commit gpg2.1687 for openSUSE:12.3:Update

Hello community, here is the log from the commit of package gpg2.1687 for openSUSE:12.3:Update checked in at 2013-05-31 17:38:11 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:12.3:Update/gpg2.1687 (Old) and /work/SRC/openSUSE:12.3:Update/.gpg2.1687.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "gpg2.1687" Changes: -------- New Changes file: --- /dev/null 2013-05-23 01:40:31.032032505 +0200 +++ /work/SRC/openSUSE:12.3:Update/.gpg2.1687.new/gpg2.changes 2013-05-31 17:38:12.000000000 +0200 @@ -0,0 +1,615 @@ +------------------------------------------------------------------- +Mon May 13 13:08:03 UTC 2013 - vcizek@suse.com + +- security fixes: + * fix for CVE-2012-6085 (bnc#798465) + added gpg2-CVE-2012-6085.patch + * fix for bnc#780943 + added gpg2-set_umask_before_open_outfile.patch + +------------------------------------------------------------------- +Fri Jan 11 20:26:50 UTC 2013 - lazy.kent@opensuse.org + +- BuildRequires: libbz2-devel (support BZIP2 compression + algorithm) (bnc#798175). + +------------------------------------------------------------------- +Wed Apr 18 10:55:34 UTC 2012 - vcizek@suse.com + +- Mention some of the changes in Greg's version update + +------------------------------------------------------------------- +Tue Mar 27 20:38:27 UTC 2012 - gregkh@opensuse.org + +- update to upstream 2.0.19 + * GPG now accepts a space separated fingerprint as a user ID. This + allows to copy and paste the fingerprint from the key listing. + * GPG now uses the longest key ID available. Removed support for the + original HKP keyserver which is not anymore used by any site. + * Rebuild the trustdb after changing the option --min-cert-level. + * Ukrainian translation. + * Honor option --cert-digest-algo when creating a cert. + * Emit a DECRYPTION_INFO status line. + * Improved detection of JPEG files. + +------------------------------------------------------------------- +Tue Dec 6 10:58:36 UTC 2011 - vcizek@suse.com + +- fixed licence to GPL-3.0+ (bnc#734878) + +------------------------------------------------------------------- +Wed Nov 30 09:55:47 UTC 2011 - coolo@suse.com + +- add automake as buildrequire to avoid implicit dependency + +------------------------------------------------------------------- +Sat Oct 1 15:53:04 UTC 2011 - crrodriguez@opensuse.org + +- Test suite hangs in qemu-arm, workaround. + +------------------------------------------------------------------- +Wed Aug 31 10:00:35 UTC 2011 - puzel@suse.com + +- link with -pie + +------------------------------------------------------------------- +Fri Aug 19 01:11:42 UTC 2011 - crrodriguez@opensuse.org + +- libcurl.m4 tests were broken, resulting in the usage + of a "fake" internal libcurl. + +------------------------------------------------------------------- +Sat Aug 6 20:19:09 UTC 2011 - andreas.stieger@gmx.de + +- update to upstream 2.0.18 + * Bug fix for newer versions of Libgcrypt. + * Support the SSH confirm flag and show SSH fingerprints in ssh + related pinentries. + * Improved dirmngr/gpgsm interaction for OCSP. + * Allow generation of card keys up to 4096 bit. +- refresh patch gnupg-2.0.10-tmpdir.diff -> gnupg-2.0.18-tmpdir.diff +- refresh patch gnupg-files-are-digests.patch -> gnupg-2.0.18-files-are-digests.patch + +------------------------------------------------------------------- +Tue Mar 15 09:29:42 UTC 2011 - puzel@novell.com + +- update to gnupg-2.0.17 + * Allow more hash algorithms with the OpenPGP v2 card. + * The gpg-agent now tests for a new gpg-agent.conf on a HUP. + * Fixed output of "gpgconf --check-options". + * Fixed a bug where Scdaemon sends a signal to Gpg-agent running + in non-daemon mode. + * Fixed TTY management for pinentries and session variable update + problem. +- drop gnupg-CVE-2010-2547.patch (in upstream) + +------------------------------------------------------------------- +Fri Jan 7 13:24:17 CET 2011 - sbrabec@suse.cz + +- Removed obsolete BuildRequires of opensc-devel. + +------------------------------------------------------------------- +Sun Oct 31 12:37:02 UTC 2010 - jengelh@medozas.de + +- Use %_smp_mflags + +------------------------------------------------------------------- +Wed Jul 28 09:39:00 UTC 2010 - puzel@novell.com + +- gnupg-CVE-2010-2547.patch (bnc#625947) +- renumber patches + +------------------------------------------------------------------- +Mon Jul 19 21:49:40 UTC 2010 - puzel@novell.com + +- update to gnupg-2.0.16 + * If the agent's --use-standard-socket option is active, all tools + try to start and daemonize the agent on the fly. In the past this + was only supported on W32; on non-W32 systems the new configure + option --use-standard-socket may now be used to use this feature by + default. + * The gpg-agent commands KILLAGENT and RELOADAGENT are now available + on all platforms. + * Minor bug fixes. +- drop gnupg-2.0.14-s2kcount.patch (builds fine without it now) + +------------------------------------------------------------------- +Mon Jun 7 09:40:32 UTC 2010 - adrian@suse.de + +- add special provides to make sure that obs signd gets correct gpg version + +------------------------------------------------------------------- +Fri Apr 9 12:47:11 UTC 2010 - chris@computersalat.de + +- fix deps + o libassuan-devel >= 2.0.0 + o pth / libpth-devel >= 1.3.7 +- added BuildReq libcurl-devel >= 7.10 +- removed BuildReq openldap2 + is already solved by openldap2-devel +- removed unrecognized configure options + --enable-external-hkp, --enable-shared, --enable-static-rnd + +------------------------------------------------------------------- +Wed Apr 7 14:19:11 UTC 2010 - puzel@novell.com + +- add gnupg-dont-fail-with-seahorse-agent.patch (bnc#589994) + +------------------------------------------------------------------- +Wed Mar 31 13:47:00 UTC 2010 - puzel@novell.com + +- update to gnupg-2.0.15 + * New command --passwd for GPG. + * Fixes a regression in 2.0.14 which prevented unprotection of new + or changed gpg-agent passphrases. + * Make use of libassuan 2.0 which is available as a DSO. + +------------------------------------------------------------------- +Mon Mar 22 15:09:24 UTC 2010 - puzel@novell.com + +- fix files-are-digests patch (bnc#469229) + +------------------------------------------------------------------- +Wed Feb 17 13:29:18 CET 2010 - dimstar@opensuse.org + +- Update to version 2.0.14: + + The default for --include-cert is now to include all + certificates in the chain except for the root certificate. + + Numerical values may now be used as an alternative to the + debug-level keywords. + + The GPGSM --audit-log feature is now more complete. + + GPG now supports DNS lookups for SRV, PKA and CERT on W32. + + New GPGSM option --ignore-cert-extension. + + New and changed passphrases are now created with an iteration + count requiring about 100ms of CPU work. +- Add gnupg-2.0.14-s2kcount.patch: