-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
-AUX blacklist-diginotar-certs.diff 6625 RMD160 2df3bab37c581f131f76f1fd5e681ef2f7731441 SHA1 7a8eae73d6da9ae4f400682bf135796d5320f97d SHA256 b41797e1b25767caf5b178e766348f70daf273a0ec84a0527d8c3eea4413493e
+AUX blacklist-diginotar-certs.diff 6153 RMD160 57b654d558a5fd2cb9626cc59a63e9f802db799a SHA1 3734404231b4406f8578dc7236e2f350fa553d79 SHA256 461a6c1b0618119251ab03ee668aaa93f6a8b8ba1298d8eb928f87df70c76d75
AUX blacklist_ssl.patch 3839 RMD160 769b5652df6d626ef4436afcdae8fc6f927c4c47 SHA1 1301a6f353ab1eda382ab9dd3fdc7134a30a1884 SHA256 33800ce89fe0d62ba08a8fad515df048f78f481ebc8726b1244f27895a84193b
AUX moc.pro 2769 RMD160 42bd282eb8e24cf291a512766270e7afed6e56be SHA1 941513c6c83813992bb91f4584d3e015295baa07 SHA256 e0898c630e079db9693fe494bf37f6b395c291373ed7edbd0827ed7d1e085a2e
AUX qt-4.5-nolibx11.diff 1167 RMD160 da983a70bd436d35e325203dfe9390b2aee925ae SHA1 ee916596e422e91179458778b013fb103dc97cac SHA256 c6c686c1cfc07caefafe697eb8b02b6806f3845f20d3fd3839301d8a94259b0b
EBUILD qt-core-4.7.3-r1.ebuild 5145 RMD160 15fc91e044bce6256c058d718956946e2bac44ed SHA1 eb6ae2c5f61b5270b7023ccc4f187ab47539dce5 SHA256 9f78ef2e73ab2053776cf4c04b7035e1ef15866883d86498d50d543beba95600
EBUILD qt-core-4.7.3.ebuild 5073 RMD160 967a5ce2abb2e75fed6212c91c3fea7dce92e13d SHA1 d8ddcb0130db836494cc4ebf1cc992f5770536de SHA256 f8585c33daa1b8b2dd7471213321c89987997bb86bf3d8143640d8d4f4f6f194
EBUILD qt-core-4.7.4.ebuild 5143 RMD160 0f1715da539a628a8678af01f04d0778f769fea5 SHA1 8faa148d586d38b34ca5af882487127c43a8bfe2 SHA256 12868decc2c84ffcfa62a9fdfe524904ea8f6dbc72e26d41efbadd071fab8ac3
-MISC ChangeLog 18566 RMD160 f4bfd6273566f5da5f3df2727d4ca69e1d09b19d SHA1 76cc8c9729350bae76c589197fdf24f1a982986b SHA256 b96c015bb7e9a6cd96051a04fad55bb579459c6d3712e5147692898d8d494c3f
+MISC ChangeLog 18739 RMD160 5a54a47436f39575f3807515a5ed632ccf7c2290 SHA1 13958bc9ebc54cf86fedcd6934cc0795c284aed5 SHA256 f08ee21e0fb9299ea57483a098d6cfe6703896024e13a878dd059e4c81fecdd8
MISC metadata.xml 802 RMD160 0341afae262322299759a5a33bae9a42e5b7801c SHA1 b564551c1b4a7902e09200255c6c0a6ede646a23 SHA256 a84f88402ece782e8ac52ad0b90eea94e5bd563ca0a7956e1d89f1263d7f2925
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.18 (GNU/Linux)
-iQIcBAEBCgAGBQJOaIiWAAoJEDZF8K7rm0r6N90P/A8AEmGLYJByhNSVtIWaVeiG
-3zzUCfBWaKsfGSFTk+Mzd6W9tzt7BsrYYBcyNpl5wIVl9Cxz2fdceDLmSfp8qx+z
-UxuMicyTPc+mZn/w6Lx92G1zgbXUEWJC5pV01XY48+ZtrD5fxUwa5FxAjd6UWqDn
-zbfHqY+o5MsbYt9jAHkoDWLB9ZCqLsikRmM406SER6Xu8jopvD6sT429vG8e0r1t
-VcUYT1ry5dCNBAl29sGqpsoAZyJR0jXsTyTFluNQ+q23WjJYQjA9abOvajb+gNw0
