Exclude private key from RPM documentation
Updated the .spec file to ensure private keys are no longer included in the %doc directory.
Due to security scan could be private key in that place flagged as an important risk.
Remove private key and related script from documentation
ďżź
- New upstream release 1.94
- Net::SSLeay now officially supports all stable releases of OpenSSL 3.1 and
3.2, and LibreSSL 3.5-3.8
- Many noisy compiler warnings have been silenced - if SSLeay.xs fails to
compile, it should now be much easier to identify the cause
- libcrypto's OPENSSL_init_crypto() function and libssl's OPENSSL_init_ssl()
function are now exposed, enabling fine-grained control over the
initialisation and configuration of both libraries
- libssl functions implementing TLS 1.3 PSK authentication are now exposed,
in particular SSL_CTX_set_psk_find_session_callback() (on the server side)
and SSL_CTX_set_psk_use_session_callback() (on the client side)
- libssl functions implementing server-side TLS 1.2 PSK authentication are
now exposed, in particular SSL_CTX_set_psk_server_callback()
- libssl's SSL_CTX_set_client_hello_cb() function is now exposed, allowing a
TLS server to set a callback function that is executed when the server
processes a ClientHello message
- Many more libcrypto/libssl constants and functions are now exposed; see the
release notes for the 1.93 developer releases for a full list
- New upstream release 1.92
- Net::SSLeay now supports stable releases of OpenSSL 3.0
- OpenSSL 3.0.0 introduces the concept of "providers", which contain
cryptographic algorithm implementations; many outdated, deprecated
and/or insecure algorithms have been moved to the "legacy" provider,
which may need to be loaded explicitly in order to use them with
Net::SSLeay (see "Low level API: OSSL_LIB_CTX and OSSL_PROVIDER
related functions" in the Net::SSLeay module documentation for details)
- Net::SSLeay's built-in PEM_get_string_PrivateKey() function depends on
algorithms that have moved to the legacy provider described above; if
OpenSSL has been compiled without the legacy provider, the tests
t/local/33_x509_create_cert.t and t/local/63_ec_key_generate_key.t will
fail when the test suite is run
- TLS 1.1 and below may only be used at security level 0 as of OpenSSL
3.0.0; if a minimum required security level is imposed (e.g. in an
OpenSSL configuration file managed by the operating system), the tests
t/local/44_sess.t and t/local/45_exporter.t will fail when the test
suite is run
- Net::SSLeay now supports stable releases of LibreSSL from the 3.2-3.4
series (with the exception of 3.2.2 and 3.2.3 - see "COMPATIBILITY" in
the Net::SSLeay module documentation for details)
- The TLS 1.3 implementation in LibreSSL 3.1-3.3, parts of which are
enabled by default, is not fully compatible with the libssl API and may
not function as expected with Net::SSLeay; see "KNOWN BUGS AND CAVEATS"
in the Net::SSLeay module documentation for details
- A number of new libcrypto/libssl constants and functions are now exposed,
including SSL_CTX_set_keylog_callback() and SSL_CTX_set_msg_callback(),
which are helpful when debugging TLS handshakes; see the release notes
for the 1.91 developer releases (in the Changes file) for a full list of
newly-exposed constants and functions
- New upstream release 1.90
- Formalised libssl version support policy: all stable versions of OpenSSL
in the 0.9.8-1.1.1 branches (with the exception of 0.9.8-0.9.8b) and all
stable releases of LibreSSL in the 2.0-3.1 series are supported
- The LibreSSL 3.2 series is not yet fully supported because its TLSv1.3
implementation is not currently libssl-compatible
- Added support for LibreSSL on Windows when built with Visual C++
- Exposed P_X509_CRL_add_extensions, several SSL_CIPHER functions, and
several stack functions
- Fixed crashes in the callback functions CTX_set_next_proto_select_cb and
CTX_set_alpn_select_cb
- The test suite is now compatible with OpenSSL 1.1.1e onwards, as well as
OpenSSL security level 2 (the default on many Linux distributions)
- New upstream release 1.88
Summary of major changes since version 1.85
- Mike McCauley has stepped down as maintainer: the new maintainers are Chris
Novakovic, Heikki Vatiainen and Tuure Vartiainen
- The source code has moved from the now-defunct Debian Subversion server
(alioth.debian.org) to GitHub
(https://github.com/radiator-software/p5-net-ssleay)
- Net-SSLeay is provided under the terms of the Artistic License 2.0; this
has been the case since version 1.66, but references to other licenses
remained in the source code, causing ambiguity
- Perl 5.8.1 or newer is now required to use Net-SSLeay; this has already
been the case for some time in practice, as the test suite hasn't fully
passed on Perl 5.6 for several years
- Much-improved compatibility with OpenSSL 1.1.1, and improved support for
TLS 1.3
- Fixed a long-standing bug in cb_data_advanced_put() that caused memory
leaks when callbacks were frequently added and removed
- Support in the test suite for "hardened" OpenSSL configurations that set a
default security level of 2 or higher (e.g., in the OpenSSL packages that
ship with recent versions of Debian, Fedora and Ubuntu)
openssl-1:1.1.1-0.pre8.2.fc29 started to obey to a system-wide crypto
policy. This affected Net-SSLeay tests. Please note that
openssl-1.1.1-0.pre8.3.fc29 fixed some regressions affecting
Net-SSLeay tests.
