pkgsrc-Changes-HG archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

[pkgsrc/trunk]: pkgsrc/security/go-crypto Update go-crypto to 0.0.20200122.



details:   https://anonhg.NetBSD.org/pkgsrc/rev/783c28b3fa50
branches:  trunk
changeset: 422790:783c28b3fa50
user:      bsiegert <bsiegert%pkgsrc.org@localhost>
date:      Mon Feb 03 13:14:20 2020 +0000

description:
Update go-crypto to 0.0.20200122.

In addition to about two years of changes, this contains notably the
following security fix:

        When int is 32 bits wide (on 32-bit architectures like 386 and arm), an
        overflow could occur, causing a panic, due to malformed ASN.1 being
        passed to any of the ASN1 methods of String.

        Tested on linux/386 and darwin/amd64.

        This fixes CVE-2020-7919 and was found thanks to the Project Wycheproof
        test vectors.

pkgsrc changes:
Once again, the acme subdirectory was removed as it introduces a circular
dependency with go-net.

Prodded several times by ng0@

diffstat:

 security/go-crypto/Makefile      |  10 ++--
 security/go-crypto/PLIST         |  98 ++++++++++++++++++++++++++-------------
 security/go-crypto/buildlink3.mk |   4 +-
 security/go-crypto/distinfo      |  10 ++--
 4 files changed, 76 insertions(+), 46 deletions(-)

diffs (292 lines):

diff -r a4a5114d1b7d -r 783c28b3fa50 security/go-crypto/Makefile
--- a/security/go-crypto/Makefile       Mon Feb 03 12:36:56 2020 +0000
+++ b/security/go-crypto/Makefile       Mon Feb 03 13:14:20 2020 +0000
@@ -1,12 +1,11 @@
-# $NetBSD: Makefile,v 1.28 2020/02/02 14:19:09 bsiegert Exp $
+# $NetBSD: Makefile,v 1.29 2020/02/03 13:14:20 bsiegert Exp $
 
 COMMENT=       Go supplementary cryptography libraries
-PKGREVISION=   15
-DISTNAME=      go-crypto-0.0.20180308
+DISTNAME=      go-crypto-0.0.20200122
 CATEGORIES=    security
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=golang/}
 GITHUB_PROJECT=        crypto
-GITHUB_TAG=    c7dcf104e3
+GITHUB_TAG=    69ecbb4d6d
 
 MAINTAINER=    pkgsrc-users%NetBSD.org@localhost
 HOMEPAGE=      https://github.com/golang/crypto/
@@ -15,7 +14,8 @@
 GO_SRCPATH=    golang.org/x/crypto
 GO_DIST_BASE=  ${GITHUB_PROJECT}-${GITHUB_TAG}*
 
-CONFLICTS=     go-crypto-acme-[0-9]*
+pre-patch:
+       ${RM} -rf ${WRKSRC}/acme
 
 .include "../../lang/go/go-package.mk"
 .include "../../devel/go-sys/buildlink3.mk"
diff -r a4a5114d1b7d -r 783c28b3fa50 security/go-crypto/PLIST
--- a/security/go-crypto/PLIST  Mon Feb 03 12:36:56 2020 +0000
+++ b/security/go-crypto/PLIST  Mon Feb 03 13:14:20 2020 +0000
@@ -1,6 +1,4 @@
-@comment $NetBSD: PLIST,v 1.5 2018/03/11 20:43:33 bsiegert Exp $
-gopkg/pkg/${GO_PLATFORM}/golang.org/x/crypto/acme.a
-gopkg/pkg/${GO_PLATFORM}/golang.org/x/crypto/acme/autocert.a
+@comment $NetBSD: PLIST,v 1.6 2020/02/03 13:14:20 bsiegert Exp $
 gopkg/pkg/${GO_PLATFORM}/golang.org/x/crypto/argon2.a
 gopkg/pkg/${GO_PLATFORM}/golang.org/x/crypto/bcrypt.a
 gopkg/pkg/${GO_PLATFORM}/golang.org/x/crypto/blake2b.a
@@ -8,6 +6,7 @@
 gopkg/pkg/${GO_PLATFORM}/golang.org/x/crypto/blowfish.a
 gopkg/pkg/${GO_PLATFORM}/golang.org/x/crypto/bn256.a
 gopkg/pkg/${GO_PLATFORM}/golang.org/x/crypto/cast5.a
+gopkg/pkg/${GO_PLATFORM}/golang.org/x/crypto/chacha20.a
 gopkg/pkg/${GO_PLATFORM}/golang.org/x/crypto/chacha20poly1305.a
 gopkg/pkg/${GO_PLATFORM}/golang.org/x/crypto/cryptobyte.a
 gopkg/pkg/${GO_PLATFORM}/golang.org/x/crypto/cryptobyte/asn1.a
@@ -15,11 +14,14 @@
 gopkg/pkg/${GO_PLATFORM}/golang.org/x/crypto/ed25519.a
 gopkg/pkg/${GO_PLATFORM}/golang.org/x/crypto/ed25519/internal/edwards25519.a
 gopkg/pkg/${GO_PLATFORM}/golang.org/x/crypto/hkdf.a
-gopkg/pkg/${GO_PLATFORM}/golang.org/x/crypto/internal/chacha20.a
+gopkg/pkg/${GO_PLATFORM}/golang.org/x/crypto/internal/subtle.a
+gopkg/pkg/${GO_PLATFORM}/golang.org/x/crypto/internal/wycheproof/internal/dsa.a
+gopkg/pkg/${GO_PLATFORM}/golang.org/x/crypto/internal/wycheproof/internal/ecdsa.a
 gopkg/pkg/${GO_PLATFORM}/golang.org/x/crypto/md4.a
 gopkg/pkg/${GO_PLATFORM}/golang.org/x/crypto/nacl/auth.a
 gopkg/pkg/${GO_PLATFORM}/golang.org/x/crypto/nacl/box.a
 gopkg/pkg/${GO_PLATFORM}/golang.org/x/crypto/nacl/secretbox.a
+gopkg/pkg/${GO_PLATFORM}/golang.org/x/crypto/nacl/sign.a
 gopkg/pkg/${GO_PLATFORM}/golang.org/x/crypto/ocsp.a
 gopkg/pkg/${GO_PLATFORM}/golang.org/x/crypto/openpgp.a
 gopkg/pkg/${GO_PLATFORM}/golang.org/x/crypto/openpgp/armor.a
@@ -53,20 +55,6 @@
 gopkg/src/golang.org/x/crypto/LICENSE
 gopkg/src/golang.org/x/crypto/PATENTS
 gopkg/src/golang.org/x/crypto/README.md
-gopkg/src/golang.org/x/crypto/acme/acme.go
-gopkg/src/golang.org/x/crypto/acme/acme_test.go
-gopkg/src/golang.org/x/crypto/acme/autocert/autocert.go
-gopkg/src/golang.org/x/crypto/acme/autocert/autocert_test.go
-gopkg/src/golang.org/x/crypto/acme/autocert/cache.go
-gopkg/src/golang.org/x/crypto/acme/autocert/cache_test.go
-gopkg/src/golang.org/x/crypto/acme/autocert/example_test.go
-gopkg/src/golang.org/x/crypto/acme/autocert/listener.go
-gopkg/src/golang.org/x/crypto/acme/autocert/renewal.go
-gopkg/src/golang.org/x/crypto/acme/autocert/renewal_test.go
-gopkg/src/golang.org/x/crypto/acme/jws.go
-gopkg/src/golang.org/x/crypto/acme/jws_test.go
-gopkg/src/golang.org/x/crypto/acme/types.go
-gopkg/src/golang.org/x/crypto/acme/types_test.go
 gopkg/src/golang.org/x/crypto/argon2/argon2.go
 gopkg/src/golang.org/x/crypto/argon2/argon2_test.go
 gopkg/src/golang.org/x/crypto/argon2/blake2b.go
@@ -113,6 +101,17 @@
 gopkg/src/golang.org/x/crypto/bn256/twist.go
