Adolf Belka [Thu, 2 Mar 2023 14:11:23 +0000 (15:11 +0100)]
dhcp.cgi: Fix bug#10629 - Highlight fixed IP's in dynamic range in red
- This v2 patch has moved the extraHead variable into header.pl
- This patch marks all IP's that are in the Fixed list but are also in the dynamic range
that has been defined, in red.
- Additional function created to check if an ip address is in a defined range.
- Added an additional key item under the Fixed Leases table for Fixed IP in dynamic range
- Added line to English Language file for this key item.
- ./make lang run before commit.
- Tested in vm testbed and confirmed that any ip address in the Fixed Leases table that
is in the defined dynamic range is highlighted in red
- This uses the css background-color appoach from the first patch in this set.
- This patch only highlights those IP's that overlap in red but does nothing more. So a
user can still create new ones if they want but they will all show up in red.
- This patch flags up if people are doing things that they shouldn't be doing but allows
them to continue doing so without changing anything if they don't want to and so will
not break existing setups.
Fixes: Bug#10629 Tested-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Reviewed-by: Bernhard Bitsch <bbitsch@ipfire.org> Tested-by: Bernhard Bitsch <bbitsch@ipfire.org>
Adolf Belka [Thu, 2 Mar 2023 14:11:22 +0000 (15:11 +0100)]
dhcp.cgi: Fix for bug#10629 - update bgcolor to css
- This v2 version moves the extraHead variable to header.pl as many of the css values
will be used in many other WUI cgi pages so makes sense to not define anew in every
location using the bgcolor or other colour variables.
- I will submit patches to follow the same approach in all other WUI cgi pages once this
has been submitted into next
- bgcolor was deprecated in HTML 4.01 and is not supported by HTML 5
- The orange colour for IP's that are outside the IPFire green and blue subnets does not
work on any browser I am using.
- I used the CSS approach that @Leo used in the Zone Configuration cgi page
- This patch changes all existing bgcolor entries to the css based background-color
- Tested on my vm testbed and confirmed to work. The Orange colour for IP's outside of
the subnet now shows up.
Fixes: Bug#10629 Tested-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Reviewed-by: Bernhard Bitsch <bbitsch@ipfire.org> Tested-by: Bernhard Bitsch <bbitsch@ipfire.org>
Matthias Fischer [Fri, 17 Feb 2023 18:00:48 +0000 (19:00 +0100)]
clamav: Update to 1.0.1
For details see:
https://blog.clamav.net/2023/02/clamav-01038-01052-and-101-patch.html
"ClamAV 1.0.1 is a critical patch release with the following fixes:
CVE-2023-20032: Fixed a possible remote code execution
vulnerability in the HFS+ file parser. The issue affects versions
1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier.
Thank you to Simon Scannell for reporting this issue.
CVE-2023-20052: Fixed a possible remote information leak
vulnerability in the DMG file parser. The issue affects versions
1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier.
Thank you to Simon Scannell for reporting this issue.
Fix an allmatch detection issue with the preclass bytecode hook."
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Wed, 8 Feb 2023 20:04:16 +0000 (21:04 +0100)]
make: Update to version 4.4
- Update from version 4.3 to 4.4
- Update of rootfile
- the $(MAKETUNING) option does not work with the elinks build with version 4.4 A linked
patch has been created for the removal of that option from the elinks lfs file.
- Changelog
Version 4.4 (31 Oct 2022)
A complete list of bugs fixed in this version is available here:
https://sv.gnu.org/bugs/index.php?group=make&report_id=111&fix_release_id=109&set=custom
* WARNING: Deprecation!
The following systems are deprecated in this release:
- OS/2 (EMX)
- AmigaOS
- Xenix
- Cray
In the NEXT release of GNU Make, support for these systems will be removed.
If you want to see them continue to be supported, contact <bug-make@gnu.org>.
* WARNING: Future backward-incompatibility!
In the NEXT release of GNU Make, pattern rules will implement the same
behavior change for multiple targets as explicit grouped targets, below: if
any target of the rule is needed by the build, the recipe will be invoked if
any target of the rule is missing or out of date. During testing some
makefiles were found to contain pattern rules that do not build all targets;
this can cause issues so we are delaying this change for one release cycle
to allow these makefiles to be updated. GNU Make shows a warning if it
detects this situation: "pattern recipe did not update peer target".
* WARNING: Backward-incompatibility!
GNU Make now uses temporary files in more situations than previous releases.
If your build system sets TMPDIR (or TMP or TEMP on Windows) and deletes the
contents during the build, or uses restrictive permissions, this may cause
problems. You can choose an alternative temporary directory only for use by
GNU Make by setting the new MAKE_TMPDIR environment variable before invoking
make. Note that this value CANNOT be set inside the makefile, since make
needs to find its temporary directory before the makefiles are parsed.
* WARNING: Backward-incompatibility!
Previously each target in a explicit grouped target rule was considered
individually: if the targets needed by the build were not out of date the
recipe was not run even if other targets in the group were out of date. Now
if any of the grouped targets are needed by the build, then if any of the
grouped targets are out of date the recipe is run and all targets in the
group are considered updated.
* WARNING: Backward-incompatibility!
Previously if --no-print-directory was seen anywhere in the environment or
command line it would take precedence over any --print-directory. Now, the
last setting of directory printing options seen will be used, so a command
line such as "--no-print-directory -w" _will_ show directory entry/exits.
* WARNING: Backward-incompatibility!
Previously the order in which makefiles were remade was not explicitly
stated, but it was (roughly) the inverse of the order in which they were
processed by make. In this release, the order in which makefiles are
rebuilt is the same order in which make processed them, and this is defined
to be true in the GNU Make manual.
* WARNING: Backward-incompatibility!
Previously only simple (one-letter) options were added to the MAKEFLAGS
variable that was visible while parsing makefiles. Now, all options are
available in MAKEFLAGS. If you want to check MAKEFLAGS for a one-letter
option, expanding "$(firstword -$(MAKEFLAGS))" is a reliable way to return
the set of one-letter options which can be examined via findstring, etc.
* WARNING: Backward-incompatibility!
Previously makefile variables marked as export were not exported to commands
started by the $(shell ...) function. Now, all exported variables are
exported to $(shell ...). If this leads to recursion during expansion, then
for backward-compatibility the value from the original environment is used.
To detect this change search for 'shell-export' in the .FEATURES variable.
* WARNING: New build requirement
GNU Make utilizes facilities from GNU Gnulib: Gnulib requires certain C99
features in the C compiler and so these features are required by GNU Make:
https://www.gnu.org/software/gnulib/manual/html_node/C99-features-assumed.html
The configure script should verify the compiler has these features.
* New feature: The .WAIT special target
If the .WAIT target appears between two prerequisites of a target, then
GNU Make will wait for all of the targets to the left of .WAIT in the list
to complete before starting any of the targets to the right of .WAIT.
This feature is available in some other versions of make, and it will be
required by an upcoming version of the POSIX standard for make.
Different patches were made by Alexey Neyman <alex.neyman@auriga.ru> (2005)
and Steffen Nurpmeso <steffen@sdaoden.eu> (2020) that were useful but the
result is a different implementation (closer to Alexey's idea).
