SHA256
1
0
forked from pool/Botan

Accepting request 691275 from devel:libraries:c_c++

- Update to Botan 2.10
  * Bump SONAME
  * Warning: XMSS currently implements draft-06 which is not compatible with
    the final RFC 8391 specification. A PR is open to fix this, however it will
    break all current uses of XMSS. If you are currently using XMSS please
    comment at https://github.com/randombit/botan/pull/1858. Otherwise the PR
    will be merged and support for draft-06 will be removed starting in 2.11.
  * Added a new certificate store implementation that can access the MacOS
    keychain certificate store. (GH #1830)
  * Redesigned Memory_Pool class, which services allocations out of a set of
    pages locked into memory (using mlock/VirtualLock). It is now faster and
    with improved exploit mitigations. (GH #1800)
  * Add BMI2 implementations of SHA-512 and SHA-3 which improve performance by
    25-35% on common CPUs. (GH #1815)
  * Unroll SHA-3 computation improving performance by 10-12% (GH #1838)
  * Add a Thread_Pool class. It is now possible to run the tests in multiple
    threads with --test-threads=N flag to select the number of threads to use.
    Use --test-threads=0 to run with as many CPU cores as are available on the
    current system. The default remains single threaded. (GH #1819)
  * XMSS signatures now uses a global thread pool instead of spawning new
    threads for each usage. This improves signature generation performance by
    between 10% and 60% depending on architecture and core count. (GH #1864)
  * Some functions related to encoding and decoding BigInts have been
    deprecated. (GH #1817)
  * Binary encoding and decoding of BigInts has been optimized by performing
    word-size operations when possible. (GH #1817)
  * Rename the exception Integrity_Failure to Invalid_Authentication_Tag to
    make its meaning and usage more clear. The old name remains as a typedef.
    (GH #1816)
  * Support for using Boost filesystem and MSVC’s std::filesystem have been

OBS-URL: https://build.opensuse.org/request/show/691275
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/Botan?expand=0&rev=52
This commit is contained in:
Dominique Leuenberger 2019-04-05 09:56:49 +00:00 committed by Git OBS Bridge
commit 74f977c8a3
7 changed files with 316 additions and 20 deletions

3
Botan-2.10.0.tgz Normal file
View File

@ -0,0 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:88481997578c27924724fea76610d43d9f59c99edfe561d41803bbc98871ad31
size 7240021

11
Botan-2.10.0.tgz.asc Normal file
View File

@ -0,0 +1,11 @@
-----BEGIN PGP SIGNATURE-----
iQEzBAABCAAdFiEEYh2vZBHhhRxM+aLhYhHr8e+637wFAlyfY5gACgkQYhHr8e+6
37zznAgAslYskgijfn0oGg43GtaPga3qq04iUxLH+MYLCOaBiIPz5AFDHULAVg1P
CVRpYvkglxDYgZVNbWRgbHUrnFju01KU9DwbTD96mcjvKq0dYbpAIn5Sp80iQ8Sr
0ApydPU0sdsrwKAz3vu7NG14rlz935uH05AiRw1WtnAG+42Y0qEbqjcCSvkhFhcn
iSzqBZwMIlyaIH0HTSiZTNLp/WFx5c9bIVpqSb1USBuJ+KM55HgvNGhaesGupkkQ
Nm2ZYNHw3hG8O194Q9HXOlwWtl2OWVsPYofei14ld99ToUvlX4sJzL722zRGzDHY
q2x1pquYuuhbVZBpSTnNHh2xo61oaA==
=YxW6
-----END PGP SIGNATURE-----

View File

@ -1,3 +0,0 @@
version https://git-lfs.github.com/spec/v1
oid sha256:e42df91556317588c6ca0e41bf796f9bd5ec5c70e0668e6c97c608c697c24a90
size 7021654

View File

@ -1,11 +0,0 @@
-----BEGIN PGP SIGNATURE-----
iQEzBAABCAAdFiEEYh2vZBHhhRxM+aLhYhHr8e+637wFAls6K+sACgkQYhHr8e+6
37yyPgf/Xcn08HUPP1tHLWsgVbhHdKUsoPyk8voQD1C1RRhS0pMPT8wq1sI0Ctws
QgF7iEk26UvXLrC99Ab29wivuN1AkBdx0D6g9AiTOEQII1uv5t5SXjXlO3z4W44+
MS310sLnvQ2F2UUOzbEENh/nuFZragh6UGr5cIFGV+T2gCJQ+WKHMDMvOz2rYj5V
01fnTKzuAzm+9ym/R/0q4apfy9XoRZd5PXZil35xGfIZMlkkQ4cPm+fOx5RQJVZY
QHkakmiK6GJZmbJM1/fsh/IXEbCACQalrdtJxTXBWwWe5ngmBv/VeaKyf8UDR54s
il3+LFjya+xMvvUG4BGqKWWgiTOwRw==
=JXvm
-----END PGP SIGNATURE-----

