-
Notifications
You must be signed in to change notification settings - Fork 5
/
openssl.spec
1624 lines (1254 loc) · 57.8 KB
/
openssl.spec
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
# For the curious:
# 0.9.5a soversion = 0
# 0.9.6 soversion = 1
# 0.9.6a soversion = 2
# 0.9.6c soversion = 3
# 0.9.7a soversion = 4
# 0.9.7ef soversion = 5
# 0.9.8ab soversion = 6
# 0.9.8g soversion = 7
# 0.9.8jk + EAP-FAST soversion = 8
# 1.0.0 soversion = 10
%define soversion 10
%define nofips 1
# Number of threads to spawn when testing some threading fixes.
%define thread_test_threads %{?threads:%{threads}}%{!?threads:1}
# Arches on which we need to prevent arch conflicts on opensslconf.h, must
# also be handled in opensslconf-new.h.
%define multilib_arches %{ix86} ia64 ppc %{power64} s390 s390x sparcv9 sparc64 x86_64
Summary: Utilities from the general purpose cryptography library with TLS implementation
Name: openssl
Version: 1.0.1e
Release: 19%{?dist}
Epoch: 2
# We have to remove certain patented algorithms from the openssl source
# tarball with the hobble-openssl script which is included below.
# The original openssl upstream tarball cannot be shipped in the .src.rpm.
###Source: openssl-%{version}-usa.tar.xz
###Source1: hobble-openssl
Source: openssl-%{version}.tar.gz
Source2: Makefile.certificate
Source6: make-dummy-cert
Source7: renew-dummy-cert
Source8: openssl-thread-test.c
Source9: opensslconf-new.h
Source10: opensslconf-new-warning.h
Source11: README.FIPS
Source12: openssl-fips.conf
# Build changes
Patch1: openssl-1.0.1-beta2-rpmbuild.patch
Patch2: openssl-1.0.0f-defaults.patch
Patch4: openssl-1.0.0-beta5-enginesdir.patch
Patch5: openssl-0.9.8a-no-rpath.patch
Patch6: openssl-0.9.8b-test-use-localhost.patch
Patch7: openssl-1.0.0-timezone.patch
Patch8: openssl-1.0.1c-perlfind.patch
Patch9: openssl-1.0.1c-aliasing.patch
# Bug fixes
Patch23: openssl-1.0.1c-default-paths.patch
Patch24: openssl-1.0.1e-issuer-hash.patch
# Functionality changes
Patch33: openssl-1.0.0-beta4-ca-dir.patch
Patch34: openssl-0.9.6-x509.patch
Patch35: openssl-0.9.8j-version-add-engines.patch
Patch36: openssl-1.0.0e-doc-noeof.patch
Patch38: openssl-1.0.1-beta2-ssl-op-all.patch
Patch39: openssl-1.0.1c-ipv6-apps.patch
##Patch40: openssl-1.0.1e-fips.patch
Patch45: openssl-1.0.1e-env-zlib.patch
Patch47: openssl-1.0.0-beta5-readme-warning.patch
Patch49: openssl-1.0.1a-algo-doc.patch
Patch50: openssl-1.0.1-beta2-dtls1-abi.patch
Patch51: openssl-1.0.1e-version.patch
##Patch56: openssl-1.0.0c-rsa-x931.patch
##Patch58: openssl-1.0.1-beta2-fips-md5-allow.patch
Patch60: openssl-1.0.0d-apps-dgst.patch
Patch63: openssl-1.0.0d-xmpp-starttls.patch
Patch65: openssl-1.0.0e-chil-fixes.patch
Patch66: openssl-1.0.1-pkgconfig-krb5.patch
##Patch68: openssl-1.0.1e-secure-getenv.patch
Patch69: openssl-1.0.1c-dh-1024.patch
Patch71: openssl-1.0.1e-manfix.patch
##Patch72: openssl-1.0.1e-fips-ctor.patch
# Backported fixes including security fixes
Patch81: openssl-1.0.1-beta2-padlock64.patch
Patch82: openssl-1.0.1e-backports.patch
Patch83: openssl-1.0.1e-bad-mac.patch
Patch84: openssl-1.0.1e-trusted-first.patch
License: OpenSSL
Group: System Environment/Libraries
URL: http://www.openssl.org/
BuildRoot: %{_tmppath}/%{name}-%{version}-root
BuildRequires: coreutils, krb5-devel, perl, sed, zlib-devel, /usr/bin/cmp
BuildRequires: /usr/bin/rename
Requires: coreutils, make
Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
%description
The OpenSSL toolkit provides support for secure communications between
machines. OpenSSL includes a certificate management tool and shared
libraries which provide various cryptographic algorithms and
protocols.
%package libs
Summary: A general purpose cryptography library with TLS implementation
Group: System Environment/Libraries
Requires: ca-certificates >= 2008-5
# Needed obsoletes due to the base/lib subpackage split
Obsoletes: openssl < 1:1.0.1-0.3.beta3
%description libs
OpenSSL is a toolkit for supporting cryptography. The openssl-libs
package contains the libraries that are used by various applications which
support cryptographic algorithms and protocols.
%package devel
Summary: Files for development of applications which will use OpenSSL
Group: Development/Libraries
Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
Requires: krb5-devel%{?_isa}, zlib-devel%{?_isa}
Requires: pkgconfig
%description devel
OpenSSL is a toolkit for supporting cryptography. The openssl-devel
package contains include files needed to develop applications which
support various cryptographic algorithms and protocols.
%package static
Summary: Libraries for static linking of applications which will use OpenSSL
Group: Development/Libraries
Requires: %{name}-devel%{?_isa} = %{epoch}:%{version}-%{release}
%description static
OpenSSL is a toolkit for supporting cryptography. The openssl-static
package contains static libraries needed for static linking of
applications which support various cryptographic algorithms and
protocols.
