October 2023 - openSUSE Commits - openSUSE Mailing Lists

commit libwebp for openSUSE:Factory
by Source-Sync 02 Oct '23

02 Oct '23

Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package libwebp for openSUSE:Factory checked in at 2023-10-02 20:04:08 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/libwebp (Old) and /work/SRC/openSUSE:Factory/.libwebp.new.28202 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "libwebp" Mon Oct 2 20:04:08 2023 rev:39 rq:1114613 version:1.3.2 Changes: -------- --- /work/SRC/openSUSE:Factory/libwebp/libwebp.changes 2023-09-17 19:29:23.373776197 +0200 +++ /work/SRC/openSUSE:Factory/.libwebp.new.28202/libwebp.changes 2023-10-02 20:04:32.390647352 +0200 @@ -1,0 +2,6 @@ +Wed Sep 27 20:37:54 UTC 2023 - Andreas Stieger <andreas.stieger(a)gmx.de> + +- Add 0001-Fix-invalid-incremental-decoding-check.patch + A fuzzing finding fixed in the SLE/Leap updates + +------------------------------------------------------------------- New: ---- 0001-Fix-invalid-incremental-decoding-check.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libwebp.spec ++++++ --- /var/tmp/diff_new_pack.5Os1T1/_old 2023-10-02 20:04:33.678693674 +0200 +++ /var/tmp/diff_new_pack.5Os1T1/_new 2023-10-02 20:04:33.678693674 +0200 @@ -29,6 +29,9 @@ Source3: %name.keyring Source4: baselibs.conf +# PATCH-FIX-UPSTREAM 0001-Fix-invalid-incremental-decoding-check.patch boo#1215231 CVE-2023-4863 xwang(a)suse.com -- Fix invalid incremental decoding check +Patch2: 0001-Fix-invalid-incremental-decoding-check.patch + BuildRequires: giflib-devel BuildRequires: pkgconfig BuildRequires: pkgconfig(glut) ++++++ 0001-Fix-invalid-incremental-decoding-check.patch ++++++ From 95ea5226c870449522240ccff26f0b006037c520 Mon Sep 17 00:00:00 2001 From: Vincent Rabaud <vrabaud(a)google.com> Date: Mon, 11 Sep 2023 16:06:08 +0200 Subject: [PATCH] Fix invalid incremental decoding check. The first condition is only necessary if we have not read enough (enough being defined by src_last, not src_end which is the end of the image). The second condition now fits the comment below: "if not incremental, and we are past the end of buffer". BUG=oss-fuzz:62136 Change-Id: I0700f67c62db8e1c02c2e429a069a71e606a5e4f --- src/dec/vp8l_dec.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/src/dec/vp8l_dec.c b/src/dec/vp8l_dec.c index 5ab34f56..809b1aa9 100644 --- a/src/dec/vp8l_dec.c +++ b/src/dec/vp8l_dec.c @@ -1233,9 +1233,20 @@ static int DecodeImageData(VP8LDecoder* const dec, uint32_t* const data, } br->eos_ = VP8LIsEndOfStream(br); - if (dec->incremental_ && br->eos_ && src < src_end) { + // In incremental decoding: + // br->eos_ && src < src_last: if 'br' reached the end of the buffer and + // 'src_last' has not been reached yet, there is not enough data. 'dec' has to + // be reset until there is more data. + // !br->eos_ && src < src_last: this cannot happen as either the buffer is + // fully read, either enough has been read to reach 'src_last'. + // src >= src_last: 'src_last' is reached, all is fine. 'src' can actually go + // beyond 'src_last' in case the image is cropped and an LZ77 goes further. + // The buffer might have been enough or there is some left. 'br->eos_' does + // not matter. + assert(!dec->incremental_ || (br->eos_ && src < src_last) || src >= src_last); + if (dec->incremental_ && br->eos_ && src < src_last) { RestoreState(dec); - } else if (!br->eos_) { + } else if ((dec->incremental_ && src >= src_last) || !br->eos_) { // Process the remaining rows corresponding to last row-block. if (process_func != NULL) { process_func(dec, row > last_row ? last_row : row); -- 2.41.0

1 0

commit console-setup for openSUSE:Factory
by Source-Sync 02 Oct '23

02 Oct '23

Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package console-setup for openSUSE:Factory checked in at 2023-10-02 20:04:07 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/console-setup (Old) and /work/SRC/openSUSE:Factory/.console-setup.new.28202 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "console-setup" Mon Oct 2 20:04:07 2023 rev:10 rq:1114605 version:1.223 Changes: -------- --- /work/SRC/openSUSE:Factory/console-setup/console-setup.changes 2023-05-17 10:52:46.811234002 +0200 +++ /work/SRC/openSUSE:Factory/.console-setup.new.28202/console-setup.changes 2023-10-02 20:04:22.662297492 +0200 @@ -1,0 +2,6 @@ +Sun Oct 1 11:32:44 UTC 2023 - Antonio Teixeira <antonio.teixeira(a)suse.com> + +- Update to version 1.223: + * Updated translations + +------------------------------------------------------------------- Old: ---- console-setup_1.220.tar.xz New: ---- console-setup_1.223.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ console-setup.spec ++++++ --- /var/tmp/diff_new_pack.HqdgDV/_old 2023-10-02 20:04:23.866340793 +0200 +++ /var/tmp/diff_new_pack.HqdgDV/_new 2023-10-02 20:04:23.870340938 +0200 @@ -17,7 +17,7 @@ Name: console-setup -Version: 1.220 +Version: 1.223 Release: 0 Summary: Tools for configuring the console using X Window System key maps License: GPL-2.0-or-later AND MIT AND SUSE-Public-Domain ++++++ console-setup_1.220.tar.xz -> console-setup_1.223.tar.xz ++++++ ++++ 400022 lines of diff (skipped)

1 0

commit kbd for openSUSE:Factory
by Source-Sync 02 Oct '23

02 Oct '23

Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package kbd for openSUSE:Factory checked in at 2023-10-02 20:04:06 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/kbd (Old) and /work/SRC/openSUSE:Factory/.kbd.new.28202 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "kbd" Mon Oct 2 20:04:06 2023 rev:120 rq:1114601 version:2.6.3 Changes: -------- --- /work/SRC/openSUSE:Factory/kbd/kbd.changes 2023-08-30 10:18:06.999080281 +0200 +++ /work/SRC/openSUSE:Factory/.kbd.new.28202/kbd.changes 2023-10-02 20:04:19.082168742 +0200 @@ -1,0 +2,11 @@ +Fri Sep 22 18:56:15 UTC 2023 - Antonio Teixeira <antonio.teixeira(a)suse.com> + +- Update to version 2.6.3: + - libkfont: + * Don't look for fonts in the current directory. + - showkey: + * Add parameter to allow to change timeout. + - po: + * Update po files. + +------------------------------------------------------------------- Old: ---- kbd-2.6.2-repack.tar.xz New: ---- kbd-2.6.3-repack.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ kbd.spec ++++++ --- /var/tmp/diff_new_pack.1gSBCw/_old 2023-10-02 20:04:21.766265269 +0200 +++ /var/tmp/diff_new_pack.1gSBCw/_new 2023-10-02 20:04:21.766265269 +0200 @@ -24,7 +24,7 @@ %define legacy_folders amiga,atari,i386,include,mac,ppc,sun Name: kbd -Version: 2.6.2 +Version: 2.6.3 Release: 0 Summary: Keyboard and Font Utilities # git: git://git.altlinux.org/people/legion/packages/kbd.git ++++++ kbd-2.6.2-repack.tar.xz -> kbd-2.6.3-repack.tar.xz ++++++ ++++ 3345 lines of diff (skipped)

1 0

commit libdecor for openSUSE:Factory
by Source-Sync 02 Oct '23

02 Oct '23

Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package libdecor for openSUSE:Factory checked in at 2023-10-02 20:04:05 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/libdecor (Old) and /work/SRC/openSUSE:Factory/.libdecor.new.28202 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "libdecor" Mon Oct 2 20:04:05 2023 rev:4 rq:1114557 version:0.2.0 Changes: -------- --- /work/SRC/openSUSE:Factory/libdecor/libdecor.changes 2022-12-15 19:26:21.860452006 +0100 +++ /work/SRC/openSUSE:Factory/.libdecor.new.28202/libdecor.changes 2023-10-02 20:04:17.298104581 +0200 @@ -1,0 +2,10 @@ +Wed Sep 27 19:42:00 UTC 2023 - Bjørn Lie <bjorn.lie(a)gmail.com> + +- Update to version 0.2.0: + * Various bug and leak fixes. + * New gtk plugin. +- Update URL and source to new home. +- Add pkgconfig(gtk-3.0) BuildRequires, new dependency. +- Use ldconfig_scriptlets macro for post(un) handling. + +------------------------------------------------------------------- @@ -12 +21,0 @@ - Old: ---- libdecor-0.1.1.tar.xz New: ---- libdecor-0.2.0.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libdecor.spec ++++++ --- /var/tmp/diff_new_pack.5cwpVj/_old 2023-10-02 20:04:18.778157808 +0200 +++ /var/tmp/diff_new_pack.5cwpVj/_new 2023-10-02 20:04:18.778157808 +0200 @@ -1,7 +1,7 @@ # # spec file for package libdecor # -# Copyright (c) 2022 SUSE LLC +# Copyright (c) 2023 SUSE LLC # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -16,21 +16,21 @@ # -%define commit ee5ef0f2c3a4743e8501a855d61cb397 Name: libdecor -Version: 0.1.1 +Version: 0.2.0 Release: 0 Summary: Wayland client side decoration library License: MIT Group: System/GUI/Other -URL: https://gitlab.gnome.org/jadahl/libdecor -Source: https://gitlab.gnome.org/jadahl/libdecor/uploads/%{commit}/%{name}-%{versio… +URL: https://gitlab.freedesktop.org/libdecor/libdecor +Source: %{url}/-/releases/%{version}/downloads/%{name}-%{version}.tar.xz Source1: baselibs.conf BuildRequires: gcc BuildRequires: meson BuildRequires: pkgconfig BuildRequires: pkgconfig(cairo) BuildRequires: pkgconfig(dbus-1) +BuildRequires: pkgconfig(gtk+-3.0) BuildRequires: pkgconfig(pangocairo) BuildRequires: pkgconfig(wayland-client) BuildRequires: pkgconfig(wayland-cursor) @@ -66,8 +66,7 @@ %install %meson_install -%post -n libdecor-0-0 -p /sbin/ldconfig -%postun -n libdecor-0-0 -p /sbin/ldconfig +%ldconfig_scriptlets -n libdecor-0-0 %files %license LICENSE ++++++ libdecor-0.1.1.tar.xz -> libdecor-0.2.0.tar.xz ++++++ ++++ 4195 lines of diff (skipped)

