CVS commit: pkgsrc/net/p5-Net-OAuth

To: pkgsrc-changes%NetBSD.org@localhost
Subject: CVS commit: pkgsrc/net/p5-Net-OAuth
From: "Thomas Klausner" <wiz%netbsd.org@localhost>
Date: Sun, 16 Aug 2026 15:24:31 +0000

Module Name:    pkgsrc
Committed By:   wiz
Date:           Sun Aug 16 15:24:31 UTC 2026

Modified Files:
        pkgsrc/net/p5-Net-OAuth: Makefile distinfo

Log Message:
p5-Net-OAuth: update to 0.32.

0.32   Sun 16 Aug 00:51:04 BST 2026
       [Security]
       - The Net::OAuth smart_require function no longer memoizes
         failures, which allowed attackers to exhaust memory with
         requests for invalid signature methods. CVE-2026-72888

       - Net::OAuth::Client no longer allows silent downgrades from
         OAuth 1.0a to 1.0 when the remote provider drops the
         oauth_verifier.  The behavior can be re-enabled with the
         allow_v1a_downgrade option. CVE-2026-72887

       [Bug Fixes]
       - RSA-SHA1 now pins PKCS#1 v1.5 padding and the SHA-1 hash rather
         than inheriting Crypt::OpenSSL::RSA's defaults, which have drifted
         (SHA-256 in 0.29_01, RSA-PSS in 0.35). Against 0.35 and later this
         produced RSA-PSS signatures that no RFC 5849 3.4.3 compliant server
         will accept. Reported as Debian #1142954.

       [Other]
       - Switched to use Crypt::SysRandom for generating random bytes.

       [Tests]
       - t/02-rsa.t asserts the signature base string separately from the
         signature, so a failure distinguishes base-string construction from
         the crypto layer.

       - t/02-rsa.t skips with a diagnostic on Crypt::OpenSSL::RSA 0.35
         through 0.37, which disabled the PKCS#1 v1.5 padding that OAuth
         RSA-SHA1 requires; 0.38 re-enabled it.

       [Toolchain]
       - Recommend Crypt::OpenSSL::RSA 0.38 or later for RSA-SHA1.

       - Declared MIN_PERL_VERSION as 5.008001, the floor imposed by URI
         and MIME::Base32.

       - Added GitHub Actions CI covering perl 5.16 through latest, and a
         matrix pinning the Crypt::OpenSSL::RSA versions that bracket the
         padding change behind Debian #1142954.

       - Added author tests under xt/, guarded by AUTHOR_TESTING.

       - Corrected the AUTHOR metadata, which credited only the current
         maintainer. Keith Grennan is the author and copyright holder;
         Robert Rothenberg maintains.

       - Updated .mailmap and the AUTHOR POD to canonicalise on reachable
         addresses, as cpan.org no longer forwards mail.

       - MANIFEST now ships CONTRIBUTING.md, and no longer lists the
         generated META.json and META.yml, which distmeta writes into the
         distribution directory regardless.

       [Documentation]
       - Removed the Dancer demo application and rewrote the SYNOPSIS and
         README to be framework-agnostic. The demo linked to a domain that
         is now parked.

       - Added =encoding utf8 to Net::OAuth, which had a non-ASCII
         contributor name in its POD without one.

       [Documentation]
       - Added missing version and timestamp to Changes for v0.31.

       - Added missing acknowledgement to Changes for v0.31.

       - Added CONTRIBUTORS section to the POD.

       - Added a "How to Contribute" document.

0.31   Thu, 03 Apr 2025 16:51 BST
       [Bug Fixes]
       - Added missing dependency RT#70407.

       - Removed use of Digest::HMAC_SHA1 (thanks to James Raspass).

       [Documentation]
       - Updated Changes for v0.29 with CVE.

       - Updated the security policy.

       [Toolchain]
       - Remove Build.PL and just use Makefile.PL.

0.30   Fri, 03 Jan 2025 09:46 GMT
       [Bug Fixes]
       - Fixed syntax error in Net::OAuth::Client (oops).
       - Added missing VERSION to Net::OAuth::Client.

0.29   Fri, 03 Jan 2025 09:15 GMT
       [Security]
       - Net::OAuth::Client uses a better source of randomness for generating the nonce CVE-2025-22376

       [Bug Fixes]
       - Removed unnecessary prerequisite RT#69810 GH#4 GH#6
       - Fix broken dependency for URI::Escape GH#4 (thanks oiami)
       - Fix handling of uri_escape_utf RT#73705 (thanks Tomaž Šolc)

       [Documentation]
       - Reorganised Changes to almost follow CPAN::Changes::Spec
       - Updated author and maintainer information
       - Changed to consistent copyright information
       - Fixed typo RT#125292 RT#90007 GH#6 (thanks Gregor Herrmann)
       - Added a Security Policy (SECURITY.md) to the distribution

       [Tests]
       - Fixed randomly failing t/02-rsa.t test RT#125291 RT#125482 (thanks Gregor Herrmann)

       [Other]
       - Maintenance taken over by Robert Rothenberg <rrwo%cpan.org@localhost>
       - Added .mailmap to the repo
       - Distribution metadata now has the git repository (thanks Sergey Romanov) GH#6
       - Set up config_requires in Build.PL
       - Updated Build.PL configuration
       - Updated MANIFEST.SKIP rules


