up to 3.3.0 (fixes CVE-2024-2511)

diff --git a/engines-dir.patch b/engines-dir.patch
index f8c6291f59e7f627d0d51db9bc69ecfeaa323b2f..29d83eec78f6639a624f5a6066daf8615a502365 100644 (file)
--- a/engines-dir.patch
+++ b/engines-dir.patch
@@ -1,6 +1,6 @@
---- openssl-3.0.0/Configurations/unix-Makefile.tmpl~   2021-09-18 10:59:16.000000000 +0200
-+++ openssl-3.0.0/Configurations/unix-Makefile.tmpl    2021-09-18 11:01:29.191573488 +0200
-@@ -303,8 +303,8 @@
+--- openssl-3.0.5/Configurations/unix-Makefile.tmpl.orig       2022-07-10 17:18:36.338376691 +0200
++++ openssl-3.0.5/Configurations/unix-Makefile.tmpl    2022-07-10 17:29:34.034813643 +0200
+@@ -304,8 +304,8 @@ LIBDIR={- our $libdir = $config{libdir};
  # $(libdir) is chosen to be compatible with the GNU coding standards
  libdir={- file_name_is_absolute($libdir)
            ? $libdir : '$(INSTALLTOP)/$(LIBDIR)' -}

diff --git a/openssl-ca-certificates.patch b/openssl-ca-certificates.patch
index 1afdbfbda0cd7ca9c6c6f49b5ad07be0a9668aaa..67bad3fa204eeba50ed014fcc00b99a0edb046e6 100644 (file)
--- a/openssl-ca-certificates.patch
+++ b/openssl-ca-certificates.patch
@@ -1,5 +1,5 @@
---- openssl-1.1.1/include/internal/cryptlib.h~ 2018-09-11 14:48:23.000000000 +0200
-+++ openssl-1.1.1/include/internal/cryptlib.h  2018-09-11 22:14:32.008012409 +0200
+--- openssl-1.1.1/include/internal/common.h~   2018-09-11 14:48:23.000000000 +0200
++++ openssl-1.1.1/include/internal/common.h    2018-09-11 22:14:32.008012409 +0200
 @@ -56,7 +56,7 @@ DEFINE_LHASH_OF(MEM);
  # ifndef OPENSSL_SYS_VMS
  #  define X509_CERT_AREA          OPENSSLDIR

diff --git a/openssl.spec b/openssl.spec
index 65f99119ed87f4439458d455453e9bef18f51a37..424e865990ccf98e7f894d954b11c5af4df0705f 100644 (file)
--- a/openssl.spec
+++ b/openssl.spec
@@ -13,12 +13,12 @@ Summary(pt_BR.UTF-8):       Uma biblioteca C que fornece vários algoritmos e protocol
 Summary(ru.UTF-8):     Библиотеки и утилиты для соединений через Secure Sockets Layer
 Summary(uk.UTF-8):     Бібліотеки та утиліти для з'єднань через Secure Sockets Layer
 Name:          openssl
-Version:       3.0.0
+Version:       3.3.0
 Release:       1
 License:       Apache v2.0
 Group:         Libraries
 Source0:       https://www.openssl.org/source/%{name}-%{version}.tar.gz
-# Source0-md5: 43c5ab628b7ab899d7cd4a4c7fe4067f
+# Source0-md5: c8b063afbea85d867e161ecb8816cfa9
 Source2:       %{name}.1.pl
 Source3:       %{name}-ssl-certificate.sh
 Source4:       %{name}-c_rehash.sh
@@ -28,19 +28,26 @@ Patch2:             %{name}-find.patch
 Patch3:                pic.patch
 Patch4:                engines-dir.patch
 URL:           http://www.openssl.org/
+%ifarch %{arm} ppc mips sparc sparcv9
+BuildRequires: libatomic-devel
+%endif
+BuildRequires: libbrotli-devel
 BuildRequires: libsctp-devel
+BuildRequires: linux-libc-headers >= 7:4.13
 BuildRequires: perl-devel >= 1:5.10.0
 BuildRequires: pkgconfig
 BuildRequires: rpm-perlprov >= 4.1-13
-BuildRequires: rpmbuild(macros) >= 1.213
+BuildRequires: rpmbuild(macros) >= 1.745
 BuildRequires: sed >= 4.0
 BuildRequires: zlib-devel
+BuildRequires: zstd-devel
 Requires:      ca-certificates >= 20141019-3
 Requires:      rpm-whiteout >= 1.7
-Obsoletes:     SSLeay
-Obsoletes:     SSLeay-devel
-Obsoletes:     SSLeay-perl
-Obsoletes:     libopenssl0
+Obsoletes:     SSLeay < 0.9.3
+Obsoletes:     SSLeay-devel < 0.9.3
+Obsoletes:     SSLeay-perl < 0.9.3
+Obsoletes:     libopenssl0 < 1
+Obsoletes:     openssl-engines < 3.0.0-2
 %if "%{pld_release}" == "ac"
 Conflicts:     neon < 0.26.3-3
 Conflicts:     ntpd < 4.2.4p8-10
@@ -104,53 +111,11 @@ RC4, RSA и SSL.
 користування, що реалізують велику кількість криптографічних
 алгоритмів, включаючи DES, RC4, RSA та SSL.
 
