openssl-vl.spec 30 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872
  1. %define build_compat32 %{?_with_compat32:1}%{!?_with_compat32:0}
  2. %{!?_pkgdocdir:%define _pkgdocdir %{_docdir}}
  3. %define version 1.1.1a
  4. %define release 1%{_dist_release}
  5. # 1.0.0 soversion = 10
  6. # 1.1.0 soversion = 1.1 (same as upstream although presence of some symbols
  7. # depends on build configuration options)
  8. %define soversion 1.1
  9. Summary: Secure Sockets Layer Toolkit
  10. Name: openssl
  11. Version: %{version}
  12. Release: %{release}
  13. # We have to remove certain patented algorithms from the openssl source
  14. # tarball with the hobble-openssl script which is included below.
  15. # The original openssl upstream tarball cannot be shipped in the .src.rpm.
  16. Source: openssl-%{version}-hobbled.tar.xz
  17. Source1: hobble-openssl
  18. Source2: Makefile.certificate
  19. Source6: make-dummy-cert
  20. Source7: renew-dummy-cert
  21. Source9: opensslconf-new.h
  22. Source10: opensslconf-new-warning.h
  23. #Source11: README.FIPS
  24. Source12: ec_curve.c
  25. Source13: ectest.c
  26. # Build changes
  27. Patch1: openssl-1.1.1-build.patch
  28. Patch2: openssl-1.1.0-defaults.patch
  29. Patch3: openssl-1.1.0-no-html.patch
  30. Patch4: openssl-1.1.1-man-rename.patch
  31. # Bug fixes
  32. Patch21: openssl-1.1.0-issuer-hash.patch
  33. # Functionality changes
  34. Patch31: openssl-1.1.1-conf-paths.patch
  35. Patch32: openssl-1.1.1-version-add-engines.patch
  36. Patch33: openssl-1.1.0-apps-dgst.patch
  37. #Patch36: openssl-1.1.1-secure-getenv.patch
  38. Patch37: openssl-1.1.1-ec-curves.patch
  39. Patch38: openssl-1.1.0-no-weak-verify.patch
  40. Patch40: openssl-1.1.1-disable-ssl3.patch
  41. Patch41: openssl-1.1.1-system-cipherlist.patch
  42. #Patch42: openssl-1.1.1-fips.patch
  43. Patch43: openssl-1.1.1-ignore-bound.patch
  44. #Patch44: openssl-1.1.1-version-override.patch
  45. Patch45: openssl-1.1.1-weak-ciphers.patch
  46. #Patch46: openssl-1.1.1-seclevel.patch
  47. # security fix
  48. # nothing ;-)
  49. License: BSDish
  50. Group: System Environment/Libraries
  51. URL: http://www.openssl.org/
  52. BuildRoot: %{_tmppath}/%{name}-%{version}-root
  53. BuildRequires: perl, sed
  54. BuildRequires: zlib-devel, krb5-devel
  55. BuildRequires: lksctp-tools-devel
  56. Requires: mktemp
  57. Requires: ca-certificates
  58. Vendor: Project Vine
  59. Distribution: Vine Linux
  60. Packager: daisuke, iwamoto
  61. %define solibbase %(echo %version | sed 's/[[:alpha:]]//g')
  62. %description
  63. The OpenSSL certificate management tool and the shared libraries that
  64. provide various cryptographic algorithms and protocols.
  65. %package devel
  66. Summary: OpenSSL libraries and development headers.
  67. Group: Development/Libraries
  68. Requires: %{name} = %{version}-%{release}
  69. Requires: krb5-devel
  70. %description devel
  71. The static libraries and include files needed to compile apps
  72. with support for various the cryptographic algorithms and protocols
  73. supported by OpenSSL.
  74. Patches for many networking apps can be found at:
  75. ftp://ftp.psy.uq.oz.au/pub/Crypto/SSLapps/
  76. %package static
  77. Summary: Libraries for static linking of applications which will use OpenSSL
  78. Group: Development/Libraries
  79. Requires: %{name}-devel = %{version}-%{release}
  80. %description static
  81. OpenSSL is a toolkit for supporting cryptography. The openssl-static
  82. package contains static libraries needed for static linking of
  83. applications which support various cryptographic algorithms and
  84. protocols.
  85. %package perl
  86. Summary: OpenSSL scripts which require Perl.
  87. Group: Applications/Internet
  88. Requires: %{name} = %{version}-%{release}
  89. Requires: perl
  90. Requires: perl-WWW-Curl
  91. %description perl
  92. Perl scripts provided with OpenSSL for converting certificates and keys
  93. from other formats to those used by OpenSSL.
  94. ## to build compat32 for x86_64 architecture support
  95. %package -n compat32-%{name}
  96. Summary: Secure Sockets Layer Toolkit
  97. Group: System Environment/Libraries
  98. Requires: %{name} = %{version}-%{release}
  99. %description -n compat32-%{name}
  100. The OpenSSL certificate management tool and the shared libraries that
  101. provide various cryptographic algorithms and protocols.
  102. %package -n compat32-%{name}-devel
  103. Summary: OpenSSL libraries and development headers.
  104. Group: Development/Libraries
  105. Requires: compat32-%{name} = %{version}-%{release}
  106. Requires: compat32-krb5-devel
  107. %description -n compat32-%{name}-devel
  108. The static libraries and include files needed to compile apps
  109. with support for various the cryptographic algorithms and protocols
  110. supported by OpenSSL.