* New feature: .NOTPARALLEL accepts prerequisites
If the .NOTPARALLEL special target has prerequisites then all prerequisites
of those targets will be run serially (as if .WAIT was specified between
each prerequisite).
* New feature: The .NOTINTERMEDIATE special target
.NOTINTERMEDIATE disables intermediate behavior for specific files, for all
files built using a pattern, or for the entire makefile.
Implementation provided by Dmitry Goncharov <dgoncharov@users.sf.net>
* New feature: The $(let ...) function
This function allows user-defined functions to define a set of local
variables: values can be assigned to these variables from within the
user-defined function and they will not impact global variable assignments.
Implementation provided by Jouke Witteveen <j.witteveen@gmail.com>
* New feature: The $(intcmp ...) function
This function allows conditional evaluation controlled by a numerical
comparison.
Implementation provided by Jouke Witteveen <j.witteveen@gmail.com>
* New feature: Improved support for -l / --load-average
On systems that provide /proc/loadavg (Linux), GNU Make will use it to
determine the number of runnable jobs and use this as the current load,
avoiding the need for heuristics.
Implementation provided by Sven C. Dack <sdack@gmx.com>
* New feature: The --shuffle command line option
This option reorders goals and prerequisites to simulate non-determinism
that may be seen using parallel build. Shuffle mode allows a form of "fuzz
testing" of parallel builds to verify that all prerequisites are correctly
described in the makefile.
Implementation provided by Sergei Trofimovich <siarheit@google.com>
* New feature: The --jobserver-style command line option and named pipes
A new jobserver method is used on systems where mkfifo(3) is supported.
This solves a number of obscure issues related to using the jobserver
and recursive invocations of GNU Make. This change means that sub-makes
will connect to the jobserver even if they are not marked as recursive.
It also means that other tools that want to participate in the jobserver
will need to be enhanced as described in the GNU Make manual.
You can force GNU Make to use the simple pipe-based jobserver (perhaps if
you are integrating with other tools or older versions of GNU Make) by
adding the '--jobserver-style=pipe' option to the command line of the
top-level invocation of GNU Make, or via MAKEFLAGS or GNUMAKEFLAGS.
To detect this change search for 'jobserver-fifo' in the .FEATURES variable.
* Some POSIX systems (*BSD) do not allow locks to be taken on pipes, which
caused the output sync feature to not work properly there. Also multiple
invocations of make redirecting to the same output file (e.g., /dev/null)
would cause hangs. Instead of locking stdout (which does have some useful
performance characteristics, but is not portable) create a temporary file
and lock that. Windows continues to use a mutex as before.
* GNU Make has sometimes chosen unexpected, and sub-optimal, chains of
implicit rules due to the definition of "ought to exist" in the implicit
rule search algorithm, which considered any prerequisite mentioned in the
makefile as "ought to exist". This algorithm has been modified to prefer
prerequisites mentioned explicitly in the target being built and only if
that results in no matching rule, will GNU Make consider prerequisites
mentioned in other targets as "ought to exist".
Implementation provided by Dmitry Goncharov <dgoncharov@users.sf.net>
* GNU Make was performing secondary expansion of all targets, even targets
which didn't need to be considered during the build. In this release
only targets which are considered will be secondarily expanded.
Implementation provided by Dmitry Goncharov <dgoncharov@users.sf.net>
* If the MAKEFLAGS variable is modified in a makefile, it will be re-parsed
immediately rather than after all makefiles have been read. Note that
although all options are parsed immediately, some special effects won't
appear until after all makefiles are read.
* The -I option accepts an argument "-" (e.g., "-I-") which means "reset the
list of search directories to empty". Among other things this can be used
to prevent GNU Make from searching in its default list of directories.
* New debug option "print" will show the recipe to be run, even when silent
mode is set, and new debug option "why" will show why a target is rebuilt
(which prerequisites caused the target to be considered out of date).
Implementation provided by David Boyce <David.S.Boyce@gmail.com>
* The existing --trace option is made equivalent to --debug=print,why
* Target-specific variables can now be marked "unexport".
* Exporting / unexporting target-specific variables is handled correctly, so
that the attribute of the most specific variable setting is used.
* Special targets like .POSIX are detected upon definition, ensuring that any
change in behavior takes effect immediately, before the next line is parsed.
* When the pipe-based jobserver is enabled and GNU Make decides it is invoking
a non-make sub-process and closes the jobserver pipes, it will now add a new
option to the MAKEFLAGS environment variable that disables the jobserver.
This prevents sub-processes that invoke make from accidentally using other
open file descriptors as jobserver pipes. For more information see
https://savannah.gnu.org/bugs/?57242 and https://savannah.gnu.org/bugs/?62397
* A long-standing issue with the directory cache has been resolved: changes
made as a side-effect of some other target's recipe are now noticed as
expected.
* GNU Make can now be built for MS-Windows using the Tiny C tcc compiler.
Port provided by Christian Jullien <eligis@orange.fr>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Adolf Belka [Wed, 8 Feb 2023 11:05:34 +0000 (12:05 +0100)]
libtirpc: Update to version 1.3.3
- Update from version 1.3.1 to 1.3.3
- Update of rootfile not required
- Changelog or News files in source tarball are from 2008 or earlier. The only source for
the changes is the commits from the git repository
http://git.linux-nfs.org/?p=steved/libtirpc.git;a=shortlog;h=refs/heads/master
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Michael Tremer [Wed, 8 Feb 2023 11:13:30 +0000 (11:13 +0000)]
openssl: Update to 1.1.1t
*) Fixed X.400 address type confusion in X.509 GeneralName.
There is a type confusion vulnerability relating to X.400 address processing
inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING
but subsequently interpreted by GENERAL_NAME_cmp as an ASN1_TYPE. This
vulnerability may allow an attacker who can provide a certificate chain and
CRL (neither of which need have a valid signature) to pass arbitrary
pointers to a memcmp call, creating a possible read primitive, subject to
some constraints. Refer to the advisory for more information. Thanks to
David Benjamin for discovering this issue. (CVE-2023-0286)
This issue has been fixed by changing the public header file definition of
GENERAL_NAME so that x400Address reflects the implementation. It was not
possible for any existing application to successfully use the existing
definition; however, if any application references the x400Address field
(e.g. in dead code), note that the type of this field has changed. There is
no ABI change.
[Hugo Landau]
*) Fixed Use-after-free following BIO_new_NDEF.
The public API function BIO_new_NDEF is a helper function used for
streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL
to support the SMIME, CMS and PKCS7 streaming capabilities, but may also
be called directly by end user applications.
The function receives a BIO from the caller, prepends a new BIO_f_asn1
filter BIO onto the front of it to form a BIO chain, and then returns
the new head of the BIO chain to the caller. Under certain conditions,
for example if a CMS recipient public key is invalid, the new filter BIO
is freed and the function returns a NULL result indicating a failure.
However, in this case, the BIO chain is not properly cleaned up and the
BIO passed by the caller still retains internal pointers to the previously
freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO
then a use-after-free will occur. This will most likely result in a crash.
(CVE-2023-0215)
[Viktor Dukhovni, Matt Caswell]
*) Fixed Double free after calling PEM_read_bio_ex.
The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and
decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload
data. If the function succeeds then the "name_out", "header" and "data"
arguments are populated with pointers to buffers containing the relevant
decoded data. The caller is responsible for freeing those buffers. It is
possible to construct a PEM file that results in 0 bytes of payload data.
