Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package lastpass-cli for openSUSE:Factory checked in at 2026-10-21 20:57:11 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/lastpass-cli (Old) and /work/SRC/openSUSE:Factory/.lastpass-cli.new.2252680 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "lastpass-cli" Wed Oct 21 20:57:11 2026 rev:2 rq:1386617 version:1.6.2 Changes: -------- --- /work/SRC/openSUSE:Factory/lastpass-cli/lastpass-cli.changes 2026-08-14 22:08:12.959700341 +0200 +++ /work/SRC/openSUSE:Factory/.lastpass-cli.new.2252680/lastpass-cli.changes 2026-10-21 20:58:35.455758633 +0200 @@ -1,0 +2,15 @@ +Tue Oct 20 17:28:03 UTC 2026 - Martin Pluskal <[email protected]> + +- Update to version 1.6.2 (boo#1286229): + * Removed certificate pinning; TLS validation now uses the system + trust store. Upgrading is required before LastPass moves to the + GlobalSign R46/E46 chain. + * Fixed `share userdel` failing to remove groups from shared folders. + * Fixed `share usermod` failing to update groups in shared folders. + * Fixed `Error: Could not unbase64 the given bytes` when showing a + password. + * Fixed `add --note-type` always creating a Secure Note instead of + the requested type. +- Drop lastpass-cli-skip-placeholder-attachkey.patch: adopted upstream. + +------------------------------------------------------------------- Old: ---- lastpass-cli-1.6.1.tar.gz lastpass-cli-skip-placeholder-attachkey.patch New: ---- lastpass-cli-1.6.2.tar.gz ----------(Old B)---------- Old: the requested type. - Drop lastpass-cli-skip-placeholder-attachkey.patch: adopted upstream. ----------(Old E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ lastpass-cli.spec ++++++ --- /var/tmp/diff_new_pack.jJQXDc/_old 2026-10-21 20:58:36.218790622 +0200 +++ /var/tmp/diff_new_pack.jJQXDc/_new 2026-10-21 20:58:36.221790747 +0200 @@ -17,14 +17,12 @@ Name: lastpass-cli -Version: 1.6.1 +Version: 1.6.2 Release: 0 Summary: LastPass command line interface tool License: GPL-2.0-only URL: https://github.com/LastPass/lastpass-cli Source: https://github.com/lastpass/lastpass-cli/archive/v%{version}.tar.gz#/%{name}-%{version}.tar.gz -# PATCH-FIX-UPSTREAM lastpass-cli-skip-placeholder-attachkey.patch gh#lastpass/lastpass-cli#718 -- do not base64-decode the literal "skipped" placeholder that blob_write() stores in the attachment-key field -Patch0: lastpass-cli-skip-placeholder-attachkey.patch BuildRequires: asciidoc BuildRequires: cmake BuildRequires: gcc-c++ ++++++ lastpass-cli-1.6.1.tar.gz -> lastpass-cli-1.6.2.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/lastpass-cli-1.6.1/blob.c new/lastpass-cli-1.6.2/blob.c --- old/lastpass-cli-1.6.1/blob.c 2024-11-14 10:40:56.000000000 +0100 +++ new/lastpass-cli-1.6.2/blob.c 2026-10-15 17:17:46.000000000 +0200 @@ -1,7 +1,7 @@ /* * encrypted vault parsing * - * Copyright (C) 2014-2024 LastPass. + * Copyright (C) 2014-2025 LastPass. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -134,7 +134,6 @@ return !strcmp(account->url, "http://group";); } -static bool account_is_secure_note(const struct account *account) { return !strcmp(account->url, "http://sn";); @@ -407,7 +406,7 @@ if (parsed->group[0] == 16) parsed->group[0] = '\0'; - if (strlen(parsed->attachkey_encrypted)) { + if ((strlen(parsed->attachkey_encrypted) && strcmp(parsed->attachkey_encrypted, "skipped") != 0)) { parsed->attachkey = cipher_aes_decrypt_base64( parsed->attachkey_encrypted, key); } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/lastpass-cli-1.6.1/blob.h new/lastpass-cli-1.6.2/blob.h --- old/lastpass-cli-1.6.1/blob.h 2024-11-14 10:40:56.000000000 +0100 +++ new/lastpass-cli-1.6.2/blob.h 2026-10-15 17:17:46.000000000 +0200 @@ -172,6 +172,7 @@ void account_assign_share(struct blob *blob, struct account *account, unsigned const char key[KDF_HASH_LEN], const struct feature_flag *feature_flag); void account_reencrypt(struct account *account, const unsigned char key[KDF_HASH_LEN], const struct feature_flag *feature_flag); bool account_is_group(struct account *account); +bool account_is_secure_note(const struct account *account); void field_set_value(struct account *account, struct field *field, char *value, unsigned const char key[KDF_HASH_LEN]); struct account *notes_expand(struct account *acc); struct account *notes_collapse(struct account *acc); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/lastpass-cli-1.6.1/endpoints-share.c new/lastpass-cli-1.6.2/endpoints-share.c --- old/lastpass-cli-1.6.1/endpoints-share.c 2024-11-14 10:40:56.000000000 +0100 +++ new/lastpass-cli-1.6.2/endpoints-share.c 2026-10-15 17:17:46.000000000 +0200 @@ -44,6 +44,18 @@ #include <errno.h> #include <curl/curl.h> +static inline void get_share_user_id(struct share_user *user, char **user_id) +{ + if (user->is_group) + { + xasprintf(user_id, "group:%s", user->uid); + } + else + { + xasprintf(user_id, "%s", user->uid); + } +} + int lastpass_share_getinfo(const struct session *session, const char *shareid, struct list_head *users) { @@ -197,17 +209,21 @@ _cleanup_free_ char *reply = NULL; size_t len; + _cleanup_free_ char *user_id = NULL; + + get_share_user_id(user, &user_id); + reply = http_post_lastpass("share.php", session, &len, "token", session->token, "id", share->id, "up", "1", "edituser", "1", - "uid", user->uid, + "uid", user_id, "readonly", user->read_only ? "on" : "", "give", !user->hide_passwords ? "on" : "", "canadminister", user->admin ? "on" : "", "xmlr", "1", NULL); - + if (!reply) return -EPERM; @@ -219,13 +235,17 @@ { char *reply = NULL; size_t len; + + _cleanup_free_ char *user_id = NULL; + get_share_user_id(user, &user_id); + reply = http_post_lastpass("share.php", session, &len, "token", session->token, "id", shareid, "update", "1", "delete", "1", - "uid", user->uid, + "uid", user_id, "xmlr", "1", NULL); free(reply); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/lastpass-cli-1.6.1/endpoints.c new/lastpass-cli-1.6.2/endpoints.c --- old/lastpass-cli-1.6.1/endpoints.c 2024-11-14 10:40:56.000000000 +0100 +++ new/lastpass-cli-1.6.2/endpoints.c 2026-10-15 17:17:46.000000000 +0200 @@ -1,7 +1,7 @@ /* * https endpoints for LastPass services * - * Copyright (C) 2014-2024 LastPass. + * Copyright (C) 2014-2025 LastPass. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -40,6 +40,7 @@ #include "config.h" #include "util.h" #include "upload-queue.h" +#include "blob.h" #include <string.h> #include <errno.h> #include <curl/curl.h> @@ -214,23 +215,18 @@ upload_queue_enqueue(sync, key, session, "addapp.php", ¶ms); goto out_free_params; } + + http_post_add_params(¶ms, + "aid", account->id, + "username", account->username_encrypted, + "password", account->password_encrypted, + "extra", account->note_encrypted, + NULL); - if (session->feature_flag.url_encryption_enabled) { - http_post_add_params(¶ms, - "aid", account->id, - "url", account->url_encrypted, - "username", account->username_encrypted, - "password", account->password_encrypted, - "extra", account->note_encrypted, - NULL); + if (session->feature_flag.url_encryption_enabled && !account_is_secure_note(account)) { + http_post_add_params(¶ms, "url", account->url_encrypted, NULL); } else { - http_post_add_params(¶ms, - "aid", account->id, - "url", url, - "username", account->username_encrypted, - "password", account->password_encrypted, - "extra", account->note_encrypted, - NULL); + http_post_add_params(¶ms, "url", url, NULL); } if (strlen(fields)) { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/lastpass-cli-1.6.1/http.c new/lastpass-cli-1.6.2/http.c --- old/lastpass-cli-1.6.1/http.c 2024-11-14 10:40:56.000000000 +0100 +++ new/lastpass-cli-1.6.2/http.c 2026-10-15 17:17:46.000000000 +0200 @@ -37,14 +37,11 @@ #include "log.h" #include "util.h" #include "version.h" -#include "pins.h" -#include "cipher.h" #include <stdarg.h> #include <stdint.h> #include <errno.h> #include <string.h> #include <signal.h> -#include <openssl/ssl.h> #include <curl/curl.h> struct mem_chunk { @@ -102,71 +99,6 @@ return len; } - -static char *hash_subject_pubkey_info(X509 *cert) -{ - _cleanup_free_ unsigned char *spki = NULL; - char *hash = NULL; - EVP_PKEY *pkey; - int len; - - pkey = X509_get_pubkey(cert); - if (!pkey) - return NULL; - - len = i2d_PUBKEY(pkey, &spki); - if (len <= 0) - goto free_pkey; - - hash = cipher_sha256_b64(spki, len); -free_pkey: - EVP_PKEY_free(pkey); - return hash; -} - -static int verify_callback(int preverify_ok, X509_STORE_CTX *ctx) -{ - int i, j; - - /* - * Preverify checks the platform's certificate store; don't - * allow any chain that doesn't already validate according to - * that. - */ - if (!preverify_ok) - return 0; - - /* check each certificate in the chain against our built-in pinlist. */ - STACK_OF(X509) *chain = X509_STORE_CTX_get_chain(ctx); - if (!chain) - die("No certificate chain available"); - - bool found = false; - for (i=0; i < sk_X509_num(chain); i++) { - _cleanup_free_ char *spki_hash = NULL; - spki_hash = hash_subject_pubkey_info(sk_X509_value(chain, i)); - if (!spki_hash) - continue; - - for (j=0; j < (int) ARRAY_SIZE(PK_PINS); j++) { - if (strcmp(PK_PINS[j], spki_hash) == 0) { - found = true; - break; - } - } - } - - return found; -} - -static CURLcode pin_keys(CURL *curl, void *sslctx, void *parm) -{ - UNUSED(curl); - UNUSED(parm); - SSL_CTX_set_verify((SSL_CTX *)sslctx, SSL_VERIFY_PEER, - verify_callback); - return CURLE_OK; -} #endif static @@ -297,7 +229,6 @@ #else curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 2); curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1); - curl_easy_setopt(curl, CURLOPT_SSL_CTX_FUNCTION, pin_keys); #endif curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_data); curl_easy_setopt(curl, CURLOPT_WRITEDATA, &result); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/lastpass-cli-1.6.1/pins.h new/lastpass-cli-1.6.2/pins.h --- old/lastpass-cli-1.6.1/pins.h 2024-11-14 10:40:56.000000000 +0100 +++ new/lastpass-cli-1.6.2/pins.h 1970-01-01 01:00:00.000000000 +0100 @@ -1,17 +0,0 @@ -#ifndef PINS_H -#define PINS_H -const char *PK_PINS[] = { - /* future lastpass root CA (GlobalSign R1) */ - "K87oWBWM9UZfyddvDfoxL+8lpNyoUB2ptGtn0fv6G2Q=", - /* future lastpass root CA (GlobalSign R2) */ - "iie1VXtL7HzAMF+/PVPR9xzT80kQxdZeJ+zduCB3uj0=", - /* future lastpass root CA (GlobalSign R3) */ - "cGuxAXyFXFkWm61cF4HPWX8S0srS9j0aSqN0k4AP+4A=", - /* current lastpass.com primary (leaf) */ - "YDjIAXSYj+mh+25FGifAiKN4oNOAj+as6gQv4naQG0M=", - /* current lastpass.eu primary (leaf) */ - "SjMnNhjAyVM5Yv6O5JaQgNygBTU0wdb8Jz3mfQfTc28=", - /* GlobalSign ECC OV SSL CA 2018 intermediate CA */ - "OD/WDbD3VsfMwwNzzy9MWd9JXppKB77Vb3ST2wn9meg=" -}; -#endif