%package perl
Summary: Perl scripts provided with OpenSSL
Group: Applications/Internet
Requires: perl
Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release}
%description perl
OpenSSL is a toolkit for supporting cryptography. The openssl-perl
package provides Perl scripts for converting certificates and keys
from other formats to the formats used by the OpenSSL toolkit.
%package fips
Summary: The FIPS module package for OpenSSL
Group: System Environment/Libraries
Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
%description fips
OpenSSL is a toolkit for supporting cryptography. The openssl-fips
package provides files that complete the installation of the
OpenSSL FIPS module.
%prep
%setup -q -n %{name}-%{version}
# The hobble_openssl is called here redundantly, just to be sure.
# The tarball has already the sources removed.
##%{SOURCE1} > /dev/null
%patch1 -p1 -b .rpmbuild
%patch2 -p1 -b .defaults
%patch4 -p1 -b .enginesdir %{?_rawbuild}
%patch5 -p1 -b .no-rpath
%patch6 -p1 -b .use-localhost
%patch7 -p1 -b .timezone
%patch8 -p1 -b .perlfind %{?_rawbuild}
%patch9 -p1 -b .aliasing
%patch23 -p1 -b .default-paths
%patch24 -p1 -b .issuer-hash
%patch33 -p1 -b .ca-dir
%patch34 -p1 -b .x509
%patch35 -p1 -b .version-add-engines
%patch36 -p1 -b .doc-noeof
%patch38 -p1 -b .op-all
%patch39 -p1 -b .ipv6-apps
##%patch40 -p1 -b .fips
%patch45 -p1 -b .env-zlib
%patch47 -p1 -b .warning
%patch49 -p1 -b .algo-doc
%patch50 -p1 -b .dtls1-abi
%patch51 -p1 -b .version
##%patch56 -p1 -b .x931
##%patch58 -p1 -b .md5-allow
%patch60 -p1 -b .dgst
%patch63 -p1 -b .starttls
%patch65 -p1 -b .chil
%patch66 -p1 -b .krb5
##%patch68 -p1 -b .secure-getenv
%patch69 -p1 -b .dh1024
%patch81 -p1 -b .padlock64
%patch82 -p1 -b .backports
%patch71 -p1 -b .manfix
##%patch72 -p1 -b .fips-ctor
%patch83 -p1 -b .bad-mac
%patch84 -p1 -b .trusted-first
sed -i 's/SHLIB_VERSION_NUMBER "1.0.0"/SHLIB_VERSION_NUMBER "%{version}"/' crypto/opensslv.h
# Modify the various perl scripts to reference perl in the right location.
perl util/perlpath.pl `dirname %{__perl}`
# Generate a table with the compile settings for my perusal.
touch Makefile
make TABLE PERL=%{__perl}
%build
# Figure out which flags we want to use.
# default
sslarch=%{_os}-%{_target_cpu}
%ifarch %ix86
sslarch=linux-elf
if ! echo %{_target} | grep -q i686 ; then
sslflags="no-asm 386"
fi
%endif
%ifarch sparcv9
sslarch=linux-sparcv9
sslflags=no-asm
%endif
%ifarch sparc64
sslarch=linux64-sparcv9
sslflags=no-asm
%endif
%ifarch alpha alphaev56 alphaev6 alphaev67
sslarch=linux-alpha-gcc
%endif
%ifarch s390 sh3eb sh4eb
sslarch="linux-generic32 -DB_ENDIAN"
%endif
%ifarch s390x
sslarch="linux64-s390x"
%endif
%ifarch %{arm}
sslarch=linux-armv4
%endif
%ifarch sh3 sh4
sslarch=linux-generic32
%endif
%ifarch %{power64}
sslarch=linux-ppc64
%endif
# ia64, x86_64, ppc are OK by default
# Configure the build tree. Override OpenSSL defaults with known-good defaults
# usable on all platforms. The Configure script already knows to use -fPIC and
# RPM_OPT_FLAGS, so we can skip specifiying them here.
./Configure \
--prefix=%{_prefix} --openssldir=%{_sysconfdir}/pki/tls ${sslflags} \
zlib enable-camellia enable-seed enable-tlsext enable-rfc3779 \
enable-cms enable-md2 no-mdc2 no-ssl2 enable-rc5 enable-ec enable-ec2m enable-ecdh enable-ecdsa enable-srp \
--with-krb5-flavor=MIT --enginesdir=%{_libdir}/openssl/engines \
--with-krb5-dir=/usr shared ${sslarch} %{?!nofips:fips}
# Add -Wa,--noexecstack here so that libcrypto's assembler modules will be
# marked as not requiring an executable stack.
# Also add -DPURIFY to make using valgrind with openssl easier as we do not
# want to depend on the uninitialized memory as a source of entropy anyway.
RPM_OPT_FLAGS="$RPM_OPT_FLAGS -Wa,--noexecstack -DPURIFY -DHMAC_SUFFIX=\\\".%{version}-%{release}.hmac\\\""
make depend
make all
# Generate hashes for the included certs.
make rehash
# Overwrite FIPS README
cp -f %{SOURCE11} .
