Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package bouncycastle for openSUSE:Factory checked in at 2026-10-09 21:42:49 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/bouncycastle (Old) and /work/SRC/openSUSE:Factory/.bouncycastle.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "bouncycastle" Fri Oct 9 21:42:49 2026 rev:50 rq:1383311 version:1.86 Changes: -------- --- /work/SRC/openSUSE:Factory/bouncycastle/bouncycastle.changes 2026-08-04 21:28:49.044437868 +0200 +++ /work/SRC/openSUSE:Factory/.bouncycastle.new.3698736/bouncycastle.changes 2026-10-09 21:43:02.803429067 +0200 @@ -1,0 +2,34 @@ +Tue Oct 6 10:01:54 UTC 2026 - Pedro Monreal <[email protected]> + +- Update to 1.86: + * CVE-2026-97873: Unbounded iteration counts in legacy PBES1 and PKCS#12 + PBE implementations can cause resource exhaustion (bsc#1284224) + * CVE-2026-71890: Unbounded Remove proposals in external MLS commits can + cause arbitrary group member eviction and session takeover (bsc#1284219) + * CVE-2026-71891: Forged ECPoint curves in BLS12-381 key validation can + cause aggregate signature verification bypasses (bsc#1284220) + * CVE-2026-71892: Type mismatch in CMS key-transport validation can cause + key-size enforcement bypasses for HKDF-derived content keys (bsc#1284221) + * CVE-2026-85515: Laundered EOF exceptions in OpenPGP message stream processing + can cause unregistered truncation errors and integrity check bypasses (bsc#1284222) + * CVE-2026-71889: Skipped leaf certificate evaluation in checkNameConstraints + can cause X.509 name constraint bypasses (bsc#1284218) + * CVE-2026-71888: Disagreement between digestAlgorithm and authAttrs in CMS + parsing can cause unauthenticated attribute injection (bsc#1284215) + * CVE-2026-18040: Table lookups and variable-time duplicate scanning in HQC + can cause cache side-channel leaks (bsc#1284205) + * CVE-2026-71886: Unvalidated CERTIFY_OTHER flags in OpenPGP subkeys can cause + unauthorized trust delegations and identity spoofing (bsc#1284212) + * CVE-2026-71887: Missing primary key back-signature validation on subkeys can + cause signature misattribution and trust context spoofing (bsc#1284213) + * CVE-2026-71885: Unbound X.509 certificates in MLS LeafNode verification can + cause identity impersonation and group message interception (bsc#1284165) + * CVE-2026-17508: Unbounded KDF iteration and memory parameters can cause + resource exhaustion (bsc#1284073) + * CVE-2026-17507: Negative signed leaf_index values from unsigned wire + encodings can cause heap exhaustion (bsc#1284075) + * CVE-2026-18036: Variable-time modulo and division operations in NTRU + implementation can allow timing side-channel attacks (bsc#1284065) + * Rebase bouncycastle-notests.patch + +------------------------------------------------------------------- Old: ---- bcjmail-jdk18on-1.85.pom bcmail-jdk18on-1.85.pom bcpg-jdk18on-1.85.pom bcpkix-jdk18on-1.85.pom bcprov-jdk18on-1.85.pom bctls-jdk18on-1.85.pom bcutil-jdk18on-1.85.pom r1rv85.tar.gz New: ---- bcjmail-jdk18on-1.86.pom bcmail-jdk18on-1.86.pom bcpg-jdk18on-1.86.pom bcpkix-jdk18on-1.86.pom bcprov-jdk18on-1.86.pom bctls-jdk18on-1.86.pom bcutil-jdk18on-1.86.pom r1rv86.