Eyad Issa
4a69295f97
* Achieved parity on most major client features with C Tor.
* Continued work on Arti Relay.
* The work-in-progress RPC system is significantly more clearly
defined and implementation is proceeding.
* More details can be found in the installed package changelog
(/usr/share/doc/packages/arti/CHANGELOG.md)
- Update to version 1.2.8:
* Arti 1.2.8 continues development on onion services,
the RPC subsystem, key management, and relay infrastructure.
It also includes fixes for two security issues in
handling the SOCKS protocol, the most severe of which is rated at
"medium" according to our security policy.
* Increased MSRV to 1.77
* More details can be found in the installed package changelog
(/usr/share/doc/packages/arti/CHANGELOG.md)
- Update to version 1.2.7:
* Arti 1.2.7 continues development on onion service client
authorization, the RPC subsystem, and relay infrastructure.
* More details can be found in the installed package changelog
(/usr/share/doc/packages/arti/CHANGELOG.md)
- Update to version 1.2.6:
* Arti 1.2.7 continues development on onion service client authorization,
the RPC subsystem, and relay infrastructure.
* More details can be found in the installed package changelog
(/usr/share/doc/packages/arti/CHANGELOG.md)
* Update curve25519-dalek to avoid a low-severity timing
* Add a key material export facility for some of our TLS
OBS-URL: https://build.opensuse.org/package/show/network/arti?expand=0&rev=25
59 lines
2.1 KiB
Plaintext
59 lines
2.1 KiB
Plaintext
<services>
|
|
<service name="obs_scm" mode="manual">
|
|
<param name="url">https://gitlab.torproject.org/tpo/core/arti.git</param>
|
|
<param name="versionformat">@PARENT_TAG@~@TAG_OFFSET@</param>
|
|
<param name="scm">git</param>
|
|
<param name="revision">arti-v1.3.0</param>
|
|
<param name="match-tag">*</param>
|
|
<param name="versionrewrite-pattern">arti-v(\d+\.\d+\.\d+)</param>
|
|
<param name="versionrewrite-replacement">\1</param>
|
|
<param name="changesgenerate">enable</param>
|
|
</service>
|
|
|
|
<service name="set_version" mode="manual" />
|
|
<service name="cargo_vendor" mode="manual">
|
|
<param name="srcdir">arti</param>
|
|
<param name="compression">zst</param>
|
|
<param name="update">true</param>
|
|
|
|
<!--
|
|
From https://gitlab.torproject.org/tpo/core/arti/-/blob/2db5ccf16d2f977c073ba3f142513b920fb7b6a1/maint/cargo_audit
|
|
-->
|
|
|
|
<!--
|
|
This is a real but theoretical unaligned read. It might happen only on
|
|
Windows and only with a custom global allocator, which we don't do in our
|
|
arti binary. The bad crate is depended on by env-logger and clap.
|
|
This is being discussed by those crates' contributors here:
|
|
https://github.com/clap-rs/clap/pull/4249
|
|
https://github.com/rust-cli/env_logger/pull/246
|
|
-->
|
|
<param name="i-accept-the-risk">RUSTSEC-2021-0145</param>
|
|
|
|
<!--
|
|
As of 28 Nov 2023, all versions of the rsa crate have a variable
|
|
timing attack that can leak private keys.
|
|
|
|
We do not use (yet) do any private-key rsa operations in arti:
|
|
we only use it to verify signatures.
|
|
-->
|
|
<param name="i-accept-the-risk">RUSTSEC-2023-0071</param>
|
|
|
|
|
|
<!--
|
|
This is not a vulnerability but an unmaintained warning for
|
|
`generational-arena`. It is only used by arti-rpcserver (which is
|
|
experimental).
|
|
-->
|
|
<param name="i-accept-the-risk">RUSTSEC-2024-0014</param>
|
|
|
|
</service>
|
|
|
|
<service name="cargo_audit" mode="manual">
|
|
<param name="srcdir">arti</param>
|
|
</service>
|
|
|
|
|
|
<service name="tar" mode="buildtime" />
|
|
</services>
|