crobinso pushed to qemu (rawhide). "spec: Re-disable tests for
power64, still intermittently hanging (..more)"
by notificationsï¼ fedoraproject.org
Notification time stamped 2021-06-30 22:54:27 UTC
From f4c1719ae12b251b9c11a5f22c8876df960e2960 Mon Sep 17 00:00:00 2001
From: Cole Robinson <crobinso(a)redhat.com>
Date: Jun 30 2021 22:53:18 +0000
Subject: spec: Re-disable tests for power64, still intermittently hanging
Signed-off-by: Cole Robinson <crobinso(a)redhat.com>
---
diff --git a/qemu.spec b/qemu.spec
index 300e75b..47b783e 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -1701,7 +1701,8 @@ echo "Testing %{name}-build"
# 2021-06: s390x tests randomly failing with 'Broken pipe' errors
# dhorak couldn't reproduce locally on an s390x machine so guessed
# it's a resource issue
-%ifnarch s390x
+# 2021-07: ppc64le intermittently hanging
+%ifnarch s390x %{power64}
make check V=1
%endif
https://src.fedoraproject.org/rpms/qemu/c/f4c1719ae12b251b9c11a5f22c8876d...
2Â years, 2Â months
nickblack pushed to notcurses (f33). "Merge branch 'main' into f33"
by notificationsï¼ fedoraproject.org
Notification time stamped 2021-06-30 22:49:43 UTC
From b7f673a27908240d4bbcdc4770fbc70b786c739e Mon Sep 17 00:00:00 2001
From: Nick Black <dankamongmen(a)gmail.com>
Date: Jun 30 2021 22:49:23 +0000
Subject: Merge branch 'main' into f33
---
diff --git a/notcurses.spec b/notcurses.spec
index 39f872a..4ce26e5 100644
--- a/notcurses.spec
+++ b/notcurses.spec
@@ -1,5 +1,5 @@
Name: notcurses
-Version: 2.3.6
+Version: 2.3.7
Release: 1%{?dist}
Summary: Character graphics and TUI library
License: ASL 2.0
@@ -144,6 +144,9 @@ cd cffi
%{python3_sitearch}/*.so
%changelog
+* Tue Jun 29 2021 Nick Black <dankamongmen(a)gmail.com> - 2.3.7-1
+- New upstream release
+
* Wed Jun 23 2021 Nick Black <dankamongmen(a)gmail.com> - 2.3.6-1
- New upstream release
https://src.fedoraproject.org/rpms/notcurses/c/b7f673a27908240d4bbcdc4770...
2Â years, 2Â months
nickblack pushed to notcurses (f33). "new upstream 2.3.7"
by notificationsï¼ fedoraproject.org
Notification time stamped 2021-06-30 22:49:43 UTC
From b6365cfaaf8379b8bd329d1a94b7bdc466a45c02 Mon Sep 17 00:00:00 2001
From: Nick Black <dankamongmen(a)gmail.com>
Date: Jun 30 2021 22:49:32 +0000
Subject: new upstream 2.3.7
---
diff --git a/.gitignore b/.gitignore
index aaa9d7e..8852370 100644
--- a/.gitignore
+++ b/.gitignore
@@ -151,3 +151,6 @@
/notcurses-2.3.5-1.fc35.src.rpm
/notcurses_2.3.6+dfsg.1.orig.tar.xz
/notcurses_2.3.6+dfsg.1.orig.tar.xz.asc
+/notcurses-2.3.7-1.fc34.src.rpm
+/notcurses_2.3.7+dfsg.1.orig.tar.xz
+/notcurses_2.3.7+dfsg.1.orig.tar.xz.asc
diff --git a/sources b/sources
index d9dea97..ebdd4cb 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,3 @@
-SHA512 (notcurses_2.3.6+dfsg.1.orig.tar.xz) = 93165928e683c2b0044649a32c35f4dffe96f6a2e38f6eddaac5334570b70038ee9eef12e23d62d4ee1bb6802436d26f4ffb2f0cbaf8216b551a1f1fc333ecbe
-SHA512 (notcurses_2.3.6+dfsg.1.orig.tar.xz.asc) = b54d57b9d3ceae8ae50b6cd2e126b29c3ec8b542e3c8538a216e0ae0d6e7ce1deff38b79cce3ff13c63fe3a09509b8b601e05e94f98a177334d5de31c696e00f
+SHA512 (notcurses-2.3.7-1.fc34.src.rpm) = 12e618a5fd5d7ecbd84504a7d963d9ef180e00dd73b47b6d9948813c925b9b9c6323c463ccc8d2f7d579c9c43bdbe21ff27248d0ce2187f3fbd327715736a607
+SHA512 (notcurses_2.3.7+dfsg.1.orig.tar.xz) = 95748b53e79e9aa44228b29eb7edd7ad66c317fff2f965f2b783317059806386e5cb5a334076106ff5286de17b1a02a060cda58e3516a17bcb6feb80a985ae61
+SHA512 (notcurses_2.3.7+dfsg.1.orig.tar.xz.asc) = d63c3e7fc6f1ea243cf96713192a456d772b677deda2f998465c39367a39c639e4752c33ee7ec3fb4de3a2138f4f5114455d9361da0bc41b23820e3b12025525
https://src.fedoraproject.org/rpms/notcurses/c/b6365cfaaf8379b8bd329d1a94...
