Upgraded to 0.16.3; disabled BIP 70 and forced SSLv3 upgrade in order to fix GUI startup issue

3 files changed, 50 insertions, 11 deletions

diff --git a/.SRCINFO b/.SRCINFO
index 2fd5d2c49c76..3e8e93f4d3a8 100644
--- a/.SRCINFO
+++ b/.SRCINFO
@@ -1,8 +1,8 @@
 pkgbase = namecoin-core-wallet
 	pkgdesc = This package provides the Namecoin Core GUI client and CLI daemon. This package does not create a systemd service.
-	pkgver = v0.16.2
+	pkgver = v0.16.3
 	pkgrel = 1
-	epoch = 1536522646
+	epoch = 1537619664
 	url = https://namecoin.org/
 	arch = i686
 	arch = x86_64
@@ -32,9 +32,11 @@ pkgbase = namecoin-core-wallet
 	source = git://github.com/namecoin/namecoin-core
 	source = namecoin.desktop
 	source = namecoin1500x1500.png
+	source = patch.diff
 	sha256sums = SKIP
 	sha256sums = 0226f5a570bbbde63f332d43d9d712287b316c726280f2ae9e21b1b365b3f0dc
 	sha256sums = f1e0593b872e18e0aebbf399bb5d77be255cb0aa160964c0528698a33f89ba04
+	sha256sums = 64b7d902b422653569917aedac04ea6e7519e81b52dead52fd0f105730c23e66
 
 pkgname = namecoin-core-wallet
 
diff --git a/PKGBUILD b/PKGBUILD
index 2cfaf9c88e6b..0f6bdf21f562 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -6,17 +6,17 @@
 
 
 pkgname=namecoin-core-wallet
-pkgver=v0.16.2
+pkgver=v0.16.3
 pkgrel=1
 
 
 # Epoch is always set to the most recent PKGBUILD update time.
 # This allows for a forced downgrade without messing up versioning.
-epoch=1536522646
+epoch=1537619664
 
 
-# Release commit for 0.16.2
-_commit=5b502c3fa2cfe6af392d03ac41ffe34baea7c473
+# Release commit for 0.16.3
+_commit=6fdea2aedfbcf0e8c24ce1552f7f58950e5efb55
 
 
 pkgdesc='This package provides the Namecoin Core GUI client and CLI daemon.'
@@ -33,14 +33,23 @@ conflicts=('namecoin-core-wallet' 'namecoin-cli' 'namecoin-daemon'
            'namecoin-qt' 'namecoin-tx')
 source=('git://github.com/namecoin/namecoin-core'
         'namecoin.desktop'
-        'namecoin1500x1500.png')
+        'namecoin1500x1500.png'
+        'patch.diff')
 sha256sums=('SKIP'
             '0226f5a570bbbde63f332d43d9d712287b316c726280f2ae9e21b1b365b3f0dc'
-            'f1e0593b872e18e0aebbf399bb5d77be255cb0aa160964c0528698a33f89ba04')
+            'f1e0593b872e18e0aebbf399bb5d77be255cb0aa160964c0528698a33f89ba04'
+            '64b7d902b422653569917aedac04ea6e7519e81b52dead52fd0f105730c23e66')
+
+
 prepare() {
     mkdir -p "$srcdir/tmp"
     cd "$srcdir/namecoin-core/"
     git checkout "$_commit"
+
+    # Disable forced upgrade from SSLv3 to TSL, due to upstream Qt5 bug
+    # which causes namecoin-qt to freeze on startup. See comment in build()
+    cd "$srcdir"
+    patch -p0 -i patch.diff
 }
 
 
@@ -49,11 +58,22 @@ build() {
     cd "$srcdir/namecoin-core/"
     ./autogen.sh
 
+
+    # Note: added --disable-bip70 option to disable BIP 70, because the only
+    #       fix for the upstream libQt5Network.so bug is to disable the
+    #       the forced upgrade from SSL to TLS. Therefore, BIP 70 payments
+    #       may be at higher risk due to the SSLv3 POODLE attack. Hence, they
+    #       have been disabled.
+    #
+    # See https://bbs.archlinux.org/viewtopic.php?id=240553
+    # and https://github.com/bitcoin/bitcoin/issues/14273
+
+
     # I have not tested the static build process on 32 bit machines yet,
     # so I'm leaving i686 with the normal dynamic build.
     if [ "$CARCH" == i686 ]; then
         ./configure --prefix=/usr --enable-upnp-default --enable-hardening \
-                    --with-gui=qt5 --disable-tests
+                    --with-gui=qt5 --disable-tests --disable-bip70
 
     # This should produce a static build that doesn't brick every time Arch
     # rolls out updates to the system libraries.
@@ -65,7 +85,8 @@ build() {
                    --enable-upnp-default \
                    --enable-hardening \
                    --with-gui=qt5 \
-                   --disable-tests
+                   --disable-tests \
+                   --disable-bip70
     fi
 
     make DESTDIR="$srcdir/tmp"
@@ -91,4 +112,3 @@ package() {
     ln -s "libnamecoinconsensus.so.0.0.0" "libnamecoinconsensus.so"
 }
 
-
diff --git a/patch.diff b/patch.diff
new file mode 100644
index 000000000000..bfa03d579900
--- /dev/null
+++ b/patch.diff
@@ -0,0 +1,17 @@
+--- ./namecoin-core/src/qt/bitcoin.cpp
++++ ./namecoin-core/src/qt/bitcoin.cpp
+@@ -573,13 +573,6 @@ int main(int argc, char *argv[])
+ #ifdef Q_OS_MAC
+     QApplication::setAttribute(Qt::AA_DontShowIconsInMenus);
+ #endif
+-#if QT_VERSION >= 0x050500
+-    // Because of the POODLE attack it is recommended to disable SSLv3 (https://disablessl3.com/),
+-    // so set SSL protocols to TLS1.0+.
+-    QSslConfiguration sslconf = QSslConfiguration::defaultConfiguration();
+-    sslconf.setProtocol(QSsl::TlsV1_0OrLater);
+-    QSslConfiguration::setDefaultConfiguration(sslconf);
+-#endif
+ 
+     // Register meta types used for QMetaObject::invokeMethod
+     qRegisterMetaType< bool* >();
+