Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package crypto-policies for openSUSE:Factory
checked in at 2026-08-04 21:27:40
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/crypto-policies (Old)
and /work/SRC/openSUSE:Factory/.crypto-policies.new.16738 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "crypto-policies"
Tue Aug 4 21:27:40 2026 rev:17 rq:1369105 version:20250714.cd6043a
Changes:
--------
--- /work/SRC/openSUSE:Factory/crypto-policies/crypto-policies.changes
2026-05-21 18:27:21.702616415 +0200
+++
/work/SRC/openSUSE:Factory/.crypto-policies.new.16738/crypto-policies.changes
2026-08-04 21:28:21.495484288 +0200
@@ -1,0 +2,7 @@
+Fri Jul 31 00:58:13 UTC 2026 - Lucas Mulling <[email protected]>
+
+- Disable umac-128* in DEFAULT, FUTURE and BSI openssh policies (bsc#1259515)
+ * Add patch:
+
crypto-policies-Disable-umac-128-in-DEFAULT-FUTURE-and-BSI-openssh-policies.patch
+
+-------------------------------------------------------------------
New:
----
crypto-policies-Disable-umac-128-in-DEFAULT-FUTURE-and-BSI-openssh-policies.patch
----------(New B)----------
New: * Add patch:
crypto-policies-Disable-umac-128-in-DEFAULT-FUTURE-and-BSI-openssh-policies.patch
----------(New E)----------
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ crypto-policies.spec ++++++
--- /var/tmp/diff_new_pack.ziKxf6/_old 2026-08-04 21:28:22.347513797 +0200
+++ /var/tmp/diff_new_pack.ziKxf6/_new 2026-08-04 21:28:22.351513935 +0200
@@ -57,6 +57,8 @@
Patch7: crypto-policies-Allow-openssl-other-policies-in-FIPS-mode.patch
#PATCH-FIX-UPSTREAM Add PQC support for OpenSSH (bsc#1258311, bsc#1259825)
Patch8: crypto-policies-OpenSSH-PQC.patch
+#PATCH-FIX-UPSTREAM Disable umac-128 (bsc#1259515)
+Patch9:
crypto-policies-Disable-umac-128-in-DEFAULT-FUTURE-and-BSI-openssh-policies.patch
BuildRequires: python3-base >= 3.11
%if %{with manbuild}
BuildRequires: asciidoc
++++++
crypto-policies-Disable-umac-128-in-DEFAULT-FUTURE-and-BSI-openssh-policies.patch
++++++
>From a18f60c0e269a5a3913affb64eaa84ef442b9312 Mon Sep 17 00:00:00 2001
From: Lucas Mulling <[email protected]>
Date: Wed, 29 Jul 2026 16:06:30 -0300
Subject: [PATCH] Disable umac-128 in DEFAULT, FUTURE and BSI openssh policies
Signed-off-by: Lucas Mulling <[email protected]>
---
policies/BSI.pol | 3 +++
policies/DEFAULT.pol | 3 +++
policies/FEDORA42.pol | 2 ++
policies/FEDORA43.pol | 2 ++
policies/FUTURE.pol | 3 +++
tests/outputs/BSI-openssh.txt | 2 +-
tests/outputs/BSI-opensshserver.txt | 2 +-
tests/outputs/DEFAULT-openssh.txt | 2 +-
tests/outputs/DEFAULT-opensshserver.txt | 2 +-
tests/outputs/DEFAULT:GOST-openssh.txt | 2 +-
tests/outputs/DEFAULT:GOST-opensshserver.txt | 2 +-
tests/outputs/DEFAULT:NO-PQ-openssh.txt | 2 +-
tests/outputs/DEFAULT:NO-PQ-opensshserver.txt | 2 +-
tests/outputs/DEFAULT:TEST-PQ-openssh.txt | 2 +-
tests/outputs/DEFAULT:TEST-PQ-opensshserver.txt | 2 +-
tests/outputs/FEDORA42-openssh.txt | 2 +-
tests/outputs/FEDORA42-opensshserver.txt | 2 +-
tests/outputs/FEDORA43-openssh.txt | 2 +-
tests/outputs/FEDORA43-opensshserver.txt | 2 +-
tests/outputs/FUTURE-openssh.txt | 2 +-
tests/outputs/FUTURE-opensshserver.txt | 2 +-
21 files changed, 29 insertions(+), 16 deletions(-)
