scm-commits June 2021

scm-commits@lists.fedoraproject.org

1 participants
38280 discussions

crobinso pushed to qemu (rawhide). "spec: Re-disable tests for power64, still intermittently hanging (..more)"
by notifications＠fedoraproject.org 30 Jun '21

30 Jun '21

Notification time stamped 2021-06-30 22:54:27 UTC From f4c1719ae12b251b9c11a5f22c8876df960e2960 Mon Sep 17 00:00:00 2001 From: Cole Robinson <crobinso(a)redhat.com> Date: Jun 30 2021 22:53:18 +0000 Subject: spec: Re-disable tests for power64, still intermittently hanging Signed-off-by: Cole Robinson <crobinso(a)redhat.com> --- diff --git a/qemu.spec b/qemu.spec index 300e75b..47b783e 100644 --- a/qemu.spec +++ b/qemu.spec @@ -1701,7 +1701,8 @@ echo "Testing %{name}-build" # 2021-06: s390x tests randomly failing with 'Broken pipe' errors # dhorak couldn't reproduce locally on an s390x machine so guessed # it's a resource issue -%ifnarch s390x +# 2021-07: ppc64le intermittently hanging +%ifnarch s390x %{power64} make check V=1 %endif https://src.fedoraproject.org/rpms/qemu/c/f4c1719ae12b251b9c11a5f22c8876df9…

1 0

nickblack pushed to notcurses (f33). "Merge branch 'main' into f33"
by notifications＠fedoraproject.org 30 Jun '21

30 Jun '21

Notification time stamped 2021-06-30 22:49:43 UTC From b7f673a27908240d4bbcdc4770fbc70b786c739e Mon Sep 17 00:00:00 2001 From: Nick Black <dankamongmen(a)gmail.com> Date: Jun 30 2021 22:49:23 +0000 Subject: Merge branch 'main' into f33 --- diff --git a/notcurses.spec b/notcurses.spec index 39f872a..4ce26e5 100644 --- a/notcurses.spec +++ b/notcurses.spec @@ -1,5 +1,5 @@ Name: notcurses -Version: 2.3.6 +Version: 2.3.7 Release: 1%{?dist} Summary: Character graphics and TUI library License: ASL 2.0 @@ -144,6 +144,9 @@ cd cffi %{python3_sitearch}/*.so %changelog +* Tue Jun 29 2021 Nick Black <dankamongmen(a)gmail.com> - 2.3.7-1 +- New upstream release + * Wed Jun 23 2021 Nick Black <dankamongmen(a)gmail.com> - 2.3.6-1 - New upstream release https://src.fedoraproject.org/rpms/notcurses/c/b7f673a27908240d4bbcdc4770fb…

1 0

nickblack pushed to notcurses (f33). "new upstream 2.3.7"
by notifications＠fedoraproject.org 30 Jun '21

30 Jun '21

Notification time stamped 2021-06-30 22:49:43 UTC From b6365cfaaf8379b8bd329d1a94b7bdc466a45c02 Mon Sep 17 00:00:00 2001 From: Nick Black <dankamongmen(a)gmail.com> Date: Jun 30 2021 22:49:32 +0000 Subject: new upstream 2.3.7 --- diff --git a/.gitignore b/.gitignore index aaa9d7e..8852370 100644 --- a/.gitignore +++ b/.gitignore @@ -151,3 +151,6 @@ /notcurses-2.3.5-1.fc35.src.rpm /notcurses_2.3.6+dfsg.1.orig.tar.xz /notcurses_2.3.6+dfsg.1.orig.tar.xz.asc +/notcurses-2.3.7-1.fc34.src.rpm +/notcurses_2.3.7+dfsg.1.orig.tar.xz +/notcurses_2.3.7+dfsg.1.orig.tar.xz.asc diff --git a/sources b/sources index d9dea97..ebdd4cb 100644 --- a/sources +++ b/sources @@ -1,2 +1,3 @@ -SHA512 (notcurses_2.3.6+dfsg.1.orig.tar.xz) = 93165928e683c2b0044649a32c35f4dffe96f6a2e38f6eddaac5334570b70038ee9eef12e23d62d4ee1bb6802436d26f4ffb2f0cbaf8216b551a1f1fc333ecbe -SHA512 (notcurses_2.3.6+dfsg.1.orig.tar.xz.asc) = b54d57b9d3ceae8ae50b6cd2e126b29c3ec8b542e3c8538a216e0ae0d6e7ce1deff38b79cce3ff13c63fe3a09509b8b601e05e94f98a177334d5de31c696e00f +SHA512 (notcurses-2.3.7-1.fc34.src.rpm) = 12e618a5fd5d7ecbd84504a7d963d9ef180e00dd73b47b6d9948813c925b9b9c6323c463ccc8d2f7d579c9c43bdbe21ff27248d0ce2187f3fbd327715736a607 +SHA512 (notcurses_2.3.7+dfsg.1.orig.tar.xz) = 95748b53e79e9aa44228b29eb7edd7ad66c317fff2f965f2b783317059806386e5cb5a334076106ff5286de17b1a02a060cda58e3516a17bcb6feb80a985ae61 +SHA512 (notcurses_2.3.7+dfsg.1.orig.tar.xz.asc) = d63c3e7fc6f1ea243cf96713192a456d772b677deda2f998465c39367a39c639e4752c33ee7ec3fb4de3a2138f4f5114455d9361da0bc41b23820e3b12025525 https://src.fedoraproject.org/rpms/notcurses/c/b6365cfaaf8379b8bd329d1a94b7…