View File

@ -1,3 +1,299 @@
-------------------------------------------------------------------
Tue Apr 2 12:54:40 UTC 2019 - Daniel Molkentin <daniel.molkentin@suse.com>
- Update to Botan 2.10
* Bump SONAME
* Warning: XMSS currently implements draft-06 which is not compatible with
the final RFC 8391 specification. A PR is open to fix this, however it will
break all current uses of XMSS. If you are currently using XMSS please
comment at https://github.com/randombit/botan/pull/1858. Otherwise the PR
will be merged and support for draft-06 will be removed starting in 2.11.
* Added a new certificate store implementation that can access the MacOS
keychain certificate store. (GH #1830)
* Redesigned Memory_Pool class, which services allocations out of a set of
pages locked into memory (using mlock/VirtualLock). It is now faster and
with improved exploit mitigations. (GH #1800)
* Add BMI2 implementations of SHA-512 and SHA-3 which improve performance by
25-35% on common CPUs. (GH #1815)
* Unroll SHA-3 computation improving performance by 10-12% (GH #1838)
* Add a Thread_Pool class. It is now possible to run the tests in multiple
threads with --test-threads=N flag to select the number of threads to use.
Use --test-threads=0 to run with as many CPU cores as are available on the
current system. The default remains single threaded. (GH #1819)
* XMSS signatures now uses a global thread pool instead of spawning new
threads for each usage. This improves signature generation performance by
between 10% and 60% depending on architecture and core count. (GH #1864)
* Some functions related to encoding and decoding BigInts have been
deprecated. (GH #1817)
* Binary encoding and decoding of BigInts has been optimized by performing
word-size operations when possible. (GH #1817)
* Rename the exception Integrity_Failure to Invalid_Authentication_Tag to
make its meaning and usage more clear. The old name remains as a typedef.
(GH #1816)
* Support for using Boost filesystem and MSVCs std::filesystem have been
removed, since already POSIX and Win32 versions had to be maintained for
portability. (GH #1814)
* Newly generated McEliece and XMSS keys now default to being encrypted using
SIV mode, support for which was added in 2.8.0. Previously GCM was used by
default for these algorithms.
* Use arc4random on Android systems (GH #1851)
* Fix the encoding of PGP-S2K iteration counts (GH #1853 #1854)
* Add a facility for sandboxing the command line util. Currently FreeBSD
(Capsicum) and OpenBSD (pledge) sandboxes are supported. (GH #1808)
* Use if constexpr when available.
* Disable building shared libs on iOS as it was broken and it is not clear
shared libraries are ever useful on iOS (GH #1865)
* Renamed the darwin build target to macos. This should not cause any
user-visible change. (GH #1866)
* Add support for using sccache to cache the Windows CI build (GH #1807)
* Add --extra-cxxflags option which allows adding compilation flags without
overriding the default set. (GH #1826)
* Add --format= option to the hash cli which allows formatting the output as
base64 or base58, default output remains hex.
* Add base58_enc and base58_dec cli utils for base58 encoding/decoding. (GH #1848)
* Enable getentropy by default on macOS (GH #1862)
* Avoid using -momit-leaf-frame-pointer flags, since -fomit-frame-pointer is
already the default with recent versions of GCC.
* Fix XLC sanitizer flags.
* Rename Blake2b class to BLAKE2b to match the official name. There is a typedef for compat.
* Fix a bug where loading a raw Ed25519_PublicKey of incorrect length would
lead to a crash. (GH #1850)
* Fix a bug that caused compilation problems using CryptoNG PRNG. (GH #1832)
* Extended SHAKE-128 cipher to support any key between 1 and 160 bytes,
instead of only multiples of 8 bytes.
* Minor HMAC optimizations.
* Build fixes for GNU/Hurd.
* Fix a bug that prevented generating or verifying Ed25519 signatures in the
CLI (GH #1828 #1829)
* Fix a compilation error when building the amalgamation outside of the
original source directory when AVX2 was enabled. (GH #1812)
* Fix a crash when creating the amalgamation if a header file was edited on
Windows but then the amalgamation was built on Linux (GH #1763)
-------------------------------------------------------------------
Thu Jan 10 10:04:33 UTC 2019 - Daniel Molkentin <daniel.molkentin@suse.com>
- Update to Botan 2.9
* Bump SONAME
* CVE-2018-20187 Address a side channel during ECC key generation, which used an
unblinded Montgomery ladder. As a result, a timing attack can reveal
information about the high bits of the secret key.
* Fix bugs in TLS which caused negotiation failures when the client used an
unknown signature algorithm or version (GH #1711 #1709 #1708)
* Fix bug affecting GCM, EAX and ChaCha20Poly1305 where if the associated data
was set after starting a message, the new AD was not reflected in the produced
tag. Now with these modes setting an AD after beginning a message throws an
exception.
* Use a smaller sieve which improves performance of prime generation.
* Fixed a bug that caused ChaCha to produce incorrect output after encrypting 256
GB. (GH #1728)
* Add NEON and AltiVec implementations of ChaCha (GH #1719 #1728 #1729)
* Optimize AVX2 ChaCha (GH #1730)
* Many more operations in BigInt, ECC and RSA code paths are either fully const
time or avoid problematic branches that could potentially be exploited in a
side channel attack. (GH #1738 #1750 #1754 #1755 #1757 #1758 #1759 #1762 #1765
#1770 #1773 #1774 #1779 #1780 #1794 #1795 #1796 #1797)
* Several optimizations for BigInt and ECC, improving ECDSA performance by as
much as 30%. (GH #1734 #1737 #1777 #1750 #1737 #1788)
* Support recovering an ECDSA public key from a message/signature pair (GH #664
#1784)
* Add base58 encoding/decoding functions (GH #1783)
* In the command line interface, add support for reading passphrases from the
terminal with echo disabled (GH #1756)
* Add CT::Mask type to simplify const-time programming (GH #1751)
* Add new configure options --disable-bmi2, --disable-rdrand, and
