Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package perl-Mail-SPF for openSUSE:Factory checked in at 2026-11-09 16:03:14 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/perl-Mail-SPF (Old) and /work/SRC/openSUSE:Factory/.perl-Mail-SPF.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "perl-Mail-SPF" Mon Nov 9 16:03:14 2026 rev:27 rq:1396020 version:3.202.611.50 Changes: -------- --- /work/SRC/openSUSE:Factory/perl-Mail-SPF/perl-Mail-SPF.changes 2026-04-10 17:43:11.973557930 +0200 +++ /work/SRC/openSUSE:Factory/.perl-Mail-SPF.new.3759290/perl-Mail-SPF.changes 2026-11-09 16:03:23.285654616 +0100 @@ -1,0 +2,118 @@ +Fri Nov 6 11:33:19 UTC 2026 - Tina Müller <[email protected]> + +- updated to 3.202.611.50 (3.20261105) + see /usr/share/doc/packages/perl-Mail-SPF/Changes + + 3.20261105 2026-11-06 Australia/Melbourne + ** Thanks to Giovanni <[email protected]> for these changes: + - RFC 7208 says there MUST be a limit of no more than 10 MX records + looked up and checked; throw a permerror when the limit is exceeded + instead of silently truncating the list + - RFC 7208 says implementations SHOULD limit "void lookups" to two; + enable the corresponding regression tests + - Ensure every module's $VERSION is set by Dist::Zilla at release time, + and manage the version number in README the same way + - Security: escape untrusted text in the Received-SPF header to + prevent header field injection: + - escape parentheses and backslashes in the explanation comment, + so text from a malformed SPF record or the sender identity can + no longer close the comment early and inject forged fields such + as client-ip= + - escape control characters (e.g. CR/LF) in the envelope-from and + helo fields + - Fix macro expansion stopping at the first line break in a macro + string, leaving later macros unexpanded + - Security: authority_explanation now escapes control and non-ASCII + characters in the explanation string (exp= TXT record) published in + DNS, and document that the result text() may contain untrusted data + - Remove the check for includes of the same domain through CNAME + aliases. Including a domain and a CNAME alias of it is legal in + RFC 7208, but the check tried to throw a hard fail for it. With + a real resolver it read an unpopulated Net::DNS internal field and + so in practice did nothing, but where it did take effect (e.g. + with Net::DNS::Resolver::Programmable) it could wrongly fail + authorized senders, and it used CNAME targets from DNS as + unescaped regular expressions, which could make process() die. + It also made an extra CNAME lookup per include that was not + counted towards the RFC 7208 DNS lookup and void lookup limits. + The test suite's resolver now follows CNAMEs, which is what the + RFC 7208 cname-aliasing test case needed + - Security: an exception thrown by the DNS resolver, including + Net::DNS refusing to compose a query for an invalid domain name, + made the SPF result none, i.e. no policy, rather than temperror. + As invalid names can come from macros expanded with the sender's + local part or HELO name, a sender could turn a domain's -all + policy into none. Invalid domain names (empty label, label longer + than 63 bytes, or name longer than 253 bytes, counted the way + Net::DNS does, i.e. in bytes of UTF-8 and reading escapes such as + "\.") are now treated as non-existent without querying the + resolver, per RFC 7208, and other resolver exceptions result in + temperror + - Check the IP address version in the ip6 mechanism using the public + NetAddr::IP API, rather than enumerating the request's address via + an overloaded array dereference and reading an internal field, + which died if the request's IP address was a large network + - Allow Mail::SPF::Server->process() to evaluate a proposed SPF record + passed in via a new 'record' option, instead of querying DNS for the + authority domain's record, so a not-yet-published record can be tested + against real DNS state + - Prefer SPF1 over SPF2 (Sender ID, which is deprecated) when a record + could be parsed as either + - When a domain publishes both "v=spf1" and "spf2.0" records, always + select the "v=spf1" record. Previously the record was chosen by the + order of the