + - CVE-2026-13586: PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS) (bsc#1272710) + - CVE-2026-58062: Stapled OCSP response accepted without binding to the checked certificate (bsc#1272716) + - CVE-2026-59638: JSSE hostname verifier CN-fallback enabled by default despite documented opt-in (bsc#1272718) + - CVE-2026-58061: CCM-family modes write plaintext to caller buffer before tag check (bsc#1272715) + - CVE-2026-12185: BKS/UBER keystore allocates from untrusted lengths before integrity check (bsc#1272701) + - CVE-2026-59651: BKS keystore accepts legacy version with 16-bit integrity MAC key (bsc#1272731) + - CVE-2026-59652: LDAP filter injection in legacy jdk1.4 LDAPStoreHelper (bsc#1272732) + - CVE-2026-15055: PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input (bsc#1272712) + - CVE-2026-58063: BCFKS keystore load honours unbounded KDF cost from untrusted file (bsc#1272717) + - CVE-2026-59647: CRMF/CMP password-MAC honours unbounded iteration count (bsc#1272727) + - CVE-2026-59648: OpenPGP Argon2 S2K honours attacker-chosen memory and passes (bsc#1272728) + - CVE-2026-59641: S/MIME validator trusts signer-asserted signingTime for path validation (bsc#1272721) + - CVE-2026-12803: KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery) (bsc#1272703) + - CVE-2026-12852: MLS wire decoder allocates attacker-declared opaque length before bounds check (bsc#1272707) + - CVE-2026-12860: RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path (bsc#1272708) + - CVE-2026-58059: Quadratic-time escaping when stringifying X.500 distinguished names (bsc#1272713) + - CVE-2026-59639: CMS verifySignatures returns true for SignedData with zero signers (bsc#1272719) + - CVE-2026-59645: OER parser recurses without depth limit on self-referential IEEE 1609.2 schema (bsc#1272725) + - CVE-2026-59640: OpenPGP CFB quick-check oracle active on symmetric/session-key paths (bsc#1272720) + - CVE-2026-58060: HSS public-key level count unbounded, enabling huge allocation on verify (bsc#1272714) + - CVE-2026-12802: CMS AuthEnvelopedData fails to enforce tag-length on decryption (bsc#1272702) + - CVE-2026-59646: DTLS handshake reassembler allocates buffer from unchecked 24-bit length (bsc#1272726) + - CVE-2026-14682: Possible OOM from unbounded up-front allocation on a definite-length read (bsc#1272711) + - CVE-2026-12817: OpenPGP AEAD decryption skips final tag on chunk-aligned data (bsc#1272705) + - CVE-2026-59642: CMS AuthenticatedData content not bound to MAC when authAttrs present (bsc#1272722) + - CVE-2026-59643: OpenPGP inline-signature policy failures silently ignored (bsc#1272723) + - CVE-2026-59644: MLS hash-ratchet honours arbitrary 32-bit generation counter from sender (bsc#1272724) + - CVE-2026-59650: MTI/A0 DH agreement exponentiates unvalidated peer value (bsc#1272730) + - CVE-2026-59649: OpenPGP user-attribute subpacket length bounded only by JVM max memory (bsc#1272729) + * Full Release Notes: + - bouncycastle.org/download/bouncy-castle-java/?filter=java%3Drelease-1-85 + * Additional Notes: + - The standardised PQC algorithms ML-KEM, ML-DSA, SLH-DSA, FrodoKEM, + and CMCE have been repackaged under org.bouncycastle.crypto and + the versions under org.bouncycastle.crypto.pqc have