2Â years, 2Â months
nickblack pushed to notcurses (f33). "new upstream 2.3.7"
by notificationsï¼ fedoraproject.org
Notification time stamped 2021-06-30 22:49:43 UTC
From 3843e8ecab67af7f16631332bdb8f0390186296f Mon Sep 17 00:00:00 2001
From: Nick Black <dankamongmen(a)gmail.com>
Date: Jun 29 2021 11:49:18 +0000
Subject: new upstream 2.3.7
---
diff --git a/notcurses.spec b/notcurses.spec
index db7ceef..6097471 100644
--- a/notcurses.spec
+++ b/notcurses.spec
@@ -1,5 +1,5 @@
Name: notcurses
-Version: 2.3.6
+Version: 2.3.7
Release: 1%{?dist}
Summary: Character graphics and TUI library
License: ASL 2.0
@@ -144,6 +144,9 @@ cd cffi
%{python3_sitearch}/*.so
%changelog
+* Tue Jun 29 2021 Nick Black <dankamongmen(a)gmail.com> - 2.3.7-1
+- New upstream release
+
* Wed Jun 23 2021 Nick Black <dankamongmen(a)gmail.com> - 2.3.6-1
- New upstream release
https://src.fedoraproject.org/rpms/notcurses/c/3843e8ecab67af7f16631332bd...
2Â years, 2Â months
nickblack pushed to notcurses (f34). "new upstream 2.3.7"
by notificationsï¼ fedoraproject.org
Notification time stamped 2021-06-30 22:27:29 UTC
From 5e7d84d56f78480335bec15625db3f01561f958a Mon Sep 17 00:00:00 2001
From: Nick Black <dankamongmen(a)gmail.com>
Date: Jun 30 2021 22:27:05 +0000
Subject: new upstream 2.3.7
---
diff --git a/.gitignore b/.gitignore
index aaa9d7e..0e2509e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -151,3 +151,5 @@
/notcurses-2.3.5-1.fc35.src.rpm
/notcurses_2.3.6+dfsg.1.orig.tar.xz
/notcurses_2.3.6+dfsg.1.orig.tar.xz.asc
+/notcurses_2.3.7+dfsg.1.orig.tar.xz
+/notcurses_2.3.7+dfsg.1.orig.tar.xz.asc
diff --git a/sources b/sources
index d9dea97..fc57e2e 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (notcurses_2.3.6+dfsg.1.orig.tar.xz) = 93165928e683c2b0044649a32c35f4dffe96f6a2e38f6eddaac5334570b70038ee9eef12e23d62d4ee1bb6802436d26f4ffb2f0cbaf8216b551a1f1fc333ecbe
-SHA512 (notcurses_2.3.6+dfsg.1.orig.tar.xz.asc) = b54d57b9d3ceae8ae50b6cd2e126b29c3ec8b542e3c8538a216e0ae0d6e7ce1deff38b79cce3ff13c63fe3a09509b8b601e05e94f98a177334d5de31c696e00f
+SHA512 (notcurses_2.3.7+dfsg.1.orig.tar.xz) = 95748b53e79e9aa44228b29eb7edd7ad66c317fff2f965f2b783317059806386e5cb5a334076106ff5286de17b1a02a060cda58e3516a17bcb6feb80a985ae61
+SHA512 (notcurses_2.3.7+dfsg.1.orig.tar.xz.asc) = d63c3e7fc6f1ea243cf96713192a456d772b677deda2f998465c39367a39c639e4752c33ee7ec3fb4de3a2138f4f5114455d9361da0bc41b23820e3b12025525
https://src.fedoraproject.org/rpms/notcurses/c/5e7d84d56f78480335bec15625...
