.gitignore

@@ -1 +1 @@
-/xmlsec1-1.2.25.tar.gz
+/xmlsec1-1.2.29.tar.gz

0001-resource-leaks.patch

@@ -1,7 +1,7 @@
-diff -up xmlsec1-1.2.25/src/c14n.c.orig xmlsec1-1.2.25/src/c14n.c
+diff -up xmlsec1-1.2.29/src/c14n.c.orig xmlsec1-1.2.29/src/c14n.c
---- xmlsec1-1.2.25/src/c14n.c.orig	2017-09-12 15:21:09.000000000 +0200
+--- xmlsec1-1.2.29/src/c14n.c.orig	2024-05-10 13:47:12.698153446 +0200
-+++ xmlsec1-1.2.25/src/c14n.c	2024-05-14 09:55:35.800202266 +0200
++++ xmlsec1-1.2.29/src/c14n.c	2024-05-10 18:30:35.148285625 +0200
-@@ -228,7 +228,10 @@ xmlSecTransformC14NPushXml(xmlSecTransfo
+@@ -233,7 +233,10 @@ xmlSecTransformC14NPushXml(xmlSecTransfo
      /* we are using a semi-hack here: we know that xmlSecPtrList keeps
       * all pointers in the big array */
      nsList = xmlSecTransformC14NGetNsList(transform);
@@ -13,7 +13,7 @@ diff -up xmlsec1-1.2.25/src/c14n.c.orig xmlsec1-1.2.25/src/c14n.c
  
      ret = xmlSecTransformC14NExecute(transform->id, nodes, (xmlChar**)(nsList->data), buf);
      if(ret < 0) {
-@@ -292,7 +295,10 @@ xmlSecTransformC14NPopBin(xmlSecTransfor
+@@ -297,7 +300,10 @@ xmlSecTransformC14NPopBin(xmlSecTransfor
          /* we are using a semi-hack here: we know that xmlSecPtrList keeps
           * all pointers in the big array */
          nsList = xmlSecTransformC14NGetNsList(transform);
@@ -25,14 +25,14 @@ diff -up xmlsec1-1.2.25/src/c14n.c.orig xmlsec1-1.2.25/src/c14n.c
  
          ret = xmlSecTransformC14NExecute(transform->id, transform->inNodes, (xmlChar**)(nsList->data), buf);
          if(ret < 0) {
-@@ -732,4 +738,3 @@ xmlSecTransformId
+@@ -737,4 +743,3 @@ xmlSecTransformId
  xmlSecTransformRemoveXmlTagsC14NGetKlass(void) {
      return(&xmlSecTransformRemoveXmlTagsC14NKlass);
  }
 -
-diff -up xmlsec1-1.2.25/src/gcrypt/asymkeys.c.orig xmlsec1-1.2.25/src/gcrypt/asymkeys.c
+diff -up xmlsec1-1.2.29/src/gcrypt/asymkeys.c.orig xmlsec1-1.2.29/src/gcrypt/asymkeys.c
---- xmlsec1-1.2.25/src/gcrypt/asymkeys.c.orig	2017-09-12 15:21:09.000000000 +0200
+--- xmlsec1-1.2.29/src/gcrypt/asymkeys.c.orig	2024-05-10 18:47:45.800368678 +0200
-+++ xmlsec1-1.2.25/src/gcrypt/asymkeys.c	2024-05-14 09:55:35.801202265 +0200
++++ xmlsec1-1.2.29/src/gcrypt/asymkeys.c	2024-05-13 09:11:08.784351577 +0200
 @@ -186,6 +186,9 @@ xmlSecGCryptAsymKeyDataAdoptKey(xmlSecKe
      pub_key = NULL; /* data owns it now */
      priv_key = NULL; /* data owns it now */
@@ -43,10 +43,10 @@ diff -up xmlsec1-1.2.25/src/gcrypt/asymkeys.c.orig xmlsec1-1.2.25/src/gcrypt/asy
      /* success */
      res = 0;
  
