Ubuntu
openssl package

lp:~sbeattie/ubuntu/oneiric/openssl/lp850608

  1. Oneiric (11.10)
  2. lp850608
Created by Steve Beattie and last modified
Get this branch:
bzr branch lp:~sbeattie/ubuntu/oneiric/openssl/lp850608
Only Steve Beattie can upload to this branch. If you are Steve Beattie please log in for upload directions.

Branch merges

Related bugs

Related blueprints

Branch information

Owner:
Steve Beattie
Status:
Development

Recent revisions

59. By Steve Beattie

CVE-2011-3210 (LP: #850608). Remaining changes:
debian/libssl1.0.0.postinst: only display restart notification on
servers (LP: #244250)

58. By Steve Beattie

* Resynchronise with Debian, fixes CVE-2011-1945, CVE-2011-3207 and
  CVE-2011-3210. Remaining changes:
  - debian/libssl1.0.0.postinst:
    + Display a system restart required notification bubble on libssl1.0.0
      upgrade.
    + Use a different priority for libssl1.0.0/restart-services depending
      on whether a desktop, or server dist-upgrade is being performed.
  - debian/{libssl1.0.0-udeb.dirs, control, rules}: Create
    libssl1.0.0-udeb, for the benefit of wget-udeb (no wget-udeb package
    in Debian).
  - debian/{libcrypto1.0.0-udeb.dirs, libssl1.0.0.dirs, libssl1.0.0.files,
    rules}: Move runtime libraries to /lib, for the benefit of
    wpasupplicant.
  - debian/patches/aesni.patch: Backport Intel AES-NI support, now from
    http://rt.openssl.org/Ticket/Display.html?id=2065 rather than the
    0.9.8 variant.
  - debian/patches/Bsymbolic-functions.patch: Link using
    -Bsymbolic-functions.
  - debian/patches/perlpath-quilt.patch: Don't change perl #! paths under
    .pc.
  - debian/rules:
    + Don't run 'make test' when cross-building.
    + Use host compiler when cross-building. Patch from Neil Williams.
    + Don't build for processors no longer supported: i486, i586 (on
      i386), v8 (on sparc).
    + Fix Makefile to properly clean up libs/ dirs in clean target.
    + Replace duplicate files in the doc directory with symlinks.
* Add a missing $(DEB_HOST_MULTIARCH)
* New upstream version
  - Fix bug where CRLs with nextUpdate in the past are sometimes accepted
    by initialising X509_STORE_CTX properly. (CVE-2011-3207)
  - Fix SSL memory handling for (EC)DH ciphersuites, in particular
    for multi-threaded use of ECDH. (CVE-2011-3210)
  - Add protection against ECDSA timing attacks (CVE-2011-1945)
* Block DigiNotar certifiates. Patch from
  Raphael Geissert <email address hidden>
* Generate hashes for all certs in a file (Closes: #628780, #594524)
  Patch from Klaus Ethgen <email address hidden>
* Add multiarch support (Closs: #638137)
  Patch from Steve Langasek / Ubuntu
* Symbols from the gost engine were removed because it didn't have
  a linker file. Thanks to Roman I Khimov <email address hidden>
  (Closes: #631503)
* Add support for s390x. Patch from Aurelien Jarno <email address hidden>
  (Closes: #641100)
* Add build-arch and build-indep targets to the rules file.
* Make it build on sparc64. Patch from Aurelien Jarno. (Closes: #626060)
* Apply patches from Scott Schaefer <email address hidden> to
  fix various pod and spelling errors. (Closes: #622820, #605561)
* Add missing symbols for the engines (Closes: #623038)
* More spelling fixes from Scott Schaefer (Closes: #395424)
* Patch from Scott Schaefer to better document pkcs12 password options
  (Closes: #462489)
* Document dgst -hmac option. Patch by Thorsten Glaser <email address hidden>
  (Closes: #529586)

57. By Steve Langasek

releasing version 1.0.0d-2ubuntu2

56. By Steve Langasek

Build for multiarch. LP: #826601.

55. By Colin Watson

* Resynchronise with Debian (LP: #675566). Remaining changes:
  - debian/libssl1.0.0.postinst:
    + Display a system restart required notification bubble on libssl1.0.0
      upgrade.
    + Use a different priority for libssl1.0.0/restart-services depending
      on whether a desktop, or server dist-upgrade is being performed.
  - debian/{libssl1.0.0-udeb.dirs, control, rules}: Create
    libssl1.0.0-udeb, for the benefit of wget-udeb (no wget-udeb package
    in Debian).
  - debian/{libcrypto1.0.0-udeb.dirs, libssl1.0.0.dirs, libssl1.0.0.files,
    rules}: Move runtime libraries to /lib, for the benefit of
    wpasupplicant.
  - debian/patches/aesni.patch: Backport Intel AES-NI support, now from
    http://rt.openssl.org/Ticket/Display.html?id=2065 rather than the
    0.9.8 variant.
  - debian/patches/Bsymbolic-functions.patch: Link using
    -Bsymbolic-functions.
  - debian/patches/perlpath-quilt.patch: Don't change perl #! paths under
    .pc.
  - debian/rules:
    + Don't run 'make test' when cross-building.
    + Use host compiler when cross-building. Patch from Neil Williams.
    + Don't build for processors no longer supported: i486, i586 (on
      i386), v8 (on sparc).
    + Fix Makefile to properly clean up libs/ dirs in clean target.
    + Replace duplicate files in the doc directory with symlinks.
* Update architectures affected by Bsymbolic-functions.patch.
* Drop debian/patches/no-sslv2.patch; Debian now adds the 'no-ssl2'
  configure option, which compiles out SSLv2 support entirely, so this is
  no longer needed.
* Drop openssl-doc in favour of the libssl-doc package introduced by
  Debian. Add Conflicts/Replaces until the next LTS release.