Index: fedora-crypto-policies-20250714.cd6043a/policies/BSI.pol
===================================================================
--- fedora-crypto-policies-20250714.cd6043a.orig/policies/BSI.pol
+++ fedora-crypto-policies-20250714.cd6043a/policies/BSI.pol
@@ -63,6 +63,9 @@ cipher@{sequoia,RPM} = AES-256-CFB AES-2
# and disabled in client OpenSSH 7.6 (2017) and server OpenSSH 6.7 (2014).
cipher@SSH = -*-CBC
+# BSI-TR-02102 recommends HMAC-SHA2-256 and HMAC-SHA2-512
+mac@SSH = -UMAC-128
+
# BSI TR 02102-2 / revision 2023.1, Table 1 and Table 2
# Note this goes to all ciphers. DHE-GSS is not valid for TLS, but used in SSH.
# TLS: ECDHE DHE DHE-RSA PSK DHE-PSK ECDHE-PSK RSA-PSK are ok, GSS is not
used in TLS, will not be used for TLS
Index: fedora-crypto-policies-20250714.cd6043a/policies/DEFAULT.pol
===================================================================
--- fedora-crypto-policies-20250714.cd6043a.orig/policies/DEFAULT.pol
+++ fedora-crypto-policies-20250714.cd6043a/policies/DEFAULT.pol
@@ -58,6 +58,9 @@ cipher@{sequoia,RPM} = AES-256-CFB AES-2
# and disabled in client OpenSSH 7.6 (2017) and server OpenSSH 6.7 (2014).
cipher@SSH = -*-CBC
+# BSI-TR-02102 recommends HMAC-SHA2-256 and HMAC-SHA2-512
+mac@SSH = -UMAC-128
+
# 'RSA' is intentionally before DHE ciphersuites, as the DHE ciphersuites have
# interoperability issues in TLS.
key_exchange = KEM-ECDH ECDHE RSA DHE DHE-RSA PSK DHE-PSK ECDHE-PSK RSA-PSK
ECDHE-GSS DHE-GSS
Index: fedora-crypto-policies-20250714.cd6043a/policies/FEDORA42.pol
===================================================================
--- fedora-crypto-policies-20250714.cd6043a.orig/policies/FEDORA42.pol
+++ fedora-crypto-policies-20250714.cd6043a/policies/FEDORA42.pol
@@ -55,6 +55,8 @@ cipher@{sequoia,RPM} = AES-256-CFB AES-2
# and disabled in client OpenSSH 7.6 (2017) and server OpenSSH 6.7 (2014).
cipher@SSH = -*-CBC
+mac@SSH = -UMAC-128
+
# 'RSA' is intentionally before DHE ciphersuites, as the DHE ciphersuites have
# interoperability issues in TLS.
key_exchange = ECDHE RSA DHE DHE-RSA PSK DHE-PSK ECDHE-PSK RSA-PSK ECDHE-GSS
DHE-GSS
Index: fedora-crypto-policies-20250714.cd6043a/policies/FEDORA43.pol
===================================================================
--- fedora-crypto-policies-20250714.cd6043a.orig/policies/FEDORA43.pol
+++ fedora-crypto-policies-20250714.cd6043a/policies/FEDORA43.pol
@@ -58,6 +58,8 @@ cipher@{sequoia,RPM} = AES-256-CFB AES-2
# and disabled in client OpenSSH 7.6 (2017) and server OpenSSH 6.7 (2014).
cipher@SSH = -*-CBC
+mac@SSH = -UMAC-128
+
# 'RSA' is intentionally before DHE ciphersuites, as the DHE ciphersuites have
# interoperability issues in TLS.
key_exchange = KEM-ECDH ECDHE RSA DHE DHE-RSA PSK DHE-PSK ECDHE-PSK RSA-PSK
ECDHE-GSS DHE-GSS
Index: fedora-crypto-policies-20250714.cd6043a/policies/FUTURE.pol
===================================================================
--- fedora-crypto-policies-20250714.cd6043a.orig/policies/FUTURE.pol
+++ fedora-crypto-policies-20250714.cd6043a/policies/FUTURE.pol
@@ -52,6 +52,9 @@ cipher@{sequoia,RPM} = AES-256-CFB AES-2
# and disabled in client OpenSSH 7.6 (2017) and server OpenSSH 6.7 (2014).
cipher@SSH = -*-CBC
+# BSI-TR-02102 recommends HMAC-SHA2-256 and HMAC-SHA2-512
+mac@SSH = -UMAC-128
+
key_exchange = KEM-ECDH ECDHE DHE DHE-RSA PSK DHE-PSK ECDHE-PSK ECDHE-GSS
DHE-GSS
# Enable SNTRUP by default for OpenSSH
Index: fedora-crypto-policies-20250714.cd6043a/tests/outputs/BSI-openssh.txt
