Hello community, here is the log from the commit of package gpg2 for openSUSE:Factory checked in at 2013-05-16 15:35:19 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/gpg2 (Old) and /work/SRC/openSUSE:Factory/.gpg2.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "gpg2" Changes: -------- --- /work/SRC/openSUSE:Factory/gpg2/gpg2.changes 2013-05-16 10:59:33.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.gpg2.new/gpg2.changes 2013-05-16 15:35:21.000000000 +0200 @@ -1,0 +2,8 @@ +Tue May 14 14:00:45 UTC 2013 - [email protected] + +- set safe umask before creating a plaintext file (bnc#780943) + added gpg2-set_umask_before_open_outfile.patch +- select proper ciphers when running in FIPS mode (bnc#808958) + added gnupg-detect_FIPS_mode.patch + +------------------------------------------------------------------- New: ---- gnupg-detect_FIPS_mode.patch gnupg-set_umask_before_open_outfile.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ gpg2.spec ++++++ --- /var/tmp/diff_new_pack.iUuveU/_old 2013-05-16 15:35:22.000000000 +0200 +++ /var/tmp/diff_new_pack.iUuveU/_new 2013-05-16 15:35:22.000000000 +0200 @@ -64,6 +64,9 @@ Patch5: gnupg-2.0.18-files-are-digests.patch Patch6: gnupg-dont-fail-with-seahorse-agent.patch Patch7: gnupg-broken-curl-test.patch +Patch8: gnupg-set_umask_before_open_outfile.patch +Patch9: gnupg-detect_FIPS_mode.patch + BuildRoot: %{_tmppath}/%{name}-%{version}-build %description @@ -81,6 +84,8 @@ %patch5 -p1 %patch6 -p1 %patch7 -p1 +%patch8 -p1 +%patch9 -p1 %build autoreconf -fi ++++++ gnupg-detect_FIPS_mode.patch ++++++ Index: gnupg-2.0.19/g10/encode.c =================================================================== --- gnupg-2.0.19.orig/g10/encode.c 2013-03-14 14:23:58.009483967 +0100 +++ gnupg-2.0.19/g10/encode.c 2013-03-14 15:49:50.524306304 +0100 @@ -732,7 +732,10 @@ encrypt_filter( void *opaque, int contro if( efx->cfx.dek->algo == -1 ) { /* because 3DES is implicitly in the prefs, this can only * happen if we do not have any public keys in the list */ - efx->cfx.dek->algo = DEFAULT_CIPHER_ALGO; + /* Libgcrypt manual says that gcry_version_check must be called + before calling gcry_fips_mode_active. */ + gcry_check_version (NULL); + efx->cfx.dek->algo = gcry_fips_mode_active() ? CIPHER_ALGO_AES : DEFAULT_CIPHER_ALGO; } /* In case 3DES has been selected, print a warning if Index: gnupg-2.0.19/g10/gpg.c =================================================================== --- gnupg-2.0.19.orig/g10/gpg.c 2013-03-14 14:24:00.031545611 +0100 +++ gnupg-2.0.19/g10/gpg.c 2013-03-14 14:24:37.495687612 +0100 @@ -1975,7 +1975,7 @@ main (int argc, char **argv) opt.compress_algo = -1; /* defaults to DEFAULT_COMPRESS_ALGO */ opt.s2k_mode = 3; /* iterated+salted */ opt.s2k_count = 0; /* Auto-calibrate when needed. */ - opt.s2k_cipher_algo = CIPHER_ALGO_CAST5; + opt.s2k_cipher_algo = gcry_fips_mode_active() ? CIPHER_ALGO_AES : CIPHER_ALGO_CAST5; opt.completes_needed = 1; opt.marginals_needed = 3; opt.max_cert_depth = 5; Index: gnupg-2.0.19/g10/mainproc.c =================================================================== --- gnupg-2.0.19.orig/g10/mainproc.c 2013-03-14 14:23:58.011484028 +0100 +++ gnupg-2.0.19/g10/mainproc.c 2013-03-14 15:50:50.970127383 +0100 @@ -685,9 +685,15 @@ proc_plaintext( CTX c, PACKET *pkt ) often. There is no good way to specify what algorithms to use in that case, so these three are the historical answer. */ - gcry_md_enable( c->mfx.md, DIGEST_ALGO_RMD160 ); + + /* Libgcrypt manual says that gcry_version_check must be called + before calling gcry_fips_mode_active. */ + gcry_check_version (NULL); + if( !gcry_fips_mode_active() ) + gcry_md_enable( c->mfx.md, DIGEST_ALGO_RMD160 ); gcry_md_enable( c->mfx.md, DIGEST_ALGO_SHA1 ); - gcry_md_enable( c->mfx.md, DIGEST_ALGO_MD5 ); + if( !gcry_fips_mode_active() ) + gcry_md_enable( c->mfx.md, DIGEST_ALGO_MD5 ); } if( opt.pgp2_workarounds && only_md5 && !opt.skip_verify ) { /* This is a kludge to work around a bug in pgp2. It does only ++++++ gnupg-set_umask_before_open_outfile.patch ++++++ Index: gnupg-2.0.20/g10/plaintext.c =================================================================== --- gnupg-2.0.20.orig/g10/plaintext.c 2013-05-13 14:26:49.290737159 +0200 +++ gnupg-2.0.20/g10/plaintext.c 2013-05-13 14:43:21.740575875 +0200 @@ -25,6 +25,7 @@ #include <errno.h> #include <assert.h> #include <sys/types.h> +#include <sys/stat.h> #ifdef HAVE_DOSISH_SYSTEM #include <fcntl.h> /* for setmode() */ #endif @@ -39,6 +40,9 @@ #include "status.h" #include "i18n.h" +/* define safe permissions for creating plaintext files */ +#define GPG_SAFE_PERMS (S_IRUSR | S_IWUSR) +#define GPG_SAFE_UMASK (0777 & ~GPG_SAFE_PERMS) /**************** * Handle a plaintext packet. If MFX is not NULL, update the MDs @@ -140,10 +144,15 @@ handle_plaintext( PKT_plaintext *pt, md_ log_error(_("error creating `%s': %s\n"), fname, strerror(errno) ); goto leave; } - else if( !(fp = fopen(fname,"wb")) ) { - rc = gpg_error_from_syserror (); - log_error(_("error creating `%s': %s\n"), fname, strerror(errno) ); - goto leave; + else { + mode_t saved_umask = umask(GPG_SAFE_UMASK); + if( !(fp = fopen(fname,"wb")) ) { + rc = gpg_error_from_syserror (); + log_error(_("error creating `%s': %s\n"), fname, strerror(errno) ); + umask(saved_umask); + goto leave; + } + umask(saved_umask); } #else /* __riscos__ */ /* If no output filename was given, i.e. we constructed it, -- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
