新建用户

    1. useradd -s /sbin/nologin mockbuild
    1. [root@n9e tmp]# rpm -ivh openssl-1.0.2k-19.el7.src.rpm 
    2. Updating / installing...
    3.    1:openssl-1:1.0.2k-19.el7          ################################# [100%]
    4. [root@n9e tmp]# cd /root/rpmbuild/
    5. [root@n9e rpmbuild]# ll
    6. total 12
    7. drwxr-xr-x 2 root root 8192 Dec 14 11:38 SOURCES
    8. drwxr-xr-x 2 root root   26 Dec 14 11:38 SPECS
    9. [root@n9e rpmbuild]#

    查看 源码和specs
    cd /root/rpmbuild

    image.png

    1. [BEGIN] 2020-12-14  11:43:00
    2. [root@n9e SPECS]# cat openssl.spec 
    3. # For the curious:
    4. # 0.9.5a soversion = 0
    5. # 0.9.6  soversion = 1
    6. # 0.9.6a soversion = 2
    7. # 0.9.6c soversion = 3
    8. # 0.9.7a soversion = 4
    9. # 0.9.7ef soversion = 5
    10. # 0.9.8ab soversion = 6
    11. # 0.9.8g soversion = 7
    12. # 0.9.8jk + EAP-FAST soversion = 8
    13. # 1.0.0 soversion = 10
    14. %define soversion 10
    16. # Number of threads to spawn when testing some threading fixes.
    17. %define thread_test_threads %{?threads:%{threads}}%{!?threads:1}
    19. # Arches on which we need to prevent arch conflicts on opensslconf.h, must
    20. # also be handled in opensslconf-new.h.
    21. %define multilib_arches %{ix86} ia64 %{mips} ppc ppc64 s390 s390x sparcv9 sparc64 x86_64
    23. %global _performance_build 1
    25. Summary: Utilities from the general purpose cryptography library with TLS implementation
    26. Name: openssl
    27. Version: 1.0.2k
    28. Release: 19%{?dist}
    29. Epoch: 1
    30. # We have to remove certain patented algorithms from the openssl source
    31. # tarball with the hobble-openssl script which is included below.
    32. # The original openssl upstream tarball cannot be shipped in the .src.rpm.
    33. Source: openssl-%{version}-hobbled.tar.xz
    34. Source1: hobble-openssl
    35. Source2: Makefile.certificate
    36. Source5: README.legacy-settings
    37. Source6: make-dummy-cert
    38. Source7: renew-dummy-cert
    39. Source8: openssl-thread-test.c
    40. Source9: opensslconf-new.h
    41. Source10: opensslconf-new-warning.h
    42. Source11: README.FIPS
    43. Source12: ec_curve.c
    44. Source13: ectest.c
    45. # Build changes
    46. Patch1: openssl-1.0.2e-rpmbuild.patch
    47. Patch2: openssl-1.0.2a-defaults.patch
    48. Patch4: openssl-1.0.2i-enginesdir.patch
    49. Patch5: openssl-1.0.2a-no-rpath.patch
    50. Patch6: openssl-1.0.2a-test-use-localhost.patch
    51. Patch7: openssl-1.0.0-timezone.patch
    52. Patch8: openssl-1.0.1c-perlfind.patch
    53. Patch9: openssl-1.0.1c-aliasing.patch
    54. # Bug fixes
    55. Patch23: openssl-1.0.2c-default-paths.patch
    56. Patch24: openssl-1.0.2a-issuer-hash.patch
    57. # Functionality changes
    58. Patch33: openssl-1.0.0-beta4-ca-dir.patch
    59. Patch34: openssl-1.0.2a-x509.patch
    60. Patch35: openssl-1.0.2a-version-add-engines.patch
    61. Patch39: openssl-1.0.2a-ipv6-apps.patch
    62. Patch40: openssl-1.0.2i-fips.patch
    63. Patch43: openssl-1.0.2j-krb5keytab.patch
    64. Patch45: openssl-1.0.2a-env-zlib.patch
    65. Patch47: openssl-1.0.2a-readme-warning.patch
    66. Patch49: openssl-1.0.1i-algo-doc.patch
    67. Patch50: openssl-1.0.2a-dtls1-abi.patch
    68. Patch51: openssl-1.0.2a-version.patch
    69. Patch56: openssl-1.0.2a-rsa-x931.patch
    70. Patch58: openssl-1.0.2a-fips-md5-allow.patch
    71. Patch60: openssl-1.0.2a-apps-dgst.patch
    72. Patch63: openssl-1.0.2k-starttls.patch
    73. Patch65: openssl-1.0.2i-chil-fixes.patch
    74. Patch66: openssl-1.0.2h-pkgconfig.patch
    75. Patch68: openssl-1.0.2i-secure-getenv.patch
    76. Patch70: openssl-1.0.2a-fips-ec.patch
    77. Patch71: openssl-1.0.2g-manfix.patch
    78. Patch72: openssl-1.0.2a-fips-ctor.patch
    79. Patch73: openssl-1.0.2c-ecc-suiteb.patch
    80. Patch74: openssl-1.0.2j-deprecate-algos.patch
    81. Patch75: openssl-1.0.2a-compat-symbols.patch
    82. Patch76: openssl-1.0.2j-new-fips-reqs.patch
    83. Patch77: openssl-1.0.2j-downgrade-strength.patch
    84. Patch78: openssl-1.0.2k-cc-reqs.patch
    85. Patch90: openssl-1.0.2i-enc-fail.patch
    86. Patch94: openssl-1.0.2d-secp256k1.patch
    87. Patch95: openssl-1.0.2e-remove-nistp224.patch
    88. Patch96: openssl-1.0.2e-speed-doc.patch
    89. Patch97: openssl-1.0.2k-no-ssl2.patch
    90. Patch98: openssl-1.0.2k-long-hello.patch
    91. Patch99: openssl-1.0.2k-fips-randlock.patch
    92. Patch106: openssl-1.0.2k-rsa-check.patch
    93. # Backported fixes including security fixes
    94. Patch80: openssl-1.0.2e-wrap-pad.patch
    95. Patch81: openssl-1.0.2a-padlock64.patch
    96. Patch82: openssl-1.0.2i-trusted-first-doc.patch
    97. Patch83: openssl-1.0.2k-backports.patch
    98. Patch84: openssl-1.0.2k-ppc-update.patch
    99. Patch85: openssl-1.0.2k-req-x509.patch
    100. Patch86: openssl-1.0.2k-cve-2017-3736.patch
    101. Patch87: openssl-1.0.2k-cve-2017-3737.patch
    102. Patch88: openssl-1.0.2k-cve-2017-3738.patch
    103. Patch89: openssl-1.0.2k-s390x-update.patch
    104. Patch100: openssl-1.0.2k-name-sensitive.patch
    105. Patch101: openssl-1.0.2k-cve-2017-3735.patch
    106. Patch102: openssl-1.0.2k-cve-2018-0732.patch
    107. Patch103: openssl-1.0.2k-cve-2018-0737.patch
    108. Patch104: openssl-1.0.2k-cve-2018-0739.patch
    109. Patch105: openssl-1.0.2k-cve-2018-0495.patch
    110. Patch107: openssl-1.0.2k-cve-2018-5407.patch
    111. Patch108: openssl-1.0.2k-cve-2018-0734.patch
    112. Patch109: openssl-1.0.2k-cve-2019-1559.patch
    113. Patch110: openssl-1.0.2k-fix-one-and-done.patch
    114. Patch111: openssl-1.0.2k-fix-9-lives.patch
    116. License: OpenSSL
    117. Group: System Environment/Libraries
    118. URL: http://www.openssl.org/
    119. BuildRoot: %{_tmppath}/%{name}-%{version}-root
    120. BuildRequires: coreutils, krb5-devel, perl, sed, zlib-devel, /usr/bin/cmp
    121. BuildRequires: lksctp-tools-devel
    122. BuildRequires: /usr/bin/rename
    123. BuildRequires: /usr/bin/pod2man
    124. Requires: coreutils, make
    125. Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
    127. %description
    128. The OpenSSL toolkit provides support for secure communications between
    129. machines. OpenSSL includes a certificate management tool and shared
    130. libraries which provide various cryptographic algorithms and
    131. protocols.
    133. %package libs
    134. Summary: A general purpose cryptography library with TLS implementation
    135. Group: System Environment/Libraries
    136. Requires: ca-certificates >= 2008-5
    137. # Needed obsoletes due to the base/lib subpackage split
    138. Obsoletes: openssl < 1:1.0.1-0.3.beta3
    140. %description libs
    141. OpenSSL is a toolkit for supporting cryptography. The openssl-libs
    142. package contains the libraries that are used by various applications which
    143. support cryptographic algorithms and protocols.
    145. %package devel
    146. Summary: Files for development of applications which will use OpenSSL
    147. Group: Development/Libraries
    148. Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
    149. Requires: krb5-devel%{?_isa}, zlib-devel%{?_isa}
    150. Requires: pkgconfig
    152. %description devel
    153. OpenSSL is a toolkit for supporting cryptography. The openssl-devel
    154. package contains include files needed to develop applications which
    155. support various cryptographic algorithms and protocols.
    157. %package static
    158. Summary:  Libraries for static linking of applications which will use OpenSSL
    159. Group: Development/Libraries
    160. Requires: %{name}-devel%{?_isa} = %{epoch}:%{version}-%{release}
    162. %description static
    163. OpenSSL is a toolkit for supporting cryptography. The openssl-static
    164. package contains static libraries needed for static linking of
    165. applications which support various cryptographic algorithms and
    166. protocols.
    168. %package perl
    169. Summary: Perl scripts provided with OpenSSL
    170. Group: Applications/Internet
    171. Requires: perl
    172. Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release}
    174. %description perl
    175. OpenSSL is a toolkit for supporting cryptography. The openssl-perl
    176. package provides Perl scripts for converting certificates and keys
    177. from other formats to the formats used by the OpenSSL toolkit.
    179. %prep
    180. %setup -q -n %{name}-%{version}
    182. # The hobble_openssl is called here redundantly, just to be sure.
    183. # The tarball has already the sources removed.
    184. %{SOURCE1} > /dev/null
    186. cp %{SOURCE12} %{SOURCE13} crypto/ec/
    188. %patch1 -p1 -b .rpmbuild
    189. %patch2 -p1 -b .defaults
    190. %patch4 -p1 -b .enginesdir %{?_rawbuild}
    191. %patch5 -p1 -b .no-rpath
    192. %patch6 -p1 -b .use-localhost
    193. %patch7 -p1 -b .timezone
    194. %patch8 -p1 -b .perlfind %{?_rawbuild}
    195. %patch9 -p1 -b .aliasing
    197. %patch23 -p1 -b .default-paths
    198. %patch24 -p1 -b .issuer-hash
    200. %patch33 -p1 -b .ca-dir
    201. %patch34 -p1 -b .x509
    202. %patch35 -p1 -b .version-add-engines
    203. %patch39 -p1 -b .ipv6-apps
    204. %patch40 -p1 -b .fips
    205. %patch43 -p1 -b .krb5keytab 
    206. %patch45 -p1 -b .env-zlib
    207. %patch47 -p1 -b .warning
    208. %patch49 -p1 -b .algo-doc
    209. %patch50 -p1 -b .dtls1-abi
    210. %patch51 -p1 -b .version
    211. %patch56 -p1 -b .x931
    212. %patch58 -p1 -b .md5-allow
    213. %patch60 -p1 -b .dgst
    214. %patch63 -p1 -b .starttls
    215. %patch65 -p1 -b .chil
    216. %patch66 -p1 -b .pkgconfig
    217. %patch68 -p1 -b .secure-getenv
    218. %patch70 -p1 -b .fips-ec
    219. %patch71 -p1 -b .manfix
    220. %patch72 -p1 -b .fips-ctor
    221. %patch73 -p1 -b .suiteb
    222. %patch74 -p1 -b .deprecate-algos
    223. %patch75 -p1 -b .compat
    224. %patch76 -p1 -b .fips-reqs
    225. %patch77 -p1 -b .strength
    226. %patch78 -p1 -b .cc-reqs
    227. %patch90 -p1 -b .enc-fail
    228. %patch94 -p1 -b .secp256k1
    229. %patch95 -p1 -b .nistp224
    230. %patch96 -p1 -b .speed-doc
    231. %patch97 -p1 -b .no-ssl2
    232. %patch98 -p1 -b .long-hello
    233. %patch99 -p1 -b .randlock
    234. %patch106 -p1 -b .rsa-check
    236. %patch80 -p1 -b .wrap
    237. %patch81 -p1 -b .padlock64
    238. %patch82 -p1 -b .trusted-first
    239. %patch83 -p1 -b .backports
    240. %patch84 -p1 -b .ppc-update
    241. %patch85 -p1 -b .req-x509
    242. %patch86 -p1 -b .mont5-carry
    243. %patch87 -p1 -b .ssl-err
    244. %patch88 -p1 -b .rsaz-overflow
    245. %patch89 -p1 -b .s390x-update
    246. %patch100 -p1 -b .name-sensitive
    247. %patch101 -p1 -b .overread
    248. %patch102 -p1 -b .large-dh
    249. %patch103 -p1 -b .gen-timing
    250. %patch104 -p1 -b .asn1-recursive
    251. %patch105 -p1 -b .rohnp-fix
    252. %patch107 -p1 -b .ecc-ladder
    253. %patch108 -p1 -b .dsa-signing
    254. %patch109 -p1 -b .padding-oracle
    255. %patch110 -p1 -b .one-and-done
    256. %patch111 -p1 -b .9-lives
    258. sed -i 's/SHLIB_VERSION_NUMBER "1.0.0"/SHLIB_VERSION_NUMBER "%{version}"/' crypto/opensslv.h
    260. # Modify the various perl scripts to reference perl in the right location.