===================================================================
--- fedora-crypto-policies-20250714.cd6043a.orig/tests/outputs/BSI-openssh.txt
+++ fedora-crypto-policies-20250714.cd6043a/tests/outputs/BSI-openssh.txt
@@ -1,5 +1,5 @@
Ciphers [email protected],aes256-ctr,[email protected],aes128-ctr
-MACs
[email protected],[email protected],[email protected],hmac-sha2-256,[email protected],hmac-sha2-512
+MACs
[email protected],[email protected],hmac-sha2-256,hmac-sha2-512
GSSAPIKexAlgorithms gss-nistp256-sha256-,gss-group16-sha512-
KexAlgorithms
ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512
PubkeyAcceptedAlgorithms
ecdsa-sha2-nistp256,[email protected],[email protected],[email protected],ecdsa-sha2-nistp384,[email protected],ecdsa-sha2-nistp521,[email protected],ssh-ed25519,[email protected],[email protected],[email protected],rsa-sha2-256,[email protected],rsa-sha2-512,[email protected]
Index:
fedora-crypto-policies-20250714.cd6043a/tests/outputs/BSI-opensshserver.txt
===================================================================
---
fedora-crypto-policies-20250714.cd6043a.orig/tests/outputs/BSI-opensshserver.txt
+++ fedora-crypto-policies-20250714.cd6043a/tests/outputs/BSI-opensshserver.txt
@@ -1,5 +1,5 @@
Ciphers [email protected],aes256-ctr,[email protected],aes128-ctr
-MACs
[email protected],[email protected],[email protected],hmac-sha2-256,[email protected],hmac-sha2-512
+MACs
[email protected],[email protected],hmac-sha2-256,hmac-sha2-512
GSSAPIKexAlgorithms gss-nistp256-sha256-,gss-group16-sha512-
KexAlgorithms
ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512
HostKeyAlgorithms
ecdsa-sha2-nistp256,[email protected],[email protected],[email protected],ecdsa-sha2-nistp384,[email protected],ecdsa-sha2-nistp521,[email protected],ssh-ed25519,[email protected],[email protected],[email protected],rsa-sha2-256,[email protected],rsa-sha2-512,[email protected]
Index: fedora-crypto-policies-20250714.cd6043a/tests/outputs/DEFAULT-openssh.txt
===================================================================
---
fedora-crypto-policies-20250714.cd6043a.orig/tests/outputs/DEFAULT-openssh.txt
+++ fedora-crypto-policies-20250714.cd6043a/tests/outputs/DEFAULT-openssh.txt
@@ -1,5 +1,5 @@
Ciphers
[email protected],[email protected],aes256-ctr,[email protected],aes128-ctr
-MACs
[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha1,[email protected],hmac-sha2-512
+MACs
[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha1,hmac-sha2-512
GSSAPIKexAlgorithms
gss-nistp256-sha256-,gss-group14-sha256-,gss-group16-sha512-
KexAlgorithms
mlkem768x25519-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512
PubkeyAcceptedAlgorithms
ecdsa-sha2-nistp256,[email protected],[email protected],[email protected],ecdsa-sha2-nistp384,[email protected],ecdsa-sha2-nistp521,[email protected],ssh-ed25519,[email protected],[email protected],[email protected],rsa-sha2-256,[email protected],rsa-sha2-512,[email protected]
Index:
fedora-crypto-policies-20250714.cd6043a/tests/outputs/DEFAULT-opensshserver.txt
===================================================================
---
fedora-crypto-policies-20250714.cd6043a.orig/tests/outputs/DEFAULT-opensshserver.txt
+++
fedora-crypto-policies-20250714.cd6043a/tests/outputs/DEFAULT-opensshserver.txt
@@ -1,5 +1,5 @@
Ciphers
[email protected],[email protected],aes256-ctr,[email protected],aes128-ctr
-MACs
[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha1,[email protected],hmac-sha2-512
+MACs