--disable-rdseed to prevent use of those instruction sets.
* Add error_type and error_code functions to Exception type (GH #1744)
* Now on POSIX systems posix_memalign is used instead of mmap for allocating the
page-locked memory pool. This avoids issues with fork. (GH #602 #1798)
* When available, use RDRAND to generate the additional data in
Stateful_RNG::randomize_with_ts_input
* Use vzeroall/vzeroupper intrinsics to avoid AVX2/SSE transition penalties.
* Support for Visual C++ 2013 has been removed (GH #1557 #1697)
* Resolve a memory leak when verifying ECDSA signatures with versions of OpenSSL
before 1.1.0 (GH #1698)
* Resolve a memory leak using ECDH via OpenSSL (GH #1767)
* Fix an error in XTS which prohibited encrypting values which were exactly the
same length as the underlying block size. Messages of this size are allowed by
the standard and other XTS implementations. (GH #1706)
* Resolve a bug in TSS which resulted in it using an incorrect length field in
the shares. Now the correct length is encoded, but either correct or buggy
lengths are accepted when decoding. (GH #1722)
* Correct a bug when reducing a negative BigInt modulo a small power of 2. (GH
#1755)
* Add CLI utils for threshold secret splitting. (GH #1722)
* Fix a bug introduced in 2.8.0 that caused compilation failure if using a single
amalgamation file with AVX2 enabled. (GH #1700)
* Add an explicit OS target for Emscripten and improve support for it. (GH #1702)
* Fix small issues when building for QNX
* Switch the Travis CI build to using Ubuntu 16.04 (GH #1767)
* Add options to configure.py to disable generation of pkg-config file, and (for
systems where pkg-config support defaults to off, like Windows), to enable
generating it. (GH #1268)
* Modify configure.py to accept empty lists or trailing/extra commas. (GH #1705)
- Update to Botan 2.8
* Add support for using Apple CommonCrypto library for hashing (GH #1667),
cipher modes (GH #1674) and block ciphers (GH #1673).
* Support for negotiating TLS versions 1.0 and 1.1 is disabled in the default
TLS policy. In addition, support for negotiating TLS ciphersuites using CBC
or CCM mode is disabled by default. Applications which need to interop with
old peers must enable these in their TLS policy object. (GH #1651)
* During primality testing, use a Lucas test in addition to Miller-Rabin. It
is possible to construct a composite integer which passes n Miller-Rabin
tests with probability (1/4)^n. So for a incautious verifier using a small
number of tests (under 16 or so) it is possible if unlikely they would
accept such a composite as prime. Adding a Lucas test precludes such an
attack. (GH #1636)
* Add XChaCha and XChaCha20Poly1305 (GH #1640)
* Add AVX2 implementations of ChaCha (GH #1662) and Serpent (GH #1660)
* Add a new password hashing interface in pwdhash.h (GH #1670)
* C binding improvements. Added functions to get name and supported
keylengths of cipher, hash and MAC objects, support for FE1 format
preserving encryption (GH #1625 #1646), functions to load and save RSA keys
in PKCS #1 format (GH #1621), HOTP and TOTP algorithms, scrypt, certificate
verification (GH #1647), functions to get the output length of public key
operations (GH #1642), and functions for loading and serializing X25519
keys (GH #1681)
* Support for building with BOTAN_MP_WORD_BITS set to 8 or 16 has been removed.
* Previously SM2 had two distinct key types, one for signatures and another
for encryption. They have now been merged into a single key type since in
practice it seems the same key is at times used for both operations. (GH
#1637)
* The Cipher_Mode class now derives from SymmetricAlgorithm (GH #1639)
* Add support for using the ARMv8 instructions for SM4 encryption (GH #1622)
* The entropy source using SecRandomCopyBytes has been removed as it was
redundant with other entropy sources (GH #1668)
* The Python module has much better error checking and reporting, and offers
new functionality such as scrypt, MPI and FPE. (GH #1643 #1646)
* Fixed a bug that caused CCM to fail with an exception when used with L=8 (GH #1631 #1632)
* The default bcrypt work factor has been increased from 10 to 12.
* The default algorithm used in passhash9 has changed from SHA-256 to
SHA-512, and the default work factor increased from 10 to 15.
* In ECC private keys, include the public key data for compatibility with GnuTLS (GH #1634 #1635)
* Add support for using Linux getrandom syscall to access the system PRNG.
This is disabled by default, use --with-os-feature=getrandom to enable.
* It is now possible to encrypt private keys using SIV mode.
* The FFI function botan_privkey_load now ignores its rng argument.
* Resolve a problem when building under Visual C++ 15.8 (GH #1624)
* Fix a bug in XSalsa20 (192-bit Salsa nonces) where if set_iv was called
twice without calling set_key, the resulting encryption was incorrect. (GH
#1640)
* Handle an error seen when verifying invalid ECDSA signatures using LibreSSL
on non x86-64 platforms (GH #1627 #1628)
* Fix bugs in PKCS7 and X9.23 CBC padding schemes, which would ignore the
first byte in the event the padding took up the entire block. (GH #1690)
* Correct bugs which would cause CFB, OCB, and GCM modes to crash when they
were used in an unkeyed state. (GH #1639)
* Optimizations for SM4 and Poly1305
* Avoid a cache side channel in the AES key schedule
* Add pk_encrypt and pk_decrypt CLI operations
* Now asn1print CLI defaults to printing context-specific fields.
* Use codec_base for Base64, which matches how Base32 is implemented (GH #1597)
* The cast module has been split up into cast128 and cast256 (GH #1685)
* When building under Visual C++ 2013, the user must acknowledge the upcoming
removal of support using the configure.py flag --ack-vc2013-deprecated (GH
#1557)
------------------------------------------------------------------- -------------------------------------------------------------------
Tue Jul 31 10:44:02 UTC 2018 - daniel.molkentin@suse.com Tue Jul 31 10:44:02 UTC 2018 - daniel.molkentin@suse.com

