diff options
| author | Baruch Siach <baruch@tkos.co.il> | 2017-08-30 15:01:04 +0300 |
|---|---|---|
| committer | Thomas Petazzoni <thomas.petazzoni@free-electrons.com> | 2017-08-30 22:07:45 +0200 |
| commit | 453ca1d6ad6aa3d55f44734ed8479ac5fa909d8a (patch) | |
| tree | 6ec84414d6a134544bfa56490180e752d1969655 /package/gnupg | |
| parent | 10b1273264ea6a61fe29a8767f2721144f23117f (diff) | |
| download | buildroot-453ca1d6ad6aa3d55f44734ed8479ac5fa909d8a.tar.gz buildroot-453ca1d6ad6aa3d55f44734ed8479ac5fa909d8a.zip | |
gnupg: security bump to version 1.4.22
Mitigate a flush+reload side-channel attack on RSA secret keys
dubbed "Sliding right into disaster". For details see
<https://eprint.iacr.org/2017/627>. [CVE-2017-7526]
Switch to https site for better firewall compatibility and security.
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Diffstat (limited to 'package/gnupg')
| -rw-r--r-- | package/gnupg/gnupg.hash | 7 | ||||
| -rw-r--r-- | package/gnupg/gnupg.mk | 4 |
2 files changed, 5 insertions, 6 deletions
diff --git a/package/gnupg/gnupg.hash b/package/gnupg/gnupg.hash index 8968b00d2b..abd76cde9c 100644 --- a/package/gnupg/gnupg.hash +++ b/package/gnupg/gnupg.hash @@ -1,4 +1,3 @@ -# From https://lists.gnu.org/archive/html/info-gnu/2016-08/msg00008.html -sha1 e3bdb585026f752ae91360f45c28e76e4a15d338 gnupg-1.4.21.tar.bz2 -# Locally computed -sha256 6b47a3100c857dcab3c60e6152e56a997f2c7862c1b8b2b25adf3884a1ae2276 gnupg-1.4.21.tar.bz2 +# Locally computed based on signature +# https://gnupg.org/ftp/gcrypt/gnupg/gnupg-1.4.22.tar.bz2.sig +sha256 9594a24bec63a21568424242e3f198b9d9828dea5ff0c335e47b06f835f930b4 gnupg-1.4.22.tar.bz2 diff --git a/package/gnupg/gnupg.mk b/package/gnupg/gnupg.mk index b3578b87df..0ed3e1e063 100644 --- a/package/gnupg/gnupg.mk +++ b/package/gnupg/gnupg.mk @@ -4,9 +4,9 @@ # ################################################################################ -GNUPG_VERSION = 1.4.21 +GNUPG_VERSION = 1.4.22 GNUPG_SOURCE = gnupg-$(GNUPG_VERSION).tar.bz2 -GNUPG_SITE = ftp://ftp.gnupg.org/gcrypt/gnupg +GNUPG_SITE = https://gnupg.org/ftp/gcrypt/gnupg GNUPG_LICENSE = GPL-3.0+ GNUPG_LICENSE_FILES = COPYING GNUPG_DEPENDENCIES = zlib ncurses $(if $(BR2_PACKAGE_LIBICONV),libiconv) |
