Re: [PR] [Bug 69607] - MD5 algorithm insecure usage in tomcat-util [tomcat]

2025-03-11 Thread via GitHub
rmaucher closed pull request #831: [Bug 69607] - MD5 algorithm insecure usage in tomcat-util URL: https://github.com/apache/tomcat/pull/831 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specif

[Bug 69607] MD5 algorithm insecure usage in tomcat-util

2025-03-11 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=69607 Remy Maucherat changed: What|Removed |Added Status|NEEDINFO|RESOLVED Resolution|---

(tomcat) branch 9.0.x updated: 69607: Allow failed initialization of MD5

2025-03-11 Thread remm
This is an automated email from the ASF dual-hosted git repository. remm pushed a commit to branch 9.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git The following commit(s) were added to refs/heads/9.0.x by this push: new f7b6e26b8f 69607: Allow failed initialization of MD5

(tomcat) branch 10.1.x updated: 69607: Allow failed initialization of MD5

2025-03-11 Thread remm
This is an automated email from the ASF dual-hosted git repository. remm pushed a commit to branch 10.1.x in repository https://gitbox.apache.org/repos/asf/tomcat.git The following commit(s) were added to refs/heads/10.1.x by this push: new 0c54bbe2bb 69607: Allow failed initialization of M

(tomcat) branch 11.0.x updated: 69607: Allow failed initialization of MD5

2025-03-11 Thread remm
This is an automated email from the ASF dual-hosted git repository. remm pushed a commit to branch 11.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git The following commit(s) were added to refs/heads/11.0.x by this push: new 305f9a2da5 69607: Allow failed initialization of M

(tomcat) branch main updated: 69607: Allow failed initialization of MD5

2025-03-11 Thread remm
This is an automated email from the ASF dual-hosted git repository. remm pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/tomcat.git The following commit(s) were added to refs/heads/main by this push: new 3b616b23d2 69607: Allow failed initialization of MD5 3

(tomcat) branch 11.0.x updated: Fix repeatable builds for Windows installer

2025-03-11 Thread markt
This is an automated email from the ASF dual-hosted git repository. markt pushed a commit to branch 11.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git The following commit(s) were added to refs/heads/11.0.x by this push: new 7cb1693f79 Fix repeatable builds for Windows inst

(tomcat) branch 9.0.x updated: Fix repeatable builds for Windows installer

2025-03-11 Thread markt
This is an automated email from the ASF dual-hosted git repository. markt pushed a commit to branch 9.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git The following commit(s) were added to refs/heads/9.0.x by this push: new 77bdb9baa8 Fix repeatable builds for Windows instal

(tomcat) branch 10.1.x updated: Fix repeatable builds for Windows installer

2025-03-11 Thread markt
This is an automated email from the ASF dual-hosted git repository. markt pushed a commit to branch 10.1.x in repository https://gitbox.apache.org/repos/asf/tomcat.git The following commit(s) were added to refs/heads/10.1.x by this push: new 91c269c5e9 Fix repeatable builds for Windows inst

(tomcat) branch 9.0.x updated: Revert JSign to 6.0

2025-03-11 Thread markt
This is an automated email from the ASF dual-hosted git repository. markt pushed a commit to branch 9.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git The following commit(s) were added to refs/heads/9.0.x by this push: new 791984363d Revert JSign to 6.0 791984363d is descri

(tomcat) branch 10.1.x updated: Revert JSign to 6.0

2025-03-11 Thread markt
This is an automated email from the ASF dual-hosted git repository. markt pushed a commit to branch 10.1.x in repository https://gitbox.apache.org/repos/asf/tomcat.git The following commit(s) were added to refs/heads/10.1.x by this push: new 5b8a05d9af Revert JSign to 6.0 5b8a05d9af is desc

(tomcat) branch 11.0.x updated: Revert JSign to 6.0

2025-03-11 Thread markt
This is an automated email from the ASF dual-hosted git repository. markt pushed a commit to branch 11.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git The following commit(s) were added to refs/heads/11.0.x by this push: new aae35d2c7c Revert JSign to 6.0 aae35d2c7c is desc