-ifdC67bNNz6PghNGmr6rFPmIdya/8DxbuJX3n4jKJsJUtL8+BNq5/cf0Qo4VcblW
-3FronCTdkMgz98ZWXQxFgxIabDxAacDk5L1qbjETzzvxOQG8/2b8Nb5OHNlPh1cl
-Ng9hvOgDeNG0pnk/dvaiK6EdmgctVmwv5geqi+nUHO0bMsJOL2tQntKZSL+YrwBU
-51L+jO6Ki3oMNDhLFEHStCVKXE5XGGMacqBuvzF6NHR2kMQ7s2OcbODTFnlPSCvM
-Dy+KCzv/08A+e3BG6ntvyM0CnQ1J7678o66Yti1+n7Ict5DNCKa+5uNCSKSNKiiY
-CwDe6AsgCykrkJKn6x9jUM1pLVCBbHV6QlKfeYRTSqeJu1k+WY93xJoJaiZtXpJS
-4L57b6KGWQrA4meIhK/H
-=kKgJ
+iQIcBAEBCgAGBQJOaJ9dAAoJEDZF8K7rm0r6nBYP/RK5HjVCrtZXFjQOxn3/i1eK
+m+k1PEgF90Wp/PX74y0DsyDi2GnL7xbxnwK98J458zMcFHj5wETVRsiEHfdEBCBd
+1YR70iefxmL21ciXbLat2Z66fR+IX1wsfzDV+5/skfVYFB3Iztb9HBTrKvYZm2uG
+i1gi8duqOt0nBMQ+ZrmLFG1wcngAzUtga9YBwJZnwdZYFYJaMQA5EVAQWL6qAymb
+dCQPsiJF9XPw4r3jwmgZhsf0Z2m/Xcyaj2k/QTrFKJVkUR8bJGWvqwVMKpvKcbzU
+ia90bdz/HOe/a2rsoyzbRy57YEn1lSsNtMb44YqXCNOV0Vk/s0eUOCTi23eUJ6qU
+kNww9kpPgWcfL9+7k4GveV2Mn48qUYSyM9+UKZA8+kwDza4MIgsVGsH/FJ61RYV1
+ECNM+76aG/pPd9iqTkQBLfW3EYHSwFlEp3YZ8pKqi/def9kr3ShDPwQw7DB71hhT
+8yhyugK4A5nM8NtjejWC4Twt1cchAReGIfhXnyVOkbgJ4ppJZUFluZrg5Oq8zC4I
+Vd8hAJAweMQKOJ+a0Zz7gRq0hrRO2yFJgdqu3n8O1CfrNbUZkHuyNZVVBHLx9N/c
+FPrPH1HO4e5PbH/BNwfUWVnPyxNTwOMSsSGhkirSNWtODjbjTRCqrnA3x0gPu9z7
+n3AlDhQBI4cltwfjSiZ0
+=Ha8i
-----END PGP SIGNATURE-----
-http://labs.qt.nokia.com/2011/09/07/what-the-diginotar-security-breach-means-for-qt-users-continued/\r
-\r
-gentoo bug: https://bugs.gentoo.org/show_bug.cgi?id=382171\r
-\r
-diff --git a/src/network/ssl/qsslcertificate.cpp b/src/network/ssl/qsslcertificate.cpp\r
-index 328c5c2..1ae98f4 100644\r
---- a/src/network/ssl/qsslcertificate.cpp\r
-+++ b/src/network/ssl/qsslcertificate.cpp\r
-@@ -803,22 +803,47 @@ QList<QSslCertificate> QSslCertificatePrivate::certificatesFromDer(const QByteAr\r
- // These certificates are known to be fraudulent and were created during the comodo\r
- // compromise. See http://www.comodo.com/Comodo-Fraud-Incident-2011-03-23.html\r
- static const char *certificate_blacklist[] = {\r
-- "04:7e:cb:e9:fc:a5:5f:7b:d0:9e:ae:36:e1:0c:ae:1e",\r
-- "f5:c8:6a:f3:61:62:f1:3a:64:f5:4f:6d:c9:58:7c:06",\r
-- "d7:55:8f:da:f5:f1:10:5b:b2:13:28:2b:70:77:29:a3",\r
-- "39:2a:43:4f:0e:07:df:1f:8a:a3:05:de:34:e0:c2:29",\r
-- "3e:75:ce:d4:6b:69:30:21:21:88:30:ae:86:a8:2a:71",\r
-- "e9:02:8b:95:78:e4:15:dc:1a:71:0a:2b:88:15:44:47",\r
-- "92:39:d5:34:8f:40:d1:69:5a:74:54:70:e1:f2:3f:43",\r
-- "b0:b7:13:3e:d0:96:f9:b5:6f:ae:91:c8:74:bd:3a:c0",\r
-- "d8:f3:5f:4e:b7:87:2b:2d:ab:06:92:e3:15:38:2f:b0",\r
-+ "04:7e:cb:e9:fc:a5:5f:7b:d0:9e:ae:36:e1:0c:ae:1e", "mail.google.com", // Comodo\r
-+ "f5:c8:6a:f3:61:62:f1:3a:64:f5:4f:6d:c9:58:7c:06", "www.google.com", // Comodo\r
-+ "d7:55:8f:da:f5:f1:10:5b:b2:13:28:2b:70:77:29:a3", "login.yahoo.com", // Comodo\r