%check
# Verify that what was compiled actually works.
# We must revert patch33 before tests otherwise they will fail
patch -p1 -R < %{PATCH33}
LD_LIBRARY_PATH=`pwd`${LD_LIBRARY_PATH:+:${LD_LIBRARY_PATH}}
export LD_LIBRARY_PATH
make -C test apps tests
%{__cc} -o openssl-thread-test \
`krb5-config --cflags` \
-I./include \
$RPM_OPT_FLAGS \
%{SOURCE8} \
-L. \
-lssl -lcrypto \
`krb5-config --libs` \
-lpthread -lz -ldl
./openssl-thread-test --threads %{thread_test_threads}
# Add generation of HMAC checksum of the final stripped library
%define __spec_install_post \
%{?__debug_package:%{__debug_install_post}} \
%{__arch_install_post} \
%{__os_install_post} \
## crypto/fips/fips_standalone_hmac $RPM_BUILD_ROOT%{_libdir}/libcrypto.so.%{version} >$RPM_BUILD_ROOT%{_libdir}/.libcrypto.so.%{version}.%{version}-%{release}.hmac \
## ln -sf .libcrypto.so.%{version}.%{version}-%{release}.hmac $RPM_BUILD_ROOT%{_libdir}/.libcrypto.so.%{soversion}.%{version}-%{release}.hmac \
## crypto/fips/fips_standalone_hmac $RPM_BUILD_ROOT%{_libdir}/libssl.so.%{version} >$RPM_BUILD_ROOT%{_libdir}/.libssl.so.%{version}.%{version}-%{release}.hmac \
## ln -sf .libssl.so.%{version}.%{version}-%{release}.hmac $RPM_BUILD_ROOT%{_libdir}/.libssl.so.%{soversion}.%{version}-%{release}.hmac \
%{nil}
%define __provides_exclude_from %{_libdir}/openssl
%install
[ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT
# Install OpenSSL.
install -d $RPM_BUILD_ROOT{%{_bindir},%{_includedir},%{_libdir},%{_mandir},%{_libdir}/openssl}
make INSTALL_PREFIX=$RPM_BUILD_ROOT install
make INSTALL_PREFIX=$RPM_BUILD_ROOT install_docs
mv $RPM_BUILD_ROOT%{_libdir}/engines $RPM_BUILD_ROOT%{_libdir}/openssl
mv $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/man/* $RPM_BUILD_ROOT%{_mandir}/
rmdir $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/man
rename so.%{soversion} so.%{version} $RPM_BUILD_ROOT%{_libdir}/*.so.%{soversion}
mkdir $RPM_BUILD_ROOT/%{_lib}
for lib in $RPM_BUILD_ROOT%{_libdir}/*.so.%{version} ; do
chmod 755 ${lib}
ln -s -f `basename ${lib}` $RPM_BUILD_ROOT%{_libdir}/`basename ${lib} .%{version}`
ln -s -f `basename ${lib}` $RPM_BUILD_ROOT%{_libdir}/`basename ${lib} .%{version}`.%{soversion}
done
# Install a makefile for generating keys and self-signed certs, and a script
# for generating them on the fly.
mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/certs
install -m644 %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/certs/Makefile
install -m755 %{SOURCE6} $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/certs/make-dummy-cert
install -m755 %{SOURCE7} $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/certs/renew-dummy-cert
# Make sure we actually include the headers we built against.
for header in $RPM_BUILD_ROOT%{_includedir}/openssl/* ; do
if [ -f ${header} -a -f include/openssl/$(basename ${header}) ] ; then
install -m644 include/openssl/`basename ${header}` ${header}
fi
done
# Rename man pages so that they don't conflict with other system man pages.
pushd $RPM_BUILD_ROOT%{_mandir}
ln -s -f config.5 man5/openssl.cnf.5
for manpage in man*/* ; do
if [ -L ${manpage} ]; then
TARGET=`ls -l ${manpage} | awk '{ print $NF }'`
ln -snf ${TARGET}ssl ${manpage}ssl
rm -f ${manpage}
else
mv ${manpage} ${manpage}ssl
fi
done
for conflict in passwd rand ; do
rename ${conflict} ssl${conflict} man*/${conflict}*
done
popd
# Pick a CA script.
pushd $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/misc
mv CA.sh CA
popd
mkdir -m755 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA
mkdir -m700 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA/private
mkdir -m755 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA/certs
mkdir -m755 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA/crl
mkdir -m755 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA/newcerts
# Ensure the openssl.cnf timestamp is identical across builds to avoid
# mulitlib conflicts and unnecessary renames on upgrade
touch -r %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/openssl.cnf
# Determine which arch opensslconf.h is going to try to #include.
basearch=%{_arch}
%ifarch %{ix86}
basearch=i386
%endif
%ifarch sparcv9
basearch=sparc
%endif
%ifarch sparc64
basearch=sparc64
%endif
%ifarch %{multilib_arches}
# Do an opensslconf.h switcheroo to avoid file conflicts on systems where you
# can have both a 32- and 64-bit version of the library, and they each need
# their own correct-but-different versions of opensslconf.h to be usable.
install -m644 %{SOURCE10} \
$RPM_BUILD_ROOT/%{_prefix}/include/openssl/opensslconf-${basearch}.h
cat $RPM_BUILD_ROOT/%{_prefix}/include/openssl/opensslconf.h >> \
$RPM_BUILD_ROOT/%{_prefix}/include/openssl/opensslconf-${basearch}.h
install -m644 %{SOURCE9} \
$RPM_BUILD_ROOT/%{_prefix}/include/openssl/opensslconf.h
%endif
#install prelink blacklist
mkdir -p $RPM_BUILD_ROOT/%{_sysconfdir}/prelink.conf.d
install -m644 %{SOURCE12} \
$RPM_BUILD_ROOT/%{_sysconfdir}/prelink.conf.d/openssl-fips.conf
# Remove unused files from upstream fips support
rm -rf $RPM_BUILD_ROOT/%{_bindir}/openssl_fips_fingerprint
rm -rf $RPM_BUILD_ROOT/%{_libdir}/fips_premain.*
rm -rf $RPM_BUILD_ROOT/%{_libdir}/fipscanister.*
%clean
[ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT
%files
%defattr(-,root,root)
%doc FAQ LICENSE CHANGES NEWS INSTALL README
%doc doc/c-indentation.el doc/openssl.txt
%doc doc/openssl_button.html doc/openssl_button.gif
%doc doc/ssleay.txt
%doc README.FIPS
%{_sysconfdir}/pki/tls/certs/make-dummy-cert
%{_sysconfdir}/pki/tls/certs/renew-dummy-cert
%{_sysconfdir}/pki/tls/certs/Makefile
%{_sysconfdir}/pki/tls/misc/CA
%dir %{_sysconfdir}/pki/CA
%dir %{_sysconfdir}/pki/CA/private
%dir %{_sysconfdir}/pki/CA/certs
%dir %{_sysconfdir}/pki/CA/crl
%dir %{_sysconfdir}/pki/CA/newcerts
%{_sysconfdir}/pki/tls/misc/c_*
%attr(0755,root,root) %{_bindir}/openssl
%attr(0644,root,root) %{_mandir}/man1*/[ABD-Zabcd-z]*
%attr(0644,root,root) %{_mandir}/man5*/*
%attr(0644,root,root) %{_mandir}/man7*/*
%files libs
%defattr(-,root,root)
%doc LICENSE
%dir %{_sysconfdir}/pki/tls
%dir %{_sysconfdir}/pki/tls/certs
%dir %{_sysconfdir}/pki/tls/misc
%dir %{_sysconfdir}/pki/tls/private
%config(noreplace) %{_sysconfdir}/pki/tls/openssl.cnf
%attr(0755,root,root) %{_libdir}/libcrypto.so.%{version}
%attr(0755,root,root) %{_libdir}/libcrypto.so.%{soversion}
%attr(0755,root,root) %{_libdir}/libssl.so.%{version}
%attr(0755,root,root) %{_libdir}/libssl.so.%{soversion}
%attr(0755,root,root) %{_libdir}/openssl
%files devel
%defattr(-,root,root)
%{_prefix}/include/openssl
%attr(0755,root,root) %{_libdir}/*.so
%attr(0644,root,root) %{_mandir}/man3*/*
%attr(0644,root,root) %{_libdir}/pkgconfig/*.pc
%files static
%defattr(-,root,root)
%attr(0644,root,root) %{_libdir}/*.a
%files perl
%defattr(-,root,root)
%attr(0755,root,root) %{_bindir}/c_rehash
%attr(0644,root,root) %{_mandir}/man1*/*.pl*
%{_sysconfdir}/pki/tls/misc/*.pl
%{_sysconfdir}/pki/tls/misc/tsget
%files fips
%defattr(-,root,root)
##%attr(0644,root,root) %{_libdir}/.libcrypto.so.*.hmac
##%attr(0644,root,root) %{_libdir}/.libssl.so.*.hmac
# We don't want to depend on prelink for this directory
%dir %{_sysconfdir}/prelink.conf.d
%{_sysconfdir}/prelink.conf.d/openssl-fips.conf
%post libs -p /sbin/ldconfig
%postun libs -p /sbin/ldconfig
%post fips
prelink -u %{_libdir}/libcrypto.so.%{version} %{_libdir}/libssl.so.%{version} 2>/dev/null || :
%changelog
* Mon Sep 2 2013 Tomas Mraz <[email protected]> 1.0.1e-19
- use version-release in .hmac suffix to avoid overwrite
during upgrade
* Thu Aug 29 2013 Tomas Mraz <[email protected]> 1.0.1e-18
- allow deinitialization of the FIPS mode
* Thu Aug 29 2013 Tomas Mraz <[email protected]> 1.0.1e-17
- always perform the FIPS selftests in library constructor
if FIPS module is installed
* Tue Aug 27 2013 Tomas Mraz <[email protected]> 1.0.1e-16
- add -fips subpackage that contains the FIPS module files
* Fri Aug 16 2013 Tomas Mraz <[email protected]> 1.0.1e-15
- fix use of rdrand if available
- more commits cherry picked from upstream
- documentation fixes
* Sat Aug 03 2013 Petr Pisar <[email protected]> - 1:1.0.1e-14
- Perl 5.18 rebuild
* Fri Jul 26 2013 Tomas Mraz <[email protected]> 1.0.1e-13
- additional manual page fix
- use symbol versioning also for the textual version
* Thu Jul 25 2013 Tomas Mraz <[email protected]> 1.0.1e-12
- additional manual page fixes
* Fri Jul 19 2013 Tomas Mraz <[email protected]> 1.0.1e-11
- use _prefix macro
* Wed Jul 17 2013 Petr Pisar <[email protected]> - 1:1.0.1e-10
- Perl 5.18 rebuild
* Thu Jul 11 2013 Tomas Mraz <[email protected]> 1.0.1e-9
- add openssl.cnf.5 manpage symlink to config.5
* Wed Jul 10 2013 Tomas Mraz <[email protected]> 1.0.1e-8
- add relro linking flag
* Wed Jul 10 2013 Tomas Mraz <[email protected]> 1.0.1e-7
- add support for the -trusted_first option for certificate chain verification
* Fri May 3 2013 Tomas Mraz <[email protected]> 1.0.1e-6
- fix build of manual pages with current pod2man (#959439)
* Sun Apr 21 2013 Peter Robinson <[email protected]> 1.0.1e-5
- Enable ARM optimised build
* Mon Mar 18 2013 Tomas Mraz <[email protected]> 1.0.1e-4
- fix random bad record mac errors (#918981)
* Tue Feb 19 2013 Tomas Mraz <[email protected]> 1.0.1e-3
- fix up the SHLIB_VERSION_NUMBER
* Tue Feb 19 2013 Tomas Mraz <[email protected]> 1.0.1e-2
- disable ZLIB loading by default (due to CRIME attack)
* Tue Feb 19 2013 Tomas Mraz <[email protected]> 1.0.1e-1
- new upstream version
* Wed Jan 30 2013 Tomas Mraz <[email protected]> 1.0.1c-12
- more fixes from upstream
- fix errors in manual causing build failure (#904777)
* Fri Dec 21 2012 Tomas Mraz <[email protected]> 1.0.1c-11
- add script for renewal of a self-signed cert by Philip Prindeville (#871566)
- allow X509_issuer_and_serial_hash() produce correct result in
the FIPS mode (#881336)
* Thu Dec 6 2012 Tomas Mraz <[email protected]> 1.0.1c-10
- do not load default verify paths if CApath or CAfile specified (#884305)
* Tue Nov 20 2012 Tomas Mraz <[email protected]> 1.0.1c-9
- more fixes from upstream CVS
- fix DSA key pairwise check (#878597)
* Thu Nov 15 2012 Tomas Mraz <[email protected]> 1.0.1c-8
- use 1024 bit DH parameters in s_server as 512 bit is not allowed
in FIPS mode and it is quite weak anyway
* Mon Sep 10 2012 Tomas Mraz <[email protected]> 1.0.1c-7
- add missing initialization of str in aes_ccm_init_key (#853963)
- add important patches from upstream CVS
- use the secure_getenv() with new glibc
* Fri Jul 20 2012 Fedora Release Engineering <[email protected]> - 1:1.0.1c-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
* Fri Jul 13 2012 Tomas Mraz <[email protected]> 1.0.1c-5
- use __getenv_secure() instead of __libc_enable_secure
* Fri Jul 13 2012 Tomas Mraz <[email protected]> 1.0.1c-4
- do not move libcrypto to /lib
- do not use environment variables if __libc_enable_secure is on
- fix strict aliasing problems in modes
* Thu Jul 12 2012 Tomas Mraz <[email protected]> 1.0.1c-3
- fix DSA key generation in FIPS mode (#833866)
- allow duplicate FIPS_mode_set(1)
- enable build on ppc64 subarch (#834652)
* Wed Jul 11 2012 Tomas Mraz <[email protected]> 1.0.1c-2
- fix s_server with new glibc when no global IPv6 address (#839031)
- make it build with new Perl
* Tue May 15 2012 Tomas Mraz <[email protected]> 1.0.1c-1
- new upstream version
* Thu Apr 26 2012 Tomas Mraz <[email protected]> 1.0.1b-1
- new upstream version
* Fri Apr 20 2012 Tomas Mraz <[email protected]> 1.0.1a-1
- new upstream version fixing CVE-2012-2110
* Wed Apr 11 2012 Tomas Mraz <[email protected]> 1.0.1-3
- add Kerberos 5 libraries to pkgconfig for static linking (#807050)
* Thu Apr 5 2012 Tomas Mraz <[email protected]> 1.0.1-2
- backports from upstream CVS
- fix segfault when /dev/urandom is not available (#809586)
* Wed Mar 14 2012 Tomas Mraz <[email protected]> 1.0.1-1
- new upstream release
* Mon Mar 5 2012 Tomas Mraz <[email protected]> 1.0.1-0.3.beta3
- add obsoletes to assist multilib updates (#799636)
* Wed Feb 29 2012 Tomas Mraz <[email protected]> 1.0.1-0.2.beta3
- epoch bumped to 1 due to revert to 1.0.0g on Fedora 17
- new upstream release from the 1.0.1 branch
- fix s390x build (#798411)
- versioning for the SSLeay symbol (#794950)
- add -DPURIFY to build flags (#797323)
- filter engine provides
- split the libraries to a separate -libs package
- add make to requires on the base package (#783446)
* Tue Feb 7 2012 Tomas Mraz <[email protected]> 1.0.1-0.1.beta2
- new upstream release from the 1.0.1 branch, ABI compatible
- add documentation for the -no_ign_eof option
* Thu Jan 19 2012 Tomas Mraz <[email protected]> 1.0.0g-1
- new upstream release fixing CVE-2012-0050 - DoS regression in
DTLS support introduced by the previous release (#782795)
* Thu Jan 5 2012 Tomas Mraz <[email protected]> 1.0.0f-1
- new upstream release fixing multiple CVEs
* Tue Nov 22 2011 Tomas Mraz <[email protected]> 1.0.0e-4
- move the libraries needed for static linking to Libs.private
* Thu Nov 3 2011 Tomas Mraz <[email protected]> 1.0.0e-3
- do not use AVX instructions when osxsave bit not set
- add direct known answer tests for SHA2 algorithms
* Wed Sep 21 2011 Tomas Mraz <[email protected]> 1.0.0e-2
- fix missing initialization of variable in CHIL engine
* Wed Sep 7 2011 Tomas Mraz <[email protected]> 1.0.0e-1
- new upstream release fixing CVE-2011-3207 (#736088)
* Wed Aug 24 2011 Tomas Mraz <[email protected]> 1.0.0d-8
- drop the separate engine for Intel acceleration improvements
