From: Kristian Fiskerstrand Date: Fri, 13 Feb 2015 22:26:51 +0000 (+0000) Subject: Remove vulnerable 2.1 version c.f security bug #540016 X-Git-Url: http://git.tremily.us/?a=commitdiff_plain;h=c2ce920ef562f1894a84c42f89e3836466ca5833;p=gentoo.git Remove vulnerable 2.1 version c.f security bug #540016 Package-Manager: portage-2.2.14/cvs/Linux x86_64 Manifest-Sign-Key: 0xFED5002857C1ABFA! --- diff --git a/app-crypt/gnupg/ChangeLog b/app-crypt/gnupg/ChangeLog index 2af775a202b8..d0f2f0e159ad 100644 --- a/app-crypt/gnupg/ChangeLog +++ b/app-crypt/gnupg/ChangeLog @@ -1,6 +1,9 @@ # ChangeLog for app-crypt/gnupg # Copyright 1999-2015 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/app-crypt/gnupg/ChangeLog,v 1.573 2015/02/13 09:35:33 k_f Exp $ +# $Header: /var/cvsroot/gentoo-x86/app-crypt/gnupg/ChangeLog,v 1.574 2015/02/13 22:26:43 k_f Exp $ + + 13 Feb 2015; Kristian Fiskerstrand -gnupg-2.1.1-r1.ebuild: + Remove vulnerable 2.1 version c.f security bug #540016 *gnupg-2.1.2 (13 Feb 2015) diff --git a/app-crypt/gnupg/Manifest b/app-crypt/gnupg/Manifest index a833b9e6a27d..f889b9c1cef5 100644 --- a/app-crypt/gnupg/Manifest +++ b/app-crypt/gnupg/Manifest @@ -8,24 +8,22 @@ AUX gnupg-2.1.1-misc-cve.patch 3548 SHA256 cef5fabc9b02366a33ed79e35b887fcb47e1d DIST gnupg-1.4.18.tar.bz2 3649557 SHA256 b7b5fdda78849955e0cdbc5a085f3a08f8b7fba126c622085debb62def5d6388 SHA512 f9619ede8e0d2844774e07fb42359444c5ab8e15565a87f419f76cc3d781940c564f35f429131686fdd7559c5c2edb49506b3c0a1feecbd95438743075be3e63 WHIRLPOOL 780876be0603fd0605b192721e2bbb770ad67d98acba8ef0fd769ab3241467696da5f49a189d89600d076691bf2cedb1294ffade5c44f6d24512d6a93a6f8981 DIST gnupg-2.0.25.tar.bz2 4301689 SHA256 b3abe97df096cf53d6a422ac922f3c48e688bc892b7ccf669b92f0b7fc6c5823 SHA512 8b80c86ec53ed3b82d15a8e316baf175691e06e1bcac28d66c61fd37d07e26196a7ee7855e6eb958c301cee764866cc3cf00e5ec0aef23abddf7427bb3d23fb1 WHIRLPOOL 786f3db3af0c96249e128ce3a30dee7e9fbec38d75ed29138f0dfdcbe4f4377c39d4152844087cec0147921eed73c1a01382b542c6a27e86e8bd9265f67e65e2 DIST gnupg-2.0.26.tar.bz2 4303384 SHA256 7758e30dc382ae7a7167ed41b7f936aa50af5ea2d6fccdef663b5b750b65b8e0 SHA512 5dd23baaac764fd48abd235ed52a85a2c7fd68b98fcde45c0f294ddb3b5629e8b1bd894585fbed4e6a6cb2bc4a5552c098c3cf1a849fffa469424fd0a4fee726 WHIRLPOOL 8d9b30337957f6bfeddea29116d862ef0c0ddd06d59bc2799db236b91b2c6767aad6f37f2166fc431c5d9454eb41f49f3e261bc38d0e89361f0c467f4591cd5a -DIST gnupg-2.1.1.tar.bz2 4801472 SHA256 70ecd01d2875db62624c911c2fd815742f50aef5492698eb3bfc09a08690ce49 SHA512 