1 0

nickblack pushed to notcurses (f33). "new upstream 2.3.7"
by notifications＠fedoraproject.org 30 Jun '21

30 Jun '21

Notification time stamped 2021-06-30 22:49:43 UTC From 3843e8ecab67af7f16631332bdb8f0390186296f Mon Sep 17 00:00:00 2001 From: Nick Black <dankamongmen(a)gmail.com> Date: Jun 29 2021 11:49:18 +0000 Subject: new upstream 2.3.7 --- diff --git a/notcurses.spec b/notcurses.spec index db7ceef..6097471 100644 --- a/notcurses.spec +++ b/notcurses.spec @@ -1,5 +1,5 @@ Name: notcurses -Version: 2.3.6 +Version: 2.3.7 Release: 1%{?dist} Summary: Character graphics and TUI library License: ASL 2.0 @@ -144,6 +144,9 @@ cd cffi %{python3_sitearch}/*.so %changelog +* Tue Jun 29 2021 Nick Black <dankamongmen(a)gmail.com> - 2.3.7-1 +- New upstream release + * Wed Jun 23 2021 Nick Black <dankamongmen(a)gmail.com> - 2.3.6-1 - New upstream release https://src.fedoraproject.org/rpms/notcurses/c/3843e8ecab67af7f16631332bdb8…

1 0

nickblack uploaded notcurses-2.3.7-1.fc34.src.rpm for rpms/notcurses
by notifications＠fedoraproject.org 30 Jun '21

30 Jun '21

Notification time stamped 2021-06-30 22:49:30 UTC 12e618a5fd5d7ecbd84504a7d963d9ef180e00dd73b47b6d9948813c925b9b9c6323c463ccc8d2f7d579c9c43bdbe21ff27248d0ce2187f3fbd327715736a607 notcurses-2.3.7-1.fc34.src.rpm https://src.fedoraproject.org/lookaside/pkgs/rpms/notcurses/notcurses-2.3.7…

1 0

nickblack pushed to notcurses (f34). "new upstream 2.3.7"
by notifications＠fedoraproject.org 30 Jun '21

30 Jun '21

Notification time stamped 2021-06-30 22:27:29 UTC From 5e7d84d56f78480335bec15625db3f01561f958a Mon Sep 17 00:00:00 2001 From: Nick Black <dankamongmen(a)gmail.com> Date: Jun 30 2021 22:27:05 +0000 Subject: new upstream 2.3.7 --- diff --git a/.gitignore b/.gitignore index aaa9d7e..0e2509e 100644 --- a/.gitignore +++ b/.gitignore @@ -151,3 +151,5 @@ /notcurses-2.3.5-1.fc35.src.rpm /notcurses_2.3.6+dfsg.1.orig.tar.xz /notcurses_2.3.6+dfsg.1.orig.tar.xz.asc +/notcurses_2.3.7+dfsg.1.orig.tar.xz +/notcurses_2.3.7+dfsg.1.orig.tar.xz.asc diff --git a/sources b/sources index d9dea97..fc57e2e 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (notcurses_2.3.6+dfsg.1.orig.tar.xz) = 93165928e683c2b0044649a32c35f4dffe96f6a2e38f6eddaac5334570b70038ee9eef12e23d62d4ee1bb6802436d26f4ffb2f0cbaf8216b551a1f1fc333ecbe -SHA512 (notcurses_2.3.6+dfsg.1.orig.tar.xz.asc) = b54d57b9d3ceae8ae50b6cd2e126b29c3ec8b542e3c8538a216e0ae0d6e7ce1deff38b79cce3ff13c63fe3a09509b8b601e05e94f98a177334d5de31c696e00f +SHA512 (notcurses_2.3.7+dfsg.1.orig.tar.xz) = 95748b53e79e9aa44228b29eb7edd7ad66c317fff2f965f2b783317059806386e5cb5a334076106ff5286de17b1a02a060cda58e3516a17bcb6feb80a985ae61 +SHA512 (notcurses_2.3.7+dfsg.1.orig.tar.xz.asc) = d63c3e7fc6f1ea243cf96713192a456d772b677deda2f998465c39367a39c639e4752c33ee7ec3fb4de3a2138f4f5114455d9361da0bc41b23820e3b12025525 https://src.fedoraproject.org/rpms/notcurses/c/5e7d84d56f78480335bec15625db…

1 0

tstellar pushed to llvm (rawhide). "12.0.1-rc3 Release"
by notifications＠fedoraproject.org 30 Jun '21