  111. %prep
  112. %setup -q -n %{name}-%{version}
  113. # The hobble_openssl is called here redundantly, just to be sure.
  114. # The tarball has already the sources removed.
  115. %{SOURCE1} > /dev/null
  116. cp %{SOURCE12} crypto/ec/
  117. cp %{SOURCE13} test/
  118. %patch1 -p1 -b .build %{?_rawbuild}
  119. %patch2 -p1 -b .defaults
  120. %patch3 -p1 -b .no-html %{?_rawbuild}
  121. %patch4 -p1 -b .man-rename
  122. %patch21 -p1 -b .issuer-hash
  123. %patch31 -p1 -b .conf-paths
  124. %patch32 -p1 -b .version-add-engines
  125. %patch33 -p1 -b .dgst
  126. #%patch36 -p1 -b .secure-getenv
  127. %patch37 -p1 -b .curves
  128. %patch38 -p1 -b .no-weak-verify
  129. %patch40 -p1 -b .disable-ssl3
  130. %patch41 -p1 -b .system-cipherlist
  131. #patch42 -p1 -b .fips
  132. %patch43 -p1 -b .ignore-bound
  133. #patch44 -p1 -b .version-override
  134. %patch45 -p1 -b .weak-ciphers
  135. #%patch46 -p1 -b .seclevel
  136. # security fix
  137. # nothing ;-)
  138. %build
  139. # Figure out which flags we want to use.
  140. # default
  141. sslarch=%{_os}-%{_target_cpu}
  142. #
  143. %ifarch %ix86
  144. sslarch=linux-elf
  145. if ! echo %{_target} | grep -q i686 ; then
  146. sslflags="no-asm 386"
  147. fi
  148. %endif
  149. %ifarch x86_64
  150. sslflags=enable-ec_nistp_64_gcc_128
  151. %endif
  152. # Add -Wa,--noexecstack here so that libcrypto's assembler modules will be
  153. # marked as not requiring an executable stack.
  154. # Also add -DPURIFY to make using valgrind with openssl easier as we do not
  155. # want to depend on the uninitialized memory as a source of entropy anyway.
  156. RPM_OPT_FLAGS="$RPM_OPT_FLAGS -Wa,--noexecstack -DPURIFY $RPM_LD_FLAGS"
  157. export HASHBANGPERL=/usr/bin/perl
  158. perl -pi -e 's|/engines-|/%{name}/engines-|' ./Configurations/unix-Makefile.tmpl
  159. # ia64, x86_64, ppc are OK by default
  160. # Configure the build tree. Override OpenSSL defaults with known-good defaults
  161. # usable on all platforms. The Configure script already knows to use -fPIC and
  162. # RPM_OPT_FLAGS, so we can skip specifiying them here.
  163. ./Configure \
  164. --prefix=%{_prefix} --openssldir=%{_sysconfdir}/pki/tls ${sslflags} \
  165. --system-ciphers-file=%{_sysconfdir}/crypto-policies/back-ends/openssl.config \
  166. zlib enable-camellia enable-seed enable-rfc3779 enable-sctp \
  167. enable-cms enable-md2 enable-rc5 enable-ssl3 enable-ssl3-method \
  168. enable-weak-ssl-ciphers \
  169. no-mdc2 no-ec2m no-sm2 no-sm4 \
  170. shared ${sslarch} $RPM_OPT_FLAGS '-DDEVRANDOM="\"/dev/urandom\""'
  171. # Do not run this in a production package the FIPS symbols must be patched-in
  172. #util/mkdef.pl crypto update
  173. make all
  174. # Clean up the .pc files
  175. for i in libcrypto.pc libssl.pc openssl.pc ; do
  176. sed -i '/^Libs.private:/{s/-L[^ ]* //;s/-Wl[^ ]* //}' $i
  177. done
  178. %check
  179. # Verify that what was compiled actually works.
  180. # Hack - either enable SCTP AUTH chunks in kernel or disable sctp for check
  181. (sysctl net.sctp.addip_enable=1 && sysctl net.sctp.auth_enable=1) || \
  182. (echo 'Failed to enable SCTP AUTH chunks, disabling SCTP for tests...' &&
  183. sed '/"zlib-dynamic" => "default",/a\ \ "sctp" => "default",' configdata.pm > configdata.pm.new && \
  184. touch -r configdata.pm configdata.pm.new && \
  185. mv -f configdata.pm.new configdata.pm)
  186. # We must revert patch31 before tests otherwise they will fail
  187. patch -p1 -R < %{PATCH31}
  188. # drop a recipe includes tests for brainpool curves (not supported by openssl-hobbled).
  189. rm -f test/recipes/80-test_ssl_new.t
  190. LD_LIBRARY_PATH=`pwd`${LD_LIBRARY_PATH:+:${LD_LIBRARY_PATH}}
  191. export LD_LIBRARY_PATH
  192. OPENSSL_ENABLE_MD5_VERIFY=
  193. export OPENSSL_ENABLE_MD5_VERIFY
  194. OPENSSL_SYSTEM_CIPHERS_OVERRIDE=xyz_nonexistent_file
  195. export OPENSSL_SYSTEM_CIPHERS_OVERRIDE
  196. make test
  197. # Add generation of HMAC checksum of the final stripped library
  198. %define __spec_install_post \
  199. %{?__debug_package:%{__debug_install_post}} \
  200. %{__arch_install_post} \
  201. %{__os_install_post} \
  202. %{nil}
  203. %define __provides_exclude_from %{_libdir}/openssl
  204. %install
  205. [ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT
  206. # Install OpenSSL.