In this case PEM_read_bio_ex() will return a failure code but will populate
the header argument with a pointer to a buffer that has already been freed.
If the caller also frees this buffer then a double free will occur. This
will most likely lead to a crash.
The functions PEM_read_bio() and PEM_read() are simple wrappers around
PEM_read_bio_ex() and therefore these functions are also directly affected.
These functions are also called indirectly by a number of other OpenSSL
functions including PEM_X509_INFO_read_bio_ex() and
SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL
internal uses of these functions are not vulnerable because the caller does
not free the header argument if PEM_read_bio_ex() returns a failure code.
(CVE-2022-4450)
[Kurt Roeckx, Matt Caswell]
*) Fixed Timing Oracle in RSA Decryption.
A timing based side channel exists in the OpenSSL RSA Decryption
implementation which could be sufficient to recover a plaintext across
a network in a Bleichenbacher style attack. To achieve a successful
decryption an attacker would have to be able to send a very large number
of trial messages for decryption. The vulnerability affects all RSA padding
modes: PKCS#1 v1.5, RSA-OEAP and RSASVE.
(CVE-2022-4304)
[Dmitry Belyavsky, Hubert Kario]
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Security #5804: Suricata crashes while processing FTP (6.0.x backport)
Bug #5815: detect: config keyword prevents tx cleanup (6.0.x backport)
Bug #5812: nfs: debug validation triggered on nfs2 read
Bug #5810: smb/ntlmssp: parser incorrectly assumes fixed field order (6.0.x backport)
Bug #5806: exceptions: midstream flows are dropped if midstream=true && stream.midstream-policy=drop-flow (6.0.x backport)
Bug #5796: TLS Handshake Fragments not Reassembled (6.0.x backport)
Bug #5795: detect/udp: different detection from rules when UDP/TCP header is broken (6.0.x backport)
Bug #5793: decode: Padded packet to minimal Ethernet length marked with invalid length event (6.0.x backport)
Bug #5791: smb: unbounded file chunk queuing after gap (6.0.x backport)
Bug #5763: libbpf: Use of legacy code in eBPF/XDP programs (6.0.x backport)
Bug #5762: detect/pcre: JIT not disabled when OS doesn't allow RWX pages
Bug #5760: nfs: ASSERT: attempt to subtract with overflow (compound) (6.0.x backport)
Bug #5749: iprep/ipv6: warning issued on valid reputation input (6.0.x backport)
Bug #5744: netmap: 6.0.9 v14 backport causes known packet stalls from v14 implementation in "legacy" mode too
Bug #5738: smb: failed assertion (!((f->alproto == ALPROTO_SMB && txd->files_logged != 0))), function CloseFile, file output-file.c (6.0.x backport)
Bug #5735: smtp: quoted-printable encoding skips empty lines in files (6.0.x backport)
Bug #5723: eve: missing common fields like community id for some event types like RFB
Bug #5601: detect: invalid hex character in content leads to bad debug message (6.0.x backport)
Bug #5565: Excessive qsort/msort time when large number of rules using tls.fingerprint (6.0.x backport)
Bug #5299: YAML warning from default config on 6.0.5
Optimization #5797: tls: support incomplete API to replace internal buffering
Optimization #5790: smb: set defaults for file chunk limits (6.0.x backport)"
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org> Reviewed-by: Adolf Belka <adolf.belka@ipfire.org>
Adolf Belka [Fri, 27 Jan 2023 14:30:02 +0000 (15:30 +0100)]
libtirpc: Convert from an addon to a core program - fixes Bug 13015
- libtirpc is required for lsof to work from CU172 onwards. rpc.h is no longer available
from glibc. This would normally cause the lsof build to fail but libtirpc as an addon
is built before lsof and so is present in the build and lsof is linked to it.
When running lsof it fails as the linked libtirpc library is not present unless it has
been installed as an addon.
- This patch converts the libtirpc lfs from an addon to a core program and moves the
rootfile from the packages directory to the common directory.
- Tested out on my vm testbed. With CU172 lsof fails to run due to the missing libtirpc
With the build based on this patch installed lsof works normally again.
- Disabled the static library build in the configure options and updated the rootfile
Tested-by: Adolf Belka <adolf.belka@ipfire.org> Fixes: Bug#13015 Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Reviewed-by: Bernhard Bitsch <bbitsch@ipfire.org>
Peter Müller [Fri, 27 Jan 2023 00:21:13 +0000 (00:21 +0000)]
Tor: Update to 0.4.7.13
Changes in version 0.4.7.13 - 2023-01-12
This version contains three major bugfixes, two for relays and one for
client being a security fix, TROVE-2022-002. We have added, for Linux, the
support for IP_BIND_ADDRESS_NO_PORT for relays using OutboundBindAddress.
We strongly recommend to upgrade to this version considering the important
congestion control fix detailed below.
o Major bugfixes (congestion control):
- Avoid incrementing the congestion window when the window is not
fully in use. Thia prevents overshoot in cases where long periods
of low activity would allow our congestion window to grow, and
then get followed by a burst, which would cause queue overload.
Also improve the increment checks for RFC3742. Fixes bug 40732;
bugfix on 0.4.7.5-alpha.
o Major bugfixes (relay):
- When opening a channel because of a circuit request that did not
include an Ed25519 identity, record the Ed25519 identity that we
actually received, so that we can use the channel for other
circuit requests that _do_ list an Ed25519 identity. (Previously
we had code to record this identity, but a logic bug caused it to
be disabled.) Fixes bug 40563; bugfix on 0.3.0.1-alpha. Patch
from "cypherpunks".
o Major bugfixes (TROVE-2022-002, client):
- The SafeSocks option had its logic inverted for SOCKS4 and
SOCKS4a. It would let the unsafe SOCKS4 pass but not the safe
SOCKS4a one. This is TROVE-2022-002 which was reported on
Hackerone by "cojabo". Fixes bug 40730; bugfix on 0.3.5.1-alpha.
o Minor feature (authority):
- Reject 0.4.6.x series at the authority level. Closes ticket 40664.
o Minor features (fallbackdir):
- Regenerate fallback directories generated on January 12, 2023.
o Minor features (geoip data):
- Update the geoip files to match the IPFire Location Database, as
retrieved on 2023/01/12.
o Minor features (relays):
- Set the Linux-specific IP_BIND_ADDRESS_NO_PORT option on outgoing
sockets, allowing relays using OutboundBindAddress to make more
outgoing connections than ephemeral ports, as long as they are to
separate destinations. Related to issue 40597; patch by Alex
Xu (Hello71).
o Minor bugfixes (relay, metrics):
- Fix typo in a congestion control label on the MetricsPort. Fixes
bug 40727; bugfix on 0.4.7.12.
o Minor bugfixes (sandbox, authority):
- With the sandbox enabled, allow to write "my-consensus-
{ns|microdesc}" and to rename them as well. Fixes bug 40729;
bugfix on 0.3.5.1-alpha.
o Code simplifications and refactoring:
- Rely on actual error returned by the kernel when choosing what
resource exhaustion to log. Fixes issue 40613; Fix
on tor-0.4.6.1-alpha.
