updated blacklist patch to work with stable version of sys-devel/patch (2.5.9)

Package-Manager: portage-2.2.0_alpha54/cvs/Linux x86_64

3 files changed, 108 insertions, 109 deletions

diff --git a/x11-libs/qt-core/ChangeLog b/x11-libs/qt-core/ChangeLog
index eccd1767aee0..177dad9a1fc3 100644
--- a/x11-libs/qt-core/ChangeLog
+++ b/x11-libs/qt-core/ChangeLog
@@ -1,6 +1,11 @@
 # ChangeLog for x11-libs/qt-core
 # Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/x11-libs/qt-core/ChangeLog,v 1.138 2011/09/08 09:18:55 wired Exp $
+# $Header: /var/cvsroot/gentoo-x86/x11-libs/qt-core/ChangeLog,v 1.139 2011/09/08 10:56:05 wired Exp $
+
+  08 Sep 2011; Alex Alexander <wired@gentoo.org>
+  files/blacklist-diginotar-certs.diff:
+  updated blacklist patch to work with stable version of sys-devel/patch
+  (2.5.9)
 
 *qt-core-4.7.4 (08 Sep 2011)
 
diff --git a/x11-libs/qt-core/Manifest b/x11-libs/qt-core/Manifest
index 4ba29a02757d..aef5cb117bfa 100644
--- a/x11-libs/qt-core/Manifest
+++ b/x11-libs/qt-core/Manifest
@@ -1,7 +1,7 @@
 -----BEGIN PGP SIGNED MESSAGE-----
 Hash: SHA512
 
-AUX blacklist-diginotar-certs.diff 6625 RMD160 2df3bab37c581f131f76f1fd5e681ef2f7731441 SHA1 7a8eae73d6da9ae4f400682bf135796d5320f97d SHA256 b41797e1b25767caf5b178e766348f70daf273a0ec84a0527d8c3eea4413493e
+AUX blacklist-diginotar-certs.diff 6153 RMD160 57b654d558a5fd2cb9626cc59a63e9f802db799a SHA1 3734404231b4406f8578dc7236e2f350fa553d79 SHA256 461a6c1b0618119251ab03ee668aaa93f6a8b8ba1298d8eb928f87df70c76d75
 AUX blacklist_ssl.patch 3839 RMD160 769b5652df6d626ef4436afcdae8fc6f927c4c47 SHA1 1301a6f353ab1eda382ab9dd3fdc7134a30a1884 SHA256 33800ce89fe0d62ba08a8fad515df048f78f481ebc8726b1244f27895a84193b
 AUX moc.pro 2769 RMD160 42bd282eb8e24cf291a512766270e7afed6e56be SHA1 941513c6c83813992bb91f4584d3e015295baa07 SHA256 e0898c630e079db9693fe494bf37f6b395c291373ed7edbd0827ed7d1e085a2e
 AUX qt-4.5-nolibx11.diff 1167 RMD160 da983a70bd436d35e325203dfe9390b2aee925ae SHA1 ee916596e422e91179458778b013fb103dc97cac SHA256 c6c686c1cfc07caefafe697eb8b02b6806f3845f20d3fd3839301d8a94259b0b
@@ -23,22 +23,22 @@ EBUILD qt-core-4.7.2-r2.ebuild 5180 RMD160 f41ceea48c45327bfc417a344e08065aab5ac
 EBUILD qt-core-4.7.3-r1.ebuild 5145 RMD160 15fc91e044bce6256c058d718956946e2bac44ed SHA1 eb6ae2c5f61b5270b7023ccc4f187ab47539dce5 SHA256 9f78ef2e73ab2053776cf4c04b7035e1ef15866883d86498d50d543beba95600
 EBUILD qt-core-4.7.3.ebuild 5073 RMD160 967a5ce2abb2e75fed6212c91c3fea7dce92e13d SHA1 d8ddcb0130db836494cc4ebf1cc992f5770536de SHA256 f8585c33daa1b8b2dd7471213321c89987997bb86bf3d8143640d8d4f4f6f194
 EBUILD qt-core-4.7.4.ebuild 5143 RMD160 0f1715da539a628a8678af01f04d0778f769fea5 SHA1 8faa148d586d38b34ca5af882487127c43a8bfe2 SHA256 12868decc2c84ffcfa62a9fdfe524904ea8f6dbc72e26d41efbadd071fab8ac3
-MISC ChangeLog 18566 RMD160 f4bfd6273566f5da5f3df2727d4ca69e1d09b19d SHA1 76cc8c9729350bae76c589197fdf24f1a982986b SHA256 b96c015bb7e9a6cd96051a04fad55bb579459c6d3712e5147692898d8d494c3f
+MISC ChangeLog 18739 RMD160 5a54a47436f39575f3807515a5ed632ccf7c2290 SHA1 13958bc9ebc54cf86fedcd6934cc0795c284aed5 SHA256 f08ee21e0fb9299ea57483a098d6cfe6703896024e13a878dd059e4c81fecdd8
 MISC metadata.xml 802 RMD160 0341afae262322299759a5a33bae9a42e5b7801c SHA1 b564551c1b4a7902e09200255c6c0a6ede646a23 SHA256 a84f88402ece782e8ac52ad0b90eea94e5bd563ca0a7956e1d89f1263d7f2925
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.18 (GNU/Linux)
 