-diff -up xmlsec1-1.2.25/src/parser.c.orig xmlsec1-1.2.25/src/parser.c
+diff -up xmlsec1-1.2.29/src/parser.c.orig xmlsec1-1.2.29/src/parser.c
---- xmlsec1-1.2.25/src/parser.c.orig	2017-09-12 15:21:09.000000000 +0200
+--- xmlsec1-1.2.29/src/parser.c.orig	2024-05-10 13:46:59.217160842 +0200
-+++ xmlsec1-1.2.25/src/parser.c	2024-05-14 09:55:35.802202264 +0200
++++ xmlsec1-1.2.29/src/parser.c	2024-05-10 17:28:22.848994008 +0200
-@@ -354,7 +354,6 @@ xmlDocPtr
+@@ -368,7 +368,6 @@ xmlDocPtr
  xmlSecParseFile(const char *filename) {
      xmlParserCtxtPtr ctxt;
      xmlDocPtr res = NULL;
@@ -54,7 +54,7 @@ diff -up xmlsec1-1.2.25/src/parser.c.orig xmlsec1-1.2.25/src/parser.c
      int ret;
  
      xmlSecAssert2(filename != NULL, NULL);
-@@ -371,23 +370,15 @@ xmlSecParseFile(const char *filename) {
+@@ -385,23 +384,15 @@ xmlSecParseFile(const char *filename) {
      /* crashes on x64 xmlCtxtUseOptions (ctxt, XML_PARSE_HUGE); */
  
      /* todo: set directories from current doc? */
@@ -81,7 +81,16 @@ diff -up xmlsec1-1.2.25/src/parser.c.orig xmlsec1-1.2.25/src/parser.c
  
      /* required for c14n! */
      ctxt->loadsubset = XML_DETECT_IDS | XML_COMPLETE_ATTRS;
-@@ -547,4 +538,3 @@ xmlSecParseMemory(const xmlSecByte *buff
+@@ -559,7 +550,7 @@ xmlSecParseMemory(const xmlSecByte *buff
+         if(ctxt->myDoc != NULL) {
+             xmlFreeDoc(ctxt->myDoc);
+             ctxt->myDoc = NULL;
+-        }	
++        }
+         xmlFreeParserCtxt(ctxt);
+         return(NULL);
+     }
+@@ -580,4 +571,3 @@ xmlSecParseMemory(const xmlSecByte *buff
      xmlFreeParserCtxt(ctxt);
      return(res);
  }

gating.yaml

@@ -1,6 +1,6 @@
 --- !Policy
 product_versions:
-  - rhel-8
+  - rhel-9
 decision_context: osci_compose_gate
 rules:
   - !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}

sources

@@ -1 +1 @@
-SHA512 (xmlsec1-1.2.25.tar.gz) = ac61547a1cbf9016d7f75be3dc5249d6bc8a526bc51715e53ede13f056c1c72c57433a6be200c886000a25826c3e473954ded3ae988f25d37ac4ef4d777c66a6
+SHA512 (xmlsec1-1.2.29.tar.gz) = 07c3012179da4392f0a9d41a51ed51d692ca8b491310488b955d5fef0637f104d3f82374754b0ef175fadc663a8ca8c996178198c5dd77b3a8b34393d1482e4d