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Adolf Belka [Wed, 25 Jan 2023 22:41:25 +0000 (23:41 +0100)]
pixman: Update to version 0.42.2
- Update from version 0.40.0 to 0.42.2
- Update of rootfile
- Build converted to meson
- Changelog is empty in the source tarball as is the NEWS file. There is no change log
info on the webpage. The only source of change info are the commits from the git repo
https://cgit.freedesktop.org/pixman/log/
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Adolf Belka [Wed, 25 Jan 2023 22:41:20 +0000 (23:41 +0100)]
cairo: Update to version 1.17.6
- Update from version 1.16.0 to 1.17.6
- Update of rootfile
- Next version will only build with meson and as there were some bugs with the autoconf
tools build which required a hack to overcome, this version was changed to run with
meson. beos and os2 backends are no longer supported and windows only builds if the
platform being used for the build is windows based. Therefore those options are no
longer needed. meson uses shared libraries only by default.
- The cairo-1.16.0-binutils-2.34 patch is no longer needed as the changes have been
included in the source tarball.
- tarball had to be changed to .bz2 as xz is no longer provided.
- Changelog
Release 1.17.6 (2022-03-18 Emmanuele Bassi <ebassi@gnome.org>)
I spy with my little eye… a Cairo snapshot!
First of all, many, many thanks to everyone who contributed to Cairo
during this development cycle. A special thank you goes to:
- Adrian Johnson
- Uli Schlachter
for their tireless efforts in ensuring that the lights are still on
in the Cairo project.
This snapshot sees the removal of the following backends and platform
support:
- Qt4
- BeOS
- OS/2
- DirectFB
- DRM
- Cogl
- OpenVG
Thanks to all past contributors for their work on them. If you were using
any of these backends then you will need to stick to Cairo 1.16.
To offset the removal of the backends above, Adrian Johnson landed the
DWrite font rendering backend on Windows.
There have been multiple improvements in the Quartz backend, courtesy of
John Ralls.
Tim-Philipp Müller has kept the Meson build in top shape.
This snapshot is going to be the **last** release of Cairo with the
Autotools build system. The Meson build has seen many improvements and
it is considerably easier to maintain and faster to build.
Release 1.17.4 (2020-11-27 Bryce Harrington <bryce@bryceharrington.org>)
Thank you to the many people who have contributed the large number of
bug fixes and refinements since 1.17.2.
A particularly noteworthy improvement in this release is the addition of
the meson build system as an alternative to autotools. Autotools is
still used for producing the releases, so will be the default in the
tarball and presumably will still be preferred by distro packagers of
Cairo. It should be possible to build the release tarball using meson,
but as this is new functionality consider it still a work in progress.
The meson configuration has striven to track the autotools
implementation but be aware there may still be some differences between
the two.
Continuous Integration configurations have been added that enable
testing on a variety of platforms including Fedora, Windows MSVC, etc.
This work has helped in identifying updates and fixes including
adjusting to changes in API calls in dependencies like rsvg and
fontconfig, and to fix platform-specific build issues.
The cogl Cairo backend underwent significant development this cycle.
Cogl provides GPU accelerated drawing support. The development work
includes implementation of core functionality, performance
optimizations, and stabilization.
Subpixel positioning support allows improved glyph outlines with the
Freetype font backend.
For a complete log of changes, please see
https://cairographics.org/releases/ChangeLog.1.17.4
[On a personal note, this will be my last release for Cairo. My Cairo
time availability has been non-existent (particularly this crazy past
year). The release process is well documented and hopefully will help
whomever picks up the baton from here.]
Release 1.17.2 (2019-01-31 Bryce Harrington <bryce@bryceharrington.org>)
This snapshot provides the new support for writing floating point
formats as 16 bpc PNGs, with support for RGBA128F and RGB96F formats.
This new feature increases Cairo's pixman version requirement to 0.36.0.
Beyond this are a range of bugfixes and some work on establishing CI for
Cairo.
For a complete log of changes, please see
https://cairographics.org/releases/ChangeLog.1.17.2
API Changes
None
Dependency Changes
pixman 0.36.0
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Adolf Belka [Wed, 25 Jan 2023 22:41:24 +0000 (23:41 +0100)]
xz: Update to version 5.4.1
- Update from version 5.4.0 to 5.4.1
- Update of rootfile
- Changelog
5.4.1 (2023-01-11)
* liblzma:
- Fixed the return value of lzma_microlzma_encoder() if the
LZMA options lc/lp/pb are invalid. Invalid lc/lp/pb options
made the function return LZMA_STREAM_END without encoding
anything instead of returning LZMA_OPTIONS_ERROR.
- Windows / Visual Studio: Workaround a possible compiler bug
when targeting 32-bit x86 and compiling the CLMUL version of
the CRC64 code. The CLMUL code isn't enabled by the Windows
project files but it is in the CMake-based builds.
* Build systems:
- Windows-specific CMake changes:
* Don't try to enable CLMUL CRC64 code if _mm_set_epi64x()
isn't available. This fixes CMake-based build with Visual
Studio 2013.
* Created a workaround for a build failure with windres
from GNU binutils. It is used only when the C compiler
is GCC (not Clang). The workaround is incompatible
with llvm-windres, resulting in "XZx20Utils" instead
of "XZ Utils" in the resource file, but without the
workaround llvm-windres works correctly. See the
comment in CMakeLists.txt for details.
* Included the resource files in the xz and xzdec build
rules. Building the command line tools is still
experimental but possible with MinGW-w64.
- Visual Studio: Added stream_decoder_mt.c to the project
files. Now the threaded decompressor lzma_stream_decoder_mt()
gets built. CMake-based build wasn't affected.
- Updated windows/INSTALL-MSVC.txt to mention that CMake-based
build is now the preferred method with Visual Studio. The
project files will probably be removed after 5.4.x releases.
- Changes to #defines in config.h:
* HAVE_DECL_CLOCK_MONOTONIC was replaced by
HAVE_CLOCK_MONOTONIC. The old macro was always defined
in configure-generated config.h to either 0 or 1. The
new macro is defined (to 1) only if the declaration of
CLOCK_MONOTONIC is available. This matches the way most
other config.h macros work and makes things simpler with
other build systems.
* HAVE_DECL_PROGRAM_INVOCATION_NAME was replaced by
HAVE_PROGRAM_INVOCATION_NAME for the same reason.
* Tests:
- Fixed test script compatibility with ancient /bin/sh
versions. Now the five test_compress_* tests should
no longer fail on Solaris 10.
- Added and refactored a few tests.
* Translations:
- Updated the Catalan and Esperanto translations.