Re: NSIS and the need for signing callbacks

2025-03-11 Thread Mark Thomas
On 11/03/2025 15:28, Mark Thomas wrote: I'm testing with the real signing service. I have found an issue. The timestamp of the Uninstaller isn't reset after the signature is inserted so that breaks repeatable builds. I should be able to fix that fairly quickly. OK. I think we are done. Wi

[Bug 69607] MD5 algorithm insecure usage in tomcat-util

2025-03-11 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=69607 --- Comment #10 from sve...@redseal.net --- We have created the PR as per Christopher's comment: https://github.com/apache/tomcat/pull/831 -- You are receiving this mail because: You are the assignee for the bug. --

[PR] [Bug 69607] - MD5 algorithm insecure usage in tomcat-util [tomcat]

2025-03-11 Thread via GitHub
ShivamVerma380 opened a new pull request, #831: URL: https://github.com/apache/tomcat/pull/831 https://bz.apache.org/bugzilla/show_bug.cgi?id=69607 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to

(tomcat) 01/02: REvert JSign to 6.0

2025-03-11 Thread markt
This is an automated email from the ASF dual-hosted git repository. markt pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/tomcat.git commit 5d64005da75df5bab13fb2f462602b3d4e23e0ca Author: Mark Thomas AuthorDate: Tue Mar 11 15:32:24 2025 + REvert JSign t

(tomcat) 02/02: Fix repeatable builds for Windows installer

2025-03-11 Thread markt
This is an automated email from the ASF dual-hosted git repository. markt pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/tomcat.git commit 30dd6da8a577ef01f6cbea026ec7db9dbfbe8a71 Author: Mark Thomas AuthorDate: Tue Mar 11 15:57:05 2025 + Fix repeatable

(tomcat) branch main updated (a1cb803bdb -> 30dd6da8a5)

2025-03-11 Thread markt
This is an automated email from the ASF dual-hosted git repository. markt pushed a change to branch main in repository https://gitbox.apache.org/repos/asf/tomcat.git from a1cb803bdb Add a link to the Log4j docs for how to replace JULI with Log4j new 5d64005da7 REvert JSign to 6.0

Re: NSIS and the need for signing callbacks

2025-03-11 Thread Mark Thomas
On 11/03/2025 13:41, Rainer Jung wrote: Am 11.03.25 um 14:31 schrieb Emmanuel Bourg: On 11/03/2025 13:09, Mark Thomas wrote: It is JSign again. If I switch back to JSign 6.0 the build starts working. Based on what we have seen previously, it looks JSign is retaining a reference to the Unins

Re: NSIS and the need for signing callbacks

2025-03-11 Thread Rainer Jung
Am 11.03.25 um 14:31 schrieb Emmanuel Bourg: On 11/03/2025 13:09, Mark Thomas wrote: It is JSign again. If I switch back to JSign 6.0 the build starts working. Based on what we have seen previously, it looks JSign is retaining a reference to the Uninstall.exe that it has just injected the si

Re: NSIS and the need for signing callbacks

2025-03-11 Thread Emmanuel Bourg
On 11/03/2025 13:09, Mark Thomas wrote: It is JSign again. If I switch back to JSign 6.0 the build starts working. Based on what we have seen previously, it looks JSign is retaining a reference to the Uninstall.exe that it has just injected the signature into and that is preventing NSIS from

Re: [OT] NSIS and the need for signing callbacks

2025-03-11 Thread Christopher Schultz
Mark, On 3/11/25 8:09 AM, Mark Thomas wrote: On 11/03/2025 11:24, Mark Thomas wrote: File Uninstall.exe line fails claiming it can' t open ".\Uninstall.exe" but that file is created a few steps earlier and is present when I check the file system. Still looking... It is JSign again. I