-%package engines
-Summary:       OpenSSL optional crypto engines
-Summary(pl.UTF-8):     Opcjonalne silniki kryptograficzne dla OpenSSL-a
-Group:         Libraries
-Requires:      %{name} = %{version}-%{release}
-
-%description engines
-With OpenSSL 0.9.6, a new component was added to support alternative
-cryptography implementations, most commonly for interfacing with
-external crypto devices (eg. accelerator cards). This component is
-called ENGINE.
-
-There are currently built-in ENGINE implementations for the following
-crypto devices:
-
-- CryptoSwift
-- Compaq Atalla
-- nCipher CHIL
-- Nuron
-- Broadcom uBSec
-
-In addition, dynamic binding to external ENGINE implementations is now
-provided by a special ENGINE called "dynamic".
-
-%description engines -l pl.UTF-8
-Począwszy od OpenSSL-a 0.9.6 został dodany nowy komponent, mający
-wspierać alternatywne implementacje kryptografii, przeważnie
-współpracujące z zewnętrznymi urządzeniami kryptograficznymi (np.
-kartami akceleratorów). Komponent ten jest nazywany SILNIKIEM (ang.
-ENGINE).
-
-Obecnie istnieją wbudowane implementacje silników dla następujących
-urządzeń kryptograficznych:
-- CryptoSwift
-- Compaq Atalla
-- nCipher CHIL
-- Nuron
-- Broadcom uBSec
-
-Ponadto zapewnione jest dynamiczne wiązanie dla zewnętrznych
-implementacji silników poprzez specjalny silnik o nazwie "dynamic".
-
 %package tools
 Summary:       OpenSSL command line tool and utilities
 Summary(pl.UTF-8):     Zestaw narzędzi i skryptów
 Group:         Applications/Communications
-Requires:      %{name} = %{version}-%{release}
+Requires:      %{name}%{?_isa} = %{version}-%{release}
 Requires:      which
 
 %description tools
@@ -181,8 +146,8 @@ Summary(pt_BR.UTF-8):       Bibliotecas e arquivos de inclusão para desenvolvimento O
 Summary(ru.UTF-8):     Библиотеки, хедеры и утилиты для Secure Sockets Layer
 Summary(uk.UTF-8):     Бібліотеки, хедери та утиліти для Secure Sockets Layer
 Group:         Development/Libraries
-Requires:      %{name} = %{version}-%{release}
-Obsoletes:     libopenssl0-devel
+Requires:      %{name}%{?_isa} = %{version}-%{release}
+Obsoletes:     libopenssl0-devel < 1
 
 %description devel
 Development part of OpenSSL library.
@@ -264,6 +229,7 @@ PERL="%{__perl}" \
        threads \
        %{?with_sslv3:enable-ssl3}%{!?with_sslv3:no-ssl3} \
        %{!?with_zlib:no-}zlib \
+       enable-brotli \
        enable-cms \
        enable-idea \
        enable-md2 \
@@ -272,6 +238,10 @@ PERL="%{__perl}" \
        enable-rfc3779 \
        enable-sctp \
        enable-seed \
+       enable-camellia \
+       enable-ktls \
+       enable-fips \
+       enable-zstd \
 %ifarch %{x8664}
        enable-ec_nistp_64_gcc_128 \
 %endif
@@ -317,13 +287,20 @@ PERL="%{__perl}" \
        linux-aarch64
 %endif
 
-v=$(awk -F= '/^VERSION/{print $2}' Makefile)
+v=$(awk -F= '/^VERSION=/{print $2}' Makefile)
 test "$v" = %{version}
 
-%{__make} -j1 all %{?with_tests:tests} \
+%{__make} all \
+       CC="%{__cc}" \
+       OPTFLAGS="%{rpmcflags} %{rpmcppflags}" \
+       INSTALLTOP=%{_prefix}
+
+%if %{with tests}
+%{__make} -j1 tests \
        CC="%{__cc}" \
        OPTFLAGS="%{rpmcflags} %{rpmcppflags}" \
        INSTALLTOP=%{_prefix}
+%endif
 