 gopkg/src/golang.org/x/crypto/cast5/cast5.go
 gopkg/src/golang.org/x/crypto/cast5/cast5_test.go
+gopkg/src/golang.org/x/crypto/chacha20/chacha_arm64.go
+gopkg/src/golang.org/x/crypto/chacha20/chacha_arm64.s
+gopkg/src/golang.org/x/crypto/chacha20/chacha_generic.go
+gopkg/src/golang.org/x/crypto/chacha20/chacha_noasm.go
+gopkg/src/golang.org/x/crypto/chacha20/chacha_ppc64le.go
+gopkg/src/golang.org/x/crypto/chacha20/chacha_ppc64le.s
+gopkg/src/golang.org/x/crypto/chacha20/chacha_s390x.go
+gopkg/src/golang.org/x/crypto/chacha20/chacha_s390x.s
+gopkg/src/golang.org/x/crypto/chacha20/chacha_test.go
+gopkg/src/golang.org/x/crypto/chacha20/vectors_test.go
+gopkg/src/golang.org/x/crypto/chacha20/xor.go
 gopkg/src/golang.org/x/crypto/chacha20poly1305/chacha20poly1305.go
 gopkg/src/golang.org/x/crypto/chacha20poly1305/chacha20poly1305_amd64.go
 gopkg/src/golang.org/x/crypto/chacha20poly1305/chacha20poly1305_amd64.s
@@ -120,6 +119,7 @@
 gopkg/src/golang.org/x/crypto/chacha20poly1305/chacha20poly1305_noasm.go
 gopkg/src/golang.org/x/crypto/chacha20poly1305/chacha20poly1305_test.go
 gopkg/src/golang.org/x/crypto/chacha20poly1305/chacha20poly1305_vectors_test.go
+gopkg/src/golang.org/x/crypto/chacha20poly1305/xchacha20poly1305.go
 gopkg/src/golang.org/x/crypto/codereview.cfg
 gopkg/src/golang.org/x/crypto/cryptobyte/asn1.go
 gopkg/src/golang.org/x/crypto/cryptobyte/asn1/asn1.go
@@ -128,27 +128,37 @@
 gopkg/src/golang.org/x/crypto/cryptobyte/cryptobyte_test.go
 gopkg/src/golang.org/x/crypto/cryptobyte/example_test.go
 gopkg/src/golang.org/x/crypto/cryptobyte/string.go
-gopkg/src/golang.org/x/crypto/curve25519/const_amd64.h
-gopkg/src/golang.org/x/crypto/curve25519/const_amd64.s
-gopkg/src/golang.org/x/crypto/curve25519/cswap_amd64.s
 gopkg/src/golang.org/x/crypto/curve25519/curve25519.go
+gopkg/src/golang.org/x/crypto/curve25519/curve25519_amd64.go
+gopkg/src/golang.org/x/crypto/curve25519/curve25519_amd64.s
+gopkg/src/golang.org/x/crypto/curve25519/curve25519_generic.go
+gopkg/src/golang.org/x/crypto/curve25519/curve25519_noasm.go
 gopkg/src/golang.org/x/crypto/curve25519/curve25519_test.go
-gopkg/src/golang.org/x/crypto/curve25519/doc.go
-gopkg/src/golang.org/x/crypto/curve25519/freeze_amd64.s
-gopkg/src/golang.org/x/crypto/curve25519/ladderstep_amd64.s
-gopkg/src/golang.org/x/crypto/curve25519/mont25519_amd64.go
-gopkg/src/golang.org/x/crypto/curve25519/mul_amd64.s
-gopkg/src/golang.org/x/crypto/curve25519/square_amd64.s
+gopkg/src/golang.org/x/crypto/curve25519/vectors_test.go
 gopkg/src/golang.org/x/crypto/ed25519/ed25519.go
+gopkg/src/golang.org/x/crypto/ed25519/ed25519_go113.go
 gopkg/src/golang.org/x/crypto/ed25519/ed25519_test.go
+gopkg/src/golang.org/x/crypto/ed25519/go113_test.go
 gopkg/src/golang.org/x/crypto/ed25519/internal/edwards25519/const.go
 gopkg/src/golang.org/x/crypto/ed25519/internal/edwards25519/edwards25519.go
 gopkg/src/golang.org/x/crypto/ed25519/testdata/sign.input.gz
+gopkg/src/golang.org/x/crypto/go.mod
+gopkg/src/golang.org/x/crypto/go.sum
 gopkg/src/golang.org/x/crypto/hkdf/example_test.go
 gopkg/src/golang.org/x/crypto/hkdf/hkdf.go
 gopkg/src/golang.org/x/crypto/hkdf/hkdf_test.go
-gopkg/src/golang.org/x/crypto/internal/chacha20/chacha_generic.go