    261. perl util/perlpath.pl `dirname %{__perl}`
    263. # Generate a table with the compile settings for my perusal.
    264. touch Makefile
    265. make TABLE PERL=%{__perl}
    267. %build
    268. # Figure out which flags we want to use.
    269. # default
    270. sslarch=%{_os}-%{_target_cpu}
    271. %ifarch %ix86
    272. sslarch=linux-elf
    273. if ! echo %{_target} | grep -q i686 ; then
    274.     sslflags="no-asm 386"
    275. fi
    276. %endif
    277. %ifarch x86_64
    278. sslflags=enable-ec_nistp_64_gcc_128
    279. %endif
    280. %ifarch sparcv9
    281. sslarch=linux-sparcv9
    282. sslflags=no-asm
    283. %endif
    284. %ifarch sparc64
    285. sslarch=linux64-sparcv9
    286. sslflags=no-asm
    287. %endif
    288. %ifarch alpha alphaev56 alphaev6 alphaev67
    289. sslarch=linux-alpha-gcc
    290. %endif
    291. %ifarch s390 sh3eb sh4eb
    292. sslarch="linux-generic32 -DB_ENDIAN"
    293. %endif
    294. %ifarch s390x
    295. sslarch="linux64-s390x"
    296. %endif
    297. %ifarch %{arm}
    298. sslarch=linux-armv4
    299. %endif
    300. %ifarch aarch64
    301. sslarch=linux-aarch64
    302. sslflags=enable-ec_nistp_64_gcc_128
    303. %endif
    304. %ifarch sh3 sh4
    305. sslarch=linux-generic32
    306. %endif
    307. %ifarch ppc64 ppc64p7
    308. sslarch=linux-ppc64
    309. %endif
    310. %ifarch ppc64le
    311. sslarch="linux-ppc64le"
    312. sslflags=enable-ec_nistp_64_gcc_128
    313. %endif
    314. %ifarch mips mipsel
    315. sslarch="linux-mips32 -mips32r2"
    316. %endif
    317. %ifarch mips64 mips64el
    318. sslarch="linux64-mips64 -mips64r2"
    319. %endif
    320. %ifarch mips64el
    321. sslflags=enable-ec_nistp_64_gcc_128
    322. %endif
    323. %ifarch riscv64
    324. sslarch=linux-generic64
    325. %endif
    327. # ia64, x86_64, ppc are OK by default
    328. # Configure the build tree.  Override OpenSSL defaults with known-good defaults
    329. # usable on all platforms.  The Configure script already knows to use -fPIC and
    330. # RPM_OPT_FLAGS, so we can skip specifiying them here.
    331. ./Configure \
    332.     --prefix=%{_prefix} --openssldir=%{_sysconfdir}/pki/tls ${sslflags} \
    333.     zlib sctp enable-camellia enable-seed enable-tlsext enable-rfc3779 \
    334.     enable-cms enable-md2 enable-rc5 \
    335.     no-mdc2 no-ec2m no-gost no-srp \
    336.     --with-krb5-flavor=MIT --enginesdir=%{_libdir}/openssl/engines \
    337.     --with-krb5-dir=/usr shared  ${sslarch} %{?!nofips:fips}
    339. # Add -Wa,--noexecstack here so that libcrypto's assembler modules will be
    340. # marked as not requiring an executable stack.
    341. # Also add -DPURIFY to make using valgrind with openssl easier as we do not
    342. # want to depend on the uninitialized memory as a source of entropy anyway.
    343. RPM_OPT_FLAGS="$RPM_OPT_FLAGS -Wa,--noexecstack -DPURIFY"
    344. make depend
    345. make all
    347. # Generate hashes for the included certs.
    348. make rehash
    350. # Overwrite FIPS README and copy README.legacy-settings
    351. cp -f %{SOURCE5} %{SOURCE11} .
    353. # Clean up the .pc files
    354. for i in libcrypto.pc libssl.pc openssl.pc ; do
    355.   sed -i '/^Libs.private:/{s/-L[^ ]* //;s/-Wl[^ ]* //}' $i
    356. done
    358. %check
    359. # Verify that what was compiled actually works.
    361. # We must revert patch33 before tests otherwise they will fail
    362. patch -p1 -R < %{PATCH33}
    364. LD_LIBRARY_PATH=`pwd`${LD_LIBRARY_PATH:+:${LD_LIBRARY_PATH}}
    365. export LD_LIBRARY_PATH
    366. OPENSSL_ENABLE_MD5_VERIFY=
    367. export OPENSSL_ENABLE_MD5_VERIFY
    368. make -C test apps tests
    369. %{__cc} -o openssl-thread-test \
    370.     `krb5-config --cflags` \
    371.     -I./include \
    372.     $RPM_OPT_FLAGS \
    373.     %{SOURCE8} \
    374.     -L. \
    375.     -lssl -lcrypto \
    376.     `krb5-config --libs` \
    377.     -lpthread -lz -ldl
    378. ./openssl-thread-test --threads %{thread_test_threads}
    380. # Add generation of HMAC checksum of the final stripped library
    381. %define __spec_install_post \
    382.     %{?__debug_package:%{__debug_install_post}} \
    383.     %{__arch_install_post} \
    384.     %{__os_install_post} \
    385.     crypto/fips/fips_standalone_hmac $RPM_BUILD_ROOT%{_libdir}/libcrypto.so.%{version} >$RPM_BUILD_ROOT%{_libdir}/.libcrypto.so.%{version}.hmac \
    386.     ln -sf .libcrypto.so.%{version}.hmac $RPM_BUILD_ROOT%{_libdir}/.libcrypto.so.%{soversion}.hmac \
    387.     crypto/fips/fips_standalone_hmac $RPM_BUILD_ROOT%{_libdir}/libssl.so.%{version} >$RPM_BUILD_ROOT%{_libdir}/.libssl.so.%{version}.hmac \
    388.     ln -sf .libssl.so.%{version}.hmac $RPM_BUILD_ROOT%{_libdir}/.libssl.so.%{soversion}.hmac \
    389. %{nil}
    391. %define __provides_exclude_from %{_libdir}/openssl
    393. %install
    394. [ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT
    395. # Install OpenSSL.
    396. install -d $RPM_BUILD_ROOT{%{_bindir},%{_includedir},%{_libdir},%{_mandir},%{_libdir}/openssl}
    397. make INSTALL_PREFIX=$RPM_BUILD_ROOT install
    398. make INSTALL_PREFIX=$RPM_BUILD_ROOT install_docs
    399. mv $RPM_BUILD_ROOT%{_libdir}/engines $RPM_BUILD_ROOT%{_libdir}/openssl
    400. mv $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/man/* $RPM_BUILD_ROOT%{_mandir}/
    401. rmdir $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/man
    402. rename so.%{soversion} so.%{version} $RPM_BUILD_ROOT%{_libdir}/*.so.%{soversion}
    403. mkdir $RPM_BUILD_ROOT/%{_lib}
    404. for lib in $RPM_BUILD_ROOT%{_libdir}/*.so.%{version} ; do
    405.     chmod 755 ${lib}
    406.     ln -s -f `basename ${lib}` $RPM_BUILD_ROOT%{_libdir}/`basename ${lib} .%{version}`
    407.     ln -s -f `basename ${lib}` $RPM_BUILD_ROOT%{_libdir}/`basename ${lib} .%{version}`.%{soversion}
    408. done
    410. # Install a makefile for generating keys and self-signed certs, and a script
    411. # for generating them on the fly.
    412. mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/certs
    413. install -m644 %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/certs/Makefile
    414. install -m755 %{SOURCE6} $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/certs/make-dummy-cert
    415. install -m755 %{SOURCE7} $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/certs/renew-dummy-cert
    417. # Make sure we actually include the headers we built against.
    418. for header in $RPM_BUILD_ROOT%{_includedir}/openssl/* ; do
    419.     if [ -f ${header} -a -f include/openssl/$(basename ${header}) ] ; then
    420.         install -m644 include/openssl/`basename ${header}` ${header}
    421.     fi
    422. done
    424. # Rename man pages so that they don't conflict with other system man pages.
    425. pushd $RPM_BUILD_ROOT%{_mandir}
    426. ln -s -f config.5 man5/openssl.cnf.5
    427. for manpage in man*/* ; do
    428.     if [ -L ${manpage} ]; then
    429.         TARGET=`ls -l ${manpage} | awk '{ print $NF }'`
    430.         ln -snf ${TARGET}ssl ${manpage}ssl
    431.         rm -f ${manpage}
    432.     else
    433.         mv ${manpage} ${manpage}ssl
    434.     fi
    435. done
    436. for conflict in passwd rand ; do
    437.     rename ${conflict} ssl${conflict} man*/${conflict}*
    438. done
    439. popd
    441. # Pick a CA script.
    442. pushd  $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/misc
    443. mv CA.sh CA
    444. popd
    446. mkdir -m755 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA
    447. mkdir -m700 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA/private
    448. mkdir -m755 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA/certs
    449. mkdir -m755 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA/crl
    450. mkdir -m755 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA/newcerts
    452. # Ensure the openssl.cnf timestamp is identical across builds to avoid
    453. # mulitlib conflicts and unnecessary renames on upgrade
    454. touch -r %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/openssl.cnf
    456. # Determine which arch opensslconf.h is going to try to #include.
    457. basearch=%{_arch}
    458. %ifarch %{ix86}
    459. basearch=i386
    460. %endif
    461. %ifarch sparcv9
    462. basearch=sparc
    463. %endif
    464. %ifarch sparc64
    465. basearch=sparc64
    466. %endif
    468. %ifarch %{multilib_arches}
    469. # Do an opensslconf.h switcheroo to avoid file conflicts on systems where you
    470. # can have both a 32- and 64-bit version of the library, and they each need
    471. # their own correct-but-different versions of opensslconf.h to be usable.
