File _patchinfo of Package patchinfo.28485
<patchinfo incident="28485">
<issue tracker="bnc" id="1209839">VUL-0: rust: update GitHub RSA key</issue>
<issue tracker="jsc" id="SLE-18626"></issue>
<packager>firstyear</packager>
<rating>moderate</rating>
<category>recommended</category>
<summary>Recommended update for rust, rust1.68</summary>
<description>This update for rust, rust1.68 fixes the following issues:
Changes in rust1.68:
- bsc#1209839 - replace leaked github keys in rust/cargo
Version 1.68.2 (2023-03-28)
===========================
- Update the GitHub RSA host key bundled within Cargo
The key was rotated by GitHub (https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/)
on 2023-03-24 after the old one leaked.
- Mark the old GitHub RSA host key as revoked](https://github.com/rust-lang/cargo/pull/11889).
This will prevent Cargo from accepting the leaked key even when trusted by
the system.
- Add support for `@revoked` and a better error message for `@cert-authority` in Cargo's SSH host key verification
- Fix miscompilation in produced Windows MSVC artifacts
This was introduced by enabling ThinLTO for the distributed rustc which led
to miscompilations in the resulting binary. Currently this is believed to be
limited to the -Zdylib-lto flag used for rustc compilation, rather than a
general bug in ThinLTO, so only rustc artifacts should be affected.
- Fix --enable-local-rust builds
- Treat `$prefix-clang` as `clang` in linker detection code
- Fix panic in compiler code
</description>
</patchinfo>