records in the DNS answer, so the result could vary + between queries, although the documentation and RFC 4406 said + "spf2.0" records were preferred. Sender ID is historic (RFC 6686), + so "v=spf1" is now deliberately preferred + - Security: a "p" macro in an explanation string (exp= TXT record) + made a PTR look-up and up to 10 A/AAAA look-ups for every + occurrence, not limited by the RFC 7208 DNS look-up limits, so a + sender could make a single SPF check send thousands of DNS + queries. The "p" macro value is now looked up at most once per SPF + check and authority domain. Also, exceeding the void look-up limit + while expanding the explanation made authority_explanation() die; + it now falls back to the default explanation + - Reject a network (e.g. '10.0.0.0/8') as a request's ip_address + with an EInvalidOptionValue exception. NetAddr::IP accepted it, + which made no sense for SPF and changed the meaning of the + mechanisms' address checks + - Ignore an explanation string (exp= TXT record) that contains + anything other than printable ASCII characters and spaces, as + RFC 7208 requires, and use the default explanation instead. + Control characters were already escaped, but an MTA using the + explanation in an SMTP reply would still have sent the escaped + text of a malicious explanation + - Return none without querying DNS when the identity's domain is + empty (e.g. "MAIL FROM:<a@>", which queried the root zone) or a + single-label name (e.g. "HELO mailhost", which the resolver may + expand with its search list and so query the receiver's internal + domains), as RFC 7208 requires + - Security: spfd now escapes control characters in the values of + its response, so text from DNS or the client cannot add lines to + the response, and in its debug output + - Security: fix spfd's privilege dropping with --set-user and + --set-group. An unknown user or group name was not reported (due to + an operator precedence bug) and could leave spfd running as root, + the invoking user's supplementary groups (e.g. root's) were kept, + and --set-user without --set-group kept group ID 0. spfd now dies on + unknown names, drops the supplementary groups when started as root, + and changes to the user's primary group if no group is given + - Security: limit spfd to 64 concurrent connections, 60 seconds per + connection, and 32 request lines of at most 1024 bytes, so a local + client can no longer exhaust the process table or memory with idle, + slow or overlong requests. A request still being processed after 60 + seconds (e.g. because DNS servers are unreachable) gets a temperror + result. spfd now also logs non-Mail::SPF errors + for a request, and no longer runs the child's code in the listening + process if fork() fails + - Security: spfd now creates its UNIX socket accessible to its owner + only until --socket-user, --socket-group and --socket-perms have + been applied, so other users can't connect to it in the meantime. + Fix --socket-group being ignored unless --socket-user was also + given (a typo compared the socket path instead of the group), and + die with a clear message if the listening socket can't be created + - Security: spfquery now opens the --file argument in explicit read + mode. A file name ending in "|" was run as a shell command, and one + starting with ">" truncated the file + +------------------------------------------------------------------- Old: ---- Mail-SPF-3.20260331.tar.gz New: ---- Mail-SPF-3.20261105.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ perl-Mail-SPF.spec ++++++ --- /var/tmp/diff_new_pack.96HrhF/_old 2026-11-09 16:03:24.157691169 +0100 +++ /var/tmp/diff_new_pack.96HrhF/_new 2026-11-09 16:03:24.159691253 +0100 @@ -18,10 +18,10 @@ %define cpan_name Mail-SPF Name: perl-Mail-SPF -Version: 3.202.603.310 +Version: 3.202.611.50 Release: 0 -# 3.20260331 -> normalize -> 3.202.603.310 -%define cpan_version 3.20260331 +# 3.20261105 -> normalize -> 3.202.611.50 +%define cpan_version 3.20261105 License: BSD-3-Clause Summary: An object-oriented implementation of Sender Policy Framework URL: https://metacpan.org/release/%{cpan_name} @@ -33,17 +33,21 @@ BuildRequires: perl BuildRequires: perl-macros BuildRequires: perl(Error) +BuildRequires: perl(Net::DNS::DomainName) +BuildRequires: perl(Net::DNS::Packet) BuildRequires: perl(Net::DNS::RR) BuildRequires: perl(Net::DNS::Resolver) BuildRequires: perl(Net::DNS::Resolver::Programmable) BuildRequires: perl(NetAddr::IP) BuildRequires: perl(URI::Escape) >= 1.130 Requires: perl(Error) +Requires: perl(Net::DNS::DomainName) +Requires: perl(Net::DNS::Packet) Requires: perl(Net::DNS::Resolver) Requires: perl(NetAddr::IP) Requires: perl(URI::Escape) >= 1.130 Provides: perl(Mail::SPF) = %{version} -Provides: perl(Mail::SPF::Base) +Provides: perl(Mail::SPF::Base) = %{version} Provides: perl(Mail::SPF::EAbstractClass) Provides: perl(Mail::SPF::EClassMethod) Provides: perl(Mail::SPF::EDNSError) @@ -77,25 +81,25 @@ Provides: perl(Mail::SPF::ETermIPv6AddressExpected) Provides: perl(Mail::SPF::ETermIPv6PrefixLengthExpected) Provides: perl(Mail::SPF::EUnexpectedTermObject) -Provides: perl(Mail::SPF::Exception) +Provides: perl(Mail::SPF::Exception) = %{version} Provides: perl(Mail::SPF::GlobalMod) -Provides: perl(Mail::SPF::MacroString) -Provides: perl(Mail::SPF::Mech) -Provides: perl(Mail::SPF::Mech::A) -Provides: perl(Mail::SPF::Mech::All) -Provides: perl(Mail::SPF::Mech::Exists) -Provides: perl(Mail::SPF::Mech::IP4) -Provides: perl(Mail::SPF::Mech::IP6) -Provides: perl(Mail::SPF::Mech::Include) -Provides: perl(Mail::SPF::Mech::MX) -Provides: perl(Mail::SPF::Mech::PTR) -Provides: perl(Mail::SPF::Mod) -Provides: perl(Mail::SPF::Mod::Exp) -Provides: perl(Mail::SPF::Mod::Redirect) +Provides: perl(Mail::SPF::MacroString) = %{version} +Provides: perl(Mail::SPF::Mech) = %{version} +Provides: perl(Mail::SPF::Mech::A) = %{version} +Provides: perl(Mail::SPF::Mech::All) = %{version} +Provides: perl(Mail::SPF::Mech::Exists) = %{version} +Provides: perl(Mail::SPF::Mech::IP4) = %{version} +Provides: perl(Mail::SPF::Mech::IP6) = %{version} +Provides: perl(Mail::SPF::Mech::Include) = %{version} +Provides: perl(Mail::SPF::Mech::MX) = %{version} +Provides: perl(Mail::SPF::Mech::PTR) = %{version} +Provides: perl(Mail::SPF::Mod) = %{version} +Provides: perl(Mail::SPF::Mod::Exp) = %{version} +Provides: perl(Mail::SPF::Mod::Redirect) = %{version} Provides: perl(Mail::SPF::PositionalMod) -Provides: perl(Mail::SPF::Record) -Provides: perl(Mail::SPF::Request) -Provides: perl(Mail::SPF::Result) +Provides: perl(Mail::SPF::Record) = %{version} +Provides: perl(Mail::SPF::Request) = %{version} +Provides: perl(Mail::SPF::Result) = %{version} Provides: perl(Mail::SPF::Result::Error) Provides: perl(Mail::SPF::Result::Fail) Provides: perl(Mail::SPF::Result::Neutral) @@ -105,13 +109,13 @@ Provides: perl(Mail::SPF::Result::PermError) Provides: perl(Mail::SPF::Result::SoftFail) Provides: perl(Mail::SPF::Result::TempError) -Provides: perl(Mail::SPF::SenderIPAddrMech) -Provides: perl(Mail::SPF::Server) -Provides: perl(Mail::SPF::Term) +Provides: perl(Mail::SPF::SenderIPAddrMech) = %{version} +Provides: perl(Mail::SPF::Server) = %{version} +Provides: perl(Mail::SPF::Term) = %{version} Provides: perl(Mail::SPF::UnknownMod) -Provides: perl(Mail::SPF::Util) -Provides: perl(Mail::SPF::v1::Record) -Provides: perl(Mail::SPF::v2::Record) +Provides: perl(Mail::SPF::Util) = %{version} +Provides: perl(Mail::SPF::v1::Record) = %{version} +Provides: perl(Mail::SPF::v2::Record) = %{version} %undefine __perllib_provides %{perl_requires} ++++++ Mail-SPF-3.20260331.tar.gz -> Mail-SPF-3.20261105.tar.gz ++++++ ++++ 2437 lines of diff (skipped) ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.96HrhF/_old 2026-11-09 16:03:24.280696326 +0100 +++ /var/tmp/diff_new_pack.96HrhF/_new 2026-11-09 16:03:24.283696451 +0100 @@ -1,6 +1,6 @@ -mtime: 1775026697 -commit: 68b3c5f38688a1c5ee1c7fad912388795e72f7380497c1e11be1a328eb2bf15b -url: https://src.opensuse.org/perl/perl-Mail-SPF.git -revision: 68b3c5f38688a1c5ee1c7fad912388795e72f7380497c1e11be1a328eb2bf15b +mtime: 1793964799 +commit: 995b015acc7b0bb4dd901a9b6fb08e173aeb100ba903e386bd87cd645cb718a1 +url: https://src.opensuse.org/perl/perl-Mail-SPF +revision: 995b015acc7b0bb4dd901a9b6fb08e173aeb100ba903e386bd87cd645cb718a1 projectscmsync: https://src.opensuse.org/perl/_ObsPrj ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-11-06 12:33:19.000000000 +0100 @@ -0,0 +1 @@ +.osc