1 0

commit python-paramiko for openSUSE:Factory
by Source-Sync 02 Oct '23

02 Oct '23

Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package python-paramiko for openSUSE:Factory checked in at 2023-10-02 20:04:04 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python-paramiko (Old) and /work/SRC/openSUSE:Factory/.python-paramiko.new.28202 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "python-paramiko" Mon Oct 2 20:04:04 2023 rev:59 rq:1114537 version:3.3.1 Changes: -------- --- /work/SRC/openSUSE:Factory/python-paramiko/python-paramiko.changes 2023-05-19 11:55:40.863317996 +0200 +++ /work/SRC/openSUSE:Factory/.python-paramiko.new.28202/python-paramiko.changes 2023-10-02 20:04:15.662045743 +0200 @@ -1,0 +2,7 @@ +Fri Sep 29 22:29:46 UTC 2023 - Ondřej Súkup <mimi.vx(a)gmail.com> + +- refresh remove-icecream-dep.patch +- update to 3.3.1 + detailed changelog: https://www.paramiko.org/changelog.html# + +------------------------------------------------------------------- Old: ---- paramiko-3.1.0.tar.gz New: ---- paramiko-3.3.1.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python-paramiko.spec ++++++ --- /var/tmp/diff_new_pack.OydPLZ/_old 2023-10-02 20:04:16.754085017 +0200 +++ /var/tmp/diff_new_pack.OydPLZ/_new 2023-10-02 20:04:16.758085160 +0200 @@ -16,10 +16,9 @@ # -%define skip_python2 1 %{?sle15_python_module_pythons} Name: python-paramiko -Version: 3.1.0 +Version: 3.3.1 Release: 0 Summary: SSH2 protocol library License: LGPL-2.1-or-later @@ -27,20 +26,17 @@ URL: https://www.paramiko.org/ Source0: https://files.pythonhosted.org/packages/source/p/paramiko/paramiko-%{versio… Patch0: paramiko-test_extend_timeout.patch -# PATCH-FIX-OPENSUSE remove-icecream-dep.patch to do not depend on python-icecream +# PATCH-FIX-OPENSUSE remove-icecream-dep.patch to do not depend on python-icecream and unvendor lexicon Patch1: remove-icecream-dep.patch BuildRequires: %{python_module PyNaCl >= 1.0.1} -%if 0%{?suse_version} > 1500 -BuildRequires: python3-Sphinx -%else BuildRequires: %{python_module Sphinx} -%endif BuildRequires: %{python_module bcrypt >= 3.2} BuildRequires: %{python_module cryptography >= 3.3} BuildRequires: %{python_module gssapi} BuildRequires: %{python_module invocations} BuildRequires: %{python_module invoke >= 2.0} -BuildRequires: %{python_module pyasn1 >= 0.1.7} +BuildRequires: %{python_module lexicon} +BuildRequires: %{python_module pyasn1} BuildRequires: %{python_module pytest-relaxed} BuildRequires: %{python_module pytest-xdist} BuildRequires: %{python_module pytest} @@ -49,10 +45,10 @@ BuildRequires: python-rpm-macros Recommends: python-gssapi Recommends: python-invoke +Recommends: python-pyasn1 >= 0.1.7 Requires: python-PyNaCl >= 1.5 Requires: python-bcrypt >= 3.2 Requires: python-cryptography >= 3.3 -Requires: python-pyasn1 >= 0.1.7 BuildArch: noarch %python_subpackages @@ -62,7 +58,6 @@ connections between python scripts. All major ciphers and hash methods are supported. SFTP client and server mode are both supported too. -%if 0%{?suse_version} > 1500 %package -n python-paramiko-doc Summary: Documentation for %{name} Group: Documentation/Other @@ -75,7 +70,6 @@ are supported. SFTP client and server mode are both supported too. This package contains the documentation. -%endif %prep %autosetup -p1 -n paramiko-%{version} @@ -101,9 +95,7 @@ %{python_sitelib}/paramiko %{python_sitelib}/paramiko-%{version}*-info -%if 0%{?suse_version} > 1500 %files -n python-paramiko-doc %license LICENSE -%endif %doc demos/ ++++++ paramiko-3.1.0.tar.gz -> paramiko-3.3.1.tar.gz ++++++ ++++ 8945 lines of diff (skipped) ++++++ remove-icecream-dep.patch ++++++ --- /var/tmp/diff_new_pack.OydPLZ/_old 2023-10-02 20:04:17.014094367 +0200 +++ /var/tmp/diff_new_pack.OydPLZ/_new 2023-10-02 20:04:17.018094511 +0200 @@ -1,14 +1,24 @@ -Index: paramiko-3.1.0/tests/conftest.py +Index: paramiko-3.3.1/tests/conftest.py =================================================================== ---- paramiko-3.1.0.orig/tests/conftest.py -+++ paramiko-3.1.0/tests/conftest.py -@@ -10,12 +10,6 @@ from .loop import LoopSocket - from .stub_sftp import StubServer, StubSFTPServer - from .util import _support +--- paramiko-3.3.1.orig/tests/conftest.py ++++ paramiko-3.3.1/tests/conftest.py +@@ -4,7 +4,7 @@ import shutil + import threading + from pathlib import Path + +-from invoke.vendor.lexicon import Lexicon ++from lexicon import Lexicon + + import pytest + from paramiko import ( +@@ -22,13 +22,6 @@ from ._loop import LoopSocket + from ._stub_sftp import StubServer, StubSFTPServer + from ._util import _support -from icecream import ic, install as install_ic - - +-# Better print() for debugging - use ic()! -install_ic() -ic.configureOutput(includeContext=True) -

1 0

commit python-pyenchant for openSUSE:Factory
by Source-Sync 02 Oct '23

02 Oct '23

Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package python-pyenchant for openSUSE:Factory checked in at 2023-10-02 20:04:04 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python-pyenchant (Old) and /work/SRC/openSUSE:Factory/.python-pyenchant.new.28202 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "python-pyenchant" Mon Oct 2 20:04:04 2023 rev:21 rq:1114536 version:3.2.2 Changes: -------- --- /work/SRC/openSUSE:Factory/python-pyenchant/python-pyenchant.changes 2021-12-09 19:45:10.777120845 +0100 +++ /work/SRC/openSUSE:Factory/.python-pyenchant.new.28202/python-pyenchant.changes 2023-10-02 20:04:14.357998847 +0200 @@ -1,0 +2,6 @@ +Sat Sep 30 09:49:17 UTC 2023 - Ben Greiner <code(a)bnavigator.de> + +- Move to PEP517 +- Add sle15_python_module_pythons (for mygnuhealth) + +------------------------------------------------------------------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python-pyenchant.spec ++++++ --- /var/tmp/diff_new_pack.Ly8dCa/_old 2023-10-02 20:04:15.478039127 +0200 +++ /var/tmp/diff_new_pack.Ly8dCa/_new 2023-10-02 20:04:15.478039127 +0200 @@ -1,7 +1,7 @@ # # spec file for package python-pyenchant # -# Copyright (c) 2021 SUSE LLC +# Copyright (c) 2023 SUSE LLC # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -16,8 +16,7 @@ # -%{?!python_module:%define python_module() python-%{**} python3-%{**}} -%define skip_python2 1 +%{?sle15_python_module_pythons} Name: python-pyenchant Version: 3.2.2 Release: 0 @@ -25,8 +24,10 @@ License: LGPL-2.1-or-later URL: https://pyenchant.github.io/pyenchant Source: https://github.com/pyenchant/pyenchant/archive/v%{version}.tar.gz#/pyenchan… +BuildRequires: %{python_module pip} BuildRequires: %{python_module pytest} BuildRequires: %{python_module setuptools} +BuildRequires: %{python_module wheel} %if 0%{?suse_version} > 1500 BuildRequires: enchant-2-backend-hunspell %else @@ -56,10 +57,10 @@ rm -rf website .github archive tools %build -%python_build +%pyproject_wheel %install -%python_install +%pyproject_install %python_expand %fdupes %{buildroot}%{$python_sitelib} %check @@ -71,5 +72,5 @@ %license LICENSE.txt %doc README.rst TODO.txt %{python_sitelib}/enchant -%{python_sitelib}/pyenchant-%{version}-py*.egg-info +%{python_sitelib}/pyenchant-%{version}.dist-info

1 0

commit python-apache-libcloud for openSUSE:Factory
by Source-Sync 02 Oct '23

02 Oct '23

Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package python-apache-libcloud for openSUSE:Factory checked in at 2023-10-02 20:04:03 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python-apache-libcloud (Old) and /work/SRC/openSUSE:Factory/.python-apache-libcloud.new.28202 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "python-apache-libcloud" Mon Oct 2 20:04:03 2023 rev:45 rq:1114461 version:3.8.0 Changes: -------- --- /work/SRC/openSUSE:Factory/python-apache-libcloud/python-apache-libcloud.changes 2023-07-04 15:21:57.690054751 +0200 +++ /work/SRC/openSUSE:Factory/.python-apache-libcloud.new.28202/python-apache-libcloud.changes 2023-10-02 20:04:12.445930083 +0200 @@ -2 +2,64 @@ -Mon Jul 3 11:38:42 UTC 2023 - ecsosa <ecsos(a)opensuse.org> +Tue Sep 26 00:00:00 PM CEST 2023 - ecsosa <ecsos(a)opensuse.org> + +- Update to 3.8.0 + * Compute + - Remove obsolete compute driver where the provider is either + dead or not offering those services anymore: Bluebox, + bsnlcloud, Cloudwatt, Enomaly, ElasticHosts, ElasticStack, + GoGrid, Gridspot, HostVirtual, Joyent, Med-1, Nephoscale, + 1on1, ProfitBricks, ServerLove, SkaliCloud, Softlayer, Voxel. + (#1743, #1852) + - [Outscale] Fix list_nodes() and list_volumes() method. (#1877) + - [Azure ARM] Implement pagination in the list_nodes() method. + This fixes a bug which would result in sometimes not all the + nodes being returned. (#1824, #1850) + - [Azure ARM] Implement pagination in the list_volumes() method. + This fixes a bug which would result in sometimes not all the + volumes nodes being returned. (#1891) + - [Azure ARM] Bump DISK_API_VERSION from 2018-06-01 to 2023-01-02 + to support premium v2 SSDs. (#1904) + - [AWS EC2] Add support for the following new arguments to the + ex_register_image() method: * boot_mode - control bios vs + uefi boot * tpm_support - enable a tpm * uefi_data - provide + NV UEFI vars * imds_support - require IMDSv2. (#1906) + * Storage + - Optimize read_in_chunks() function implementation. + - This should result in large performance speedups and lower memory + usage when uploading or downloading a large file with a mismatching chunk size. + - Keep in mind that this only affects code paths where the function + is called with fill_size=True argument + (such as in the S3 driver, etc). (#1847) + - [Aliyun OSS] Fix upload_object() function. (#1796) + - [S3] Support all available storage classes. Previously only + "standard" and "reduced_redundancy" were supported. (#1875) + - [CloudFiles] Fix get_endpoint_url() throwing an exception when + being used with use_internal_url=True argument. (#1883, #1884) + - [CloudFiles] Update OpenStack connection handling code to only + re-connect in case connection details (scheme, host, port) have changed. + - This should result in significant performance improvements when + downloading objects since the underlying HTTP connection will + be properly re-used. (#1885, #1886) + - [Backblaze B2] Fix a bug which would result in an exception + when passing extra={"meta_data": {}} argument to the + upload_object() method. (#1916) + * Other + - Move Python tooling (pytest, bandit, pylint, mypy, coverage) + config options from separate config files into single + pyproject.yaml config files. + - NOTE: This change only affects development process and nothing + else. (#1901) + - Fix minor typos in the code using codespell package and enforce + this check as part of our GHA CI system. (#1923) + - Indicate we also support Python 3.12 (beta). (#1920) + - Remove unused libcloud.security.SSL_VERSION constant / module + level variable. This variable has been unused and had no affect + on the behavior since we switched to the requests library for + making HTTP(s) requests in 2016. + - Packaging related metadata has been migrated from setup.py to + pyproject.yaml file. (#1929) + - Deprecated and unsafe setup.py test convenience alias for + running tests using pytest has been removed in favor of + running pytest directly. (#1929) + - Script for building release artifacts has been updated to + utilize build Python package to build release artifacts + (sdist + wheel) in an isolated environment. (#1929) @@ -3,0 +67,2 @@ +------------------------------------------------------------------- +Mon Jul 3 11:38:42 UTC 2023 - ecsosa <ecsos(a)opensuse.org> Old: ---- apache-libcloud-3.7.0.tar.bz2 apache-libcloud-3.7.0.tar.bz2.asc New: ---- apache-libcloud-3.8.0.tar.gz apache-libcloud-3.8.0.tar.gz.asc ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python-apache-libcloud.spec ++++++ --- /var/tmp/diff_new_pack.JErbj7/_old 2023-10-02 20:04:13.869981296 +0200 +++ /var/tmp/diff_new_pack.JErbj7/_new 2023-10-02 20:04:13.873981439 +0200 @@ -18,21 +18,21 @@ %{?sle15_python_module_pythons} Name: python-apache-libcloud -Version: 3.7.0 +Version: 3.8.0 Release: 0 Summary: Abstraction over multiple cloud provider APIs License: Apache-2.0 Group: Development/Languages/Python URL: https://libcloud.apache.org -Source0: https://downloads.apache.org/libcloud/apache-libcloud-%{version}.tar.bz2 -Source1: https://downloads.apache.org/libcloud/apache-libcloud-%{version}.tar.bz2.asc +Source0: https://downloads.apache.org/libcloud/apache-libcloud-%{version}.tar.gz +Source1: https://downloads.apache.org/libcloud/apache-libcloud-%{version}.tar.gz.asc # https://libcloud.apache.org/downloads.html#package-verification-guide Source2: https://www.apache.org/dist/libcloud/KEYS#/%{name}.keyring Patch1: gce_image_projects.patch Patch2: ec2_create_node.patch BuildRequires: %{python_module base >= 3.7} +BuildRequires: %{python_module fasteners} BuildRequires: %{python_module libvirt-python} -BuildRequires: %{python_module lockfile} BuildRequires: %{python_module lxml} BuildRequires: %{python_module paramiko} BuildRequires: %{python_module pyOpenSSL} @@ -47,7 +47,7 @@ Requires: python-requests Requires: python-typing Suggests: python-libvirt-python -Suggests: python-lockfile +Suggests: python-fastners Suggests: python-paramiko Suggests: python-pysphere BuildArch: noarch