    472. install -m644 %{SOURCE10} \
    473.     $RPM_BUILD_ROOT/%{_prefix}/include/openssl/opensslconf-${basearch}.h
    474. cat $RPM_BUILD_ROOT/%{_prefix}/include/openssl/opensslconf.h >> \
    475.     $RPM_BUILD_ROOT/%{_prefix}/include/openssl/opensslconf-${basearch}.h
    476. install -m644 %{SOURCE9} \
    477.     $RPM_BUILD_ROOT/%{_prefix}/include/openssl/opensslconf.h
    478. %endif
    480. # Remove unused files from upstream fips support
    481. rm -rf $RPM_BUILD_ROOT/%{_bindir}/openssl_fips_fingerprint
    482. rm -rf $RPM_BUILD_ROOT/%{_libdir}/fips_premain.*
    483. rm -rf $RPM_BUILD_ROOT/%{_libdir}/fipscanister.*
    485. %clean
    486. [ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT
    488. %files
    489. %defattr(-,root,root)
    490. %{!?_licensedir:%global license %%doc}
    491. %license LICENSE
    492. %doc FAQ NEWS README
    493. %doc README.FIPS
    494. %doc README.legacy-settings
    495. %{_sysconfdir}/pki/tls/certs/make-dummy-cert
    496. %{_sysconfdir}/pki/tls/certs/renew-dummy-cert
    497. %{_sysconfdir}/pki/tls/certs/Makefile
    498. %{_sysconfdir}/pki/tls/misc/CA
    499. %dir %{_sysconfdir}/pki/CA
    500. %dir %{_sysconfdir}/pki/CA/private
    501. %dir %{_sysconfdir}/pki/CA/certs
    502. %dir %{_sysconfdir}/pki/CA/crl
    503. %dir %{_sysconfdir}/pki/CA/newcerts
    504. %{_sysconfdir}/pki/tls/misc/c_*
    505. %attr(0755,root,root) %{_bindir}/openssl
    506. %attr(0644,root,root) %{_mandir}/man1*/*
    507. %exclude %{_mandir}/man1*/*.pl*
    508. %exclude %{_mandir}/man1*/c_rehash*
    509. %exclude %{_mandir}/man1*/tsget*
    510. %attr(0644,root,root) %{_mandir}/man5*/*
    511. %attr(0644,root,root) %{_mandir}/man7*/*
    513. %files libs
    514. %defattr(-,root,root)
    515. %{!?_licensedir:%global license %%doc}
    516. %license LICENSE
    517. %dir %{_sysconfdir}/pki/tls
    518. %dir %{_sysconfdir}/pki/tls/certs
    519. %dir %{_sysconfdir}/pki/tls/misc
    520. %dir %{_sysconfdir}/pki/tls/private
    521. %config(noreplace) %{_sysconfdir}/pki/tls/openssl.cnf
    522. %attr(0755,root,root) %{_libdir}/libcrypto.so.%{version}
    523. %attr(0755,root,root) %{_libdir}/libcrypto.so.%{soversion}
    524. %attr(0755,root,root) %{_libdir}/libssl.so.%{version}
    525. %attr(0755,root,root) %{_libdir}/libssl.so.%{soversion}
    526. %attr(0644,root,root) %{_libdir}/.libcrypto.so.*.hmac
    527. %attr(0644,root,root) %{_libdir}/.libssl.so.*.hmac
    528. %attr(0755,root,root) %{_libdir}/openssl
    530. %files devel
    531. %defattr(-,root,root)
    532. %doc doc/c-indentation.el doc/openssl.txt CHANGES
    533. %{_prefix}/include/openssl
    534. %attr(0755,root,root) %{_libdir}/*.so
    535. %attr(0644,root,root) %{_mandir}/man3*/*
    536. %attr(0644,root,root) %{_libdir}/pkgconfig/*.pc
    538. %files static
    539. %defattr(-,root,root)
    540. %attr(0644,root,root) %{_libdir}/*.a
    542. %files perl
    543. %defattr(-,root,root)
    544. %attr(0755,root,root) %{_bindir}/c_rehash
    545. %attr(0644,root,root) %{_mandir}/man1*/*.pl*
    546. %attr(0644,root,root) %{_mandir}/man1*/c_rehash*
    547. %attr(0644,root,root) %{_mandir}/man1*/tsget*
    548. %{_sysconfdir}/pki/tls/misc/*.pl
    549. %{_sysconfdir}/pki/tls/misc/tsget
    551. %post libs -p /sbin/ldconfig
    553. %postun libs -p /sbin/ldconfig
    555. %changelog
    556. * Tue Apr  9 2019 Tomáš Mráz <tmraz@redhat.com> 1.0.2k-19
    557. - close the RSA decryption 9 lives of Bleichenbacher cat
    558.   timing side channel (#1649568)
    560. * Fri Apr  5 2019 Tomáš Mráz <tmraz@redhat.com> 1.0.2k-18
    561. - fix CVE-2018-0734 - DSA signature local timing side channel
    562. - fix CVE-2019-1559 - 0-byte record padding oracle
    563. - close the RSA decryption One & done EM side channel (#1619558)
    565. * Wed Feb  6 2019 Tomáš Mráz <tmraz@redhat.com> 1.0.2k-17
    566. - use SHA-256 in FIPS RSA pairwise key check
    567. - fix CVE-2018-5407 (and CVE-2018-0735) - EC signature local
    568.   timing side-channel key extraction
    570. * Tue Aug 14 2018 Tomáš Mráz <tmraz@redhat.com> 1.0.2k-16
    571. - fix CVE-2018-0495 - ROHNP - Key Extraction Side Channel on DSA, ECDSA
    572. - fix incorrect error message on FIPS DSA parameter generation (#1603597)
    574. * Tue Jun 19 2018 Tomáš Mráz <tmraz@redhat.com> 1.0.2k-14
    575. - ppc64le is not multilib architecture (#1585004)
    577. * Mon Jun 18 2018 Tomáš Mráz <tmraz@redhat.com> 1.0.2k-13
    578. - add S390x assembler updates
    579. - make CA name list comparison function case sensitive (#1548401)
    580. - fix CVE-2017-3735 - possible one byte overread with X.509 IPAdressFamily
    581. - fix CVE-2018-0732 - large prime DH DoS of TLS client
    582. - fix CVE-2018-0737 - RSA key generation cache timing vulnerability
    583. - fix CVE-2018-0739 - stack overflow parsing recursive ASN.1 structure
    585. * Wed Dec 13 2017 Tomáš Mráz <tmraz@redhat.com> 1.0.2k-12
    586. - fix CVE-2017-3737 - incorrect handling of fatal error state
    587. - fix CVE-2017-3738 - AVX2 Montgomery multiplication bug with 1024 bit modulus
    589. * Wed Dec  6 2017 Tomáš Mráz <tmraz@redhat.com> 1.0.2k-11
    590. - fix deadlock in RNG in the FIPS mode in mariadb
    592. * Tue Nov  7 2017 Tomáš Mráz <tmraz@redhat.com> 1.0.2k-9
    593. - fix CVE-2017-3736 - carry propagation bug in Montgomery multiplication
    595. * Wed May 17 2017 Tomáš Mráz <tmraz@redhat.com> 1.0.2k-8
    596. - fix regression in openssl req -x509 command (#1450015)
    598. * Thu Apr 13 2017 Tomáš Mráz <tmraz@redhat.com> 1.0.2k-7
    599. - handle incorrect size gracefully in aes_p8_cbc_encrypt()
    601. * Mon Mar 27 2017 Tomáš Mráz <tmraz@redhat.com> 1.0.2k-6
    602. - allow long client hellos to be received by server
    604. * Mon Mar 27 2017 Tomáš Mráz <tmraz@redhat.com> 1.0.2k-5
    605. - fix CPU features detection on new AMD processors
    607. * Thu Mar  9 2017 Tomáš Mráz <tmraz@redhat.com> 1.0.2k-4
    608. - add support for additional STARTTLS protocols to s_client
    609.   original backported patch by Robert Scheck (#1396209)
    611. * Wed Mar  1 2017 Tomáš Mráz <tmraz@redhat.com> 1.0.2k-3
    612. - properly document the SSLv2 support removal
    614. * Mon Feb 20 2017 Tomáš Mráz <tmraz@redhat.com> 1.0.2k-2
    615. - add PPC assembler updates
    617. * Tue Feb  7 2017 Tomáš Mráz <tmraz@redhat.com> 1.0.2k-1
    618. - minor upstream release 1.0.2k fixing security issues
    620. * Tue Jan 10 2017 Tomáš Mráz <tmraz@redhat.com> 1.0.2j-2
    621. - deprecate and disable verification of insecure hash algorithms
    622. - add support for /etc/pki/tls/legacy-settings also for minimum DH length
    623.   accepted by SSL client
    624. - compare the encrypt and tweak key in XTS as required by FIPS
    626. * Thu Jan  5 2017 Tomáš Mráz <tmraz@redhat.com> 1.0.2j-1
    627. - rebase to latest upstream release from the 1.0.2 branch, ABI compatible
    629. * Thu Sep 22 2016 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-60
    630. - fix CVE-2016-2177 - possible integer overflow
    631. - fix CVE-2016-2178 - non-constant time DSA operations
    632. - fix CVE-2016-2179 - further DoS issues in DTLS
    633. - fix CVE-2016-2180 - OOB read in TS_OBJ_print_bio()
    634. - fix CVE-2016-2181 - DTLS1 replay protection and unprocessed records issue
    635. - fix CVE-2016-2182 - possible buffer overflow in BN_bn2dec()
    636. - fix CVE-2016-6302 - insufficient TLS session ticket HMAC length check
    637. - fix CVE-2016-6304 - unbound memory growth with OCSP status request
    638. - fix CVE-2016-6306 - certificate message OOB reads
    639. - mitigate CVE-2016-2183 - degrade all 64bit block ciphers and RC4 to
    640.   112 bit effective strength
    642. * Tue Jun 21 2016 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-58
    643. - replace expired testing certificates
    645. * Fri Apr 29 2016 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-57
    646. - fix CVE-2016-2105 - possible overflow in base64 encoding
    647. - fix CVE-2016-2106 - possible overflow in EVP_EncryptUpdate()
    648. - fix CVE-2016-2107 - padding oracle in stitched AES-NI CBC-MAC
    649. - fix CVE-2016-2108 - memory corruption in ASN.1 encoder
    650. - fix CVE-2016-2109 - possible DoS when reading ASN.1 data from BIO
    652. * Thu Apr  7 2016 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-56
    653. - fix 1-byte memory leak in pkcs12 parse (#1312112)
    654. - document some options of the speed command (#1312110)
    655. - fix high-precision timestamps in timestamping authority
    656. - enable SCTP support in DTLS 
    657. - use correct digest when exporting keying material in TLS1.2 (#1289620)
    658. - fix CVE-2016-0799 - memory issues in BIO_printf
    659. - add support for setting Kerberos service and keytab in
    660.   s_server and s_client
    662. * Wed Feb 24 2016 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-55
    663. - fix CVE-2016-0702 - side channel attack on modular exponentiation
    664. - fix CVE-2016-0705 - double-free in DSA private key parsing
    665. - fix CVE-2016-0797 - heap corruption in BN_hex2bn and BN_dec2bn
    667. * Tue Feb 16 2016 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-54
    668. - fix CVE-2015-3197 - SSLv2 ciphersuite enforcement
    669. - disable SSLv2 in the generic TLS method
    671. * Mon Dec 21 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-53
    672. - fix CVE-2015-7575 - disallow use of MD5 in TLS1.2
    674. * Fri Dec  4 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-52
    675. - fix CVE-2015-3194 - certificate verify crash with missing PSS parameter
    676. - fix CVE-2015-3195 - X509_ATTRIBUTE memory leak
    677. - fix CVE-2015-3196 - race condition when handling PSK identity hint
    679. * Tue Jun 23 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-51
    680. - fix the CVE-2015-1791 fix (broken server side renegotiation)
    682. * Thu Jun 11 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-50
    683. - improved fix for CVE-2015-1791
    684. - add missing parts of CVE-2015-0209 fix for corectness although unexploitable
    686. * Tue Jun  9 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-49
    687. - fix CVE-2014-8176 - invalid free in DTLS buffering code
    688. - fix CVE-2015-1789 - out-of-bounds read in X509_cmp_time
    689. - fix CVE-2015-1790 - PKCS7 crash with missing EncryptedContent
    690. - fix CVE-2015-1791 - race condition handling NewSessionTicket
    691. - fix CVE-2015-1792 - CMS verify infinite loop with unknown hash function
    693. * Wed Jun  3 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-48
    694. - fix CVE-2015-3216 - regression in RAND locking that can cause segfaults on
    695.   read in multithreaded applications
    697. * Mon May 25 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-47
    698. - fix CVE-2015-4000 - prevent the logjam attack on client - restrict
    699.   the DH key size to at least 768 bits (limit will be increased in future)