- Added Korean and Ukrainian man page translations.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Adolf Belka [Wed, 25 Jan 2023 22:41:23 +0000 (23:41 +0100)]
xfsprogs: Update to version 6.1.1
- Update from version 6.1.0 to 6.1.1
- Update of rootfile not required
- Changelog
There is no changelog in the source tarball or in the kernel site where the source
tarballs are available from. xfs.org, which normally provides access to the git
repository, fails to connect. xfs.wiki.kernel.org has no changelog info in it.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Adolf Belka [Wed, 25 Jan 2023 22:41:22 +0000 (23:41 +0100)]
nfs: Update to version 2.6.2
- Update from version 2.6.1 to 2.6.2
- Update of rootfile
- Changelog is available in sourceforge at the following url
https://sourceforge.net/projects/nfs/files/nfs-utils/2.6.2/
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Adolf Belka [Wed, 25 Jan 2023 22:41:21 +0000 (23:41 +0100)]
lz4: Update to version 1.9.4
- Update from version 1.9.3 to 1.9.4
- Update of rootfile
- Changelog
v1.9.4
perf : faster decoding speed (~+20%) on aarch64 platforms
perf : faster decoding speed (~+70%) for -BD4 setting in CLI
api : new function `LZ4_decompress_safe_partial_usingDict()` by @yawqi
api : lz4frame: ability to provide custom allocators at state creation
api : can skip checksum validation for improved decoding speed
api : new experimental unit `lz4file` for file i/o API, by @anjiahao1
api : new experimental function `LZ4F_uncompressedUpdate()`, by @alexmohr
cli : `--list` works on `stdin` input, by @Low-power
cli : `--no-crc` does not produce (compression) nor check (decompression) checksums
cli : fix: `--test` and `--list` produce an error code when parsing invalid input
cli : fix: support skippable frames when passed via `stdin`, reported by @davidmankin
build: fix: Makefile respects CFLAGS directives passed via environment variable
build: `LZ4_FREESTANDING`, new build macro for freestanding environments, by @t-mat
build: `make` and `make test` are compatible with `-j` parallel run
build: AS/400 compatibility, by @jonrumsey
build: Solaris 10 compatibility, by @pekdon
build: MSVC 2022 support, by @t-mat
build: improved meson script, by @eli-schwartz
doc : Updated LZ4 block format, provide an "implementation notes" section
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Matthias Fischer [Wed, 25 Jan 2023 17:16:24 +0000 (18:16 +0100)]
nano: Update to 7.2
For details see:
https://lists.gnu.org/archive/html/info-gnu/2023-01/msg00007.html
"
...
The specific issue that was addressed in this release:
https://savannah.gnu.org/bugs/?63616 (pasting succeeded despite --view)
Changes between v7.1 and v7.2:
------------------------------
Benno Schulenberg (12):
bindings: let ^/ toggle between the 'search' and 'gotoline' menus
bump version numbers and add a news item for the 7.2 release
copyright: update the years for the FSF
docs: give ^K and ^U some useful function in the alternative bindings
docs: put the binding of ^Y after its unbinding, for it to be effective
gnulib: update to its current upstream state
input: disallow bracketed pastes when in view mode
po: update translations and regenerate POT file and PO files
syntax: html: colorize specially the other two emphasizing tags too
tweaks: avoid warnings when compiling with -Wpedantic
tweaks: rewrap an old news item
tweaks: separate a special thanks from the preceding ones"
Matthias Fischer [Thu, 26 Jan 2023 19:40:27 +0000 (20:40 +0100)]
bind: Update to 9.16.37
For details for 9.16.36 and 9.16.37 see:
https://downloads.isc.org/isc/bind9/9.16.37/doc/arm/html/notes.html#notes-for-bind-9-16-37
"Notes for BIND 9.16.37
Security Fixes
An UPDATE message flood could cause named to exhaust all available
memory. This flaw was addressed by adding a new update-quota option
that controls the maximum number of outstanding DNS UPDATE messages
that named can hold in a queue at any given time (default: 100).
(CVE-2022-3094)
ISC would like to thank Rob Schulhof from Infoblox for bringing this
vulnerability to our attention. [GL #3523]
named could crash with an assertion failure when an RRSIG query was
received and stale-answer-client-timeout was set to a non-zero value.
This has been fixed. (CVE-2022-3736)
ISC would like to thank Borja Marcos from Sarenet (with assistance by
Iratxe Niño from Fundación Sarenet) for bringing this vulnerability to
our attention. [GL #3622]
named running as a resolver with the stale-answer-client-timeout option
set to any value greater than 0 could crash with an assertion failure,
when the recursive-clients soft quota was reached. This has been fixed.
(CVE-2022-3924)
ISC would like to thank Maksym Odinintsev from AWS for bringing this
vulnerability to our attention. [GL #3619]
New Features
The new update-quota option can be used to control the number of
simultaneous DNS UPDATE messages that can be processed to update an
authoritative zone on a primary server, or forwarded to the primary
server by a secondary server. The default is 100. A new statistics
counter has also been added to record events when this quota is
exceeded, and the version numbers for the XML and JSON statistics
schemas have been updated. [GL #3523]
Feature Changes
The Differentiated Services Code Point (DSCP) feature in BIND has been
deprecated. Configuring DSCP values in named.conf now causes a warning
to be logged. Note that this feature has only been partly operational
since the new Network Manager was introduced in BIND 9.16.0. [GL #3773]
The catalog zone implementation has been optimized to work with
hundreds of thousands of member zones. [GL #3744]
Bug Fixes
In certain query resolution scenarios (e.g. when following CNAME
records), named configured to answer from stale cache could return a
SERVFAIL response despite a usable, non-stale answer being present in
the cache. This has been fixed. [GL #3678]
...
Notes for BIND 9.16.36
Feature Changes
The auto-dnssec option has been deprecated and will be removed in a
future BIND 9.19.x release. Please migrate to dnssec-policy. [GL #3667]
Bug Fixes
When a catalog zone was removed from the configuration, in some cases a
dangling pointer could cause the named process to crash. This has been
fixed. [GL #3683]
When a zone was deleted from a server, a key management object related
to that zone was inadvertently kept in memory and only released upon
shutdown. This could lead to constantly increasing memory use on
servers with a high rate of changes affecting the set of zones being
served. This has been fixed. [GL #3727]
In certain cases, named waited for the resolution of outstanding
recursive queries to finish before shutting down. This was unintended
and has been fixed. [GL #3183]
The zone <name>/<class>: final reference detached log message was moved
from the INFO log level to the DEBUG(1) log level to prevent the
named-checkzone tool from superfluously logging this message in
non-debug mode. [GL #3707]"
I have removed the patches instead of readd the mpfr-4.1.0
patchset because this result may result in different builds if we
not update the prebuild toolchain.
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Adolf Belka [Fri, 9 Dec 2022 21:47:12 +0000 (22:47 +0100)]
libtool: Update to version 2.4.7
- Update from version 2.4.6 (Feb 2015) to 2.4.7 (Mar 2022)
- Update of rootfile
- The shebang in the libtoolize script has changed from ! /bin/sh to ! /usr/bin/env sh
because apparently the previous version presented challenges for containerised
environments. For IPFire build it meant that using libtoolize in the build of libxcrypt
failed because it could not deal with the changed shebang.
- Patch created to change the shebang for libtoolize.in back to the version in 2.4.6 and
earlier.
- The change of libtoolize.in then caused the libtool build to try and rebuild the man
page for it but this fails as help2man is required for this. There is no option in the
configure to not build the docs so hence there is an associated patch with this one
that build help2man but the rootfile is completely commented out as it is only
required for the build
- Added --disable-static to the configure options
- Changelog
Noteworthy changes in release 2.4.7 (2022-03-16) [stable]
New features:
- Libtool script now supports (configure-time and runtime) ARFLAGS
variable, which obsoletes AR_FLAGS. This is due to naming conventions
among other *FLAGS and to be consistent with Automake's ARFLAGS.
