Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package evolution-data-server for openSUSE:Factory checked in at 2023-05-30 22:01:04 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/evolution-data-server (Old) and /work/SRC/openSUSE:Factory/.evolution-data-server.new.1533 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "evolution-data-server" Tue May 30 22:01:04 2023 rev:246 rq:1089507 version:3.48.2 Changes: -------- --- /work/SRC/openSUSE:Factory/evolution-data-server/evolution-data-server.changes 2023-04-22 21:57:49.052268395 +0200 +++ /work/SRC/openSUSE:Factory/.evolution-data-server.new.1533/evolution-data-server.changes 2023-05-30 22:01:05.458532401 +0200 @@ -1,0 +2,10 @@ +Fri May 26 13:40:03 UTC 2023 - Bjørn Lie <bjorn....@gmail.com> + +- Update to version 3.48.2: + + Bug Fixed: + - Camel: Set proper S/MIME signature verification status. + - IMAP: Cannot remove labels added in Thunderbird. + - WebDAV: Fails to discover iCloud address book. + - Wrong S/MIME certificate selection for encrypted email. + +------------------------------------------------------------------- Old: ---- evolution-data-server-3.48.1.tar.xz New: ---- evolution-data-server-3.48.2.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ evolution-data-server.spec ++++++ --- /var/tmp/diff_new_pack.ZquiQr/_old 2023-05-30 22:01:06.066535985 +0200 +++ /var/tmp/diff_new_pack.ZquiQr/_new 2023-05-30 22:01:06.070536009 +0200 @@ -32,7 +32,7 @@ %bcond_without introspection Name: evolution-data-server -Version: 3.48.1 +Version: 3.48.2 Release: 0 Summary: Evolution Data Server License: LGPL-2.0-only ++++++ evolution-data-server-3.48.1.tar.xz -> evolution-data-server-3.48.2.tar.xz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/evolution-data-server-3.48.1/CMakeLists.txt new/evolution-data-server-3.48.2/CMakeLists.txt --- old/evolution-data-server-3.48.1/CMakeLists.txt 2023-04-21 07:03:32.000000000 +0200 +++ new/evolution-data-server-3.48.2/CMakeLists.txt 2023-05-26 07:18:42.000000000 +0200 @@ -4,7 +4,7 @@ cmake_policy(VERSION 3.1) project(evolution-data-server - VERSION 3.48.1 + VERSION 3.48.2 LANGUAGES C CXX) set(PROJECT_BUGREPORT "https://gitlab.gnome.org/GNOME/evolution-data-server/issues/") diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/evolution-data-server-3.48.1/NEWS new/evolution-data-server-3.48.2/NEWS --- old/evolution-data-server-3.48.1/NEWS 2023-04-21 07:03:32.000000000 +0200 +++ new/evolution-data-server-3.48.2/NEWS 2023-05-26 07:18:42.000000000 +0200 @@ -1,3 +1,12 @@ +Evolution-Data-Server 3.48.2 2023-05-26 +--------------------------------------- + +Bug Fixes: + I#474 - Camel: Set proper S/MIME signature verification status + I#478 - IMAP: Cannot remove labels added in Thunderbird + I#479 - WebDAV: Fails to discover iCloud address book + evo-I#2345 - Wrong S/MIME certificate selection for encrypted email + Evolution-Data-Server 3.48.1 2023-04-21 --------------------------------------- diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/evolution-data-server-3.48.1/src/addressbook/libebook/CMakeLists.txt new/evolution-data-server-3.48.2/src/addressbook/libebook/CMakeLists.txt --- old/evolution-data-server-3.48.1/src/addressbook/libebook/CMakeLists.txt 2023-04-21 07:03:32.000000000 +0200 +++ new/evolution-data-server-3.48.2/src/addressbook/libebook/CMakeLists.txt 2023-05-26 07:18:42.000000000 +0200 @@ -61,6 +61,7 @@ target_compile_options(ebook PUBLIC ${ADDRESSBOOK_CFLAGS} + ${CAMEL_CFLAGS} ) target_include_directories(ebook PUBLIC @@ -74,11 +75,13 @@ ${CMAKE_CURRENT_BINARY_DIR} ${CMAKE_CURRENT_SOURCE_DIR} ${ADDRESSBOOK_INCLUDE_DIRS} + ${CAMEL_INCLUDE_DIRS} ) target_link_libraries(ebook ${DEPENDENCIES} ${ADDRESSBOOK_LDFLAGS} + ${CAMEL_LDFLAGS} ) install(TARGETS ebook diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/evolution-data-server-3.48.1/src/addressbook/libebook/e-book-utils.c new/evolution-data-server-3.48.2/src/addressbook/libebook/e-book-utils.c --- old/evolution-data-server-3.48.1/src/addressbook/libebook/e-book-utils.c 2023-04-21 07:03:32.000000000 +0200 +++ new/evolution-data-server-3.48.2/src/addressbook/libebook/e-book-utils.c 2023-05-26 07:18:42.000000000 +0200 @@ -18,6 +18,10 @@ #include "evolution-data-server-config.h" +#ifdef ENABLE_SMIME +#include <cert.h> +#endif + #include "camel/camel.h" #include "libebook-contacts/libebook-contacts.h" @@ -135,6 +139,22 @@ decoded = e_vcard_attribute_get_value_decoded (cattr); if (decoded && decoded->len) { + #ifdef ENABLE_SMIME + if (field_id == E_CONTACT_X509_CERT) { + CERTCertificate *nss_cert; + gboolean usable; + + nss_cert = CERT_DecodeCertFromPackage (decoded->str, decoded->len); + usable = nss_cert && (nss_cert->keyUsage & certificateUsageEmailRecipient) != 0; + if (nss_cert) + CERT_DestroyCertificate (nss_cert); + + if (!usable) { + g_string_free (decoded, TRUE); + continue; + } + } + #endif base64_data = g_base64_encode ((const guchar *) decoded->str, decoded->len); g_string_free (decoded, TRUE); break; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/evolution-data-server-3.48.1/src/camel/camel-smime-context.c new/evolution-data-server-3.48.2/src/camel/camel-smime-context.c --- old/evolution-data-server-3.48.1/src/camel/camel-smime-context.c 2023-04-21 07:03:32.000000000 +0200 +++ new/evolution-data-server-3.48.2/src/camel/camel-smime-context.c 2023-05-26 07:18:42.000000000 +0200 @@ -490,25 +490,31 @@ } static const gchar * -sm_status_description (NSSCMSVerificationStatus status) +sm_status_description (NSSCMSVerificationStatus status, + CamelCipherValiditySign *out_sign_status) { /* could use this but then we can't control i18n? */ /*NSS_CMSUtil_VerificationStatusToString (status));*/ + *out_sign_status = CAMEL_CIPHER_VALIDITY_SIGN_BAD; + switch (status) { case NSSCMSVS_Unverified: default: /* Translators: A fallback message when couldn't verify an SMIME signature */ return _("Unverified"); case NSSCMSVS_GoodSignature: + *out_sign_status = CAMEL_CIPHER_VALIDITY_SIGN_GOOD; return _("Good signature"); case NSSCMSVS_BadSignature: return _("Bad signature"); case NSSCMSVS_DigestMismatch: return _("Content tampered with or altered in transit"); case NSSCMSVS_SigningCertNotFound: + *out_sign_status = CAMEL_CIPHER_VALIDITY_SIGN_NEED_PUBLIC_KEY; return _("Signing certificate not found"); case NSSCMSVS_SigningCertNotTrusted: + *out_sign_status = CAMEL_CIPHER_VALIDITY_SIGN_UNKNOWN; return _("Signing certificate not trusted"); case NSSCMSVS_SignatureAlgorithmUnknown: return _("Signature algorithm unknown"); @@ -521,6 +527,125 @@ } } +/* Below camel_smime_NSS_...() functions are copy&pasted from NSS, + because they are available in the header files, but not exported + in the libraries... */ +static SECOidTag +camel_smime_NSS_CMSUtil_MapSignAlgs (SECOidTag signAlg) +{ + switch (signAlg) { + case SEC_OID_PKCS1_MD2_WITH_RSA_ENCRYPTION: + return SEC_OID_MD2; + case SEC_OID_PKCS1_MD5_WITH_RSA_ENCRYPTION: + return SEC_OID_MD5; + case SEC_OID_PKCS1_SHA1_WITH_RSA_ENCRYPTION: + case SEC_OID_ANSIX962_ECDSA_SHA1_SIGNATURE: + case SEC_OID_ANSIX9_DSA_SIGNATURE_WITH_SHA1_DIGEST: + return SEC_OID_SHA1; + case SEC_OID_PKCS1_SHA256_WITH_RSA_ENCRYPTION: + case SEC_OID_ANSIX962_ECDSA_SHA256_SIGNATURE: + return SEC_OID_SHA256; + case SEC_OID_PKCS1_SHA384_WITH_RSA_ENCRYPTION: + case