1 0

commit systemd for openSUSE:Factory
by Source-Sync 02 Oct '23

02 Oct '23

Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package systemd for openSUSE:Factory checked in at 2023-10-02 20:04:02 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/systemd (Old) and /work/SRC/openSUSE:Factory/.systemd.new.28202 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "systemd" Mon Oct 2 20:04:02 2023 rev:403 rq:1113906 version:254.5 Changes: -------- --- /work/SRC/openSUSE:Factory/systemd/systemd.changes 2023-09-26 22:14:33.104331659 +0200 +++ /work/SRC/openSUSE:Factory/.systemd.new.28202/systemd.changes 2023-10-02 20:04:08.641793275 +0200 @@ -1,0 +2,34 @@ +Wed Sep 27 13:14:12 UTC 2023 - Franck Bui <fbui(a)suse.com> + +- Import commit 9674bb256205e6c643feadbcccfd1ee8feeee684 (merge of v254.5) + + For a complete list of changes, visit: + https://github.com/openSUSE/systemd/compare/6ed5b11298005e07509832881a0c5ff… + +------------------------------------------------------------------- +Wed Sep 27 10:12:48 UTC 2023 - Franck Bui <fbui(a)suse.com> + +- Make sure to call %sysusers_create only when transfiletrigger is disabled. + +------------------------------------------------------------------- +Wed Sep 27 09:52:33 UTC 2023 - Franck Bui <fbui(a)suse.com> + +- systemd.spec: switch to %ldconfig_scriptlets + +------------------------------------------------------------------- +Wed Sep 27 07:31:06 UTC 2023 - Franck Bui <fbui(a)suse.com> + +- systemd.spec: add `%tmpfiles_create systemd-resolve` + + It's only needed by SLE distros since systemd packages rely on + transtriggerfiles in Factory. + +------------------------------------------------------------------- +Mon Sep 25 08:05:21 UTC 2023 - Franck Bui <fbui(a)suse.com> + +- Import commit 6ed5b11298005e07509832881a0c5ff1a80bf225 (merge of v254.4) + + For a complete list of changes, visit: + https://github.com/openSUSE/systemd/compare/b6b4e5a8a82d1f13f265a4ef170f2d1… + +------------------------------------------------------------------- Old: ---- systemd-v254.3+suse.3.gb6b4e5a8a8.tar.xz New: ---- systemd-v254.5+suse.5.g9674bb2562.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ systemd.spec ++++++ --- /var/tmp/diff_new_pack.qquK6H/_old 2023-10-02 20:04:11.649901455 +0200 +++ /var/tmp/diff_new_pack.qquK6H/_new 2023-10-02 20:04:11.653901600 +0200 @@ -19,7 +19,7 @@ %global flavor @BUILD_FLAVOR@%{nil} %define min_kernel_version 4.5 -%define archive_version +suse.3.gb6b4e5a8a8 +%define archive_version +suse.5.g9674bb2562 %define _testsuitedir %{_systemd_util_dir}/tests %define xinitconfdir %{?_distconfdir}%{!?_distconfdir:%{_sysconfdir}}/X11/xinit @@ -67,7 +67,7 @@ Name: systemd%{?mini} URL: http://www.freedesktop.org/wiki/Software/systemd -Version: 254.3 +Version: 254.5 Release: 0 Summary: A System and Session Manager License: LGPL-2.1-or-later @@ -440,7 +440,7 @@ %if %{with networkd} || %{with resolved} %package network -Summary: systemd network and Network Name Resolution managers +Summary: Systemd Network And Network Name Resolution Managers License: LGPL-2.1-or-later Requires: %{name} = %{version}-%{release} %systemd_requires @@ -782,7 +782,11 @@ -Doomd=%{when experimental} \ -Drepart=%{when experimental} \ -Dsysupdate=%{when experimental} \ +%if %{with sd_boot} -Dukify=%{when experimental} \ +%else + -Dukify=false \ +%endif \ -Dtests=%{when testsuite unsafe} \ -Dinstall-tests=%{when testsuite} @@ -1126,11 +1130,8 @@ %posttrans -n udev%{?mini} %regenerate_initrd_posttrans -%post -n libudev%{?mini}1 -p %ldconfig -%post -n libsystemd0%{?mini} -p %ldconfig - -%postun -n libudev%{?mini}1 -p %ldconfig -%postun -n libsystemd0%{?mini} -p %ldconfig +%ldconfig_scriptlets -n libsystemd0%{?mini} +%ldconfig_scriptlets -n libudev%{?mini}1 %if %{with machined} %pre container @@ -1140,24 +1141,26 @@ %systemd_preun machines.target %postun container -%systemd_postun machines.target %ldconfig +%systemd_postun machines.target %endif %post container %if %{with machined} +%ldconfig %if %{without filetriggers} %tmpfiles_create systemd-nspawn.conf %endif %systemd_post machines.target -%ldconfig %{_systemd_util_dir}/rpm/fixlet-container-post.sh $1 || : %endif %if %{with coredump} %post coredump +%if %{without filetriggers} %sysusers_create systemd-coredump.conf %endif +%endif %if %{with journal_remote} %pre journal-remote @@ -1167,7 +1170,9 @@ %post journal-remote # Assume that all files shipped by systemd-journal-remove are owned by root. +%if %{without filetriggers} %sysusers_create systemd-remote.conf +%endif %systemd_post systemd-journal-gatewayd.service %systemd_post systemd-journal-remote.service %systemd_post systemd-journal-upload.service @@ -1204,7 +1209,10 @@ %endif %if %{with resolved} %ldconfig +%if %{without filetriggers} %sysusers_create systemd-resolve.conf +%tmpfiles_create systemd-resolve.conf +%endif %systemd_post systemd-resolved.service %endif @@ -1271,7 +1279,9 @@ %systemd_pre systemd-oomd.service systemd-oomd.socket %post experimental +%if %{without filetriggers} %sysusers_create systemd-oom.conf +%endif %systemd_post systemd-homed.service %systemd_post systemd-oomd.service systemd-oomd.socket ++++++ systemd-v254.3+suse.3.gb6b4e5a8a8.tar.xz -> systemd-v254.5+suse.5.g9674bb2562.tar.xz ++++++ /work/SRC/openSUSE:Factory/systemd/systemd-v254.3+suse.3.gb6b4e5a8a8.tar.xz /work/SRC/openSUSE:Factory/.systemd.new.28202/systemd-v254.5+suse.5.g9674bb2562.tar.xz differ: char 27, line 1

1 0

commit kdepim-runtime for openSUSE:Factory
by Source-Sync 02 Oct '23

02 Oct '23

Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package kdepim-runtime for openSUSE:Factory checked in at 2023-10-02 20:04:01 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/kdepim-runtime (Old) and /work/SRC/openSUSE:Factory/.kdepim-runtime.new.28202 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "kdepim-runtime" Mon Oct 2 20:04:01 2023 rev:112 rq:1113907 version:23.08.1 Changes: -------- --- /work/SRC/openSUSE:Factory/kdepim-runtime/kdepim-runtime.changes 2023-09-22 21:47:54.781947076 +0200 +++ /work/SRC/openSUSE:Factory/.kdepim-runtime.new.28202/kdepim-runtime.changes 2023-10-02 20:04:06.361711276 +0200 @@ -1,0 +2,6 @@ +Tue Sep 26 11:43:01 UTC 2023 - Bob Haley <fawz(a)use.startmail.com> + +- Add libetebase-devel to BuildRequires to enable the etesync resource for + factory builds + +------------------------------------------------------------------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ kdepim-runtime.spec ++++++ --- /var/tmp/diff_new_pack.ZF34DL/_old 2023-10-02 20:04:07.925767524 +0200 +++ /var/tmp/diff_new_pack.ZF34DL/_new 2023-10-02 20:04:07.929767668 +0200 @@ -81,6 +81,9 @@ BuildRequires: cmake(Qt5WebEngineWidgets) BuildRequires: cmake(Qt5Widgets) BuildRequires: cmake(Qt5XmlPatterns) +%if 0%{?suse_version} > 1500 || 0%{?sle_version} > 150500 +BuildRequires: libetebase-devel +%endif Recommends: kalendarac Requires: akonadi-plugin-calendar Requires: akonadi-plugin-contacts @@ -135,6 +138,9 @@ %ifarch %{ix86} x86_64 %{arm} aarch64 %{_kf5_iconsdir}/hicolor/*/apps/akonadi-ews.png %endif +%if 0%{?suse_version} > 1500 || 0%{?sle_version} > 150500 +%{_kf5_iconsdir}/hicolor/*/apps/akonadi-etesync.png +%endif %{_kf5_iconsdir}/hicolor/*/apps/ox.png %{_kf5_libdir}/*.so.* %{_kf5_notifydir}/