  207. install -d $RPM_BUILD_ROOT{/%{_lib},%{_bindir},%{_includedir},%{_libdir},%{_mandir},%{_libdir}/openssl,%{_pkgdocdir}}
  208. make DESTDIR=$RPM_BUILD_ROOT install
  209. mv $RPM_BUILD_ROOT%{_libdir}/lib*.so.%{soversion} $RPM_BUILD_ROOT/%{_lib}/
  210. rename so.%{soversion} so.%{version} $RPM_BUILD_ROOT/%{_lib}/*.so.%{soversion}
  211. for lib in $RPM_BUILD_ROOT/%{_lib}/*.so.%{version} ; do
  212. chmod 755 ${lib}
  213. ln -s -f ../../%{_lib}/`basename ${lib}` $RPM_BUILD_ROOT/%{_libdir}/`basename ${lib} .%{version}`
  214. ln -s -f `basename ${lib}` $RPM_BUILD_ROOT/%{_lib}/`basename ${lib} .%{version}`.%{soversion}
  215. done
  216. # Install a makefile for generating keys and self-signed certs, and a script
  217. # for generating them on the fly.
  218. mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/certs
  219. install -m644 %{SOURCE2} $RPM_BUILD_ROOT%{_pkgdocdir}/Makefile.certificate
  220. install -m755 %{SOURCE6} $RPM_BUILD_ROOT%{_bindir}/make-dummy-cert
  221. install -m755 %{SOURCE7} $RPM_BUILD_ROOT%{_bindir}/renew-dummy-cert
  222. # Move runable perl scripts to bindir
  223. mv $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/misc/*.pl $RPM_BUILD_ROOT%{_bindir}
  224. mv $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/misc/tsget $RPM_BUILD_ROOT%{_bindir}
  225. # Rename man pages so that they don't conflict with other system man pages.
  226. pushd $RPM_BUILD_ROOT%{_mandir}
  227. ln -s -f config.5 man5/openssl.cnf.5
  228. for manpage in man*/* ; do
  229. if [ -L ${manpage} ]; then
  230. TARGET=`ls -l ${manpage} | awk '{ print $NF }'`
  231. ln -snf ${TARGET}ssl ${manpage}ssl
  232. rm -f ${manpage}
  233. else
  234. mv ${manpage} ${manpage}ssl
  235. fi
  236. done
  237. for conflict in passwd rand ; do
  238. rename ${conflict} ssl${conflict} man*/${conflict}*
  239. # Fix dangling symlinks
  240. manpage=man1/openssl-${conflict}.*
  241. if [ -L ${manpage} ] ; then
  242. ln -snf ssl${conflict}.1ssl ${manpage}
  243. fi
  244. done
  245. popd
  246. mkdir -m755 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA
  247. mkdir -m700 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA/private
  248. mkdir -m755 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA/certs
  249. mkdir -m755 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA/crl
  250. mkdir -m755 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA/newcerts
  251. # Ensure the config file timestamps are identical across builds to avoid
  252. # mulitlib conflicts and unnecessary renames on upgrade
  253. touch -r %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/openssl.cnf
  254. touch -r %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/ct_log_list.cnf
  255. rm -f $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/openssl.cnf.dist
  256. rm -f $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/ct_log_list.cnf.dist
  257. # Determine which arch opensslconf.h is going to try to #include.
  258. basearch=%{_arch}
  259. %ifarch %{ix86}
  260. basearch=i386
  261. %endif
  262. # Next step of gradual disablement of SSL3.
  263. # Make SSL3 disappear to newly built dependencies.
  264. sed -i '/^\#ifndef OPENSSL_NO_SSL_TRACE/i\
  265. #ifndef OPENSSL_NO_SSL3\
  266. # define OPENSSL_NO_SSL3\
  267. #endif' $RPM_BUILD_ROOT/%{_prefix}/include/openssl/opensslconf.h
  268. %ifarch %{multilib_arches}
  269. # Do an opensslconf.h switcheroo to avoid file conflicts on systems where you
  270. # can have both a 32- and 64-bit version of the library, and they each need
  271. # their own correct-but-different versions of opensslconf.h to be usable.