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ bouncycastle.spec ++++++ --- /var/tmp/diff_new_pack.qrvRaz/_old 2026-10-09 21:43:04.649506436 +0200 +++ /var/tmp/diff_new_pack.qrvRaz/_new 2026-10-09 21:43:04.650506478 +0200 @@ -17,7 +17,7 @@ %global ver_major 1 -%global ver_minor 85 +%global ver_minor 86 #%%global ver_micro 1 %global gittag r%{ver_major}rv%{ver_minor}%{?ver_micro:v%{ver_micro}} %global archivever jdk18on-%{ver_major}.%{ver_minor}%{?ver_micro:0%{ver_micro}} @@ -140,6 +140,9 @@ find . -type f -name "*.class" -exec rm -f {} \; find . -type f -name "*.jar" -exec rm -f {} \; +# Create missing resource directories expected by Ant build scripts +mkdir -p core/src/main/resources + %build echo "package.version:\ %{version}" >> bc-build.properties echo "bundle.version:\ %{version}.0" >> bc-build.properties ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.qrvRaz/_old 2026-10-09 21:43:04.702508658 +0200 +++ /var/tmp/diff_new_pack.qrvRaz/_new 2026-10-09 21:43:04.705508783 +0200 @@ -1,6 +1,6 @@ -mtime: 1785753955 -commit: e0919bc052b046219afc7832176fff95f8fee24622d541242a0bd69555629d44 +mtime: 1791285359 +commit: 099c1b69177ca998337e8f0c306fb4369b748169baa69340443ee7343d4a8b40 url: https://src.opensuse.org/java-packages/bouncycastle -revision: e0919bc052b046219afc7832176fff95f8fee24622d541242a0bd69555629d44 +revision: 099c1b69177ca998337e8f0c306fb4369b748169baa69340443ee7343d4a8b40 projectscmsync: https://src.opensuse.org/java-packages/_ObsPrj ++++++ bcjmail-jdk18on-1.85.pom -> bcjmail-jdk18on-1.86.pom ++++++ --- /work/SRC/openSUSE:Factory/bouncycastle/bcjmail-jdk18on-1.85.pom 2026-08-04 21:28:48.904433023 +0200 +++ /work/SRC/openSUSE:Factory/.bouncycastle.new.3698736/bcjmail-jdk18on-1.86.pom 2026-10-09 21:43:02.607420852 +0200 @@ -5,7 +5,7 @@ <artifactId>bcjmail-jdk18on</artifactId> <packaging>jar</packaging> <name>Bouncy Castle JavaMail Jakarta S/MIME APIs</name> - <version>1.85</version> + <version>1.86</version> <description>The Bouncy Castle Java APIs for doing S/MIME with the Jakarta Mail APIs. The APIs are designed primarily to be used in conjunction with the BC Java provider for Java 1.8 and later.</description> <url>https://www.bouncycastle.org/download/bouncy-castle-java/</url> <licenses> @@ -33,7 +33,7 @@ <dependency> <groupId>org.bouncycastle</groupId> <artifactId>bcpkix-jdk18on</artifactId> - <version>1.85</version> + <version>1.86</version> <type>jar</type> </dependency> </dependencies> ++++++ bcmail-jdk18on-1.85.pom -> bcmail-jdk18on-1.86.pom ++++++ --- /work/SRC/openSUSE:Factory/bouncycastle/bcmail-jdk18on-1.85.pom 2026-08-04 21:28:48.912433299 +0200 +++ /work/SRC/openSUSE:Factory/.bouncycastle.new.3698736/bcmail-jdk18on-1.86.pom 2026-10-09 21:43:02.664423241 +0200 @@ -5,7 +5,7 @@ <artifactId>bcmail-jdk18on</artifactId> <packaging>jar</packaging> <name>Bouncy Castle JavaMail S/MIME APIs</name> - <version>1.85</version> + <version>1.86</version> <description>The Bouncy Castle Java APIs for doing S/MIME with JavaMail. The APIs are designed primarily to be used in conjunction with the BC Java provider for Java 1.8 and later.