Review Results

Comment

The change only bumps pkgrel from 12 to 13 in .SRCINFO for openssl-1.1. No source URLs, checksums, build steps, dependencies, install scripts, or packaging behavior changed. This is a metadata-only release increment with no security-relevant impact visible in the provided diff.

@@ -1,7 +1,7 @@
 pkgbase = openssl-1.1
 	pkgdesc = The Open Source toolkit for Secure Sockets Layer and Transport Layer Security
 	pkgver = 1.1.1.w
-	pkgrel = 12
+	pkgrel = 13
 	url = https://www.openssl.org
 	arch = aarch64
 	arch = x86_64

Comment

The change only updates .SRCINFO metadata: pkgrel increments from 12 to 13 and one sha256 checksum entry changes to match an updated patch/source artifact. There are no new sources, no build-script changes, no install scripts, and no evidence of network access, privilege escalation, or other malicious behavior in the reviewed diff. Based on the limited metadata-only change, risk is low.

@@ -108,7 +108,7 @@ pkgbase = openssl-1.1
 	sha256sums = 4fe62fbbce088325f5b62fab3edfe59d4d9a8108ddfd06cf2a53fa1bd758c5b3
 	sha256sums = d89423836be0cb5ca076e173ea373c4deeef3d6ffa17085ca8a0850b364d7d3b
 	sha256sums = 933c61f15a81ac9c50f66f8c6c059d09f94a116d7b4c4d534a41b1c8f0140160
-	sha256sums = 4da3e07ceed3790c0bd0dd8ff93b97759ff38ed50e123f46ebe44381eea00b93
+	sha256sums = d13b969c692af11b5531c76b25f7e8c21fee79f2fca694f53ba1c6754d1ade3f
 	sha256sums = f41abfd62f213e489afcc3d4608b034e1c71a8cecc10b2bb81fc3a8ece31cc21
 
 pkgname = openssl-1.1

Comment

The patch is a test-only addition for an OpenSSL security fix. It adds a regression test that exercises CMS_decrypt() with a crafted EC recipient and verifies the failure path for the reported wrap-pad overflow, plus a small test harness argument update. I do not see any supply-chain, persistence, privilege, or build-time execution concerns in this change. The only code changes are in test files and the patch itself; the actual vulnerable code fix is in the upstream patch content, not in package scripts or install hooks. Overall this looks safe from a packaging/security-review perspective.

@@ -82,7 +82,7 @@ index a79ae8c..272b327 100644
  
  static int test_encrypt_decrypt(void)
  {
-@@ -92,1 +94,94 @@ int setup_tests(void)
+@@ -92 +94,94 @@ int setup_tests(void)
 +#ifndef OPENSSL_NO_EC
 +
 +/*

Comment

The patch is a straightforward security fix and regression test for an OpenSSL CMS heap overflow. The code change in cms_kari.c only increases the allocation size to the maximum of the cipher-reported output length and the input length, which prevents an integrity-failure path from cleansing past the end of the buffer. The accompanying test constructs a malformed CMS message to exercise the bug and only adds a new test input file path; it does not introduce network access, privilege changes, or suspicious build behavior. No supply-chain or packaging red flags are present in this diff.

@@ -177,7 +177,7 @@ index a79ae8c..272b327 100644
 +#endif
 +
  int setup_tests(void)
-@@ -100,5 +194,6 @@ int setup_tests(void)
+@@ -100,6 +195,7 @@ int setup_tests(void)
      if (!TEST_ptr(certin = test_get_argument(0))
              || !TEST_ptr(privkeyin = test_get_argument(1))
 -            || !TEST_ptr(pwri_kek_oob_der_in = test_get_argument(2)))

Comment

The change only bumps pkgrel from 12 to 13 and updates the checksum for an existing source artifact in PKGBUILD. There are no new sources, no build logic changes, no install script changes, and no new network or privilege-related behavior. Based on the diff provided, this is a routine packaging update with no security impact visible in the reviewed hunk.

@@ -7,7 +7,7 @@ _pkgname=openssl
 _ver=1.1.1w
 # use a pacman compatible version scheme
 pkgver=${_ver/[a-z]/.${_ver//[0-9.]/}}
-pkgrel=12
+pkgrel=13
 pkgdesc='The Open Source toolkit for Secure Sockets Layer and Transport Layer Security'
 arch=('aarch64' 'x86_64')
 url='https://www.openssl.org'

Comment

The change is limited to bumping pkgrel and updating one SHA-256 checksum in PKGBUILD. I see no new sources, no build-time network access, no script execution, and no packaging/persistence changes. The checksum update is consistent with a source artifact refresh rather than an integrity bypass, and the rest of the package metadata remains unchanged.

@@ -112,7 +112,7 @@ sha256sums=('cf3098950cb4d853ad95c0841f1f9c6d3dc102dccfcacd521d93925208b76ac8'
             '4fe62fbbce088325f5b62fab3edfe59d4d9a8108ddfd06cf2a53fa1bd758c5b3'
             'd89423836be0cb5ca076e173ea373c4deeef3d6ffa17085ca8a0850b364d7d3b'
             '933c61f15a81ac9c50f66f8c6c059d09f94a116d7b4c4d534a41b1c8f0140160'
-            '4da3e07ceed3790c0bd0dd8ff93b97759ff38ed50e123f46ebe44381eea00b93'
+            'd13b969c692af11b5531c76b25f7e8c21fee79f2fca694f53ba1c6754d1ade3f'
             'f41abfd62f213e489afcc3d4608b034e1c71a8cecc10b2bb81fc3a8ece31cc21')
 validpgpkeys=(
 	'EFC0A467D613CB83C7ED6D30D894E2CE8B3D79F5'