-iQIcBAEBCgAGBQJOaIiWAAoJEDZF8K7rm0r6N90P/A8AEmGLYJByhNSVtIWaVeiG
-3zzUCfBWaKsfGSFTk+Mzd6W9tzt7BsrYYBcyNpl5wIVl9Cxz2fdceDLmSfp8qx+z
-UxuMicyTPc+mZn/w6Lx92G1zgbXUEWJC5pV01XY48+ZtrD5fxUwa5FxAjd6UWqDn
-zbfHqY+o5MsbYt9jAHkoDWLB9ZCqLsikRmM406SER6Xu8jopvD6sT429vG8e0r1t
-VcUYT1ry5dCNBAl29sGqpsoAZyJR0jXsTyTFluNQ+q23WjJYQjA9abOvajb+gNw0
-ifdC67bNNz6PghNGmr6rFPmIdya/8DxbuJX3n4jKJsJUtL8+BNq5/cf0Qo4VcblW
-3FronCTdkMgz98ZWXQxFgxIabDxAacDk5L1qbjETzzvxOQG8/2b8Nb5OHNlPh1cl
-Ng9hvOgDeNG0pnk/dvaiK6EdmgctVmwv5geqi+nUHO0bMsJOL2tQntKZSL+YrwBU
-51L+jO6Ki3oMNDhLFEHStCVKXE5XGGMacqBuvzF6NHR2kMQ7s2OcbODTFnlPSCvM
-Dy+KCzv/08A+e3BG6ntvyM0CnQ1J7678o66Yti1+n7Ict5DNCKa+5uNCSKSNKiiY
-CwDe6AsgCykrkJKn6x9jUM1pLVCBbHV6QlKfeYRTSqeJu1k+WY93xJoJaiZtXpJS
-4L57b6KGWQrA4meIhK/H
-=kKgJ
+iQIcBAEBCgAGBQJOaJ9dAAoJEDZF8K7rm0r6nBYP/RK5HjVCrtZXFjQOxn3/i1eK
+m+k1PEgF90Wp/PX74y0DsyDi2GnL7xbxnwK98J458zMcFHj5wETVRsiEHfdEBCBd
+1YR70iefxmL21ciXbLat2Z66fR+IX1wsfzDV+5/skfVYFB3Iztb9HBTrKvYZm2uG
+i1gi8duqOt0nBMQ+ZrmLFG1wcngAzUtga9YBwJZnwdZYFYJaMQA5EVAQWL6qAymb
+dCQPsiJF9XPw4r3jwmgZhsf0Z2m/Xcyaj2k/QTrFKJVkUR8bJGWvqwVMKpvKcbzU
+ia90bdz/HOe/a2rsoyzbRy57YEn1lSsNtMb44YqXCNOV0Vk/s0eUOCTi23eUJ6qU
+kNww9kpPgWcfL9+7k4GveV2Mn48qUYSyM9+UKZA8+kwDza4MIgsVGsH/FJ61RYV1
+ECNM+76aG/pPd9iqTkQBLfW3EYHSwFlEp3YZ8pKqi/def9kr3ShDPwQw7DB71hhT
+8yhyugK4A5nM8NtjejWC4Twt1cchAReGIfhXnyVOkbgJ4ppJZUFluZrg5Oq8zC4I
+Vd8hAJAweMQKOJ+a0Zz7gRq0hrRO2yFJgdqu3n8O1CfrNbUZkHuyNZVVBHLx9N/c
+FPrPH1HO4e5PbH/BNwfUWVnPyxNTwOMSsSGhkirSNWtODjbjTRCqrnA3x0gPu9z7
+n3AlDhQBI4cltwfjSiZ0
+=Ha8i
 -----END PGP SIGNATURE-----
diff --git a/x11-libs/qt-core/files/blacklist-diginotar-certs.diff b/x11-libs/qt-core/files/blacklist-diginotar-certs.diff
index e37af240f38a..12eeb3ad5f86 100644
--- a/x11-libs/qt-core/files/blacklist-diginotar-certs.diff
+++ b/x11-libs/qt-core/files/blacklist-diginotar-certs.diff
@@ -1,93 +1,87 @@
-http://labs.qt.nokia.com/2011/09/07/what-the-diginotar-security-breach-means-for-qt-users-continued/

