Accepting request 502802 from Base:System

1

OBS-URL: https://build.opensuse.org/request/show/502802
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/gnutls?expand=0&rev=101

gnutls-3.5.11.tar.xz

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:51765cc5579e250da77fbd7871507c517d01b15353cc40af7b67e9ec7b6fe28f
-size 7208068

gnutls-3.5.13.tar.xz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:79f5480ad198dad5bc78e075f4a40c4a315a1b2072666919d2d05a08aec13096
+size 7226468

gnutls-broken-openpgp-tests.patch

@@ -1,7 +1,7 @@
-Index: gnutls-3.5.11/tests/Makefile.am
+Index: gnutls-3.5.13/tests/Makefile.am
 ===================================================================
---- gnutls-3.5.11.orig/tests/Makefile.am
-+++ gnutls-3.5.11/tests/Makefile.am
+--- gnutls-3.5.13.orig/tests/Makefile.am	2017-06-07 07:17:11.000000000 +0200
++++ gnutls-3.5.13/tests/Makefile.am	2017-06-08 16:53:59.125158222 +0200
 @@ -19,7 +19,7 @@
  # along with this file; if not, write to the Free Software Foundation,
  # Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
@@ -18,7 +18,7 @@ Index: gnutls-3.5.11/tests/Makefile.am
 -	 mini-dtls-record-asym openpgp-callback key-import-export \
 +	 mini-dtls-record-asym key-import-export \
  	 mini-dtls-fork mini-dtls-pthread mini-key-material x509cert-invalid \
- 	 strict-der tls-ext-register tls-supplemental mini-dtls0-9 \
+ 	 tls-ext-register tls-supplemental mini-dtls0-9 \
  	 mini-record-retvals mini-server-name tls-etm x509-cert-callback \
 @@ -236,6 +236,7 @@ endif
  endif

gnutls.changes

@@ -1,3 +1,53 @@
+-------------------------------------------------------------------
+Thu Jun  8 22:51:06 UTC 2017 - astieger@suse.com
+
+- GnuTLS 3.5.13:
+  * libgnutls: fixed issue with AES-GCM in-place encryption and
+    decryption in aarch64
+  * libgnutls: no longer parse the ResponseID field of the status
+    response TLS extension. The field is not used by GnuTLS nor is
+    made available to calling applications. That addresses a null
+    pointer dereference on server side caused by packets containing
+    the ResponseID field. GNUTLS-SA-2017-4, bsc#1043398
+  * libgnutls: tolerate certificates which do not have strict DER
+    time encoding. It is possible using 3rd party tools to generate
+    certificates with time fields that do not conform to DER
+    requirements. Since 3.4.x these certificates were rejected and
+    cannot be used with GnuTLS, however that caused problems with
+    existing private certificate infrastructures, which were
+    relying on such certificates. Tolerate reading and using these
+    certificates.
+  * minitasn1: updated to libtasn1 4.11.
+  * certtool: allow multiple certificates to be used in --p7-sign
+    with the --load-certificate option
+
+-------------------------------------------------------------------
+Sun Jun  4 19:52:56 UTC 2017 - astieger@suse.com
+
+- GnuTLS 3.5.12:
+  * libgnutls: gnutls_x509_crt_check_hostname2() no longer matches
+    IP addresses against DNS fields of certificate (CN or DNSname).
+    The previous behavior was to tolerate some misconfigured
+    servers, but that was non-standard and skipped any IP
+    constraints present in higher level certificates.
+  * libgnutls: when converting to IDNA2008, fallback to IDNA2003
+    (i.e., transitional encoding) if the domain cannot be converted.
+    That provides maximum compatibility with browsers like firefox
+    that perform the same conversion.
+  * libgnutls: fix issue in RSA-PSK client callback which resulted
+    in no username being sent to the peer
+  * libgnutls: fix regression causing stapled extensions in trust
+    modules not to be considered.
+  * certtool: introduced the email_protection_key option.  This
+    option was introduced in documentation for certtool without an
+    implementation of it. It is a shortcut for option
+   'key_purpose_oid = 1.3.6.1.5.5.7.3.4'.
+  * certtool: made printing of key ID and key PIN consistent
+    between certificates, public keys, and private keys. That is
+    the private key printing now uses the same format as the rest.
+  * gnutls-cli: introduced the --sni-hostname option. This allows
+    overriding the hostname advertised to the peer.
+
 -------------------------------------------------------------------
 Thu May 18 08:44:18 UTC 2017 - astieger@suse.com
 

gnutls.spec

@@ -29,7 +29,7 @@
 %define gnutls_dane_sover 0
 %endif
 Name:           gnutls
-Version:        3.5.11
+Version:        3.5.13
 Release:        0
 Summary:        The GNU Transport Layer Security Library
 License:        LGPL-2.1+ and GPL-3.0+