  272. install -m644 %{SOURCE10} \
  273. $RPM_BUILD_ROOT/%{_prefix}/include/openssl/opensslconf-${basearch}.h
  274. cat $RPM_BUILD_ROOT/%{_prefix}/include/openssl/opensslconf.h >> \
  275. $RPM_BUILD_ROOT/%{_prefix}/include/openssl/opensslconf-${basearch}.h
  276. install -m644 %{SOURCE9} \
  277. $RPM_BUILD_ROOT/%{_prefix}/include/openssl/opensslconf.h
  278. %endif
  279. LD_LIBRARY_PATH=`pwd`${LD_LIBRARY_PATH:+:${LD_LIBRARY_PATH}}
  280. export LD_LIBRARY_PATH
  281. %clean
  282. [ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT
  283. %files
  284. %defattr(-,root,root)
  285. %{!?_licensedir:%global license %%doc}
  286. %license LICENSE
  287. %doc FAQ NEWS README
  288. %{_pkgdocdir}/Makefile.certificate
  289. %dir %{_sysconfdir}/pki/tls
  290. %dir %{_sysconfdir}/pki/tls/certs
  291. %dir %{_sysconfdir}/pki/tls/misc
  292. %dir %{_sysconfdir}/pki/tls/private
  293. %config(noreplace) %{_sysconfdir}/pki/tls/openssl.cnf
  294. %config(noreplace) %{_sysconfdir}/pki/tls/ct_log_list.cnf
  295. %{_bindir}/make-dummy-cert
  296. %{_bindir}/renew-dummy-cert
  297. %{_bindir}/openssl
  298. %attr(0755,root,root) /%{_lib}/*.so.*
  299. /%{_lib}/*.so.%{soversion}
  300. %attr(0755,root,root) %{_libdir}/%{name}/engines-%{soversion}
  301. %dir %{_mandir}/man1*
  302. %{_mandir}/man1*/*
  303. %dir %{_mandir}/man5*
  304. %{_mandir}/man5*/*
  305. %dir %{_mandir}/man7*
  306. %{_mandir}/man7*/*
  307. %files devel
  308. %defattr(-,root,root)
  309. %{_prefix}/include/openssl
  310. %exclude %{_libdir}/lib*.a
  311. %attr(0755,root,root) %{_libdir}/*.so
  312. %attr(0644,root,root) %{_libdir}/pkgconfig/*.pc
  313. %dir %{_mandir}/man3*
  314. %{_mandir}/man3*/*
  315. %files static
  316. %defattr(-,root,root)
  317. %attr(0644,root,root) %{_libdir}/*.a
  318. %files perl
  319. %defattr(-,root,root)
  320. %{_bindir}/c_rehash
  321. %{_bindir}/*.pl
  322. %{_bindir}/tsget
  323. %{_mandir}/man1*/*.pl*
  324. %{_mandir}/man1*/c_rehash*
  325. %{_mandir}/man1*/tsget*
  326. %{_mandir}/man1*/openssl-tsget*
  327. %dir %{_sysconfdir}/pki/CA
  328. %dir %{_sysconfdir}/pki/CA/private
  329. %dir %{_sysconfdir}/pki/CA/certs
  330. %dir %{_sysconfdir}/pki/CA/crl
  331. %dir %{_sysconfdir}/pki/CA/newcerts
  332. ## to build compat32 for x86_64 architecture support
  333. %if %{build_compat32}
  334. %files -n compat32-%{name}
  335. %defattr(-,root,root)
  336. %attr(0755,root,root) /%{_lib}/*.so.*
  337. %files -n compat32-%{name}-devel
  338. %defattr(-,root,root)
  339. %exclude %{_libdir}/lib*.a
  340. %attr(0755,root,root) %{_libdir}/*.so
  341. %attr(0644,root,root) %{_libdir}/pkgconfig/*.pc
  342. %endif
  343. %post -p /sbin/ldconfig
  344. %postun -p /sbin/ldconfig
  345. %post -n compat32-%{name} -p /sbin/ldconfig
  346. %postun -n compat32-%{name} -p /sbin/ldconfig
  347. %changelog
  348. * Sat Dec 08 2018 Tomohiro "Tomo-p" KATO <tomop@teamgedoh.net> 1.1.1a-1
  349. - new upstream release.
  350. - updated Patch2.
  351. - dropped Patch36 and 46: fixed in upstream.
  352. * Thu Nov 01 2018 Tomohiro "Tomo-p" KATO <tomop@teamgedoh.net> 1.1.1-2
  353. - fixed symlinks.
  354. * Thu Nov 01 2018 Tomohiro "Tomo-p" KATO <tomop@teamgedoh.net> 1.1.1-1
  355. - new upstream release (newest LTS version).
  356. - imported fedora stuff (except FIPS).
  357. * Sun Apr 1 2018 IWAI, Masaharu <iwaim.sub@gmail.com> 1.0.2o-1
  358. - new upstream release with security fixes
  359. * Sun Jan 21 2018 Satoshi IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 1.0.2n-1
  360. - new upstream release with security fixes
  361. * Wed Nov 15 2017 Satoshi IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 1.0.2m-1
  362. - new upstream release with security fixes
  363. * Sun Jan 29 2017 IWAI, Masaharu <iwaim.sub@gmail.com> 1.0.2k-1
  364. - new upstream release with security fixes
  365. * Thu May 5 2016 IWAI, Masaharu <iwaim.sub@gmail.com> 1.0.2h-1
  366. - new upstream release with security fixes
  367. * Wed Mar 9 2016 Satoshi IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 1.0.2g-1
  368. - new upstream release 1.0.2 with security fixes
  369. - Patch2 is merged into Patch0
  370. * Mon Dec 28 2015 Satoshi IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 1.0.1q-1
  371. - new upstream release with security fixes
  372. * Fri Jul 10 2015 Satoshi IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 1.0.1p-1
  373. - new upstream release with security fixes
  374. * Wed Jul 1 2015 Satoshi IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 1.0.1o-1
  375. - new upstream release
  376. * Sun Apr 12 2015 Yoji TOYODA <bsyamato@sea.plala.or.jp> 1.0.1m-1
  377. - merged into Vine6
  378. * Fri Mar 20 2015 Satoshi IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 1.0.1m-1
  379. - new upstream release with security fixes
  380. - update Patch2,5
  381. * Mon Jan 12 2015 Satoshi IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 1.0.1k-1
  382. - new upstream release with security fixes
  383. * Mon Oct 20 2014 Satoshi IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 1.0.1j-1
  384. - new upstream release with security fixes
  385. - add patch8 from fc21 (fix perl find.pl)
  386. * Fri Jun 6 2014 Tomohiro "Tomo-p" KATO <tomop@teamgedoh.net> 1.0.1h-1
  387. - new upstream release with security fixes.