-

-gentoo bug: https://bugs.gentoo.org/show_bug.cgi?id=382171

-

-diff --git a/src/network/ssl/qsslcertificate.cpp b/src/network/ssl/qsslcertificate.cpp

-index 328c5c2..1ae98f4 100644

---- a/src/network/ssl/qsslcertificate.cpp

-+++ b/src/network/ssl/qsslcertificate.cpp

-@@ -803,22 +803,47 @@ QList<QSslCertificate> QSslCertificatePrivate::certificatesFromDer(const QByteAr

- // These certificates are known to be fraudulent and were created during the comodo

- // compromise. See http://www.comodo.com/Comodo-Fraud-Incident-2011-03-23.html

- static const char *certificate_blacklist[] = {

--    "04:7e:cb:e9:fc:a5:5f:7b:d0:9e:ae:36:e1:0c:ae:1e",

--    "f5:c8:6a:f3:61:62:f1:3a:64:f5:4f:6d:c9:58:7c:06",

--    "d7:55:8f:da:f5:f1:10:5b:b2:13:28:2b:70:77:29:a3",

--    "39:2a:43:4f:0e:07:df:1f:8a:a3:05:de:34:e0:c2:29",

--    "3e:75:ce:d4:6b:69:30:21:21:88:30:ae:86:a8:2a:71",

--    "e9:02:8b:95:78:e4:15:dc:1a:71:0a:2b:88:15:44:47",

--    "92:39:d5:34:8f:40:d1:69:5a:74:54:70:e1:f2:3f:43",

--    "b0:b7:13:3e:d0:96:f9:b5:6f:ae:91:c8:74:bd:3a:c0",

--    "d8:f3:5f:4e:b7:87:2b:2d:ab:06:92:e3:15:38:2f:b0",

-+    "04:7e:cb:e9:fc:a5:5f:7b:d0:9e:ae:36:e1:0c:ae:1e", "mail.google.com", // Comodo

-+    "f5:c8:6a:f3:61:62:f1:3a:64:f5:4f:6d:c9:58:7c:06", "www.google.com", // Comodo

-+    "d7:55:8f:da:f5:f1:10:5b:b2:13:28:2b:70:77:29:a3", "login.yahoo.com", // Comodo

-+    "39:2a:43:4f:0e:07:df:1f:8a:a3:05:de:34:e0:c2:29", "login.yahoo.com", // Comodo

-+    "3e:75:ce:d4:6b:69:30:21:21:88:30:ae:86:a8:2a:71", "login.yahoo.com", // Comodo

-+    "e9:02:8b:95:78:e4:15:dc:1a:71:0a:2b:88:15:44:47", "login.skype.com", // Comodo

-+    "92:39:d5:34:8f:40:d1:69:5a:74:54:70:e1:f2:3f:43", "addons.mozilla.org", // Comodo

-+    "b0:b7:13:3e:d0:96:f9:b5:6f:ae:91:c8:74:bd:3a:c0", "login.live.com", // Comodo

-+    "d8:f3:5f:4e:b7:87:2b:2d:ab:06:92:e3:15:38:2f:b0", "global trustee", // Comodo

-+

-+    "05:e2:e6:a4:cd:09:ea:54:d6:65:b0:75:fe:22:a2:56", "*.google.com", // leaf certificate issued by DigiNotar

-+    "0c:76:da:9c:91:0c:4e:2c:9e:fe:15:d0:58:93:3c:4c", "DigiNotar Root CA", // DigiNotar root

-+    "f1:4a:13:f4:87:2b:56:dc:39:df:84:ca:7a:a1:06:49", "DigiNotar Services CA", // DigiNotar intermediate signed by DigiNotar Root