and merge in the AES-NI, SHA1, and RC4 optimizations
- add support for OPENSSL_DISABLE_AES_NI environment variable
that disables the AES-NI support
* Tue Jul 26 2011 Tomas Mraz <[email protected]> 1.0.0d-7
- correct openssl cms help output (#636266)
- more tolerant starttls detection in XMPP protocol (#608239)
* Wed Jul 20 2011 Tomas Mraz <[email protected]> 1.0.0d-6
- add support for newest Intel acceleration improvements backported
from upstream by Intel in form of a separate engine
* Thu Jun 9 2011 Tomas Mraz <[email protected]> 1.0.0d-5
- allow the AES-NI engine in the FIPS mode
* Tue May 24 2011 Tomas Mraz <[email protected]> 1.0.0d-4
- add API necessary for CAVS testing of the new DSA parameter generation
* Thu Apr 28 2011 Tomas Mraz <[email protected]> 1.0.0d-3
- add support for VIA Padlock on 64bit arch from upstream (#617539)
- do not return bogus values from load_certs (#652286)
* Tue Apr 5 2011 Tomas Mraz <[email protected]> 1.0.0d-2
- clarify apps help texts for available digest algorithms (#693858)
* Thu Feb 10 2011 Tomas Mraz <[email protected]> 1.0.0d-1
- new upstream release fixing CVE-2011-0014 (OCSP stapling vulnerability)
* Tue Feb 08 2011 Fedora Release Engineering <[email protected]> - 1.0.0c-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
* Fri Feb 4 2011 Tomas Mraz <[email protected]> 1.0.0c-3
- add -x931 parameter to openssl genrsa command to use the ANSI X9.31
key generation method
- use FIPS-186-3 method for DSA parameter generation
- add OPENSSL_FIPS_NON_APPROVED_MD5_ALLOW environment variable
to allow using MD5 when the system is in the maintenance state
even if the /proc fips flag is on
- make openssl pkcs12 command work by default in the FIPS mode
* Mon Jan 24 2011 Tomas Mraz <[email protected]> 1.0.0c-2
- listen on ipv6 wildcard in s_server so we accept connections
from both ipv4 and ipv6 (#601612)
- fix openssl speed command so it can be used in the FIPS mode
with FIPS allowed ciphers
* Fri Dec 3 2010 Tomas Mraz <[email protected]> 1.0.0c-1
- new upstream version fixing CVE-2010-4180
* Tue Nov 23 2010 Tomas Mraz <[email protected]> 1.0.0b-3
- replace the revert for the s390x bignum asm routines with
fix from upstream
* Mon Nov 22 2010 Tomas Mraz <[email protected]> 1.0.0b-2
- revert upstream change in s390x bignum asm routines
* Tue Nov 16 2010 Tomas Mraz <[email protected]> 1.0.0b-1
- new upstream version fixing CVE-2010-3864 (#649304)
* Tue Sep 7 2010 Tomas Mraz <[email protected]> 1.0.0a-3
- make SHLIB_VERSION reflect the library suffix
* Wed Jun 30 2010 Tomas Mraz <[email protected]> 1.0.0a-2
- openssl man page fix (#609484)
* Fri Jun 4 2010 Tomas Mraz <[email protected]> 1.0.0a-1
- new upstream patch release, fixes CVE-2010-0742 (#598738)
and CVE-2010-1633 (#598732)
* Wed May 19 2010 Tomas Mraz <[email protected]> 1.0.0-5
- pkgconfig files now contain the correct libdir (#593723)
* Tue May 18 2010 Tomas Mraz <[email protected]> 1.0.0-4
- make CA dir readable - the private keys are in private subdir (#584810)
* Fri Apr 9 2010 Tomas Mraz <[email protected]> 1.0.0-3
- a few fixes from upstream CVS
- move libcrypto to /lib (#559953)
* Tue Apr 6 2010 Tomas Mraz <[email protected]> 1.0.0-2
- set UTC timezone on pod2man run (#578842)
- make X509_NAME_hash_old work in FIPS mode
* Tue Mar 30 2010 Tomas Mraz <[email protected]> 1.0.0-1
- update to final 1.0.0 upstream release
* Tue Feb 16 2010 Tomas Mraz <[email protected]> 1.0.0-0.22.beta5
- make TLS work in the FIPS mode
* Fri Feb 12 2010 Tomas Mraz <[email protected]> 1.0.0-0.21.beta5
- gracefully handle zero length in assembler implementations of
OPENSSL_cleanse (#564029)
- do not fail in s_server if client hostname not resolvable (#561260)
* Wed Jan 20 2010 Tomas Mraz <[email protected]> 1.0.0-0.20.beta5
- new upstream release
* Thu Jan 14 2010 Tomas Mraz <[email protected]> 1.0.0-0.19.beta4
- fix CVE-2009-4355 - leak in applications incorrectly calling
CRYPTO_free_all_ex_data() before application exit (#546707)
- upstream fix for future TLS protocol version handling
* Wed Jan 13 2010 Tomas Mraz <[email protected]> 1.0.0-0.18.beta4
- add support for Intel AES-NI
* Thu Jan 7 2010 Tomas Mraz <[email protected]> 1.0.0-0.17.beta4
- upstream fix compression handling on session resumption
- various null checks and other small fixes from upstream
- upstream changes for the renegotiation info according to the latest draft
* Mon Nov 23 2009 Tomas Mraz <[email protected]> 1.0.0-0.16.beta4
- fix non-fips mingw build (patch by Kalev Lember)
- add IPV6 fix for DTLS
* Fri Nov 20 2009 Tomas Mraz <[email protected]> 1.0.0-0.15.beta4
- add better error reporting for the unsafe renegotiation
* Fri Nov 20 2009 Tomas Mraz <[email protected]> 1.0.0-0.14.beta4
- fix build on s390x
* Wed Nov 18 2009 Tomas Mraz <[email protected]> 1.0.0-0.13.beta4
- disable enforcement of the renegotiation extension on the client (#537962)
- add fixes from the current upstream snapshot
* Fri Nov 13 2009 Tomas Mraz <[email protected]> 1.0.0-0.12.beta4
- keep the beta status in version number at 3 so we do not have to rebuild
openssh and possibly other dependencies with too strict version check
* Thu Nov 12 2009 Tomas Mraz <[email protected]> 1.0.0-0.11.beta4
- update to new upstream version, no soname bump needed
- fix CVE-2009-3555 - note that the fix is bypassed if SSL_OP_ALL is used
so the compatibility with unfixed clients is not broken. The
protocol extension is also not final.
