diff --git a/IO-Socket-SSL-2.081-use-system-default-SSL-version.patch b/IO-Socket-SSL-2.082-use-system-default-SSL-version.patch similarity index 87% rename from IO-Socket-SSL-2.081-use-system-default-SSL-version.patch rename to IO-Socket-SSL-2.082-use-system-default-SSL-version.patch index e62d0c1..1722cf8 100644 --- a/IO-Socket-SSL-2.081-use-system-default-SSL-version.patch +++ b/IO-Socket-SSL-2.082-use-system-default-SSL-version.patch @@ -1,15 +1,16 @@ --- lib/IO/Socket/SSL.pm +++ lib/IO/Socket/SSL.pm -@@ -196,7 +196,7 @@ if ( defined &Net::SSLeay::CTX_set_min_p +@@ -196,8 +196,7 @@ if ( defined &Net::SSLeay::CTX_set_min_p # global defaults my %DEFAULT_SSL_ARGS = ( SSL_check_crl => 0, -- SSL_version => 'SSLv23:!SSLv3:!SSLv2', # consider both SSL3.0 and SSL2.0 as broken +- # TLS 1.1 and lower are deprecated with RFC 8996 +- SSL_version => 'SSLv23:!TLSv1:!TLSv1_1:!SSLv3:!SSLv2', + SSL_version => '', SSL_verify_callback => undef, SSL_verifycn_scheme => undef, # fallback cn verification SSL_verifycn_publicsuffix => undef, # fallback default list verification -@@ -2436,7 +2436,7 @@ sub new { +@@ -2438,7 +2437,7 @@ sub new { my $ssl_op = $DEFAULT_SSL_OP; diff --git a/IO-Socket-SSL-2.081-use-system-default-cipher-list.patch b/IO-Socket-SSL-2.082-use-system-default-cipher-list.patch similarity index 96% rename from IO-Socket-SSL-2.081-use-system-default-cipher-list.patch rename to IO-Socket-SSL-2.082-use-system-default-cipher-list.patch index 23265b6..4c08428 100644 --- a/IO-Socket-SSL-2.081-use-system-default-cipher-list.patch +++ b/IO-Socket-SSL-2.082-use-system-default-cipher-list.patch @@ -1,6 +1,6 @@ --- lib/IO/Socket/SSL.pm +++ lib/IO/Socket/SSL.pm -@@ -204,8 +204,10 @@ my %DEFAULT_SSL_ARGS = ( +@@ -205,8 +205,10 @@ my %DEFAULT_SSL_ARGS = ( SSL_npn_protocols => undef, # meaning depends whether on server or client side SSL_alpn_protocols => undef, # list of protocols we'll accept/send, for example ['http/1.1','spdy/3.1'] diff --git a/perl-IO-Socket-SSL.spec b/perl-IO-Socket-SSL.spec index 6463585..71c2a0f 100644 --- a/perl-IO-Socket-SSL.spec +++ b/perl-IO-Socket-SSL.spec @@ -6,14 +6,14 @@ %bcond_without perl_IO_Socket_SSL_test_IO_Socket_INET6 Name: perl-IO-Socket-SSL -Version: 2.081 +Version: 2.082 Release: 1%{?dist} Summary: Perl library for transparent SSL License: (GPL-1.0-or-later OR Artistic-1.0-Perl) AND MPL-2.0 URL: https://metacpan.org/release/IO-Socket-SSL Source0: https://cpan.metacpan.org/modules/by-module/IO/IO-Socket-SSL-%{version}.tar.gz -Patch0: IO-Socket-SSL-2.081-use-system-default-cipher-list.patch -Patch1: IO-Socket-SSL-2.081-use-system-default-SSL-version.patch +Patch0: IO-Socket-SSL-2.082-use-system-default-cipher-list.patch +Patch1: IO-Socket-SSL-2.082-use-system-default-SSL-version.patch # A test for Enable-Post-Handshake-Authentication-TLSv1.3-feature.patch, # bug #1632660, requires openssl tool Patch2: IO-Socket-SSL-2.080-Test-client-performs-Post-Handshake-Authentication.patch @@ -85,13 +85,13 @@ mod_perl. # Use system-wide default cipher list to support use of system-wide # crypto policy (#1076390, #1127577, CPAN RT#97816) # https://fedoraproject.org/wiki/Changes/CryptoPolicy -%patch0 +%patch -P 0 # Use system-default SSL version too -%patch1 +%patch -P 1 # Add a test for PHA -%patch2 -p1 +%patch -P 2 -p1 %build NO_NETWORK_TESTING=1 perl Makefile.PL \ @@ -125,6 +125,17 @@ make test %{_mandir}/man3/IO::Socket::SSL::PublicSuffix.3* %changelog +* Thu May 18 2023 Paul Howarth - 2.082-1 +- Update to 2.082 + - SSL_version default now TLS 1.2+ since TLS 1.1 and lower are deprecated + (GH#122) + - Fix output of alert string when debugging (GH#132) + - Improve regex for hostname validation (GH#130, (GH#126) + - Add can_ciphersuites subroutine for feature checking (GH#127) + - Utils::CERT_create - die if unexpected arguments are given instead of + ignoring these +- Avoid use of deprecated patch syntax + * Wed Jan 25 2023 Paul Howarth - 2.081-1 - Update to 2.081 - New function set_msg_callback for user defined callback on each SSL message diff --git a/sources b/sources index 9764906..95a2013 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (IO-Socket-SSL-2.081.tar.gz) = 309d02983a8a6c1440c2161189fd4648533bafb784a3271fb0d8671681ed606aeaeb5f0650de5f26869e1fd84e9c8bd94674988bbefcd0f424c94a387a548534 +SHA512 (IO-Socket-SSL-2.082.tar.gz) = 666b3a703ae6f7cd9e57c04165f4ad2b4758ce4c01b848892353087263c3ebe6a8c77f8023129b58435cdcc6c0abbcff1a4b12079751cbc1b222aab7ac45932d