-+    "36:16:71:55:43:42:1b:9d:e6:cb:a3:64:41:df:24:38", "DigiNotar Services 1024 CA", // DigiNotar intermediate signed by DigiNotar Root

-+    "0a:82:bd:1e:14:4e:88:14:d7:5b:1a:55:27:be:bf:3e", "DigiNotar Root CA G2", // other DigiNotar Root CA

-+    "a4:b6:ce:e3:2e:d3:35:46:26:3c:b3:55:3a:a8:92:21", "CertiID Enterprise Certificate Authority", // DigiNotar intermediate signed by "DigiNotar Root CA G2"

-+    "5b:d5:60:9c:64:17:68:cf:21:0e:35:fd:fb:05:ad:41", "DigiNotar Qualified CA", // DigiNotar intermediate signed by DigiNotar Root

-+

-+    "1184640176",                                      "DigiNotar Services 1024 CA", // DigiNotar intermediate cross-signed by Entrust

-+    "120000525",                                       "DigiNotar Cyber CA", // DigiNotar intermediate cross-signed by CyberTrust

-+    "120000505",                                       "DigiNotar Cyber CA", // DigiNotar intermediate cross-signed by CyberTrust

-+    "120000515",                                       "DigiNotar Cyber CA", // DigiNotar intermediate cross-signed by CyberTrust

-+    "20015536",                                        "DigiNotar PKIoverheid CA Overheid en Bedrijven", // DigiNotar intermediate cross-signed by the Dutch government

-+    "20001983",                                        "DigiNotar PKIoverheid CA Organisatie - G2", // DigiNotar intermediate cross-signed by the Dutch government

-+    "d6:d0:29:77:f1:49:fd:1a:83:f2:b9:ea:94:8c:5c:b4", "DigiNotar Extended Validation CA", // DigiNotar intermediate signed by DigiNotar EV Root

-+    "1e:7d:7a:53:3d:45:30:41:96:40:0f:71:48:1f:45:04", "DigiNotar Public CA 2025", // DigiNotar intermediate

-+//    "(has not been seen in the wild so far)", "DigiNotar Public CA - G2", // DigiNotar intermediate

-+//    "(has not been seen in the wild so far)", "Koninklijke Notariele Beroepsorganisatie CA", // compromised during DigiNotar breach

-+//    "(has not been seen in the wild so far)", "Stichting TTP Infos CA," // compromised during DigiNotar breach

-+    "1184640175", "DigiNotar Root CA", // DigiNotar intermediate cross-signed by Entrust

-+    "1184644297", "DigiNotar Root CA", // DigiNotar intermediate cross-signed by Entrust

-     0

- };

- 

- bool QSslCertificatePrivate::isBlacklisted(const QSslCertificate &certificate)

- {

-     for (int a = 0; certificate_blacklist[a] != 0; a++) {

--        if (certificate.serialNumber() == certificate_blacklist[a])

-+        QString blacklistedCommonName = QString::fromUtf8(certificate_blacklist[(a+1)]);

-+        if (certificate.serialNumber() == certificate_blacklist[a++] &&

-+            (certificate.subjectInfo(QSslCertificate::CommonName) == blacklistedCommonName ||

-+             certificate.issuerInfo(QSslCertificate::CommonName) == blacklistedCommonName))

-             return true;

-     }

-     return false;

-diff --git a/src/network/ssl/qsslsocket_openssl.cpp b/src/network/ssl/qsslsocket_openssl.cpp

-index 141d80a..b8e6c4c 100644

---- a/src/network/ssl/qsslsocket_openssl.cpp

-+++ b/src/network/ssl/qsslsocket_openssl.cpp

-@@ -1193,12 +1193,16 @@ bool QSslSocketBackendPrivate::startHandshake()

-     X509 *x509 = q_SSL_get_peer_certificate(ssl);

-     configuration.peerCertificate = QSslCertificatePrivate::QSslCertificate_from_X509(x509);

-     q_X509_free(x509);

--    if (QSslCertificatePrivate::isBlacklisted(configuration.peerCertificate)) {

--        q->setErrorString(QSslSocket::tr("The peer certificate is blacklisted"));

--        q->setSocketError(QAbstractSocket::SslHandshakeFailedError);

--        emit q->error(QAbstractSocket::SslHandshakeFailedError);

--        plainSocket->disconnectFromHost();

--        return false;

-+

-+    // check the whole chain for blacklisting (including root, as we check for subjectInfo and issuer)

-+    foreach (const QSslCertificate &cert, configuration.peerCertificateChain) {

-+        if (QSslCertificatePrivate::isBlacklisted(cert)) {

-+            q->setErrorString(QSslSocket::tr("The peer certificate is blacklisted"));

-+            q->setSocketError(QAbstractSocket::SslHandshakeFailedError);

-+            emit q->error(QAbstractSocket::SslHandshakeFailedError);

-+            plainSocket->disconnectFromHost();

-+            return false;

-+        }

-     }

- 

-     // Start translating errors.