2Â years, 2Â months
tstellar pushed to llvm (rawhide). "12.0.1-rc3 Release"
by notificationsï¼ fedoraproject.org
Notification time stamped 2021-06-30 22:23:20 UTC
From 086ce6b60e883dc9cc3894885b34117062ae3cbe Mon Sep 17 00:00:00 2001
From: Tom Stellard <tstellar(a)redhat.com>
Date: Jun 30 2021 12:49:06 +0000
Subject: 12.0.1-rc3 Release
---
diff --git a/.gitignore b/.gitignore
index bf68e80..cee6988 100644
--- a/.gitignore
+++ b/.gitignore
@@ -104,3 +104,5 @@
/llvm-12.0.0.src.tar.xz.sig
/llvm-12.0.1rc1.src.tar.xz
/llvm-12.0.1rc1.src.tar.xz.sig
+/llvm-12.0.1rc3.src.tar.xz
+/llvm-12.0.1rc3.src.tar.xz.sig
diff --git a/llvm.spec b/llvm.spec
index c683c77..5406da7 100644
--- a/llvm.spec
+++ b/llvm.spec
@@ -10,7 +10,7 @@
%global llvm_libdir %{_libdir}/%{name}
%global build_llvm_libdir %{buildroot}%{llvm_libdir}
-%global rc_ver 1
+%global rc_ver 3
%global maj_ver 12
%global min_ver 0
%global patch_ver 1
@@ -48,7 +48,7 @@
Name: %{pkg_name}
Version: %{maj_ver}.%{min_ver}.%{patch_ver}%{?rc_ver:~rc%{rc_ver}}
-Release: 2%{?dist}
+Release: 1%{?dist}
Summary: The Low Level Virtual Machine
License: NCSA
@@ -499,6 +499,9 @@ fi
%endif
%changelog
+* Wed Jun 30 2021 Tom Stellard <tstellar(a)redhat.com> - llvm-12.0.1~rc3-1
+- 12.0.1-rc3 Release
+
* Fri May 28 2021 Tom Stellard <tstellar(a)redhat.com> - 12.0.1~rc1-2
- Stop installing lit tests
diff --git a/sources b/sources
index f6201b6..c810e63 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (llvm-12.0.1rc1.src.tar.xz) = ac9dc0353f5f6c47478c6e0911364e97676484a64b20eeba19eebac7728ac174f55d36a02e8a668a0959640cfddfbeb887b8a03dd1f6fbddede1ad446021149c
-SHA512 (llvm-12.0.1rc1.src.tar.xz.sig) = db2d38d60a64bfa18c58903c2423c3eeb6a6141d0ca5921afb0e1d6478be1a3d8720a3175369e930b19a65033350314328340707019bf359ab85f248478fdcfb
+SHA512 (llvm-12.0.1rc3.src.tar.xz) = c8ef7c4ba0122a1ea5145042274a35e3e75ebd4f197005d25ccce25250f516a3fe81f043800bd370c52739585b1da033713e4277d00f192e9038cc4e82cce919
+SHA512 (llvm-12.0.1rc3.src.tar.xz.sig) = 41ec675cf0efd612ec36fd54ca1bfd013b783df603b06d22f820353b0fffb643bde2c89030cbd81da44737a50eb6e108f655c1bb393bdb56cee0d751657ed61d
https://src.fedoraproject.org/rpms/llvm/c/086ce6b60e883dc9cc3894885b34117...
2Â years, 2Â months
packagerbot pushed to dummy-test-package-gloster (rawhide). "Bump
release (..more)"
by notificationsï¼ fedoraproject.org
Notification time stamped 2021-06-30 22:21:55 UTC
From 1d27527e9059ad6a0d5dc6a40d3082ec466d567f Mon Sep 17 00:00:00 2001
From: packagerbot <admin(a)fedoraproject.org>
Date: Jun 30 2021 22:21:50 +0000
Subject: Bump release
Signed-off-by: packagerbot <admin(a)fedoraproject.org>
---
diff --git a/dummy-test-package-gloster.spec b/dummy-test-package-gloster.spec
index 5bb0727..8c501a4 100644
--- a/dummy-test-package-gloster.spec
+++ b/dummy-test-package-gloster.spec
@@ -3,7 +3,7 @@
Name: dummy-test-package-gloster
Version: 0
-Release: 4284%{?dist}
+Release: 4285%{?dist}
Summary: Dummy Test Package called Gloster
License: CC0
URL: http://fedoraproject.org/wiki/DummyTestPackages
@@ -32,6 +32,9 @@ cp -p uuid %{buildroot}%{_datadir}/%{name}
%{_datadir}/%{name}
%changelog
+* Wed Jun 30 2021 packagerbot <admin(a)fedoraproject.org> - 0-4285
+- rebuilt
+
* Wed Jun 30 2021 packagerbot <admin(a)fedoraproject.org> - 0-4284
- rebuilt
https://src.fedoraproject.org/rpms/dummy-test-package-gloster/c/1d27527e9...
2Â years, 2Â months
adamwill pushed to perl-Mojolicious (f33). "Backport session security
fixes from 9.19"
by notificationsï¼ fedoraproject.org
Notification time stamped 2021-06-30 22:17:25 UTC
From 9ffff020320f2ea937c12873fb7e6735d6210aa1 Mon Sep 17 00:00:00 2001
From: Adam Williamson <awilliam(a)redhat.com>
Date: Jun 30 2021 22:04:12 +0000
Subject: Backport session security fixes from 9.19
---
diff --git a/0001-Switch-from-HMAC-SHA1-to-HMAC-SHA256.patch b/0001-Switch-from-HMAC-SHA1-to-HMAC-SHA256.patch
new file mode 100644
index 0000000..bed436d
--- /dev/null
+++ b/0001-Switch-from-HMAC-SHA1-to-HMAC-SHA256.patch
@@ -0,0 +1,114 @@
+From 1f91263f3c6d5438a43d814171b88409d94bb61a Mon Sep 17 00:00:00 2001
+From: Sebastian Riedel <sri(a)cpan.org>
+Date: Tue, 1 Jun 2021 18:32:36 +0200
+Subject: [PATCH 1/2] Switch from HMAC-SHA1 to HMAC-SHA256
+
+---
+ lib/Mojolicious/Controller.pm | 13 +++++++------
+ lib/Mojolicious/Guides/Growing.pod | 8 ++++----
+ lib/Mojolicious/Sessions.pm | 2 +-
+ 3 files changed, 12 insertions(+), 11 deletions(-)
+
+diff --git a/lib/Mojolicious/Controller.pm b/lib/Mojolicious/Controller.pm
+index 9abc56e17..f52adda82 100644
+--- a/lib/Mojolicious/Controller.pm
++++ b/lib/Mojolicious/Controller.pm
+@@ -2,7 +2,8 @@ package Mojolicious::Controller;
+ use Mojo::Base -base;
+
+ # No imports, for security reasons!