* Fri Oct 16 2009 Tomas Mraz <[email protected]> 1.0.0-0.10.beta3
- fix use of freed memory if SSL_CTX_free() is called before
SSL_free() (#521342)
* Thu Oct 8 2009 Tomas Mraz <[email protected]> 1.0.0-0.9.beta3
- fix typo in DTLS1 code (#527015)
- fix leak in error handling of d2i_SSL_SESSION()
* Wed Sep 30 2009 Tomas Mraz <[email protected]> 1.0.0-0.8.beta3
- fix RSA and DSA FIPS selftests
- reenable fixed x86_64 camellia assembler code (#521127)
* Fri Sep 4 2009 Tomas Mraz <[email protected]> 1.0.0-0.7.beta3
- temporarily disable x86_64 camellia assembler code (#521127)
* Mon Aug 31 2009 Tomas Mraz <[email protected]> 1.0.0-0.6.beta3
- fix openssl dgst -dss1 (#520152)
* Wed Aug 26 2009 Tomas Mraz <[email protected]> 1.0.0-0.5.beta3
- drop the compat symlink hacks
* Sat Aug 22 2009 Tomas Mraz <[email protected]> 1.0.0-0.4.beta3
- constify SSL_CIPHER_description()
* Fri Aug 21 2009 Tomas Mraz <[email protected]> 1.0.0-0.3.beta3
- fix WWW:Curl:Easy reference in tsget
* Fri Aug 21 2009 Tomas Mraz <[email protected]> 1.0.0-0.2.beta3
- enable MD-2
* Thu Aug 20 2009 Tomas Mraz <[email protected]> 1.0.0-0.1.beta3
- update to new major upstream release
* Sat Jul 25 2009 Fedora Release Engineering <[email protected]> - 0.9.8k-7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
* Wed Jul 22 2009 Bill Nottingham <[email protected]>
- do not build special 'optimized' versions for i686, as that's the base
arch in Fedora now
* Tue Jun 30 2009 Tomas Mraz <[email protected]> 0.9.8k-6
- abort if selftests failed and random number generator is polled
- mention EVP_aes and EVP_sha2xx routines in the manpages
- add README.FIPS
- make CA dir absolute path (#445344)
- change default length for RSA key generation to 2048 (#484101)
* Thu May 21 2009 Tomas Mraz <[email protected]> 0.9.8k-5
- fix CVE-2009-1377 CVE-2009-1378 CVE-2009-1379
(DTLS DoS problems) (#501253, #501254, #501572)
* Tue Apr 21 2009 Tomas Mraz <[email protected]> 0.9.8k-4
- support compatibility DTLS mode for CISCO AnyConnect (#464629)
* Fri Apr 17 2009 Tomas Mraz <[email protected]> 0.9.8k-3
- correct the SHLIB_VERSION define
* Wed Apr 15 2009 Tomas Mraz <[email protected]> 0.9.8k-2
- add support for multiple CRLs with same subject
- load only dynamic engine support in FIPS mode
* Wed Mar 25 2009 Tomas Mraz <[email protected]> 0.9.8k-1
- update to new upstream release (minor bug fixes, security
fixes and machine code optimizations only)
* Thu Mar 19 2009 Tomas Mraz <[email protected]> 0.9.8j-10
- move libraries to /usr/lib (#239375)
* Fri Mar 13 2009 Tomas Mraz <[email protected]> 0.9.8j-9
- add a static subpackage
* Thu Feb 26 2009 Fedora Release Engineering <[email protected]> - 0.9.8j-8
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
* Mon Feb 2 2009 Tomas Mraz <[email protected]> 0.9.8j-7
- must also verify checksum of libssl.so in the FIPS mode
- obtain the seed for FIPS rng directly from the kernel device
- drop the temporary symlinks
* Mon Jan 26 2009 Tomas Mraz <[email protected]> 0.9.8j-6
- drop the temporary triggerpostun and symlinking in post
- fix the pkgconfig files and drop the unnecessary buildrequires
on pkgconfig as it is a rpmbuild dependency (#481419)
* Sat Jan 17 2009 Tomas Mraz <[email protected]> 0.9.8j-5
- add temporary triggerpostun to reinstate the symlinks
* Sat Jan 17 2009 Tomas Mraz <[email protected]> 0.9.8j-4
- no pairwise key tests in non-fips mode (#479817)
* Fri Jan 16 2009 Tomas Mraz <[email protected]> 0.9.8j-3
- even more robust test for the temporary symlinks
* Fri Jan 16 2009 Tomas Mraz <[email protected]> 0.9.8j-2
- try to ensure the temporary symlinks exist
* Thu Jan 15 2009 Tomas Mraz <[email protected]> 0.9.8j-1
- new upstream version with necessary soname bump (#455753)
- temporarily provide symlink to old soname to make it possible to rebuild
the dependent packages in rawhide
- add eap-fast support (#428181)
- add possibility to disable zlib by setting
- add fips mode support for testing purposes
- do not null dereference on some invalid smime files
- add buildrequires pkgconfig (#479493)
* Sun Aug 10 2008 Tomas Mraz <[email protected]> 0.9.8g-11
- do not add tls extensions to server hello for SSLv3 either
* Mon Jun 2 2008 Joe Orton <[email protected]> 0.9.8g-10
- move root CA bundle to ca-certificates package
* Wed May 28 2008 Tomas Mraz <[email protected]> 0.9.8g-9
- fix CVE-2008-0891 - server name extension crash (#448492)
- fix CVE-2008-1672 - server key exchange message omit crash (#448495)