00aea535f18d66fa8053c25633f89acbdfc43c91db568d6b7de0db6b40331edafacd04bf2da0aeef3201642e63baf242504d58f05286cfab4014c062432d7885 WHIRLPOOL d49b164d52188f5a9b47a0892aa81918c21ee71bd85b2b1c27979edf1f303afa5bd94d77ff491d33d6f991057cce1faf347419a784cb64f25ebfe5c1fff78d16 DIST gnupg-2.1.2.tar.bz2 4832996 SHA256 404f5a43d591dfe41f0ffb204b49a1533b67d77bc1fd68febd7e447575616792 SHA512 a12187d32a0d75e4e8ecabe87cd2a49de047dc0d5e601f73779303e0b2f3dad6c2874a665278319e50debd8acb724232be1f1122286ee82c82751063fef07ceb WHIRLPOOL 33f9e7306eb87b35a28489260b2c599164f8c8ac9d4e77d30145402df697a2705062dee02e6d1b904323df953c4b311e9d809216e8657145edd1cf8b1e63a37e EBUILD gnupg-1.4.18.ebuild 3763 SHA256 37cedb3946b555e83111f5096b3dd73f9506175976be10d648f8eb76b0b5fd3a SHA512 3dd165eb15a4946a9e2157549f0da6864e84c054a6369d7053730a899b50c5f05a703c1ce8e208b9de21b135bc8888f0f13835fce50f0e9eec467140e7e63355 WHIRLPOOL 9c64d59b7c444dde1fb601a6ab8d1085525153174b5995009ff7758866e56b88028056b42154fa0e28b3328978e15df515e4c65e65cb667fc17b75fb340e8e15 EBUILD gnupg-2.0.25.ebuild 4716 SHA256 5b0139d96798f1da97dba5074de1ef97b0e778c7b8f3486c3410156d80b16589 SHA512 813f897f335b10b9ca0bbc747251f800531f4725905048d9ad1117a2d1bfccd6d913ae00403bef8aa29a9e3f43cff142ac310e841044bf7052fedc2885f0168e WHIRLPOOL fe7fbc891d1bd49a6bfd8c43e634ddd989482b36a991dc50df910635e66f91b37a5482ca70d71485c360f0d2042eefbba3be46f7129e4425f10aeedf74855796 EBUILD gnupg-2.0.26-r2.ebuild 4854 SHA256 a71843091396ca9e4beeb8feb0cfa36bdf6347c4576ad89535cf4bbf3492a98d SHA512 fdc8d8525f0673bb59fc3e1f6aec19beadf602e15ed14d00da3ccf99926d3e8bf052753eb706c07817035c4ad6294d7c601bedb5afce9dd42154041367eff0cf WHIRLPOOL 41ef8787be1cda4da2321c4eb972619425f8eb6e9a0c9d002b56a9c49f4c3097a1e048bf1e5afd98ceff5d7772bb0aca572c0de4f6126ee862a5c99ea2493d21 EBUILD gnupg-2.0.26-r3.ebuild 4889 SHA256 48c2e76ad50604d0771c4feb68b1cbc79889ff79b494076dcd840baffa3c0bbb SHA512 d6e57d4003247c6ed163ff40c8e924807d7b67a5dc80a67dade78bbb50ccac1df5cee0c8cc7fad3461ccf298a9c08b4118325027d5684ddf06649403d90524bd WHIRLPOOL 8f68c021757b0240ddc0d33532c4cddea74abc34851885d62e78f75e84f5e4d1d8bd23127e5a8541ee1c48ba781aeea5e1ab452e128c4941326c5de7328ea922 EBUILD gnupg-2.0.26.ebuild 4815 SHA256 c1dad0a216f9af5605619bfd4ccc6d02caf49051d3532ecc039966284a807dc4 SHA512 7bd67cd37735a92b45ec167f30b038a830c7da1834d6e7500768bae2a4c89e9c9994012d78f4d52f4ad520cf7a7e1e1b42125dcecc5f408da0e4dbfa40afbf45 WHIRLPOOL 3d4d532f357d949cb02d4e61f86a9d724c10212a9329abf600e1adf5be6430c24992e076b4674b5c66e332928530a6fec166c5838a2eaa9fe4845a6f80eeb02c -EBUILD gnupg-2.1.1-r1.ebuild 4651 