xmlSecOpenSSLX509DataNodeRead-error.patch

@@ -1,55 +0,0 @@
-Please see this bug report for full details:
-https://github.com/lsh123/xmlsec/issues/164
-
-commit e303e077fb3e13654ba711b2816ff1a94247338b
-Author: lsh123 <aleksey@aleksey.com>
-Date:   Wed Apr 11 17:13:43 2018 -1000
-
-    Add missing return(-1). (#165)
-    
-    Fixed issue #164. All other crypto libraries are ok.
-
-diff --git a/src/openssl/x509.c b/src/openssl/x509.c
-index 15fe70db..b98e62d1 100644
---- a/src/openssl/x509.c
-+++ b/src/openssl/x509.c
-@@ -870,6 +870,7 @@ xmlSecOpenSSLX509DataNodeRead(xmlSecKeyDataPtr data, xmlNodePtr node, xmlSecKeyI
-                 xmlSecInternalError2("xmlSecOpenSSLX509CertificateNodeRead",
-                                      xmlSecKeyDataGetName(data),
-                                      "node=%s", xmlSecErrorsSafeString(xmlSecNodeGetName(cur)));
-+                return(-1);
-             }
-         } else if(xmlSecCheckNodeName(cur, xmlSecNodeX509SubjectName, xmlSecDSigNs)) {
-             ret = xmlSecOpenSSLX509SubjectNameNodeRead(data, cur, keyInfoCtx);
-@@ -877,6 +878,7 @@ xmlSecOpenSSLX509DataNodeRead(xmlSecKeyDataPtr data, xmlNodePtr node, xmlSecKeyI
-                 xmlSecInternalError2("xmlSecOpenSSLX509SubjectNameNodeRead",
-                                      xmlSecKeyDataGetName(data),
-                                      "node=%s", xmlSecErrorsSafeString(xmlSecNodeGetName(cur)));
-+                return(-1);
-             }
-         } else if(xmlSecCheckNodeName(cur, xmlSecNodeX509IssuerSerial, xmlSecDSigNs)) {
-             ret = xmlSecOpenSSLX509IssuerSerialNodeRead(data, cur, keyInfoCtx);
-@@ -884,6 +886,7 @@ xmlSecOpenSSLX509DataNodeRead(xmlSecKeyDataPtr data, xmlNodePtr node, xmlSecKeyI
-                 xmlSecInternalError2("xmlSecOpenSSLX509IssuerSerialNodeRead",
-                                      xmlSecKeyDataGetName(data),
-                                      "node=%s", xmlSecErrorsSafeString(xmlSecNodeGetName(cur)));
-+                return(-1);
-             }
-         } else if(xmlSecCheckNodeName(cur, xmlSecNodeX509SKI, xmlSecDSigNs)) {
-             ret = xmlSecOpenSSLX509SKINodeRead(data, cur, keyInfoCtx);
-@@ -891,6 +894,7 @@ xmlSecOpenSSLX509DataNodeRead(xmlSecKeyDataPtr data, xmlNodePtr node, xmlSecKeyI
-                 xmlSecInternalError2("xmlSecOpenSSLX509SKINodeRead",
-                                      xmlSecKeyDataGetName(data),
-                                      "node=%s", xmlSecErrorsSafeString(xmlSecNodeGetName(cur)));
-+                return(-1);
-             }
-         } else if(xmlSecCheckNodeName(cur, xmlSecNodeX509CRL, xmlSecDSigNs)) {
-             ret = xmlSecOpenSSLX509CRLNodeRead(data, cur, keyInfoCtx);
-@@ -898,6 +902,7 @@ xmlSecOpenSSLX509DataNodeRead(xmlSecKeyDataPtr data, xmlNodePtr node, xmlSecKeyI
-                 xmlSecInternalError2("xmlSecOpenSSLX509CRLNodeRead",
-                                      xmlSecKeyDataGetName(data),
-                                      "node=%s", xmlSecErrorsSafeString(xmlSecNodeGetName(cur)));
-+                return(-1);
-             }
-         } else if((keyInfoCtx->flags & XMLSEC_KEYINFO_FLAGS_X509DATA_STOP_ON_UNKNOWN_CHILD) != 0) {
-             /* laxi schema validation: ignore unknown nodes */

xmlsec1.spec

@@ -1,10 +1,11 @@
 Summary: Library providing support for "XML Signature" and "XML Encryption" standards
 Name: xmlsec1
-Version: 1.2.25
+Version: 1.2.29
-Release: 8%{?dist}%{?extra_release}
+Release: 13%{?dist}%{?extra_release}
 License: MIT
-Source0: http://www.aleksey.com/xmlsec/download/xmlsec1-%{version}.tar.gz
+Source0: https://www.aleksey.com/xmlsec/download/xmlsec1-%{version}.tar.gz
 URL: http://www.aleksey.com/xmlsec/
+BuildRequires: make
 BuildRequires: pkgconfig(libxml-2.0) >= 2.8.0
 BuildRequires: pkgconfig(libxslt) >= 1.0.20
 BuildRequires: pkgconfig(openssl) >= 1.0.0
@@ -19,7 +20,6 @@ BuildRequires: automake
 BuildRequires: gettext-devel
 BuildRequires: libtool
 Patch0: 0001-resource-leaks.patch
-Patch1: xmlSecOpenSSLX509DataNodeRead-error.patch
 
 %description
 XML Security Library is a C library based on LibXML2  and OpenSSL.
@@ -107,7 +107,7 @@ Libraries, includes, etc. for developing XML Security applications with NSS.
 
