OpenSSL updates

OpenSSL updates

[Leo Famulari]

[-- Attachment #1.1: Type: text/plain, Size: 102 bytes --]

Here are patches to replace openssl with openssl-1.0.2i and to update
openssl-next to openssl@1.1.0a.

[-- Attachment #1.2: 0001-gnu-openssl-Replace-with-1.0.2i-security-fixes.patch --]
[-- Type: text/plain, Size: 1861 bytes --]

From 1f020e2cb580941a36aa98737cd679a8605cdc4d Mon Sep 17 00:00:00 2001
From: Leo Famulari <leo@famulari.name>
Date: Thu, 22 Sep 2016 09:38:56 -0400
Subject: [PATCH 1/2] gnu: openssl: Replace with 1.0.2i [security fixes].

Fixes CVE-2016-{2177,2178,2179,2180,2181,2182,2183,6302,6303,6304,6306,6308}.

* gnu/packages/tls.scm (openssl)[replacement]: New field.
(openssl-1.0.2i): New variable.
---
 gnu/packages/tls.scm | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/gnu/packages/tls.scm b/gnu/packages/tls.scm
index 0762703..198d298 100644
--- a/gnu/packages/tls.scm
+++ b/gnu/packages/tls.scm
@@ -229,6 +229,7 @@ required structures.")
 (define-public openssl
   (package
    (name "openssl")
+   (replacement openssl-1.0.2i)
    (version "1.0.2h")
    (source (origin
              (method url-fetch)
@@ -367,6 +368,24 @@ required structures.")
    (license license:openssl)
    (home-page "http://www.openssl.org/")))
 
+(define-public openssl-1.0.2i
+  (package (inherit openssl)
+    (source
+      (let ((name "openssl")
+            (version "1.0.2i"))
+        (origin
+          (method url-fetch)
+          (uri (list (string-append "ftp://ftp.openssl.org/source/"
+                                    name "-" version ".tar.gz")
+                     (string-append "ftp://ftp.openssl.org/source/old/"
+                                    (string-trim-right version char-set:letter)
+                                    "/" name "-" version ".tar.gz")))
+          (sha256
+           (base32
+            "0vyy038676cv3m2523fi9ll9nkjxadqdnz18zdp5nm6925yli1wj"))
+          (patches (search-patches "openssl-runpath.patch"
+                                   "openssl-c-rehash-in.patch")))))))
+
 (define-public openssl-next
   (package
     (inherit openssl)
-- 
2.10.0


[-- Attachment #1.3: 0002-gnu-openssl-next-Update-to-1.1.0a-security-fixes.patch --]
[-- Type: text/plain, Size: 1309 bytes --]

From 391b88aa981f9ae8201b6f8959bdbd6d92d6e27b Mon Sep 17 00:00:00 2001
From: Leo Famulari <leo@famulari.name>
Date: Thu, 22 Sep 2016 09:44:17 -0400
Subject: [PATCH 2/2] gnu: openssl-next: Update to 1.1.0a [security fixes].

Fixes CVE-2016-{6304,6305,6307,6308}.

* gnu/packages/tls.scm (openssl-next): Update to 1.1.0a.
---
 gnu/packages/tls.scm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/gnu/packages/tls.scm b/gnu/packages/tls.scm
index 198d298..45ae447 100644
--- a/gnu/packages/tls.scm
+++ b/gnu/packages/tls.scm
@@ -390,7 +390,7 @@ required structures.")
   (package
     (inherit openssl)
     (name "openssl")
-    (version "1.1.0")
+    (version "1.1.0a")
     (source (origin
              (method url-fetch)
              (uri (list (string-append "ftp://ftp.openssl.org/source/"
@@ -401,7 +401,7 @@ required structures.")
               (patches (search-patches "openssl-1.1.0-c-rehash-in.patch"))
               (sha256
                (base32
-                "10lcpmnxap9nw8ymdglys93cgkwd1lf1rz4fhq5whwhlmkwrzipm"))))
+                "0as40a1lipl9qfax7495jc1xfb049ygavkaxxk4y5kcn8birdrn2"))))
     (outputs '("out"
                "doc"        ;1.3MiB of man3 pages
                "static"))   ; 5.5MiB of .a files
-- 
2.10.0


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

Re: OpenSSL updates

[Mark H Weaver]

Leo Famulari <leo@famulari.name> writes:

> Here are patches to replace openssl with openssl-1.0.2i and to update
> openssl-next to openssl@1.1.0a.
>
> From 1f020e2cb580941a36aa98737cd679a8605cdc4d Mon Sep 17 00:00:00 2001
> From: Leo Famulari <leo@famulari.name>
> Date: Thu, 22 Sep 2016 09:38:56 -0400
> Subject: [PATCH 1/2] gnu: openssl: Replace with 1.0.2i [security fixes].
>
> Fixes CVE-2016-{2177,2178,2179,2180,2181,2182,2183,6302,6303,6304,6306,6308}.
>
> * gnu/packages/tls.scm (openssl)[replacement]: New field.
> (openssl-1.0.2i): New variable.
> ---
>  gnu/packages/tls.scm | 19 +++++++++++++++++++
>  1 file changed, 19 insertions(+)
>
> diff --git a/gnu/packages/tls.scm b/gnu/packages/tls.scm
> index 0762703..198d298 100644
> --- a/gnu/packages/tls.scm
> +++ b/gnu/packages/tls.scm
> @@ -229,6 +229,7 @@ required structures.")
>  (define-public openssl
>    (package
>     (name "openssl")
> +   (replacement openssl-1.0.2i)
>     (version "1.0.2h")
>     (source (origin
>               (method url-fetch)
> @@ -367,6 +368,24 @@ required structures.")
>     (license license:openssl)
>     (home-page "http://www.openssl.org/")))
>  
> +(define-public openssl-1.0.2i

Should this be kept private?  Otherwise, both patches look good to me,
please push.

     Thanks!
       Mark

Re: OpenSSL updates

[Leo Famulari]

[-- Attachment #1: Type: text/plain, Size: 854 bytes --]

On Thu, Sep 22, 2016 at 12:33:15PM -0400, Mark H Weaver wrote:
> Leo Famulari <leo@famulari.name> writes:
> > +(define-public openssl-1.0.2i
> 
> Should this be kept private?  Otherwise, both patches look good to me,
> please push.

Good catch.

I also realized that these patches change what variable is used when
using 'openssl' with the Guix command-line tools.

Without these patches, `guix build openssl` uses
(@@ (gnu packages tls) openssl-next) [0]

With these patches, `guix build openssl` uses
(@@ (gnu packages tls) openssl-1.0.2i)

So, I put (replacement #f) in openssl-next, which restores the old
behavior. We don't want to replace openssl-next with openssl-1.0.2i.

Pushed HEAD to 163d93a6bd231596959e2e157b60eb964db85d04

[0] Is that the right way to describe a package variable? That's how I
use `guix build -e`.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 819 bytes --]