-+ "39:2a:43:4f:0e:07:df:1f:8a:a3:05:de:34:e0:c2:29", "login.yahoo.com", // Comodo\r
-+ "3e:75:ce:d4:6b:69:30:21:21:88:30:ae:86:a8:2a:71", "login.yahoo.com", // Comodo\r
-+ "e9:02:8b:95:78:e4:15:dc:1a:71:0a:2b:88:15:44:47", "login.skype.com", // Comodo\r
-+ "92:39:d5:34:8f:40:d1:69:5a:74:54:70:e1:f2:3f:43", "addons.mozilla.org", // Comodo\r
-+ "b0:b7:13:3e:d0:96:f9:b5:6f:ae:91:c8:74:bd:3a:c0", "login.live.com", // Comodo\r
-+ "d8:f3:5f:4e:b7:87:2b:2d:ab:06:92:e3:15:38:2f:b0", "global trustee", // Comodo\r
-+\r
-+ "05:e2:e6:a4:cd:09:ea:54:d6:65:b0:75:fe:22:a2:56", "*.google.com", // leaf certificate issued by DigiNotar\r
-+ "0c:76:da:9c:91:0c:4e:2c:9e:fe:15:d0:58:93:3c:4c", "DigiNotar Root CA", // DigiNotar root\r
-+ "f1:4a:13:f4:87:2b:56:dc:39:df:84:ca:7a:a1:06:49", "DigiNotar Services CA", // DigiNotar intermediate signed by DigiNotar Root\r
-+ "36:16:71:55:43:42:1b:9d:e6:cb:a3:64:41:df:24:38", "DigiNotar Services 1024 CA", // DigiNotar intermediate signed by DigiNotar Root\r
-+ "0a:82:bd:1e:14:4e:88:14:d7:5b:1a:55:27:be:bf:3e", "DigiNotar Root CA G2", // other DigiNotar Root CA\r
-+ "a4:b6:ce:e3:2e:d3:35:46:26:3c:b3:55:3a:a8:92:21", "CertiID Enterprise Certificate Authority", // DigiNotar intermediate signed by "DigiNotar Root CA G2"\r
-+ "5b:d5:60:9c:64:17:68:cf:21:0e:35:fd:fb:05:ad:41", "DigiNotar Qualified CA", // DigiNotar intermediate signed by DigiNotar Root\r
-+\r
-+ "1184640176", "DigiNotar Services 1024 CA", // DigiNotar intermediate cross-signed by Entrust\r
-+ "120000525", "DigiNotar Cyber CA", // DigiNotar intermediate cross-signed by CyberTrust\r
-+ "120000505", "DigiNotar Cyber CA", // DigiNotar intermediate cross-signed by CyberTrust\r
-+ "120000515", "DigiNotar Cyber CA", // DigiNotar intermediate cross-signed by CyberTrust\r
-+ "20015536", "DigiNotar PKIoverheid CA Overheid en Bedrijven", // DigiNotar intermediate cross-signed by the Dutch government\r
-+ "20001983", "DigiNotar PKIoverheid CA Organisatie - G2", // DigiNotar intermediate cross-signed by the Dutch government\r
-+ "d6:d0:29:77:f1:49:fd:1a:83:f2:b9:ea:94:8c:5c:b4", "DigiNotar Extended Validation CA", // DigiNotar intermediate signed by DigiNotar EV Root\r
-+ "1e:7d:7a:53:3d:45:30:41:96:40:0f:71:48:1f:45:04", "DigiNotar Public CA 2025", // DigiNotar intermediate\r
-+// "(has not been seen in the wild so far)", "DigiNotar Public CA - G2", // DigiNotar intermediate\r
-+// "(has not been seen in the wild so far)", "Koninklijke Notariele Beroepsorganisatie CA", // compromised during DigiNotar breach\r
-+// "(has not been seen in the wild so far)", "Stichting TTP Infos CA," // compromised during DigiNotar breach\r