- Gnulib testsuite is enabled and run during 'make check'.
- Support the Windows version of the Intel C Compiler (icl) in
libtool script.
- Pass '-fsanitize=*' flags for GCC and LLVM, and '-specs=*' for GCC
to linker.
- Pass '-Xassembler=*' and '-Wa,*' flag to compilers and linkers.
- The variable 'FILECMD' with default value of '/usr/bin/file' was used to
replace existing hard coded references to '/usr/bin/file'.
- Add MidnightBSD support.
Important incompatible changes:
- Libtool changed ARFLAGS/AR_FLAGS default from 'cru' to 'cr'.
- Do not pass '-pthread' to Solaris linker.
- 'libtool' and 'libtoolize' scripts now use '#! /usr/bin/env sh' shebang.
Previously '#! /bin/sh' was used, which presents challenges for
containerized environments.
Bug fixes:
- Fix significant slowdown of libtoolize for certain projects (regression
introduced in 2.4.3 release) caused by infinite m4 macro recursion.
- Mitigate the slowdown of libtool script (introduced in v2.4.3) caused by
increased number of calls to '$SED $sed_quote_subst' (bug#20006).
- Properly parse and export TLS symbols on AIX.
- Various bug fixes surrounding use of 'sed'.
- Darwin systems set proper "allow undefined" flag on OSX 11, and
PowerPC 10.5.
- Removed some deprecated tests related to 'Makefile.inc' files.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
[Please note: This 'clamav' version needs rust >1.56]
For details see:
https://blog.clamav.net/2022/11/clamav-100-lts-released.html
Excerpt:
"Major changes
Support for decrypting read-only OLE2-based XLS files that are encrypted with the default password. Use of
the default password will now appear in the metadata JSON.
Overhauled the implementation of the all-match feature. The newer code is more reliable and easier to
maintain.
This project fixed several known issues with signature detection in all- match mode:
Enabled embedded file-type recognition signatures to match when a malware signature also matched in
a scan of the same layer.
Enabled bytecode signatures to run in all-match mode after a match has occurred.
Fixed an assortment of all-match edge case issues.
Added multiple test cases to verify correct all-match behavior.
Added a new callback to the public API for inspecting file content during a scan at each layer of archive
extraction.
The new callback function type is clcb_file_inspection defined in clamav.h.
The function cl_engine_set_clcb_file_inspection() may be used to enable the callback prior to performing
a scan.
This new callback is to be considered unstable for the 1.0 release. We may alter this function in a
subsequent feature version.
Added a new function to the public API for unpacking CVD signature archives.
The new function is cl_cvdunpack(). The last parameter for the function may be set to verify if a CVD's
signature is valid before unpacking the CVD content to the destination directory.
The option to build with an external TomsFastMath library has been removed. ClamAV requires non-default
build options for TomsFastMath to support bigger floating point numbers. Without this change, database and
Windows EXE/DLL authenticode certificate validation may fail. The ENABLE_EXTERNAL_TOMSFASTMATH build is now
ignored.
Moved the Dockerfile and supporting scripts from the main ClamAV repository over to a new
repository: https://github.com/Cisco-Talos/clamav-docker
The separate repository will make it easier to update the images and fix issues with images for released
ClamAV versions.
Any users building the ClamAV Docker image rather than pulling them from Docker Hub will have to get the
latest Docker files from the new location.
Increased the SONAME major version for libclamav because of ABI changes between the 0.103 LTS release and
the 1.0 LTS release.
Other improvements
Add checks to limit PDF object extraction recursion.
Increased the limit for memory allocations based on untrusted input and altered the warning message when the
limit is exceeded so that it is more helpful and less dramatic.
Dramatically improved the build time of libclamav-Rust unit tests. The unit test build is included in the
time limit for the test itself and was timing out on slower systems. The ClamAV Rust code modules now share
the same build directory, which also reduces the amount of disk space used for the build.
For Windows: The debugging symbol (PDB) files are now installed alongside the DLL and LIB library files when
built in "RelWithDebInfo" or "Debug" mode.
Relaxed the constraints on the check for overlapping ZIP file entries so as not to alert on slightly
malformed, but non-malicious, Java (JAR) archives.
Increased the time limit in FreshClam before warning if the DNS entry is stale. In combination with changes
to update the DNS entry more frequently, this should prevent false alarms of failures in the database
publication system.
Docker: The C library header files are now included in the Docker image. Patch courtesy of GitHub user
TerminalFi.
Show the BYTECODE_RUNTIME build options when using the ccmake GUI for CMake. Patch courtesy of
Дилян Палаузов.
Added explicit minimum and maximum supported LLVM versions so that the build will fail if you try to build
with a version that is too old or too new and will print a helpful message rather than simply failing to
compile because of compatibility issues. Patch courtesy of Matt Jolly.
Fixed compiler warnings that may turn into errors in Clang 16. Patch courtesy of Michael Orlitzky.
Allow building with a custom RPATH so that the executables may be moved after build in a development
environment to a final installation directory.
Bug fixes
Assorted code quality fixes. These are not security issues and will not be backported to prior feature
versions:
Several heap buffer overflows while loading PDB and WDB databases were found by OSS-Fuzz and by Michal
Dardas.
oss-fuzz 44849: heap buffer overflow read (4) in HTML/js-norm
oss-fuzz 43816: heap buffer overflow read (8) in cli_bcomp_freemeta
oss-fuzz 43832: heap buffer overflow read (2) in cli_parse_add
oss-fuzz 44493: integer overflow in cli_scannulsft
CIFuzz leak detected in IDB parser
oss-fuzz assorted signature parser leaks
oss-fuzz 40601: leak detected in pdf_parseobj
Fixed a build failure when using LIBCLAMAV_ONLY mode with tests enabled.
Fixed an issue verifying EXE/DLL authenticode signatures to determine a given file can be trusted (skipped).
Fixed a caching bug relating to the Container and Intermediates logical signature condition.
Fixed a build issue when build with RAR disabled or when building with an external libmspack library rather
than the bundled library.
Fixed the capitalization of the -W option for clamonacc in the clamonacc manpage. Patch courtesy of GitHub
user monkz.
macOS: Fixed an issue with memory-map (mmap) system call detection affecting versions 0.105 and 0.104.
Memory maps may be used in ClamAV to improve signature load performance and scan performance, as well as RAM
usage.
Fixed a performance issue with Rust code when the build type is not explicitly set to "Release" or
"RelWithDebInfo". The Rust default build type is now "RelWithDebInfo" just like the C code, instead of
Debug. This means it is now optimized by default.
Fixed an issue loading Yara rules containing regex strings with an escaped forward-slash (\/) followed by a
colon (:).
Fixed an issue detecting and scanning ZIP file entries appended to very small files. The fix is part of the
all-match feature overhaul.
Fixed a detection issue with EXE/DLL import-address-table hash signatures that specify a wildcard (*) for
the size field. The fix is part of the all-match feature overhaul.
Fixed the default bytecode timeout value listed in the manpages and in the sample config files. Patches
courtesy of Liam Jarvis and Ben Bodenmiller.
Fixed an issue building the libclamav_rust test program when running ctest if building
with BYTECODE_RUNTIME=llvm and when the FindLLVM.cmake module is used to find the LLVM libraries. Patch
courtesy of GitHub user teoberi.
