From 3639ab922257309bfbeb7cd1c433dcffe4bfb8b308defd4e26d3e24cf1f0f7f7 Mon Sep 17 00:00:00 2001 From: Matej Cepl Date: Tue, 25 Oct 2022 05:27:10 +0000 Subject: [PATCH 1/2] Accepting request 1030935 from home:bnavigator:branches:devel:languages:python - Update to 0.18.0 * New features: + Support for EdDSA (Ed25519, Ed448) signature creation and verification. + Support for Ed25519 and Ed448 in PKCS#8 and public key files. + Support for point precomputation for EdDSA. * New API: + CurveEdTw class to represent the Twisted Edwards curve parameters. + PointEdwards class to represent points on Twisted Edwards curve and provide point arithmetic on it. + curve_by_name in curves module to get a Curve object by providing curve name. * Bug fix: + Accept private EdDSA keys that include public key in the ASN.1 structure. + Fix incompatibility with Python 3.3 in handling of memoryviews of empty strings. + Make the VerifyingKey encoded with explicit parameters use the same kind of point encoding for public key and curve generator. + Better handling of malformed curve parameters (as in CVE-2022-0778); make python-ecdsa raise MalformedPointError instead of AssertionError. OBS-URL: https://build.opensuse.org/request/show/1030935 OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-ecdsa?expand=0&rev=30 --- ecdsa-0.17.0.tar.gz | 3 --- ecdsa-0.18.0.tar.gz | 3 +++ python-ecdsa.changes | 28 ++++++++++++++++++++++++++++ python-ecdsa.spec | 17 +++++++++++------ 4 files changed, 42 insertions(+), 9 deletions(-) delete mode 100644 ecdsa-0.17.0.tar.gz create mode 100644 ecdsa-0.18.0.tar.gz diff --git a/ecdsa-0.17.0.tar.gz b/ecdsa-0.17.0.tar.gz deleted file mode 100644 index f14d91d..0000000 --- a/ecdsa-0.17.0.tar.gz +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:b9f500bb439e4153d0330610f5d26baaf18d17b8ced1bc54410d189385ea68aa -size 158486 diff --git a/ecdsa-0.18.0.tar.gz b/ecdsa-0.18.0.tar.gz new file mode 100644 index 0000000..f3238a2 --- /dev/null +++ b/ecdsa-0.18.0.tar.gz @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:190348041559e21b22a1d65cee485282ca11a6f81d503fddb84d5017e9ed1e49 +size 197938 diff --git a/python-ecdsa.changes b/python-ecdsa.changes index 90eec68..1e9a139 100644 --- a/python-ecdsa.changes +++ b/python-ecdsa.changes @@ -1,3 +1,31 @@ +------------------------------------------------------------------- +Mon Oct 24 17:14:10 UTC 2022 - Ben Greiner + +- Update to 0.18.0 + * New features: + + Support for EdDSA (Ed25519, Ed448) signature creation and + verification. + + Support for Ed25519 and Ed448 in PKCS#8 and public key files. + + Support for point precomputation for EdDSA. + * New API: + + CurveEdTw class to represent the Twisted Edwards curve + parameters. + + PointEdwards class to represent points on Twisted Edwards + curve and provide point arithmetic on it. + + curve_by_name in curves module to get a Curve object by + providing curve name. + * Bug fix: + + Accept private EdDSA keys that include public key in the + ASN.1 structure. + + Fix incompatibility with Python 3.3 in handling of + memoryviews of empty strings. + + Make the VerifyingKey encoded with explicit parameters use + the same kind of point encoding for public key and curve + generator. + + Better handling of malformed curve parameters (as in + CVE-2022-0778); make python-ecdsa raise MalformedPointError + instead of AssertionError. + ------------------------------------------------------------------- Tue Aug 31 10:18:41 UTC 2021 - John Paul Adrian Glaubitz diff --git a/python-ecdsa.spec b/python-ecdsa.spec index 8f8a019..3ee7f67 100644 --- a/python-ecdsa.spec +++ b/python-ecdsa.spec @@ -1,7 +1,7 @@ # # spec file for package python-ecdsa # -# Copyright (c) 2021 SUSE LLC +# Copyright (c) 2022 SUSE LLC # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -18,11 +18,11 @@ %{?!python_module:%define python_module() python-%{**} python3-%{**}} Name: python-ecdsa -Version: 0.17.0 +Version: 0.18.0 Release: 0 Summary: ECDSA cryptographic signature library (pure python) License: MIT -URL: https://github.com/warner/python-ecdsa +URL: https://github.com/tlsfuzzer/python-ecdsa Source: https://files.pythonhosted.org/packages/source/e/ecdsa/ecdsa-%{version}.tar.gz BuildRequires: %{python_module hypothesis} BuildRequires: %{python_module pytest} @@ -31,7 +31,7 @@ BuildRequires: %{python_module six} BuildRequires: fdupes BuildRequires: openssl BuildRequires: python-rpm-macros -Requires: python-six +Requires: python-six >= 1.9.0 Suggests: python-gmpy Suggests: python-gmpy2 BuildArch: noarch @@ -59,11 +59,16 @@ find ./ -type f -name "*.py" -perm 644 -exec sed -i -e '1{\@^#! %{_bindir}/env p %python_expand %fdupes %{buildroot}%{$python_sitelib} %check -%pytest +# unfortunate hypothesis fuzzing (gh#warner/python-ecdsa#307): +donttest="(test_ecdsa and test_sig_verify)" +donttest="$donttest or (test_jacobi and test_add and scale_points)" +donttest="$donttest or (test_ellipticcurve and test_p192_mult_tests)" +%pytest -k "not ($donttest)" %files %{python_files} %license LICENSE %doc NEWS README.md -%{python_sitelib}/* +%{python_sitelib}/ecdsa +%{python_sitelib}/ecdsa-%{version}*-info %changelog From f234762a99f8d8f9dc836af992654963d59228199aefee6b721cf65527092efd Mon Sep 17 00:00:00 2001 From: Matej Cepl Date: Tue, 25 Oct 2022 05:29:50 +0000 Subject: [PATCH 2/2] - Also remove the conditional definition of python_module. OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-ecdsa?expand=0&rev=31 --- python-ecdsa.changes | 1 + python-ecdsa.spec | 1 - 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/python-ecdsa.changes b/python-ecdsa.changes index 1e9a139..170b310 100644 --- a/python-ecdsa.changes +++ b/python-ecdsa.changes @@ -25,6 +25,7 @@ Mon Oct 24 17:14:10 UTC 2022 - Ben Greiner + Better handling of malformed curve parameters (as in CVE-2022-0778); make python-ecdsa raise MalformedPointError instead of AssertionError. +- Also remove the conditional definition of python_module. ------------------------------------------------------------------- Tue Aug 31 10:18:41 UTC 2021 - John Paul Adrian Glaubitz diff --git a/python-ecdsa.spec b/python-ecdsa.spec index 3ee7f67..a3858fc 100644 --- a/python-ecdsa.spec +++ b/python-ecdsa.spec @@ -16,7 +16,6 @@ # -%{?!python_module:%define python_module() python-%{**} python3-%{**}} Name: python-ecdsa Version: 0.18.0 Release: 0