1 0

commit crypto-policies for openSUSE:Factory
by Source-Sync 02 Oct '23

02 Oct '23

Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package crypto-policies for openSUSE:Factory checked in at 2023-10-02 20:03:59 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/crypto-policies (Old) and /work/SRC/openSUSE:Factory/.crypto-policies.new.28202 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "crypto-policies" Mon Oct 2 20:03:59 2023 rev:6 rq:1114288 version:20230920.570ea89 Changes: -------- --- /work/SRC/openSUSE:Factory/crypto-policies/crypto-policies.changes 2023-09-07 21:12:04.791887233 +0200 +++ /work/SRC/openSUSE:Factory/.crypto-policies.new.28202/crypto-policies.changes 2023-10-02 20:04:03.925623668 +0200 @@ -1,0 +2,36 @@ +Wed Sep 27 10:54:17 UTC 2023 - Pedro Monreal <pmonreal(a)suse.com> + +- nss: Skip the NSS policy check if the mozilla-nss-tools package + is not installed. This avoids adding more dependencies in ring0. + * Add crypto-policies-nss.patch [bsc#1211301] + +------------------------------------------------------------------- +Fri Sep 22 10:27:53 UTC 2023 - Pedro Monreal <pmonreal(a)suse.com> + +- Update to version 20230920.570ea89: + * fips-mode-setup: more thorough --disable, still unsupported + * FIPS:OSPP: tighten beyond reason for OSPP 4.3 + * krb5: sort enctypes mac-first, cipher-second, prioritize SHA-2 ones + * openssl: implement relaxing EMS in FIPS (NO-ENFORCE-EMS) + * gnutls: prepare for tls-session-hash option coming + * nss: prepare for TLS-REQUIRE-EMS option coming + * NO-ENFORCE-EMS: add subpolicy + * FIPS: set __ems = ENFORCE + * cryptopolicies: add enums and __ems tri-state + * docs: replace `FIPS 140-2` with just `FIPS 140` + * .gitlab-ci: remove forcing OPENSSH_MIN_RSA_SIZE + * cryptopolicies: add comments on dunder options + * nss: retire NSS_OLD and replace with NSS_LAX 3.80 check + * BSI: start a BSI TR 02102 policy [jsc#PED-4933] + * Rebase patches: + - crypto-policies-policygenerators.patch + - crypto-policies-revert-rh-allow-sha1-signatures.patch + - crypto-policies-FIPS.patch + +------------------------------------------------------------------- +Fri Sep 15 11:23:06 UTC 2023 - Pedro Monreal <pmonreal(a)suse.com> + +- Conditionally recommend the crypto-policies-scripts package + when python is not installed in the system [bsc#1215201] + +------------------------------------------------------------------- @@ -14 +50 @@ - for transactional systems [jsc#PED-4578]. + for transactional systems [jsc#PED-5041]. Old: ---- BSI.pol fedora-crypto-policies-20230614.5f3458e.tar.gz New: ---- crypto-policies-nss.patch fedora-crypto-policies-20230920.570ea89.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ crypto-policies.spec ++++++ --- /var/tmp/diff_new_pack.J7X0d7/_old 2023-10-02 20:04:05.881694013 +0200 +++ /var/tmp/diff_new_pack.J7X0d7/_new 2023-10-02 20:04:05.885694157 +0200 @@ -22,7 +22,7 @@ %bcond_with manbuild %global _python_bytecompile_extra 0 Name: crypto-policies -Version: 20230614.5f3458e +Version: 20230920.570ea89 Release: 0 Summary: System-wide crypto policies License: LGPL-2.1-or-later @@ -35,8 +35,6 @@ Source4: fips-mode-setup.8.gz Source5: fips-finish-install.8.gz Source6: crypto-policies-rpmlintrc -# BSI TR-02102 encoded for jsc#PED-4933 (customer request to have BSI TR-02102 policies) -Source7: BSI.pol %if %{without manbuild} #PATCH-FIX-OPENSUSE Manpages build cycles and dependencies # To reduce the build dependencies in Ring0, we have to compile the @@ -55,6 +53,8 @@ Patch5: crypto-policies-pylint.patch #PATCH-FIX-OPENSUSE Adpat the fips-mode-setup script for SUSE/openSUSE [jsc#PED-4578] Patch6: crypto-policies-FIPS.patch +#PATCH-FIX-OPENSUSE Skip NSS policy check if not installed mozilla-nss-tools [bsc#1211301] +Patch7: crypto-policies-nss.patch BuildRequires: python3-base >= 3.6 # The sequoia stuff needs python3-toml, removed until needed # BuildRequires: python3-toml @@ -69,7 +69,7 @@ BuildRequires: java-devel BuildRequires: krb5-devel BuildRequires: libxslt -#BuildRequires: mozilla-nss-tools +BuildRequires: mozilla-nss-tools BuildRequires: openssl BuildRequires: perl BuildRequires: python3-coverage @@ -82,7 +82,9 @@ BuildRequires: perl(File::Which) BuildRequires: perl(File::pushd) %endif +%if 0%{?primary_python:1} Recommends: crypto-policies-scripts +%endif Conflicts: gnutls < 3.7.3 #Conflicts: libreswan < 3.28 Conflicts: nss < 3.90.0 @@ -138,9 +140,6 @@ make DESTDIR=%{buildroot} DIR=%{_datarootdir}/crypto-policies MANDIR=%{_mandir} %{?_smp_mflags} install -# BSI.pol -install -c -m 644 %{SOURCE7} %{buildroot}/%{_datarootdir}/crypto-policies/policies/ - install -p -m 644 default-config %{buildroot}%{_sysconfdir}/crypto-policies/config touch %{buildroot}%{_sysconfdir}/crypto-policies/state/current touch %{buildroot}%{_sysconfdir}/crypto-policies/state/CURRENT.pol @@ -166,7 +165,7 @@ rm -rf %{buildroot}%{_datarootdir}/crypto-policies/*FEDORA* # Create back-end configs for mounting with read-only /etc/ -for d in LEGACY DEFAULT FUTURE FIPS ; do +for d in LEGACY DEFAULT FUTURE FIPS BSI ; do mkdir -p -m 755 %{buildroot}%{_datarootdir}/crypto-policies/back-ends/$d for f in %{buildroot}%{_datarootdir}/crypto-policies/$d/* ; do ln $f %{buildroot}%{_datarootdir}/crypto-policies/back-ends/$d/$(basename $f .txt).config @@ -241,6 +240,7 @@ %ghost %config(missingok,noreplace) %verify(not mode) %{_sysconfdir}/crypto-policies/back-ends/gnutls.config %ghost %config(missingok,noreplace) %verify(not mode) %{_sysconfdir}/crypto-policies/back-ends/openssl.config %ghost %config(missingok,noreplace) %verify(not mode) %{_sysconfdir}/crypto-policies/back-ends/opensslcnf.config +%ghost %config(missingok,noreplace) %verify(not mode) %{_sysconfdir}/crypto-policies/back-ends/openssl_fips.config %ghost %config(missingok,noreplace) %verify(not mode) %{_sysconfdir}/crypto-policies/back-ends/openssh.config %ghost %config(missingok,noreplace) %verify(not mode) %{_sysconfdir}/crypto-policies/back-ends/opensshserver.config %ghost %config(missingok,noreplace) %verify(not mode) %{_sysconfdir}/crypto-policies/back-ends/nss.config @@ -262,6 +262,7 @@ %{_datarootdir}/crypto-policies/DEFAULT %{_datarootdir}/crypto-policies/FUTURE %{_datarootdir}/crypto-policies/FIPS +%{_datarootdir}/crypto-policies/BSI %{_datarootdir}/crypto-policies/EMPTY %{_datarootdir}/crypto-policies/back-ends %{_datarootdir}/crypto-policies/default-config ++++++ _service ++++++ --- /var/tmp/diff_new_pack.J7X0d7/_old 2023-10-02 20:04:05.921695452 +0200 +++ /var/tmp/diff_new_pack.J7X0d7/_new 2023-10-02 20:04:05.925695596 +0200 @@ -4,7 +4,7 @@ <param name="scm">git</param> <param name="versionformat">%cd.%h</param> <param name="changesgenerate">enable</param> - <param name="revision">5f3458e619628288883f22695f3311f1ccd6a39f</param> + <param name="revision">570ea89092555c6c289f226bb48c2d8c1f332b0f</param> </service> <service name="recompress" mode="disabled"> <param name="file">*.tar</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.J7X0d7/_old 2023-10-02 20:04:05.941696172 +0200 +++ /var/tmp/diff_new_pack.J7X0d7/_new 2023-10-02 20:04:05.945696315 +0200 @@ -1,6 +1,6 @@ <servicedata> <service name="tar_scm"> <param name="url">https://gitlab.com/redhat-crypto/fedora-crypto-policies.git</param> - <param name="changesrevision">5f3458e619628288883f22695f3311f1ccd6a39f</param></service></servicedata> + <param name="changesrevision">570ea89092555c6c289f226bb48c2d8c1f332b0f</param></service></servicedata> (No newline at EOF) ++++++ crypto-policies-FIPS.patch ++++++ --- /var/tmp/diff_new_pack.J7X0d7/_old 2023-10-02 20:04:05.953696603 +0200 +++ /var/tmp/diff_new_pack.J7X0d7/_new 2023-10-02 20:04:05.957696747 +0200 @@ -1,7 +1,7 @@ -Index: fedora-crypto-policies-20230614.5f3458e/fips-mode-setup +Index: fedora-crypto-policies-20230920.570ea89/fips-mode-setup =================================================================== ---- fedora-crypto-policies-20230614.5f3458e.orig/fips-mode-setup -+++ fedora-crypto-policies-20230614.5f3458e/fips-mode-setup +--- fedora-crypto-policies-20230920.570ea89.orig/fips-mode-setup ++++ fedora-crypto-policies-20230920.570ea89/fips-mode-setup @@ -81,6 +81,19 @@ if [ "$(id -u)" != 0 ]; then exit 1 fi @@ -22,7 +22,7 @@ # Detect 1: kernel FIPS flag fips_kernel_enabled=$(cat /proc/sys/crypto/fips_enabled) -@@ -203,9 +216,22 @@ else +@@ -204,9 +217,22 @@ else fi fi @@ -48,7 +48,7 @@ fi echo "FIPS mode will be $(enable2txt $enable_fips)." -@@ -216,15 +242,19 @@ if test $boot_config = 0 ; then +@@ -217,15 +243,19 @@ if test $boot_config = 0 ; then echo "Now you need to configure the bootloader to add kernel options \"$fipsopts\"" echo "and reboot the system for the setting to take effect." else @@ -77,37 +77,40 @@ echo "Please reboot the system for the setting to take effect." fi -Index: fedora-crypto-policies-20230614.5f3458e/fips-finish-install +Index: fedora-crypto-policies-20230920.570ea89/fips-finish-install =================================================================== ---- fedora-crypto-policies-20230614.5f3458e.orig/fips-finish-install -+++ fedora-crypto-policies-20230614.5f3458e/fips-finish-install -@@ -23,7 +23,16 @@ fi +--- fedora-crypto-policies-20230920.570ea89.orig/fips-finish-install ++++ fedora-crypto-policies-20230920.570ea89/fips-finish-install +@@ -24,6 +24,15 @@ fi umask 022 --trap "rm -f $dracut_cfg" ERR -+# trap "rm -f $dracut_cfg" ERR -+ +# Install required packages: patterns-base-fips and perl-Bootloader +if test ! -f $dracut_cfg && test ! -x "$(command -v pbl)" ; then -+ zypper -n install patterns-base-fips perl-Bootloader ++ zypper -n install patterns-base-fips perl-Bootloader +elif test ! -f $dracut_cfg ; then -+ zypper -n install patterns-base-fips ++ zypper -n install patterns-base-fips +elif test ! -x "$(command -v pbl)" ; then -+ zypper -n install perl-Bootloader ++ zypper -n install perl-Bootloader +fi - ++ if test ! -d $dracut_cfg_d -o ! -d /boot -o "$is_ostree_system" = 1 ; then # No dracut configuration or boot directory present, do not try to modify it. -@@ -32,23 +41,23 @@ if test ! -d $dracut_cfg_d -o ! -d /boot + # Also, on OSTree systems, we currently rely on the initrd already including +@@ -31,28 +40,28 @@ if test ! -d $dracut_cfg_d -o ! -d /boot exit 0 fi --cat >$dracut_cfg <<EOF +-if test x"$1" == x--complete; then +- trap "rm -f $dracut_cfg" ERR +- cat >$dracut_cfg <<EOF -# turn on fips module - -add_dracutmodules+=" fips " -EOF +-elif test x"$1" == x--undo; then +- rm -f $dracut_cfg +-fi - -echo "Kernel initramdisks are being regenerated. This might take some time." - @@ -123,16 +126,21 @@ - echo '`zipl` execution has been skipped: `zipl` not found.' - fi -fi -+# cat >$dracut_cfg <<EOF ++# if test x"$1" == x--complete; then ++# trap "rm -f $dracut_cfg" ERR ++# cat >$dracut_cfg <<EOF +# # turn on fips module -+# ++ +# add_dracutmodules+=" fips " +# EOF -+# ++# elif test x"$1" == x--undo; then ++# rm -f $dracut_cfg ++# fi ++ +# echo "Kernel initramdisks are being regenerated. This might take some time." -+# ++ +# dracut -f --regenerate-all -+# ++ +# # This is supposed to be a fast and safe operation that's always good to run. +# # Regenerating an initrd and skipping it might render the system unbootable +# # (RHBZ#2013195). @@ -143,10 +151,10 @@ +# echo '`zipl` execution has been skipped: `zipl` not found.' +# fi +# fi -Index: fedora-crypto-policies-20230614.5f3458e/fips-mode-setup.8.txt +Index: fedora-crypto-policies-20230920.570ea89/fips-mode-setup.8.txt =================================================================== ---- fedora-crypto-policies-20230614.5f3458e.orig/fips-mode-setup.8.txt -+++ fedora-crypto-policies-20230614.5f3458e/fips-mode-setup.8.txt +--- fedora-crypto-policies-20230920.570ea89.orig/fips-mode-setup.8.txt ++++ fedora-crypto-policies-20230920.570ea89/fips-mode-setup.8.txt @@ -45,6 +45,23 @@ Then the command modifies the boot loade When disabling the system FIPS mode the system crypto policy is switched to DEFAULT and the kernel command line option 'fips=0' is set. ++++++ crypto-policies-nss.patch ++++++ Index: fedora-crypto-policies-20230920.570ea89/python/policygenerators/nss.py =================================================================== --- fedora-crypto-policies-20230920.570ea89.orig/python/policygenerators/nss.py +++ fedora-crypto-policies-20230920.570ea89/python/policygenerators/nss.py @@ -198,12 +198,20 @@ class NSSGenerator(ConfigGenerator): try: with os.fdopen(fd, 'w') as f: f.write(config) - try: - ret = call(f'/usr/bin/nss-policy-check {options} {path}' - '>/dev/null', - shell=True) - except CalledProcessError: - cls.eprint("/usr/bin/nss-policy-check: Execution failed") + if os.path.exists('/usr/bin/nss-policy-check'): + # Perform a policy check only if the mozilla-nss-tools + # package is installed. This avoids adding more + # dependencies to Ring0. + try: + ret = call(f'/usr/bin/nss-policy-check {options} {path}' + '>/dev/null', shell=True) + except CalledProcessError: + cls.eprint("/usr/bin/nss-policy-check: Execution failed") + else: + # The mozilla-nss-tools package is not installed and we can + # temporarily skip the policy check for mozilla-nss. + ret = 3 + finally: os.unlink(path) @@ -211,6 +219,10 @@ class NSSGenerator(ConfigGenerator): cls.eprint("There is a warning in NSS generated policy") cls.eprint(f'Policy:\n{config}') return False + elif ret == 3: + cls.eprint('Skipping NSS policy check: ' + '/usr/bin/nss-policy-check not found') + return True elif ret: cls.eprint("There is an error in NSS generated policy") cls.eprint(f'Policy:\n{config}') ++++++ crypto-policies-policygenerators.patch ++++++ --- /var/tmp/diff_new_pack.J7X0d7/_old 2023-10-02 20:04:05.977697466 +0200 +++ /var/tmp/diff_new_pack.J7X0d7/_new 2023-10-02 20:04:05.981697610 +0200 @@ -1,8 +1,8 @@ -Index: fedora-crypto-policies-20230614.5f3458e/python/policygenerators/__init__.py +Index: fedora-crypto-policies-20230920.570ea89/python/policygenerators/__init__.py =================================================================== ---- fedora-crypto-policies-20230614.5f3458e.orig/python/policygenerators/__init__.py -+++ fedora-crypto-policies-20230614.5f3458e/python/policygenerators/__init__.py -@@ -8,15 +8,15 @@ from .gnutls import GnuTLSGenerator +--- fedora-crypto-policies-20230920.570ea89.orig/python/policygenerators/__init__.py ++++ fedora-crypto-policies-20230920.570ea89/python/policygenerators/__init__.py +@@ -8,7 +8,7 @@ from .gnutls import GnuTLSGenerator from .java import JavaGenerator from .java import JavaSystemGenerator from .krb5 import KRB5Generator @@ -11,9 +11,10 @@ from .libssh import LibsshGenerator from .nss import NSSGenerator from .openssh import OpenSSHClientGenerator - from .openssh import OpenSSHServerGenerator +@@ -16,8 +16,8 @@ from .openssh import OpenSSHServerGenera from .openssl import OpenSSLConfigGenerator from .openssl import OpenSSLGenerator + from .openssl import OpenSSLFIPSGenerator -from .sequoia import SequoiaGenerator -from .sequoia import RPMSequoiaGenerator +# from .sequoia import SequoiaGenerator @@ -21,7 +22,7 @@ __all__ = [ 'BindGenerator', -@@ -24,13 +24,14 @@ __all__ = [ +@@ -25,7 +25,6 @@ __all__ = [ 'JavaGenerator', 'JavaSystemGenerator', 'KRB5Generator', @@ -29,14 +30,15 @@ 'LibsshGenerator', 'NSSGenerator', 'OpenSSHClientGenerator', - 'OpenSSHServerGenerator', +@@ -33,6 +32,8 @@ __all__ = [ 'OpenSSLConfigGenerator', 'OpenSSLGenerator', + 'OpenSSLFIPSGenerator', - 'SequoiaGenerator', - 'RPMSequoiaGenerator', ] + -+# 'LibreswanGenerator', -+# 'SequoiaGenerator', -+# 'RPMSequoiaGenerator', ++# 'LibreswanGenerator', ++# 'SequoiaGenerator', ++# 'RPMSequoiaGenerator', ++++++ crypto-policies-revert-rh-allow-sha1-signatures.patch ++++++ --- /var/tmp/diff_new_pack.J7X0d7/_old 2023-10-02 20:04:05.993698042 +0200 +++ /var/tmp/diff_new_pack.J7X0d7/_new 2023-10-02 20:04:05.997698185 +0200 @@ -4,11 +4,11 @@ Subject: openssl: disable SHA-1 signatures in FUTURE/NO-SHA1 -Index: fedora-crypto-policies-20230614.5f3458e/policies/FUTURE.pol +Index: fedora-crypto-policies-20230920.570ea89/policies/FUTURE.pol =================================================================== ---- fedora-crypto-policies-20230614.5f3458e.orig/policies/FUTURE.pol -+++ fedora-crypto-policies-20230614.5f3458e/policies/FUTURE.pol -@@ -65,7 +65,3 @@ sha1_in_certs = 0 +--- fedora-crypto-policies-20230920.570ea89.orig/policies/FUTURE.pol ++++ fedora-crypto-policies-20230920.570ea89/policies/FUTURE.pol +@@ -66,7 +66,3 @@ sha1_in_certs = 0 arbitrary_dh_groups = 1 ssh_certs = 1 ssh_etm = 1 @@ -16,10 +16,10 @@ -# https://fedoraproject.org/wiki/Changes/StrongCryptoSettings3Forewarning1 -# SHA-1 signatures are blocked in OpenSSL in FUTURE only -__openssl_block_sha1_signatures = 1 -Index: fedora-crypto-policies-20230614.5f3458e/policies/modules/NO-SHA1.pmod +Index: fedora-crypto-policies-20230920.570ea89/policies/modules/NO-SHA1.pmod =================================================================== ---- fedora-crypto-policies-20230614.5f3458e.orig/policies/modules/NO-SHA1.pmod -+++ fedora-crypto-policies-20230614.5f3458e/policies/modules/NO-SHA1.pmod +--- fedora-crypto-policies-20230920.570ea89.orig/policies/modules/NO-SHA1.pmod ++++ fedora-crypto-policies-20230920.570ea89/policies/modules/NO-SHA1.pmod @@ -3,7 +3,3 @@ hash = -SHA1 sign = -*-SHA1 @@ -28,23 +28,23 @@ -# https://fedoraproject.org/wiki/Changes/StrongCryptoSettings3Preview1 -# SHA-1 signatures are blocked in OpenSSL in FUTURE only -__openssl_block_sha1_signatures = 1 -Index: fedora-crypto-policies-20230614.5f3458e/python/cryptopolicies/cryptopolicies.py +Index: fedora-crypto-policies-20230920.570ea89/python/cryptopolicies/cryptopolicies.py =================================================================== ---- fedora-crypto-policies-20230614.5f3458e.orig/python/cryptopolicies/cryptopolicies.py -+++ fedora-crypto-policies-20230614.5f3458e/python/cryptopolicies/cryptopolicies.py -@@ -19,7 +19,6 @@ from . import validation # moved out of +--- fedora-crypto-policies-20230920.570ea89.orig/python/cryptopolicies/cryptopolicies.py ++++ fedora-crypto-policies-20230920.570ea89/python/cryptopolicies/cryptopolicies.py +@@ -24,7 +24,6 @@ from . import validation # moved out of INT_DEFAULTS = {k: 0 for k in ( 'arbitrary_dh_groups', 'min_dh_size', 'min_dsa_size', 'min_rsa_size', -- '__openssl_block_sha1_signatures', +- '__openssl_block_sha1_signatures', # FUTURE/TEST-FEDORA39/NO-SHA1 'sha1_in_certs', 'ssh_certs', 'ssh_etm', )} -Index: fedora-crypto-policies-20230614.5f3458e/python/policygenerators/openssl.py +Index: fedora-crypto-policies-20230920.570ea89/python/policygenerators/openssl.py =================================================================== ---- fedora-crypto-policies-20230614.5f3458e.orig/python/policygenerators/openssl.py -+++ fedora-crypto-policies-20230614.5f3458e/python/policygenerators/openssl.py -@@ -7,14 +7,6 @@ from subprocess import check_output, Cal +--- fedora-crypto-policies-20230920.570ea89.orig/python/policygenerators/openssl.py ++++ fedora-crypto-policies-20230920.570ea89/python/policygenerators/openssl.py +@@ -7,13 +7,6 @@ from subprocess import check_output, Cal from .configgenerator import ConfigGenerator @@ -55,13 +55,12 @@ -[evp_properties] -rh-allow-sha1-signatures = {} -''' -- - class OpenSSLGenerator(ConfigGenerator): - CONFIG_NAME = 'openssl' -@@ -254,12 +246,6 @@ class OpenSSLConfigGenerator(OpenSSLGene - groups = [cls.group_map[i] for i in p['group'] if i in cls.group_map] - s += 'Groups = ' + ':'.join(groups) + '\n' + FIPS_MODULE_CONFIG = ''' + [fips_sect] +@@ -263,12 +256,6 @@ class OpenSSLConfigGenerator(OpenSSLGene + if policy.enums['__ems'] == 'RELAX': + s += 'Options = RHNoEnforceEMSinFIPS\n' - # In the future it'll be just - # s += RH_SHA1_SECTION.format('yes' if 'SHA1' in p['hash'] else 'no') @@ -72,11 +71,11 @@ return s @classmethod -Index: fedora-crypto-policies-20230614.5f3458e/tests/alternative-policies/FUTURE.pol +Index: fedora-crypto-policies-20230920.570ea89/tests/alternative-policies/FUTURE.pol =================================================================== ---- fedora-crypto-policies-20230614.5f3458e.orig/tests/alternative-policies/FUTURE.pol -+++ fedora-crypto-policies-20230614.5f3458e/tests/alternative-policies/FUTURE.pol -@@ -71,7 +71,3 @@ sha1_in_dnssec = 0 +--- fedora-crypto-policies-20230920.570ea89.orig/tests/alternative-policies/FUTURE.pol ++++ fedora-crypto-policies-20230920.570ea89/tests/alternative-policies/FUTURE.pol +@@ -73,7 +73,3 @@ sha1_in_dnssec = 0 arbitrary_dh_groups = 1 ssh_certs = 1 ssh_etm = 1 @@ -84,10 +83,10 @@ -# https://fedoraproject.org/wiki/Changes/StrongCryptoSettings3Preview1 -# SHA-1 signatures are blocked in OpenSSL in FUTURE only -__openssl_block_sha1_signatures = 1 -Index: fedora-crypto-policies-20230614.5f3458e/tests/outputs/DEFAULT-opensslcnf.txt +Index: fedora-crypto-policies-20230920.570ea89/tests/outputs/DEFAULT-opensslcnf.txt =================================================================== ---- fedora-crypto-policies-20230614.5f3458e.orig/tests/outputs/DEFAULT-opensslcnf.txt -+++ fedora-crypto-policies-20230614.5f3458e/tests/outputs/DEFAULT-opensslcnf.txt +--- fedora-crypto-policies-20230920.570ea89.orig/tests/outputs/DEFAULT-opensslcnf.txt ++++ fedora-crypto-policies-20230920.570ea89/tests/outputs/DEFAULT-opensslcnf.txt @@ -6,9 +6,3 @@ DTLS.MinProtocol = DTLSv1.2 DTLS.MaxProtocol = DTLSv1.2 SignatureAlgorithms = ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:ed25519:ed448:rsa_pss_pss_sha256:rsa_pss_pss_sha384:rsa_pss_pss_sha512:rsa_pss_rsae_sha256:rsa_pss_rsae_sha384:rsa_pss_rsae_sha512:RSA+SHA256:RSA+SHA384:RSA+SHA512:ECDSA+SHA224:RSA+SHA224 @@ -98,10 +97,10 @@ - -[evp_properties] -rh-allow-sha1-signatures = yes -Index: fedora-crypto-policies-20230614.5f3458e/tests/outputs/DEFAULT:FEDORA32-opensslcnf.txt +Index: fedora-crypto-policies-20230920.570ea89/tests/outputs/DEFAULT:FEDORA32-opensslcnf.txt =================================================================== ---- fedora-crypto-policies-20230614.5f3458e.orig/tests/outputs/DEFAULT:FEDORA32-opensslcnf.txt -+++ fedora-crypto-policies-20230614.5f3458e/tests/outputs/DEFAULT:FEDORA32-opensslcnf.txt +--- fedora-crypto-policies-20230920.570ea89.orig/tests/outputs/DEFAULT:FEDORA32-opensslcnf.txt ++++ fedora-crypto-policies-20230920.570ea89/tests/outputs/DEFAULT:FEDORA32-opensslcnf.txt @@ -6,9 +6,3 @@ DTLS.MinProtocol = DTLSv1 DTLS.MaxProtocol = DTLSv1.2 SignatureAlgorithms = ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:ed25519:ed448:rsa_pss_pss_sha256:rsa_pss_pss_sha384:rsa_pss_pss_sha512:rsa_pss_rsae_sha256:rsa_pss_rsae_sha384:rsa_pss_rsae_sha512:RSA+SHA256:RSA+SHA384:RSA+SHA512:ECDSA+SHA224:RSA+SHA224:ECDSA+SHA1:RSA+SHA1 @@ -112,10 +111,10 @@ - -[evp_properties] -rh-allow-sha1-signatures = yes -Index: fedora-crypto-policies-20230614.5f3458e/tests/outputs/DEFAULT:GOST-opensslcnf.txt +Index: fedora-crypto-policies-20230920.570ea89/tests/outputs/DEFAULT:GOST-opensslcnf.txt =================================================================== ---- fedora-crypto-policies-20230614.5f3458e.orig/tests/outputs/DEFAULT:GOST-opensslcnf.txt -+++ fedora-crypto-policies-20230614.5f3458e/tests/outputs/DEFAULT:GOST-opensslcnf.txt +--- fedora-crypto-policies-20230920.570ea89.orig/tests/outputs/DEFAULT:GOST-opensslcnf.txt ++++ fedora-crypto-policies-20230920.570ea89/tests/outputs/DEFAULT:GOST-opensslcnf.txt @@ -6,9 +6,3 @@ DTLS.MinProtocol = DTLSv1.2 DTLS.MaxProtocol = DTLSv1.2 SignatureAlgorithms = ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:ed25519:ed448:rsa_pss_pss_sha256:rsa_pss_pss_sha384:rsa_pss_pss_sha512:rsa_pss_rsae_sha256:rsa_pss_rsae_sha384:rsa_pss_rsae_sha512:RSA+SHA256:RSA+SHA384:RSA+SHA512:ECDSA+SHA224:RSA+SHA224 @@ -126,10 +125,10 @@ - -[evp_properties] -rh-allow-sha1-signatures = yes -Index: fedora-crypto-policies-20230614.5f3458e/tests/outputs/EMPTY-opensslcnf.txt +Index: fedora-crypto-policies-20230920.570ea89/tests/outputs/EMPTY-opensslcnf.txt =================================================================== ---- fedora-crypto-policies-20230614.5f3458e.orig/tests/outputs/EMPTY-opensslcnf.txt -+++ fedora-crypto-policies-20230614.5f3458e/tests/outputs/EMPTY-opensslcnf.txt +--- fedora-crypto-policies-20230920.570ea89.orig/tests/outputs/EMPTY-opensslcnf.txt ++++ fedora-crypto-policies-20230920.570ea89/tests/outputs/EMPTY-opensslcnf.txt @@ -2,9 +2,3 @@ CipherString = @SECLEVEL=0:-kPSK:-kDHEPS Ciphersuites = SignatureAlgorithms = @@ -140,10 +139,10 @@ - -[evp_properties] -rh-allow-sha1-signatures = yes -Index: fedora-crypto-policies-20230614.5f3458e/tests/outputs/FIPS-opensslcnf.txt +Index: fedora-crypto-policies-20230920.570ea89/tests/outputs/FIPS-opensslcnf.txt =================================================================== ---- fedora-crypto-policies-20230614.5f3458e.orig/tests/outputs/FIPS-opensslcnf.txt -+++ fedora-crypto-policies-20230614.5f3458e/tests/outputs/FIPS-opensslcnf.txt +--- fedora-crypto-policies-20230920.570ea89.orig/tests/outputs/FIPS-opensslcnf.txt ++++ fedora-crypto-policies-20230920.570ea89/tests/outputs/FIPS-opensslcnf.txt @@ -6,9 +6,3 @@ DTLS.MinProtocol = DTLSv1.2 DTLS.MaxProtocol = DTLSv1.2 SignatureAlgorithms = ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:rsa_pss_pss_sha256:rsa_pss_pss_sha384:rsa_pss_pss_sha512:rsa_pss_rsae_sha256:rsa_pss_rsae_sha384:rsa_pss_rsae_sha512:RSA+SHA256:RSA+SHA384:RSA+SHA512:ECDSA+SHA224:RSA+SHA224 @@ -154,10 +153,10 @@ - -[evp_properties] -rh-allow-sha1-signatures = yes -Index: fedora-crypto-policies-20230614.5f3458e/tests/outputs/FIPS:ECDHE-ONLY-opensslcnf.txt +Index: fedora-crypto-policies-20230920.570ea89/tests/outputs/FIPS:ECDHE-ONLY-opensslcnf.txt =================================================================== ---- fedora-crypto-policies-20230614.5f3458e.orig/tests/outputs/FIPS:ECDHE-ONLY-opensslcnf.txt -+++ fedora-crypto-policies-20230614.5f3458e/tests/outputs/FIPS:ECDHE-ONLY-opensslcnf.txt +--- fedora-crypto-policies-20230920.570ea89.orig/tests/outputs/FIPS:ECDHE-ONLY-opensslcnf.txt ++++ fedora-crypto-policies-20230920.570ea89/tests/outputs/FIPS:ECDHE-ONLY-opensslcnf.txt @@ -6,9 +6,3 @@ DTLS.MinProtocol = DTLSv1.2 DTLS.MaxProtocol = DTLSv1.2 SignatureAlgorithms = ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:rsa_pss_pss_sha256:rsa_pss_pss_sha384:rsa_pss_pss_sha512:rsa_pss_rsae_sha256:rsa_pss_rsae_sha384:rsa_pss_rsae_sha512:RSA+SHA256:RSA+SHA384:RSA+SHA512:ECDSA+SHA224:RSA+SHA224 @@ -168,10 +167,10 @@ - -[evp_properties] -rh-allow-sha1-signatures = yes -Index: fedora-crypto-policies-20230614.5f3458e/tests/outputs/FUTURE-opensslcnf.txt +Index: fedora-crypto-policies-20230920.570ea89/tests/outputs/FUTURE-opensslcnf.txt =================================================================== ---- fedora-crypto-policies-20230614.5f3458e.orig/tests/outputs/FUTURE-opensslcnf.txt -+++ fedora-crypto-policies-20230614.5f3458e/tests/outputs/FUTURE-opensslcnf.txt +--- fedora-crypto-policies-20230920.570ea89.orig/tests/outputs/FUTURE-opensslcnf.txt ++++ fedora-crypto-policies-20230920.570ea89/tests/outputs/FUTURE-opensslcnf.txt @@ -6,9 +6,3 @@ DTLS.MinProtocol = DTLSv1.2 DTLS.MaxProtocol = DTLSv1.2 SignatureAlgorithms = ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:ed25519:ed448:rsa_pss_pss_sha256:rsa_pss_pss_sha384:rsa_pss_pss_sha512:rsa_pss_rsae_sha256:rsa_pss_rsae_sha384:rsa_pss_rsae_sha512:RSA+SHA256:RSA+SHA384:RSA+SHA512 @@ -182,10 +181,10 @@ - -[evp_properties] -rh-allow-sha1-signatures = no -Index: fedora-crypto-policies-20230614.5f3458e/tests/outputs/GOST-ONLY-opensslcnf.txt +Index: fedora-crypto-policies-20230920.570ea89/tests/outputs/GOST-ONLY-opensslcnf.txt =================================================================== ---- fedora-crypto-policies-20230614.5f3458e.orig/tests/outputs/GOST-ONLY-opensslcnf.txt -+++ fedora-crypto-policies-20230614.5f3458e/tests/outputs/GOST-ONLY-opensslcnf.txt +--- fedora-crypto-policies-20230920.570ea89.orig/tests/outputs/GOST-ONLY-opensslcnf.txt ++++ fedora-crypto-policies-20230920.570ea89/tests/outputs/GOST-ONLY-opensslcnf.txt @@ -4,9 +4,3 @@ TLS.MinProtocol = TLSv1 TLS.MaxProtocol = TLSv1.3 SignatureAlgorithms = @@ -196,10 +195,10 @@ - -[evp_properties] -rh-allow-sha1-signatures = yes -Index: fedora-crypto-policies-20230614.5f3458e/tests/outputs/LEGACY-opensslcnf.txt +Index: fedora-crypto-policies-20230920.570ea89/tests/outputs/LEGACY-opensslcnf.txt =================================================================== ---- fedora-crypto-policies-20230614.5f3458e.orig/tests/outputs/LEGACY-opensslcnf.txt -+++ fedora-crypto-policies-20230614.5f3458e/tests/outputs/LEGACY-opensslcnf.txt +--- fedora-crypto-policies-20230920.570ea89.orig/tests/outputs/LEGACY-opensslcnf.txt ++++ fedora-crypto-policies-20230920.570ea89/tests/outputs/LEGACY-opensslcnf.txt @@ -6,9 +6,3 @@ DTLS.MinProtocol = DTLSv1 DTLS.MaxProtocol = DTLSv1.2 SignatureAlgorithms = ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:ed25519:ed448:rsa_pss_pss_sha256:rsa_pss_pss_sha384:rsa_pss_pss_sha512:rsa_pss_rsae_sha256:rsa_pss_rsae_sha384:rsa_pss_rsae_sha512:RSA+SHA256:RSA+SHA384:RSA+SHA512:ECDSA+SHA224:RSA+SHA224:DSA+SHA256:DSA+SHA384:DSA+SHA512:DSA+SHA224:ECDSA+SHA1:RSA+SHA1:DSA+SHA1 @@ -210,10 +209,10 @@ - -[evp_properties] -rh-allow-sha1-signatures = yes -Index: fedora-crypto-policies-20230614.5f3458e/tests/outputs/LEGACY:AD-SUPPORT-opensslcnf.txt +Index: fedora-crypto-policies-20230920.570ea89/tests/outputs/LEGACY:AD-SUPPORT-opensslcnf.txt =================================================================== ---- fedora-crypto-policies-20230614.5f3458e.orig/tests/outputs/LEGACY:AD-SUPPORT-opensslcnf.txt -+++ fedora-crypto-policies-20230614.5f3458e/tests/outputs/LEGACY:AD-SUPPORT-opensslcnf.txt +--- fedora-crypto-policies-20230920.570ea89.orig/tests/outputs/LEGACY:AD-SUPPORT-opensslcnf.txt ++++ fedora-crypto-policies-20230920.570ea89/tests/outputs/LEGACY:AD-SUPPORT-opensslcnf.txt @@ -6,9 +6,3 @@ DTLS.MinProtocol = DTLSv1 DTLS.MaxProtocol = DTLSv1.2 SignatureAlgorithms = ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:ed25519:ed448:rsa_pss_pss_sha256:rsa_pss_pss_sha384:rsa_pss_pss_sha512:rsa_pss_rsae_sha256:rsa_pss_rsae_sha384:rsa_pss_rsae_sha512:RSA+SHA256:RSA+SHA384:RSA+SHA512:ECDSA+SHA224:RSA+SHA224:DSA+SHA256:DSA+SHA384:DSA+SHA512:DSA+SHA224:ECDSA+SHA1:RSA+SHA1:DSA+SHA1 @@ -224,10 +223,10 @@ - -[evp_properties] -rh-allow-sha1-signatures = yes -Index: fedora-crypto-policies-20230614.5f3458e/tests/unit/test_cryptopolicy.py +Index: fedora-crypto-policies-20230920.570ea89/tests/unit/test_cryptopolicy.py =================================================================== ---- fedora-crypto-policies-20230614.5f3458e.orig/tests/unit/test_cryptopolicy.py -+++ fedora-crypto-policies-20230614.5f3458e/tests/unit/test_cryptopolicy.py +--- fedora-crypto-policies-20230920.570ea89.orig/tests/unit/test_cryptopolicy.py ++++ fedora-crypto-policies-20230920.570ea89/tests/unit/test_cryptopolicy.py @@ -260,7 +260,6 @@ def test_cryptopolicy_to_string_empty(tm min_dh_size = 0 min_dsa_size = 0 @@ -236,7 +235,7 @@ sha1_in_certs = 0 ssh_certs = 0 ssh_etm = 0 -@@ -291,7 +290,6 @@ def test_cryptopolicy_to_string_twisted( +@@ -292,7 +291,6 @@ def test_cryptopolicy_to_string_twisted( min_dh_size = 0 min_dsa_size = 0 min_rsa_size = 0 @@ -244,11 +243,11 @@ sha1_in_certs = 0 ssh_certs = 0 ssh_etm = 0 -Index: fedora-crypto-policies-20230614.5f3458e/policies/TEST-FEDORA39.pol +Index: fedora-crypto-policies-20230920.570ea89/policies/TEST-FEDORA39.pol =================================================================== ---- fedora-crypto-policies-20230614.5f3458e.orig/policies/TEST-FEDORA39.pol -+++ fedora-crypto-policies-20230614.5f3458e/policies/TEST-FEDORA39.pol -@@ -67,7 +67,3 @@ sha1_in_certs = 0 +--- fedora-crypto-policies-20230920.570ea89.orig/policies/TEST-FEDORA39.pol ++++ fedora-crypto-policies-20230920.570ea89/policies/TEST-FEDORA39.pol +@@ -68,7 +68,3 @@ sha1_in_certs = 0 arbitrary_dh_groups = 1 ssh_certs = 1 ssh_etm = 1 @@ -256,10 +255,10 @@ -# https://fedoraproject.org/wiki/Changes/StrongCryptoSettings3Forewarning1 -# SHA-1 signatures will blocked in OpenSSL -__openssl_block_sha1_signatures = 1 -Index: fedora-crypto-policies-20230614.5f3458e/tests/outputs/FEDORA38-opensslcnf.txt +Index: fedora-crypto-policies-20230920.570ea89/tests/outputs/FEDORA38-opensslcnf.txt =================================================================== ---- fedora-crypto-policies-20230614.5f3458e.orig/tests/outputs/FEDORA38-opensslcnf.txt -+++ fedora-crypto-policies-20230614.5f3458e/tests/outputs/FEDORA38-opensslcnf.txt +--- fedora-crypto-policies-20230920.570ea89.orig/tests/outputs/FEDORA38-opensslcnf.txt ++++ fedora-crypto-policies-20230920.570ea89/tests/outputs/FEDORA38-opensslcnf.txt @@ -6,9 +6,3 @@ DTLS.MinProtocol = DTLSv1.2 DTLS.MaxProtocol = DTLSv1.2 SignatureAlgorithms = ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:ed25519:ed448:rsa_pss_pss_sha256:rsa_pss_pss_sha384:rsa_pss_pss_sha512:rsa_pss_rsae_sha256:rsa_pss_rsae_sha384:rsa_pss_rsae_sha512:RSA+SHA256:RSA+SHA384:RSA+SHA512:ECDSA+SHA224:RSA+SHA224 @@ -270,10 +269,10 @@ - -[evp_properties] -rh-allow-sha1-signatures = yes -Index: fedora-crypto-policies-20230614.5f3458e/tests/outputs/TEST-FEDORA39-opensslcnf.txt +Index: fedora-crypto-policies-20230920.570ea89/tests/outputs/TEST-FEDORA39-opensslcnf.txt =================================================================== ---- fedora-crypto-policies-20230614.5f3458e.orig/tests/outputs/TEST-FEDORA39-opensslcnf.txt -+++ fedora-crypto-policies-20230614.5f3458e/tests/outputs/TEST-FEDORA39-opensslcnf.txt +--- fedora-crypto-policies-20230920.570ea89.orig/tests/outputs/TEST-FEDORA39-opensslcnf.txt ++++ fedora-crypto-policies-20230920.570ea89/tests/outputs/TEST-FEDORA39-opensslcnf.txt @@ -6,9 +6,3 @@ DTLS.MinProtocol = DTLSv1.2 DTLS.MaxProtocol = DTLSv1.2 SignatureAlgorithms = ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:ed25519:ed448:rsa_pss_pss_sha256:rsa_pss_pss_sha384:rsa_pss_pss_sha512:rsa_pss_rsae_sha256:rsa_pss_rsae_sha384:rsa_pss_rsae_sha512:RSA+SHA256:RSA+SHA384:RSA+SHA512:ECDSA+SHA224:RSA+SHA224 @@ -284,14 +283,42 @@ - -[evp_properties] -rh-allow-sha1-signatures = no -Index: fedora-crypto-policies-20230614.5f3458e/tests/outputs/FIPS:OSPP-opensslcnf.txt +Index: fedora-crypto-policies-20230920.570ea89/tests/outputs/FIPS:OSPP-opensslcnf.txt +=================================================================== +--- fedora-crypto-policies-20230920.570ea89.orig/tests/outputs/FIPS:OSPP-opensslcnf.txt ++++ fedora-crypto-policies-20230920.570ea89/tests/outputs/FIPS:OSPP-opensslcnf.txt +@@ -6,9 +6,3 @@ DTLS.MinProtocol = DTLSv1.2 + DTLS.MaxProtocol = DTLSv1.2 + SignatureAlgorithms = ECDSA+SHA384:ECDSA+SHA512:rsa_pss_pss_sha256:rsa_pss_pss_sha384:rsa_pss_pss_sha512:rsa_pss_rsae_sha256:rsa_pss_rsae_sha384:rsa_pss_rsae_sha512:RSA+SHA256:RSA+SHA384:RSA+SHA512 + Groups = secp521r1:secp384r1:ffdhe3072:ffdhe4096:ffdhe6144:ffdhe8192 +- +-[openssl_init] +-alg_section = evp_properties +- +-[evp_properties] +-rh-allow-sha1-signatures = yes +Index: fedora-crypto-policies-20230920.570ea89/tests/outputs/BSI-opensslcnf.txt =================================================================== ---- fedora-crypto-policies-20230614.5f3458e.orig/tests/outputs/FIPS:OSPP-opensslcnf.txt -+++ fedora-crypto-policies-20230614.5f3458e/tests/outputs/FIPS:OSPP-opensslcnf.txt +--- fedora-crypto-policies-20230920.570ea89.orig/tests/outputs/BSI-opensslcnf.txt ++++ fedora-crypto-policies-20230920.570ea89/tests/outputs/BSI-opensslcnf.txt @@ -6,9 +6,3 @@ DTLS.MinProtocol = DTLSv1.2 DTLS.MaxProtocol = DTLSv1.2 - SignatureAlgorithms = ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:rsa_pss_pss_sha256:rsa_pss_pss_sha384:rsa_pss_pss_sha512:rsa_pss_rsae_sha256:rsa_pss_rsae_sha384:rsa_pss_rsae_sha512:RSA+SHA256:RSA+SHA384:RSA+SHA512 + SignatureAlgorithms = ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:ed25519:ed448:rsa_pss_pss_sha256:rsa_pss_pss_sha384:rsa_pss_pss_sha512:rsa_pss_rsae_sha256:rsa_pss_rsae_sha384:rsa_pss_rsae_sha512:RSA+SHA256:RSA+SHA384:RSA+SHA512 + Groups = secp256r1:secp384r1:secp521r1:ffdhe2048:ffdhe3072:ffdhe4096:brainpoolP512r1:brainpoolP384r1:brainpoolP256r1 +- +-[openssl_init] +-alg_section = evp_properties +- +-[evp_properties] +-rh-allow-sha1-signatures = yes +Index: fedora-crypto-policies-20230920.570ea89/tests/outputs/FIPS:NO-ENFORCE-EMS-opensslcnf.txt +=================================================================== +--- fedora-crypto-policies-20230920.570ea89.orig/tests/outputs/FIPS:NO-ENFORCE-EMS-opensslcnf.txt ++++ fedora-crypto-policies-20230920.570ea89/tests/outputs/FIPS:NO-ENFORCE-EMS-opensslcnf.txt +@@ -7,9 +7,3 @@ DTLS.MaxProtocol = DTLSv1.2 + SignatureAlgorithms = ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:rsa_pss_pss_sha256:rsa_pss_pss_sha384:rsa_pss_pss_sha512:rsa_pss_rsae_sha256:rsa_pss_rsae_sha384:rsa_pss_rsae_sha512:RSA+SHA256:RSA+SHA384:RSA+SHA512:ECDSA+SHA224:RSA+SHA224 Groups = secp256r1:secp521r1:secp384r1:ffdhe2048:ffdhe3072:ffdhe4096:ffdhe6144:ffdhe8192 + Options = RHNoEnforceEMSinFIPS - -[openssl_init] -alg_section = evp_properties ++++++ crypto-policies.7.gz ++++++ --- /var/tmp/diff_new_pack.J7X0d7/_old 2023-10-02 20:04:06.025699192 +0200 +++ /var/tmp/diff_new_pack.J7X0d7/_new 2023-10-02 20:04:06.033699480 +0200 @@ -2,12 +2,12 @@ .