  388. * Tue Apr 8 2014 Satoshi IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 1.0.1g-1
  389. - new upstream release with security fixes
  390. * Thu Jan 9 2014 Satoshi IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 1.0.1f-1
  391. - new upstream release with security fixes
  392. * Tue Sep 24 2013 Daisuke SUZUKI <daisuke@linux.or.jp> 1.0.1e-2
  393. - move root CA bundle to ca-certificates package
  394. * Tue Feb 12 2013 Daisuke SUZUKI <daisuke@linux.or.jp> 1.0.1e-1
  395. - update to 1.0.1e
  396. - 1.0.1d has major regressions from 1.0.1c
  397. * Sat Feb 9 2013 IWAI, Masaharu <iwai@alib.jp> 1.0.1d-2
  398. - remove tsget script to delete dependency perl(WWW::Curl::Easy)
  399. - openssl-perl package contains it in docdir
  400. * Fri Feb 08 2013 Toshiharu Kudoh <toshi.kd2@gmail.com> 1.0.1d-1
  401. - new upstream release with security fix (CVE-2012-2686, CVE-2013-0166, 0169)
  402. - fixed %%files
  403. * Tue May 29 2012 Daisuke SUZUKI <daisuke@linux.or.jp> 1.0.1c-1
  404. - update to 1.0.1c
  405. - enable configure options:
  406. enable-camellia enable-seed enable-tlsext enable-rfc3779
  407. enable-cms enable-md2
  408. - remove no-asm option from ai64/x86_64/ppc/ppc64/i686
  409. - generate a table with the compile settings before configure
  410. * Fri Jan 20 2012 Satoshi IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 1.0.0g-1
  411. - new upstream release with security fix (CVE-2012-0050)
  412. * Fri Jan 6 2012 Satoshi IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 1.0.0f-1
  413. - new upstream release with security fix
  414. (CVE-2011-4108,09, CVE-2011-4576,77, CVE-2011-4619, CVE-2012-0027)
  415. * Wed Sep 7 2011 Satoshi IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 1.0.0e-1
  416. - new upstream release with security fix (CVE-2011-3207, 3210)
  417. * Sun Mar 20 2011 Satoshi IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 1.0.0d-2
  418. - rebuild with krb5-libs 1.8
  419. * Fri Feb 11 2011 Satoshi IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 1.0.0d-1
  420. - new upstream release with security fix
  421. * Sat Jan 15 2011 Satoshi IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 1.0.0c-4
  422. - use upstream openssl.pc instead of vine original one (SOURCE6)
  423. * Sun Jan 9 2011 Satoshi IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 1.0.0c-3
  424. - move tsget to docs to delete dependency perl(WWW::Curl::Easy)
  425. * Sat Jan 1 2011 Satoshi IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 1.0.0c-2
  426. - add R: krb5-devel into devel pkg
  427. - add R: compat32-krb5-devel into compat32-devel pkg
  428. * Fri Dec 31 2010 Satoshi IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 1.0.0c-1
  429. - new upstream release 1.0.0x
  430. - separate static libs into static package
  431. - change configure options
  432. - change so version 10
  433. - add tsget into perl package
  434. - update all patches
  435. * Thu Dec 30 2010 Satoshi IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 0.9.8q-2
  436. - fix changelog typo...
  437. * Tue Dec 7 2010 Satoshi IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 0.9.8q-1
  438. - new upstream release with security fix (CVE-2010-4180)
  439. * Wed Nov 17 2010 Satoshi IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 0.9.8p-1
  440. - new upstream release with security fix (CVE-2010-3864)
  441. - drop patches included in new release
  442. - update patch4
  443. * Sun Jan 17 2010 Satoshi IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 0.9.8k-5
  444. - add patch12 for fix CVE-2009-3555 (renegotiation)
  445. * Fri Jan 15 2010 Satoshi IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 0.9.8k-4
  446. - add patch11 for fix CVE-2009-4355 (memory leak)
  447. * Tue Jun 23 2009 Satoshi IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 0.9.8k-3
  448. - add patch10 to fix CVE-2009-1377, 78, 79 (from fc11)
  449. * Mon Jun 22 2009 NAKAMURA Kenta <kenta@vinelinux.org> 0.9.8k-2
  450. - removed unnecessary %%if %{build_compat32} statements
  451. - removed lib*.a from devel package
  452. * Mon Mar 30 2009 Satosh IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 0.9.8k-1
  453. - new upstream release with security fix (CVE-2000-0590,0591,0789)