 %install
 rm -rf $RPM_BUILD_ROOT
@@ -331,7 +308,7 @@ install -d $RPM_BUILD_ROOT{%{_sysconfdir}/%{name},%{_libdir}/%{name}} \
        $RPM_BUILD_ROOT{%{_mandir}/{pl/man1,man{1,3,5,7}},%{_datadir}/ssl} \
        $RPM_BUILD_ROOT%{_pkgconfigdir}
 
-%{__make} -j1 install \
+%{__make} install \
        CC="%{__cc}" \
        DESTDIR=$RPM_BUILD_ROOT
 
@@ -383,76 +360,79 @@ fi
 %doc CHANGES.md NEWS.md README.md doc/*.txt
 %attr(755,root,root) /%{_lib}/libcrypto.so.*
 %attr(755,root,root) /%{_lib}/libssl.so.*
+%dir /%{_lib}/engines-3
+%attr(755,root,root) /%{_lib}/engines-3/*.so
 %dir /%{_lib}/ossl-modules
+%attr(755,root,root) /%{_lib}/ossl-modules/fips.so
 %attr(755,root,root) /%{_lib}/ossl-modules/legacy.so
 %dir %{_sysconfdir}/%{name}
+%config(noreplace) %verify(not md5 mtime size) %{_sysconfdir}/%{name}/ct_log_list.cnf
+%config(noreplace) %verify(not md5 mtime size) %{_sysconfdir}/%{name}/fipsmodule.cnf
+%config(noreplace) %verify(not md5 mtime size) %{_sysconfdir}/%{name}/openssl.cnf
 %dir %{_sysconfdir}/%{name}/certs
 %dir %attr(700,root,root) %{_sysconfdir}/%{name}/private
 %dir %{_datadir}/ssl
-
-%files engines
-%defattr(644,root,root,755)
-%dir /%{_lib}/engines-3
-%attr(755,root,root) /%{_lib}/engines-3/*.so
+%{_mandir}/man5/config.5ossl*
 