    701. * Wed Mar 25 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-46
    702. - drop the AES-GCM restriction of 2^32 operations because the IV is
    703.   always 96 bits (32 bit fixed field + 64 bit invocation field)
    705. * Thu Mar 19 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-45
    706. - update fix for CVE-2015-0287 to what was released upstream
    708. * Wed Mar 18 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-44
    709. - fix CVE-2015-0209 - potential use after free in d2i_ECPrivateKey()
    710. - fix CVE-2015-0286 - improper handling of ASN.1 boolean comparison
    711. - fix CVE-2015-0287 - ASN.1 structure reuse decoding memory corruption
    712. - fix CVE-2015-0288 - X509_to_X509_REQ NULL pointer dereference
    713. - fix CVE-2015-0289 - NULL dereference decoding invalid PKCS#7 data
    714. - fix CVE-2015-0292 - integer underflow in base64 decoder
    715. - fix CVE-2015-0293 - triggerable assert in SSLv2 server
    717. * Mon Mar 16 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-43
    718. - fix broken error detection when unwrapping unpadded key
    720. * Mon Mar  2 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-42.1
    721. - fix the RFC 5649 for key material that does not need padding
    723. * Thu Jan 15 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-42
    724. - test in the non-FIPS RSA keygen for minimal distance of p and q
    725.   similarly to the FIPS RSA keygen
    727. * Tue Jan 13 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-41
    728. - fix CVE-2014-3570 - incorrect computation in BN_sqr()
    729. - fix CVE-2014-3571 - possible crash in dtls1_get_record()
    730. - fix CVE-2014-3572 - possible downgrade of ECDH ciphersuite to non-PFS state
    731. - fix CVE-2014-8275 - various certificate fingerprint issues
    732. - fix CVE-2015-0204 - remove support for RSA ephemeral keys for non-export
    733.   ciphersuites and on server
    734. - fix CVE-2015-0205 - do not allow unauthenticated client DH certificate
    735. - fix CVE-2015-0206 - possible memory leak when buffering DTLS records
    737. * Tue Oct 21 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-40
    738. - use FIPS approved method for computation of d in RSA
    739. - copy digest algorithm when handling SNI context switch
    741. * Wed Oct 15 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-39
    742. - fix CVE-2014-3567 - memory leak when handling session tickets
    743. - fix CVE-2014-3513 - memory leak in srtp support
    744. - add support for fallback SCSV to partially mitigate CVE-2014-3566
    745.   (padding attack on SSL3)
    747. * Wed Sep 24 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-38
    748. - do FIPS algorithm selftest before the integrity check
    750. * Thu Sep 18 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-37
    751. - add support for RFC 5649 (#1119738)
    752. - do not pass the FIPS integrity check if the .hmac files are empty (#1128849)
    753. - add ECC TLS extensions to DTLS (#1119803)
    754. - do not send ECC ciphersuites in SSLv2 client hello (#1090955)
    755. - properly propagate encryption failure in BIO_f_cipher (#1072439)
    756. - fix CVE-2014-0224 fix that broke EAP-FAST session resumption support
    757. - improve documentation of ciphersuites - patch by Hubert Kario (#1108026)
    758. - use case insensitive comparison for servername in s_server (#1081163)
    759. - add support for automatic ECDH curve selection on server (#1080128)
    760. - FIPS mode: make the limitations on DSA, DH, and RSA keygen
    761.   length enforced only if OPENSSL_ENFORCE_MODULUS_BITS environment
    762.   variable is set
    764. * Wed Aug 13 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-36
    765. - add support for ppc64le architecture
    766. - add Power 8 optimalizations
    768. * Fri Aug  8 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-35
    769. - fix CVE-2014-3505 - doublefree in DTLS packet processing
    770. - fix CVE-2014-3506 - avoid memory exhaustion in DTLS
    771. - fix CVE-2014-3507 - avoid memory leak in DTLS
    772. - fix CVE-2014-3508 - fix OID handling to avoid information leak
    773. - fix CVE-2014-3509 - fix race condition when parsing server hello
    774. - fix CVE-2014-3510 - fix DoS in anonymous (EC)DH handling in DTLS
    775. - fix CVE-2014-3511 - disallow protocol downgrade via fragmentation
    777. * Tue Jun  3 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-34.3
    778. - fix CVE-2010-5298 - possible use of memory after free
    779. - fix CVE-2014-0195 - buffer overflow via invalid DTLS fragment
    780. - fix CVE-2014-0198 - possible NULL pointer dereference
    781. - fix CVE-2014-0221 - DoS from invalid DTLS handshake packet
    782. - fix CVE-2014-0224 - SSL/TLS MITM vulnerability
    783. - fix CVE-2014-3470 - client-side DoS when using anonymous ECDH
    785. * Tue Apr  8 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-34
    786. - fix CVE-2014-0160 - information disclosure in TLS heartbeat extension
    788. * Fri Feb 14 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-33
    789. - use the key length from configuration file if req -newkey rsa is invoked
    791. * Thu Feb 13 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-32
    792. - avoid unnecessary reseeding in BN_rand in the FIPS mode
    794. * Wed Feb 12 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-31
    795. - print ephemeral key size negotiated in TLS handshake (#1057715)
    796. - add DH_compute_key_padded needed for FIPS CAVS testing
    797. - make expiration and key length changeable by DAYS and KEYLEN
    798.   variables in the certificate Makefile (#1058108)
    799. - change default hash to sha256 (#1062325)
    800. - lower the actual 3des strength so it is sorted behind aes128 (#1056616)
    802. * Fri Jan 24 2014 Daniel Mach <dmach@redhat.com> - 1:1.0.1e-30
    803. - Mass rebuild 2014-01-24
    805. * Wed Jan 15 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-29
    806. - rebuild with -O3 on ppc64 architecture
    808. * Tue Jan  7 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-28
    809. - fix CVE-2013-4353 - Invalid TLS handshake crash
    810. - fix CVE-2013-6450 - possible MiTM attack on DTLS1
    812. * Fri Dec 27 2013 Daniel Mach <dmach@redhat.com> - 1:1.0.1e-27
    813. - Mass rebuild 2013-12-27
    815. * Fri Dec 20 2013 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-26
    816. - fix CVE-2013-6449 - crash when version in SSL structure is incorrect
    817. - drop weak ciphers from the default TLS ciphersuite list
    818. - add back some symbols that were dropped with update to 1.0.1 branch
    819. - more FIPS validation requirement changes
    821. * Tue Nov 19 2013 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-25
    822. - fix locking and reseeding problems with FIPS drbg
    824. * Fri Nov 15 2013 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-24
    825. - additional changes required for FIPS validation
    826. - disable verification of certificate, CRL, and OCSP signatures
    827.   using MD5 if OPENSSL_ENABLE_MD5_VERIFY environment variable
    828.   is not set
    830. * Fri Nov  8 2013 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-23
    831. - add back support for secp521r1 EC curve
    832. - add aarch64 to Configure (#969692)
    834. * Thu Oct 24 2013 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-22
    835. - do not advertise ECC curves we do not support (#1022493)
    837. * Fri Oct  4 2013 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-21
    838. - make DTLS1 work in FIPS mode
    839. - avoid RSA and DSA 512 bits and Whirlpool in 'openssl speed' in FIPS mode
    840. - drop the -fips subpackage, installation of dracut-fips marks that the FIPS
    841.   module is installed
    842. - avoid dlopening libssl.so from libcrypto
    843. - fix small memory leak in FIPS aes selftest
    844. - fix segfault in openssl speed hmac in the FIPS mode
    846. * Thu Sep 12 2013 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-20
    847. - document the nextprotoneg option in manual pages
    848.   original patch by Hubert Kario
    849. - try to avoid some races when updating the -fips subpackage
    851. * Mon Sep  2 2013 Tomas Mraz <tmraz@redhat.com> 1.0.1e-19
    852. - use version-release in .hmac suffix to avoid overwrite
    853.   during upgrade
    855. * Thu Aug 29 2013 Tomas Mraz <tmraz@redhat.com> 1.0.1e-18
    856. - always perform the FIPS selftests in library constructor
    857.   if FIPS module is installed
    859. * Tue Aug 27 2013 Tomas Mraz <tmraz@redhat.com> 1.0.1e-16
    860. - add -fips subpackage that contains the FIPS module files
    862. * Fri Aug 16 2013 Tomas Mraz <tmraz@redhat.com> 1.0.1e-15
    863. - fix use of rdrand if available
    864. - more commits cherry picked from upstream
    865. - documentation fixes
    867. * Fri Jul 26 2013 Tomas Mraz <tmraz@redhat.com> 1.0.1e-14
    868. - additional manual page fix
    869. - use symbol versioning also for the textual version
    871. * Thu Jul 25 2013 Tomas Mraz <tmraz@redhat.com> 1.0.1e-13
    872. - additional manual page fixes
    873. - cleanup speed command output for ECDH ECDSA
    875. * Fri Jul 19 2013 Tomas Mraz <tmraz@redhat.com> 1.0.1e-12
    876. - use _prefix macro
    878. * Thu Jul 11 2013 Tomas Mraz <tmraz@redhat.com> 1.0.1e-11
    879. - add openssl.cnf.5 manpage symlink to config.5
    881. * Wed Jul 10 2013 Tomas Mraz <tmraz@redhat.com> 1.0.1e-10
    882. - add relro linking flag
    884. * Wed Jul 10 2013 Tomas Mraz <tmraz@redhat.com> 1.0.1e-9
    885. - add support for the -trusted_first option for certificate chain verification
    887. * Fri May 10 2013 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-8
    888. - disable GOST engine
    890. * Thu May  9 2013 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-7
    891. - add symbol version for ECC functions
    893. * Fri May  3 2013 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-6
    894. - update the FIPS selftests to use 256 bit curves
    896. * Tue Apr 30 2013 Tomas Mraz <tmraz@redhat.com> 1.0.1e-5
    897. - enabled NIST Suite B ECC curves and algorithms
    899. * Mon Mar 18 2013 Tomas Mraz <tmraz@redhat.com> 1.0.1e-4
    900. - fix random bad record mac errors (#918981)
    902. * Tue Feb 19 2013 Tomas Mraz <tmraz@redhat.com> 1.0.1e-3
    903. - fix up the SHLIB_VERSION_NUMBER
    905. * Tue Feb 19 2013 Tomas Mraz <tmraz@redhat.com> 1.0.1e-2
    906. - disable ZLIB loading by default (due to CRIME attack)
    908. * Tue Feb 19 2013 Tomas Mraz <tmraz@redhat.com> 1.0.1e-1
    909. - new upstream version
    911. * Wed Jan 30 2013 Tomas Mraz <tmraz@redhat.com> 1.0.1c-12
    912. - more fixes from upstream
    913. - fix errors in manual causing build failure (#904777)
    915. * Fri Dec 21 2012 Tomas Mraz <tmraz@redhat.com> 1.0.1c-11
    916. - add script for renewal of a self-signed cert by Philip Prindeville (#871566)