Fixed an issue where scans sent to clamd with the all-match mode enabled caused all subsequent scans to also
use all-match mode.
Fixed bug when starting clamonacc with the --log=FILE option that created randomly named files in the
current directory.
...
error: invalid inclusion of reserved file name Cargo.toml.orig in
package source
...
[Build stops]
After a rather frustrating while, I decided to delete this file during building the particular crate file.
Fun! Building completed without errors.
For now, I added an appropriate if-statement in each crate file which contains 'Cargo.toml.orig'.
If 'Cargo-toml.orig' is present: delete it. Just throw it away.
It might be that there is a more elegant way to do this - if 'someone' has a better solution, please
submit an easier patch.
I searched a few days, but didn't find ANY clue what is going on here.
All I can say: building runs. No more errors or breaks. Nothing.
For details see:
https://github.com/rust-lang/rust/blob/stable/RELEASES.md#version-1650-2022-11-03
I started updating rust to 1.65 mainly because 'clamav 0.105.1-3' and the
shortly thereafter released version 'clamav 1.0.0' need at least 'rust 1.56':
"Building ClamAV requires, at a minimum, Rust compiler version 1.56, as it
relies on features introduced in the Rust 2021 Edition."
At this point we were still on 'nightly 2022-01-27'. Ok then...
But it was a bit more tricky than I thought, because this update wouldn't build without
patching most of the existing rust-crate-lfs files in a way I didn't expect.
Please note the patch series following this update...
Nevertheless, the update to 1.65 and ALL testbuilds completed without any errors.
Unfortunately, I can only provide the rootfile for x86_64 - I don't have the appropriate hardware
for anything else.
During updating rust to 1.65 I found that 'lfsmake2 rust' appeared
twice and removed the second - obsolete - call.
'rust-cipher' now requires 'rust-crypto-common', but was called later
in the build sequence.
=> Moved 'rust-crypto-common' just before 'rust-cipher'. [Thanks Adolf! ;-)]
Adolf Belka [Tue, 27 Dec 2022 17:13:50 +0000 (18:13 +0100)]
iotop: Update to version 1.22 coming from new repository
- Existing iotop is version 0.6 from 2013. In that original repository there have been 42
commits since then up to 2022-03-07 but without any version release.
- In 2020 a new repository was started, based on the original iotop but converted to only
C code with no python. This is being updated on a regular basis with version releases.
This version was released in July 10th 2022. There have been n21 releases since this
repository was started.
- Built and tested this version of iotop and it gave a screen with very similar look to
the original version. The new version has the ability to scroll all the entries whereas
the original one required the window to be made larger to show more entries.
- The new version also has a column showing a graphical view of the amount of traffic as
well as the actual numbers.
- Overall this looks to match what vthe original iotop did, plus with a few extras and is
being regularly maintained with new releases.
- Updated rootfile
- This version of iotop is automatically placed in /usr/sbin as the original used to be.
- New repository is at https://github.com/Tomas-M/iotop
- Changelog can be seen at the above repository. It is too large to include here with
21 version updates.
Tested-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Adolf Belka [Thu, 5 Jan 2023 18:21:09 +0000 (19:21 +0100)]
igmpproxy: Update to version 0.4
- Update from version 0.3 to 0.4
- Update of rootfile not required
- Changelog
* Release version 0.4
* Complement phyint whitelist with blacklist Fixes: #54
Implement new phyint configuration option (blacklist), which enables
blocking of specific traffic.
* Chroot and drop privileges after startup
With this PR:
- The apparent root directory can be changed after startup, thus denying
igmpproxy access to files and commands outside that environmental
directory tree.
- igmpproxy can drop root privileges after startup by changing id to
another user.
* Add travis apt repositories for Ubuntu Precise
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Adolf Belka [Sun, 8 Jan 2023 21:40:48 +0000 (22:40 +0100)]
alsa: Update to version 1.2.8
- Update from version 1.2.5.1 to 1.2.8
- Update of rootfile
- Changelog for alsa-lib and alsa-utils is too long to include here.
Details can be found by looking at the individual web site pages for each change
version from 1.2.5.1 to 1.2.8 at https://www.alsa-project.org/wiki/Main_Page_News
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Adolf Belka [Sun, 8 Jan 2023 21:40:52 +0000 (22:40 +0100)]
shadow: Update to version 4.13
- Update from version 4.11.1 to 4.13
- Update of rootfile not required
- Changelog
4.13
* useradd.8: fix default group ID (Tim Biermann)
* Revert drop of subid_init() (Serge Hallyn)
* Georgian translation (NorwayFun)
* useradd: Avoid taking unneeded space: do not reset non-existent data
in lastlog (David Kalnischkies)
* relax username restrictions (Alexander Kanavin)
* selinux: check MLS enabled before setting serange (genBTC)
* copy_tree: use fchmodat instead of chmod (Samanta Navarro)
* copy_tree: don't block on FIFOs (Samanta Navarro)
* add shell linter (Jan Macku)
* copy_tree: carefully treat permissions (Samanta Navarro)
* lib/commonio: make lock failures more detailed (Luca BRUNO)
* lib: use strzero and memzero where applicable (Christian Göttsche)
* Update Dutch translation (Frans Spiesschaert)
* Don't test for NULL before calling free (Alex Colomar)
* Use libc MAX() and MIN() (Alejandro Colomar)
* chage: Fix regression in print_date (Xiami)
* usermod: report error if homedir does not exist (Iker Pedrosa)
* libmisc: minimum id check for system accounts (Iker Pedrosa)
* fix usermod -rG x y wrongly adding a group (xyz)
* man: add missing space in useradd.8.xml (Iker Pedrosa)
* lastlog: check for localtime() return value (Iker Pedrosa)
* Raise limit for passwd and shadow entry length (Iker Pedrosa)
* Remove adduser-old.c (Alejandro Colomar)
* useradd: Fix buffer overflow when using a prefix (David Michael)
* Don't warn when failed to open /etc/nsswitch.conf (Serge Hallyn)
4.12.3
Revert removal of subid_init, which should have bumped soname. So note that 4.12
through 4.12.2 were broken for subid users.
4.12.2
This includes the fix by Christian Göttsche for a TOCTTOU when copying directories.
4.12.1
This should fix the broken uk manpages in 4.12.