View File

@ -1,7 +1,7 @@
# #
# spec file for package Botan # spec file for package Botan
# #
# Copyright (c) 2018 SUSE LINUX GmbH, Nuernberg, Germany. # Copyright (c) 2019 SUSE LINUX GmbH, Nuernberg, Germany.
# #
# All modifications and additions to the file contributed by third parties # All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed # remain the property of their copyright owners, unless otherwise agreed
@ -12,14 +12,14 @@
# license that conforms to the Open Source Definition (Version 1.9) # license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative. # published by the Open Source Initiative.
# Please submit bugfixes or comments via http://bugs.opensuse.org/ # Please submit bugfixes or comments via https://bugs.opensuse.org/
# #
%define version_suffix 2-7 %define version_suffix 2-10
%define short_version 2 %define short_version 2
Name: Botan Name: Botan
Version: 2.7.0 Version: 2.10.0
Release: 0 Release: 0
Summary: A C++ Crypto Library Summary: A C++ Crypto Library
License: BSD-2-Clause License: BSD-2-Clause

View File

@ -1,4 +1,4 @@
libbotan-2-7 libbotan-2-10
libbotan-devel libbotan-devel
requires -libbotan-<targettype> = <version> requires -libbotan-<targettype> = <version>
requires "libbotan-2-7-<targettype> = <version>" requires "libbotan-2-10-<targettype> = <version>"