Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package libressl for openSUSE:Factory checked in at 2026-10-24 22:05:30 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/libressl (Old) and /work/SRC/openSUSE:Factory/.libressl.new.2252680 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libressl" Sat Oct 24 22:05:30 2026 rev:76 rq:1392224 version:4.4.0 Changes: -------- --- /work/SRC/openSUSE:Factory/libressl/libressl.changes 2026-10-06 19:17:05.337199313 +0200 +++ /work/SRC/openSUSE:Factory/.libressl.new.2252680/libressl.changes 2026-10-24 22:07:30.574864141 +0200 @@ -1,0 +2,24 @@ +Fri Oct 23 14:01:14 UTC 2026 - Jan Engelhardt <[email protected]> + +- Update to release 4.4.0 + * Removed eMudhra emSign ECC Root CA - G3 from cert.pem + * Enabled SHA assembly on ELF AArch64 with CMake. + * Enabled bignum assembly on RISC-V with autotools. + * Use X25519MLKEM768 as the preferred group for TLSv1.3 + connections in libtls. + * Align X509_check_ca() with modern OpenSSL. While it has long + been documented that it only works after calling + X509_check_purpose(), it still makes sense to "fail closed", + i.e., indicate a non-CA. + * Fix PKCS7_set_{un,}signed_attributes() to allow caller to free + on failure rather than risking a double free. + * Avoid NULL dereference and out-of-bounds read in password-based + CMS decryption. + * Add some missing bounds check to ASN1_mbstrinc_copy(). + * Avoid freeing a caller-owned buffer in PKCS7_verify(). + * Fix parsing issues in X.509 name constraints URI host parsing. + Handle IPv6 literals correctly and don't allow specially + crafted userinfo to bypass host checks. +- Delete enable_pqc.patch (merged) + +------------------------------------------------------------------- Old: ---- enable_pqc.patch libressl-4.3.3.tar.gz libressl-4.3.3.tar.gz.asc New: ---- libressl-4.4.0.tar.gz libressl-4.4.0.tar.gz.asc ----------(Old B)---------- Old: crafted userinfo to bypass host checks. - Delete enable_pqc.patch (merged) ----------(Old E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libressl.spec ++++++ --- /var/tmp/diff_new_pack.1xAEl5/_old 2026-10-24 22:07:31.271893293 +0200 +++ /var/tmp/diff_new_pack.1xAEl5/_new 2026-10-24 22:07:31.274893419 +0200 @@ -17,7 +17,7 @@ Name: libressl -Version: 4.3.3 +Version: 4.4.0 Release: 0 Summary: An SSL/TLS protocol implementation License: OpenSSL @@ -33,7 +33,6 @@ Patch1: des-fcrypt.diff Patch2: extra-symver.diff Patch3: fix_cert_path.patch -Patch4: enable_pqc.patch BuildRequires: automake BuildRequires: fdupes BuildRequires: libtool ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.1xAEl5/_old 2026-10-24 22:07:31.310894924 +0200 +++ /var/tmp/diff_new_pack.1xAEl5/_new 2026-10-24 22:07:31.313895050 +0200 @@ -1,5 +1,5 @@ -mtime: 1791227490 -commit: 1b2ff9db3f7d07a715b2f5badbb3fc45ffdef5764865f2a201c067855f858ed6 +mtime: 1792839979 +commit: e13440d0d1ace4bb1c3c02a36226df7716484fa23356ae3b5d26a2bd59a617cf url: https://src.opensuse.org/jengelh/libressl revision: master ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-10-24 13:06:19.000000000 +0200 @@ -0,0 +1 @@ +.osc ++++++ fix_cert_path.patch ++++++ --- /var/tmp/diff_new_pack.1xAEl5/_old 2026-10-24 22:07:31.452900863 +0200 +++ /var/tmp/diff_new_pack.1xAEl5/_new 2026-10-24 22:07:31.456901031 +0200 @@ -1,19 +1,28 @@ Use the correct filename for cert bundle from ca-certificates package. -Index: libressl-3.2.4/tls/Makefile.am +--- + tls/Makefile.am | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +Index: libressl-4.4.0/tls/Makefile.am =================================================================== ---- libressl-3.2.4.orig/tls/Makefile.am -+++ libressl-3.2.4/tls/Makefile.am -@@ -18,9 +18,9 @@ libtls_la_LIBADD += $(PLATFORM_LDADD) +--- libressl-4.4.0.orig/tls/Makefile.am ++++ libressl-4.4.0/tls/Makefile.am +@@ -54,13 +54,13 @@ libtls_la_LIBADD += $(PLATFORM_LDADD) libtls_la_CPPFLAGS = $(AM_CPPFLAGS) if OPENSSLDIR_DEFINED -libtls_la_CPPFLAGS += -DTLS_DEFAULT_CA_FILE=\"@OPENSSLDIR@/cert.pem\" -+libtls_la_CPPFLAGS += -DTLS_DEFAULT_CA_FILE=\"$(sysconfdir)/ssl/ca-bundle.pem\" ++libtls_la_CPPFLAGS += -DTLS_DEFAULT_CA_FILE=\"@OPENSSLDIR@/ca-bundle.pem\" + else + if HOST_WIN + # See crypto/Makefile.am: keep the default CA file out of a drive-relative path. +-libtls_la_CPPFLAGS += -DTLS_DEFAULT_CA_FILE=\"C:/Windows/libressl/ssl/cert.pem\" ++libtls_la_CPPFLAGS += -DTLS_DEFAULT_CA_FILE=\"C:/Windows/libressl/ssl/ca-bundle.pem\" else -libtls_la_CPPFLAGS += -DTLS_DEFAULT_CA_FILE=\"$(sysconfdir)/ssl/cert.pem\" +libtls_la_CPPFLAGS += -DTLS_DEFAULT_CA_FILE=\"$(sysconfdir)/ssl/ca-bundle.pem\" endif + endif - libtls_la_SOURCES = tls.c ++++++ libressl-4.3.3.tar.gz -> libressl-4.4.0.tar.gz ++++++ /work/SRC/openSUSE:Factory/libressl/libressl-4.3.3.tar.gz /work/SRC/openSUSE:Factory/.libressl.new.2252680/libressl-4.4.0.tar.gz differ: char 26, line 1