use fixed s2k-count number + otherwise the gpg2 would want to consult gpg-agent which is not + yet installed in the mock chroot (Patch shamelessly stolen from + Fedora). + +------------------------------------------------------------------- +Thu Jan 28 14:15:24 UTC 2010 - puzel@novell.com + +- fix build for older distributions + +------------------------------------------------------------------- +Wed Jan 27 16:30:41 UTC 2010 - puzel@novell.com + +- port files-are-digests patch from gpg1 (bnc#469229) + +------------------------------------------------------------------- +Tue Dec 15 20:56:35 CET 2009 - jengelh@medozas.de + +- enable parallel building +- SPARC needs large PIE model + +------------------------------------------------------------------- +Sun Dec 6 08:52:32 UTC 2009 - coolo@novell.com + +- change -lang require to recommended + +------------------------------------------------------------------- +Fri Nov 13 14:37:58 UTC 2009 - puzel@novell.com + +- update to gnupg-2.0.13 + * GPG now generates 2048 bit RSA keys by default. The default hash + algorithm preferences has changed to prefer SHA-256 over SHA-1. + 2048 bit DSA keys are now generated to use a 256 bit hash algorithm ++++ 418 more lines (skipped) ++++ between /dev/null ++++ and /work/SRC/openSUSE:12.3:Update/.gpg2.1687.new/gpg2.changes New: ---- gnupg-2.0.18-files-are-digests.patch gnupg-2.0.18-tmpdir.diff gnupg-2.0.19.tar.bz2 gnupg-2.0.4-install_tools.diff gnupg-2.0.9-RSA_ES.patch gnupg-2.0.9-langinfo.patch gnupg-broken-curl-test.patch gnupg-dont-fail-with-seahorse-agent.patch gpg2-CVE-2012-6085.patch gpg2-set_umask_before_open_outfile.patch gpg2.changes gpg2.spec ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ gpg2.spec ++++++ # # spec file for package gpg2 # # Copyright (c) 2013 SUSE LINUX Products GmbH, Nuernberg, Germany. # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed # upon. The license for this file, and modifications and additions to the # file, is the same license as for the pristine package itself (unless the # license for the pristine package is not an Open Source License, in which # case the license is the MIT License). An "Open Source License" is a # license that conforms to the Open Source Definition (Version 1.9) # published by the Open Source Initiative. # Please submit bugfixes or comments via http://bugs.opensuse.org/ # Name: gpg2 Version: 2.0.19 Release: 0 BuildRequires: automake BuildRequires: expect BuildRequires: fdupes BuildRequires: libadns-devel BuildRequires: libassuan-devel >= 2.0.0 BuildRequires: libbz2-devel BuildRequires: libcurl-devel >= 7.10 BuildRequires: libgcrypt-devel >= 1.4.0 BuildRequires: libgpg-error-devel >= 1.7 BuildRequires: libksba-devel >= 1.0.7 BuildRequires: libusb-devel BuildRequires: openldap2-devel BuildRequires: readline-devel BuildRequires: zlib-devel %if 0%{?suse_version} >= 1120 BuildRequires: libpth-devel >= 1.3.7 %else BuildRequires: pth >= 1.3.7 %endif Url: http://www.gnupg.org/aegypten2/ PreReq: %install_info_prereq Requires: dirmngr Requires: pinentry Recommends: %name-lang = %{version} Provides: gnupg = %{version} Provides: gpg = 1.4.9 Provides: newpg # special feature needed for OBS signd Provides: gpg2_signd_support Obsoletes: gpg < 1.4.9 Summary: GnuPG 2 License: GPL-3.0+ Group: Productivity/Networking/Security Source: gnupg-%{version}.tar.bz2 Patch1: gnupg-2.0.18-tmpdir.diff Patch2: gnupg-2.0.4-install_tools.diff Patch3: gnupg-2.0.9-RSA_ES.patch