SHA256 3415ee14db62dca13fde95a14685fb49f90c395edab34f665c17ac730a83f261 SHA512 6538b2ec536934b8b1edcdc393dbdbdc69284ea0d2ee9ce355d3bdd85b304fbb89addb81bcb1ab38130b69611f3474a60d92412c4e3fdd0e67c7274468c30cb8 WHIRLPOOL 7851f46481863c72facb109bac2a566d42650d7e4df2c6b828fab9d149c45cd37a7d34b4c6b1b548bcd98561da8bc321c624c241475d88c1bcb650b2ec0c5ff6 EBUILD gnupg-2.1.2.ebuild 4606 SHA256 2dd6dae035f526af8ea1fddc9d25bd4853d88f11a874b991ec9f1a0ba976c2d6 SHA512 bd549ec9a0f6d1fe106767619bd532090835a400290b909ad34e31b7c8fb70dd5f043c620ee14addcbb6c38546a8407127d8b0019eacf72904074ddaaf601f6e WHIRLPOOL d0bcc6f1561f44fd5a0964485e1abef9b28d3dd59e1f3b08cb725291260b524e85f336c4bfe345aeb132afef5c6c1719060eb5608ae052509eb7203706759ad7 -MISC ChangeLog 84111 SHA256 7ae80ca4fdd79af6b55b6228a91b0a3f4f0e4eaba63085bcc19e63025a1601ac SHA512 143edbb3e1a8a8b67bac02b1275f131781604197b87495a98c60bfdcf83405215e1313c645421115767447366efc465090b6cd5edc3cd9fa23e251e27be9d106 WHIRLPOOL cbbd6af930d32ce67d83271bd895219d1087fa635900a43614c423b60540091a9a17e2976060e8f871223eb9129bdae88518b350f894db7e85465d95f745d42c +MISC ChangeLog 84247 SHA256 c8af9fcac7fa5bfaf278b38561a30a7ae76c24abfe64b2bd3c676246923d05ad SHA512 df7c2846b037d66b715657a3e665498a2ed9f96b342ecc303d9554106c884846d5bf6dcc813153fa4d8b528fbb8a378a0217e670376beac8f12c8cc3f8ff559d WHIRLPOOL 0788de1a827ffd435e1d0d542fbe38078a3c3c6a36aae0304f44ef3c3198b2f137323fc479644d681f092951314e5fffc1f925beefd74ab5f1576490850a0ab4 MISC metadata.xml 1032 SHA256 cbef1621eb1364c8d12ac18e71cf4aabfced9ecd3c990a3f3cdf066902dc97bb SHA512 5e2ef4380effe027a0b0b8a11a29ed1996b3b5256ee333909d4a7cfcb18ea1e9dead9b8303c7dffc1ad10014dea79e827b1d84caa92294f4d3dfc29ff23a6af5 WHIRLPOOL a24c7f71ed140f34dd59b10314869d0c5482063be20faefa1591595feb856c79bc57a6b344dd467875cf3389d8cd14e2d41f2312f51d3b77dcbe27af97b7f129 -----BEGIN PGP SIGNATURE----- -iQEcBAEBCAAGBQJU3cVmAAoJEP7VAChXwav61mAH/0pF/q9Bx18OBBtcm2ytpOrA -7/jeSb7i0FVwsQeofYYcqy4vMuVLY7qWThZeZVne28iaCpZ24t1eSJxFWagJnsx/ -eVa0vgrWV19jNv2rhtb9MWz/tFAqMCyLXxnlmKiEaBApVWyWVYArtfSfzhURWQVi -90sfK1SIDRftrk/i2fs7n8Pmbis82yauZgbLp6ymPRp3Q+vkYACYZ7QYLrFRORrv -rQyXS2/oeU2xO1Bw35793GiqJ6Rrw+v6px+6zRnSKuWAlyhCalZdtT5YXiq5yhND -G/uIDiNIdyxu8derB9lEhNqw7glFA2el7Zhn8QxPUPRz6qYNw7DzWe1WCHGQOL8= -=MydW +iQEcBAEBCAAGBQJU3nokAAoJEP7VAChXwav6le8H/2JggukEviC3prgHSMR1nCYJ +XROV+SYUGnAusa3Ro04u/8u17QNoRAEsJtcw1VN7Aq44fXV3Ua85UELNx3iUBozC +LtqLsoQoBn5PynhOBrS7PT9UBvE2LO6Bq1jywvT9ZPg+7VMcdFIDvEjp1dB1QxPd +sljDzc6pSYcHVSHefrumJWS/MQqA0SmC1LLNbHW218WtVnfJVh84TBX7qHWVney+ +6/s5zcVmQKRnhBIafIR794TpRM8gqQAP/SDfIKcHoZu54X2ROMmsgvJKJX3uedM5 +qw9i6WLCvBKJLdFXOAInPku5JI6DRkYs3+GPlfyDLWCIBdu5KHdEZ0OKrAlisqg= +=g22y -----END PGP SIGNATURE----- diff --git a/app-crypt/gnupg/gnupg-2.1.1-r1.ebuild b/app-crypt/gnupg/gnupg-2.1.1-r1.ebuild deleted file mode 100644 index d28aed98da2f..000000000000 --- a/app-crypt/gnupg/gnupg-2.1.1-r1.ebuild +++ /dev/null @@ -1,168 +0,0 @@ -# Copyright 1999-2015 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 -# $Header: /var/cvsroot/gentoo-x86/app-crypt/gnupg/gnupg-2.1.1-r1.ebuild,v 1.3 2015/02/09 20:49:42 k_f Exp $ - -EAPI="5" - -inherit eutils flag-o-matic toolchain-funcs - -DESCRIPTION="The GNU Privacy Guard, a GPL pgp replacement" -HOMEPAGE="http://www.gnupg.org/" -MY_P="${P/_/-}" -SRC_URI="mirror://gnupg/gnupg/${MY_P}.tar.bz2" - -LICENSE="GPL-3" -SLOT="0" -KEYWORDS="" -IUSE="bzip2 doc +gnutls ldap nls readline static selinux smartcard tools usb" - -COMMON_DEPEND_LIBS=" - dev-libs/npth - >=dev-libs/libassuan-2 - >=dev-libs/libgcrypt-1.6.2 - >=dev-libs/libgpg-error-1.17 - >=dev-libs/libksba-1.0.7 - >=net-misc/curl-7.10 - gnutls? ( >=net-libs/gnutls-3.0 ) - sys-libs/zlib - ldap? ( net-nds/openldap ) - bzip2? ( app-arch/bzip2 ) - readline? ( sys-libs/readline ) - smartcard? ( usb? ( virtual/libusb:0 ) ) - " -COMMON_DEPEND_BINS="app-crypt/pinentry - !app-crypt/dirmngr" - -# Existence of executables is checked during configuration. -DEPEND="${COMMON_DEPEND_LIBS} - ${COMMON_DEPEND_BINS} - static? ( - >=dev-libs/libassuan-2[static-libs] - >=dev-libs/libgcrypt-1.6.2[static-libs] - >=dev-libs/libgpg-error-1.17[static-libs] - >=dev-libs/libksba-1.0.7[static-libs] - dev-libs/npth[static-libs] - >=net-misc/curl-7.10[static-libs] - sys-libs/zlib[static-libs] - bzip2? ( app-arch/bzip2[static-libs] ) - ) - nls? ( sys-devel/gettext ) - doc? ( sys-apps/texinfo )" - -RDEPEND="!static? ( ${COMMON_DEPEND_LIBS} ) - ${COMMON_DEPEND_BINS} - selinux? ( sec-policy/selinux-gpg ) - nls? ( virtual/libintl )" - -REQUIRED_USE="smartcard? ( !static )" - -S="${WORKDIR}/${MY_P}" - -src_prepare() { - epatch "${FILESDIR}/${PN}-2.0.17-gpgsm-gencert.patch" - epatch "${FILESDIR}/${P}-misc-cve.patch" - epatch_user -} - -src_configure() { - local myconf=() - - # 'USE=static' support was requested: - # gnupg1: bug #29299 - # gnupg2: bug #159623 - use static && append-ldflags -static - - if use smartcard; then - myconf+=( - --enable-scdaemon - $(use_enable usb ccid-driver) - ) - else - myconf+=( --disable-scdaemon ) - fi - - if use elibc_SunOS || use elibc_AIX; then - myconf+=( --disable-symcryptrun ) - else - myconf+=( --enable-symcryptrun ) - fi - - econf \ - --docdir="${EPREFIX}/usr/share/doc/${PF}" \ - --enable-gpg \ - --enable-gpgsm \ - --enable-agent \ - --without-adns \ - "${myconf[@]}" \ - $(use_enable bzip2) \ - $(use_enable gnutls) \ - $(use_with ldap) \ - $(use_enable nls) \ - $(use_with readline) \ - CC_FOR_BUILD="$(tc-getBUILD_CC)" -} - -src_compile() { - default - - if use doc; then - cd doc - emake html - fi -} - -src_install() { - default - - use tools && dobin tools/{convert-from-106,gpg-check-pattern} \ - tools/{gpg-zip,gpgconf,gpgsplit,lspgpot,mail-signed-keys,make-dns-cert} - - emake DESTDIR="${D}" -f doc/Makefile uninstall-nobase_dist_docDATA - rm "${ED}"/usr/share/gnupg/help* || die - - dodoc ChangeLog NEWS README THANKS TODO VERSION doc/FAQ doc/DETAILS \ - doc/HACKING doc/TRANSLATE doc/OpenPGP doc/KEYSERVER doc/help* - - dosym gpg2 /usr/bin/gpg - dosym gpgv2 /usr/bin/gpgv - echo ".so man1/gpg2.1" > "${ED}"/usr/share/man/man1/gpg.1 - echo ".so man1/gpgv2.1" > "${ED}"/usr/share/man/man1/gpgv.1 - - dodir /etc/env.d - echo "CONFIG_PROTECT=/usr/share/gnupg/qualified.txt" >> "${ED}"/etc/env.d/30gnupg - - if use doc; then - dohtml doc/gnupg.html/* doc/*.png - fi -} - -pkg_postinst() { - elog "If you wish to view images emerge:" - elog "media-gfx/xloadimage, media-gfx/xli or any other viewer" - elog "Remember to use photo-viewer option in configuration file to activate" - elog "the right viewer." - elog - - if use smartcard; then - elog "To use your OpenPGP smartcard (or token) with GnuPG you need one of" - use usb && elog " - a CCID-compatible reader, used directly through libusb;" - elog " - sys-apps/pcsc-lite and a compatible reader device;" - elog " - dev-libs/openct and a compatible reader device;" - elog " - a reader device and drivers exporting either PC/SC or CT-API interfaces." - elog "" - elog "General hint: you probably want to try installing sys-apps/pcsc-lite and" - elog "app-crypt/ccid first." - fi - - ewarn "Please remember to restart gpg-agent if a different version" - ewarn "of the agent is currently used. If you are unsure of the gpg" - ewarn "agent you are using please run 'killall gpg-agent'," - ewarn "and to start a fresh daemon just run 'gpg-agent --daemon'." - - if [[ -n ${REPLACING_VERSIONS} ]]; then - elog "If upgrading from a version prior than 2.1 you might have to re-import" - elog "secret keys after restarting the gpg-agent as the new version is using" - elog "a new storage mechanism." - elog "You can migrate the keys using gpg --import \$HOME/.gnupg/secring.gpg" - fi -}