Hello community, here is the log from the commit of package apache2-mod_nss for openSUSE:Factory checked in at 2016-08-05 18:16:40 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/apache2-mod_nss (Old) and /work/SRC/openSUSE:Factory/.apache2-mod_nss.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "apache2-mod_nss" Changes: -------- --- /work/SRC/openSUSE:Factory/apache2-mod_nss/apache2-mod_nss.changes 2016-04-28 16:57:51.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.apache2-mod_nss.new/apache2-mod_nss.changes 2016-08-05 18:16:41.000000000 +0200 @@ -1,0 +2,7 @@ +Fri Jul 29 18:04:55 UTC 2016 - [email protected] + +- use systemd-ask-password to prompt for a certificate passphrase + (bsc#972968) + * drop obsolete mod_nss-bnc863518-reopen_dev_tty.diff + +------------------------------------------------------------------- Old: ---- mod_nss-bnc863518-reopen_dev_tty.diff ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ apache2-mod_nss.spec ++++++ --- /var/tmp/diff_new_pack.BxDyVN/_old 2016-08-05 18:16:42.000000000 +0200 +++ /var/tmp/diff_new_pack.BxDyVN/_new 2016-08-05 18:16:42.000000000 +0200 @@ -51,7 +51,6 @@ BuildRequires: mozilla-nss-tools BuildRequires: pkgconfig -Patch0: mod_nss-bnc863518-reopen_dev_tty.diff Patch1: mod_nss-migrate.patch BuildRoot: %{_tmppath}/%{name}-%{version}-build @@ -72,7 +71,6 @@ %prep %setup -q -n mod_nss-%{version} -%patch0 -p0 -b .mod_nss-bnc863518-reopen_dev_tty.rpmpatch %patch1 -p1 # Touch expression parser sources to prevent regenerating it @@ -136,9 +134,7 @@ %check set +x mkdir -p %{apache_test_module_dir} -# create password file including internal token to suppress -# apache 'builtin dialog', see NSSPassPhraseDialog below -# (http://mcs.une.edu.au/doc/mod_nss/mod_nss.html) +# create password file including internal token to suppress apache 'builtin dialog' cat << EOF > %{apache_test_module_dir}/password.conf internal:httptest EOF ++++++ mod_nss.conf.in ++++++ --- /var/tmp/diff_new_pack.BxDyVN/_old 2016-08-05 18:16:42.000000000 +0200 +++ /var/tmp/diff_new_pack.BxDyVN/_new 2016-08-05 18:16:42.000000000 +0200 @@ -26,7 +26,7 @@ # VirtualHosts on the same IP Address and port is not possible. # # Reason: -# The brwoser/client connects to the web server's port 443 and initializes +# The browser/client connects to the web server's port 443 and initializes # an SSL/TLS handshake. If SSLv3 protocol is used, there is no way for the # client to specify the host that it wants to connect to, unless the crypto # has been fully initialized already. Similarly, the server cannot present @@ -132,8 +132,7 @@ # Configure the pass phrase gathering process. # The filtering dialog program (`builtin' is a internal # terminal dialog) has to provide the pass phrase on stdout. -NSSPassPhraseDialog builtin - +NSSPassPhraseDialog exec:/usr/sbin/apache2-systemd-ask-pass # Pass Phrase Helper: # This helper program stores the token password