30 Jun '21

Notification time stamped 2021-06-30 22:23:20 UTC From 086ce6b60e883dc9cc3894885b34117062ae3cbe Mon Sep 17 00:00:00 2001 From: Tom Stellard <tstellar(a)redhat.com> Date: Jun 30 2021 12:49:06 +0000 Subject: 12.0.1-rc3 Release --- diff --git a/.gitignore b/.gitignore index bf68e80..cee6988 100644 --- a/.gitignore +++ b/.gitignore @@ -104,3 +104,5 @@ /llvm-12.0.0.src.tar.xz.sig /llvm-12.0.1rc1.src.tar.xz /llvm-12.0.1rc1.src.tar.xz.sig +/llvm-12.0.1rc3.src.tar.xz +/llvm-12.0.1rc3.src.tar.xz.sig diff --git a/llvm.spec b/llvm.spec index c683c77..5406da7 100644 --- a/llvm.spec +++ b/llvm.spec @@ -10,7 +10,7 @@ %global llvm_libdir %{_libdir}/%{name} %global build_llvm_libdir %{buildroot}%{llvm_libdir} -%global rc_ver 1 +%global rc_ver 3 %global maj_ver 12 %global min_ver 0 %global patch_ver 1 @@ -48,7 +48,7 @@ Name: %{pkg_name} Version: %{maj_ver}.%{min_ver}.%{patch_ver}%{?rc_ver:~rc%{rc_ver}} -Release: 2%{?dist} +Release: 1%{?dist} Summary: The Low Level Virtual Machine License: NCSA @@ -499,6 +499,9 @@ fi %endif %changelog +* Wed Jun 30 2021 Tom Stellard <tstellar(a)redhat.com> - llvm-12.0.1~rc3-1 +- 12.0.1-rc3 Release + * Fri May 28 2021 Tom Stellard <tstellar(a)redhat.com> - 12.0.1~rc1-2 - Stop installing lit tests diff --git a/sources b/sources index f6201b6..c810e63 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (llvm-12.0.1rc1.src.tar.xz) = ac9dc0353f5f6c47478c6e0911364e97676484a64b20eeba19eebac7728ac174f55d36a02e8a668a0959640cfddfbeb887b8a03dd1f6fbddede1ad446021149c -SHA512 (llvm-12.0.1rc1.src.tar.xz.sig) = db2d38d60a64bfa18c58903c2423c3eeb6a6141d0ca5921afb0e1d6478be1a3d8720a3175369e930b19a65033350314328340707019bf359ab85f248478fdcfb +SHA512 (llvm-12.0.1rc3.src.tar.xz) = c8ef7c4ba0122a1ea5145042274a35e3e75ebd4f197005d25ccce25250f516a3fe81f043800bd370c52739585b1da033713e4277d00f192e9038cc4e82cce919 +SHA512 (llvm-12.0.1rc3.src.tar.xz.sig) = 41ec675cf0efd612ec36fd54ca1bfd013b783df603b06d22f820353b0fffb643bde2c89030cbd81da44737a50eb6e108f655c1bb393bdb56cee0d751657ed61d https://src.fedoraproject.org/rpms/llvm/c/086ce6b60e883dc9cc3894885b3411706…

1 0

packagerbot pushed to dummy-test-package-gloster (rawhide). "Bump release (..more)"
by notifications＠fedoraproject.org 30 Jun '21

30 Jun '21

Notification time stamped 2021-06-30 22:21:55 UTC From 1d27527e9059ad6a0d5dc6a40d3082ec466d567f Mon Sep 17 00:00:00 2001 From: packagerbot <admin(a)fedoraproject.org> Date: Jun 30 2021 22:21:50 +0000 Subject: Bump release Signed-off-by: packagerbot <admin(a)fedoraproject.org> --- diff --git a/dummy-test-package-gloster.spec b/dummy-test-package-gloster.spec index 5bb0727..8c501a4 100644 --- a/dummy-test-package-gloster.spec +++ b/dummy-test-package-gloster.spec @@ -3,7 +3,7 @@ Name: dummy-test-package-gloster Version: 0 -Release: 4284%{?dist} +Release: 4285%{?dist} Summary: Dummy Test Package called Gloster License: CC0 URL: http://fedoraproject.org/wiki/DummyTestPackages @@ -32,6 +32,9 @@ cp -p uuid %{buildroot}%{_datadir}/%{name} %{_datadir}/%{name} %changelog +* Wed Jun 30 2021 packagerbot <admin(a)fedoraproject.org> - 0-4285 +- rebuilt + * Wed Jun 30 2021 packagerbot <admin(a)fedoraproject.org> - 0-4284 - rebuilt https://src.fedoraproject.org/rpms/dummy-test-package-gloster/c/1d27527e905…

1 0

adamwill pushed to perl-Mojolicious (f33). "Backport session security fixes from 9.19"
by notifications＠fedoraproject.org 30 Jun '21