+-use Carp ();
++use Carp ();
++use Digest::SHA ();
+ use Mojo::ByteStream;
+ use Mojo::DynamicMethods -dispatch;
+ use Mojo::URL;
+@@ -83,7 +84,7 @@ sub every_signed_cookie {
+
+ my $valid;
+ for my $secret (@$secrets) {
+- my $check = Mojo::Util::hmac_sha1_sum("$name=$value", $secret);
++ my $check = Digest::SHA::hmac_sha256_hex("$name=$value", $secret);
+ ++$valid and last if Mojo::Util::secure_compare($signature, $check);
+ }
+ if ($valid) { push @results, $value }
+@@ -233,7 +234,7 @@ sub signed_cookie {
+ return $self->every_signed_cookie($name)->[-1] unless defined $value;
+
+ # Response cookie
+- my $sum = Mojo::Util::hmac_sha1_sum("$name=$value", $self->app->secrets->[0]);
++ my $sum = Digest::SHA::hmac_sha256_hex("$name=$value", $self->app->secrets->[0]);
+ return $self->cookie($name, "$value--$sum", $options);
+ }
+
+@@ -681,8 +682,8 @@ L<Mojolicious::Plugin::DefaultHelpers/"inactivity_timeout">, which usually defau
+ $c = $c->session(foo => 'bar');
+
+ Persistent data storage for the next few requests, all session data gets serialized with L<Mojo::JSON> and stored
+-Base64 encoded in HMAC-SHA1 signed cookies, to prevent tampering. Note that cookies usually have a C<4096> byte (4KiB)
+-limit, depending on browser.
++Base64 encoded in HMAC-SHA256 signed cookies, to prevent tampering. Note that cookies usually have a C<4096> byte
++(4KiB) limit, depending on browser.
+
+ # Manipulate session
+ $c->session->{foo} = 'bar';
+@@ -706,7 +707,7 @@ limit, depending on browser.
+
+ Access signed request cookie values and create new signed response cookies. If there are multiple values sharing the
+ same name, and you want to access more than just the last one, you can use L</"every_signed_cookie">. Cookies are
+-cryptographically signed with HMAC-SHA1, to prevent tampering, and the ones failing signature verification will be
++cryptographically signed with HMAC-SHA256, to prevent tampering, and the ones failing signature verification will be
+ automatically discarded.
+
+ =head2 stash
+diff --git a/lib/Mojolicious/Guides/Growing.pod b/lib/Mojolicious/Guides/Growing.pod
+index c3fef407e..c8e152dba 100644
+--- a/lib/Mojolicious/Guides/Growing.pod
++++ b/lib/Mojolicious/Guides/Growing.pod
+@@ -100,10 +100,10 @@ information across several HTTP requests.
+ Traditionally all session data was stored on the server-side and only session ids were exchanged between browser and
+ web server in the form of cookies.
+
+- Set-Cookie: session=hmac-sha1(base64(json($session)))
++ Set-Cookie: session=hmac-sha256(base64(json($session)))
+
+ In L<Mojolicious> however we are taking this concept one step further by storing everything JSON serialized and Base64
+-encoded in HMAC-SHA1 signed cookies, which is more compatible with the REST philosophy and reduces infrastructure
++encoded in HMAC-SHA256 signed cookies, which is more compatible with the REST philosophy and reduces infrastructure
+ requirements.
+
+ =head2 Test-Driven Development
+@@ -378,7 +378,7 @@ L<Mojolicious/"secrets">.
+
+ $app->secrets(['Mojolicious rocks']);
+
+-This passphrase is used by the HMAC-SHA1 algorithm to make signed cookies tamper resistant and can be changed at any
++This passphrase is used by the HMAC-SHA256 algorithm to make signed cookies tamper resistant and can be changed at any
+ time to invalidate all existing sessions.
+
+ $c->session(user => 'sebastian');
+@@ -401,7 +401,7 @@ L<Mojolicious::Plugin::DefaultHelpers/"flash">.
+ $c->flash(message => 'Everything is fine.');
+ $c->redirect_to('goodbye');
+
+-Just remember that all session data gets serialized with L<Mojo::JSON> and stored in HMAC-SHA1 signed cookies, which
++Just remember that all session data gets serialized with L<Mojo::JSON> and stored in HMAC-SHA256 signed cookies, which
+ usually have a C<4096> byte (4KiB) limit, depending on browser.