Patch4: gnupg-2.0.9-langinfo.patch Patch5: gnupg-2.0.18-files-are-digests.patch Patch6: gnupg-dont-fail-with-seahorse-agent.patch Patch7: gnupg-broken-curl-test.patch Patch8: gpg2-CVE-2012-6085.patch Patch9: gpg2-set_umask_before_open_outfile.patch BuildRoot: %{_tmppath}/%{name}-%{version}-build %description GnuPG 2 is the successor of "GnuPG" or GPG. It provides: GPGSM, gpg-agent, and a keybox library. %lang_package %prep %setup -q -n gnupg-%version %patch1 -p1 %patch2 %patch3 -p1 %patch4 %patch5 -p1 %patch6 -p1 %patch7 -p1 %patch8 -p1 %patch9 -p1 %build autoreconf -fi # build PIEs (position independent executables) for address space randomisation: %ifarch s390x %sparc # s390x needs to use the large PIE model (at least for gpg.c): PIE="-fPIE" %else PIE="-fpie" %endif export CFLAGS="%{optflags} ${PIE}" export LDFLAGS=-pie %configure \ --libexecdir=%{_libdir} \ --docdir=%{_docdir}/%{name} \ --with-agent-pgm=%{_prefix}/bin/gpg-agent \ --with-pinentry-pgm=%{_prefix}/bin/pinentry \ --with-dirmngr-pgm=%{_prefix}/bin/dirmngr \ --with-scdaemon-pgm=%{_prefix}/bin/scdaemon \ --enable-ldap \ --enable-gpgsm=yes \ --enable-gpg \ --with-gnu-ld make %{?_smp_mflags} %install %makeinstall mkdir -p $RPM_BUILD_ROOT/etc/gnupg/ # bnc#391347 install -m 644 doc/examples/gpgconf.conf $RPM_BUILD_ROOT/etc/gnupg # delete to prevent fdupes from creating cross-partition hardlink rm -rf $RPM_BUILD_ROOT/usr/share/doc/packages/gpg2/examples/gpgconf.conf rm $RPM_BUILD_ROOT/usr/share/info/dir # compat symlinks ln -sf gpg2 $RPM_BUILD_ROOT/usr/bin/gpg ln -sf gpgv2 $RPM_BUILD_ROOT/usr/bin/gpgv ln -sf gpg2.1 $RPM_BUILD_ROOT/usr/share/man/man1/gpg.1 ln -sf gpgv2.1 $RPM_BUILD_ROOT/usr/share/man/man1/gpgv.1 # fix rpmlint invalid-lc-messages-dir: rm -rf $RPM_BUILD_ROOT/%_datadir/locale/en@{bold,}quot # additional files to documentation directory install -m 644 AUTHORS COPYING ChangeLog NEWS THANKS TODO doc/FAQ $RPM_BUILD_ROOT/%{_docdir}/%{name} %find_lang gnupg2 %if 0%{?suse_version} > 1020 %fdupes %buildroot %endif %check %if ! 0%{?qemu_user_space_build} make check $RPM_BUILD_ROOT/usr/bin/gpgsplit -v -p pubsplit- --uncompress version >= 4) { + log_bug("files-are-digests doesn't work with v4 sigs\n"); + } rc = do_sign( sk, sig, md, hash_for (sk) ); gcry_md_close (md); @@ -723,6 +727,8 @@ sign_file( strlist_t filenames, int deta SK_LIST sk_rover = NULL; int multifile = 0; u32 duration=0; + int sigclass = 0x00; + u32 timestamp = 0; pfx = new_progress_context (); afx = new_armor_context (); @@ -739,7 +745,16 @@ sign_file( strlist_t filenames, int deta fname = NULL; if( fname && filenames->next && (!detached || encryptflag) ) - log_bug("multiple files can only be detached signed"); + log_bug("multiple files can only be detached signed\n"); + + if (opt.files_are_digests && (multifile || !fname)) + log_bug("files-are-digests only works with one file\n"); + if (opt.files_are_digests && !detached) + log_bug("files-are-digests can only write detached signatures\n"); + if (opt.files_are_digests && !opt.def_digest_algo) + log_bug("files-are-digests needs --digest-algo\n"); + if (opt.files_are_digests && opt.textmode) + log_bug("files-are-digests doesn't work with --textmode\n"); if(encryptflag==2 && (rc=setup_symkey(&efx.symkey_s2k,&efx.symkey_dek))) @@ -767,7 +782,7 @@ sign_file( strlist_t filenames, int deta goto leave; /* prepare iobufs */ - if( multifile ) /* have list of filenames */ + if( multifile || opt.files_are_digests) /* have list of filenames */ inp = NULL; /* we do it later */ else { inp = iobuf_open(fname); @@ -900,7 +915,7 @@ sign_file( strlist_t filenames, int deta gcry_md_enable (mfx.md, hash_for(sk)); } - if( !multifile ) + if( !multifile && !opt.files_are_digests ) iobuf_push_filter( inp, md_filter, &mfx ); if( detached && !encryptflag && !RFC1991 ) @@ -955,6 +970,8 @@ sign_file( strlist_t filenames, int deta write_status_begin_signing (mfx.md); + sigclass = opt.textmode && !outfile? 