Hello community, here is the log from the commit of package gnutls for openSUSE:Factory checked in at 2016-07-09 09:21:14 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/gnutls (Old) and /work/SRC/openSUSE:Factory/.gnutls.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "gnutls" Changes: -------- --- /work/SRC/openSUSE:Factory/gnutls/gnutls.changes 2016-05-04 08:17:30.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.gnutls.new/gnutls.changes 2016-07-09 09:21:20.000000000 +0200 @@ -1,0 +2,39 @@ +Thu Jun 30 08:38:05 UTC 2016 - [email protected] + +- Fix a problem with expired test certificate by using datefudge + (boo#987139) + * add 0001-tests-use-datefudge-in-name-constraints-test.patch + +------------------------------------------------------------------- +Tue Jun 7 05:52:13 UTC 2016 - [email protected] + +- Version 3.4.13 (released 2016-06-06) + * libgnutls: Consider the SSLKEYLOGFILE environment to be compatible with + NSS instead of using a separate variable; in addition append any keys to + the file instead of overwriting it. + * libgnutls: use secure_getenv() where available to obtain environment + variables. Addresses GNUTLS-SA-2016-1. +- Version 3.4.12 (released 2016-05-20) + * libgnutls: The CHACHA20-POLY1305 ciphersuite is enabled by default. This + cipher is prioritized after AES-GCM. + * libgnutls: Fixes in gnutls_privkey_import_ecc_raw(). + * libgnutls: Fixed gnutls_pkcs11_get_raw_issuer() usage with the + GNUTLS_PKCS11_OBJ_FLAG_OVERWRITE_TRUSTMOD_EXT flag. Previously that + operation could fail on certain PKCS#11 modules. + * libgnutls: gnutls_pkcs11_obj_import_url() and gnutls_x509_crt_import_url() + can accept the GNUTLS_PKCS11_OBJ_FLAG_OVERWRITE_TRUSTMOD_EXT flag. + * libgnutls: gnutls_certificate_set_key() was enhanced to import the DNS + name of the certificates if the provided names are NULL. + * libgnutls: when receiving SNI names, only save and expose to application + the supported DNS names. + * libgnutls: when importing the certificate names at the + gnutls_certificate_set* functions, only consider the CN as a fallback + if DNS names are provided via the alternative name extension. + * gnutls-cli: on OCSP verification do not fail if we have a single valid + reply. Report and reproducer by Thomas Klute. + * libgnutls: The GNUTLS_KEYLOGFILE environment variable can be used to + log session keys in client side. These session keys are compatible with + the NSS Key Log Format and can be used to decrypt the session for + debugging using wireshark. + +------------------------------------------------------------------- Old: ---- gnutls-3.4.11.tar.xz gnutls-3.4.11.tar.xz.sig New: ---- 0001-tests-use-datefudge-in-name-constraints-test.patch gnutls-3.4.13.tar.xz gnutls-3.4.13.tar.xz.sig ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ gnutls.spec ++++++ --- /var/tmp/diff_new_pack.taHfsR/_old 2016-07-09 09:21:23.000000000 +0200 +++ /var/tmp/diff_new_pack.taHfsR/_new 2016-07-09 09:21:23.000000000 +0200 @@ -30,7 +30,7 @@ %bcond_without guile Name: gnutls -Version: 3.4.11 +Version: 3.4.13 Release: 0 Summary: The GNU Transport Layer Security Library License: LGPL-2.1+ and GPL-3.0+ @@ -41,15 +41,18 @@ Source1: ftp://ftp.gnutls.org/gcrypt/gnutls/v3.4/%{name}-%{version}.tar.xz.sig Source2: %name.keyring Source3: baselibs.conf +Patch: 0001-tests-use-datefudge-in-name-constraints-test.patch BuildRequires: autogen BuildRequires: automake +BuildRequires: datefudge BuildRequires: fdupes BuildRequires: gcc-c++ BuildRequires: libidn-devel BuildRequires: libnettle-devel >= 3.1 BuildRequires: libtasn1-devel >= 4.3 BuildRequires: libtool +BuildRequires: net-tools-deprecated %if %{with tpm} BuildRequires: trousers-devel %endif @@ -188,6 +191,7 @@ %prep %setup -q +%patch -p1 %build export LDFLAGS="-pie" ++++++ 0001-tests-use-datefudge-in-name-constraints-test.patch ++++++ >From cc22a052f40ba800acde7d81fe0ab91b56e66921 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos <[email protected]> Date: Wed, 29 Jun 2016 17:25:06 +0200 Subject: [PATCH] tests: use datefudge in name-constraints test This avoids the expiration of the used certificate to affect the test. --- tests/cert-tests/name-constraints | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) Index: gnutls-3.4.13/tests/cert-tests/name-constraints =================================================================== --- gnutls-3.4.13.orig/tests/cert-tests/name-constraints 2016-06-30 11:11:35.920632613 +0200 +++ gnutls-3.4.13/tests/cert-tests/name-constraints 2016-06-30 11:13:06.633974903 +0200 @@ -28,7 +28,12 @@ if ! test -z "${VALGRIND}"; then fi TMPFILE=tmp.$$.pem -${VALGRIND} "${CERTTOOL}" -e --infile "${srcdir}/name-constraints-ip.pem" +. ${srcdir}/../scripts/common.sh + +check_for_datefudge + +datefudge -s "2016-04-22" \ + ${VALGRIND} "${CERTTOOL}" -e --infile "${srcdir}/name-constraints-ip.pem" rc=$? if test "${rc}" != "0"; then ++++++ gnutls-3.4.11.tar.xz -> gnutls-3.4.13.tar.xz ++++++ /work/SRC/openSUSE:Factory/gnutls/gnutls-3.4.11.tar.xz /work/SRC/openSUSE:Factory/.gnutls.new/gnutls-3.4.13.tar.xz differ: char 26, line 1