 %build
 autoreconf -vfi
-%configure --disable-static
+%configure --disable-static --disable-md5 --disable-sha1
 sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool
 sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool
 %make_build V=1
@@ -137,9 +137,7 @@ mv %{buildroot}%{_docdir}/xmlsec1/* __tmp_doc
 %{_bindir}/xmlsec1-config
 %dir %{_includedir}/xmlsec1
 %dir %{_includedir}/xmlsec1/xmlsec
-%dir %{_includedir}/xmlsec1/xmlsec/private
 %{_includedir}/xmlsec1/xmlsec/*.h
-%{_includedir}/xmlsec1/xmlsec/private/*.h
 %{_libdir}/libxmlsec1.so
 %{_libdir}/pkgconfig/xmlsec1.pc
 %{_libdir}/xmlsec1Conf.sh
@@ -180,21 +178,65 @@ mv %{buildroot}%{_docdir}/xmlsec1/* __tmp_doc
 %{_libdir}/pkgconfig/xmlsec1-nss.pc
 
 %changelog
-* Fri May 31 2024 Tomas Halman <thalman@redhat.com> - 1.2.25-8
+* Mon May 20 2024 Tomas Halman <thalman@redhat.com> - 1.2.29-12
-- Add gating tests
-  Related: RHEL-36185
-
-* Mon May 20 2024 Tomas Halman <thalman@redhat.com> - 1.2.25-7
 - Fix adopt function the same way as in upstream
-  Related: RHEL-36185
+  Related: RHEL-35381
 
-* Fri May 17 2024 Tomas Halman <thalman@redhat.com> - 1.2.25-6
+* Fri May 17 2024 Tomas Halman <thalman@redhat.com> - 1.2.29-12
+- Fix double free in xmlSecGCryptAsymKeyDataGenerate
+  Related: RHEL-35381
+
+* Fri May 17 2024 Tomas Halman <thalman@redhat.com> - 1.2.29-11
 - Add xmlsec1-gnutls dependency on xmlsec1-gcrypt
-  Related: RHEL-36185
+  Related: RHEL-35381
 
-* Mon May 13 2024 Tomas Halman <thalman@redhat.com> - 1.2.25-5
+* Mon May 13 2024 Tomas Halman <thalman@redhat.com> - 1.2.29-10
 - Fix memory leaks found by SAST
-  Resolves: RHEL-36185
+  Resolves: RHEL-35381
+
+* Tue Aug 10 2021 Mohan Boddu <mboddu@redhat.com> - 1.2.29-9
+- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
+  Related: rhbz#1991688
+
+* Wed Jul 28 2021 Florian Weimer <fweimer@redhat.com> - 1.2.29-8
+- Rebuild to pick up OpenSSL 3.0 Beta ABI (#1984097)
+
+* Thu Jun 17 2021 Jakub Hrozek <jhrozek@redhat.com> - 1.2.29-7
+- compile without sha1 and md5
+- Resolves: rhbz#1936682 - xmlsec1 implements and/or uses the deprecated
+                           SHA-1 algorithm by default
+
+* Wed Jun 16 2021 Mohan Boddu <mboddu@redhat.com> - 1.2.29-6
+- Rebuilt for RHEL 9 BETA for openssl 3.0
+  Related: rhbz#1971065
+
+* Thu Jun  3 2021 Jakub Hrozek <jhrozek@redhat.com> - 1.2.29-5
+- Rebuilt for OpenSSL3
+- Related: rhbz#1962052 - lasso: Port to OpenSSL 3.0
+
+* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 1.2.29-4
+- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
+
+* Thu Jan 28 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.29-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.29-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Wed Jan 29 2020 Caolán McNamara <caolanm@redhat.com> - 1.2.29-1
+- New upstream release
+
+* Sat Jul 27 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.27-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
+* Sun Feb 03 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.27-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Tue Oct 23 2018 Simo Sorce <simo@redhat.com> - 1.2.27-1
+- New upstream release
+
+* Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.25-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
 
 * Thu Apr 12 2018 John Dennis <jdennis@redhat.com> - 1.2.25-4
 - Resolves: rhbz#1566748