-+ "1184640175", "DigiNotar Root CA", // DigiNotar intermediate cross-signed by Entrust\r
-+ "1184644297", "DigiNotar Root CA", // DigiNotar intermediate cross-signed by Entrust\r
- 0\r
- };\r
- \r
- bool QSslCertificatePrivate::isBlacklisted(const QSslCertificate &certificate)\r
- {\r
- for (int a = 0; certificate_blacklist[a] != 0; a++) {\r
-- if (certificate.serialNumber() == certificate_blacklist[a])\r
-+ QString blacklistedCommonName = QString::fromUtf8(certificate_blacklist[(a+1)]);\r
-+ if (certificate.serialNumber() == certificate_blacklist[a++] &&\r
-+ (certificate.subjectInfo(QSslCertificate::CommonName) == blacklistedCommonName ||\r
-+ certificate.issuerInfo(QSslCertificate::CommonName) == blacklistedCommonName))\r
- return true;\r
- }\r
- return false;\r
-diff --git a/src/network/ssl/qsslsocket_openssl.cpp b/src/network/ssl/qsslsocket_openssl.cpp\r
-index 141d80a..b8e6c4c 100644\r
---- a/src/network/ssl/qsslsocket_openssl.cpp\r
-+++ b/src/network/ssl/qsslsocket_openssl.cpp\r
-@@ -1193,12 +1193,16 @@ bool QSslSocketBackendPrivate::startHandshake()\r
- X509 *x509 = q_SSL_get_peer_certificate(ssl);\r
- configuration.peerCertificate = QSslCertificatePrivate::QSslCertificate_from_X509(x509);\r
- q_X509_free(x509);\r
-- if (QSslCertificatePrivate::isBlacklisted(configuration.peerCertificate)) {\r
-- q->setErrorString(QSslSocket::tr("The peer certificate is blacklisted"));\r
-- q->setSocketError(QAbstractSocket::SslHandshakeFailedError);\r
-- emit q->error(QAbstractSocket::SslHandshakeFailedError);\r
-- plainSocket->disconnectFromHost();\r
-- return false;\r
-+\r
-+ // check the whole chain for blacklisting (including root, as we check for subjectInfo and issuer)\r
-+ foreach (const QSslCertificate &cert, configuration.peerCertificateChain) {\r
-+ if (QSslCertificatePrivate::isBlacklisted(cert)) {\r
-+ q->setErrorString(QSslSocket::tr("The peer certificate is blacklisted"));\r
-+ q->setSocketError(QAbstractSocket::SslHandshakeFailedError);\r
-+ emit q->error(QAbstractSocket::SslHandshakeFailedError);\r
-+ plainSocket->disconnectFromHost();\r
-+ return false;\r
-+ }\r
- }\r
- \r
- // Start translating errors.\r
+http://labs.qt.nokia.com/2011/09/07/what-the-diginotar-security-breach-means-for-qt-users-continued/
+gentoo bug: https://bugs.gentoo.org/show_bug.cgi?id=382171
+--- src/network/ssl/qsslcertificate.cpp
++++ src/network/ssl/qsslcertificate.cpp
+@@ -803,22 +803,47 @@
+ // These certificates are known to be fraudulent and were created during the comodo
+ // compromise. See http://www.comodo.com/Comodo-Fraud-Incident-2011-03-23.html