pins between @@ -188,35 +187,9 @@ # List the ciphers that the client is permitted to negotiate. # See the mod_nss documentation for a complete list. -# SSL 3 ciphers. SSL 2 is disabled -#NSSCipherSuite +rsa_rc4_128_md5,+rsa_rc4_128_sha,+rsa_3des_sha,-rsa_des_sha,-rsa_rc4_40_md5,-rsa_rc2_40_md5,-rsa_null_md5,-rsa_null_sha,+fips_3des_sha,-fips_des_sha,-fortezza,-fortezza_rc4_128_sha,-fortezza_null,-rsa_des_56_sha,-rsa_rc4_56_sha,+rsa_aes_128_sha,+rsa_aes_256_sha - -# The following ciphers are available in SUSE's package after June 2014; -# The GCM mode aes ciphers are of particular interest. -# You may want to add them if so desired: -# -# rsa_aes_128_gcm_sha -# ecdh_ecdsa_aes_128_gcm_sha -# ecdhe_ecdsa_aes_128_gcm_sha -# ecdh_rsa_aes_128_gcm_sha -# ecdhe_rsa_aes_128_gcm_sha - -# SSL 3 ciphers + ECC ciphers. SSL 2 is disabled by default. -# -# Comment out the NSSCipherSuite line above and use the one below if you have -# ECC enabled NSS and mod_nss and want to use Elliptical Curve Cryptography -#NSSCipherSuite +rsa_rc4_128_md5,+rsa_rc4_128_sha,+rsa_3des_sha,-rsa_des_sha,-rsa_rc4_40_md5,-rsa_rc2_40_md5,-rsa_null_md5,-rsa_null_sha,+fips_3des_sha,-fips_des_sha,-fortezza,-fortezza_rc4_128_sha,-fortezza_null,-rsa_des_56_sha,-rsa_rc4_56_sha,+rsa_aes_128_sha,+rsa_aes_256_sha,-ecdh_ecdsa_null_sha,+ecdh_ecdsa_rc4_128_sha,+ecdh_ecdsa_3des_sha,+ecdh_ecdsa_aes_128_sha,+ecdh_ecdsa_aes_256_sha,-ecdhe_ecdsa_null_sha,+ecdhe_ecdsa_rc4_128_sha,+ecdhe_ecdsa_3des_sha,+ecdhe_ecdsa_aes_128_sha,+ecdhe_ecdsa_aes_256_sha,-ecdh_rsa_null_sha,+ecdh_rsa_128_sha,+ecdh_rsa_3des_sha,+ecdh_rsa_aes_128_sha,+ecdh_rsa_aes_256_sha,-echde_rsa_null,+ecdhe_rsa_rc4_128_sha,+ecdhe_rsa_3des_sha,+ecdhe_rsa_aes_128_sha,+ecdhe_rsa_aes_256_sha - -# The following is taken as default with the apache2-mod_nss package, as -# provided with the August 2014 update (which features the GCM mode ciphers -# along with server side SNI support). -# Ideas: -# * cipher mode may be more important than key length -# (AES-GCM is 128 bit, vs AES256 on a different mode) -# * no rc4, no 3des, no des -# * ephemeral is what you want (PFS). -# * EC has precedence over RSA -NSSCipherSuite +ecdhe_ecdsa_aes_128_gcm_sha,+ecdh_ecdsa_aes_128_gcm_sha,+ecdhe_rsa_aes_256_sha,+ecdh_rsa_aes_256_sha,+ecdhe_rsa_aes_128_gcm_sha,+ecdh_rsa_aes_128_gcm_sha,+ecdhe_rsa_aes_128_sha,+ecdh_rsa_aes_128_sha,+rsa_aes_128_gcm_sha,+rsa_aes_256_sha,+rsa_aes_128_sha +# The following cipher suite is the default that comes with mod_nss 1.0.14, +# plus some additional ciphers +NSSCipherSuite +aes_128_sha_256,+aes_256_sha_256,+ecdhe_ecdsa_aes_128_gcm_sha_256,+ecdhe_ecdsa_aes_128_sha,+ecdhe_ecdsa_aes_256_sha,+ecdhe_rsa_aes_128_gcm_sha_256,+ecdhe_rsa_aes_128_sha,+ecdhe_rsa_aes_256_sha,+rsa_aes_128_gcm_sha_256,+rsa_aes_128_sha,+rsa_aes_256_sha,+ecdh_rsa_aes_256_sha,+ecdh_rsa_aes_128_sha # SSL Protocol: # Cryptographic protocols that provide communication security.