4.12
This release includes the following changes:
* Add absolute path hint to --root (Celeste Liu)
* Various cleanups (Christian Göttsche)
* Fix Ubuntu release used in CI tests (Jeremy Whiting)
* add -F options to useradd (and tests) (Masatake YAMATO)
* useradd manpage updates (Masatake YAMATO and Alexander Zhang))
* Check for ownerid (not just username) in subid ranges (Iker Pedrosa)
* Declare file local functions static (Christian Göttsche)
* Use strict prototypes (Christian Göttsche)
* Do not drop const qualifier for Basename (Christian Göttsche)
* Constify various pointers (Christian Göttsche)
* Don't return uninitialized memory (Christian Göttsche)
* Don't let compiler optimize away memory cleaning (Christian Göttsche)
* Remove many obsolete compatibility checks and defines (Alejandro Colomar)
* Modify ID range check in useradd (Iker Pedrosa)
* Use "extern "C"" to make libsubid easier to use from C++ (Alois Wohlschlager)
* French translation updates (bubu)
* Fix s/with-pam/with-libpam/ (serge)
* Spanish translation updates (Fernando)
* French translation fixes (Balint Reczey)
* Default max group name length to 32 (Jami Kettunen)
* Fix PAM service files without-selinux (Ali Riza KESKIN)
* Improve manpages (Markus Hiereth)
- groupadd, useradd, usermod
- groups and id
- pwck
* Add fedora to CI builds (Iker Pedrosa)
* Fix condition under which pw_dir check happens (Ed Neville)
* logoutd: switch to strncat (Steve Grubb)
* AUTHORS: improve markdown output (Iker Pedrosa)
* Handle ERANGE errors correctly (Niko)
* Check for fopen NULL return (juyin)
* Split get_salt() into its own fn juyin)
* Get salt before chroot to ensure /dev/urandom. (juyin)
* Chpasswd code cleanup (juyin)
* Work around git safe.directory enforcement (serge)
* Alphabetize order in usermod help (Matheus Marques)
* Erase password copy on error branches (Christian Göttsche)
* Suggest using --badname if needed (Iker Pedrosa)
* Update translation files (Iker Pedrosa)
* Correct badnames option to badname (Iker Pedrosa)
* configure: replace obsolete autoconf macros (Christian Göttsche)
* tests: replace egrep with grep -E (Sam James)
* Update Ukrainian translations (Yuri Chornoivan)
* Cleanups (Iker Pedrosa)
- Remove redeclared variable
- Remove commented out code and FIXMEs
- Add header guards
- Initialize local variables
* CI updates (Iker Pedrosa)
- Create github workflow to install dependencies
- Enable CodeQL
- Update actions version
* libmisc: use /dev/urandom as fallback if other methods fail (Xi Ruoyao)
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Adolf Belka [Mon, 23 Jan 2023 09:06:38 +0000 (10:06 +0100)]
ragel: Update to version 7.0.4
- Update from version 7.0.0.11 to 7.0.4
- Update of rootfile
- Changelog
updated language flags, catch abortcompile throw in non-ragel progs
7.0.3
This version of colm includes a critical fix for big-endian system. Fixes #61.
expect colm version 0.14.6 and version bump ragel to 7.0.3
7.0.2
Latest colm includes bugfixes for refcounting, which fixes a ragel issue with includes #58.
expect colm 0.14.5 and version bump to 7.0.2
7.0.1
removed accidental commit of ragel/.exrc
7.0.0.12
implemented NfaClear in asm codegen
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Adolf Belka [Mon, 23 Jan 2023 09:06:34 +0000 (10:06 +0100)]
colm: Update to version 0.14.7
- Update from version 0.13.0.6 to 0.14.7
- Update of rootfile
- patch from colm commit fc61ecb required to fix bug of make looking for static and
dynamic libs even if one of them was disabled
- Changelog is not available in source tarball or on website etc. Changes have to be
reviewed by the commits https://github.com/adrian-thurston/colm/commits/0.14.7
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Adolf Belka [Sat, 21 Jan 2023 18:03:32 +0000 (19:03 +0100)]
python3-packaging: Update to version 23.0
- Update from version 21.3 to 23.0
- Update of rootfile
- Changelog
23.0
What's Changed
Remove unused LPAREN token from tokenizer by @hrnciar in #630
Reorganise the project layout and version management by @pradyunsg in #626
Correctly handle non-normalised specifiers in requirements by @pradyunsg in #634
Use stable Python 3.11 in tests by @153957 in #641
Fix typing for specifiers.BaseSpecifier.filter() by @henryiii in #643
Correctly handle trailing whitespace on URL requirements by @pradyunsg in #642
refactor _generic_api to use EXT_SUFFIX by @mattip in #607
Allow "extra" to be None in the marker environment by @pradyunsg in #650
Fix typos by @kianmeng in #648
Update changelog for release by @pradyunsg in #656
22.0
What's Changed
Fix compatible version specifier incorrectly strip trailing '0' by @kasium in #493
Remove support for Python 3.6 by @abravalheri in #500
Use concurrency limit in ci by @blink1073 in #510
Fix issue link in changelog. by @bdice in #509
chore: test with PyPy 3.8 & 3.9 by @mayeut in #512
Accept locally installed prereleases by @q0w in #515
Always run GHA workflows when they change by @mayeut in #516
Add __hash__/__eq__ to requirements by @abravalheri in #499
Upgrade to setup-python v3 and use caching for GHA by @brettcannon in #521
allow pre-release versions in marker evaluation by @graingert in #523
Error out from workflow on missing interpreter by @mayeut in #525
chore: update pre-commit config to the latest repos' versions by @mayeut in #534
chore: remove Windows PyPy 3.9 workaround on GHA by @mayeut in #533
Use pipx to run nox / build in GHA workflows by @mayeut in #517
Run tests with all PyPy versions locally by @mayeut in #535
Adhere to PEP 685 when evaluating markers with extras by @hroncok in #545
chore: update mypy and move to toml by @henryiii in #547
Normalize extra comparison in markers for output by @brettcannon in #549
Evaluate markers under environment with empty "extra" by @MrMino in #550
Do not set extra in default_environment() by @sbidoul in #554
Update extlinks strings to use a format string by @mayeut in #555
Update CI test workflow to use setup-python@v4 by @mayeut in #556
CI: Update actions/* to their latest major versions by @mayeut in #557
Fix a spelling mistake by @venthur in #558
fix: macOS platform tags with old macOS SDK by @mayeut in #513
Correctly parse ELF for musllinux on Big Endian by @uranusjr in #538
A metadata module with a data class for core metadata by @brettcannon in #518
Document utils.NormalizedName by @brettcannon in #565
Drop LegacySpecifier and LegacyVersion by @pradyunsg in #407
Move metadata, versions and specifiers API documentation to sphinx.ext.autodoc by @pradyunsg in #572
Demonstrate behaviour of SpecifierSet.__iter__ by @hauntsaninja in #575
Handwritten parser for parsing requirements by @hrnciar in #484
Add changelog entry for removal of pyparsing dependency by @hroncok in #581
Use Iterator instead of Iterable for specifier filter methods by @ichard26 in #584
Better output on linter failure by @henryiii in #478
Add a "cpNNN-none-any" tag by @joonis in #541
Document exceptions raised by functions in utils by @MrMino in #544
Refactor ELF parsing logic to standlone class by @uranusjr in #553
Forbid prefix version matching on pre-release/post-release segments by @mayeut in #563
Update coverage to >=5.0.0 by @mayeut in #586
Normalize specifier version for prefix matching by @mayeut in #561
Add python 3.11 by @mayeut in #587
Fix prefix version matching by @mayeut in #564
Remove duplicate namedtuple by @layday in #589
Update changelog by @pradyunsg in #595
Change email-related fields in Metadata to str by @brettcannon in #596
Add versionchanged for 21.3 by @brettcannon in #599
refactor: use flit as a backend by @henryiii in #546
Remove packaging.metadata by @pradyunsg in #603
Refactor nox requirements to use requirements files (#601) by @strokirk in #609
Improve Requirement/Marker parser with context-sensitive tokenisation by @pradyunsg in #624
Tested-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
projects / people / pmueller / ipfire-2.x.git / log