</description> <url>https://www.bouncycastle.org/download/bouncy-castle-java/</url> <licenses> @@ -33,7 +33,7 @@ <dependency> <groupId>org.bouncycastle</groupId> <artifactId>bcpkix-jdk18on</artifactId> - <version>1.85</version> + <version>1.86</version> <type>jar</type> </dependency> </dependencies> ++++++ bcpg-jdk18on-1.85.pom -> bcpg-jdk18on-1.86.pom ++++++ --- /work/SRC/openSUSE:Factory/bouncycastle/bcpg-jdk18on-1.85.pom 2026-08-04 21:28:48.924433714 +0200 +++ /work/SRC/openSUSE:Factory/.bouncycastle.new.3698736/bcpg-jdk18on-1.86.pom 2026-10-09 21:43:02.704424918 +0200 @@ -5,7 +5,7 @@ <artifactId>bcpg-jdk18on</artifactId> <packaging>jar</packaging> <name>Bouncy Castle OpenPGP APIs</name> - <version>1.85</version> + <version>1.86</version> <description>The Bouncy Castle Java APIs for the OpenPGP Protocol. The APIs are designed primarily to be used in conjunction with the BC Java provider but may also be used with other providers providing cryptographic services. This jar is designed to work best with Java 1.8 and later.</description> <url>https://www.bouncycastle.org/download/bouncy-castle-java/</url> <licenses> @@ -38,13 +38,13 @@ <dependency> <groupId>org.bouncycastle</groupId> <artifactId>bcprov-jdk18on</artifactId> - <version>1.85</version> + <version>1.86</version> <type>jar</type> </dependency> <dependency> <groupId>org.bouncycastle</groupId> <artifactId>bcutil-jdk18on</artifactId> - <version>1.85</version> + <version>1.86</version> <type>jar</type> </dependency> </dependencies> ++++++ bcpkix-jdk18on-1.85.pom -> bcpkix-jdk18on-1.86.pom ++++++ --- /work/SRC/openSUSE:Factory/bouncycastle/bcpkix-jdk18on-1.85.pom 2026-08-04 21:28:48.944434407 +0200 +++ /work/SRC/openSUSE:Factory/.bouncycastle.new.3698736/bcpkix-jdk18on-1.86.pom 2026-10-09 21:43:02.729425965 +0200 @@ -5,7 +5,7 @@ <artifactId>bcpkix-jdk18on</artifactId> <packaging>jar</packaging> <name>Bouncy Castle PKIX, CMS, EAC, TSP, PKCS, OCSP, CMP, and CRMF APIs</name> - <version>1.85</version> + <version>1.86</version> <description>The Bouncy Castle Java APIs for CMS, PKCS, EAC, TSP, CMP, CRMF, OCSP, and certificate generation. This jar contains APIs for Java 1.8 and later. The APIs are designed primarily to be used in conjunction with the BC Java provider but may also be used with other providers providing cryptographic services.</description> <url>https://www.bouncycastle.org/download/bouncy-castle-java/</url> <licenses> @@ -33,7 +33,7 @@ <dependency> <groupId>org.bouncycastle</groupId> <artifactId>bcutil-jdk18on</artifactId> - <version>1.85</version> + <version>1.86</version> <type>jar</type> </dependency> </dependencies> ++++++ bcprov-jdk18on-1.85.pom -> bcprov-jdk18on-1.86.pom ++++++ --- /work/SRC/openSUSE:Factory/bouncycastle/bcprov-jdk18on-1.85.pom 2026-08-04 21:28:48.972435376 +0200 +++ /work/SRC/openSUSE:Factory/.bouncycastle.new.3698736/bcprov-jdk18on-1.86.pom 2026-10-09 21:43:02.746426678 +0200 @@ -5,8 +5,8 @@ <artifactId>bcprov-jdk18on</artifactId> <packaging>jar</packaging> <name>Bouncy Castle Provider</name> - <version>1.85</version> - <description>The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains the JCA/JCE provider and low-level API for the BC Java version 1.85 for Java 1.8 and later.