Re: NSIS and the need for signing callbacks

2025-03-11 Thread Rainer Jung
Am 11.03.25 um 13:09 schrieb Mark Thomas: On 11/03/2025 11:24, Mark Thomas wrote: File Uninstall.exe line fails claiming it can' t open ".\Uninstall.exe" but that file is created a few steps earlier and is present when I check the file system. Still looking... It is JSign again. If I

Re: NSIS and the need for signing callbacks

2025-03-11 Thread Mark Thomas
On 11/03/2025 11:24, Mark Thomas wrote: File Uninstall.exe line fails claiming it can' t open ".\Uninstall.exe" but that file is created a few steps earlier and is present when I check the file system. Still looking... It is JSign again. If I switch back to JSign 6.0 the build starts w

Re: NSIS and the need for signing callbacks

2025-03-11 Thread Mark Thomas
On 11/03/2025 09:24, Mark Thomas wrote: On 10/03/2025 11:18, Rainer Jung wrote: I implemented this and tested it on Linux with custom makensis and on Windows with native makensis.exe. I could not test the codesigning part on Windows, because I did not have the right detached signatures and usi

(tomcat) branch 9.0.x updated: Add release date for 9.0.102

2025-03-11 Thread markt
This is an automated email from the ASF dual-hosted git repository. markt pushed a commit to branch 9.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git The following commit(s) were added to refs/heads/9.0.x by this push: new c620f73ad0 Add release date for 9.0.102 c620f73ad0

(tomcat) branch 10.1.x updated: Add release date for 10.1.39

2025-03-11 Thread markt
This is an automated email from the ASF dual-hosted git repository. markt pushed a commit to branch 10.1.x in repository https://gitbox.apache.org/repos/asf/tomcat.git The following commit(s) were added to refs/heads/10.1.x by this push: new 966d1eccda Add release date for 10.1.39 966d1eccd

(tomcat) branch 11.0.x updated: Add release date for 11.0.5

2025-03-11 Thread markt
This is an automated email from the ASF dual-hosted git repository. markt pushed a commit to branch 11.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git The following commit(s) were added to refs/heads/11.0.x by this push: new 6e85210615 Add release date for 11.0.5 6e85210615

Re: NSIS and the need for signing callbacks

2025-03-11 Thread Mark Thomas
On 10/03/2025 11:18, Rainer Jung wrote: I implemented this and tested it on Linux with custom makensis and on Windows with native makensis.exe. I could not test the codesigning part on Windows, because I did not have the right detached signatures and using a wrong one seems to prevent NSIS from

(tomcat) branch 9.0.x updated: Add a link to the Log4j docs for how to replace JULI with Log4j

2025-03-11 Thread markt
This is an automated email from the ASF dual-hosted git repository. markt pushed a commit to branch 9.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git The following commit(s) were added to refs/heads/9.0.x by this push: new d835445fc8 Add a link to the Log4j docs for how to

(tomcat) branch 10.1.x updated: Add a link to the Log4j docs for how to replace JULI with Log4j

2025-03-11 Thread markt
This is an automated email from the ASF dual-hosted git repository. markt pushed a commit to branch 10.1.x in repository https://gitbox.apache.org/repos/asf/tomcat.git The following commit(s) were added to refs/heads/10.1.x by this push: new b1f84abd1b Add a link to the Log4j docs for how t

(tomcat) branch 11.0.x updated: Add a link to the Log4j docs for how to replace JULI with Log4j

2025-03-11 Thread markt
This is an automated email from the ASF dual-hosted git repository. markt pushed a commit to branch 11.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git The following commit(s) were added to refs/heads/11.0.x by this push: new 9e88cc8036 Add a link to the Log4j docs for how t

(tomcat) branch main updated: Add a link to the Log4j docs for how to replace JULI with Log4j

2025-03-11 Thread markt
This is an automated email from the ASF dual-hosted git repository. markt pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/tomcat.git The following commit(s) were added to refs/heads/main by this push: new a1cb803bdb Add a link to the Log4j docs for how to re