been deprecated. + These deprecated versions will be removed in BC 1.86. + * Rebase patches: + - bouncycastle-char-literal.patch + - bouncycastle-notests.patch + +------------------------------------------------------------------- Old: ---- bcjmail-jdk18on-1.84.pom bcmail-jdk18on-1.84.pom bcpg-jdk18on-1.84.pom bcpkix-jdk18on-1.84.pom bcprov-jdk18on-1.84.pom bctls-jdk18on-1.84.pom bcutil-jdk18on-1.84.pom r1rv84.tar.gz New: ---- bcjmail-jdk18on-1.85.pom bcmail-jdk18on-1.85.pom bcpg-jdk18on-1.85.pom bcpkix-jdk18on-1.85.pom bcprov-jdk18on-1.85.pom bctls-jdk18on-1.85.pom bcutil-jdk18on-1.85.pom r1rv85.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ bouncycastle.spec ++++++ --- /var/tmp/diff_new_pack.hV7LM6/_old 2026-08-04 21:28:51.996540036 +0200 +++ /var/tmp/diff_new_pack.hV7LM6/_new 2026-08-04 21:28:52.000540174 +0200 @@ -17,7 +17,7 @@ %global ver_major 1 -%global ver_minor 84 +%global ver_minor 85 #%%global ver_micro 1 %global gittag r%{ver_major}rv%{ver_minor}%{?ver_micro:v%{ver_micro}} %global archivever jdk18on-%{ver_major}.%{ver_minor}%{?ver_micro:0%{ver_micro}} ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.hV7LM6/_old 2026-08-04 21:28:52.056542113 +0200 +++ /var/tmp/diff_new_pack.hV7LM6/_new 2026-08-04 21:28:52.060542251 +0200 @@ -1,6 +1,6 @@ -mtime: 1776349843 -commit: ded791bd0a9f8637d3dba60e9db7c35e2c62a9c430687911f45995431f309de8 -url: https://src.opensuse.org/java-packages/bouncycastle.git -revision: ded791bd0a9f8637d3dba60e9db7c35e2c62a9c430687911f45995431f309de8 +mtime: 1785753955 +commit: e0919bc052b046219afc7832176fff95f8fee24622d541242a0bd69555629d44 +url: https://src.opensuse.org/java-packages/bouncycastle +revision: e0919bc052b046219afc7832176fff95f8fee24622d541242a0bd69555629d44 projectscmsync: https://src.opensuse.org/java-packages/_ObsPrj ++++++ bcjmail-jdk18on-1.84.pom -> bcjmail-jdk18on-1.85.pom ++++++ --- /work/SRC/openSUSE:Factory/bouncycastle/bcjmail-jdk18on-1.84.pom 2026-04-18 21:34:14.984367578 +0200 +++ /work/SRC/openSUSE:Factory/.bouncycastle.new.16738/bcjmail-jdk18on-1.85.pom 2026-08-04 21:28:48.904433023 +0200 @@ -5,7 +5,7 @@ <artifactId>bcjmail-jdk18on</artifactId> <packaging>jar</packaging> <name>Bouncy Castle JavaMail Jakarta S/MIME APIs</name> - <version>1.84</version> + <version>1.85</version> <description>The Bouncy Castle Java APIs for doing S/MIME with the Jakarta Mail APIs. The APIs are designed primarily to be used in conjunction with the BC Java provider for Java 1.8 and later.</description> <url>https://www.bouncycastle.org/download/bouncy-castle-java/</url> <licenses> @@ -33,7 +33,7 @@ <dependency> <groupId>org.bouncycastle</groupId> <artifactId>bcpkix-jdk18on</artifactId> - <version>1.84</version> + <version>1.85</version> <type>jar</type> </dependency> </dependencies> ++++++ bcmail-jdk18on-1.84.pom -> bcmail-jdk18on-1.85.pom ++++++ --- /work/SRC/openSUSE:Factory/bouncycastle/bcmail-jdk18on-1.84.pom 2026-04-18 21:34:14.996368066 +0200 +++ /work/SRC/openSUSE:Factory/.bouncycastle.new.16738/bcmail-jdk18on-1.85.pom 2026-08-04 21:28:48.912433299 +0200 @@ -5,7 +5,7 @@ <artifactId>bcmail-jdk18on</artifactId> <packaging>jar</packaging> <name>Bouncy Castle JavaMail S/MIME APIs</name> - <version>1.84</version> + <version>1.85</version> <description>The Bouncy Castle Java APIs for doing S/MIME with JavaMail. The APIs are designed primarily to be used in conjunction with the BC Java provider for Java 1.8 and later.