30 Jun '21

Notification time stamped 2021-06-30 22:17:25 UTC From 9ffff020320f2ea937c12873fb7e6735d6210aa1 Mon Sep 17 00:00:00 2001 From: Adam Williamson <awilliam(a)redhat.com> Date: Jun 30 2021 22:04:12 +0000 Subject: Backport session security fixes from 9.19 --- diff --git a/0001-Switch-from-HMAC-SHA1-to-HMAC-SHA256.patch b/0001-Switch-from-HMAC-SHA1-to-HMAC-SHA256.patch new file mode 100644 index 0000000..bed436d --- /dev/null +++ b/0001-Switch-from-HMAC-SHA1-to-HMAC-SHA256.patch @@ -0,0 +1,114 @@ +From 1f91263f3c6d5438a43d814171b88409d94bb61a Mon Sep 17 00:00:00 2001 +From: Sebastian Riedel <sri(a)cpan.org> +Date: Tue, 1 Jun 2021 18:32:36 +0200 +Subject: [PATCH 1/2] Switch from HMAC-SHA1 to HMAC-SHA256 + +--- + lib/Mojolicious/Controller.pm | 13 +++++++------ + lib/Mojolicious/Guides/Growing.pod | 8 ++++---- + lib/Mojolicious/Sessions.pm | 2 +- + 3 files changed, 12 insertions(+), 11 deletions(-) + +diff --git a/lib/Mojolicious/Controller.pm b/lib/Mojolicious/Controller.pm +index 9abc56e17..f52adda82 100644 +--- a/lib/Mojolicious/Controller.pm ++++ b/lib/Mojolicious/Controller.pm +@@ -2,7 +2,8 @@ package Mojolicious::Controller; + use Mojo::Base -base; + + # No imports, for security reasons! +-use Carp (); ++use Carp (); ++use Digest::SHA (); + use Mojo::ByteStream; + use Mojo::DynamicMethods -dispatch; + use Mojo::URL; +@@ -83,7 +84,7 @@ sub every_signed_cookie { + + my $valid; + for my $secret (@$secrets) { +- my $check = Mojo::Util::hmac_sha1_sum("$name=$value", $secret); ++ my $check = Digest::SHA::hmac_sha256_hex("$name=$value", $secret); + ++$valid and last if Mojo::Util::secure_compare($signature, $check); + } + if ($valid) { push @results, $value } +@@ -233,7 +234,7 @@ sub signed_cookie { + return $self->every_signed_cookie($name)->[-1] unless defined $value; + + # Response cookie +- my $sum = Mojo::Util::hmac_sha1_sum("$name=$value", $self->app->secrets->[0]); ++ my $sum = Digest::SHA::hmac_sha256_hex("$name=$value", $self->app->secrets->[0]); + return $self->cookie($name, "$value--$sum", $options); + } + +@@ -681,8 +682,8 @@ L<Mojolicious::Plugin::DefaultHelpers/"inactivity_timeout">, which usually defau + $c = $c->session(foo => 'bar'); + + Persistent data storage for the next few requests, all session data gets serialized with L<Mojo::JSON> and stored +-Base64 encoded in HMAC-SHA1 signed cookies, to prevent tampering. Note that cookies usually have a C<4096> byte (4KiB) +-limit, depending on browser. ++Base64 encoded in HMAC-SHA256 signed cookies, to prevent tampering. Note that cookies usually have a C<4096> byte ++(4KiB) limit, depending on browser. + + # Manipulate session + $c->session->{foo} = 'bar'; +@@ -706,7 +707,7 @@ limit, depending on browser. + + Access signed request cookie values and create new signed response cookies. If there are multiple values sharing the + same name, and you want to access more than just the last one, you can use L</"every_signed_cookie">. Cookies are +-cryptographically signed with HMAC-SHA1, to prevent tampering, and the ones failing signature verification will be ++cryptographically signed with HMAC-SHA256, to prevent tampering, and the ones failing signature verification will be + automatically discarded. + + =head2 stash +diff --git a/lib/Mojolicious/Guides/Growing.pod b/lib/Mojolicious/Guides/Growing.pod +index c3fef407e..c8e152dba 100644 +--- a/lib/Mojolicious/Guides/Growing.pod ++++ b/lib/Mojolicious/Guides/Growing.pod +@@ -100,10 +100,10 @@ information across several HTTP requests. + Traditionally all session data was stored on the server-side and only session ids were exchanged between browser and + web server in the form of cookies. + +- Set-Cookie: session=hmac-sha1(base64(json($session))) ++ Set-Cookie: session=hmac-sha256(base64(json($session))) + + In L<Mojolicious> however we are taking this concept one step further by storing everything JSON serialized and Base64 +-encoded in HMAC-SHA1 signed cookies, which is more compatible with the REST philosophy and reduces infrastructure ++encoded in HMAC-SHA256 signed cookies, which is more compatible with the REST philosophy and reduces infrastructure + requirements. + + =head2 Test-Driven Development +@@ -378,7 +378,7 @@ L<Mojolicious/"secrets">. + + $app->secrets(['Mojolicious rocks']); + +-This passphrase is used by the HMAC-SHA1 algorithm to make signed cookies tamper resistant and can be changed at any ++This passphrase is used by the HMAC-SHA256 algorithm to make signed cookies tamper resistant and can be changed at any + time to invalidate all existing sessions. + + $c->session(user => 'sebastian'); +@@ -401,7 +401,7 @@ L<Mojolicious::Plugin::DefaultHelpers/"flash">. + $c->flash(message => 'Everything is fine.'); + $c->redirect_to('goodbye'); + +-Just remember that all session data gets serialized with L<Mojo::JSON> and stored in HMAC-SHA1 signed cookies, which ++Just remember that all session data gets serialized with L<Mojo::JSON> and stored in HMAC-SHA256 signed cookies, which + usually have a C<4096> byte (4KiB) limit, depending on browser. + + =head2 Final prototype +diff --git a/lib/Mojolicious/Sessions.pm b/lib/Mojolicious/Sessions.pm +index 