%define maj 1.0.0 %define engines_name %mklibname openssl-engines %{maj} %define libname %mklibname openssl %{maj} %define develname %mklibname openssl -d %define staticname %mklibname openssl -s -d %define conflict1 %mklibname openssl 0.9.7 %define conflict2 %mklibname openssl 0.9.8 # Number of threads to spawn when testing some threading fixes. #define thread_test_threads %{?threads:%{threads}}%{!?threads:1} %define with_krb5 0 Summary: Secure Sockets Layer communications libs & utils Name: openssl Version: 1.0.1p Release: %mkrel 1 License: BSD-like Group: System/Libraries URL: http://www.openssl.org/ Source0: http://www.openssl.org/source/%{name}-%{version}.tar.gz Source1: http://www.openssl.org/source/%{name}-%{version}.tar.gz.asc Source2: Makefile.certificate Source3: make-dummy-cert Source4: openssl-thread-test.c # (gb) 0.9.7b-4mdk: Handle RPM_OPT_FLAGS in Configure Patch2: openssl-1.0.1n-optflags.patch # (oe) support Brazilian Government OTHERNAME X509v3 field (#14158) # http://www.iti.gov.br/resolucoes/RESOLU__O_13_DE_26_04_2002.PDF Patch6: openssl-1.0.1m-icpbrasil.diff # http://qa.mandriva.com/show_bug.cgi?id=32621 Patch15: openssl-0.9.8e-crt.patch Patch5: openssl-1.0.1g-use-after-free.patch # upstream patches # # fedora patches Patch7: openssl-1.0.0f-defaults.patch Patch13: openssl-1.0.1m-x509.patch Patch14: openssl-1.0.1m-version-add-engines.patch Patch16: openssl-1.0.0-beta5-enginesdir.patch Patch17: openssl-1.0.1-pkgconfig-krb5.patch # MIPS and ARM support Patch300: openssl-1.0.1m-mips.patch Patch301: openssl-1.0.1m-arm.patch Requires: %{libname} = %{version}-%{release} Requires: perl-base Requires: rootcerts %if %with_krb5 BuildRequires: krb5-devel %endif BuildRequires: multiarch-utils >= 1.0.3 BuildRequires: chrpath BuildRequires: zlib-devel # (tv) for test suite: BuildRequires: bc %description The openssl certificate management tool and the shared libraries that provide various encryption and decription algorithms and protocols, including DES, RC4, RSA and SSL. %package -n %{engines_name} Summary: Engines for openssl Group: System/Libraries Obsoletes: openssl-engines < 1.0.0a-5 Provides: openssl-engines = %{version}-%{release} %description -n %{engines_name} This package provides engines for openssl. %package -n %{libname} Summary: Secure Sockets Layer communications libs Group: System/Libraries Requires: %{engines_name} >= %{version}-%{release} Provides: %{libname} = %{version}-%{release} %description -n %{libname} The libraries files are needed for various cryptographic algorithms and protocols, including DES, RC4, RSA and SSL. %package -n %{develname} Summary: Secure Sockets Layer communications libs & headers & utils Group: Development/Other Requires: %{libname} = %{version}-%{release} Provides: libopenssl-devel Provides: openssl-devel = %{version}-%{release} Obsoletes: openssl-devel # temporary opsolete, will be a conflict later. a compat package # with openssl-0.9.7 devel libs will be provided soon Obsoletes: %{conflict1}-devel Obsoletes: %{conflict2}-devel Obsoletes: %{mklibname openssl 1.0.0}-devel Provides: %{name}-devel = %{version}-%{release} %description -n %{develname} The libraries and include files needed to compile apps with support for various cryptographic algorithms and protocols, including DES, RC4, RSA and SSL. %package -n %{staticname} Summary: Secure Sockets Layer communications static libs Group: Development/Other Requires: %{develname} = %{version}-%{release} Provides: libopenssl-static-devel Provides: openssl-static-devel = %{version}-%{release} # temporary opsolete, will be a conflict later. a compat package # with openssl-0.9.7 static-devel libs will be provided soon Obsoletes: %{conflict1}-static-devel Obsoletes: %{conflict2}-static-devel Obsoletes: %{mklibname openssl 1.0.0}-static-devel Provides: %{name}-static-devel = %{version}-%{release} %description -n %{staticname} The static libraries needed to compile apps with support for various cryptographic algorithms and protocols, including DES, RC4, RSA and SSL. %prep %setup -q -n %{name}-%{version} %patch2 -p1 -b .optflags %patch6 -p0 -b .icpbrasil %patch7 -p1 -b .defaults %patch13 -p1 -b .x509 %patch14 -p1 -b .version-add-engines %patch15 -p1 -b .crt %patch16 -p1 -b .engines %patch17 -p1 -b .krb5 %patch300 -p1 -b .mips %patch301 -p1 -b .arm perl -pi -e "s,^(OPENSSL_LIBNAME=).+$,\1%{_lib}," Makefile.org engines/Makefile cp %{SOURCE2} Makefile.certificate cp %{SOURCE3} make-dummy-cert cp %{SOURCE4} openssl-thread-test.c %build %serverbuild # Figure out which flags we want to use. # default sslarch=%{_os}-%{_arch} %ifarch %ix86 sslarch=linux-elf if ! echo %{_target} | grep -q i[56]86 ; then sslflags="no-asm" fi %endif %ifarch sparcv9 sslarch=linux-sparcv9 %endif %ifarch alpha sslarch=linux-alpha-gcc %endif %ifarch s390 sslarch="linux-generic32 -DB_ENDIAN -DNO_ASM" %endif %ifarch s390x sslarch="linux-generic64 -DB_ENDIAN -DNO_ASM" %endif # ia64, x86_64, ppc, ppc64 are OK by default # Configure the build tree. Override OpenSSL defaults with known-good defaults # usable on all platforms. The Configure script already knows to use -fPIC and # RPM_OPT_FLAGS, so we can skip specifiying them here. ./Configure \ --prefix=%{_prefix} \ --openssldir=%{_sysconfdir}/pki/tls ${sslflags} \ --libdir=%{_lib}/ \ %if %with_krb5 --with-krb5-flavor=MIT --with-krb5-dir=%{_prefix} \ %endif --enginesdir=%{_libdir}/openssl/%{version}/engines \ zlib no-idea no-rc5 enable-camellia shared enable-tlsext ${sslarch} # Add -Wa,--noexecstack here so that libcrypto's assembler modules will be # marked as not requiring an executable stack. RPM_OPT_FLAGS="%{optflags} -Wa,--noexecstack" make depend make all build-shared # Generate hashes for the included certs. make rehash build-shared %check # Verify that what was compiled actually works. export LD_LIBRARY_PATH=`pwd`${LD_LIBRARY_PATH:+:${LD_LIBRARY_PATH}} make -C test apps tests gcc -o openssl-thread-test \ %{?_with_krb5:`krb5-config --cflags`} \ -I./include \ %{optflags} \ openssl-thread-test.c \ -L. -lssl -lcrypto \ %{?_with_krb5:`krb5-config --libs`} \ -lpthread -lz -ldl ./openssl-thread-test --threads %{thread_test_threads} %install rm -fr %{buildroot} %makeinstall \ INSTALL_PREFIX=%{buildroot} \ MANDIR=%{_mandir} \ build-shared install -d -m 755 %{buildroot}%{_libdir}/openssl/%{version} mv %{buildroot}%{_libdir}/engines %{buildroot}%{_libdir}/openssl/%{version} # make the rootcerts dir install -d %{buildroot}%{_sysconfdir}/pki/tls/rootcerts # Install a makefile for generating keys and self-signed certs, and a script # for generating them on the fly. install -d %{buildroot}%{_sysconfdir}/pki/tls/certs install -m0644 Makefile.certificate %{buildroot}%{_sysconfdir}/pki/tls/certs/Makefile install -m0755 make-dummy-cert %{buildroot}%{_sysconfdir}/pki/tls/certs/make-dummy-cert # Pick a CA script. mv %{buildroot}%{_sysconfdir}/pki/tls/misc/CA.sh %{buildroot}%{_sysconfdir}/pki/tls/misc/CA install -d %{buildroot}%{_sysconfdir}/pki/CA install -d %{buildroot}%{_sysconfdir}/pki/CA/private # openssl was named ssleay in "ancient" times. ln -snf openssl %{buildroot}%{_bindir}/ssleay # The man pages rand.3 and passwd.1 conflict with other packages # Rename them to ssl-* and also make a symlink from openssl-* to ssl-* mv %{buildroot}%{_mandir}/man1/passwd.1 %{buildroot}%{_mandir}/man1/ssl-passwd.1 ln -sf