</description> + <version>1.86</version> + <description>The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains the JCA/JCE provider and low-level API for the BC Java version 1.86 for Java 1.8 and later.</description> <url>https://www.bouncycastle.org/download/bouncy-castle-java/</url> <licenses> <license> ++++++ bctls-jdk18on-1.85.pom -> bctls-jdk18on-1.86.pom ++++++ --- /work/SRC/openSUSE:Factory/bouncycastle/bctls-jdk18on-1.85.pom 2026-08-04 21:28:48.980435653 +0200 +++ /work/SRC/openSUSE:Factory/.bouncycastle.new.3698736/bctls-jdk18on-1.86.pom 2026-10-09 21:43:02.757427139 +0200 @@ -5,7 +5,7 @@ <artifactId>bctls-jdk18on</artifactId> <packaging>jar</packaging> <name>Bouncy Castle TLS/JSSE APIs</name> - <version>1.85</version> + <version>1.86</version> <description>The Bouncy Castle Java APIs for the TLS, including a JSSE provider (except in Java 4). The APIs are designed primarily to be used in conjunction with the BC Java provider but may also be used with other providers providing cryptographic services. This jar is designed to best work with Java 1.8 and later.</description> <url>https://www.bouncycastle.org/download/bouncy-castle-java/</url> <licenses> @@ -33,7 +33,7 @@ <dependency> <groupId>org.bouncycastle</groupId> <artifactId>bcutil-jdk18on</artifactId> - <version>1.85</version> + <version>1.86</version> <type>jar</type> </dependency> </dependencies> ++++++ bcutil-jdk18on-1.85.pom -> bcutil-jdk18on-1.86.pom ++++++ --- /work/SRC/openSUSE:Factory/bouncycastle/bcutil-jdk18on-1.85.pom 2026-08-04 21:28:49.004436484 +0200 +++ /work/SRC/openSUSE:Factory/.bouncycastle.new.3698736/bcutil-jdk18on-1.86.pom 2026-10-09 21:43:02.781428145 +0200 @@ -5,7 +5,7 @@ <artifactId>bcutil-jdk18on</artifactId> <packaging>jar</packaging> <name>Bouncy Castle ASN.1 Extension and Utility APIs</name> - <version>1.85</version> + <version>1.86</version> <description>The Bouncy Castle Java APIs for ASN.1 extension and utility APIs used to support bcpkix and bctls. This jar contains APIs for Java 1.8 and later.</description> <url>https://www.bouncycastle.org/download/bouncy-castle-java/</url> <licenses> @@ -33,7 +33,7 @@ <dependency> <groupId>org.bouncycastle</groupId> <artifactId>bcprov-jdk18on</artifactId> - <version>1.85</version> + <version>1.86</version> <type>jar</type> </dependency> </dependencies> ++++++ bouncycastle-notests.patch ++++++ --- /var/tmp/diff_new_pack.qrvRaz/_old 2026-10-09 21:43:04.899516914 +0200 +++ /var/tmp/diff_new_pack.qrvRaz/_new 2026-10-09 21:43:04.905517166 +0200 @@ -1,8 +1,8 @@ -Index: bc-java-r1rv85/ant/bc+-build.xml +Index: bc-java-r1rv86/ant/bc+-build.xml =================================================================== ---- bc-java-r1rv85.orig/ant/bc+-build.xml -+++ bc-java-r1rv85/ant/bc+-build.xml -@@ -299,7 +299,7 @@ +--- bc-java-r1rv86.orig/ant/bc+-build.xml ++++ bc-java-r1rv86/ant/bc+-build.xml +@@ -302,7 +302,7 @@ </target> @@ -11,7 +11,7 @@ <target name="build-lw" depends="initMacros"> <!-- -@@ -993,153 +993,6 @@ +@@ -1025,174 +1025,6 @@ </target> @@ -35,6 +35,12 @@ - <fileset dir="${src.dir}" includes="**/*AllTests.java" /> - <fileset dir="${src.dir}" includes="**/math/**/*Test.java" /> - <fileset dir="${src.dir}" includes="**/crypto/*/*Test.java" /> +- <fileset dir="${src.dir}" includes="**/crypto/agreement/owl/*Test.java" /> +- <fileset dir="${src.dir}" includes="org/bouncycastle/tls/SpreadCertificateStatusTest.java" /> +- <!