Merge ~vpa1977/ubuntu/+source/yapet:ubuntu/devel into ubuntu/+source/yapet:ubuntu/devel

[Vladimir Petko]

Changes:
 - disable failing blowfish tests (openssl regression)
 - clear memory when disposing SecureArray.

PPA: ppa:vpa1977/october-21[1]

Testing:
 - ppa rebuild [2]
 - autopkgtest
----
autopkgtest [16:05:17]: test smoke-test: -----------------------]
autopkgtest [16:05:17]: test smoke-test: - - - - - - - - - - results - - - - - - - - - -
smoke-test PASS (superficial)
autopkgtest [16:05:17]: @@@@@@@@@@@@@@@@@@@@ summary
smoke-test PASS (superficial)
----

[1] https://launchpad.net/~vpa1977/+archive/ubuntu/october-21
[2] https://launchpad.net/~vpa1977/+archive/ubuntu/october-21/+sourcepub/15868620/+listing-archive-extra

diff --git a/debian/changelog b/debian/changelog
index 90d469d..3275feb 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,12 @@
+yapet (2.6-1ubuntu1) noble; urgency=medium
+
+  * d/p/use-std-fill.patch: use std::fill to reset memory instead of
+    std::memset. This fixes armhf test failure (LP: #2058584).
+  * d/p/disable-blowfish-tests.patch: disable failing blowfish tests.
+    See Debian bug 1064724.
+
+ -- Vladimir Petko <[e-mail]>  Thu, 21 Mar 2024 15:56:18 +1300
+
 yapet (2.6-1build1) noble; urgency=medium
 
   * No-change rebuild against libssl3t64
diff --git a/debian/patches/disable-blowfish-tests.patch b/debian/patches/disable-blowfish-tests.patch
new file mode 100644
index 0000000..3f4112e
--- /dev/null
+++ b/debian/patches/disable-blowfish-tests.patch
@@ -0,0 +1,48 @@
+Description: disable blowfish tests
+ Blowfish tests fail with openssl 3.1.5-1. Disable failing tests.
+ The failure may be related to the fix for
+ https://www.openssl.org/news/vulnerabilities.html#CVE-2023-5363.
+Author: Vladimir Petko <[e-mail]>
+Bug: https://github.com/RafaelOstertag/yapet/issues/26
+Bug-Debian: https://bugs.debian.org/1064724
+Last-Update: 2024-03-21
+
+--- a/tests/crypt/Makefile.am
++++ b/tests/crypt/Makefile.am
+@@ -47,10 +47,10 @@
+ 	$(cpy_verbose)cp $< $(builddir)/$@
+ 	$(chmod_verbose)chmod u=rw $(builddir)/$@
+
+-check_PROGRAMS  = key448 key256 blowfish aes256 blowfishfactory aes256factory file_blowfish file_aes256 foreign cryptofactoryhelper
++check_PROGRAMS  = key448 key256 aes256 blowfishfactory aes256factory file_aes256 cryptofactoryhelper
+ check_PROGRAMS += passwordchange_exerciser
+
+-TESTS = key448 key256 blowfish aes256 blowfishfactory aes256factory file_blowfish file_aes256 foreign cryptofactoryhelper
++TESTS = key448 key256 aes256 blowfishfactory aes256factory file_aes256 cryptofactoryhelper
+
+ AM_CPPFLAGS = -I$(yapet_libs_srcdir)/consts \
+ 	-I$(yapet_libs_srcdir)/exceptions \
+--- a/tests/crypt/Makefile.in
++++ b/tests/crypt/Makefile.in
+@@ -87,15 +87,15 @@
+ POST_UNINSTALL = :
+ build_triplet = @build@
+ host_triplet = @host@
+-check_PROGRAMS = key448$(EXEEXT) key256$(EXEEXT) blowfish$(EXEEXT) \
++check_PROGRAMS = key448$(EXEEXT) key256$(EXEEXT)  \
+ 	aes256$(EXEEXT) blowfishfactory$(EXEEXT) \
+-	aes256factory$(EXEEXT) file_blowfish$(EXEEXT) \
+-	file_aes256$(EXEEXT) foreign$(EXEEXT) \
++	aes256factory$(EXEEXT)  \
++	file_aes256$(EXEEXT)  \
+ 	cryptofactoryhelper$(EXEEXT) passwordchange_exerciser$(EXEEXT)
+-TESTS = key448$(EXEEXT) key256$(EXEEXT) blowfish$(EXEEXT) \
++TESTS = key448$(EXEEXT) key256$(EXEEXT) \
+ 	aes256$(EXEEXT) blowfishfactory$(EXEEXT) \
+-	aes256factory$(EXEEXT) file_blowfish$(EXEEXT) \
+-	file_aes256$(EXEEXT) foreign$(EXEEXT) \
++	aes256factory$(EXEEXT)  \
++	file_aes256$(EXEEXT)  \
+ 	cryptofactoryhelper$(EXEEXT)
+ subdir = tests/crypt
+ ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
diff --git a/debian/patches/series b/debian/patches/series
index b407841..2cac1d4 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,2 +1,4 @@
 do-not-install-licenses-files.patch
 avoid-remote-font.patch
+use-std-fill.patch
+disable-blowfish-tests.patch
diff --git a/debian/patches/use-std-fill.patch b/debian/patches/use-std-fill.patch
new file mode 100644
index 0000000..d88dbed
--- /dev/null
+++ b/debian/patches/use-std-fill.patch
@@ -0,0 +1,38 @@
+From: Vladimir Petko <[e-mail]>
+Date: Thu, 21 Mar 2024 15:47:02 +1300
+Bug: https://github.com/RafaelOstertag/yapet/issues/27
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/yapet/+bug/2058584
+Description: use std::fill with volatile pointers to reset memory
+ std::memset can be optimized away and can not be used to
+ securely reset memory.
+ Use std::fill with volatile pointers.
+
+---
+ src/libs/utils/securearray.cc | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/src/libs/utils/securearray.cc b/src/libs/utils/securearray.cc
+index c517189..d69bfa3 100644
+--- a/src/libs/utils/securearray.cc
++++ b/src/libs/utils/securearray.cc
+@@ -31,6 +31,7 @@
+ #include <cstring>
+ #include <limits>
+ #include <stdexcept>
++#include <algorithm>
+
+ #include "consts.h"
+ #include "intl.h"
+@@ -126,8 +127,8 @@ SecureArray& SecureArray::operator=(SecureArray&& other) {
+
+ inline void SecureArray::clearMemory() {
+     if (_array == nullptr) return;
+-
+-    std::memset(_array, 0, _size);
++    std::fill(reinterpret_cast<volatile std::uint8_t*>(_array),
++        reinterpret_cast<volatile std::uint8_t*>(_array + _size), 0);
+ }
+
+ inline void SecureArray::freeMemory() {
+--
+2.40.1