gnutls: fix an upstream regression in RSA certificates #311735
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
gador
added
0.kind: ZHF Fixes
Pandapip1
suggested changes
May 14, 2024
|
Otherwise, LGTM. |
github-actions
bot
added
6.topic: python
6.topic: nixos
gador
force-pushed
the
gnutls-fix-rsa
branch
2 times, most recently
from
abd5a1d
to
17364f4
Compare
github-actions
bot
removed
6.topic: python
6.topic: nixos
The update to 3.8.5 involved adding a feature to conditionally disable RSAES-PKCS1-v1.5 [1]. It was intended to be turned on by default [2], but failed [3]. Therefore it is disabled, which in turn throws a new error: "Fatal error: The encryption algorithm is not supported". (error 113). This can have severe implications, as for example Lets Encrypt signed RSA certificates aren't trusted anymore. This commit fetches the upstream patch, which hasn't been included in 3.8.5 [1]: https://gitlab.com/gnutls/gnutls/-/merge_requests/1828 [2]: https://gitlab.com/gnutls/gnutls/-/merge_requests/1828/diffs#cd5a2ba3b145c1bd292e027ef84c618b6b7fb895_267_274 [3]: https://gitlab.com/gnutls/gnutls/-/issues/1540 Signed-off-by: Florian Brandes <[email protected]>
|
It's a trap that the latest release is still kept on a version with this kind of breakage. But maybe that's why 3.8.5 isn't mentioned on some of the usual places? https://gnutls.org/news.html |
|
Thanks a lot. I expedited this fix, as it seems like a relatively big problem and at this moment it most likely won't waste much of rebuild work. |
ofborg
bot
added
the
10.rebuild-darwin: 0
ofborg
bot
added
10.rebuild-linux: 0
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description of changes
The update to 3.8.5 involved adding a feature to conditionally disable RSAES-PKCS1-v1.5 1. It was intended to be turned on by default 2, but failed 3.
Therefore it is disabled, which in turn throws a new error: "Fatal error: The encryption algorithm is not supported". (error 113).
This can have severe implications, as for example Lets Encrypt signed RSA certificates aren't trusted anymore.
This commit fetches the upstream patch, which hasn't been included in 3.8.5
Things done
nix.conf? (See Nix manual)sandbox = relaxedsandbox = truenix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage./result/bin/)Add a 👍 reaction to pull requests you find important.