2f7f21c2b..6056105fa 100644 +--- a/lib/Mojolicious/Sessions.pm ++++ b/lib/Mojolicious/Sessions.pm +@@ -80,7 +80,7 @@ Mojolicious::Sessions - Session manager based on signed cookies + =head1 DESCRIPTION + + L<Mojolicious::Sessions> manages sessions based on signed cookies for L<Mojolicious>. All data gets serialized with +-L<Mojo::JSON> and stored Base64 encoded on the client-side, but is protected from unwanted changes with a HMAC-SHA1 ++L<Mojo::JSON> and stored Base64 encoded on the client-side, but is protected from unwanted changes with a HMAC-SHA256 + signature. + + =head1 ATTRIBUTES +-- +2.32.0 + diff --git a/0002-pad-session-values-to-1025-bytes-by-default.patch b/0002-pad-session-values-to-1025-bytes-by-default.patch new file mode 100644 index 0000000..dbc4cf9 --- /dev/null +++ b/0002-pad-session-values-to-1025-bytes-by-default.patch @@ -0,0 +1,92 @@ +From 4e660c4659cb1cde53db2b6591c32fdf09334c2a Mon Sep 17 00:00:00 2001 +From: Joel Berger <joel.a.berger(a)gmail.com> +Date: Tue, 1 Jun 2021 13:39:54 -0500 +Subject: [PATCH 2/2] pad session values to 1025 bytes by default + +--- + lib/Mojolicious/Sessions.pm | 12 ++++++++++-- + t/mojolicious/lite_app.t | 30 ++++++++++++++++++++++++++++++ + 2 files changed, 40 insertions(+), 2 deletions(-) + +diff --git a/lib/Mojolicious/Sessions.pm b/lib/Mojolicious/Sessions.pm +index 6056105fa..989ad5faa 100644 +--- a/lib/Mojolicious/Sessions.pm ++++ b/lib/Mojolicious/Sessions.pm +@@ -8,9 +8,9 @@ has [qw(cookie_domain secure)]; + has cookie_name => 'mojolicious'; + has cookie_path => '/'; + has default_expiration => 3600; +-has deserialize => sub { \&Mojo::JSON::j }; ++has deserialize => sub { \&_deserialize }; + has samesite => 'Lax'; +-has serialize => sub { \&Mojo::JSON::encode_json }; ++has serialize => sub { \&_serialize }; + + sub load { + my ($self, $c) = @_; +@@ -61,6 +61,14 @@ sub store { + $c->signed_cookie($self->cookie_name, $value, $options); + } + ++sub _deserialize { Mojo::JSON::decode_json($_[0] =~ s/\}\KZ*$//r) } ++ ++sub _serialize { ++ no warnings 'numeric'; ++ my $out = Mojo::JSON::encode_json($_[0]); ++ return $out . 'Z' x (1025 - length $out); ++} ++ + 1; + + =encoding utf8 +diff --git a/t/mojolicious/lite_app.t b/t/mojolicious/lite_app.t +index 9a997b4c8..b06fdd1fb 100644 +--- a/t/mojolicious/lite_app.t ++++ b/t/mojolicious/lite_app.t +@@ -276,6 +276,12 @@ get '/session_cookie/2' => sub { + $c->render(text => "Session is $value!"); + }; + ++get '/session_length' => sub { ++ my $c = shift; ++ $c->session->{q} = $c->param('q'); ++ $c->rendered(204); ++}; ++ + get '/foo' => sub { + my $c = shift; + $c->render(text => 'Yea baby!'); +@@ -801,6 +807,30 @@ ok !$t->tx, 'session reset'; + $t->get_ok('/session_cookie/2')->status_is(200)->header_is(Server => 'Mojolicious (Perl)') + ->content_is('Session is missing!'); + ++ ++subtest 'Session length' => sub { ++ my $extract = sub { ++ my $value = $_[0]->tx->res->cookie('mojolicious')->value; ++ $value =~ s/--([^\-]+)$//; ++ $value =~ y/-/=/; ++ return Mojo::Util::b64_decode($value); ++ }; ++ ++ subtest 'Short session' => sub { ++ $t->reset_session; ++ my $value = $t->get_ok('/session_length?q=a')->status_is(204)->$extract; ++ cmp_ok length($value), '>', 1024, 'session is long enough'; ++ ok $value =~ /Z+$/, 'session is padded'; ++ }; ++ ++ subtest 'Long session' => sub { ++ $t->reset_session; ++ my $value = $t->get_ok('/session_length?q=' . 'a' x 1025)->status_is(204)->$extract; ++ cmp_ok length($value), '>', 1024, 'session is long enough'; ++ ok $value !~ /Z+$/, 'session is not padded'; ++ }; ++}; ++ + # Text + $t->get_ok('/foo')->status_is(200)->header_is(Server => 'Mojolicious (Perl)')->content_is('Yea baby!'); + +-- +2.32.0 + diff --git a/perl-Mojolicious.spec b/perl-Mojolicious.spec index 943aa38..19a236b 100644 --- a/perl-Mojolicious.spec +++ b/perl-Mojolicious.spec @@ -1,12 +1,18 @@ Name: perl-Mojolicious Version: 8.73 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A next generation web framework for Perl License: Artistic 2.0 URL: https://metacpan.org/release/Mojolicious Source0: http://cpan.metacpan.org/authors/id/S/SR/SRI/Mojolicious-%{version}.tar.gz +# Security fixes backported from 9.19: +# https://github.com/mojolicious/mojo/commit/3f10b6af0271c4b5b589d2d9c31ea43c… +Patch0: 0001-Switch-from-HMAC-SHA1-to-HMAC-SHA256.patch +# https://github.com/mojolicious/mojo/commit/c99dee43f62ac5d552208ebf494f1147… +Patch1: 0002-pad-session-values-to-1025-bytes-by-default.patch + BuildArch: noarch BuildRequires: coreutils BuildRequires: make @@ -114,7 +120,7 @@ techniques used are outdated now, the idea behind it is not. Mojolicious is a new attempt at implementing this idea using state of the art technology. %prep -%setup -q -n Mojolicious-%{version} +%autosetup -p1 -n Mojolicious-%{version} mv README.md lib/Mojolicious/ %build @@ -143,6 +149,9 @@ mv README.md lib/Mojolicious/ %{perl_vendorlib}/Test %changelog +* Wed Jun 30 2021 Adam Williamson <awilliam(a)redhat.com> - 8.73-2 +- Backport session security fixes from 9.19 + * Sun Feb 07 2021 Emmanuel Seyman <emmanuel(a)seyman.fr> - 8.73-1 - Update to 8.73 https://src.fedoraproject.org/rpms/perl-Mojolicious/c/9ffff020320f2ea937c12…