  454. * Sun Jan 11 2009 Satosh IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 0.9.8j-1
  455. - new upstream release with security fix (CVE-2008-5077)
  456. * Sat Sep 20 2008 Daisuke SUZUKI <daisuke@linux.or.jp> 0.9.8i-1
  457. - new upstream release
  458. * Sat Jul 12 2008 Satosh IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 0.9.8h-1
  459. - new upstream release
  460. - new versioning policy
  461. * Sat Oct 27 2007 Daisuke SUZUKI <daisuke@linux.or.jp> 0.9.8g-0vl1
  462. - new upstream release
  463. - drop patch10,20 which is merged in upstream
  464. * Fri Sep 28 2007 MATSUBAYASHI Kohji <shaolin@vinelinux.org> 0.9.8e-0vl3
  465. - add security patch in advance for CVE-2007-5135
  466. http://www.securityfocus.com/archive/1/archive/1/480855/100/0/threaded
  467. http://marc.info/?l=openssl-cvs&m=119020417919619&w=2
  468. * Fri Aug 10 2007 MATSUBAYASHI Kohji <shaolin@vinelinux.org> 0.9.8e-0vl2
  469. - add security patch for CVE-2007-3108
  470. (http://openssl.org/news/patch-CVE-2007-3108.txt)
  471. * Tue May 15 2007 Daisuke SUZUKI <daisuke@linux.or.jp> 0.9.8e-0vl1
  472. - new upstream release
  473. * Sun Dec 24 2006 Satosh IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 0.9.7l-0vl2
  474. - update (fix) openssl.pc <BTS:437>
  475. * Fri Sep 29 2006 Satosh IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 0.9.7l-0vl1
  476. - new upstream release (with security fix)
  477. * Mon Sep 11 2006 Satosh IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 0.9.7k-0vl1
  478. - new upstream release
  479. - add patch2 to use RPM_OPT macro
  480. * Mon Feb 06 2006 Shu KONNO <owa@bg.wakwak.com> 0.9.7i-0vl3
  481. - moved macros _lib to /usr/lib/rpm/rpmrc or macros files
  482. * Fri Feb 03 2006 Shu KONNO <owa@bg.wakwak.com> 0.9.7i-0vl2
  483. - added compat32-* packages for x86_64 architecture support
  484. - added openssl-0.9.7i.Configure-compat32.patch
  485. - changed '/lib' to '/%{_lib}'
  486. * Mon Oct 17 2005 Daisuke SUZUKI <daisuke@linux.or.jp> 0.9.7i-0vl1
  487. - new upstream release
  488. * Mon Jan 31 2005 Daisuke SUZUKI <daisuke@linux.or.jp> 0.9.7d-0vl4
  489. - rebuild on VineSeed
  490. * Sun Jan 09 2005 IKEDA Katsumi <ikeda@webmasters.gr.jp> 0.9.7d-0vl3.1
  491. - added a security patch from Gentoo.
  492. - Patch1: openssl-0.9.7c-tempfile.patch
  493. * Sun Mar 28 2004 MATSUBAYASHI Kohji <shaolin@vinelinux.org> 0.9.7d-0vl3
  494. - sslarch for ppc was missing... added.
  495. * Fri Mar 26 2004 Tomoya TAKA <taka@vinelinux.org> 0.9.7d-0vl2
  496. - use sslarch=linux-alpha-gcc instead of alpha-gcc
  497. * Mon Mar 22 2004 Satoshi MACHINO <machino@vinelinux.org> 0.9.7d-0vl1
  498. - new upstream version
  499. - clean up of spec file
  500. -- removed old patches
  501. * Sat Mar 20 2004 Daisuke SUZUKI <daisuke@linux.or.jp> 0.9.6m-0vl1
  502. - new upstream release
  503. - SECURITY fix.
  504. - http://www.openssl.org/news/secadv_20040317.txt
  505. * Wed Oct 1 2003 Daisuke SUZUKI <daisuke@linux.or.jp> 0.9.6k-0vl1
  506. - new upstream release
  507. - [Security fix]
  508. - Vulnerabilities in ASN.1 parsing
  509. http://www.openssl.org/news/secadv_20030930.txt
  510. - see %{_docdir}/%{name}-%{version}/CHANGES for other changes
  511. * Wed Jun 04 2003 HOTTA Michihide <hotta@net-newbie.com> 0.9.6j-0vl2
  512. - add openssl.pc for pkgconfig
  513. * Tue Mar 11 2003 Satoshi MACHINO <machino@vinelinux.org> 0.9.6j-0vl1
  514. - New upstream version
  515. - dropped patch10, 11
  516. -- merged upstream version
  517. * Sun Feb 23 2003 Daisuke SUZUKI <daisuke@linux.or.jp> 0.9.6i-0vl1
  518. - rebuild for VineSeed
  519. * Sun Feb 23 2003 Daisuke SUZUKI <daisuke@linux.or.jp> 0.9.6i-0vl0.26.1
  520. - [Security Fix]
  521. - Timing-based attacks on RSA keys
  522. http://www.openssl.org/news/secadv_20030317.txt
  523. - Klima-Pokorny0Rosa attack on RSA in SSL/TLS
  524. http://www.openssl.org/news/secadv_20030317.txt
  525. * Sun Feb 23 2003 Daisuke SUZUKI <daisuke@linux.or.jp> 0.9.6i-0vl0.26
  526. - new upstream release 0.9.6i
  527. - [Security Fix]
  528. - build for Vine Linux 2.6 errata
  529. * Mon Nov 18 2002 Daisuke SUZUKI <daisuke@linux.or.jp> 0.9.6h-0vl1
  530. - new upstream release 0.9.6h
  531. * Mon Nov 18 2002 Daisuke SUZUKI <daisuke@linux.or.jp> 0.9.6g-0vl1
  532. - new upstream release 0.9.6g
  533. * Mon Oct 28 2002 IWAI Masaharu <iwai@alib.jp> 0.9.6b-1vl6