\" Title: crypto-policies .\" Author: [see the "AUTHOR" section] .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/> -.\" Date: 08/31/2023 +.\" Date: 09/22/2023 .\" Manual: \ \& .\" Source: crypto-policies .\" Language: English .\" -.TH "CRYPTO\-POLICIES" "7" "08/31/2023" "crypto\-policies" "\ \&" +.TH "CRYPTO\-POLICIES" "7" "09/22/2023" "crypto\-policies" "\ \&" .\" ----------------------------------------------------------------- .\" * Define some portability stuff .\" ----------------------------------------------------------------- @@ -646,14 +646,196 @@ .RE .RE .PP +\fBBSI\fR +.RS 4 +A security policy based on recommendations by the german government agency BSI (Bundesamt fuer Sicherheit in der Informationstechnik, translated as "agency for security in software technology") in its ruleset BSI TR 02102 (TR \- technical recommendation)\&. The BSI TR 02102 standard is updated in regular intervals\&. +.sp +.if n \{\ +.RS 4 +.\} +.nf +This policy does not allow the use of *SHA\-1* in signature algorithms +(except *DNSSEC* and *RPM*)\&. +.fi +.if n \{\ +.RE +.\} +.sp +.if n \{\ +.RS 4 +.\} +.nf +The policy also provides some (not complete) preparation for +post\-quantum encryption support in form of 256\-bit symmetric encryption +requirement\&. +.fi +.if n \{\ +.RE +.\} +.sp +.if n \{\ +.RS 4 +.\} +.nf +The *RSA* parameters are accepted if larger than 2047 bits, and +*Diffie\-Hellman* parameters are accepted if larger than 3071 bits\&. +.fi +.if n \{\ +.RE +.\} +.sp +.if n \{\ +.RS 4 +.\} +.nf +This policy provides at least 128\-bit security, excepting the transition +of *RSA*\&. +.fi +.if n \{\ +.RE +.\} +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +MACs: all +\fBHMAC\fR +with +\fBSHA\-256\fR +or better + all modern MACs +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +Curves: all prime >= 255 bits (including Bernstein curves) +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +Signature algorithms: with +\fBSHA\-256\fR +hash or better (no +\fBDSA\fR) +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +\fBTLS\fR +Ciphers: >= 256\-bit key, >= 128\-bit block, only Authenticated Encryption (AE) ciphers +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +non\-TLS Ciphers: same as +\fBTLS\fR +ciphers with added non AE ciphers +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +key exchange: +\fBECDHE\fR, +\fBDHE\fR +(no +\fBDHE\-DSS\fR, no +\fBRSA\fR) +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +\fBDH\fR +params size: >= 3072 +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +\fBRSA\fR +keys size: >= 2048 (until end of 2023, then it will switch to 3072) +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +\fBTLS\fR +protocols: +\fBTLS\fR +>= 1\&.2, +\fBDTLS\fR +>= 1\&.2 +.sp +.if n \{\ +.RS 4 +.\} +.nf +Note that compared to others profiles *Chacha20* and *Camellia* are not +recommended by the BSI\&. +.fi +.if n \{\ +.RE +.\} +.RE +.RE +.PP \fBFIPS\fR .RS 4 A policy to aid conformance to the -\fBFIPS 140\-2\fR +\fBFIPS 140\fR requirements\&. This policy is used internally by the \fBfips\-mode\-setup(8)\fR tool which can switch the system into the -\fBFIPS 140\-2\fR +\fBFIPS 140\fR mode\&. This policy provides at least 112\-bit security\&. .sp .RS 4 @@ -1056,7 +1238,7 @@ .RS 4 This command allows the system administrator to enable, or disable the system FIPS mode and also apply the \fBFIPS\fR -cryptographic policy which limits the allowed algorithms and protocols to these allowed by the FIPS 140\-2 requirements\&. +cryptographic policy which limits the allowed algorithms and protocols to these allowed by the FIPS 140 requirements\&. .RE .SH "NOTES" .sp ++++++ fedora-crypto-policies-20230614.5f3458e.tar.gz -> fedora-crypto-policies-20230920.570ea89.tar.gz ++++++ ++++ 2109 lines of diff (skipped) ++++++ fips-finish-install.8.gz ++++++ --- /var/tmp/diff_new_pack.J7X0d7/_old 2023-10-02 20:04:06.177704659 +0200 +++ /var/tmp/diff_new_pack.J7X0d7/_new 2023-10-02 20:04:06.181704803 +0200 @@ -2,12 +2,12 @@ .\" Title: fips-finish-install .\" Author: [see the "AUTHOR" section] .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/> -.\" Date: 08/31/2023 +.\" Date: 09/22/2023 .\" Manual: \ \& .\" Source: fips-finish-install .\" Language: English .\" -.TH "FIPS\-FINISH\-INSTAL" "8" "08/31/2023" "fips\-finish\-install" "\ \&" +.TH "FIPS\-FINISH\-INSTAL" "8" "09/22/2023" "fips\-finish\-install" "\ \&" .\" ----------------------------------------------------------------- .\" * Define some portability stuff .\" ----------------------------------------------------------------- @@ -31,17 +31,17 @@ fips-finish-install \- complete the installation of FIPS modules\&. .SH "SYNOPSIS" .sp -\fBfips\-finish\-install\fR \-\-complete +\fBfips\-finish\-install\fR [\-\-complete|\-\-undo] .SH "DESCRIPTION" .sp fips\-finish\-install(8) is used by the fips\-mode\-setup(8) command to complete the installation of the system FIPS modules\&. The tool is not supposed to be called directly by the system administrator, but it is possible to do so\&. -.sp -The completion of the installation cannot be undone\&. The system has to be reinstalled if the FIPS modules are not supposed to be installed anymore\&. .SH "OPTIONS" .sp The only recognized and mandatory option is: .sp \-\-complete: The command completes the FIPS module installation and calls \fIdracut \-f\fR to regenerate the initramfs\&. +.sp +\-\-undo: The command undoes some of the FIPS module installation steps\&. Please note that module installation cannot be undone without reformatting of and overwriting, at least once, the platform\(cqs hard drive or other permanent storage media\&. This option is not meant to be used in production, is not supported, and is implemented for testing purposes only\&. .SH "SEE ALSO" .sp fips\-mode\-setup(8) ++++++ fips-mode-setup.8.gz ++++++ --- /var/tmp/diff_new_pack.J7X0d7/_old 2023-10-02 20:04:06.197705378 +0200 +++ /var/tmp/diff_new_pack.J7X0d7/_new 2023-10-02 20:04:06.205705666 +0200 @@ -2,12 +2,12 @@ .\" Title: fips-mode-setup .\" Author: [see the "AUTHOR" section] .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/> -.\" Date: 08/31/2023 +.\" Date: 09/22/2023 .\" Manual: \ \& .\" Source: fips-mode-setup .\" Language: English .\" -.TH "FIPS\-MODE\-SETUP" "8" "08/31/2023" "fips\-mode\-setup" "\ \&" +.TH "FIPS\-MODE\-SETUP" "8" "09/22/2023" "fips\-mode\-setup" "\ \&" .\" ----------------------------------------------------------------- .\" * Define some portability stuff .\" ----------------------------------------------------------------- @@ -120,7 +120,7 @@ .sp -1 .IP \(bu 2.3 .\} -\-\-disable: Undo some of the FIPS\-enablement steps (unsupported)\&. +\-\-disable: Undo some of the FIPS\-enablement steps\&. Please note that module installation cannot be undone without reformatting of and overwriting, at least once, the platform\(cqs hard drive or other permanent storage media\&. This option is not meant to be used in production, is not supported, and is implemented for testing purposes only\&. .RE .sp .RS 4 ++++++ update-crypto-policies.8.gz ++++++ --- /var/tmp/diff_new_pack.J7X0d7/_old 2023-10-02 20:04:06.221706241 +0200 +++ /var/tmp/diff_new_pack.J7X0d7/_new 2023-10-02 20:04:06.229706529 +0200 @@ -2,12 +2,12 @@ .\" Title: update-crypto-policies .\" Author: [see the "AUTHOR" section] .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/> -.\" Date: 08/31/2023 +.\" Date: 09/22/2023 .\" Manual: \ \& .\" Source: update-crypto-policies .\" Language: English .\" -.TH "UPDATE\-CRYPTO\-POLI" "8" "08/31/2023" "update\-crypto\-policies" "\ \&" +.TH "UPDATE\-CRYPTO\-POLI" "8" "09/22/2023" "update\-crypto\-policies" "\ \&" .\" ----------------------------------------------------------------- .\" * Define some portability stuff .\" -----------------------------------------------------------------

1 0