+
+ =head2 Final prototype
+diff --git a/lib/Mojolicious/Sessions.pm b/lib/Mojolicious/Sessions.pm
+index 2f7f21c2b..6056105fa 100644
+--- a/lib/Mojolicious/Sessions.pm
++++ b/lib/Mojolicious/Sessions.pm
+@@ -80,7 +80,7 @@ Mojolicious::Sessions - Session manager based on signed cookies
+ =head1 DESCRIPTION
+
+ L<Mojolicious::Sessions> manages sessions based on signed cookies for L<Mojolicious>. All data gets serialized with
+-L<Mojo::JSON> and stored Base64 encoded on the client-side, but is protected from unwanted changes with a HMAC-SHA1
++L<Mojo::JSON> and stored Base64 encoded on the client-side, but is protected from unwanted changes with a HMAC-SHA256
+ signature.
+
+ =head1 ATTRIBUTES
+--
+2.32.0
+
diff --git a/0002-pad-session-values-to-1025-bytes-by-default.patch b/0002-pad-session-values-to-1025-bytes-by-default.patch
new file mode 100644
index 0000000..dbc4cf9
--- /dev/null
+++ b/0002-pad-session-values-to-1025-bytes-by-default.patch
@@ -0,0 +1,92 @@
+From 4e660c4659cb1cde53db2b6591c32fdf09334c2a Mon Sep 17 00:00:00 2001
+From: Joel Berger <joel.a.berger(a)gmail.com>
+Date: Tue, 1 Jun 2021 13:39:54 -0500
+Subject: [PATCH 2/2] pad session values to 1025 bytes by default
+
+---
+ lib/Mojolicious/Sessions.pm | 12 ++++++++++--
+ t/mojolicious/lite_app.t | 30 ++++++++++++++++++++++++++++++
+ 2 files changed, 40 insertions(+), 2 deletions(-)
+
+diff --git a/lib/Mojolicious/Sessions.pm b/lib/Mojolicious/Sessions.pm
+index 6056105fa..989ad5faa 100644
+--- a/lib/Mojolicious/Sessions.pm
++++ b/lib/Mojolicious/Sessions.pm
+@@ -8,9 +8,9 @@ has [qw(cookie_domain secure)];
+ has cookie_name => 'mojolicious';
+ has cookie_path => '/';
+ has default_expiration => 3600;
+-has deserialize => sub { \&Mojo::JSON::j };
++has deserialize => sub { \&_deserialize };
+ has samesite => 'Lax';
+-has serialize => sub { \&Mojo::JSON::encode_json };
++has serialize => sub { \&_serialize };
+
+ sub load {
+ my ($self, $c) = @_;
+@@ -61,6 +61,14 @@ sub store {
+ $c->signed_cookie($self->cookie_name, $value, $options);
+ }
+
++sub _deserialize { Mojo::JSON::decode_json($_[0] =~ s/\}\KZ*$//r) }
++
++sub _serialize {
++ no warnings 'numeric';
++ my $out = Mojo::JSON::encode_json($_[0]);
++ return $out . 'Z' x (1025 - length $out);
++}
++
+ 1;
+
+ =encoding utf8
+diff --git a/t/mojolicious/lite_app.t b/t/mojolicious/lite_app.t
+index 9a997b4c8..b06fdd1fb 100644
+--- a/t/mojolicious/lite_app.t
++++ b/t/mojolicious/lite_app.t
+@@ -276,6 +276,12 @@ get '/session_cookie/2' => sub {
+ $c->render(text => "Session is $value!");
+ };
+
++get '/session_length' => sub {
++ my $c = shift;
++ $c->session->{q} = $c->param('q');
++ $c->rendered(204);
++};
++
+ get '/foo' => sub {
+ my $c = shift;
+ $c->render(text => 'Yea baby!');
+@@ -801,6 +807,30 @@ ok !$t->tx, 'session reset';
+ $t->get_ok('/session_cookie/2')->status_is(200)->header_is(Server => 'Mojolicious (Perl)')
+ ->content_is('Session is missing!');
+
++
++subtest 'Session length' => sub {
++ my $extract = sub {
++ my $value = $_[0]->tx->res->cookie('mojolicious')->value;
++ $value =~ s/--([^\-]+)$//;
++ $value =~ y/-/=/;
++ return Mojo::Util::b64_decode($value);
++ };
++
++ subtest 'Short session' => sub {
++ $t->reset_session;
++ my $value = $t->get_ok('/session_length?q=a')->status_is(204)->$extract;
++ cmp_ok length($value), '>', 1024, 'session is long enough';
++ ok $value =~ /Z+$/, 'session is padded';
++ };
++
++ subtest 'Long session' => sub {
++ $t->reset_session;
++ my $value = $t->get_ok('/session_length?q=' . 'a' x 1025)->status_is(204)->$extract;
++ cmp_ok length($value), '>', 1024, 'session is long enough';
++ ok $value !~ /Z+$/, 'session is not padded';
++ };
++};
++
+ # Text
+ $t->get_ok('/foo')->status_is(200)->header_is(Server => 'Mojolicious (Perl)')->content_is('Yea baby!');
+
+--
+2.32.0
+
diff --git a/perl-Mojolicious.spec b/perl-Mojolicious.spec
index 943aa38..19a236b 100644
--- a/perl-Mojolicious.spec
+++ b/perl-Mojolicious.spec
@@ -1,12 +1,18 @@
Name: perl-Mojolicious
Version: 8.73
-Release: 1%{?dist}
+Release: 2%{?dist}
Summary: A next generation web framework for Perl
License: Artistic 2.0
URL: https://metacpan.org/release/Mojolicious
Source0: http://cpan.metacpan.org/authors/id/S/SR/SRI/Mojolicious-%{version}.tar.gz
+# Security fixes backported from 9.19:
+# https://github.com/mojolicious/mojo/commit/3f10b6af0271c4b5b589d2d9c31ea4...