ssl-passwd.1%{_extension} %{buildroot}%{_mandir}/man1/openssl-passwd.1%{_extension} for i in rand err; do mv %{buildroot}%{_mandir}/man3/$i.3 %{buildroot}%{_mandir}/man3/ssl-$i.3 ln -snf ssl-$i.3%{_extension} %{buildroot}%{_mandir}/man3/openssl-$i.3%{_extension} done rm -rf {main,devel}-doc-info mkdir -p {main,devel}-doc-info cat > main-doc-info/README.mga <<EOF Warning: The man page of passwd, passwd.1, has been renamed to ssl-passwd.1 to avoid a conflict with passwd.1 man page from the package passwd. EOF cat > devel-doc-info/README.mga <<EOF Warning: The man page of rand, rand.3, has been renamed to ssl-rand.3 to avoid a conflict with rand.3 from the package man-pages The man page of err, err.3, has been renamed to ssl-err.3 to avoid a conflict with err.3 from the package man-pages EOF chmod 755 %{buildroot}%{_libdir}/pkgconfig %multiarch_includes %{buildroot}%{_includedir}/openssl/opensslconf.h # strip cannot touch these unless 755 chmod 755 %{buildroot}%{_libdir}/openssl/%{version}/engines/*.so* chmod 755 %{buildroot}%{_libdir}/*.so* chmod 755 %{buildroot}%{_bindir}/* # nuke a mistake rm -f %{buildroot}%{_mandir}/man3/.3 # nuke rpath chrpath -d %{buildroot}%{_bindir}/openssl # Fix libdir. pushd %{buildroot}%{_libdir}/pkgconfig for i in *.pc ; do sed 's,^libdir=${exec_prefix}/lib$,libdir=${exec_prefix}/%{_lib},g' \ $i >$i.tmp && \ cat $i.tmp >$i && \ rm -f $i.tmp done popd # adjust ssldir perl -pi -e "s|^CATOP=.*|CATOP=%{_sysconfdir}/pki/tls|g" %{buildroot}%{_sysconfdir}/pki/tls/misc/CA perl -pi -e "s|^\\\$CATOP\=\".*|\\\$CATOP\=\"%{_sysconfdir}/pki/tls\";|g" %{buildroot}%{_sysconfdir}/pki/tls/misc/CA.pl perl -pi -e "s|\./demoCA|%{_sysconfdir}/pki/tls|g" %{buildroot}%{_sysconfdir}/pki/tls/openssl.cnf %files %doc FAQ INSTALL LICENSE NEWS PROBLEMS main-doc-info/README* %doc README README.ASN1 README.ENGINE %dir %{_sysconfdir}/pki %dir %{_sysconfdir}/pki/CA %dir %{_sysconfdir}/pki/CA/private %dir %{_sysconfdir}/pki/tls %dir %{_sysconfdir}/pki/tls/certs %dir %{_sysconfdir}/pki/tls/misc %dir %{_sysconfdir}/pki/tls/private %dir %{_sysconfdir}/pki/tls/rootcerts %config(noreplace) %{_sysconfdir}/pki/tls/openssl.cnf %{_sysconfdir}/pki/tls/certs/make-dummy-cert %{_sysconfdir}/pki/tls/certs/Makefile %{_sysconfdir}/pki/tls/misc/* %{_bindir}/* %{_mandir}/man[157]/* %files -n %{libname} %doc FAQ INSTALL LICENSE NEWS PROBLEMS README* %{_libdir}/lib*.so.%{maj} %files -n %{engines_name} %{_libdir}/openssl %files -n %{develname} %doc CHANGES doc/* devel-doc-info/README* %dir %{_includedir}/openssl %multiarch %{multiarch_includedir}/openssl/opensslconf.h %{_includedir}/openssl/* %{_libdir}/lib*.so %{_mandir}/man3/* %{_libdir}/pkgconfig/* %files -n %{staticname} %{_libdir}/lib*.a %changelog * Thu Jul 09 2015 luigiwalser <luigiwalser> 1.0.1p-1.mga4 + Revision: 853089 - 1.0.1p (fixes CVE-2015-1793) - 1.0.1o (fixes hmac abi breakage in 1.0.1n) - 1.0.1n (fixes CVE-2015-4000, CVE-2015-178[89], CVE-2015-179[0-2]) - rediff patch 2 - 1.0.1m - rediff patches 2, 6, 13, 14, 300, 301 - add patches from rhel to fix CVE-2014-3513 and CVE-2014-3567 - rediff patch from rhel to add scsv (mitigate CVE-2014-3566) - update patch 112 to cope with scsv changes - add patches from debian to fix security issues fixed in 1.0.1h (mga#13874) - add patches from fedora to fix: - CVE-2014-0195 - CVE-2014-0221 - CVE-2014-0224 - CVE-2014-3470 - update CVE-2014-0198 patch from fedora - rediff patch from openbsd to fix CVE-2014-0198 - add patch from debian to fix checking critical flag in TSA cert extensions - add patch from openbsd to fix CVE-2010-5298 - add upstream patch to fix CVE-2014-0160 - add patch from upstream via opensuse to fix CVE-2014-0076 + oden <oden> - 1.0.1k (fixes