Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package conscrypt for openSUSE:Factory checked in at 2026-08-25 13:20:35 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/conscrypt (Old) and /work/SRC/openSUSE:Factory/.conscrypt.new.1258 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "conscrypt" Tue Aug 25 13:20:35 2026 rev:6 rq:1373535 version:2.6.3 Changes: -------- --- /work/SRC/openSUSE:Factory/conscrypt/conscrypt.changes 2026-07-07 21:06:37.605386601 +0200 +++ /work/SRC/openSUSE:Factory/.conscrypt.new.1258/conscrypt.changes 2026-08-25 13:21:20.193598403 +0200 @@ -1,0 +2,29 @@ +Tue Aug 25 06:31:37 UTC 2026 - Fridrich Strba <[email protected]> + +- Added patch: + * ignore-unsupported-x25519kyber768draft00-group.patch + + fix the ignore-unsupported-x25519kyber768draft00-group.patch + by never calling the removed X25519Kyber768Draft00 + +------------------------------------------------------------------- +Mon Aug 24 07:50:00 UTC 2026 - Fridrich Strba <[email protected]> + +- Upgrade to upstream version 2.6.3 + * Fixes + + #1530: SSL errors using v2.6.2 + + #1526: Conscrypt 2.6+ incompatible with Netty + + #1519: Byte-array elements leak in EVP_DigestSign() + * Important changes since 2.5.x + + Many new algorithms, such as X25519, Ed25519, ML-DSA, + SLH-DSA, ML-KEM, X-Wing. + + For TLS, it supports X25519MLKEM768 and MLKEM1024. + + Includes a new HPKE interface. + + Support osx-aarch_64 (Apple Silicon) and linux-aarch_64 + (Linux on ARM). + + Dropped support of windows-x86 (32-bit Windows) + + On Linux, it requires GLIBC 2.35 or newer +- Removed patch: + * boringssl.patch + + not needed with this version and recent boringssl + +------------------------------------------------------------------- Old: ---- boringssl.patch conscrypt-2.5.2.tar.gz conscrypt-openjdk-2.5.2.pom New: ---- conscrypt-2.6.3.tar.gz conscrypt-openjdk-2.6.3.pom ignore-unsupported-x25519kyber768draft00-group.patch ----------(Old B)---------- Old:- Removed patch: * boringssl.patch + not needed with this version and recent boringssl ----------(Old E)---------- ----------(New B)---------- New:- Added patch: * ignore-unsupported-x25519kyber768draft00-group.patch + fix the ignore-unsupported-x25519kyber768draft00-group.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ conscrypt.spec ++++++ --- /var/tmp/diff_new_pack.YC4T4x/_old 2026-08-25 13:21:21.599647984 +0200 +++ /var/tmp/diff_new_pack.YC4T4x/_new 2026-08-25 13:21:21.601648055 +0200 @@ -17,8 +17,11 @@ %global ver_major 2 -%global ver_minor 5 -%global ver_patch 2 +%global ver_minor 6 +%global ver_patch 3 +%if 0%{?gcc_version} < 10 +%define with_gcc 11 +%endif Name: conscrypt Version: %{ver_major}.%{ver_minor}.%{ver_patch} Release: 0 @@ -28,11 +31,12 @@ URL: https://github.com/google/%{name} Source0: %{url}/archive/refs/tags/%{version}.tar.gz#/%{name}-%{version}.tar.gz Source1: https://repo1.maven.org/maven2/org/%{name}/%{name}-openjdk/%{version}/%{name}-openjdk-%{version}.pom -Patch0: boringssl.patch +# fixes: https://github.com/google/conscrypt/issues/1530 +Patch0: ignore-unsupported-x25519kyber768draft00-group.patch BuildRequires: boringssl-devel BuildRequires: cmake BuildRequires: fdupes -BuildRequires: gcc-c++ +BuildRequires: gcc%{?with_gcc}-c++ BuildRequires: maven-local %description @@ -52,8 +56,8 @@ %prep %setup -q -cp %{SOURCE1} openjdk/pom.xml %patch -P 0 -p1 +cp %{SOURCE1} openjdk/pom.xml %pom_xpath_remove pom:packaging