+Patch0: 0001-Switch-from-HMAC-SHA1-to-HMAC-SHA256.patch
+# https://github.com/mojolicious/mojo/commit/c99dee43f62ac5d552208ebf494f11...
+Patch1: 0002-pad-session-values-to-1025-bytes-by-default.patch
+
BuildArch: noarch
BuildRequires: coreutils
BuildRequires: make
@@ -114,7 +120,7 @@ techniques used are outdated now, the idea behind it is not. Mojolicious is
a new attempt at implementing this idea using state of the art technology.
%prep
-%setup -q -n Mojolicious-%{version}
+%autosetup -p1 -n Mojolicious-%{version}
mv README.md lib/Mojolicious/
%build
@@ -143,6 +149,9 @@ mv README.md lib/Mojolicious/
%{perl_vendorlib}/Test
%changelog
+* Wed Jun 30 2021 Adam Williamson <awilliam(a)redhat.com> - 8.73-2
+- Backport session security fixes from 9.19
+
* Sun Feb 07 2021 Emmanuel Seyman <emmanuel(a)seyman.fr> - 8.73-1
- Update to 8.73
https://src.fedoraproject.org/rpms/perl-Mojolicious/c/9ffff020320f2ea937c...
2Â years, 2Â months
adamwill pushed to perl-Mojolicious (f34). "Backport session security
fixes from 9.19"
by notificationsï¼ fedoraproject.org
Notification time stamped 2021-06-30 22:09:05 UTC
From 9ffff020320f2ea937c12873fb7e6735d6210aa1 Mon Sep 17 00:00:00 2001
From: Adam Williamson <awilliam(a)redhat.com>
Date: Jun 30 2021 22:04:12 +0000
Subject: Backport session security fixes from 9.19
---
diff --git a/0001-Switch-from-HMAC-SHA1-to-HMAC-SHA256.patch b/0001-Switch-from-HMAC-SHA1-to-HMAC-SHA256.patch
new file mode 100644
index 0000000..bed436d
--- /dev/null
+++ b/0001-Switch-from-HMAC-SHA1-to-HMAC-SHA256.patch
@@ -0,0 +1,114 @@
+From 1f91263f3c6d5438a43d814171b88409d94bb61a Mon Sep 17 00:00:00 2001
+From: Sebastian Riedel <sri(a)cpan.org>
+Date: Tue, 1 Jun 2021 18:32:36 +0200
+Subject: [PATCH 1/2] Switch from HMAC-SHA1 to HMAC-SHA256
+
+---
+ lib/Mojolicious/Controller.pm | 13 +++++++------
+ lib/Mojolicious/Guides/Growing.pod | 8 ++++----
+ lib/Mojolicious/Sessions.pm | 2 +-
+ 3 files changed, 12 insertions(+), 11 deletions(-)
+
+diff --git a/lib/Mojolicious/Controller.pm b/lib/Mojolicious/Controller.pm
+index 9abc56e17..f52adda82 100644
+--- a/lib/Mojolicious/Controller.pm
++++ b/lib/Mojolicious/Controller.pm
+@@ -2,7 +2,8 @@ package Mojolicious::Controller;
+ use Mojo::Base -base;
+
+ # No imports, for security reasons!
+-use Carp ();
++use Carp ();
++use Digest::SHA ();
+ use Mojo::ByteStream;
+ use Mojo::DynamicMethods -dispatch;
+ use Mojo::URL;
+@@ -83,7 +84,7 @@ sub every_signed_cookie {
+
+ my $valid;
+ for my $secret (@$secrets) {
+- my $check = Mojo::Util::hmac_sha1_sum("$name=$value", $secret);
++ my $check = Digest::SHA::hmac_sha256_hex("$name=$value", $secret);
+ ++$valid and last if Mojo::Util::secure_compare($signature, $check);
+ }
+ if ($valid) { push @results, $value }
+@@ -233,7 +234,7 @@ sub signed_cookie {
+ return $self->every_signed_cookie($name)->[-1] unless defined $value;
+
+ # Response cookie
+- my $sum = Mojo::Util::hmac_sha1_sum("$name=$value", $self->app->secrets->[0]);
++ my $sum = Digest::SHA::hmac_sha256_hex("$name=$value", $self->app->secrets->[0]);
+ return $self->cookie($name, "$value--$sum", $options);
+ }
+
+@@ -681,8 +682,8 @@ L<Mojolicious::Plugin::DefaultHelpers/"inactivity_timeout">, which usually defau
+ $c = $c->session(foo => 'bar');
+
+ Persistent data storage for the next few requests, all session data gets serialized with L<Mojo::JSON> and stored
+-Base64 encoded in HMAC-SHA1 signed cookies, to prevent tampering. Note that cookies usually have a C<4096> byte (4KiB)
+-limit, depending on browser.
++Base64 encoded in HMAC-SHA256 signed cookies, to prevent tampering. Note that cookies usually have a C<4096> byte
++(4KiB) limit, depending on browser.
+
+ # Manipulate session
+ $c->session->{foo} = 'bar';
+@@ -706,7 +707,7 @@ limit, depending on browser.
+
+ Access signed request cookie values and create new signed response cookies. If there are multiple values sharing the
+ same name, and you want to access more than just the last one, you can use L</"every_signed_cookie">. Cookies are
+-cryptographically signed with HMAC-SHA1, to prevent tampering, and the ones failing signature verification will be
++cryptographically signed with HMAC-SHA256, to prevent tampering, and the ones failing signature verification will be
+ automatically discarded.
+
+ =head2 stash
+diff --git a/lib/Mojolicious/Guides/Growing.pod b/lib/Mojolicious/Guides/Growing.pod
+index c3fef407e..c8e152dba 100644
+--- a/lib/Mojolicious/Guides/Growing.pod
++++ b/lib/Mojolicious/Guides/Growing.pod
+@@ -100,10 +100,10 @@ information across several HTTP requests.
+ Traditionally all session data was stored on the server-side and only session ids were exchanged between browser and
+ web server in the form of cookies.
+
+- Set-Cookie: session=hmac-sha1(base64(json($session)))
++ Set-Cookie: session=hmac-sha256(base64(json($session)))
+
+ In L<Mojolicious> however we are taking this concept one step further by storing everything JSON serialized and Base64
+-encoded in HMAC-SHA1 signed cookies, which is more compatible with the REST philosophy and reduces infrastructure
++encoded in HMAC-SHA256 signed cookies, which is more compatible with the REST philosophy and reduces infrastructure
+ requirements.
+
+ =head2 Test-Driven Development
+@@ -378,7 +378,7 @@ L<Mojolicious/"secrets">.
+
+ $app->secrets(['Mojolicious rocks']);
+
+-This passphrase is used by the HMAC-SHA1 algorithm to make signed cookies tamper resistant and can be changed at any
++This passphrase is used by the HMAC-SHA256 algorithm to make signed cookies tamper resistant and can be changed at any
+ time to invalidate all existing sessions.
+
+ $c->session(user => 'sebastian');
+@@ -401,7 +401,7 @@ L<Mojolicious::Plugin::DefaultHelpers/"flash">.
+ $c->flash(message => 'Everything is fine.');
+ $c->redirect_to('goodbye');
+
+-Just remember that all session data gets serialized with L<Mojo::JSON> and stored in HMAC-SHA1 signed cookies, which
++Just remember that all session data gets serialized with L<Mojo::JSON> and stored in HMAC-SHA256 signed cookies, which
+ usually have a C<4096> byte (4KiB) limit, depending on browser.
+
+ =head2 Final prototype
+diff --git a/lib/Mojolicious/Sessions.pm b/lib/Mojolicious/Sessions.pm
+index 2f7f21c2b..6056105fa 100644
+--- a/lib/Mojolicious/Sessions.pm
++++ b/lib/Mojolicious/Sessions.pm
+@@ -80,7 +80,7 @@ Mojolicious::Sessions - Session manager based on signed cookies
+ =head1 DESCRIPTION
+
+ L<Mojolicious::Sessions> manages sessions based on signed cookies for L<Mojolicious>. All data gets serialized with
+-L<Mojo::JSON> and stored Base64 encoded on the client-side, but is protected from unwanted changes with a HMAC-SHA1
++L<Mojo::JSON> and stored Base64 encoded on the client-side, but is protected from unwanted changes with a HMAC-SHA256
+ signature.