</description> <url>https://www.bouncycastle.org/download/bouncy-castle-java/</url> <licenses> @@ -33,7 +33,7 @@ <dependency> <groupId>org.bouncycastle</groupId> <artifactId>bcpkix-jdk18on</artifactId> - <version>1.84</version> + <version>1.85</version> <type>jar</type> </dependency> </dependencies> ++++++ bcpg-jdk18on-1.84.pom -> bcpg-jdk18on-1.85.pom ++++++ --- /work/SRC/openSUSE:Factory/bouncycastle/bcpg-jdk18on-1.84.pom 2026-04-18 21:34:15.016368879 +0200 +++ /work/SRC/openSUSE:Factory/.bouncycastle.new.16738/bcpg-jdk18on-1.85.pom 2026-08-04 21:28:48.924433714 +0200 @@ -5,7 +5,7 @@ <artifactId>bcpg-jdk18on</artifactId> <packaging>jar</packaging> <name>Bouncy Castle OpenPGP APIs</name> - <version>1.84</version> + <version>1.85</version> <description>The Bouncy Castle Java APIs for the OpenPGP Protocol. The APIs are designed primarily to be used in conjunction with the BC Java provider but may also be used with other providers providing cryptographic services. This jar is designed to work best with Java 1.8 and later.</description> <url>https://www.bouncycastle.org/download/bouncy-castle-java/</url> <licenses> @@ -38,13 +38,13 @@ <dependency> <groupId>org.bouncycastle</groupId> <artifactId>bcprov-jdk18on</artifactId> - <version>1.84</version> + <version>1.85</version> <type>jar</type> </dependency> <dependency> <groupId>org.bouncycastle</groupId> <artifactId>bcutil-jdk18on</artifactId> - <version>1.84</version> + <version>1.85</version> <type>jar</type> </dependency> </dependencies> ++++++ bcpkix-jdk18on-1.84.pom -> bcpkix-jdk18on-1.85.pom ++++++ --- /work/SRC/openSUSE:Factory/bouncycastle/bcpkix-jdk18on-1.84.pom 2026-04-18 21:34:15.024369204 +0200 +++ /work/SRC/openSUSE:Factory/.bouncycastle.new.16738/bcpkix-jdk18on-1.85.pom 2026-08-04 21:28:48.944434407 +0200 @@ -5,7 +5,7 @@ <artifactId>bcpkix-jdk18on</artifactId> <packaging>jar</packaging> <name>Bouncy Castle PKIX, CMS, EAC, TSP, PKCS, OCSP, CMP, and CRMF APIs</name> - <version>1.84</version> + <version>1.85</version> <description>The Bouncy Castle Java APIs for CMS, PKCS, EAC, TSP, CMP, CRMF, OCSP, and certificate generation. This jar contains APIs for Java 1.8 and later. The APIs are designed primarily to be used in conjunction with the BC Java provider but may also be used with other providers providing cryptographic services.</description> <url>https://www.bouncycastle.org/download/bouncy-castle-java/</url> <licenses> @@ -33,7 +33,7 @@ <dependency> <groupId>org.bouncycastle</groupId> <artifactId>bcutil-jdk18on</artifactId> - <version>1.84</version> + <version>1.85</version> <type>jar</type> </dependency> </dependencies> ++++++ bcprov-jdk18on-1.84.pom -> bcprov-jdk18on-1.85.pom ++++++ --- /work/SRC/openSUSE:Factory/bouncycastle/bcprov-jdk18on-1.84.pom 2026-04-18 21:34:15.028369367 +0200 +++ /work/SRC/openSUSE:Factory/.bouncycastle.new.16738/bcprov-jdk18on-1.85.pom 2026-08-04 21:28:48.972435376 +0200 @@ -5,8 +5,8 @@ <artifactId>bcprov-jdk18on</artifactId> <packaging>jar</packaging> <name>Bouncy Castle Provider</name> - <version>1.84</version> - <description>The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains the JCA/JCE provider and low-level API for the BC Java version 1.84 for Java 1.8 and later.