  534. - SECURITY: CAN-2002-0659 fixed
  535. - added Patch101 from RedHat 7.2 updates 0.9.6b-28
  536. * Fri Aug 02 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-28
  537. - update asn patch to fix accidental reversal of a logic check
  538. * Thu Aug 01 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-27
  539. - update asn patch to reduce chance that compiler optimization will remove
  540. one of the added tests
  541. * Thu Aug 01 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-26
  542. - rebuild
  543. * Tue Jul 30 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-25
  544. - add patch to fix ASN.1 vulnerabilities
  545. * Wed Jul 31 2002 IWAI Masaharu <iwai@alib.jp> 0.9.6b-1vl5
  546. - rename spec file name
  547. - SECURITY: CA-2002-23 fixed
  548. - added Patch100 from RedHat 7.2 updates 0.9.6b-24
  549. * Thu Jul 25 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-24
  550. - add backport of Ben Laurie's patches for OpenSSL 0.9.6d
  551. * Mon Sep 10 2001 Satoshi MACHINO <machino@vinelinux.org> 0.9.6b-1vl4
  552. - added ${PATH} in LD_LIBRARY_PATH
  553. - added install -m 755 *.so.* $RPM_BUILD_ROOT%{_libdir} in %install
  554. * Sun Jul 15 2001 Daisuke SUZUKI <daisuke@linux.or.jp> 0.9.6b-1vl3
  555. - remove --no-<cipher>
  556. * Sun Jul 15 2001 Daisuke SUZUKI <daisuke@linux.or.jp> 0.9.6b-1vl2
  557. - add Patch10 for mipsel shared ( Configure )
  558. * Sat Jul 14 2001 Daisuke SUZUKI <daisuke@linux.or.jp> 0.9.6b-1vl1
  559. - build for Vine Linux
  560. - use openssl-engine-0.9.6b.tar.gz
  561. * Wed Jul 11 2001 Nalin Dahyabhai <nalin@redhat.com>
  562. - update to 0.9.6b
  563. * Thu Jul 5 2001 Nalin Dahyabhai <nalin@redhat.com>
  564. - move .so symlinks back to %%{_libdir}
  565. * Tue Jul 3 2001 Nalin Dahyabhai <nalin@redhat.com>
  566. - move shared libraries to /lib (#38410)
  567. * Mon Jun 25 2001 Nalin Dahyabhai <nalin@redhat.com>
  568. - switch to engine code base
  569. * Mon Jun 18 2001 Nalin Dahyabhai <nalin@redhat.com>
  570. - add a script for creating dummy certificates
  571. - move man pages from %%{_mandir}/man?/foo.?ssl to %%{_mandir}/man?ssl/foo.?
  572. * Thu Jun 07 2001 Florian La Roche <Florian.LaRoche@redhat.de>
  573. - add s390x support
  574. * Fri Jun 1 2001 Nalin Dahyabhai <nalin@redhat.com>
  575. - change two memcpy() calls to memmove()
  576. - don't define L_ENDIAN on alpha
  577. * Tue May 15 2001 Nalin Dahyabhai <nalin@redhat.com>
  578. - make subpackages depend on the main package
  579. * Tue May 1 2001 Nalin Dahyabhai <nalin@redhat.com>
  580. - adjust the hobble script to not disturb symlinks in include/ (fix from
  581. Joe Orton)
  582. * Thu Apr 26 2001 Nalin Dahyabhai <nalin@redhat.com>
  583. - drop the m2crypo patch we weren't using
  584. * Tue Apr 24 2001 Nalin Dahyabhai <nalin@redhat.com>
  585. - configure using "shared" as well
  586. * Sun Apr 8 2001 Nalin Dahyabhai <nalin@redhat.com>
  587. - update to 0.9.6a
  588. - use the build-shared target to build shared libraries
  589. - bump the soversion to 2 because we're no longer compatible with
  590. our 0.9.5a packages or our 0.9.6 packages
  591. - drop the patch for making rsatest a no-op when rsa null support is used
  592. - put all man pages into <section>ssl instead of <section>
  593. - break the m2crypto modules into a separate package
  594. * Tue Mar 13 2001 Nalin Dahyabhai <nalin@redhat.com>
  595. - use BN_LLONG on s390
  596. * Mon Mar 12 2001 Nalin Dahyabhai <nalin@redhat.com>
  597. - fix the s390 changes for 0.9.6 (isn't supposed to be marked as 64-bit)
  598. * Sat Mar 3 2001 Nalin Dahyabhai <nalin@redhat.com>
  599. - move c_rehash to the perl subpackage, because it's a perl script now
  600. * Fri Mar 2 2001 Nalin Dahyabhai <nalin@redhat.com>
  601. - update to 0.9.6
  602. - enable MD2
  603. - use the libcrypto.so and libssl.so targets to build shared libs with
  604. - bump the soversion to 1 because we're no longer compatible with any of
  605. the various 0.9.5a packages circulating around, which provide lib*.so.0
  606. * Wed Feb 28 2001 Florian La Roche <Florian.LaRoche@redhat.de>
  607. - change hobble-openssl for disabling MD2 again
  608. * Tue Feb 27 2001 Nalin Dahyabhai <nalin@redhat.com>
  609. - re-disable MD2 -- the EVP_MD_CTX structure would grow from 100 to 152