-gopkg/src/golang.org/x/crypto/internal/chacha20/chacha_test.go
+gopkg/src/golang.org/x/crypto/internal/subtle/aliasing.go
+gopkg/src/golang.org/x/crypto/internal/subtle/aliasing_appengine.go
+gopkg/src/golang.org/x/crypto/internal/subtle/aliasing_test.go
+gopkg/src/golang.org/x/crypto/internal/wycheproof/README.md
+gopkg/src/golang.org/x/crypto/internal/wycheproof/dsa_test.go
+gopkg/src/golang.org/x/crypto/internal/wycheproof/ecdsa_test.go
+gopkg/src/golang.org/x/crypto/internal/wycheproof/eddsa_test.go
+gopkg/src/golang.org/x/crypto/internal/wycheproof/internal/dsa/dsa.go
+gopkg/src/golang.org/x/crypto/internal/wycheproof/internal/ecdsa/ecdsa.go
+gopkg/src/golang.org/x/crypto/internal/wycheproof/rsa_pss_test.go
+gopkg/src/golang.org/x/crypto/internal/wycheproof/rsa_signature_test.go
+gopkg/src/golang.org/x/crypto/internal/wycheproof/wycheproof_test.go
 gopkg/src/golang.org/x/crypto/md4/example_test.go
 gopkg/src/golang.org/x/crypto/md4/md4.go
 gopkg/src/golang.org/x/crypto/md4/md4_test.go
@@ -162,6 +172,8 @@
 gopkg/src/golang.org/x/crypto/nacl/secretbox/example_test.go
 gopkg/src/golang.org/x/crypto/nacl/secretbox/secretbox.go
 gopkg/src/golang.org/x/crypto/nacl/secretbox/secretbox_test.go
+gopkg/src/golang.org/x/crypto/nacl/sign/sign.go
+gopkg/src/golang.org/x/crypto/nacl/sign/sign_test.go
 gopkg/src/golang.org/x/crypto/ocsp/ocsp.go
 gopkg/src/golang.org/x/crypto/ocsp/ocsp_test.go
 gopkg/src/golang.org/x/crypto/openpgp/armor/armor.go
@@ -175,6 +187,7 @@
 gopkg/src/golang.org/x/crypto/openpgp/elgamal/elgamal_test.go
 gopkg/src/golang.org/x/crypto/openpgp/errors/errors.go
 gopkg/src/golang.org/x/crypto/openpgp/keys.go
+gopkg/src/golang.org/x/crypto/openpgp/keys_data_test.go
 gopkg/src/golang.org/x/crypto/openpgp/keys_test.go
 gopkg/src/golang.org/x/crypto/openpgp/packet/compressed.go
 gopkg/src/golang.org/x/crypto/openpgp/packet/compressed_test.go
@@ -235,20 +248,30 @@
 gopkg/src/golang.org/x/crypto/pkcs12/pkcs12.go
 gopkg/src/golang.org/x/crypto/pkcs12/pkcs12_test.go
 gopkg/src/golang.org/x/crypto/pkcs12/safebags.go
+gopkg/src/golang.org/x/crypto/poly1305/bits_compat.go
+gopkg/src/golang.org/x/crypto/poly1305/bits_go1.13.go
+gopkg/src/golang.org/x/crypto/poly1305/mac_noasm.go
 gopkg/src/golang.org/x/crypto/poly1305/poly1305.go
 gopkg/src/golang.org/x/crypto/poly1305/poly1305_test.go
 gopkg/src/golang.org/x/crypto/poly1305/sum_amd64.go
 gopkg/src/golang.org/x/crypto/poly1305/sum_amd64.s
-gopkg/src/golang.org/x/crypto/poly1305/sum_arm.go
-gopkg/src/golang.org/x/crypto/poly1305/sum_arm.s
-gopkg/src/golang.org/x/crypto/poly1305/sum_ref.go
+gopkg/src/golang.org/x/crypto/poly1305/sum_generic.go
+gopkg/src/golang.org/x/crypto/poly1305/sum_noasm.go
+gopkg/src/golang.org/x/crypto/poly1305/sum_ppc64le.go
+gopkg/src/golang.org/x/crypto/poly1305/sum_ppc64le.s
+gopkg/src/golang.org/x/crypto/poly1305/sum_s390x.go
+gopkg/src/golang.org/x/crypto/poly1305/sum_s390x.s
+gopkg/src/golang.org/x/crypto/poly1305/sum_vmsl_s390x.s
+gopkg/src/golang.org/x/crypto/poly1305/vectors_test.go
 gopkg/src/golang.org/x/crypto/ripemd160/ripemd160.go
 gopkg/src/golang.org/x/crypto/ripemd160/ripemd160_test.go
 gopkg/src/golang.org/x/crypto/ripemd160/ripemd160block.go