1 0

adamwill pushed to perl-Mojolicious (f34). "Backport session security fixes from 9.19"
by notifications＠fedoraproject.org 30 Jun '21

30 Jun '21

Notification time stamped 2021-06-30 22:09:05 UTC From 9ffff020320f2ea937c12873fb7e6735d6210aa1 Mon Sep 17 00:00:00 2001 From: Adam Williamson <awilliam(a)redhat.com> Date: Jun 30 2021 22:04:12 +0000 Subject: Backport session security fixes from 9.19 --- diff --git a/0001-Switch-from-HMAC-SHA1-to-HMAC-SHA256.patch b/0001-Switch-from-HMAC-SHA1-to-HMAC-SHA256.patch new file mode 100644 index 0000000..bed436d --- /dev/null +++ b/0001-Switch-from-HMAC-SHA1-to-HMAC-SHA256.patch @@ -0,0 +1,114 @@ +From 1f91263f3c6d5438a43d814171b88409d94bb61a Mon Sep 17 00:00:00 2001 +From: Sebastian Riedel <sri(a)cpan.org> +Date: Tue, 1 Jun 2021 18:32:36 +0200 +Subject: [PATCH 1/2] Switch from HMAC-SHA1 to HMAC-SHA256 + +--- + lib/Mojolicious/Controller.pm | 13 +++++++------ + lib/Mojolicious/Guides/Growing.pod | 8 ++++---- + lib/Mojolicious/Sessions.pm | 2 +- + 3 files changed, 12 insertions(+), 11 deletions(-) + +diff --git a/lib/Mojolicious/Controller.pm b/lib/Mojolicious/Controller.pm +index 9abc56e17..f52adda82 100644 +--- a/lib/Mojolicious/Controller.pm ++++ b/lib/Mojolicious/Controller.pm +@@ -2,7 +2,8 @@ package Mojolicious::Controller; + use Mojo::Base -base; + + # No imports, for security reasons! +-use Carp (); ++use Carp (); ++use Digest::SHA (); + use Mojo::ByteStream; + use Mojo::DynamicMethods -dispatch; + use Mojo::URL; +@@ -83,7 +84,7 @@ sub every_signed_cookie { + + my $valid; + for my $secret (@$secrets) { +- my $check = Mojo::Util::hmac_sha1_sum("$name=$value", $secret); ++ my $check = Digest::SHA::hmac_sha256_hex("$name=$value", $secret); + ++$valid and last if Mojo::Util::secure_compare($signature, $check); + } + if ($valid) { push @results, $value } +@@ -233,7 +234,7 @@ sub signed_cookie { + return $self->every_signed_cookie($name)->[-1] unless defined $value; + + # Response cookie +- my $sum = Mojo::Util::hmac_sha1_sum("$name=$value", $self->app->secrets->[0]); ++ my $sum = Digest::SHA::hmac_sha256_hex("$name=$value", $self->app->secrets->[0]); + return $self->cookie($name, "$value--$sum", $options); + } + +@@ -681,8 +682,8 @@ L<Mojolicious::Plugin::DefaultHelpers/"inactivity_timeout">, which usually defau + $c = $c->session(foo => 'bar'); + + Persistent data storage for the next few requests, all session data gets serialized with L<Mojo::JSON> and stored +-Base64 encoded in HMAC-SHA1 signed cookies, to prevent tampering. Note that cookies usually have a C<4096> byte (4KiB) +-limit, depending on browser. ++Base64 encoded in HMAC-SHA256 signed cookies, to prevent tampering. Note that cookies usually have a C<4096> byte ++(4KiB) limit, depending on browser. + + # Manipulate session + $c->session->{foo} = 'bar'; +@@ -706,7 +707,7 @@ limit, depending on browser. + + Access signed request cookie values and create new signed response cookies. If there are multiple values sharing the + same name, and you want to access more than just the last one, you can use L</"every_signed_cookie">. Cookies are +-cryptographically signed with HMAC-SHA1, to prevent tampering, and the ones failing signature verification will be ++cryptographically signed with HMAC-SHA256, to prevent tampering, and the ones failing signature verification will be + automatically discarded. + + =head2 stash +diff --git a/lib/Mojolicious/Guides/Growing.pod b/lib/Mojolicious/Guides/Growing.pod +index c3fef407e..c8e152dba 100644 +--- a/lib/Mojolicious/Guides/Growing.pod ++++ b/lib/Mojolicious/Guides/Growing.pod +@@ -100,10 +100,10 @@ information across several HTTP requests. + Traditionally all session data was stored on the server-side and only session ids were exchanged between browser and + web server in the form of cookies. + +- Set-Cookie: session=hmac-sha1(base64(json($session))) ++ Set-Cookie: session=hmac-sha256(base64(json($session))) + + In L<Mojolicious> however we are taking this concept one step further by storing everything JSON serialized and Base64 +-encoded in HMAC-SHA1 signed cookies, which is more compatible with the REST philosophy and reduces infrastructure ++encoded in HMAC-SHA256 signed cookies, which is more compatible with the REST philosophy and reduces infrastructure + requirements. + + =head2 Test-Driven Development +@@ -378,7 +378,7 @@ L<Mojolicious/"secrets">. + + $app->secrets(['Mojolicious rocks']); + +-This passphrase is used by the HMAC-SHA1 algorithm to make signed cookies tamper resistant and can be changed at any ++This passphrase is used by the HMAC-SHA256 algorithm to make signed cookies tamper resistant and can be changed at any + time to invalidate all existing sessions. + + $c->session(user => 'sebastian'); +@@ -401,7 +401,7 @@ L<Mojolicious::Plugin::DefaultHelpers/"flash">. + $c->flash(message => 'Everything is fine.'); + $c->redirect_to('goodbye'); + +-Just remember that all session data gets serialized with L<Mojo::JSON> and stored in HMAC-SHA1 signed cookies, which ++Just remember that all session data gets serialized with L<Mojo::JSON> and stored in HMAC-SHA256 signed cookies, which + usually have a C<4096> byte (4KiB) limit, depending on browser. + + =head2 Final prototype +diff --git a/lib/Mojolicious/Sessions.pm b/lib/Mojolicious/Sessions.pm +index 2f7f21c2b..6056105fa 100644 +--- a/lib/Mojolicious/Sessions.pm ++++ b/lib/Mojolicious/Sessions.pm +@@ -80,7 +80,7 @@ Mojolicious::Sessions - Session manager based on signed cookies + =head1 DESCRIPTION + + L<Mojolicious::Sessions> manages sessions based on signed cookies for L<Mojolicious>. All data gets serialized with +-L<Mojo::JSON> and stored Base64 encoded on the client-side, but is protected from unwanted changes with a HMAC-SHA1 ++L<Mojo::JSON> and stored Base64 encoded on the client-side, but is protected from unwanted changes with a HMAC-SHA256 + signature. + + =head1 ATTRIBUTES +-- +2.32.0 + diff --git a/0002-pad-session-values-to-1025-bytes-by-default.patch b/0002-pad-session-values-to-1025-bytes-by-default.patch new file mode 100644 index 0000000..dbc4cf9 --- /dev/null +++ b/0002-pad-session-values-to-1025-bytes-by-default.patch @@ -0,0 +1,92 @@ +From 4e660c4659cb1cde53db2b6591c32fdf09334c2a Mon Sep 17 00:00:00 2001 +From: Joel Berger <joel.a.berger(a)gmail.com> +Date: Tue, 1 Jun 2021 13:39:54 -0500 +Subject: [PATCH 2/2] pad session values to 1025 bytes by default + +--- + lib/Mojolicious/Sessions.pm | 12 ++++++++++-- + t/mojolicious/lite_app.t | 30 ++++++++++++++++++++++++++++++ + 2 files changed, 40 insertions(+), 2 deletions(-) + +diff --git a/lib/Mojolicious/Sessions.pm b/lib/Mojolicious/Sessions.pm +index 6056105fa..989ad5faa 100644 +--- a/lib/Mojolicious/Sessions.pm ++++ b/lib/Mojolicious/Sessions.pm +@@ -8,9 +8,9 @@ has [qw(cookie_domain secure)]; + has cookie_name => 'mojolicious'; + has cookie_path => '/'; + has default_expiration => 3600; +-has deserialize => sub { \&Mojo::JSON::j }; ++has deserialize => sub { \&_deserialize }; + has samesite => 'Lax'; +-has serialize => sub { \&Mojo::JSON::encode_json }; ++has serialize => sub { \&_serialize }; + + sub load { + my ($self, $c) = @_; +@@ -61,6 +61,14 @@ sub store { + $c->signed_cookie($self->cookie_name, $value, $options); + } + ++sub _deserialize { Mojo::JSON::decode_json($_[0] =~ s/\}\KZ*$//r) } ++ ++sub _serialize { ++ no warnings 'numeric'; ++ my $out = Mojo::JSON::encode_json($_[0]); ++ return $out . 