    917. - allow X509_issuer_and_serial_hash() produce correct result in
    918.   the FIPS mode (#881336)
    920. * Thu Dec  6 2012 Tomas Mraz <tmraz@redhat.com> 1.0.1c-10
    921. - do not load default verify paths if CApath or CAfile specified (#884305)
    923. * Tue Nov 20 2012 Tomas Mraz <tmraz@redhat.com> 1.0.1c-9
    924. - more fixes from upstream CVS
    925. - fix DSA key pairwise check (#878597)
    927. * Thu Nov 15 2012 Tomas Mraz <tmraz@redhat.com> 1.0.1c-8
    928. - use 1024 bit DH parameters in s_server as 512 bit is not allowed
    929.   in FIPS mode and it is quite weak anyway
    931. * Mon Sep 10 2012 Tomas Mraz <tmraz@redhat.com> 1.0.1c-7
    932. - add missing initialization of str in aes_ccm_init_key (#853963)
    933. - add important patches from upstream CVS
    934. - use the secure_getenv() with new glibc
    936. * Fri Jul 20 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1:1.0.1c-6
    937. - Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
    939. * Fri Jul 13 2012 Tomas Mraz <tmraz@redhat.com> 1.0.1c-5
    940. - use __getenv_secure() instead of __libc_enable_secure
    942. * Fri Jul 13 2012 Tomas Mraz <tmraz@redhat.com> 1.0.1c-4
    943. - do not move libcrypto to /lib
    944. - do not use environment variables if __libc_enable_secure is on
    945. - fix strict aliasing problems in modes
    947. * Thu Jul 12 2012 Tomas Mraz <tmraz@redhat.com> 1.0.1c-3
    948. - fix DSA key generation in FIPS mode (#833866)
    949. - allow duplicate FIPS_mode_set(1)
    950. - enable build on ppc64 subarch (#834652)
    952. * Wed Jul 11 2012 Tomas Mraz <tmraz@redhat.com> 1.0.1c-2
    953. - fix s_server with new glibc when no global IPv6 address (#839031)
    954. - make it build with new Perl
    956. * Tue May 15 2012 Tomas Mraz <tmraz@redhat.com> 1.0.1c-1
    957. - new upstream version
    959. * Thu Apr 26 2012 Tomas Mraz <tmraz@redhat.com> 1.0.1b-1
    960. - new upstream version
    962. * Fri Apr 20 2012 Tomas Mraz <tmraz@redhat.com> 1.0.1a-1
    963. - new upstream version fixing CVE-2012-2110
    965. * Wed Apr 11 2012 Tomas Mraz <tmraz@redhat.com> 1.0.1-3
    966. - add Kerberos 5 libraries to pkgconfig for static linking (#807050)
    968. * Thu Apr  5 2012 Tomas Mraz <tmraz@redhat.com> 1.0.1-2
    969. - backports from upstream CVS
    970. - fix segfault when /dev/urandom is not available (#809586)
    972. * Wed Mar 14 2012 Tomas Mraz <tmraz@redhat.com> 1.0.1-1
    973. - new upstream release
    975. * Mon Mar  5 2012 Tomas Mraz <tmraz@redhat.com> 1.0.1-0.3.beta3
    976. - add obsoletes to assist multilib updates (#799636)
    978. * Wed Feb 29 2012 Tomas Mraz <tmraz@redhat.com> 1.0.1-0.2.beta3
    979. - epoch bumped to 1 due to revert to 1.0.0g on Fedora 17
    980. - new upstream release from the 1.0.1 branch
    981. - fix s390x build (#798411)
    982. - versioning for the SSLeay symbol (#794950)
    983. - add -DPURIFY to build flags (#797323)
    984. - filter engine provides
    985. - split the libraries to a separate -libs package
    986. - add make to requires on the base package (#783446)
    988. * Tue Feb  7 2012 Tomas Mraz <tmraz@redhat.com> 1.0.1-0.1.beta2
    989. - new upstream release from the 1.0.1 branch, ABI compatible
    990. - add documentation for the -no_ign_eof option
    992. * Thu Jan 19 2012 Tomas Mraz <tmraz@redhat.com> 1.0.0g-1
    993. - new upstream release fixing CVE-2012-0050 - DoS regression in
    994.   DTLS support introduced by the previous release (#782795)
    996. * Thu Jan  5 2012 Tomas Mraz <tmraz@redhat.com> 1.0.0f-1
    997. - new upstream release fixing multiple CVEs
    999. * Tue Nov 22 2011 Tomas Mraz <tmraz@redhat.com> 1.0.0e-4
    1000. - move the libraries needed for static linking to Libs.private
    1002. * Thu Nov  3 2011 Tomas Mraz <tmraz@redhat.com> 1.0.0e-3
    1003. - do not use AVX instructions when osxsave bit not set
    1004. - add direct known answer tests for SHA2 algorithms
    1006. * Wed Sep 21 2011 Tomas Mraz <tmraz@redhat.com> 1.0.0e-2
    1007. - fix missing initialization of variable in CHIL engine
    1009. * Wed Sep  7 2011 Tomas Mraz <tmraz@redhat.com> 1.0.0e-1
    1010. - new upstream release fixing CVE-2011-3207 (#736088)
    1012. * Wed Aug 24 2011 Tomas Mraz <tmraz@redhat.com> 1.0.0d-8
    1013. - drop the separate engine for Intel acceleration improvements
    1014.   and merge in the AES-NI, SHA1, and RC4 optimizations
    1015. - add support for OPENSSL_DISABLE_AES_NI environment variable
    1016.   that disables the AES-NI support
    1018. * Tue Jul 26 2011 Tomas Mraz <tmraz@redhat.com> 1.0.0d-7
    1019. - correct openssl cms help output (#636266)
    1020. - more tolerant starttls detection in XMPP protocol (#608239)
    1022. * Wed Jul 20 2011 Tomas Mraz <tmraz@redhat.com> 1.0.0d-6
    1023. - add support for newest Intel acceleration improvements backported
    1024.   from upstream by Intel in form of a separate engine
    1026. * Thu Jun  9 2011 Tomas Mraz <tmraz@redhat.com> 1.0.0d-5
    1027. - allow the AES-NI engine in the FIPS mode
    1029. * Tue May 24 2011 Tomas Mraz <tmraz@redhat.com> 1.0.0d-4
    1030. - add API necessary for CAVS testing of the new DSA parameter generation
    1032. * Thu Apr 28 2011 Tomas Mraz <tmraz@redhat.com> 1.0.0d-3
    1033. - add support for VIA Padlock on 64bit arch from upstream (#617539)
    1034. - do not return bogus values from load_certs (#652286)
    1036. * Tue Apr  5 2011 Tomas Mraz <tmraz@redhat.com> 1.0.0d-2
    1037. - clarify apps help texts for available digest algorithms (#693858)
    1039. * Thu Feb 10 2011 Tomas Mraz <tmraz@redhat.com> 1.0.0d-1
    1040. - new upstream release fixing CVE-2011-0014 (OCSP stapling vulnerability)
    1042. * Tue Feb 08 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.0.0c-4
    1043. - Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
    1045. * Fri Feb  4 2011 Tomas Mraz <tmraz@redhat.com> 1.0.0c-3
    1046. - add -x931 parameter to openssl genrsa command to use the ANSI X9.31
    1047.   key generation method
    1048. - use FIPS-186-3 method for DSA parameter generation
    1049. - add OPENSSL_FIPS_NON_APPROVED_MD5_ALLOW environment variable
    1050.   to allow using MD5 when the system is in the maintenance state
    1051.   even if the /proc fips flag is on
    1052. - make openssl pkcs12 command work by default in the FIPS mode
    1054. * Mon Jan 24 2011 Tomas Mraz <tmraz@redhat.com> 1.0.0c-2
    1055. - listen on ipv6 wildcard in s_server so we accept connections
    1056.   from both ipv4 and ipv6 (#601612)
    1057. - fix openssl speed command so it can be used in the FIPS mode
    1058.   with FIPS allowed ciphers
    1060. * Fri Dec  3 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0c-1
    1061. - new upstream version fixing CVE-2010-4180
    1063. * Tue Nov 23 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0b-3
    1064. - replace the revert for the s390x bignum asm routines with
    1065.   fix from upstream
    1067. * Mon Nov 22 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0b-2
    1068. - revert upstream change in s390x bignum asm routines
    1070. * Tue Nov 16 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0b-1
    1071. - new upstream version fixing CVE-2010-3864 (#649304)
    1073. * Tue Sep  7 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0a-3
    1074. - make SHLIB_VERSION reflect the library suffix
    1076. * Wed Jun 30 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0a-2
    1077. - openssl man page fix (#609484)
    1079. * Fri Jun  4 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0a-1
    1080. - new upstream patch release, fixes CVE-2010-0742 (#598738)
    1081.   and CVE-2010-1633 (#598732)
    1083. * Wed May 19 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0-5
    1084. - pkgconfig files now contain the correct libdir (#593723)
    1086. * Tue May 18 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0-4
    1087. - make CA dir readable - the private keys are in private subdir (#584810)
    1089. * Fri Apr  9 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0-3
    1090. - a few fixes from upstream CVS
    1091. - move libcrypto to /lib (#559953)
    1093. * Tue Apr  6 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0-2
    1094. - set UTC timezone on pod2man run (#578842)
    1095. - make X509_NAME_hash_old work in FIPS mode
    1097. * Tue Mar 30 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0-1
    1098. - update to final 1.0.0 upstream release
    1100. * Tue Feb 16 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.22.beta5
    1101. - make TLS work in the FIPS mode
    1103. * Fri Feb 12 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.21.beta5
    1104. - gracefully handle zero length in assembler implementations of
    1105.   OPENSSL_cleanse (#564029)
    1106. - do not fail in s_server if client hostname not resolvable (#561260)
    1108. * Wed Jan 20 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.20.beta5
    1109. - new upstream release
    1111. * Thu Jan 14 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.19.beta4
    1112. - fix CVE-2009-4355 - leak in applications incorrectly calling
    1113.   CRYPTO_free_all_ex_data() before application exit (#546707)
    1114. - upstream fix for future TLS protocol version handling
    1116. * Wed Jan 13 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.18.beta4
    1117. - add support for Intel AES-NI
    1119. * Thu Jan  7 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.17.beta4
    1120. - upstream fix compression handling on session resumption
    1121. - various null checks and other small fixes from upstream
    1122. - upstream changes for the renegotiation info according to the latest draft
    1124. * Mon Nov 23 2009 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.16.beta4
    1125. - fix non-fips mingw build (patch by Kalev Lember)
    1126. - add IPV6 fix for DTLS
    1128. * Fri Nov 20 2009 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.15.beta4
    1129. - add better error reporting for the unsafe renegotiation
    1131. * Fri Nov 20 2009 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.14.beta4
    1132. - fix build on s390x
    1134. * Wed Nov 18 2009 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.13.beta4
    1135. - disable enforcement of the renegotiation extension on the client (#537962)
    1136. - add fixes from the current upstream snapshot
    1138. * Fri Nov 13 2009 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.12.beta4
    1139. - keep the beta status in version number at 3 so we do not have to rebuild
    1140.   openssh and possibly other dependencies with too strict version check
    1142. * Thu Nov 12 2009 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.11.beta4
    1143. - update to new upstream version, no soname bump needed
    1144. - fix CVE-2009-3555 - note that the fix is bypassed if SSL_OP_ALL is used
    1145.   so the compatibility with unfixed clients is not broken. The
    1146.   protocol extension is also not final.