  610. bytes or so, causing EVP_DigestInit() to zero out stack variables in
  611. apps built against a version of the library without it
  612. * Mon Feb 26 2001 Nalin Dahyabhai <nalin@redhat.com>
  613. - disable some inline assembly, which on x86 is Pentium-specific
  614. - re-enable MD2 (see http://www.ietf.org/ietf/IPR/RSA-MD-all)
  615. * Thu Feb 08 2001 Florian La Roche <Florian.LaRoche@redhat.de>
  616. - fix s390 patch
  617. * Fri Dec 8 2000 Than Ngo <than@redhat.com>
  618. - added support s390
  619. * Mon Nov 20 2000 Nalin Dahyabhai <nalin@redhat.com>
  620. - remove -Wa,* and -m* compiler flags from the default Configure file (#20656)
  621. - add the CA.pl man page to the perl subpackage
  622. * Thu Nov 2 2000 Nalin Dahyabhai <nalin@redhat.com>
  623. - always build with -mcpu=ev5 on alpha
  624. * Tue Oct 31 2000 Nalin Dahyabhai <nalin@redhat.com>
  625. - add a symlink from cert.pem to ca-bundle.crt
  626. * Wed Oct 25 2000 Nalin Dahyabhai <nalin@redhat.com>
  627. - add a ca-bundle file for packages like Samba to reference for CA certificates
  628. * Tue Oct 24 2000 Nalin Dahyabhai <nalin@redhat.com>
  629. - remove libcrypto's crypt(), which doesn't handle md5crypt (#19295)
  630. * Mon Oct 2 2000 Nalin Dahyabhai <nalin@redhat.com>
  631. - add unzip as a buildprereq (#17662)
  632. - update m2crypto to 0.05-snap4
  633. * Tue Sep 26 2000 Bill Nottingham <notting@redhat.com>
  634. - fix some issues in building when it's not installed
  635. * Wed Sep 6 2000 Nalin Dahyabhai <nalin@redhat.com>
  636. - make sure the headers we include are the ones we built with (aaaaarrgh!)
  637. * Fri Sep 1 2000 Nalin Dahyabhai <nalin@redhat.com>
  638. - add Richard Henderson's patch for BN on ia64
  639. - clean up the changelog
  640. * Tue Aug 29 2000 Nalin Dahyabhai <nalin@redhat.com>
  641. - fix the building of python modules without openssl-devel already installed
  642. * Wed Aug 23 2000 Nalin Dahyabhai <nalin@redhat.com>
  643. - byte-compile python extensions without the build-root
  644. - adjust the makefile to not remove temporary files (like .key files when
  645. building .csr files) by marking them as .PRECIOUS
  646. * Sat Aug 19 2000 Nalin Dahyabhai <nalin@redhat.com>
  647. - break out python extensions into a subpackage
  648. * Mon Jul 17 2000 Nalin Dahyabhai <nalin@redhat.com>
  649. - tweak the makefile some more
  650. * Tue Jul 11 2000 Nalin Dahyabhai <nalin@redhat.com>
  651. - disable MD2 support
  652. * Thu Jul 6 2000 Nalin Dahyabhai <nalin@redhat.com>
  653. - disable MDC2 support
  654. * Sun Jul 2 2000 Nalin Dahyabhai <nalin@redhat.com>
  655. - tweak the disabling of RC5, IDEA support
  656. - tweak the makefile
  657. * Thu Jun 29 2000 Nalin Dahyabhai <nalin@redhat.com>
  658. - strip binaries and libraries
  659. - rework certificate makefile to have the right parts for Apache
  660. * Wed Jun 28 2000 Nalin Dahyabhai <nalin@redhat.com>
  661. - use %%{_perl} instead of /usr/bin/perl
  662. - disable alpha until it passes its own test suite
  663. * Fri Jun 9 2000 Nalin Dahyabhai <nalin@redhat.com>
  664. - move the passwd.1 man page out of the passwd package's way
  665. * Fri Jun 2 2000 Nalin Dahyabhai <nalin@redhat.com>
  666. - update to 0.9.5a, modified for U.S.
  667. - add perl as a build-time requirement
  668. - move certificate makefile to another package
  669. - disable RC5, IDEA, RSA support
  670. - remove optimizations for now
  671. * Wed Mar 1 2000 Florian La Roche <Florian.LaRoche@redhat.de>
  672. - Bero told me to move the Makefile into this package
  673. * Wed Mar 1 2000 Florian La Roche <Florian.LaRoche@redhat.de>
  674. - add lib*.so symlinks to link dynamically against shared libs
  675. * Tue Feb 29 2000 Florian La Roche <Florian.LaRoche@redhat.de>
  676. - update to 0.9.5
  677. - run ldconfig directly in post/postun
  678. - add FAQ
  679. * Sat Dec 18 1999 Bernhard Rosenkrdnzer <bero@redhat.de>
  680. - Fix build on non-x86 platforms
  681. * Fri Nov 12 1999 Bernhard Rosenkrdnzer <bero@redhat.de>
  682. - move /usr/share/ssl/* from -devel to main package
  683. * Tue Oct 26 1999 Bernhard Rosenkrdnzer <bero@redhat.de>
  684. - inital packaging
  685. - changes from base:
  686. - Move /usr/local/ssl to /usr/share/ssl for FHS compliance
  687. - handle RPM_OPT_FLAGS