openjdk %pom_add_plugin org.apache.maven.plugins:maven-jar-plugin openjdk \ @@ -71,14 +75,6 @@ cp -rv common/src openjdk/ -sed -i -e 's#<openssl/#<boringssl/#' \ - constants/src/gen/cpp/generate_constants.cc \ - common/src/jni/main/cpp/conscrypt/*.cc \ - common/src/jni/main/include/conscrypt/jniutil.h \ - common/src/jni/main/include/conscrypt/bio_input_stream.h \ - common/src/jni/main/include/conscrypt/scoped_ssl_bio.h \ - common/src/jni/main/include/conscrypt/ssl_error.h - cat <<__CMAKELISTS__ >openjdk/CMakeLists.txt cmake_minimum_required(VERSION 3.5.0) project(conscrypt_jni LANGUAGES CXX) @@ -88,12 +84,11 @@ ../common/src/jni/main/cpp/conscrypt/jniutil.cc ../common/src/jni/main/cpp/conscrypt/native_crypto.cc ../common/src/jni/main/cpp/conscrypt/netutil.cc - ../common/src/jni/main/cpp/conscrypt/trace.cc ) include_directories( + %{_includedir}/boringssl ../common/src/jni/main/include/ ../common/src/jni/unbundled/include/ - %{_includedir}/boringssl ${JAVA_HOME}/include/ ${JAVA_HOME}/include/linux/ ) @@ -102,6 +97,10 @@ %build pushd openjdk +%if 0%{?with_gcc} +export CXX=g++-%{with_gcc} +export CC=gcc-%{with_gcc} +%endif %cmake . %cmake_build mkdir -p ../src/main/resources/META-INF/native/ @@ -116,7 +115,7 @@ __PROPERTIES__ popd -env -Cconstants g++ src/gen/cpp/generate_constants.cc -o generate_constants +env -Cconstants ${CXX:-g++} -I%{_includedir}/boringssl src/gen/cpp/generate_constants.cc -o generate_constants ./constants/generate_constants >openjdk/src/main/java/org/conscrypt/NativeConstants.java pushd openjdk ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.YC4T4x/_old 2026-08-25 13:21:21.639649395 +0200 +++ /var/tmp/diff_new_pack.YC4T4x/_new 2026-08-25 13:21:21.643649536 +0200 @@ -1,6 +1,6 @@ -mtime: 1783405105 -commit: 8b867e3d7ddc7b784a46bf9cc440e6f4b6bdd133348a289898e2ed688325ebdd +mtime: 1787639718 +commit: 64591840cb7913a9d91b59e8ef9c7c9dc867a49a637394104a362d09cc370444 url: https://src.opensuse.org/java-packages/conscrypt -revision: 8b867e3d7ddc7b784a46bf9cc440e6f4b6bdd133348a289898e2ed688325ebdd +revision: 64591840cb7913a9d91b59e8ef9c7c9dc867a49a637394104a362d09cc370444 projectscmsync: https://src.opensuse.org/java-packages/_ObsPrj ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-08-25 08:35:18.000000000 +0200 @@ -0,0 +1 @@ +.osc ++++++ conscrypt-2.5.2.tar.gz -> conscrypt-2.6.3.tar.gz ++++++ /work/SRC/openSUSE:Factory/conscrypt/conscrypt-2.5.2.tar.gz /work/SRC/openSUSE:Factory/.conscrypt.new.1258/conscrypt-2.6.3.tar.gz differ: char 12, line 1 ++++++ conscrypt-openjdk-2.5.2.pom -> conscrypt-openjdk-2.6.3.pom ++++++ --- /work/SRC/openSUSE:Factory/conscrypt/conscrypt-openjdk-2.5.2.pom 2024-10-12 13:35:45.541242143 +0200 +++ /work/SRC/openSUSE:Factory/.conscrypt.new.1258/conscrypt-openjdk-2.6.3.pom 2026-08-25 13:21:20.175597768 +0200 @@ -1,33 +1,33 @@ -<?xml version="1.0" encoding="UTF-8"?> -<project xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"; xmlns="http://maven.apache.org/POM/4.0.0"; - xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";> - <modelVersion>4.0.0</modelVersion> - <groupId>org.conscrypt</groupId> - <artifactId>conscrypt-openjdk</artifactId> - <version>2.5.2</version> - <packaging>pom</packaging> - <name>org.conscrypt:conscrypt-openjdk</name> - <description>Conscrypt: OpenJdk</description> - <url>https://conscrypt.org/</url> - <licenses> - <license> - <name>Apache 2</name> - <url>https://www.apache.org/licenses/LICENSE-2.0</url> - </license> - </licenses> - <developers> - <developer> - <id>conscrypt</id> - <name>Conscrypt Contributors</name> - <email>[email protected]</email> - <url>https://conscrypt.org/</url> - <organization>Google, Inc.