    1148. * Fri Oct 16 2009 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.10.beta3
    1149. - fix use of freed memory if SSL_CTX_free() is called before
    1150.   SSL_free() (#521342)
    1152. * Thu Oct  8 2009 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.9.beta3
    1153. - fix typo in DTLS1 code (#527015)
    1154. - fix leak in error handling of d2i_SSL_SESSION()
    1156. * Wed Sep 30 2009 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.8.beta3
    1157. - fix RSA and DSA FIPS selftests
    1158. - reenable fixed x86_64 camellia assembler code (#521127)
    1160. * Fri Sep  4 2009 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.7.beta3
    1161. - temporarily disable x86_64 camellia assembler code (#521127)
    1163. * Mon Aug 31 2009 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.6.beta3
    1164. - fix openssl dgst -dss1 (#520152)
    1166. * Wed Aug 26 2009 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.5.beta3
    1167. - drop the compat symlink hacks
    1169. * Sat Aug 22 2009 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.4.beta3
    1170. - constify SSL_CIPHER_description()
    1172. * Fri Aug 21 2009 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.3.beta3
    1173. - fix WWW:Curl:Easy reference in tsget
    1175. * Fri Aug 21 2009 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.2.beta3
    1176. - enable MD-2
    1178. * Thu Aug 20 2009 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.1.beta3
    1179. - update to new major upstream release
    1181. * Sat Jul 25 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.9.8k-7
    1182. - Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
    1184. * Wed Jul 22 2009 Bill Nottingham <notting@redhat.com>
    1185. - do not build special 'optimized' versions for i686, as that's the base
    1186.   arch in Fedora now
    1188. * Tue Jun 30 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8k-6
    1189. - abort if selftests failed and random number generator is polled
    1190. - mention EVP_aes and EVP_sha2xx routines in the manpages
    1191. - add README.FIPS
    1192. - make CA dir absolute path (#445344)
    1193. - change default length for RSA key generation to 2048 (#484101)
    1195. * Thu May 21 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8k-5
    1196. - fix CVE-2009-1377 CVE-2009-1378 CVE-2009-1379
    1197.   (DTLS DoS problems) (#501253, #501254, #501572)
    1199. * Tue Apr 21 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8k-4
    1200. - support compatibility DTLS mode for CISCO AnyConnect (#464629)
    1202. * Fri Apr 17 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8k-3
    1203. - correct the SHLIB_VERSION define
    1205. * Wed Apr 15 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8k-2
    1206. - add support for multiple CRLs with same subject
    1207. - load only dynamic engine support in FIPS mode
    1209. * Wed Mar 25 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8k-1
    1210. - update to new upstream release (minor bug fixes, security
    1211.   fixes and machine code optimizations only)
    1213. * Thu Mar 19 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8j-10
    1214. - move libraries to /usr/lib (#239375)
    1216. * Fri Mar 13 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8j-9
    1217. - add a static subpackage
    1219. * Thu Feb 26 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.9.8j-8
    1220. - Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
    1222. * Mon Feb  2 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8j-7
    1223. - must also verify checksum of libssl.so in the FIPS mode
    1224. - obtain the seed for FIPS rng directly from the kernel device
    1225. - drop the temporary symlinks
    1227. * Mon Jan 26 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8j-6
    1228. - drop the temporary triggerpostun and symlinking in post
    1229. - fix the pkgconfig files and drop the unnecessary buildrequires
    1230.   on pkgconfig as it is a rpmbuild dependency (#481419)
    1232. * Sat Jan 17 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8j-5
    1233. - add temporary triggerpostun to reinstate the symlinks
    1235. * Sat Jan 17 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8j-4
    1236. - no pairwise key tests in non-fips mode (#479817)
    1238. * Fri Jan 16 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8j-3
    1239. - even more robust test for the temporary symlinks
    1241. * Fri Jan 16 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8j-2
    1242. - try to ensure the temporary symlinks exist
    1244. * Thu Jan 15 2009 Tomas Mraz <tmraz@redhat.com> 0.9.8j-1
    1245. - new upstream version with necessary soname bump (#455753)
    1246. - temporarily provide symlink to old soname to make it possible to rebuild
    1247.   the dependent packages in rawhide
    1248. - add eap-fast support (#428181)
    1249. - add possibility to disable zlib by setting
    1250. - add fips mode support for testing purposes
    1251. - do not null dereference on some invalid smime files
    1252. - add buildrequires pkgconfig (#479493)
    1254. * Sun Aug 10 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8g-11
    1255. - do not add tls extensions to server hello for SSLv3 either
    1257. * Mon Jun  2 2008 Joe Orton <jorton@redhat.com> 0.9.8g-10
    1258. - move root CA bundle to ca-certificates package
    1260. * Wed May 28 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8g-9
    1261. - fix CVE-2008-0891 - server name extension crash (#448492)
    1262. - fix CVE-2008-1672 - server key exchange message omit crash (#448495)
    1264. * Tue May 27 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8g-8
    1265. - super-H arch support
    1266. - drop workaround for bug 199604 as it should be fixed in gcc-4.3
    1268. * Mon May 19 2008 Tom "spot" Callaway <tcallawa@redhat.com> 0.9.8g-7
    1269. - sparc handling
    1271. * Mon Mar 10 2008 Joe Orton <jorton@redhat.com> 0.9.8g-6
    1272. - update to new root CA bundle from mozilla.org (r1.45)
    1274. * Wed Feb 20 2008 Fedora Release Engineering <rel-eng@fedoraproject.org> - 0.9.8g-5
    1275. - Autorebuild for GCC 4.3
    1277. * Thu Jan 24 2008 Tomas Mraz <tmraz@redhat.com> 0.9.8g-4
    1278. - merge review fixes (#226220)
    1279. - adjust the SHLIB_VERSION_NUMBER to reflect library name (#429846)
    1281. * Thu Dec 13 2007 Tomas Mraz <tmraz@redhat.com> 0.9.8g-3
    1282. - set default paths when no explicit paths are set (#418771)
    1283. - do not add tls extensions to client hello for SSLv3 (#422081)
    1285. * Tue Dec  4 2007 Tomas Mraz <tmraz@redhat.com> 0.9.8g-2
    1286. - enable some new crypto algorithms and features
    1287. - add some more important bug fixes from openssl CVS
    1289. * Mon Dec  3 2007 Tomas Mraz <tmraz@redhat.com> 0.9.8g-1
    1290. - update to latest upstream release, SONAME bumped to 7
    1292. * Mon Oct 15 2007 Joe Orton <jorton@redhat.com> 0.9.8b-17
    1293. - update to new CA bundle from mozilla.org
    1295. * Fri Oct 12 2007 Tomas Mraz <tmraz@redhat.com> 0.9.8b-16
    1296. - fix CVE-2007-5135 - off-by-one in SSL_get_shared_ciphers (#309801)
    1297. - fix CVE-2007-4995 - out of order DTLS fragments buffer overflow (#321191)
    1298. - add alpha sub-archs (#296031)
    1300. * Tue Aug 21 2007 Tomas Mraz <tmraz@redhat.com> 0.9.8b-15
    1301. - rebuild
    1303. * Fri Aug  3 2007 Tomas Mraz <tmraz@redhat.com> 0.9.8b-14
    1304. - use localhost in testsuite, hopefully fixes slow build in koji
    1305. - CVE-2007-3108 - fix side channel attack on private keys (#250577)
    1306. - make ssl session cache id matching strict (#233599)
    1308. * Wed Jul 25 2007 Tomas Mraz <tmraz@redhat.com> 0.9.8b-13
    1309. - allow building on ARM architectures (#245417)
    1310. - use reference timestamps to prevent multilib conflicts (#218064)
    1311. - -devel package must require pkgconfig (#241031)
    1313. * Mon Dec 11 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-12
    1314. - detect duplicates in add_dir properly (#206346)
    1316. * Thu Nov 30 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-11
    1317. - the previous change still didn't make X509_NAME_cmp transitive
    1319. * Thu Nov 23 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-10
    1320. - make X509_NAME_cmp transitive otherwise certificate lookup
    1321.   is broken (#216050)
    1323. * Thu Nov  2 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-9
    1324. - aliasing bug in engine loading, patch by IBM (#213216)
    1326. * Mon Oct  2 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-8
    1327. - CVE-2006-2940 fix was incorrect (#208744)
    1329. * Mon Sep 25 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-7
    1330. - fix CVE-2006-2937 - mishandled error on ASN.1 parsing (#207276)
    1331. - fix CVE-2006-2940 - parasitic public keys DoS (#207274)
    1332. - fix CVE-2006-3738 - buffer overflow in SSL_get_shared_ciphers (#206940)
    1333. - fix CVE-2006-4343 - sslv2 client DoS (#206940)
    1335. * Tue Sep  5 2006 Tomas Mraz <tmraz@redhat.com> 0.9.8b-6
    1336. - fix CVE-2006-4339 - prevent attack on PKCS#1 v1.5 signatures (#205180)
    1338. * Wed Aug  2 2006 Tomas Mraz <tmraz@redhat.com> - 0.9.8b-5
    1339. - set buffering to none on stdio/stdout FILE when bufsize is set (#200580)
    1340.   patch by IBM
    1342. * Fri Jul 28 2006 Alexandre Oliva <aoliva@redhat.com> - 0.9.8b-4.1
    1343. - rebuild with new binutils (#200330)
    1345. * Fri Jul 21 2006 Tomas Mraz <tmraz@redhat.com> - 0.9.8b-4
    1346. - add a temporary workaround for sha512 test failure on s390 (#199604)
    1348. * Thu Jul 20 2006 Tomas Mraz <tmraz@redhat.com>
    1349. - add ipv6 support to s_client and s_server (by Jan Pazdziora) (#198737)
    1350. - add patches for BN threadsafety, AES cache collision attack hazard fix and
    1351.   pkcs7 code memleak fix from upstream CVS
    1353. * Wed Jul 12 2006 Jesse Keating <jkeating@redhat.com> - 0.9.8b-3.1
    1354. - rebuild
    1356. * Wed Jun 21 2006 Tomas Mraz <tmraz@redhat.com> - 0.9.8b-3
    1357. - dropped libica and ica engine from build
    1359. * Wed Jun 21 2006 Joe Orton <jorton@redhat.com>
    1360. - update to new CA bundle from mozilla.org; adds CA certificates
    1361.   from netlock.hu and startcom.org
    1363. * Mon Jun  5 2006 Tomas Mraz <tmraz@redhat.com> - 0.9.8b-2
    1364. - fixed a few rpmlint warnings
    1365. - better fix for #173399 from upstream
    1366. - upstream fix for pkcs12
    1368. * Thu May 11 2006 Tomas Mraz <tmraz@redhat.com> - 0.9.8b-1
    1369. - upgrade to new version, stays ABI compatible
    1370. - there is no more linux/config.h (it was empty anyway)
    1372. * Tue Apr  4 2006 Tomas Mraz <tmraz@redhat.com> - 0.9.8a-6
    1373. - fix stale open handles in libica (#177155)
    1374. - fix build if 'rand' or 'passwd' in buildroot path (#178782)
    1375. - initialize VIA Padlock engine (#186857)
    1377. * Fri Feb 10 2006 Jesse Keating <jkeating@redhat.com> - 0.9.8a-5.2
    1378. - bump again for double-long bug on ppc(64)
    1380. * Tue Feb 07 2006 Jesse Keating <jkeating@redhat.com> - 0.9.8a-5.1
    1381. - rebuilt for new gcc4.1 snapshot and glibc changes
    1383. * Thu Dec 15 2005 Tomas Mraz <tmraz@redhat.com> 0.9.8a-5
    1384. - don't include SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
    1385.   in SSL_OP_ALL (#175779)
    1387. * Fri Dec 09 2005 Jesse Keating <jkeating@redhat.com>
    1388. - rebuilt
    1390. * Tue Nov 29 2005 Tomas Mraz <tmraz@redhat.com> 0.9.8a-4
    1391. - fix build (-lcrypto was erroneusly dropped) of the updated libica
    1392. - updated ICA engine to 1.3.6-rc3
    1394. * Tue Nov 22 2005 Tomas Mraz <tmraz@redhat.com> 0.9.8a-3
    1395. - disable builtin compression methods for now until they work
    1396.   properly (#173399)
    1398. * Wed Nov 16 2005 Tomas Mraz <tmraz@redhat.com> 0.9.8a-2
    1399. - don't set -rpath for openssl binary
    1401. * Tue Nov  8 2005 Tomas Mraz <tmraz@redhat.com> 0.9.8a-1
    1402. - new upstream version
    1403. - patches partially renumbered
    1405. * Fri Oct 21 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-11
    1406. - updated IBM ICA engine library and patch to latest upstream version
    1408. * Wed Oct 12 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-10
    1409. - fix CAN-2005-2969 - remove SSL_OP_MSIE_SSLV2_RSA_PADDING which
    1410.   disables the countermeasure against man in the middle attack in SSLv2
    1411.   (#169863)
    1412. - use sha1 as default for CA and cert requests - CAN-2005-2946 (#169803)
    1414. * Tue Aug 23 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-9
    1415. - add *.so.soversion as symlinks in /lib (#165264)
    1416. - remove unpackaged symlinks (#159595)
    1417. - fixes from upstream (constant time fixes for DSA,
    1418.   bn assembler div on ppc arch, initialize memory on realloc)
    1420. * Thu Aug 11 2005 Phil Knirsch <pknirsch@redhat.com> 0.9.7f-8
    1421. - Updated ICA engine IBM patch to latest upstream version.