SEC_OID_ANSIX962_ECDSA_SHA384_SIGNATURE: + return SEC_OID_SHA384; + case SEC_OID_PKCS1_SHA512_WITH_RSA_ENCRYPTION: + case SEC_OID_ANSIX962_ECDSA_SHA512_SIGNATURE: + return SEC_OID_SHA512; + default: + break; + } + /* not one of the algtags incorrectly sent to us*/ + return signAlg; +} + +static SECOidData * +camel_smime_NSS_CMSSignerInfo_GetDigestAlg (NSSCMSSignerInfo *signerinfo) +{ + SECOidData *algdata; + SECOidTag algtag; + + algdata = SECOID_FindOID (&(signerinfo->digestAlg.algorithm)); + if (algdata == NULL) { + return algdata; + } + /* Windows may have given us a signer algorithm oid instead of a digest + * algorithm oid. This call will map to a signer oid to a digest one, + * otherwise it leaves the oid alone and let the chips fall as they may + * if it's not a digest oid. + */ + algtag = camel_smime_NSS_CMSUtil_MapSignAlgs (algdata->offset); + if (algtag != algdata->offset) { + /* if the tags don't match, then we must have received a signer + * algorithID. Now we need to get the oid data for the digest + * oid, which the rest of the code is expecting */ + algdata = SECOID_FindOIDByTag (algtag); + } + + return algdata; +} + +static gint +camel_smime_NSS_CMSAlgArray_GetIndexByAlgTag (SECAlgorithmID **algorithmArray, + SECOidTag algtag) +{ + SECOidData *algid; + int i = -1; + + if (algorithmArray == NULL || algorithmArray[0] == NULL) + return i; + + algid = SECOID_FindOIDByTag (algtag); + if (!algid) + return i; + for (i = 0; algorithmArray[i] != NULL; i++) { + if (SECITEM_ItemsAreEqual (&algorithmArray[i]->algorithm, &algid->oid)) + break; /* bingo */ + } + + if (algorithmArray[i] == NULL) + return -1; /* not found */ + + return i; +} + +static SECItem * +camel_smime_NSS_CMSSignedData_GetDigestValue (NSSCMSSignedData *sigd, SECOidTag digestalgtag) +{ + int n; + + if (!sigd) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return NULL; + } + + if (sigd->digestAlgorithms == NULL || sigd->digests == NULL) { + PORT_SetError(SEC_ERROR_DIGEST_NOT_FOUND); + return NULL; + } + + n = camel_smime_NSS_CMSAlgArray_GetIndexByAlgTag (sigd->digestAlgorithms, digestalgtag); + + return (n < 0) ? NULL : sigd->digests[n]; +} + +static SECItem * +camel_smime_NSS_CMSContentInfo_GetContentTypeOID (NSSCMSContentInfo *cinfo) +{ + if (cinfo == NULL) { + return NULL; + } + + if (cinfo->contentTypeTag == NULL) { + cinfo->contentTypeTag = SECOID_FindOID (&(cinfo->contentType)); + } + + if (cinfo->contentTypeTag == NULL) { + return NULL; + } + + return &(cinfo->contentTypeTag->oid); +} + static CamelCipherValidity * sm_verify_cmsg (CamelCipherContext *context, NSSCMSMessage *cmsg, @@ -541,12 +666,12 @@ PLArenaPool *poolp = NULL; CamelStream *mem; NSSCMSVerificationStatus status; + CamelCipherValiditySign sign_status = CAMEL_CIPHER_VALIDITY_SIGN_UNKNOWN; CamelCipherValidity *valid; GString *description; description = g_string_new (""); valid = camel_cipher_validity_new (); - camel_cipher_validity_set_valid (valid, TRUE); status = NSSCMSVS_Unverified; /* NB: this probably needs to go into a decoding routine that can be used for processing @@ -641,6 +766,7 @@ for (j = 0; j < nsigners; j++) { CERTCertificate *cert; NSSCMSSignerInfo *si; + const gchar *status_description; gchar *cn, *em; gint idx; @@ -648,6 +774,33 @@ NSS_CMSSignedData_VerifySignerInfo (sigd, j, p->certdb, certUsageEmailSigner); status = NSS_CMSSignerInfo_GetVerificationStatus (si); + status_description = sm_status_description (status, &sign_status); + + /* certificate trust is verified first; check the signature itself, + because CAMEL_CIPHER_VALIDITY_SIGN_UNKNOWN means "valid signature, + but not trusted certificate" */ + if (status == NSSCMSVS_SigningCertNotTrusted) { + NSSCMSContentInfo *cinfo; + SECOidData *algiddata; + SECItem *contentType, *digest; + SECOidTag oidTag; + + cinfo = &(sigd->contentInfo); + + /* find digest and contentType for signerinfo */ + algiddata = camel_smime_NSS_CMSSignerInfo_GetDigestAlg (si); + oidTag = algiddata ? algiddata->offset : SEC_OID_UNKNOWN; + digest = camel_smime_NSS_CMSSignedData_GetDigestValue (sigd, oidTag); + /* NULL digest is acceptable. */ + contentType = camel_smime_NSS_CMSContentInfo_GetContentTypeOID (cinfo); + /* NULL contentType is acceptable. */ + + /* now verify signature */ + if (NSS_CMSSignerInfo_Verify (si, digest, contentType) != SECSuccess || + NSS_CMSSignerInfo_GetVerificationStatus (si) != NSSCMSVS_GoodSignature) { + sign_status = CAMEL_CIPHER_VALIDITY_SIGN_BAD; + } + } cn = NSS_CMSSignerInfo_GetSignerCommonName (si); em = NSS_CMSSignerInfo_GetSignerEmailAddress (si); @@ -655,7 +808,7 @@ g_string_append_printf ( description, _("Signer: %s <%s>: %s\n"), cn ? cn:"<unknown>", em ? em:"<unknown>", - sm_status_description (status)); + status_description); cert = NSS_CMSSignerInfo_GetSigningCertificate (si, p->certdb); @@ -695,9 +848,6 @@ PORT_Free (cn); if (em) PORT_Free (em); - - if (status != NSSCMSVS_GoodSignature) - camel_cipher_validity_set_valid (valid, FALSE); } } break; @@ -716,7 +866,7 @@ } } - camel_cipher_validity_set_valid (valid, camel_cipher_validity_get_valid (valid) && status == NSSCMSVS_GoodSignature); + valid->sign.status = sign_status; camel_cipher_validity_set_description (valid, description->str); g_string_free (description, TRUE); @@ -1119,6 +1269,7 @@ /* Cannot short-circuit when frd->certs_missing is 0, because there can be better certificates */ if (!frd->recipients_table || + !(cert->keyUsage & certificateUsageEmailRecipient) || CERT_CheckCertValidTimes (cert, frd->now, PR_FALSE) != secCertTimeValid) { return SECFailure; } @@ -1271,7 +1422,8 @@ /* Default to the provided certificate, if valid */ if (cert) { - if (CERT_CheckCertValidTimes (cert, frd.now, PR_FALSE) == secCertTimeValid) { + if ((cert->keyUsage & certificateUsageEmailRecipient) != 0 && + CERT_CheckCertValidTimes (cert, frd.now, PR_FALSE) == secCertTimeValid) { recipient_certs[i] = cert; frd.certs_missing--; } else { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/evolution-data-server-3.48.1/src/camel/providers/imapx/camel-imapx-server.c new/evolution-data-server-3.48.2/src/camel/providers/imapx/camel-imapx-server.c --- old/evolution-data-server-3.48.1/src/camel/providers/imapx/camel-imapx-server.c 2023-04-21 07:03:32.000000000 +0200 +++ new/evolution-data-server-3.48.2/src/camel/providers/imapx/camel-imapx-server.c 2023-05-26 07:18:42.000000000 +0200 @@ -6348,11 +6348,30 @@ if (imapx_uidset_add (&uidset, ic, camel_message_info_get_uid (info)) == 1 || (i == c->infos->len - 1 && imapx_uidset_done (&uidset, ic))) { + const gchar *renamed; gchar *utf7; + gboolean did_add; store_changes: - utf7 = camel_utf8_utf7 (c->name); + did_add = FALSE; + renamed = imapx_rename_label_flag (c->name, FALSE); + utf7 = camel_utf8_utf7 (renamed); - camel_imapx_command_add (ic, " %tFLAGS.SILENT (%t)", on ? "+" : "-", utf7 ? utf7 : c->name); + if (!on) { + /* For backward compatibility, where the old code could + write the original (used in evo) name to the server */ + if (g_ascii_strcasecmp (renamed, c->name) != 0) { + gchar *orig_utf7; + + orig_utf7 = camel_utf8_utf7 (c->name); + camel_imapx_command_add (ic, " -FLAGS.SILENT (%t %t)", utf7 ? utf7 : renamed, orig_utf7 ? orig_utf7 : c->name); + g_free (orig_utf7); + + did_add = TRUE; + } + } + + if (!did_add) + camel_imapx_command_add (ic, " %tFLAGS.SILENT (%t)", on ? "+" : "-", utf7 ? utf7 : renamed); g_free (utf7); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/evolution-data-server-3.48.1/src/camel/providers/imapx/camel-imapx-utils.c new/evolution-data-server-3.48.2/src/camel/providers/imapx/camel-imapx-utils.c --- old/evolution-data-server-3.48.1/src/camel/providers/imapx/camel-imapx-utils.c 2023-04-21 07:03:32.000000000 +0200 +++ new/evolution-data-server-3.48.2/src/camel/providers/imapx/camel-imapx-utils.c 2023-05-26 07:18:42.000000000 +0200 @@ -78,8 +78,6 @@ return 0; } -static const gchar * rename_label_flag (const gchar *flag, gint len, gboolean server_to_evo); - /* flag table */ static struct { const gchar *name; @@ -154,9 +152,7 @@ const gchar *flag_name; gchar *utf8; - flag_name = rename_label_flag ( - (gchar *) token, - strlen ((gchar *) token), TRUE); + flag_name = imapx_rename_label_flag ((const gchar *) token, TRUE); utf8 = camel_utf7_utf8 (flag_name); if (utf8 && !g_utf8_validate (utf8, -1, NULL)) { @@ -187,19 +183,16 @@ } /* - * rename_flag * Converts label flag name on server to name used in Evolution or back. - * if the flags does not match returns the original one as it is. + * If the flag does not match any known, returns the original one as it is. * It will never return NULL, it will return empty string, instead. * * @flag: Flag to rename. - * @len: Length of the flag name. * @server_to_evo: if TRUE, then converting server names to evo's names, if FALSE then opposite. */ -static const gchar * -rename_label_flag (const gchar *flag, - gint len, - gboolean server_to_evo) +const gchar * +imapx_rename_label_flag (const gchar *flag, + gboolean server_to_evo) { gint i; const gchar *labels[] = { @@ -212,11 +205,11 @@ /* It really can pass zero-length flags inside, in that case it was able * to always add first label, which is definitely wrong. */ - if (!len || !flag || !*flag) + if (!flag || !*flag) return ""; for (i = 0 + (server_to_evo ? 0 : 1); labels[i]; i = i + 2) { - if (!g_ascii_strncasecmp (flag, labels[i], len)) + if (!g_ascii_strcasecmp (flag, labels[i])) return labels[i + (server_to_evo ? 1 : -1)]; } @@ -258,7 +251,7 @@ continue; - flag_name = rename_label_flag (name, strlen (name), FALSE); + flag_name = imapx_rename_label_flag (name, FALSE); if (!first) g_string_append_c (string, ' '); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/evolution-data-server-3.48.1/src/camel/providers/imapx/camel-imapx-utils.h new/evolution-data-server-3.48.2/src/camel/providers/imapx/camel-imapx-utils.h --- old/evolution-data-server-3.48.1/src/camel/providers/imapx/camel-imapx-utils.h 2023-04-21 07:03:32.000000000 +0200 +++ new/evolution-data-server-3.48.2/src/camel/providers/imapx/camel-imapx-utils.h 2023-05-26 07:18:42.000000000 +0200 @@ -412,6 +412,8 @@ goffset file_size, GCancellable *cancellable, GError **error); +const gchar * imapx_rename_label_flag (const gchar *flag, + gboolean server_to_evo); G_END_DECLS diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/evolution-data-server-3.48.1/src/libedataserver/e-webdav-session.c new/evolution-data-server-3.48.2/src/libedataserver/e-webdav-session.c --- old/evolution-data-server-3.48.1/src/libedataserver/e-webdav-session.c 2023-04-21 07:03:32.000000000 +0200 +++ new/evolution-data-server-3.48.2/src/libedataserver/e-webdav-session.c 2023-05-26 07:18:42.000000000 +0200 @@ -3639,7 +3639,7 @@ EWebDAVResource *resource = link->data; if (resource && !resource->display_name && resource->href) { - gchar *href_decoded = g_filename_from_uri (resource->href, NULL, NULL); + gchar *href_decoded = g_uri_unescape_string (resource->href, NULL); if (href_decoded) { gchar *cp;