</organization> - <organizationUrl>https://www.google.com</organizationUrl> - </developer> - </developers> - <scm> - <connection>scm:git:https://github.com/google/conscrypt.git</connection> - <developerConnection>scm:git:[email protected]:google/conscrypt.git</developerConnection> - <url>https://github.com/google/conscrypt</url> - </scm> -</project> +<?xml version="1.0" encoding="UTF-8"?> +<project xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd"; xmlns="http://maven.apache.org/POM/4.0.0"; + xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";> + <modelVersion>4.0.0</modelVersion> + <groupId>org.conscrypt</groupId> + <artifactId>conscrypt-openjdk</artifactId> + <version>2.6.3</version> + <packaging>pom</packaging> + <name>org.conscrypt:conscrypt-openjdk</name> + <description>Conscrypt: OpenJdk</description> + <url>https://conscrypt.org/</url> + <licenses> + <license> + <name>Apache 2</name> + <url>https://www.apache.org/licenses/LICENSE-2.0</url> + </license> + </licenses> + <developers> + <developer> + <id>conscrypt</id> + <name>Conscrypt Contributors</name> + <email>[email protected]</email> + <url>https://conscrypt.org/</url> + <organization>Google, Inc.</organization> + <organizationUrl>https://www.google.com</organizationUrl> + </developer> + </developers> + <scm> + <connection>scm:git:https://github.com/google/conscrypt.git</connection> + <developerConnection>scm:git:[email protected]:google/conscrypt.git</developerConnection> + <url>https://github.com/google/conscrypt</url> + </scm> +</project> ++++++ ignore-unsupported-x25519kyber768draft00-group.patch ++++++ --- a/common/src/main/java/org/conscrypt/NativeSsl.java +++ b/common/src/main/java/org/conscrypt/NativeSsl.java @@ -296,7 +296,9 @@ case "X25519MLKEM768": return NativeConstants.NID_X25519MLKEM768; case "X25519Kyber768Draft00": - return NativeConstants.NID_X25519Kyber768Draft00; + // Not in this BoringSSL's group table; SSL_set1_groups() rejects the + // whole list on one unknown id, so drop it rather than fail the handshake. + return -1; case "MLKEM1024": return NativeConstants.NID_ML_KEM_1024; default: --- a/openjdk/src/test/java/org/conscrypt/NativeSslTest.java +++ b/openjdk/src/test/java/org/conscrypt/NativeSslTest.java @@ -45,8 +45,6 @@ NativeSsl.toBoringSslGroups(new String[] {"secp521r1"})); assertArrayEquals(new int[] {NativeConstants.NID_X25519MLKEM768}, NativeSsl.toBoringSslGroups(new String[] {"X25519MLKEM768"})); - assertArrayEquals(new int[] {NativeConstants.NID_X25519Kyber768Draft00}, - NativeSsl.toBoringSslGroups(new String[] {"X25519Kyber768Draft00"})); assertArrayEquals(new int[] {NativeConstants.NID_ML_KEM_1024}, NativeSsl.toBoringSslGroups(new String[] {"MLKEM1024"})); } @@ -66,6 +64,14 @@ } @Test + public void toBoringSslGroups_ignoresX25519Kyber768Draft00() { + // Not present in this BoringSSL's group table; see NativeSsl.toBoringSslGroup(). + assertArrayEquals( + new int[] {NativeConstants.NID_X25519}, + NativeSsl.toBoringSslGroups(new String[] {"X25519Kyber768Draft00", "X25519"})); + } + + @Test public void toBoringSslGroups_throwsIfNoKnownGroupsFound() { assertThrows(IllegalArgumentException.class, () -> NativeSsl.toBoringSslGroups(new String[] {}));