    1423. * Thu May 19 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-7
    1424. - fix CAN-2005-0109 - use constant time/memory access mod_exp
    1425.   so bits of private key aren't leaked by cache eviction (#157631)
    1426. - a few more fixes from upstream 0.9.7g
    1428. * Wed Apr 27 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-6
    1429. - use poll instead of select in rand (#128285)
    1430. - fix Makefile.certificate to point to /etc/pki/tls
    1431. - change the default string mask in ASN1 to PrintableString+UTF8String
    1433. * Mon Apr 25 2005 Joe Orton <jorton@redhat.com> 0.9.7f-5
    1434. - update to revision 1.37 of Mozilla CA bundle
    1436. * Thu Apr 21 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-4
    1437. - move certificates to _sysconfdir/pki/tls (#143392)
    1438. - move CA directories to _sysconfdir/pki/CA
    1439. - patch the CA script and the default config so it points to the
    1440.   CA directories
    1442. * Fri Apr  1 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-3
    1443. - uninitialized variable mustn't be used as input in inline
    1444.   assembly
    1445. - reenable the x86_64 assembly again
    1447. * Thu Mar 31 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-2
    1448. - add back RC4_CHAR on ia64 and x86_64 so the ABI isn't broken
    1449. - disable broken bignum assembly on x86_64
    1451. * Wed Mar 30 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7f-1
    1452. - reenable optimizations on ppc64 and assembly code on ia64
    1453. - upgrade to new upstream version (no soname bump needed)
    1454. - disable thread test - it was testing the backport of the
    1455.   RSA blinding - no longer needed
    1456. - added support for changing serial number to
    1457.   Makefile.certificate (#151188)
    1458. - make ca-bundle.crt a config file (#118903)
    1460. * Tue Mar  1 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7e-3
    1461. - libcrypto shouldn't depend on libkrb5 (#135961)
    1463. * Mon Feb 28 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7e-2
    1464. - rebuild
    1466. * Mon Feb 28 2005 Tomas Mraz <tmraz@redhat.com> 0.9.7e-1
    1467. - new upstream source, updated patches
    1468. - added patch so we are hopefully ABI compatible with upcoming
    1469.   0.9.7f
    1471. * Thu Feb 10 2005 Tomas Mraz <tmraz@redhat.com>
    1472. - Support UTF-8 charset in the Makefile.certificate (#134944)
    1473. - Added cmp to BuildPrereq
    1475. * Thu Jan 27 2005 Joe Orton <jorton@redhat.com> 0.9.7a-46
    1476. - generate new ca-bundle.crt from Mozilla certdata.txt (revision 1.32)
    1478. * Thu Dec 23 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-45
    1479. - Fixed and updated libica-1.3.4-urandom.patch patch (#122967)
    1481. * Fri Nov 19 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-44
    1482. - rebuild
    1484. * Fri Nov 19 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-43
    1485. - rebuild
    1487. * Fri Nov 19 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-42
    1488. - rebuild
    1490. * Fri Nov 19 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-41
    1491. - remove der_chop, as upstream cvs has done (CAN-2004-0975, #140040)
    1493. * Tue Oct 05 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-40
    1494. - Include latest libica version with important bugfixes
    1496. * Tue Jun 15 2004 Elliot Lee <sopwith@redhat.com>
    1497. - rebuilt
    1499. * Mon Jun 14 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-38
    1500. - Updated ICA engine IBM patch to latest upstream version.
    1502. * Mon Jun  7 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-37
    1503. - build for linux-alpha-gcc instead of alpha-gcc on alpha (Jeff Garzik)
    1505. * Tue May 25 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-36
    1506. - handle %%{_arch}=i486/i586/i686/athlon cases in the intermediate
    1507.   header (#124303)
    1509. * Thu Mar 25 2004 Joe Orton <jorton@redhat.com> 0.9.7a-35
    1510. - add security fixes for CAN-2004-0079, CAN-2004-0112
    1512. * Tue Mar 16 2004 Phil Knirsch <pknirsch@redhat.com>
    1513. - Fixed libica filespec.
    1515. * Thu Mar 11 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-34
    1516. - ppc/ppc64 define __powerpc__/__powerpc64__, not __ppc__/__ppc64__, fix
    1517.   the intermediate header
    1519. * Wed Mar 10 2004 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-33
    1520. - add an intermediate <openssl/opensslconf.h> which points to the right
    1521.   arch-specific opensslconf.h on multilib arches
    1523. * Tue Mar 02 2004 Elliot Lee <sopwith@redhat.com>
    1524. - rebuilt
    1526. * Thu Feb 26 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-32
    1527. - Updated libica to latest upstream version 1.3.5.
    1529. * Tue Feb 17 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-31
    1530. - Update ICA crypto engine patch from IBM to latest version.
    1532. * Fri Feb 13 2004 Elliot Lee <sopwith@redhat.com>
    1533. - rebuilt
    1535. * Fri Feb 13 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-29
    1536. - rebuilt
    1538. * Wed Feb 11 2004 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-28
    1539. - Fixed libica build.
    1541. * Wed Feb  4 2004 Nalin Dahyabhai <nalin@redhat.com>
    1542. - add "-ldl" to link flags added for Linux-on-ARM (#99313)
    1544. * Wed Feb  4 2004 Joe Orton <jorton@redhat.com> 0.9.7a-27
    1545. - updated ca-bundle.crt: removed expired GeoTrust roots, added
    1546.   freessl.com root, removed trustcenter.de Class 0 root
    1548. * Sun Nov 30 2003 Tim Waugh <twaugh@redhat.com> 0.9.7a-26
    1549. - Fix link line for libssl (bug #111154).
    1551. * Fri Oct 24 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-25
    1552. - add dependency on zlib-devel for the -devel package, which depends on zlib
    1553.   symbols because we enable zlib for libssl (#102962)
    1555. * Fri Oct 24 2003 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-24
    1556. - Use /dev/urandom instead of PRNG for libica.
    1557. - Apply libica-1.3.5 fix for /dev/urandom in icalinux.c
    1558. - Use latest ICA engine patch from IBM.
    1560. * Sat Oct  4 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-22.1
    1561. - rebuild
    1563. * Wed Oct  1 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-22
    1564. - rebuild (22 wasn't actually built, fun eh?)
    1566. * Tue Sep 30 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-23
    1567. - re-disable optimizations on ppc64
    1569. * Tue Sep 30 2003 Joe Orton <jorton@redhat.com>
    1570. - add a_mbstr.c fix for 64-bit platforms from CVS
    1572. * Tue Sep 30 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-22
    1573. - add -Wa,--noexecstack to RPM_OPT_FLAGS so that assembled modules get tagged
    1574.   as not needing executable stacks
    1576. * Mon Sep 29 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-21
    1577. - rebuild
    1579. * Thu Sep 25 2003 Nalin Dahyabhai <nalin@redhat.com>
    1580. - re-enable optimizations on ppc64
    1582. * Thu Sep 25 2003 Nalin Dahyabhai <nalin@redhat.com>
    1583. - remove exclusivearch
    1585. * Wed Sep 24 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-20
    1586. - only parse a client cert if one was requested
    1587. - temporarily exclusivearch for %%{ix86}
    1589. * Tue Sep 23 2003 Nalin Dahyabhai <nalin@redhat.com>
    1590. - add security fixes for protocol parsing bugs (CAN-2003-0543, CAN-2003-0544)
    1591.   and heap corruption (CAN-2003-0545)
    1592. - update RHNS-CA-CERT files
    1593. - ease back on the number of threads used in the threading test
    1595. * Wed Sep 17 2003 Matt Wilson <msw@redhat.com> 0.9.7a-19
    1596. - rebuild to fix gzipped file md5sums (#91211)
    1598. * Mon Aug 25 2003 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-18
    1599. - Updated libica to version 1.3.4.
    1601. * Thu Jul 17 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-17
    1602. - rebuild
    1604. * Tue Jul 15 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-10.9
    1605. - free the kssl_ctx structure when we free an SSL structure (#99066)
    1607. * Fri Jul 11 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-16
    1608. - rebuild
    1610. * Thu Jul 10 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-15
    1611. - lower thread test count on s390x
    1613. * Tue Jul  8 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-14
    1614. - rebuild
    1616. * Thu Jun 26 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-13
    1617. - disable assembly on arches where it seems to conflict with threading
    1619. * Thu Jun 26 2003 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-12
    1620. - Updated libica to latest upstream version 1.3.0
    1622. * Wed Jun 11 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-9.9
    1623. - rebuild
    1625. * Wed Jun 11 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-11
    1626. - rebuild
    1628. * Tue Jun 10 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-10
    1629. - ubsec: don't stomp on output data which might also be input data
    1631. * Tue Jun 10 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-9
    1632. - temporarily disable optimizations on ppc64
    1634. * Mon Jun  9 2003 Nalin Dahyabhai <nalin@redhat.com>
    1635. - backport fix for engine-used-for-everything from 0.9.7b
    1636. - backport fix for prng not being seeded causing problems, also from 0.9.7b
    1637. - add a check at build-time to ensure that RSA is thread-safe
    1638. - keep perlpath from stomping on the libica configure scripts
    1640. * Fri Jun  6 2003 Nalin Dahyabhai <nalin@redhat.com>
    1641. - thread-safety fix for RSA blinding
    1643. * Wed Jun 04 2003 Elliot Lee <sopwith@redhat.com> 0.9.7a-8
    1644. - rebuilt
    1646. * Fri May 30 2003 Phil Knirsch <pknirsch@redhat.com> 0.9.7a-7
    1647. - Added libica-1.2 to openssl (featurerequest).
    1649. * Wed Apr 16 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-6
    1650. - fix building with incorrect flags on ppc64
    1652. * Wed Mar 19 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-5
    1653. - add patch to harden against Klima-Pokorny-Rosa extension of Bleichenbacher's
    1654.   attack (CAN-2003-0131)
    1656. * Mon Mar 17 2003 Nalin Dahyabhai <nalin@redhat.com>  0.9.7a-4
    1657. - add patch to enable RSA blinding by default, closing a timing attack
    1658.   (CAN-2003-0147)
    1660. * Wed Mar  5 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-3
    1661. - disable use of BN assembly module on x86_64, but continue to allow inline
    1662.   assembly (#83403)
    1664. * Thu Feb 27 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-2
    1665. - disable EC algorithms
    1667. * Wed Feb 19 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-1
    1668. - update to 0.9.7a
    1670. * Wed Feb 19 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7-8
    1671. - add fix to guard against attempts to allocate negative amounts of memory
    1672. - add patch for CAN-2003-0078, fixing a timing attack
    1674. * Thu Feb 13 2003 Elliot Lee <sopwith@redhat.com> 0.9.7-7
    1675. - Add openssl-ppc64.patch
    1677. * Mon Feb 10 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7-6
    1678. - EVP_DecryptInit should call EVP_CipherInit() instead of EVP_CipherInit_ex(),
    1679.   to get the right behavior when passed uninitialized context structures
    1680.   (#83766)
    1681. - build with -mcpu=ev5 on alpha family (#83828)
    1683. * Wed Jan 22 2003 Tim Powers <timp@redhat.com>
    1684. - rebuilt
    1686. * Fri Jan 17 2003 Phil Knirsch <pknirsch@redhat.com> 0.9.7-4
    1687. - Added IBM hw crypto support patch.
    1689. * Wed Jan 15 2003 Nalin Dahyabhai <nalin@redhat.com>
    1690. - add missing builddep on sed
    1692. * Thu Jan  9 2003 Bill Nottingham <notting@redhat.com> 0.9.7-3
    1693. - debloat
    1694. - fix broken manpage symlinks
    1696. * Wed Jan  8 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7-2
    1697. - fix double-free in 'openssl ca'
    1699. * Fri Jan  3 2003 Nalin Dahyabhai <nalin@redhat.com> 0.9.7-1
    1700. - update to 0.9.7 final
    1702. * Tue Dec 17 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.7-0
    1703. - update to 0.9.7 beta6 (DO NOT USE UNTIL UPDATED TO FINAL 0.9.7)
    1705. * Wed Dec 11 2002 Nalin Dahyabhai <nalin@redhat.com>
    1706. - update to 0.9.7 beta5 (DO NOT USE UNTIL UPDATED TO FINAL 0.9.7)
    1708. * Tue Oct 22 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-30
    1709. - add configuration stanza for x86_64 and use it on x86_64
    1710. - build for linux-ppc on ppc
    1711. - start running the self-tests again
    1713. * Wed Oct 02 2002 Elliot Lee <sopwith@redhat.com> 0.9.6b-29hammer.3
    1714. - Merge fixes from previous hammer packages, including general x86-64 and
    1715.   multilib
    1717. * Tue Aug  6 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-29
    1718. - rebuild
    1720. * Thu Aug  1 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-28
    1721. - update asn patch to fix accidental reversal of a logic check
    1723. * Wed Jul 31 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-27
    1724. - update asn patch to reduce chance that compiler optimization will remove
    1725.   one of the added tests
    1727. * Wed Jul 31 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-26
    1728. - rebuild
    1730. * Mon Jul 29 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-25
    1731. - add patch to fix ASN.1 vulnerabilities
    1733. * Thu Jul 25 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-24
    1734. - add backport of Ben Laurie's patches for OpenSSL 0.9.6d
    1736. * Wed Jul 17 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-23
    1737. - own {_datadir}/ssl/misc
    1739. * Fri Jun 21 2002 Tim Powers <timp@redhat.com>
    1740. - automated rebuild
    1742. * Sun May 26 2002 Tim Powers <timp@redhat.com>
    1743. - automated rebuild
    1745. * Fri May 17 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-20
    1746. - free ride through the build system (whee!)