54. By Artur Rona

* Merge from debian unstable. Remaining changes: (LP: #718205)
  - d/libssl0.9.8.postinst:
    + Display a system restart required notification bubble
      on libssl0.9.8 upgrade.
    + Use a different priority for libssl0.9.8/restart-services
      depending on whether a desktop, or server dist-upgrade
      is being performed.
  - d/{libssl0.9.8-udeb.dirs, control, rules}: Create
    libssl0.9.8-udeb, for the benefit of wget-udeb (no wget-udeb
    package in Debian).
  - d/{libcrypto0.9.8-udeb.dirs, libssl0.9.8.dirs, libssl0.9.8.files,
    rules}: Move runtime libraries to /lib, for the benefit of wpasupplicant.
  - d/{control, openssl-doc.docs, openssl.docs, openssl.dirs}:
    + Ship documentation in openssl-doc, suggested by the package.
     (Closes: #470594)
  - d/p/aesni.patch: Backport Intel AES-NI support from
    http://rt.openssl.org/Ticket/Display.html?id=2067 (refreshed)
  - d/p/Bsymbolic-functions.patch: Link using -Bsymbolic-functions.
  - d/p/perlpath-quilt.patch: Don't change perl #! paths under .pc.
  - d/p/no-sslv2.patch: Disable SSLv2 to match NSS and GnuTLS.
    The protocol is unsafe and extremely deprecated. (Closes: #589706)
  - d/rules:
    + Disable SSLv2 during compile. (Closes: #589706)
    + Don't run 'make test' when cross-building.
    + Use host compiler when cross-building. Patch from Neil Williams.
      (Closes: #465248)
    + Don't build for processors no longer supported: i486, i586
      (on i386), v8 (on sparc).
    + Fix Makefile to properly clean up libs/ dirs in clean target.
      (Closes: #611667)
    + Replace duplicate files in the doc directory with symlinks.
* This upload fixed CVE: (LP: #718208)
  - CVE-2011-0014

53. By Steve Langasek

[ Peter Pearse ]
Fix Makefile to properly clean up libs/ dirs in clean target

52. By Artur Rona

* Merge from debian unstable. Remaining changes: (LP: #693902)
  - debian/patches/Bsymbolic-functions.patch: Link using
    -Bsymbolic-functions.
  - Use a different priority for libssl0.9.8/restart-services
    depending on whether a desktop, or server dist-upgrade is being
    performed.
  - Display a system restart required notification bubble on libssl0.9.8
    upgrade.
  - Don't build for processors no longer supported: i486, i586
    (on i386), v8 (on sparc).
  - Create libssl0.9.8-udeb, for the benefit of wget-udeb (no
    wget-udeb package in Debian).
  - Replace duplicate files in the doc directory with symlinks.
  - Move runtime libraries to /lib, for the benefit of wpasupplicant.
  - Ship documentation in openssl-doc, suggested by the package.
    (Closes: #470594)
  - Use host compiler when cross-building. Patch from Neil Williams.
    (Closes: #465248).
  - Don't run 'make test' when cross-building.
  - debian/patches/aesni.patch: Backport Intel AES-NI support from
    http://rt.openssl.org/Ticket/Display.html?id=2067 (refreshed)
  - debian/patches/perlpath-quilt.patch: Don't change perl #! paths
    under .pc.
  - debian/patches/no-sslv2.patch: disable SSLv2 to match NSS
    and GnuTLS. The protocol is unsafe and extremely deprecated.
    (Closes: #589706)

51. By Steve Beattie

* Merge from debian unstable (LP: #677756). Remaining changes:
  - debian/patches/Bsymbolic-functions.patch: Link using
    -Bsymbolic-functions (refreshed)
  - Use a different priority for libssl0.9.8/restart-services
    depending on whether a desktop, or server dist-upgrade is being
    performed.
  - Display a system restart required notification bubble on libssl0.9.8
    upgrade.
  - Don't build for processors no longer supported: i486, i586
    (on i386), v8 (on sparc).
  - Create libssl0.9.8-udeb, for the benefit of wget-udeb (no
    wget-udeb package in Debian)
  - Replace duplicate files in the doc directory with symlinks.
  - Move runtime libraries to /lib, for the benefit of wpasupplicant
  - Ship documentation in openssl-doc, suggested by the package.
    (Debian bug 470594)
  - Use host compiler when cross-building (patch from Neil Williams in
    Debian bug 465248).
  - Don't run 'make test' when cross-building.
  - debian/patches/aesni.patch: Backport Intel AES-NI support from
    http://rt.openssl.org/Ticket/Display.html?id=2067 (refreshed)
  - debian/patches/perlpath-quilt.patch: Don't change perl #! paths
    under .pc.
  - debian/patches/no-sslv2.patch: disable SSLv2 to match NSS
    and GnuTLS. The protocol is unsafe and extremely deprecated.
    (Debian bug 589706)
* Dropped patches, now upstream:
  - debian/patches/CVE-2010-2939.patch (Debian patch is identically
    named)

50. By Steve Beattie

* SECURITY UPDATE: TLS race condition leading to a buffer overflow and
  possible code execution. (LP: #676243)
  - patches/debian/openssl-CVE-2010-3864-secadv_20101116-0.9.8.patch:
    stricter NULL/not-NULL checking in ssl/t1_lib.c
  - CVE-2010-3864

Branch metadata

Branch format:
Branch format 7
Repository format:
Bazaar repository format 2a (needs bzr 1.16 or later)
Stacked on:
lp:ubuntu/oneiric/openssl
This branch contains Public information 
Everyone can see this information.

Subscribers