0x01 : 0x00; + /* Setup the inner packet. */ if( detached ) { if( multifile ) { @@ -995,6 +1012,45 @@ sign_file( strlist_t filenames, int deta if( opt.verbose ) putc( '\n', stderr ); } + else if (opt.files_are_digests) { + byte *mdb, ts[5]; + size_t mdlen; + const char *fp; + int c, d; + + gcry_md_final(mfx.md); + /* this assumes gcry_md_read returns the same buffer */ + mdb = gcry_md_read(mfx.md, opt.def_digest_algo); + mdlen = gcry_md_get_algo_dlen(opt.def_digest_algo); + if (strlen(fname) != mdlen * 2 + 11) + log_bug("digests must be %d + @ + 5 bytes\n", mdlen); + d = -1; + for (fp = fname ; *fp; ) { + c = *fp++; + if (c >= '0' && c <= '9') + c -= '0'; + else if (c >= 'a' && c <= 'f') + c -= 'a' - 10; + else if (c >= 'A' && c <= 'F') + c -= 'A' - 10; + else + log_bug("filename is not hex\n"); + if (d >= 0) { + *mdb++ = d << 4 | c; + c = -1; + if (--mdlen == 0) { + mdb = ts; + if (*fp++ != '@') + log_bug("missing time separator\n"); + } + } + d = c; + } + sigclass = ts[0]; + if (sigclass != 0x00 && sigclass != 0x01) + log_bug("bad cipher class\n"); + timestamp = buffer_to_u32(ts + 1); + } else { /* read, so that the filter can calculate the digest */ while( iobuf_get(inp) != -1 ) @@ -1012,8 +1068,8 @@ sign_file( strlist_t filenames, int deta /* write the signatures */ rc = write_signature_packets (sk_list, out, mfx.md, - opt.textmode && !outfile? 0x01 : 0x00, - 0, duration, detached ? 'D':'S'); + sigclass, + timestamp, duration, detached ? 'D':'S'); if( rc ) goto leave; ++++++ gnupg-2.0.18-tmpdir.diff ++++++ diff -rup gnupg-2.0.18.orig/agent/gpg-agent.c gnupg-2.0.18/agent/gpg-agent.c --- gnupg-2.0.18.orig/agent/gpg-agent.c 2011-08-04 10:57:02.000000000 +0100 +++ gnupg-2.0.18/agent/gpg-agent.c 2011-08-06 21:01:32.000000000 +0100 @@ -1002,6 +1002,10 @@ main (int argc, char **argv ) gnupg_fd_t fd_ssh; pid_t pid; + char *tmp1, *tmp; + char *tmp2 = "gpg-XXXXXX/S.gpg-agent"; + size_t len; + /* Remove the DISPLAY variable so that a pinentry does not default to a specific display. There is still a default display when gpg-agent was started using --display or a @@ -1013,13 +1017,23 @@ main (int argc, char **argv ) unsetenv ("DISPLAY"); #endif + if ((tmp1 = getenv("TMPDIR")) == NULL) + tmp1 = "/tmp"; + + len = strlen(tmp1) + strlen(tmp2) + 10; + tmp = malloc(len); + + snprintf(tmp, len, "%s%s%s", tmp1, tmp1 && strlen(tmp1) > 0 ? "/" : "", tmp2); /* Create the sockets. */ socket_name = create_socket_name - ("S.gpg-agent", "/tmp/gpg-XXXXXX/S.gpg-agent"); - if (opt.ssh_support) + ("S.gpg-agent", tmp); + if (opt.ssh_support) { + snprintf(tmp, len, "%s%s%s.ssh", tmp1, tmp1 && strlen(tmp1) > 0 ? "/" : "", tmp2); socket_name_ssh = create_socket_name - ("S.gpg-agent.ssh", "/tmp/gpg-XXXXXX/S.gpg-agent.ssh"); + ("S.gpg-agent.ssh", tmp); + } + free(tmp); fd = create_server_socket (socket_name, 0, &socket_nonce); if (opt.ssh_support) ++++++ gnupg-2.0.4-install_tools.diff ++++++ Index: tools/Makefile.am =================================================================== --- tools/Makefile.am.orig +++ tools/Makefile.am @@ -32,8 +32,8 @@ sbin_SCRIPTS = addgnupghome applygnupgde bin_SCRIPTS = gpgsm-gencert.sh if HAVE_USTAR -# bin_SCRIPTS += gpg-zip -noinst_SCRIPTS = gpg-zip +bin_SCRIPTS += gpg-zip +#noinst_SCRIPTS = gpg-zip endif if BUILD_SYMCRYPTRUN @@ -51,14 +51,14 @@ endif bin_PROGRAMS = gpgconf gpg-connect-agent gpgkey2ssh ${symcryptrun} ${gpgtar} if !HAVE_W32_SYSTEM -bin_PROGRAMS += watchgnupg gpgparsemail +bin_PROGRAMS += watchgnupg gpgparsemail gpgsplit endif if !DISABLE_REGEX libexec_PROGRAMS = gpg-check-pattern endif -noinst_PROGRAMS = clean-sat mk-tdata make-dns-cert gpgsplit +noinst_PROGRAMS = clean-sat mk-tdata make-dns-cert common_libs = $(libcommon) ../jnlib/libjnlib.a ../gl/libgnu.a pwquery_libs = ../common/libsimple-pwquery.a ++++++ gnupg-2.0.9-RSA_ES.patch ++++++ # adds back support for deprecated RSA_E, RSA_S algorithms Index: gnupg-2.0.13/g10/misc.c =================================================================== --- gnupg-2.0.13.orig/g10/misc.c 2009-07-16 08:22:45.000000000 +0200 +++ gnupg-2.0.13/g10/misc.c 2009-11-13 13:19:39.000000000 +0100 @@ -1308,6 +1308,8 @@ pubkey_get_npkey( int algo ) if (algo == GCRY_PK_ELG_E) algo = GCRY_PK_ELG; + if (algo == GCRY_PK_RSA_E || algo == GCRY_PK_RSA_S) + algo = GCRY_PK_RSA; if (gcry_pk_algo_info( algo, GCRYCTL_GET_ALGO_NPKEY, NULL, &n)) n = 0; return n; @@ -1321,6 +1323,8 @@ pubkey_get_nskey( int algo ) if (algo == GCRY_PK_ELG_E) algo = GCRY_PK_ELG; + if (algo == GCRY_PK_RSA_E || algo == GCRY_PK_RSA_S) + algo = GCRY_PK_RSA; if (gcry_pk_algo_info( algo, GCRYCTL_GET_ALGO_NSKEY, NULL, &n )) n = 0; return n; @@ -1334,6 +1338,8 @@ pubkey_get_nsig( int algo ) if (algo == GCRY_PK_ELG_E) algo = GCRY_PK_ELG; + if (algo == GCRY_PK_RSA_E || algo == GCRY_PK_RSA_S) + algo = GCRY_PK_RSA; if (gcry_pk_algo_info( algo, GCRYCTL_GET_ALGO_NSIGN, NULL, &n)) n = 0; return n; @@ -1347,6 +1353,8 @@ pubkey_get_nenc( int algo ) if (algo == GCRY_PK_ELG_E) algo = GCRY_PK_ELG; + if (algo == GCRY_PK_RSA_E || algo == GCRY_PK_RSA_S) + algo = GCRY_PK_RSA; if (gcry_pk_algo_info( algo, GCRYCTL_GET_ALGO_NENCR, NULL, &n )) n = 0; return n; ++++++ gnupg-2.0.9-langinfo.patch ++++++ # fix [bnc#305725] - non latin characters displayed incorrectly by pinentry Index: jnlib/utf8conv.c =================================================================== --- jnlib/utf8conv.c.orig 2008-11-04 15:39:06.000000000 +0100 +++ jnlib/utf8conv.c 2009-06-18 11:42:36.000000000 +0200 @@ -203,6 +203,7 @@ set_native_charset (const char *newset) #else /*!HAVE_W32_SYSTEM*/ #ifdef HAVE_LANGINFO_CODESET + setlocale(LC_ALL, ""); newset = nl_langinfo (CODESET); #else /*!HAVE_LANGINFO_CODESET*/ /* Try to get the used charset from environment variables. */ ++++++ gnupg-broken-curl-test.patch ++++++ diff --git a/m4/libcurl.m4 b/m4/libcurl.m4 index 7d1dbd3..92cf801 100644 --- a/m4/libcurl.m4 +++ b/m4/libcurl.m4 @@ -68,13 +68,7 @@ AC_DEFUN([LIBCURL_CHECK_CONFIG], _libcurl_try_link=yes - if test -d "$_libcurl_with" ; then - LIBCURL_CPPFLAGS="-I$withval/include" - _libcurl_ldflags="-L$withval/lib" - AC_PATH_PROG([_libcurl_config],["$withval/bin/curl-config"]) - else AC_PATH_PROG([_libcurl_config],[curl-config]) - fi if test x$_libcurl_config != "x" ; then AC_CACHE_CHECK([for the version of libcurl], ++++++ gnupg-dont-fail-with-seahorse-agent.patch ++++++ --- g10/passphrase.