 gopkg/src/golang.org/x/crypto/salsa20/salsa/hsalsa20.go
-gopkg/src/golang.org/x/crypto/salsa20/salsa/salsa2020_amd64.s
 gopkg/src/golang.org/x/crypto/salsa20/salsa/salsa208.go
 gopkg/src/golang.org/x/crypto/salsa20/salsa/salsa20_amd64.go
+gopkg/src/golang.org/x/crypto/salsa20/salsa/salsa20_amd64.s
+gopkg/src/golang.org/x/crypto/salsa20/salsa/salsa20_amd64_test.go
+gopkg/src/golang.org/x/crypto/salsa20/salsa/salsa20_noasm.go
 gopkg/src/golang.org/x/crypto/salsa20/salsa/salsa20_ref.go
 gopkg/src/golang.org/x/crypto/salsa20/salsa/salsa_test.go
 gopkg/src/golang.org/x/crypto/salsa20/salsa20.go
@@ -258,13 +281,17 @@
 gopkg/src/golang.org/x/crypto/scrypt/scrypt_test.go
 gopkg/src/golang.org/x/crypto/sha3/doc.go
 gopkg/src/golang.org/x/crypto/sha3/hashes.go
+gopkg/src/golang.org/x/crypto/sha3/hashes_generic.go
 gopkg/src/golang.org/x/crypto/sha3/keccakf.go
 gopkg/src/golang.org/x/crypto/sha3/keccakf_amd64.go
 gopkg/src/golang.org/x/crypto/sha3/keccakf_amd64.s
 gopkg/src/golang.org/x/crypto/sha3/register.go
 gopkg/src/golang.org/x/crypto/sha3/sha3.go
+gopkg/src/golang.org/x/crypto/sha3/sha3_s390x.go
+gopkg/src/golang.org/x/crypto/sha3/sha3_s390x.s
 gopkg/src/golang.org/x/crypto/sha3/sha3_test.go
 gopkg/src/golang.org/x/crypto/sha3/shake.go
+gopkg/src/golang.org/x/crypto/sha3/shake_generic.go
 gopkg/src/golang.org/x/crypto/sha3/testdata/keccakKats.json.deflate
 gopkg/src/golang.org/x/crypto/sha3/xor.go
 gopkg/src/golang.org/x/crypto/sha3/xor_generic.go
@@ -291,6 +318,7 @@
 gopkg/src/golang.org/x/crypto/ssh/client_auth_test.go
 gopkg/src/golang.org/x/crypto/ssh/client_test.go
 gopkg/src/golang.org/x/crypto/ssh/common.go
+gopkg/src/golang.org/x/crypto/ssh/common_test.go
 gopkg/src/golang.org/x/crypto/ssh/connection.go
 gopkg/src/golang.org/x/crypto/ssh/doc.go
 gopkg/src/golang.org/x/crypto/ssh/example_test.go
@@ -311,12 +339,15 @@
 gopkg/src/golang.org/x/crypto/ssh/server.go
 gopkg/src/golang.org/x/crypto/ssh/session.go
 gopkg/src/golang.org/x/crypto/ssh/session_test.go
+gopkg/src/golang.org/x/crypto/ssh/ssh_gss.go
+gopkg/src/golang.org/x/crypto/ssh/ssh_gss_test.go
 gopkg/src/golang.org/x/crypto/ssh/streamlocal.go
 gopkg/src/golang.org/x/crypto/ssh/tcpip.go
 gopkg/src/golang.org/x/crypto/ssh/tcpip_test.go
 gopkg/src/golang.org/x/crypto/ssh/terminal/terminal.go
 gopkg/src/golang.org/x/crypto/ssh/terminal/terminal_test.go
 gopkg/src/golang.org/x/crypto/ssh/terminal/util.go
+gopkg/src/golang.org/x/crypto/ssh/terminal/util_aix.go
 gopkg/src/golang.org/x/crypto/ssh/terminal/util_bsd.go
 gopkg/src/golang.org/x/crypto/ssh/terminal/util_linux.go
 gopkg/src/golang.org/x/crypto/ssh/terminal/util_plan9.go
@@ -347,4 +378,3 @@
 gopkg/src/golang.org/x/crypto/xtea/xtea_test.go
 gopkg/src/golang.org/x/crypto/xts/xts.go
 gopkg/src/golang.org/x/crypto/xts/xts_test.go
-@pkgdir bin
diff -r a4a5114d1b7d -r 783c28b3fa50 security/go-crypto/buildlink3.mk
--- a/security/go-crypto/buildlink3.mk  Mon Feb 03 12:36:56 2020 +0000
+++ b/security/go-crypto/buildlink3.mk  Mon Feb 03 13:14:20 2020 +0000
@@ -1,4 +1,4 @@
-# $NetBSD: buildlink3.mk,v 1.5 2018/03/11 20:43:33 bsiegert Exp $
+# $NetBSD: buildlink3.mk,v 1.6 2020/02/03 13:14:20 bsiegert Exp $
 