</description> + <version>1.85</version> + <description>The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains the JCA/JCE provider and low-level API for the BC Java version 1.85 for Java 1.8 and later.</description> <url>https://www.bouncycastle.org/download/bouncy-castle-java/</url> <licenses> <license> ++++++ bctls-jdk18on-1.84.pom -> bctls-jdk18on-1.85.pom ++++++ --- /work/SRC/openSUSE:Factory/bouncycastle/bctls-jdk18on-1.84.pom 2026-04-18 21:34:15.036369691 +0200 +++ /work/SRC/openSUSE:Factory/.bouncycastle.new.16738/bctls-jdk18on-1.85.pom 2026-08-04 21:28:48.980435653 +0200 @@ -5,7 +5,7 @@ <artifactId>bctls-jdk18on</artifactId> <packaging>jar</packaging> <name>Bouncy Castle TLS/JSSE APIs</name> - <version>1.84</version> + <version>1.85</version> <description>The Bouncy Castle Java APIs for the TLS, including a JSSE provider (except in Java 4). The APIs are designed primarily to be used in conjunction with the BC Java provider but may also be used with other providers providing cryptographic services. This jar is designed to best work with Java 1.8 and later.</description> <url>https://www.bouncycastle.org/download/bouncy-castle-java/</url> <licenses> @@ -33,7 +33,7 @@ <dependency> <groupId>org.bouncycastle</groupId> <artifactId>bcutil-jdk18on</artifactId> - <version>1.84</version> + <version>1.85</version> <type>jar</type> </dependency> </dependencies> ++++++ bcutil-jdk18on-1.84.pom -> bcutil-jdk18on-1.85.pom ++++++ --- /work/SRC/openSUSE:Factory/bouncycastle/bcutil-jdk18on-1.84.pom 2026-04-18 21:34:15.040369854 +0200 +++ /work/SRC/openSUSE:Factory/.bouncycastle.new.16738/bcutil-jdk18on-1.85.pom 2026-08-04 21:28:49.004436484 +0200 @@ -5,7 +5,7 @@ <artifactId>bcutil-jdk18on</artifactId> <packaging>jar</packaging> <name>Bouncy Castle ASN.1 Extension and Utility APIs</name> - <version>1.84</version> + <version>1.85</version> <description>The Bouncy Castle Java APIs for ASN.1 extension and utility APIs used to support bcpkix and bctls. This jar contains APIs for Java 1.8 and later.</description> <url>https://www.bouncycastle.org/download/bouncy-castle-java/</url> <licenses> @@ -33,7 +33,7 @@ <dependency> <groupId>org.bouncycastle</groupId> <artifactId>bcprov-jdk18on</artifactId> - <version>1.84</version> + <version>1.85</version> <type>jar</type> </dependency> </dependencies> ++++++ bouncycastle-char-literal.patch ++++++ --- /var/tmp/diff_new_pack.hV7LM6/_old 2026-08-04 21:28:52.240548481 +0200 +++ /var/tmp/diff_new_pack.hV7LM6/_new 2026-08-04 21:28:52.248548757 +0200 @@ -1,12 +1,14 @@ ---- bc-java-r1v81/pg/src/main/java/org/bouncycastle/bcpg/ArmoredOutputStream.java 2025-06-18 16:53:17.839002101 +0200 -+++ bc-java-r1v81/pg/src/main/java/org/bouncycastle/bcpg/ArmoredOutputStream.java 2025-06-18 16:53:25.752560133 +0200 -@@ -619,7 +619,7 @@ +Index: bc-java-r1rv85/pg/src/main/java/org/bouncycastle/bcpg/ArmoredOutputStream.java +=================================================================== +--- bc-java-r1rv85.orig/pg/src/main/java/org/bouncycastle/bcpg/ArmoredOutputStream.java ++++ bc-java-r1rv85/pg/src/main/java/org/bouncycastle/bcpg/ArmoredOutputStream.java +@@ -633,7 +633,7 @@ public class ArmoredOutputStream if (comment.length() > availableCommentCharsPerLine) { - comment = comment.substring(0, availableCommentCharsPerLine - 1) + '…'; + comment = comment.substring(0, availableCommentCharsPerLine - "…".length()) + "…"; } - addComment(comment); - return this; + return addComment(comment); + } ++++++ bouncycastle-notests.patch ++++++ --- /var/tmp/diff_new_pack.hV7LM6/_old 2026-08-04 21:28:52.268549450 +0200 +++ /var/tmp/diff_new_pack.hV7LM6/_new 2026-08-04 21:28:52.276549727 +0200 @@ -1,8 +1,8 @@ -Index: bc-java-r1rv79/ant/bc+-build.xml +Index: bc-java-r1rv85/ant/bc+-build.xml =================================================================== ---- bc-java-r1rv79.orig/ant/bc+-build.xml -+++ bc-java-r1rv79/ant/bc+-build.xml -@@ -280,7 +280,7 @@ +--- bc-java-r1rv85.orig/ant/bc+-build.xml ++++ bc-java-r1rv85/ant/bc+-build.xml +@@ -299,7 +299,7 @@ </target> @@ -11,7 +11,7 @@ <target name="build-lw" depends="initMacros"> <!-- -@@ -964,148 +964,6 @@ +@@ -993,153 +993,6 @@ </target> @@ -39,10 +39,13 @@ - <fileset dir="${src.dir}" includes="**/utiltest/*Test.java" /> - <fileset dir="${src.dir}" includes="**/util/io/pem/*Test.java" /> - <fileset dir="${src.dir}" includes="**/keybox/*Test.java" /> +- <fileset dir="${src.dir}" includes="**/jce/provider/*Test.java" /> +- <fileset dir="${src.dir}" includes="**/est/*Test.java" /> - <fileset dir="${src.dir}" includes="**/test/*.java" /> - <fileset dir="${src.dir}" includes="**/test/*/*.java" /> - <fileset dir="${src.dir}" includes="**/*.asc" /> - <fileset dir="${src.dir}" includes="**/*.pem" /> +- <fileset dir="${src.dir}" includes="**/*.p12" /> - <fileset dir="${src.dir}" includes="**/*.p7m" /> - <fileset dir="${src.dir}" includes="**/*.eml" /> - <fileset dir="${src.dir}" includes="**/*.sig" /> @@ -69,6 +72,8 @@ - </copy> - - <delete file="${test.target.src.dir}/org/bouncycastle/pqc/crypto/lms/AllTests.java" /> +- <delete file="${test.target.src.dir}/org/bouncycastle/pqc/crypto/mayo/AllTests.java" /> +- <delete file="${test.target.src.dir}/org/bouncycastle/est/AllTests.java" /> - <delete file="${test.target.src.dir}/org/bouncycastle/gpg/keybox/AllTests.java" /> - <delete file="${test.target.src.dir}/org/bouncycastle/x509/CertPathReviewerMessages_de.properties" /> - <delete file="${test.target.src.dir}/org/bouncycastle/x509/CertPathReviewerMessages.properties" /> @@ -107,7 +112,6 @@ - <exclude name="**/bcjmail-jdk*.jar" /> - </fileset> - </classpath> -- <sysproperty key="bc.test.data.home" value="../../core/src/test/data" /> - <sysproperty key="test.java.version.prefix" value="${env.JAVA_VERSION_PREFIX}" /> - - <formatter type="xml" /> @@ -157,7 +161,8 @@ - <report format="frames" todir="${artifacts.reports.html.dir}" /> - </junitreport> - </target> - +- <target name="javadoc-libraries" depends="javadoc-util, javadoc-pkix, javadoc-mail, javadoc-jmail, javadoc-pg" /> + <!-- ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-08-03 12:45:55.000000000 +0200 @@ -0,0 +1 @@ +.osc ++++++ r1rv84.tar.gz -> r1rv85.tar.gz ++++++ /work/SRC/openSUSE:Factory/bouncycastle/r1rv84.tar.gz /work/SRC/openSUSE:Factory/.bouncycastle.new.16738/r1rv85.tar.gz differ: char 13, line 1