+ static const char *certificate_blacklist[] = {
+- "04:7e:cb:e9:fc:a5:5f:7b:d0:9e:ae:36:e1:0c:ae:1e",
+- "f5:c8:6a:f3:61:62:f1:3a:64:f5:4f:6d:c9:58:7c:06",
+- "d7:55:8f:da:f5:f1:10:5b:b2:13:28:2b:70:77:29:a3",
+- "39:2a:43:4f:0e:07:df:1f:8a:a3:05:de:34:e0:c2:29",
+- "3e:75:ce:d4:6b:69:30:21:21:88:30:ae:86:a8:2a:71",
+- "e9:02:8b:95:78:e4:15:dc:1a:71:0a:2b:88:15:44:47",
+- "92:39:d5:34:8f:40:d1:69:5a:74:54:70:e1:f2:3f:43",
+- "b0:b7:13:3e:d0:96:f9:b5:6f:ae:91:c8:74:bd:3a:c0",
+- "d8:f3:5f:4e:b7:87:2b:2d:ab:06:92:e3:15:38:2f:b0",
++ "04:7e:cb:e9:fc:a5:5f:7b:d0:9e:ae:36:e1:0c:ae:1e", "mail.google.com", // Comodo
++ "f5:c8:6a:f3:61:62:f1:3a:64:f5:4f:6d:c9:58:7c:06", "www.google.com", // Comodo
++ "d7:55:8f:da:f5:f1:10:5b:b2:13:28:2b:70:77:29:a3", "login.yahoo.com", // Comodo
++ "39:2a:43:4f:0e:07:df:1f:8a:a3:05:de:34:e0:c2:29", "login.yahoo.com", // Comodo
++ "3e:75:ce:d4:6b:69:30:21:21:88:30:ae:86:a8:2a:71", "login.yahoo.com", // Comodo
++ "e9:02:8b:95:78:e4:15:dc:1a:71:0a:2b:88:15:44:47", "login.skype.com", // Comodo
++ "92:39:d5:34:8f:40:d1:69:5a:74:54:70:e1:f2:3f:43", "addons.mozilla.org", // Comodo
++ "b0:b7:13:3e:d0:96:f9:b5:6f:ae:91:c8:74:bd:3a:c0", "login.live.com", // Comodo
++ "d8:f3:5f:4e:b7:87:2b:2d:ab:06:92:e3:15:38:2f:b0", "global trustee", // Comodo
++
++ "05:e2:e6:a4:cd:09:ea:54:d6:65:b0:75:fe:22:a2:56", "*.google.com", // leaf certificate issued by DigiNotar
++ "0c:76:da:9c:91:0c:4e:2c:9e:fe:15:d0:58:93:3c:4c", "DigiNotar Root CA", // DigiNotar root
++ "f1:4a:13:f4:87:2b:56:dc:39:df:84:ca:7a:a1:06:49", "DigiNotar Services CA", // DigiNotar intermediate signed by DigiNotar Root
++ "36:16:71:55:43:42:1b:9d:e6:cb:a3:64:41:df:24:38", "DigiNotar Services 1024 CA", // DigiNotar intermediate signed by DigiNotar Root
++ "0a:82:bd:1e:14:4e:88:14:d7:5b:1a:55:27:be:bf:3e", "DigiNotar Root CA G2", // other DigiNotar Root CA
++ "a4:b6:ce:e3:2e:d3:35:46:26:3c:b3:55:3a:a8:92:21", "CertiID Enterprise Certificate Authority", // DigiNotar intermediate signed by "DigiNotar Root CA G2"
++ "5b:d5:60:9c:64:17:68:cf:21:0e:35:fd:fb:05:ad:41", "DigiNotar Qualified CA", // DigiNotar intermediate signed by DigiNotar Root
++
++ "1184640176", "DigiNotar Services 1024 CA", // DigiNotar intermediate cross-signed by Entrust
++ "120000525", "DigiNotar Cyber CA", // DigiNotar intermediate cross-signed by CyberTrust
++ "120000505", "DigiNotar Cyber CA", // DigiNotar intermediate cross-signed by CyberTrust
++ "120000515", "DigiNotar Cyber CA", // DigiNotar intermediate cross-signed by CyberTrust
++ "20015536", "DigiNotar PKIoverheid CA Overheid en Bedrijven", // DigiNotar intermediate cross-signed by the Dutch government