To generate a diff of this commit:
cvs rdiff -u -r1.27 -r1.28 pkgsrc/net/p5-Net-OAuth/Makefile
cvs rdiff -u -r1.8 -r1.9 pkgsrc/net/p5-Net-OAuth/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/net/p5-Net-OAuth/Makefile
diff -u pkgsrc/net/p5-Net-OAuth/Makefile:1.27 pkgsrc/net/p5-Net-OAuth/Makefile:1.28
--- pkgsrc/net/p5-Net-OAuth/Makefile:1.27       Thu Jul 16 19:04:29 2026
+++ pkgsrc/net/p5-Net-OAuth/Makefile    Sun Aug 16 15:24:31 2026
@@ -1,10 +1,9 @@
-# $NetBSD: Makefile,v 1.27 2026/07/16 19:04:29 wiz Exp $
+# $NetBSD: Makefile,v 1.28 2026/08/16 15:24:31 wiz Exp $
 
-DISTNAME=      Net-OAuth-0.28
+DISTNAME=      Net-OAuth-0.32
 PKGNAME=       p5-${DISTNAME}
-PKGREVISION=   12
 CATEGORIES=    net perl5
-MASTER_SITES=  ${MASTER_SITE_PERL_CPAN:=Net/}
+MASTER_SITES=  ${MASTER_SITE_PERL_CPAN:=../../authors/id/R/RR/RRWO/}
 
 MAINTAINER=    pkgsrc-users%NetBSD.org@localhost
 HOMEPAGE=      https://metacpan.org/release/Net-OAuth
@@ -13,15 +12,13 @@ LICENSE=    ${PERL5_LICENSE}
 
 DEPENDS+=      p5-Class-Accessor>=0.31:../../devel/p5-Class-Accessor
 DEPENDS+=      p5-Class-Data-Inheritable>=0.06:../../devel/p5-Class-Data-Inheritable
-DEPENDS+=      p5-Digest-HMAC>=1.01:../../security/p5-Digest-HMAC
-DEPENDS+=      p5-Digest-SHA1>=2.12:../../security/p5-Digest-SHA1
-#DEPENDS+=     {perl>=5.10.1,p5-Encode>=2.35}:../../textproc/p5-Encode
-DEPENDS+=      p5-URI>=1.36:../../www/p5-URI
-
+DEPENDS+=      p5-Crypt-OpenSSL-RSA>=0.38:../../security/p5-Crypt-OpenSSL-RSA
+DEPENDS+=      p5-URI>=5.15:../../www/p5-URI
+DEPENDS+=      p5-libwww>=1:../../www/p5-libwww
+DEPENDS+=      p5-Crypt-SysRandom>=0.006:../../security/p5-Crypt-SysRandom
 TOOL_DEPENDS+= p5-Test-Warn>=0.21:../../devel/p5-Test-Warn
 
 PERL5_PACKLIST=                auto/Net/OAuth/.packlist
-PERL5_MODULE_TYPE=     Module::Build
 
 .include "../../lang/perl5/module.mk"
 .include "../../mk/bsd.pkg.mk"

Index: pkgsrc/net/p5-Net-OAuth/distinfo
diff -u pkgsrc/net/p5-Net-OAuth/distinfo:1.8 pkgsrc/net/p5-Net-OAuth/distinfo:1.9
--- pkgsrc/net/p5-Net-OAuth/distinfo:1.8        Tue Oct 26 11:06:21 2021
+++ pkgsrc/net/p5-Net-OAuth/distinfo    Sun Aug 16 15:24:31 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.8 2021/10/26 11:06:21 nia Exp $
+$NetBSD: distinfo,v 1.9 2026/08/16 15:24:31 wiz Exp $
 
-BLAKE2s (Net-OAuth-0.28.tar.gz) = 1ce56e773bab3780c9bdfd5d71c8ce31d5648a95cfe055faeb4eb040b838f3d0
-SHA512 (Net-OAuth-0.28.tar.gz) = b38c3784221bdf56b5b55021cc7e74cf6c5ce47b6743b6fefae9e148ff61d3c1e068aa5829dfed13ffd070e1286ab0d743e2f7b7c900f5fd8cf78f788cff70c4
-Size (Net-OAuth-0.28.tar.gz) = 29063 bytes
+BLAKE2s (Net-OAuth-0.32.tar.gz) = a6a8ccba243437ff724b4e867964b899f1c40f59f52fcd4dd7fb9adaa4d876e0
+SHA512 (Net-OAuth-0.32.tar.gz) = 4fb48f6d210f62eec85694fd040b1593293b0035df659e6d5bec21a79155c6fbf3ffdd02766deda02833fbffc07eb3153e83fab517362bdb104ea0bf5d8d440f
+Size (Net-OAuth-0.32.tar.gz) = 32274 bytes

Prev by Date: CVS commit: pkgsrc/doc
Next by Date: CVS commit: pkgsrc/doc
Previous by Thread: CVS commit: pkgsrc/doc
Next by Thread: CVS commit: pkgsrc/doc
Indexes:

Home | Main Index | Thread Index | Old Index