[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha1,hmac-sha2-512
GSSAPIKexAlgorithms
gss-curve25519-sha256-,gss-nistp256-sha256-,gss-group14-sha256-,gss-group16-sha512-
KexAlgorithms
mlkem768x25519-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512
HostKeyAlgorithms
ecdsa-sha2-nistp256,[email protected],[email protected],[email protected],ecdsa-sha2-nistp384,[email protected],ecdsa-sha2-nistp521,[email protected],ssh-ed25519,[email protected],[email protected],[email protected],rsa-sha2-256,[email protected],rsa-sha2-512,[email protected]
Index:
fedora-crypto-policies-20250714.cd6043a/tests/outputs/FEDORA42-openssh.txt
===================================================================
---
fedora-crypto-policies-20250714.cd6043a.orig/tests/outputs/FEDORA42-openssh.txt
+++ fedora-crypto-policies-20250714.cd6043a/tests/outputs/FEDORA42-openssh.txt
@@ -1,5 +1,5 @@
Ciphers
[email protected],[email protected],aes256-ctr,[email protected],aes128-ctr
-MACs
[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha1,[email protected],hmac-sha2-512
+MACs
[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha1,hmac-sha2-512
GSSAPIKexAlgorithms
gss-curve25519-sha256-,gss-nistp256-sha256-,gss-group14-sha256-,gss-group16-sha512-
KexAlgorithms
curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512
PubkeyAcceptedAlgorithms
ecdsa-sha2-nistp256,[email protected],[email protected],[email protected],ecdsa-sha2-nistp384,[email protected],ecdsa-sha2-nistp521,[email protected],ssh-ed25519,[email protected],[email protected],[email protected],rsa-sha2-256,[email protected],rsa-sha2-512,[email protected]
Index:
fedora-crypto-policies-20250714.cd6043a/tests/outputs/FEDORA42-opensshserver.txt
===================================================================
---
fedora-crypto-policies-20250714.cd6043a.orig/tests/outputs/FEDORA42-opensshserver.txt
+++
fedora-crypto-policies-20250714.cd6043a/tests/outputs/FEDORA42-opensshserver.txt
@@ -1,5 +1,5 @@
Ciphers
[email protected],[email protected],aes256-ctr,[email protected],aes128-ctr
-MACs
[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha1,[email protected],hmac-sha2-512
+MACs
[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha1,hmac-sha2-512
GSSAPIKexAlgorithms
gss-curve25519-sha256-,gss-nistp256-sha256-,gss-group14-sha256-,gss-group16-sha512-
KexAlgorithms
curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512
HostKeyAlgorithms
ecdsa-sha2-nistp256,[email protected],[email protected],[email protected],ecdsa-sha2-nistp384,[email protected],ecdsa-sha2-nistp521,[email protected],ssh-ed25519,[email protected],[email protected],[email protected],rsa-sha2-256,[email protected],rsa-sha2-512,[email protected]
Index:
fedora-crypto-policies-20250714.cd6043a/tests/outputs/FEDORA43-openssh.txt
===================================================================
---
fedora-crypto-policies-20250714.cd6043a.orig/tests/outputs/FEDORA43-openssh.txt
+++ fedora-crypto-policies-20250714.cd6043a/tests/outputs/FEDORA43-openssh.txt
@@ -1,5 +1,5 @@
Ciphers
[email protected],[email protected],aes256-ctr,[email protected],aes128-ctr
-MACs
[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha1,[email protected],hmac-sha2-512
+MACs
[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha1,hmac-sha2-512
GSSAPIKexAlgorithms
gss-curve25519-sha256-,gss-nistp256-sha256-,gss-group14-sha256-,gss-group16-sha512-
KexAlgorithms
mlkem768x25519-sha256,curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512