    1748. * Thu May 16 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-19
    1749. - rebuild in new environment
    1751. * Thu Apr  4 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-17, 0.9.6b-18
    1752. - merge RHL-specific bits into stronghold package, rename
    1754. * Tue Apr 02 2002 Gary Benson <gbenson@redhat.com> stronghold-0.9.6c-2
    1755. - add support for Chrysalis Luna token
    1757. * Tue Mar 26 2002 Gary Benson <gbenson@redhat.com>
    1758. - disable AEP random number generation, other AEP fixes
    1760. * Fri Mar 15 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-15
    1761. - only build subpackages on primary arches
    1763. * Thu Mar 14 2002 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-13
    1764. - on ia32, only disable use of assembler on i386
    1765. - enable assembly on ia64
    1767. * Mon Jan  7 2002 Florian La Roche <Florian.LaRoche@redhat.de> 0.9.6b-11
    1768. - fix sparcv9 entry
    1770. * Mon Jan  7 2002 Gary Benson <gbenson@redhat.com> stronghold-0.9.6c-1
    1771. - upgrade to 0.9.6c
    1772. - bump BuildArch to i686 and enable assembler on all platforms
    1773. - synchronise with shrimpy and rawhide
    1774. - bump soversion to 3
    1776. * Wed Oct 10 2001 Florian La Roche <Florian.LaRoche@redhat.de>
    1777. - delete BN_LLONG for s390x, patch from Oliver Paukstadt
    1779. * Mon Sep 17 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-9
    1780. - update AEP driver patch
    1782. * Mon Sep 10 2001 Nalin Dahyabhai <nalin@redhat.com>
    1783. - adjust RNG disabling patch to match version of patch from Broadcom
    1785. * Fri Sep  7 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-8
    1786. - disable the RNG in the ubsec engine driver
    1788. * Tue Aug 28 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-7
    1789. - tweaks to the ubsec engine driver
    1791. * Fri Aug 24 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-6
    1792. - tweaks to the ubsec engine driver
    1794. * Thu Aug 23 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-5
    1795. - update ubsec engine driver from Broadcom
    1797. * Fri Aug 10 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-4
    1798. - move man pages back to %%{_mandir}/man?/foo.?ssl from
    1799.   %%{_mandir}/man?ssl/foo.?
    1800. - add an [ engine ] section to the default configuration file
    1802. * Thu Aug  9 2001 Nalin Dahyabhai <nalin@redhat.com>
    1803. - add a patch for selecting a default engine in SSL_library_init()
    1805. * Mon Jul 23 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-3
    1806. - add patches for AEP hardware support
    1807. - add patch to keep trying when we fail to load a cert from a file and
    1808.   there are more in the file
    1809. - add missing prototype for ENGINE_ubsec() in engine_int.h
    1811. * Wed Jul 18 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-2
    1812. - actually add hw_ubsec to the engine list
    1814. * Tue Jul 17 2001 Nalin Dahyabhai <nalin@redhat.com>
    1815. - add in the hw_ubsec driver from CVS
    1817. * Wed Jul 11 2001 Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-1
    1818. - update to 0.9.6b
    1820. * Thu Jul  5 2001 Nalin Dahyabhai <nalin@redhat.com>
    1821. - move .so symlinks back to %%{_libdir}
    1823. * Tue Jul  3 2001 Nalin Dahyabhai <nalin@redhat.com>
    1824. - move shared libraries to /lib (#38410)
    1826. * Mon Jun 25 2001 Nalin Dahyabhai <nalin@redhat.com>
    1827. - switch to engine code base
    1829. * Mon Jun 18 2001 Nalin Dahyabhai <nalin@redhat.com>
    1830. - add a script for creating dummy certificates
    1831. - move man pages from %%{_mandir}/man?/foo.?ssl to %%{_mandir}/man?ssl/foo.?
    1833. * Thu Jun 07 2001 Florian La Roche <Florian.LaRoche@redhat.de>
    1834. - add s390x support
    1836. * Fri Jun  1 2001 Nalin Dahyabhai <nalin@redhat.com>
    1837. - change two memcpy() calls to memmove()
    1838. - don't define L_ENDIAN on alpha
    1840. * Wed May 23 2001 Joe Orton <jorton@redhat.com> stronghold-0.9.6a-1
    1841. - Add 'stronghold-' prefix to package names.
    1842. - Obsolete standard openssl packages.
    1844. * Wed May 16 2001 Joe Orton <jorton@redhat.com>
    1845. - Add BuildArch: i586 as per Nalin's advice.
    1847. * Tue May 15 2001 Joe Orton <jorton@redhat.com>
    1848. - Enable assembler on ix86 (using new .tar.bz2 which does
    1849.   include the asm directories).
    1851. * Tue May 15 2001 Nalin Dahyabhai <nalin@redhat.com>
    1852. - make subpackages depend on the main package
    1854. * Tue May  1 2001 Nalin Dahyabhai <nalin@redhat.com>
    1855. - adjust the hobble script to not disturb symlinks in include/ (fix from
    1856.   Joe Orton)
    1858. * Fri Apr 27 2001 Nalin Dahyabhai <nalin@redhat.com>
    1859. - drop the m2crypo patch we weren't using
    1861. * Tue Apr 24 2001 Nalin Dahyabhai <nalin@redhat.com>
    1862. - configure using "shared" as well
    1864. * Sun Apr  8 2001 Nalin Dahyabhai <nalin@redhat.com>
    1865. - update to 0.9.6a
    1866. - use the build-shared target to build shared libraries
    1867. - bump the soversion to 2 because we're no longer compatible with
    1868.   our 0.9.5a packages or our 0.9.6 packages
    1869. - drop the patch for making rsatest a no-op when rsa null support is used
    1870. - put all man pages into <section>ssl instead of <section>
    1871. - break the m2crypto modules into a separate package
    1873. * Tue Mar 13 2001 Nalin Dahyabhai <nalin@redhat.com>
    1874. - use BN_LLONG on s390
    1876. * Mon Mar 12 2001 Nalin Dahyabhai <nalin@redhat.com>
    1877. - fix the s390 changes for 0.9.6 (isn't supposed to be marked as 64-bit)
    1879. * Sat Mar  3 2001 Nalin Dahyabhai <nalin@redhat.com>
    1880. - move c_rehash to the perl subpackage, because it's a perl script now
    1882. * Fri Mar  2 2001 Nalin Dahyabhai <nalin@redhat.com>
    1883. - update to 0.9.6
    1884. - enable MD2
    1885. - use the libcrypto.so and libssl.so targets to build shared libs with
    1886. - bump the soversion to 1 because we're no longer compatible with any of
    1887.   the various 0.9.5a packages circulating around, which provide lib*.so.0
    1889. * Wed Feb 28 2001 Florian La Roche <Florian.LaRoche@redhat.de>
    1890. - change hobble-openssl for disabling MD2 again
    1892. * Tue Feb 27 2001 Nalin Dahyabhai <nalin@redhat.com>
    1893. - re-disable MD2 -- the EVP_MD_CTX structure would grow from 100 to 152
    1894.   bytes or so, causing EVP_DigestInit() to zero out stack variables in
    1895.   apps built against a version of the library without it
    1897. * Mon Feb 26 2001 Nalin Dahyabhai <nalin@redhat.com>
    1898. - disable some inline assembly, which on x86 is Pentium-specific
    1899. - re-enable MD2 (see http://www.ietf.org/ietf/IPR/RSA-MD-all)
    1901. * Thu Feb 08 2001 Florian La Roche <Florian.LaRoche@redhat.de>
    1902. - fix s390 patch
    1904. * Fri Dec 8 2000 Than Ngo <than@redhat.com>
    1905. - added support s390
    1907. * Mon Nov 20 2000 Nalin Dahyabhai <nalin@redhat.com>
    1908. - remove -Wa,* and -m* compiler flags from the default Configure file (#20656)
    1909. - add the CA.pl man page to the perl subpackage
    1911. * Thu Nov  2 2000 Nalin Dahyabhai <nalin@redhat.com>
    1912. - always build with -mcpu=ev5 on alpha
    1914. * Tue Oct 31 2000 Nalin Dahyabhai <nalin@redhat.com>
    1915. - add a symlink from cert.pem to ca-bundle.crt
    1917. * Wed Oct 25 2000 Nalin Dahyabhai <nalin@redhat.com>
    1918. - add a ca-bundle file for packages like Samba to reference for CA certificates
    1920. * Tue Oct 24 2000 Nalin Dahyabhai <nalin@redhat.com>
    1921. - remove libcrypto's crypt(), which doesn't handle md5crypt (#19295)
    1923. * Mon Oct  2 2000 Nalin Dahyabhai <nalin@redhat.com>
    1924. - add unzip as a buildprereq (#17662)
    1925. - update m2crypto to 0.05-snap4
    1927. * Tue Sep 26 2000 Bill Nottingham <notting@redhat.com>
    1928. - fix some issues in building when it's not installed
    1930. * Wed Sep  6 2000 Nalin Dahyabhai <nalin@redhat.com>
    1931. - make sure the headers we include are the ones we built with (aaaaarrgh!)
    1933. * Fri Sep  1 2000 Nalin Dahyabhai <nalin@redhat.com>
    1934. - add Richard Henderson's patch for BN on ia64
    1935. - clean up the changelog
    1937. * Tue Aug 29 2000 Nalin Dahyabhai <nalin@redhat.com>
    1938. - fix the building of python modules without openssl-devel already installed
    1940. * Wed Aug 23 2000 Nalin Dahyabhai <nalin@redhat.com>
    1941. - byte-compile python extensions without the build-root
    1942. - adjust the makefile to not remove temporary files (like .key files when
    1943.   building .csr files) by marking them as .PRECIOUS
    1945. * Sat Aug 19 2000 Nalin Dahyabhai <nalin@redhat.com>
    1946. - break out python extensions into a subpackage
    1948. * Mon Jul 17 2000 Nalin Dahyabhai <nalin@redhat.com>
    1949. - tweak the makefile some more
    1951. * Tue Jul 11 2000 Nalin Dahyabhai <nalin@redhat.com>
    1952. - disable MD2 support
    1954. * Thu Jul  6 2000 Nalin Dahyabhai <nalin@redhat.com>
    1955. - disable MDC2 support
    1957. * Sun Jul  2 2000 Nalin Dahyabhai <nalin@redhat.com>
    1958. - tweak the disabling of RC5, IDEA support
    1959. - tweak the makefile
    1961. * Thu Jun 29 2000 Nalin Dahyabhai <nalin@redhat.com>
    1962. - strip binaries and libraries
    1963. - rework certificate makefile to have the right parts for Apache
    1965. * Wed Jun 28 2000 Nalin Dahyabhai <nalin@redhat.com>
    1966. - use %%{_perl} instead of /usr/bin/perl
    1967. - disable alpha until it passes its own test suite
    1969. * Fri Jun  9 2000 Nalin Dahyabhai <nalin@redhat.com>
    1970. - move the passwd.1 man page out of the passwd package's way
    1972. * Fri Jun  2 2000 Nalin Dahyabhai <nalin@redhat.com>
    1973. - update to 0.9.5a, modified for U.S.
    1974. - add perl as a build-time requirement
    1975. - move certificate makefile to another package
    1976. - disable RC5, IDEA, RSA support
    1977. - remove optimizations for now
    1979. * Wed Mar  1 2000 Florian La Roche <Florian.LaRoche@redhat.de>
    1980. - Bero told me to move the Makefile into this package
    1982. * Wed Mar  1 2000 Florian La Roche <Florian.LaRoche@redhat.de>
    1983. - add lib*.so symlinks to link dynamically against shared libs
    1985. * Tue Feb 29 2000 Florian La Roche <Florian.LaRoche@redhat.de>
    1986. - update to 0.9.5
    1987. - run ldconfig directly in post/postun
    1988. - add FAQ
    1990. * Sat Dec 18 1999 Bernhard Rosenkrdnzer <bero@redhat.de>
    1991. - Fix build on non-x86 platforms
    1993. * Fri Nov 12 1999 Bernhard Rosenkrdnzer <bero@redhat.de>
    1994. - move /usr/share/ssl/* from -devel to main package
    1996. * Tue Oct 26 1999 Bernhard Rosenkrdnzer <bero@redhat.de>
    1997. - inital packaging
    1998. - changes from base:
    1999.   - Move /usr/local/ssl to /usr/share/ssl for FHS compliance
    2000.   - handle RPM_OPT_FLAGS