* Tue May 27 2008 Tomas Mraz <[email protected]> 0.9.8g-8
- super-H arch support
- drop workaround for bug 199604 as it should be fixed in gcc-4.3
* Mon May 19 2008 Tom "spot" Callaway <[email protected]> 0.9.8g-7
- sparc handling
* Mon Mar 10 2008 Joe Orton <[email protected]> 0.9.8g-6
- update to new root CA bundle from mozilla.org (r1.45)
* Wed Feb 20 2008 Fedora Release Engineering <[email protected]> - 0.9.8g-5
- Autorebuild for GCC 4.3
* Thu Jan 24 2008 Tomas Mraz <[email protected]> 0.9.8g-4
- merge review fixes (#226220)
- adjust the SHLIB_VERSION_NUMBER to reflect library name (#429846)
* Thu Dec 13 2007 Tomas Mraz <[email protected]> 0.9.8g-3
- set default paths when no explicit paths are set (#418771)
- do not add tls extensions to client hello for SSLv3 (#422081)
* Tue Dec 4 2007 Tomas Mraz <[email protected]> 0.9.8g-2
- enable some new crypto algorithms and features
- add some more important bug fixes from openssl CVS
* Mon Dec 3 2007 Tomas Mraz <[email protected]> 0.9.8g-1
- update to latest upstream release, SONAME bumped to 7
* Mon Oct 15 2007 Joe Orton <[email protected]> 0.9.8b-17
- update to new CA bundle from mozilla.org
* Fri Oct 12 2007 Tomas Mraz <[email protected]> 0.9.8b-16
- fix CVE-2007-5135 - off-by-one in SSL_get_shared_ciphers (#309801)
- fix CVE-2007-4995 - out of order DTLS fragments buffer overflow (#321191)
- add alpha sub-archs (#296031)
* Tue Aug 21 2007 Tomas Mraz <[email protected]> 0.9.8b-15
- rebuild
* Fri Aug 3 2007 Tomas Mraz <[email protected]> 0.9.8b-14
- use localhost in testsuite, hopefully fixes slow build in koji
- CVE-2007-3108 - fix side channel attack on private keys (#250577)
- make ssl session cache id matching strict (#233599)
* Wed Jul 25 2007 Tomas Mraz <[email protected]> 0.9.8b-13
- allow building on ARM architectures (#245417)
- use reference timestamps to prevent multilib conflicts (#218064)
- -devel package must require pkgconfig (#241031)
* Mon Dec 11 2006 Tomas Mraz <[email protected]> 0.9.8b-12
- detect duplicates in add_dir properly (#206346)
* Thu Nov 30 2006 Tomas Mraz <[email protected]> 0.9.8b-11
- the previous change still didn't make X509_NAME_cmp transitive
* Thu Nov 23 2006 Tomas Mraz <[email protected]> 0.9.8b-10
- make X509_NAME_cmp transitive otherwise certificate lookup
is broken (#216050)
* Thu Nov 2 2006 Tomas Mraz <[email protected]> 0.9.8b-9
- aliasing bug in engine loading, patch by IBM (#213216)
* Mon Oct 2 2006 Tomas Mraz <[email protected]> 0.9.8b-8
- CVE-2006-2940 fix was incorrect (#208744)
* Mon Sep 25 2006 Tomas Mraz <[email protected]> 0.9.8b-7
- fix CVE-2006-2937 - mishandled error on ASN.1 parsing (#207276)
- fix CVE-2006-2940 - parasitic public keys DoS (#207274)
- fix CVE-2006-3738 - buffer overflow in SSL_get_shared_ciphers (#206940)
- fix CVE-2006-4343 - sslv2 client DoS (#206940)
* Tue Sep 5 2006 Tomas Mraz <[email protected]> 0.9.8b-6
- fix CVE-2006-4339 - prevent attack on PKCS#1 v1.5 signatures (#205180)
* Wed Aug 2 2006 Tomas Mraz <[email protected]> - 0.9.8b-5
- set buffering to none on stdio/stdout FILE when bufsize is set (#200580)
patch by IBM
* Fri Jul 28 2006 Alexandre Oliva <[email protected]> - 0.9.8b-4.1
- rebuild with new binutils (#200330)
* Fri Jul 21 2006 Tomas Mraz <[email protected]> - 0.9.8b-4
- add a temporary workaround for sha512 test failure on s390 (#199604)
* Thu Jul 20 2006 Tomas Mraz <[email protected]>
- add ipv6 support to s_client and s_server (by Jan Pazdziora) (#198737)
- add patches for BN threadsafety, AES cache collision attack hazard fix and
pkcs7 code memleak fix from upstream CVS
* Wed Jul 12 2006 Jesse Keating <[email protected]> - 0.9.8b-3.1
- rebuild
* Wed Jun 21 2006 Tomas Mraz <[email protected]> - 0.9.8b-3
- dropped libica and ica engine from build
* Wed Jun 21 2006 Joe Orton <[email protected]>
- update to new CA bundle from mozilla.org; adds CA certificates
from netlock.hu and startcom.org
* Mon Jun 5 2006 Tomas Mraz <[email protected]> - 0.9.8b-2
- fixed a few rpmlint warnings
- better fix for #173399 from upstream
- upstream fix for pkcs12
* Thu May 11 2006 Tomas Mraz <[email protected]> - 0.9.8b-1
- upgrade to new version, stays ABI compatible
- there is no more linux/config.h (it was empty anyway)
* Tue Apr 4 2006 Tomas Mraz <[email protected]> - 0.9.8a-6
- fix stale open handles in libica (#177155)
- fix build if 'rand' or 'passwd' in buildroot path (#178782)
- initialize VIA Padlock engine (#186857)