PubkeyAcceptedAlgorithms
ecdsa-sha2-nistp256,[email protected],[email protected],[email protected],ecdsa-sha2-nistp384,[email protected],ecdsa-sha2-nistp521,[email protected],ssh-ed25519,[email protected],[email protected],[email protected],rsa-sha2-256,[email protected],rsa-sha2-512,[email protected]
Index:
fedora-crypto-policies-20250714.cd6043a/tests/outputs/FEDORA43-opensshserver.txt
===================================================================
---
fedora-crypto-policies-20250714.cd6043a.orig/tests/outputs/FEDORA43-opensshserver.txt
+++
fedora-crypto-policies-20250714.cd6043a/tests/outputs/FEDORA43-opensshserver.txt
@@ -1,5 +1,5 @@
Ciphers
[email protected],[email protected],aes256-ctr,[email protected],aes128-ctr
-MACs
[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha1,[email protected],hmac-sha2-512
+MACs
[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha1,hmac-sha2-512
GSSAPIKexAlgorithms
gss-curve25519-sha256-,gss-nistp256-sha256-,gss-group14-sha256-,gss-group16-sha512-
KexAlgorithms
mlkem768x25519-sha256,curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512
HostKeyAlgorithms
ecdsa-sha2-nistp256,[email protected],[email protected],[email protected],ecdsa-sha2-nistp384,[email protected],ecdsa-sha2-nistp521,[email protected],ssh-ed25519,[email protected],[email protected],[email protected],rsa-sha2-256,[email protected],rsa-sha2-512,[email protected]
Index: fedora-crypto-policies-20250714.cd6043a/tests/outputs/FUTURE-openssh.txt
===================================================================
---
fedora-crypto-policies-20250714.cd6043a.orig/tests/outputs/FUTURE-openssh.txt
+++ fedora-crypto-policies-20250714.cd6043a/tests/outputs/FUTURE-openssh.txt
@@ -1,5 +1,5 @@
Ciphers [email protected],[email protected],aes256-ctr
-MACs
[email protected],[email protected],[email protected],hmac-sha2-256,[email protected],hmac-sha2-512
+MACs
[email protected],[email protected],hmac-sha2-256,hmac-sha2-512
GSSAPIKexAlgorithms
gss-curve25519-sha256-,gss-nistp256-sha256-,gss-group16-sha512-
KexAlgorithms
mlkem768x25519-sha256,curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512
PubkeyAcceptedAlgorithms
ecdsa-sha2-nistp256,[email protected],[email protected],[email protected],ecdsa-sha2-nistp384,[email protected],ecdsa-sha2-nistp521,[email protected],ssh-ed25519,[email protected],[email protected],[email protected],rsa-sha2-256,[email protected],rsa-sha2-512,[email protected]
Index:
fedora-crypto-policies-20250714.cd6043a/tests/outputs/FUTURE-opensshserver.txt
===================================================================
---
fedora-crypto-policies-20250714.cd6043a.orig/tests/outputs/FUTURE-opensshserver.txt
+++
fedora-crypto-policies-20250714.cd6043a/tests/outputs/FUTURE-opensshserver.txt
@@ -1,5 +1,5 @@
Ciphers [email protected],[email protected],aes256-ctr
-MACs
[email protected],[email protected],[email protected],hmac-sha2-256,[email protected],hmac-sha2-512
+MACs
[email protected],[email protected],hmac-sha2-256,hmac-sha2-512
GSSAPIKexAlgorithms
gss-curve25519-sha256-,gss-nistp256-sha256-,gss-group16-sha512-
KexAlgorithms
mlkem768x25519-sha256,curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512
HostKeyAlgorithms
ecdsa-sha2-nistp256,[email protected],[email protected],[email protected],ecdsa-sha2-nistp384,[email protected],ecdsa-sha2-nistp521,[email protected],ssh-ed25519,[email protected],[email protected],[email protected],rsa-sha2-256,[email protected],rsa-sha2-512,[email protected]