CVE-2014-3571, CVE-2015-0206, CVE-2014-3569, CVE-2014-3572, CVE-2015-0204, CVE-2015-0205, CVE-2014-8275, CVE-2014-3570) - drop a lot of redundant patches * Mon Jan 06 2014 luigiwalser <luigiwalser> 1.0.1e-8.mga4 + Revision: 565222 - add upstream patch to fix CVE-2013-6450 * Mon Jan 06 2014 guillomovitch <guillomovitch> 1.0.1e-7.mga4 + Revision: 565179 - use upstream patch to fix CVE 2013-4353 * Mon Dec 23 2013 luigiwalser <luigiwalser> 1.0.1e-6.mga4 + Revision: 560125 - add patch from fedora to fix CVE-2013-6449 * Mon Oct 28 2013 guillomovitch <guillomovitch> 1.0.1e-5.mga4 + Revision: 547610 - add upstream patch to fix null pointer issue (mga #11549) * Mon Oct 21 2013 umeabot <umeabot> 1.0.1e-4.mga4 + Revision: 540748 - Mageia 4 Mass Rebuild * Wed Oct 09 2013 guillomovitch <guillomovitch> 1.0.1e-3.mga4 + Revision: 494272 - disable kerberos support, to fix circular dependency issue (#mga 10339) * Wed May 29 2013 sander85 <sander85> 1.0.1e-2.mga4 + Revision: 432014 - fix build of manpages with current pod2man (patches from fedora and upstream) * Mon Feb 11 2013 luigiwalser <luigiwalser> 1.0.1e-1.mga3 + Revision: 397936 - 1.0.1e - remove upstreamed patch * Fri Feb 08 2013 fwang <fwang> 1.0.1d-1.mga3 + Revision: 395433 - new version 1.0.1d * Sun Jan 13 2013 umeabot <umeabot> 1.0.1c-8.mga3 + Revision: 362158 - Mass Rebuild - https://wiki.mageia.org/en/Feature:Mageia3MassRebuild * Wed Jan 02 2013 guillomovitch <guillomovitch> 1.0.1c-7.mga3 + Revision: 337612 - re-enable kerberos support * Wed Jan 02 2013 guillomovitch <guillomovitch> 1.0.1c-6.mga3 + Revision: 337573 - temporarily disable kerberos support, to be able to build kerberos package without kerberos-devel installed + oden <oden> - small fixes * Wed Dec 05 2012 guillomovitch <guillomovitch> 1.0.1c-5.mga3 + Revision: 327008 - use a versionned subdirectory for engines, so as to avoid a file conflict with multiple versions installed simultaneously (spotted by oden) * Wed Oct 31 2012 guillomovitch <guillomovitch> 1.0.1c-4.mga3 + Revision: 311718 - fix engines location * Tue Oct 30 2012 guillomovitch <guillomovitch> 1.0.1c-3.mga3 + Revision: 311668 - ships engine in a non-versioned directory, as in fedora + fwang <fwang> - lock libmajor * Thu Jun 07 2012 guillomovitch <guillomovitch> 1.0.1c-2.mga3 + Revision: 257018 - downgrade lib major, it didn't change * Thu Jun 07 2012 guillomovitch <guillomovitch> 1.0.1c-1.mga3 + Revision: 256938 - fix krb5 support, and make it mandatory as in fedora - new version - drop outdated pkcs11 engine patch * Fri May 11 2012 luigiwalser <luigiwalser> 1.0.0j-1.mga2 + Revision: 235378 - 1.0.0j (fixes CVE-2012-2333) * Thu Apr 19 2012 guillomovitch <guillomovitch> 1.0.0i-1.mga2 + Revision: 231806 - new version (fix CVE 2012-2110) * Tue Mar 13 2012 guillomovitch <guillomovitch> 1.0.0h-1.mga2 + Revision: 223223 - new version * Thu Jan 19 2012 fwang <fwang> 1.0.0g-1.mga2 + Revision: 198045 - new version 1.0.0g * Thu Jan 05 2012 guillomovitch <guillomovitch> 1.0.0f-1.mga2 + Revision: 191621 - rename distribution-specific README files to README.mga - spec cleanup - drop unapplied conditional patch0, this isn't true anymore - new version * Mon Dec 19 2011 fwang <fwang> 1.0.0e-2.mga2 + Revision: 184360 - enable zlib support * Wed Sep 07 2011 fwang <fwang> 1.0.0e-1.mga2 + Revision: 140881 - new version 1.0.0e * Sun May 15 2011 pterjan <pterjan> 1.0.0d-2.mga1 + Revision: 99024 - Rebuild for fixed find-requires * Sat Apr 16 2011 pterjan <pterjan> 1.0.0d-1.mga1 + Revision: 86203 - Update to 1.0.0d + rtp <rtp> - Fix arm & mips openssl 1.0.0 patches. * Sat Jan 08 2011 blino <blino> 1.0.0c-2.mga1 + Revision: 736 - use generic distribution macro - remove old distro checks - imported package openssl