'Z' x (1025 - length $out); ++} ++ + 1; + + =encoding utf8 +diff --git a/t/mojolicious/lite_app.t b/t/mojolicious/lite_app.t +index 9a997b4c8..b06fdd1fb 100644 +--- a/t/mojolicious/lite_app.t ++++ b/t/mojolicious/lite_app.t +@@ -276,6 +276,12 @@ get '/session_cookie/2' => sub { + $c->render(text => "Session is $value!"); + }; + ++get '/session_length' => sub { ++ my $c = shift; ++ $c->session->{q} = $c->param('q'); ++ $c->rendered(204); ++}; ++ + get '/foo' => sub { + my $c = shift; + $c->render(text => 'Yea baby!'); +@@ -801,6 +807,30 @@ ok !$t->tx, 'session reset'; + $t->get_ok('/session_cookie/2')->status_is(200)->header_is(Server => 'Mojolicious (Perl)') + ->content_is('Session is missing!'); + ++ ++subtest 'Session length' => sub { ++ my $extract = sub { ++ my $value = $_[0]->tx->res->cookie('mojolicious')->value; ++ $value =~ s/--([^\-]+)$//; ++ $value =~ y/-/=/; ++ return Mojo::Util::b64_decode($value); ++ }; ++ ++ subtest 'Short session' => sub { ++ $t->reset_session; ++ my $value = $t->get_ok('/session_length?q=a')->status_is(204)->$extract; ++ cmp_ok length($value), '>', 1024, 'session is long enough'; ++ ok $value =~ /Z+$/, 'session is padded'; ++ }; ++ ++ subtest 'Long session' => sub { ++ $t->reset_session; ++ my $value = $t->get_ok('/session_length?q=' . 'a' x 1025)->status_is(204)->$extract; ++ cmp_ok length($value), '>', 1024, 'session is long enough'; ++ ok $value !~ /Z+$/, 'session is not padded'; ++ }; ++}; ++ + # Text + $t->get_ok('/foo')->status_is(200)->header_is(Server => 'Mojolicious (Perl)')->content_is('Yea baby!'); + +-- +2.32.0 + diff --git a/perl-Mojolicious.spec b/perl-Mojolicious.spec index 943aa38..19a236b 100644 --- a/perl-Mojolicious.spec +++ b/perl-Mojolicious.spec @@ -1,12 +1,18 @@ Name: perl-Mojolicious Version: 8.73 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A next generation web framework for Perl License: Artistic 2.0 URL: https://metacpan.org/release/Mojolicious Source0: http://cpan.metacpan.org/authors/id/S/SR/SRI/Mojolicious-%{version}.tar.gz +# Security fixes backported from 9.19: +# https://github.com/mojolicious/mojo/commit/3f10b6af0271c4b5b589d2d9c31ea43c… +Patch0: 0001-Switch-from-HMAC-SHA1-to-HMAC-SHA256.patch +# https://github.com/mojolicious/mojo/commit/c99dee43f62ac5d552208ebf494f1147… +Patch1: 0002-pad-session-values-to-1025-bytes-by-default.patch + BuildArch: noarch BuildRequires: coreutils BuildRequires: make @@ -114,7 +120,7 @@ techniques used are outdated now, the idea behind it is not. Mojolicious is a new attempt at implementing this idea using state of the art technology. %prep -%setup -q -n Mojolicious-%{version} +%autosetup -p1 -n Mojolicious-%{version} mv README.md lib/Mojolicious/ %build @@ -143,6 +149,9 @@ mv README.md lib/Mojolicious/ %{perl_vendorlib}/Test %changelog +* Wed Jun 30 2021 Adam Williamson <awilliam(a)redhat.com> - 8.73-2 +- Backport session security fixes from 9.19 + * Sun Feb 07 2021 Emmanuel Seyman <emmanuel(a)seyman.fr> - 8.73-1 - Update to 8.73 https://src.fedoraproject.org/rpms/perl-Mojolicious/c/9ffff020320f2ea937c12…

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

scm-commits June 2021