gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

openssl: 3.6.0 -> 3.6.1

Browse Source 
The second item (severity: High) has possible unauthenticated RCE:
https://www.openwall.com/lists/oss-security/2026/01/27/5
https://github.com/openssl/openssl/blob/openssl-3.6.1/CHANGES.md#openssl-36

The patches differ in whitespace only, as that's what upstream changed.
This commit is contained in:
Vladimír Čunát
2026-01-27 19:25:36 +01:00
parent f93b00f6e6
commit eab028a911
5 changed files with 30 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkgs/development/libraries/openssl/3.5/use-etc-ssl-certs-darwin.patch
-13
View File
@@ -1,13 +0,0 @@
diff --git a/include/internal/common.h b/include/internal/common.h
index 15666f1..d91e25b 100644
--- a/include/internal/common.h
+++ b/include/internal/common.h
@@ -83,7 +83,7 @@ __owur static ossl_inline int ossl_assert_int(int expr, const char *exprstr,
# ifndef OPENSSL_SYS_VMS
# define X509_CERT_AREA OPENSSLDIR
# define X509_CERT_DIR OPENSSLDIR "/certs"
-# define X509_CERT_FILE OPENSSLDIR "/cert.pem"
+# define X509_CERT_FILE "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt"
# define X509_PRIVATE_DIR OPENSSLDIR "/private"
# define CTLOG_FILE OPENSSLDIR "/ct_log_list.cnf"
# else
pkgs/development/libraries/openssl/3.5/use-etc-ssl-certs.patch
-13
View File
@@ -1,13 +0,0 @@
diff --git a/include/internal/common.h b/include/internal/common.h
index 15666f1..d91e25b 100644
--- a/include/internal/common.h
+++ b/include/internal/common.h
@@ -83,7 +83,7 @@ __owur static ossl_inline int ossl_assert_int(int expr, const char *exprstr,
# ifndef OPENSSL_SYS_VMS
# define X509_CERT_AREA OPENSSLDIR
# define X509_CERT_DIR OPENSSLDIR "/certs"
-# define X509_CERT_FILE OPENSSLDIR "/cert.pem"
+# define X509_CERT_FILE "/etc/ssl/certs/ca-certificates.crt"
# define X509_PRIVATE_DIR OPENSSLDIR "/private"
# define CTLOG_FILE OPENSSLDIR "/ct_log_list.cnf"
# else
pkgs/development/libraries/openssl/3.6/use-etc-ssl-certs-darwin.patch
+13
View File
@@ -0,0 +1,13 @@
diff --git a/include/internal/common.h b/include/internal/common.h
index 15666f1..d91e25b 100644
--- a/include/internal/common.h
+++ b/include/internal/common.h
@@ -83,7 +83,7 @@ __owur static ossl_inline int ossl_assert_int(int expr, const char *exprstr,
#ifndef OPENSSL_SYS_VMS
#define X509_CERT_AREA OPENSSLDIR
#define X509_CERT_DIR OPENSSLDIR "/certs"
-#define X509_CERT_FILE OPENSSLDIR "/cert.pem"
+#define X509_CERT_FILE "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt"
#define X509_PRIVATE_DIR OPENSSLDIR "/private"
#define CTLOG_FILE OPENSSLDIR "/ct_log_list.cnf"
#else
pkgs/development/libraries/openssl/3.6/use-etc-ssl-certs.patch
+13
View File
@@ -0,0 +1,13 @@
diff --git a/include/internal/common.h b/include/internal/common.h
index 15666f1..d91e25b 100644
--- a/include/internal/common.h
+++ b/include/internal/common.h
@@ -83,7 +83,7 @@ __owur static ossl_inline int ossl_assert_int(int expr, const char *exprstr,
#ifndef OPENSSL_SYS_VMS
#define X509_CERT_AREA OPENSSLDIR
#define X509_CERT_DIR OPENSSLDIR "/certs"
-#define X509_CERT_FILE OPENSSLDIR "/cert.pem"
+#define X509_CERT_FILE "/etc/ssl/certs/ca-certificates.crt"
#define X509_PRIVATE_DIR OPENSSLDIR "/private"
#define CTLOG_FILE OPENSSLDIR "/ct_log_list.cnf"
#else
pkgs/development/libraries/openssl/default.nix
+4 -4
View File
@@ -459,8 +459,8 @@ in
};
openssl_3_6 = common {
version = "3.6.0";
hash = "sha256-tqX0S362nj+jXb8VUkQFtEg3pIHUPYHa3d4/8h/LuOk=";
version = "3.6.1";
hash = "sha256-sb/tzVson/Iq7ofJ1gD1FXZ+v0X3cWjLbWTyMfUYqC4=";
patches = [
# Support for NIX_SSL_CERT_FILE, motivation:
@@ -474,9 +474,9 @@ in
# Look up SSL certificates in /etc rather than the immutable installation directory
(
if stdenv.hostPlatform.isDarwin then
./3.5/use-etc-ssl-certs-darwin.patch
./3.6/use-etc-ssl-certs-darwin.patch
else
./3.5/use-etc-ssl-certs.patch
./3.6/use-etc-ssl-certs.patch
)
]
++ lib.optionals stdenv.hostPlatform.isMinGW [