+
+ =head1 ATTRIBUTES
+--
+2.32.0
+
diff --git a/0002-pad-session-values-to-1025-bytes-by-default.patch b/0002-pad-session-values-to-1025-bytes-by-default.patch
new file mode 100644
index 0000000..dbc4cf9
--- /dev/null
+++ b/0002-pad-session-values-to-1025-bytes-by-default.patch
@@ -0,0 +1,92 @@
+From 4e660c4659cb1cde53db2b6591c32fdf09334c2a Mon Sep 17 00:00:00 2001
+From: Joel Berger <joel.a.berger(a)gmail.com>
+Date: Tue, 1 Jun 2021 13:39:54 -0500
+Subject: [PATCH 2/2] pad session values to 1025 bytes by default
+
+---
+ lib/Mojolicious/Sessions.pm | 12 ++++++++++--
+ t/mojolicious/lite_app.t | 30 ++++++++++++++++++++++++++++++
+ 2 files changed, 40 insertions(+), 2 deletions(-)
+
+diff --git a/lib/Mojolicious/Sessions.pm b/lib/Mojolicious/Sessions.pm
+index 6056105fa..989ad5faa 100644
+--- a/lib/Mojolicious/Sessions.pm
++++ b/lib/Mojolicious/Sessions.pm
+@@ -8,9 +8,9 @@ has [qw(cookie_domain secure)];
+ has cookie_name => 'mojolicious';
+ has cookie_path => '/';
+ has default_expiration => 3600;
+-has deserialize => sub { \&Mojo::JSON::j };
++has deserialize => sub { \&_deserialize };
+ has samesite => 'Lax';
+-has serialize => sub { \&Mojo::JSON::encode_json };
++has serialize => sub { \&_serialize };
+
+ sub load {
+ my ($self, $c) = @_;
+@@ -61,6 +61,14 @@ sub store {
+ $c->signed_cookie($self->cookie_name, $value, $options);
+ }
+
++sub _deserialize { Mojo::JSON::decode_json($_[0] =~ s/\}\KZ*$//r) }
++
++sub _serialize {
++ no warnings 'numeric';
++ my $out = Mojo::JSON::encode_json($_[0]);
++ return $out . 'Z' x (1025 - length $out);
++}
++
+ 1;
+
+ =encoding utf8
+diff --git a/t/mojolicious/lite_app.t b/t/mojolicious/lite_app.t
+index 9a997b4c8..b06fdd1fb 100644
+--- a/t/mojolicious/lite_app.t
++++ b/t/mojolicious/lite_app.t
+@@ -276,6 +276,12 @@ get '/session_cookie/2' => sub {
+ $c->render(text => "Session is $value!");
+ };
+
++get '/session_length' => sub {
++ my $c = shift;
++ $c->session->{q} = $c->param('q');
++ $c->rendered(204);
++};
++
+ get '/foo' => sub {
+ my $c = shift;
+ $c->render(text => 'Yea baby!');
+@@ -801,6 +807,30 @@ ok !$t->tx, 'session reset';
+ $t->get_ok('/session_cookie/2')->status_is(200)->header_is(Server => 'Mojolicious (Perl)')
+ ->content_is('Session is missing!');
+
++
++subtest 'Session length' => sub {
++ my $extract = sub {
++ my $value = $_[0]->tx->res->cookie('mojolicious')->value;
++ $value =~ s/--([^\-]+)$//;
++ $value =~ y/-/=/;
++ return Mojo::Util::b64_decode($value);
++ };
++
++ subtest 'Short session' => sub {
++ $t->reset_session;
++ my $value = $t->get_ok('/session_length?q=a')->status_is(204)->$extract;
++ cmp_ok length($value), '>', 1024, 'session is long enough';
++ ok $value =~ /Z+$/, 'session is padded';
++ };
++
++ subtest 'Long session' => sub {
++ $t->reset_session;
++ my $value = $t->get_ok('/session_length?q=' . 'a' x 1025)->status_is(204)->$extract;
++ cmp_ok length($value), '>', 1024, 'session is long enough';
++ ok $value !~ /Z+$/, 'session is not padded';
++ };
++};
++
+ # Text
+ $t->get_ok('/foo')->status_is(200)->header_is(Server => 'Mojolicious (Perl)')->content_is('Yea baby!');
+
+--
+2.32.0
+
diff --git a/perl-Mojolicious.spec b/perl-Mojolicious.spec
index 943aa38..19a236b 100644
--- a/perl-Mojolicious.spec
+++ b/perl-Mojolicious.spec
@@ -1,12 +1,18 @@
Name: perl-Mojolicious
Version: 8.73
-Release: 1%{?dist}
+Release: 2%{?dist}
Summary: A next generation web framework for Perl
License: Artistic 2.0
URL: https://metacpan.org/release/Mojolicious
Source0: http://cpan.metacpan.org/authors/id/S/SR/SRI/Mojolicious-%{version}.tar.gz
+# Security fixes backported from 9.19:
+# https://github.com/mojolicious/mojo/commit/3f10b6af0271c4b5b589d2d9c31ea4...
+Patch0: 0001-Switch-from-HMAC-SHA1-to-HMAC-SHA256.patch
+# https://github.com/mojolicious/mojo/commit/c99dee43f62ac5d552208ebf494f11...
+Patch1: 0002-pad-session-values-to-1025-bytes-by-default.patch
+
BuildArch: noarch
BuildRequires: coreutils
BuildRequires: make
@@ -114,7 +120,7 @@ techniques used are outdated now, the idea behind it is not. Mojolicious is
a new attempt at implementing this idea using state of the art technology.
%prep
-%setup -q -n Mojolicious-%{version}
+%autosetup -p1 -n Mojolicious-%{version}
mv README.md lib/Mojolicious/
%build
@@ -143,6 +149,9 @@ mv README.md lib/Mojolicious/
%{perl_vendorlib}/Test
%changelog
+* Wed Jun 30 2021 Adam Williamson <awilliam(a)redhat.com> - 8.73-2
+- Backport session security fixes from 9.19
+
* Sun Feb 07 2021 Emmanuel Seyman <emmanuel(a)seyman.fr> - 8.73-1
- Update to 8.73
https://src.fedoraproject.org/rpms/perl-Mojolicious/c/9ffff020320f2ea937c...
2Â years, 2Â months