+http://labs.qt.nokia.com/2011/09/07/what-the-diginotar-security-breach-means-for-qt-users-continued/
+gentoo bug: https://bugs.gentoo.org/show_bug.cgi?id=382171
+--- src/network/ssl/qsslcertificate.cpp
++++ src/network/ssl/qsslcertificate.cpp
+@@ -803,22 +803,47 @@
+ // These certificates are known to be fraudulent and were created during the comodo
+ // compromise. See http://www.comodo.com/Comodo-Fraud-Incident-2011-03-23.html
+ static const char *certificate_blacklist[] = {
+-    "04:7e:cb:e9:fc:a5:5f:7b:d0:9e:ae:36:e1:0c:ae:1e",
+-    "f5:c8:6a:f3:61:62:f1:3a:64:f5:4f:6d:c9:58:7c:06",
+-    "d7:55:8f:da:f5:f1:10:5b:b2:13:28:2b:70:77:29:a3",
+-    "39:2a:43:4f:0e:07:df:1f:8a:a3:05:de:34:e0:c2:29",
+-    "3e:75:ce:d4:6b:69:30:21:21:88:30:ae:86:a8:2a:71",
+-    "e9:02:8b:95:78:e4:15:dc:1a:71:0a:2b:88:15:44:47",
+-    "92:39:d5:34:8f:40:d1:69:5a:74:54:70:e1:f2:3f:43",
+-    "b0:b7:13:3e:d0:96:f9:b5:6f:ae:91:c8:74:bd:3a:c0",
+-    "d8:f3:5f:4e:b7:87:2b:2d:ab:06:92:e3:15:38:2f:b0",
++    "04:7e:cb:e9:fc:a5:5f:7b:d0:9e:ae:36:e1:0c:ae:1e", "mail.google.com", // Comodo
++    "f5:c8:6a:f3:61:62:f1:3a:64:f5:4f:6d:c9:58:7c:06", "www.google.com", // Comodo
++    "d7:55:8f:da:f5:f1:10:5b:b2:13:28:2b:70:77:29:a3", "login.yahoo.com", // Comodo
++    "39:2a:43:4f:0e:07:df:1f:8a:a3:05:de:34:e0:c2:29", "login.yahoo.com", // Comodo
++    "3e:75:ce:d4:6b:69:30:21:21:88:30:ae:86:a8:2a:71", "login.yahoo.com", // Comodo
++    "e9:02:8b:95:78:e4:15:dc:1a:71:0a:2b:88:15:44:47", "login.skype.com", // Comodo
++    "92:39:d5:34:8f:40:d1:69:5a:74:54:70:e1:f2:3f:43", "addons.mozilla.org", // Comodo
++    "b0:b7:13:3e:d0:96:f9:b5:6f:ae:91:c8:74:bd:3a:c0", "login.live.com", // Comodo
++    "d8:f3:5f:4e:b7:87:2b:2d:ab:06:92:e3:15:38:2f:b0", "global trustee", // Comodo
++
++    "05:e2:e6:a4:cd:09:ea:54:d6:65:b0:75:fe:22:a2:56", "*.google.com", // leaf certificate issued by DigiNotar
++    "0c:76:da:9c:91:0c:4e:2c:9e:fe:15:d0:58:93:3c:4c", "DigiNotar Root CA", // DigiNotar root
++    "f1:4a:13:f4:87:2b:56:dc:39:df:84:ca:7a:a1:06:49", "DigiNotar Services CA", // DigiNotar intermediate signed by DigiNotar Root
++    "36:16:71:55:43:42:1b:9d:e6:cb:a3:64:41:df:24:38", "DigiNotar Services 1024 CA", // DigiNotar intermediate signed by DigiNotar Root
++    "0a:82:bd:1e:14:4e:88:14:d7:5b:1a:55:27:be:bf:3e", "DigiNotar Root CA G2", // other DigiNotar Root CA
++    "a4:b6:ce:e3:2e:d3:35:46:26:3c:b3:55:3a:a8:92:21", "CertiID Enterprise Certificate Authority", // DigiNotar intermediate signed by "DigiNotar Root CA G2"
++    "5b:d5:60:9c:64:17:68:cf:21:0e:35:fd:fb:05:ad:41", "DigiNotar Qualified CA", // DigiNotar intermediate signed by DigiNotar Root
++
++    "1184640176",                                      "DigiNotar Services 1024 CA", // DigiNotar intermediate cross-signed by Entrust
++    "120000525",                                       "DigiNotar Cyber CA", // DigiNotar intermediate cross-signed by CyberTrust
++    "120000505",                                       "DigiNotar Cyber CA", // DigiNotar intermediate cross-signed by CyberTrust
++    "120000515",                                       "DigiNotar Cyber CA", // DigiNotar intermediate cross-signed by CyberTrust
++    "20015536",                                        "DigiNotar PKIoverheid CA Overheid en Bedrijven", // DigiNotar intermediate cross-signed by the Dutch government
++    "20001983",                                        "DigiNotar PKIoverheid CA Organisatie - G2", // DigiNotar intermediate cross-signed by the Dutch government
++    "d6:d0:29:77:f1:49:fd:1a:83:f2:b9:ea:94:8c:5c:b4", "DigiNotar Extended Validation CA", // DigiNotar intermediate signed by DigiNotar EV Root
++    "1e:7d:7a:53:3d:45:30:41:96:40:0f:71:48:1f:45:04", "DigiNotar Public CA 2025", // DigiNotar intermediate
++//    "(has not been seen in the wild so far)", "DigiNotar Public CA - G2", // DigiNotar intermediate
++//    "(has not been seen in the wild so far)", "Koninklijke Notariele Beroepsorganisatie CA", // compromised during DigiNotar breach
++//    "(has not been seen in the wild so far)", "Stichting TTP Infos CA," // compromised during DigiNotar breach
++    "1184640175", "DigiNotar Root CA", // DigiNotar intermediate cross-signed by Entrust
++    "1184644297", "DigiNotar Root CA", // DigiNotar intermediate cross-signed by Entrust
+     0
+ };
+ 
+ bool QSslCertificatePrivate::isBlacklisted(const QSslCertificate &certificate)
+ {
+     for (int a = 0; certificate_blacklist[a] != 0; a++) {
+-        if (certificate.serialNumber() == certificate_blacklist[a])
++        QString blacklistedCommonName = QString::fromUtf8(certificate_blacklist[(a+1)]);
++        if (certificate.serialNumber() == certificate_blacklist[a++] &&
++            (certificate.subjectInfo(QSslCertificate::CommonName) == blacklistedCommonName ||
++             certificate.issuerInfo(QSslCertificate::CommonName) == blacklistedCommonName))
+             return true;
+     }
+     return false;
+--- src/network/ssl/qsslsocket_openssl.cpp
++++ src/network/ssl/qsslsocket_openssl.cpp
+@@ -1183,12 +1183,16 @@
+     X509 *x509 = q_SSL_get_peer_certificate(ssl);
+     configuration.peerCertificate = QSslCertificatePrivate::QSslCertificate_from_X509(x509);
+     q_X509_free(x509);
+-    if (QSslCertificatePrivate::isBlacklisted(configuration.peerCertificate)) {
+-        q->setErrorString(QSslSocket::tr("The peer certificate is blacklisted"));
+-        q->setSocketError(QAbstractSocket::SslHandshakeFailedError);
+-        emit q->error(QAbstractSocket::SslHandshakeFailedError);
+-        plainSocket->disconnectFromHost();
+-        return false;
++
++    // check the whole chain for blacklisting (including root, as we check for subjectInfo and issuer)
++    foreach (const QSslCertificate &cert, configuration.peerCertificateChain) {
++        if (QSslCertificatePrivate::isBlacklisted(cert)) {
++            q->setErrorString(QSslSocket::tr("The peer certificate is blacklisted"));
++            q->setSocketError(QAbstractSocket::SslHandshakeFailedError);
++            emit q->error(QAbstractSocket::SslHandshakeFailedError);
++            plainSocket->disconnectFromHost();
++            return false;
++        }
+     }
+ 
+     // Start translating errors.