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Index: gnupg-2.0.15/g10/passphrase.c =================================================================== --- gnupg-2.0.15.orig/g10/passphrase.c 2010-01-11 15:11:17.000000000 +0100 +++ gnupg-2.0.15/g10/passphrase.c 2010-04-07 16:06:49.000000000 +0200 @@ -72,7 +72,7 @@ encode_s2k_iterations (int iterations) { /* Don't print an error if an older agent is used. */ if (err && gpg_err_code (err) != GPG_ERR_ASS_PARAMETER) - log_error (_("problem with the agent: %s\n"), gpg_strerror (err)); + log_info (_("problem with the agent: %s\n"), gpg_strerror (err)); /* Default to 65536 which we used up to 2.0.13. */ return 96; } ++++++ gpg2-CVE-2012-6085.patch ++++++ commit 498882296ffac7987c644aaf2a0aa108a2925471 Author: Werner Koch Date: Thu Dec 20 09:43:41 2012 +0100 gpg: Import only packets which are allowed in a keyblock. * g10/import.c (valid_keyblock_packet): New. (read_block): Store only valid packets. -- A corrupted key, which for example included a mangled public key encrypted packet, used to corrupt the keyring. This change skips all packets which are not allowed in a keyblock. GnuPG-bug-id: 1455 (cherry-picked from commit 3a4b96e665fa639772854058737ee3d54ba0694e) diff --git a/g10/import.c b/g10/import.c index ba2439d..ad112d6 100644 --- a/g10/import.c +++ b/g10/import.c @@ -347,6 +347,27 @@ import_print_stats (void *hd) } +/* Return true if PKTTYPE is valid in a keyblock. */ +static int +valid_keyblock_packet (int pkttype) +{ + switch (pkttype) + { + case PKT_PUBLIC_KEY: + case PKT_PUBLIC_SUBKEY: + case PKT_SECRET_KEY: + case PKT_SECRET_SUBKEY: + case PKT_SIGNATURE: + case PKT_USER_ID: + case PKT_ATTRIBUTE: + case PKT_RING_TRUST: + return 1; + default: + return 0; + } +} + + /**************** * Read the next keyblock from stream A. * PENDING_PKT should be initialzed to NULL @@ -424,7 +445,7 @@ read_block( IOBUF a, PACKET **pending_pkt, KBNODE *ret_root ) } in_cert = 1; default: - if( in_cert ) { + if (in_cert && valid_keyblock_packet (pkt->pkttype)) { if( !root ) root = new_kbnode( pkt ); else ++++++ gpg2-set_umask_before_open_outfile.patch ++++++ Index: gnupg-2.0.20/g10/plaintext.c =================================================================== --- gnupg-2.0.20.orig/g10/plaintext.c 2013-05-13 14:26:49.290737159 +0200 +++ gnupg-2.0.20/g10/plaintext.c 2013-05-13 14:43:21.740575875 +0200 @@ -25,6 +25,7 @@ #include #include #include +#include #ifdef HAVE_DOSISH_SYSTEM #include /* for setmode() */ #endif @@ -39,6 +40,9 @@ #include "status.h" #include "i18n.h" +/* define safe permissions for creating plaintext files */ +#define GPG_SAFE_PERMS (S_IRUSR | S_IWUSR) +#define GPG_SAFE_UMASK (0777 & ~GPG_SAFE_PERMS) /**************** * Handle a plaintext packet. If MFX is not NULL, update the MDs @@ -140,10 +144,15 @@ handle_plaintext( PKT_plaintext *pt, md_ log_error(_("error creating `%s': %s\n"), fname, strerror(errno) ); goto leave; } - else if( !(fp = fopen(fname,"wb")) ) { - rc = gpg_error_from_syserror (); - log_error(_("error creating `%s': %s\n"), fname, strerror(errno) ); - goto leave; + else { + mode_t saved_umask = umask(GPG_SAFE_UMASK); + if( !(fp = fopen(fname,"wb")) ) { + rc = gpg_error_from_syserror (); + log_error(_("error creating `%s': %s\n"), fname, strerror(errno) ); + umask(saved_umask); + goto leave; + } + umask(saved_umask); } #else /* __riscos__ */ /* If no output filename was given, i.e. we constructed it, -- To unsubscribe, e-mail: opensuse-commit+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-commit+help@opensuse.org