 BUILDLINK_TREE+=       go-crypto
 
@@ -8,7 +8,7 @@
 BUILDLINK_CONTENTS_FILTER.go-crypto=   ${EGREP} gopkg/
 BUILDLINK_DEPMETHOD.go-crypto?=                build
 
-BUILDLINK_API_DEPENDS.go-crypto+=      go-crypto>=0.0.20170317
+BUILDLINK_API_DEPENDS.go-crypto+=      go-crypto>=0.0.20200122
 BUILDLINK_PKGSRCDIR.go-crypto?=                ../../security/go-crypto
 
 .include "../../devel/go-sys/buildlink3.mk"
diff -r a4a5114d1b7d -r 783c28b3fa50 security/go-crypto/distinfo
--- a/security/go-crypto/distinfo       Mon Feb 03 12:36:56 2020 +0000
+++ b/security/go-crypto/distinfo       Mon Feb 03 13:14:20 2020 +0000
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.4 2018/03/11 20:43:33 bsiegert Exp $
+$NetBSD: distinfo,v 1.5 2020/02/03 13:14:20 bsiegert Exp $
 
-SHA1 (go-crypto-0.0.20180308-c7dcf104e3.tar.gz) = 1322992aaebe336ce424954c196e49a076ee017c
-RMD160 (go-crypto-0.0.20180308-c7dcf104e3.tar.gz) = 3d8f852250f3f78557476b624e7c9e3b25db33b0
-SHA512 (go-crypto-0.0.20180308-c7dcf104e3.tar.gz) = e22312a9a4c87ee35e1df182cafa4016733780a37bd8688f1d5cb87b47306b60bc7f8b24d69ecd9e00482483100849b6e821e6c8c96eccff02f65a9c71fc629e
-Size (go-crypto-0.0.20180308-c7dcf104e3.tar.gz) = 1451474 bytes
+SHA1 (go-crypto-0.0.20200122-69ecbb4d6d.tar.gz) = fb78c506c62b77d16628ddd177a9ca9e562088c9
+RMD160 (go-crypto-0.0.20200122-69ecbb4d6d.tar.gz) = 4f8455fcdfbd8f7a5810a7de95f1e1c77ecdef64
+SHA512 (go-crypto-0.0.20200122-69ecbb4d6d.tar.gz) = 74733829ea5d5f8dc553d181219fa671142eaa446ebc020e1c2d09e0efb864bb7c6fd175a7ec2da4220086d843995fea5488223c903f01ee992130f6a2621b8e
+Size (go-crypto-0.0.20200122-69ecbb4d6d.tar.gz) = 1720483 bytes



Home | Main Index | Thread Index | Old Index