-- main-namespace test fixture the bcpg copy now excludes; the openpgp.api tests resolve it from here --> +- <fileset dir="${src.dir}" includes="org/bouncycastle/openpgp/OpenPGPTestKeys.java" /> +- <fileset dir="${src.dir}" includes="**/pqc/crypto/hqc/*Test.java" /> +- <fileset dir="${src.dir}" includes="**/pqc/math/ntru/*Test.java" /> - <fileset dir="${src.dir}" includes="**/tsp/*UnitTest.java" /> - <fileset dir="${src.dir}" includes="**/utiltest/*Test.java" /> - <fileset dir="${src.dir}" includes="**/util/io/pem/*Test.java" /> @@ -72,9 +78,13 @@ - </copy> - - <delete file="${test.target.src.dir}/org/bouncycastle/pqc/crypto/lms/AllTests.java" /> +- <delete file="${test.target.src.dir}/org/bouncycastle/crypto/params/AllTests.java" /> +- <delete file="${test.target.src.dir}/org/bouncycastle/crypto/signers/lms/AllTests.java" /> +- <delete file="${test.target.src.dir}/org/bouncycastle/crypto/signers/xmss/AllTests.java" /> - <delete file="${test.target.src.dir}/org/bouncycastle/pqc/crypto/mayo/AllTests.java" /> - <delete file="${test.target.src.dir}/org/bouncycastle/est/AllTests.java" /> - <delete file="${test.target.src.dir}/org/bouncycastle/gpg/keybox/AllTests.java" /> +- <delete file="${test.target.src.dir}/org/bouncycastle/crypto/agreement/owl/AllTests.java" /> - <delete file="${test.target.src.dir}/org/bouncycastle/x509/CertPathReviewerMessages_de.properties" /> - <delete file="${test.target.src.dir}/org/bouncycastle/x509/CertPathReviewerMessages.properties" /> - @@ -113,6 +123,11 @@ - </fileset> - </classpath> - <sysproperty key="test.java.version.prefix" value="${env.JAVA_VERSION_PREFIX}" /> +- <!-- the PKCS#12 keystore writes with a 600,000 iteration PBE by default and BCFKS +- with a 51,200 iteration PBKDF2, several seconds per store; the tests are not +- measuring the KDF, so write cheap files --> +- <sysproperty key="org.bouncycastle.pkcs12.store_it_count" value="4096" /> +- <sysproperty key="org.bouncycastle.bcfks.store_it_count" value="1024" /> - - <formatter type="xml" /> - <batchtest todir="${artifacts.reports.xml.dir}" unless="testcase"> @@ -142,6 +157,12 @@ - </fileset> - </classpath> - +- <!-- the PKCS#12 keystore writes with a 600,000 iteration PBE by default and BCFKS +- with a 51,200 iteration PBKDF2, several seconds per store; the tests are not +- measuring the KDF, so write cheap files --> +- <sysproperty key="org.bouncycastle.pkcs12.store_it_count" value="4096" /> +- <sysproperty key="org.bouncycastle.bcfks.store_it_count" value="1024" /> +- - <formatter type="xml" /> - <test name="${testcase}" todir="${artifacts.reports.xml.dir}" if="testcase" /> - <batchtest todir="${artifacts.reports.xml.dir}" unless="testcase"> ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-10-06 13:15:59.000000000 +0200 @@ -0,0 +1 @@ +.osc ++++++ r1rv85.tar.gz -> r1rv86.tar.gz ++++++ /work/SRC/openSUSE:Factory/bouncycastle/r1rv85.tar.gz /work/SRC/openSUSE:Factory/.bouncycastle.new.3698736/r1rv86.tar.gz differ: char 12, line 1