 %files tools
 %defattr(644,root,root,755)
-%config(noreplace) %verify(not md5 mtime size) %{_sysconfdir}/%{name}/ct_log_list.cnf
-%config(noreplace) %verify(not md5 mtime size) %{_sysconfdir}/%{name}/openssl.cnf
 %attr(755,root,root) %{_bindir}/c_rehash.sh
 %attr(755,root,root) %{_bindir}/openssl
 %attr(754,root,root) %{_bindir}/ssl-certificate
-%{_mandir}/man1/asn1parse.1*
-%{_mandir}/man1/ca.1*
-%{_mandir}/man1/ciphers.1*
-%{_mandir}/man1/cms.1*
-%{_mandir}/man1/crl.1*
-%{_mandir}/man1/crl2pkcs7.1*
-%{_mandir}/man1/dgst.1*
-%{_mandir}/man1/dhparam.1*
-%{_mandir}/man1/dsa.1*
-%{_mandir}/man1/dsaparam.1*
-%{_mandir}/man1/ec.1*
-%{_mandir}/man1/ecparam.1*
-%{_mandir}/man1/enc.1*
-%{_mandir}/man1/engine.1*
-%{_mandir}/man1/errstr.1*
-%{_mandir}/man1/gendsa.1*
-%{_mandir}/man1/genpkey.1*
-%{_mandir}/man1/genrsa.1*
-%{_mandir}/man1/kdf.1*
-%{_mandir}/man1/mac.1*
-%{_mandir}/man1/nseq.1*
-%{_mandir}/man1/ocsp.1*
+%{_mandir}/man1/asn1parse.1ossl*
+%{_mandir}/man1/ca.1ossl*
+%{_mandir}/man1/ciphers.1ossl*
+%{_mandir}/man1/cmp.1ossl*
+%{_mandir}/man1/cms.1ossl*
+%{_mandir}/man1/crl.1ossl*
+%{_mandir}/man1/crl2pkcs7.1ossl*
+%{_mandir}/man1/dgst.1ossl*
+%{_mandir}/man1/dhparam.1ossl*
+%{_mandir}/man1/dsa.1ossl*
+%{_mandir}/man1/dsaparam.1ossl*
+%{_mandir}/man1/ec.1ossl*
+%{_mandir}/man1/ecparam.1ossl*
+%{_mandir}/man1/enc.1ossl*
+%{_mandir}/man1/engine.1ossl*
+%{_mandir}/man1/errstr.1ossl*
+%{_mandir}/man1/gendsa.1ossl*
+%{_mandir}/man1/genpkey.1ossl*
+%{_mandir}/man1/genrsa.1ossl*
+%{_mandir}/man1/info.1ossl*
+%{_mandir}/man1/kdf.1ossl*
+%{_mandir}/man1/mac.1ossl*
+%{_mandir}/man1/nseq.1ossl*
+%{_mandir}/man1/ocsp.1ossl*
 %{_mandir}/man1/openssl.1*
 %{_mandir}/man1/openssl-*.1*
-%{_mandir}/man1/passwd.1*
-%{_mandir}/man1/pkcs12.1*
-%{_mandir}/man1/pkcs7.1*
-%{_mandir}/man1/pkcs8.1*
-%{_mandir}/man1/pkey.1*
-%{_mandir}/man1/pkeyparam.1*
-%{_mandir}/man1/pkeyutl.1*
-%{_mandir}/man1/prime.1*
-%{_mandir}/man1/rand.1*
-%{_mandir}/man1/rehash.1*
-%{_mandir}/man1/req.1*
-%{_mandir}/man1/rsa.1*
-%{_mandir}/man1/rsautl.1*
-%{_mandir}/man1/s_client.1*
-%{_mandir}/man1/sess_id.1*
-%{_mandir}/man1/smime.1*
-%{_mandir}/man1/speed.1*
-%{_mandir}/man1/spkac.1*
-%{_mandir}/man1/srp.1*
-%{_mandir}/man1/s_server.1*
-%{_mandir}/man1/s_time.1*
-%{_mandir}/man1/storeutl.1*
-%{_mandir}/man1/ts.1*
-%{_mandir}/man1/verify.1*
-%{_mandir}/man1/version.1*
-%{_mandir}/man1/x509.1*
-%{_mandir}/man5/*.5*
+%{_mandir}/man1/passwd.1ossl*
+%{_mandir}/man1/pkcs12.1ossl*
+%{_mandir}/man1/pkcs7.1ossl*
+%{_mandir}/man1/pkcs8.1ossl*
+%{_mandir}/man1/pkey.1ossl*
+%{_mandir}/man1/pkeyparam.1ossl*
+%{_mandir}/man1/pkeyutl.1ossl*
+%{_mandir}/man1/prime.1ossl*
+%{_mandir}/man1/rand.1ossl*
+%{_mandir}/man1/rehash.1ossl*
+%{_mandir}/man1/req.1ossl*
+%{_mandir}/man1/rsa.1ossl*
+%{_mandir}/man1/rsautl.1ossl*
+%{_mandir}/man1/s_client.1ossl*
+%{_mandir}/man1/sess_id.1ossl*
+%{_mandir}/man1/smime.1ossl*
+%{_mandir}/man1/speed.1ossl*
+%{_mandir}/man1/spkac.1ossl*
+%{_mandir}/man1/srp.1ossl*
+%{_mandir}/man1/s_server.1ossl*
+%{_mandir}/man1/s_time.1ossl*
+%{_mandir}/man1/storeutl.1ossl*
+%{_mandir}/man1/ts.1ossl*
+%{_mandir}/man1/verify.1ossl*
+%{_mandir}/man1/version.1ossl*
+%{_mandir}/man1/x509.1ossl*
+%{_mandir}/man5/fips_config.5ossl*
+%{_mandir}/man5/x509v3_config.5ossl*
 %lang(pl) %{_mandir}/pl/man1/openssl.1*
 
 %files tools-perl
@@ -462,20 +442,21 @@ fi
 %attr(755,root,root) %{_libdir}/%{name}/CA.pl
 %attr(755,root,root) %{_libdir}/%{name}/tsget
 %attr(755,root,root) %{_libdir}/%{name}/tsget.pl
-%{_mandir}/man1/CA.pl.1*
-%{_mandir}/man1/c_rehash.1*
-%{_mandir}/man1/tsget.1*
+%{_mandir}/man1/CA.pl.1ossl*
+%{_mandir}/man1/c_rehash.1ossl*
+%{_mandir}/man1/tsget.1ossl*
 
 %files devel
 %defattr(644,root,root,755)
 %attr(755,root,root) %{_libdir}/libcrypto.so
 %attr(755,root,root) %{_libdir}/libssl.so
 %{_includedir}/%{name}
+%{_libdir}/cmake/OpenSSL
 %{_pkgconfigdir}/libcrypto.pc
 %{_pkgconfigdir}/libssl.pc
 %{_pkgconfigdir}/openssl.pc
-%{_mandir}/man3/*.3*
-%{_mandir}/man7/*.7*
+%{_mandir}/man3/*.3ossl*
+%{_mandir}/man7/*.7ossl*
 
 %files static
 %defattr(644,root,root,755)