This fixes CVE-2020-8945 by incorporating proglottis/gpgme#23 .
Other changes included by the rebase:
Support for gpgme_off_t (~no-op with the RHEL 7 GPGME 1.3.2)
Wrapping a few more GPGME functions (irrelevant if we don't call them)
Better error reporting in Context.GetKey
Given how invasive the CVE fix is (affecting basically all binding code), it seems safer to just update the package (and be verifiably equivalent with upstream) than to backport and try to back out the few other changes.
- What I did
This fixes CVE-2020-8945 by incorporating proglottis/gpgme#23 .
Other changes included by the rebase:
Given how invasive the CVE fix is (affecting basically all binding code), it seems safer to just update the package (and be verifiably equivalent with upstream) than to backport and try to back out the few other changes.
- How I did it
Performed by updating vendor.conf, and
- How to verify it
I have only checked that it compiles, via
- Description for the changelog Incorporated a fix for CVE-2020-8945 .