++ "20001983", "DigiNotar PKIoverheid CA Organisatie - G2", // DigiNotar intermediate cross-signed by the Dutch government
++ "d6:d0:29:77:f1:49:fd:1a:83:f2:b9:ea:94:8c:5c:b4", "DigiNotar Extended Validation CA", // DigiNotar intermediate signed by DigiNotar EV Root
++ "1e:7d:7a:53:3d:45:30:41:96:40:0f:71:48:1f:45:04", "DigiNotar Public CA 2025", // DigiNotar intermediate
++// "(has not been seen in the wild so far)", "DigiNotar Public CA - G2", // DigiNotar intermediate
++// "(has not been seen in the wild so far)", "Koninklijke Notariele Beroepsorganisatie CA", // compromised during DigiNotar breach
++// "(has not been seen in the wild so far)", "Stichting TTP Infos CA," // compromised during DigiNotar breach
++ "1184640175", "DigiNotar Root CA", // DigiNotar intermediate cross-signed by Entrust
++ "1184644297", "DigiNotar Root CA", // DigiNotar intermediate cross-signed by Entrust
+ 0
+ };
+
+ bool QSslCertificatePrivate::isBlacklisted(const QSslCertificate &certificate)
+ {
+ for (int a = 0; certificate_blacklist[a] != 0; a++) {
+- if (certificate.serialNumber() == certificate_blacklist[a])
++ QString blacklistedCommonName = QString::fromUtf8(certificate_blacklist[(a+1)]);
++ if (certificate.serialNumber() == certificate_blacklist[a++] &&
++ (certificate.subjectInfo(QSslCertificate::CommonName) == blacklistedCommonName ||
++ certificate.issuerInfo(QSslCertificate::CommonName) == blacklistedCommonName))
+ return true;
+ }
+ return false;
+--- src/network/ssl/qsslsocket_openssl.cpp
++++ src/network/ssl/qsslsocket_openssl.cpp
+@@ -1183,12 +1183,16 @@
+ X509 *x509 = q_SSL_get_peer_certificate(ssl);
+ configuration.peerCertificate = QSslCertificatePrivate::QSslCertificate_from_X509(x509);
+ q_X509_free(x509);
+- if (QSslCertificatePrivate::isBlacklisted(configuration.peerCertificate)) {
+- q->setErrorString(QSslSocket::tr("The peer certificate is blacklisted"));
+- q->setSocketError(QAbstractSocket::SslHandshakeFailedError);
+- emit q->error(QAbstractSocket::SslHandshakeFailedError);
+- plainSocket->disconnectFromHost();
+- return false;
++
++ // check the whole chain for blacklisting (including root, as we check for subjectInfo and issuer)
++ foreach (const QSslCertificate &cert, configuration.peerCertificateChain) {
++ if (QSslCertificatePrivate::isBlacklisted(cert)) {
++ q->setErrorString(QSslSocket::tr("The peer certificate is blacklisted"));
++ q->setSocketError(QAbstractSocket::SslHandshakeFailedError);
++ emit q->error(QAbstractSocket::SslHandshakeFailedError);
++ plainSocket->disconnectFromHost();
++ return false;
++ }
+ }
+
+ // Start translating errors.
projects / gentoo.git / commitdiff