File _patchinfo of Package patchinfo.28485

Overview Repositories Revisions Requests Users Attributes Meta

File _patchinfo of Package patchinfo.28485

<patchinfo incident="28485">
  <issue tracker="bnc" id="1209839">VUL-0: rust: update GitHub RSA key</issue>
  <issue tracker="jsc" id="SLE-18626"></issue>
  <packager>firstyear</packager>
  <rating>moderate</rating>
  <category>recommended</category>
  <summary>Recommended update for rust, rust1.68</summary>
  <description>This update for rust, rust1.68 fixes the following issues:

Changes in rust1.68:

- bsc#1209839 - replace leaked github keys in rust/cargo

Version 1.68.2 (2023-03-28)
===========================

- Update the GitHub RSA host key bundled within Cargo
  The key was rotated by GitHub (https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/)
  on 2023-03-24 after the old one leaked.
- Mark the old GitHub RSA host key as revoked](https://github.com/rust-lang/cargo/pull/11889).
  This will prevent Cargo from accepting the leaked key even when trusted by
  the system.
- Add support for `@revoked` and a better error message for `@cert-authority` in Cargo's SSH host key verification
- Fix miscompilation in produced Windows MSVC artifacts
  This was introduced by enabling ThinLTO for the distributed rustc which led
  to miscompilations in the resulting binary. Currently this is believed to be
  limited to the -Zdylib-lto flag used for rustc compilation, rather than a
  general bug in ThinLTO, so only rustc artifacts should be affected.
- Fix --enable-local-rust builds
- Treat `$prefix-clang` as `clang` in linker detection code
- Fix panic in compiler code
</description>
</patchinfo>

Places

File _patchinfo of Package patchinfo.28485

Places