gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

gnutls: fix an upstream regression in RSA certificates

Browse Source 
The update to 3.8.5 involved adding a feature to conditionally
disable RSAES-PKCS1-v1.5 [1]. It was intended to be turned on
by default [2], but failed [3].
Therefore it is disabled, which in turn throws a new error:
"Fatal error: The encryption algorithm is not supported". (error 113).

This can have severe implications, as for example Lets Encrypt
signed RSA certificates aren't trusted anymore.

This commit fetches the upstream patch, which hasn't been included
in 3.8.5

[1]: https://gitlab.com/gnutls/gnutls/-/merge_requests/1828
[2]: https://gitlab.com/gnutls/gnutls/-/merge_requests/1828/diffs#cd5a2ba3b145c1bd292e027ef84c618b6b7fb895_267_274
[3]: https://gitlab.com/gnutls/gnutls/-/issues/1540

Signed-off-by: Florian Brandes <florian.brandes@posteo.de>
This commit is contained in:
Florian Brandes
2024-05-14 22:03:13 +02:00
parent e0bd15ff1b
commit ff52a36f8f
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
pkgs/development/libraries/gnutls/default.nix
View File

@@ -85,6 +85,16 @@ stdenv.mkDerivation rec {
revert = true; revert = true;
hash = "sha256-r/+Gmwqy0Yc1LHL/PdPLXlErUBC5JxquLzCBAN3LuRM="; hash = "sha256-r/+Gmwqy0Yc1LHL/PdPLXlErUBC5JxquLzCBAN3LuRM=";
}) })
# Makes the system-wide configuration for RSAES-PKCS1-v1_5 actually apply
# and makes it enabled by default when the config file is missing
# Without this an error 113 is thrown when using some RSA certificates
# see https://gitlab.com/gnutls/gnutls/-/issues/1540
# "This is pretty sever[e], since it breaks on letsencrypt-issued RSA keys." (comment from above issue)
(fetchpatch2 {
name = "fix-rsaes-pkcs1-v1_5-system-wide-configuration.patch";
url = "https://gitlab.com/gnutls/gnutls/-/commit/2d73d945c4b1dfcf8d2328c4d23187d62ffaab2d.diff";
hash = "sha256-2aWcLff9jzJnY+XSqCIaK/zdwSLwkNlfDeMlWyRShN8=";
})
]; ];
# Skip some tests: # Skip some tests: