From e5985b8e66b3b43c34328efb47b9b12e8ce5a690 Mon Sep 17 00:00:00 2001 From: V3n3RiX Date: Fri, 28 Oct 2022 03:58:39 +0100 Subject: gentoo auto-resync : 28:10:2022 - 03:58:39 --- app-arch/Manifest.gz | Bin 16910 -> 16907 bytes app-arch/tarlz/Manifest | 4 +- app-arch/tarlz/tarlz-0.22.ebuild | 27 ----- app-arch/tarlz/tarlz-0.23.ebuild | 2 +- app-arch/xz-utils/Manifest | 6 +- .../xz-utils-5.2.5-xzgrep-ZDI-CAN-16587.patch | 88 --------------- app-arch/xz-utils/xz-utils-5.2.5-r2.ebuild | 118 --------------------- app-arch/xz-utils/xz-utils-9999.ebuild | 3 - 8 files changed, 3 insertions(+), 245 deletions(-) delete mode 100644 app-arch/tarlz/tarlz-0.22.ebuild delete mode 100644 app-arch/xz-utils/files/xz-utils-5.2.5-xzgrep-ZDI-CAN-16587.patch delete mode 100644 app-arch/xz-utils/xz-utils-5.2.5-r2.ebuild (limited to 'app-arch') diff --git a/app-arch/Manifest.gz b/app-arch/Manifest.gz index ba16469880fc..cde138b8f9ae 100644 Binary files a/app-arch/Manifest.gz and b/app-arch/Manifest.gz differ diff --git a/app-arch/tarlz/Manifest b/app-arch/tarlz/Manifest index b709cded7cbf..0fc49672d5d5 100644 --- a/app-arch/tarlz/Manifest +++ b/app-arch/tarlz/Manifest @@ -1,5 +1,3 @@ -DIST tarlz-0.22.tar.lz 105724 BLAKE2B 7921f7085d63f553f745cf8b7fee43ece32346a0804e41227806efae0ab338c48ee1830a8b087f03000a27fcf44338b3dba6d52d37f4de790d8b7bc5f0234ade SHA512 4e241ea0571e421c93fbeeb54a20e73fd4a7e9c85dc3b24295caec1a52e156cdcf5e85f4ee41f5dfae712b851d17fe0e96955380bb86306d8002f4187d0c60ec DIST tarlz-0.23.tar.lz 112276 BLAKE2B 87153b1e843ed74b5efd339d29e79ddef2bbd11ff951898383ae4c6c099f4e97ef58b8bd2f14ff5bff2cfd6baccb433ab55b9b9b78d0893caef5bd1f4d07a36e SHA512 623407142d03e0ddae3dbb057b8ef5f1aea850418dbb47c6278affa42c88bc1786cd3249d1e8c018643f41516787225cb2ed3aca2fc02ba8e65dfe4744f965d8 -EBUILD tarlz-0.22.ebuild 596 BLAKE2B ce0e0f5cf2fabde971a2980f5ebc5cb152e130501d0ea254e19a86c10bb08078bc6efab9f702eb35df1ba3ddbe036c3b589f37ecf16a46631b68635b9eb2967c SHA512 ca3e78d6d30428f9108ea9af965314525816c83647bd2938d49d0f141cc24a978c00f252731a7821edd714a8772c08eb6686e5e2813b7eed4edb9e35ae244d5a -EBUILD tarlz-0.23.ebuild 605 BLAKE2B 0f5ffef5a03986e0b04bbcceb79cb5dc97698d8c474f7342525bb6173a84ba79085d61bb23b3644a2d7931fe511aaa231c10d94eb83836997d9b951544298d5f SHA512 fc9e09435ec1e25dbcf4c3a9b7b4fe806c2cea94f49c23a5d4acf6c2deefe304d82b1a9a9ab5162a59815017c30dc0ab3a38c1228c8f535f515b65becf38ef83 +EBUILD tarlz-0.23.ebuild 604 BLAKE2B 2c85673c45730ff37832e0543231ada768b747d9df453538f120f07c6d2ff7e3b3130a2b2691eb0dd64d2f5f1d6d96a5921620a4b2650f80bdb2504aac554166 SHA512 40f93fc0f73b51916d0718913150b09441644313eacab6389fba414badcb82cbe9ab6b4475724d51272f6f0af61f09c684535beacff872eac33300f3cd0ee0fe MISC metadata.xml 355 BLAKE2B 395fec08847b666d16f1b38e094844c5821076bb58688ce21277c2a798a7ffc1f029cb6e92a6dcd92f71f35715f7a55638c6d34224055df275970b1c06acd6e0 SHA512 8a88a29f6ed88692e554ef13820e1ab95f1da4854d13832cc839b29b3e3278cc479412fc22e021b4de696d92cf726181b8434eb19d479d9be36b621a69040ff6 diff --git a/app-arch/tarlz/tarlz-0.22.ebuild b/app-arch/tarlz/tarlz-0.22.ebuild deleted file mode 100644 index 8c9cc43c7abc..000000000000 --- a/app-arch/tarlz/tarlz-0.22.ebuild +++ /dev/null @@ -1,27 +0,0 @@ -# Copyright 1999-2022 Gentoo Authors -# Distributed under the terms of the GNU General Public License v2 - -EAPI=8 - -inherit toolchain-funcs unpacker - -DESCRIPTION="A parallel archiver combining tar and lzip" -HOMEPAGE="https://www.nongnu.org/lzip/tarlz.html" -SRC_URI="https://download.savannah.gnu.org/releases/lzip/${PN}/${P}.tar.lz" -LICENSE="GPL-2+" - -SLOT="0" - -KEYWORDS="amd64" - -RDEPEND=">=app-arch/lzlib-1.12" -DEPEND="${RDEPEND}" -BDEPEND="$(unpacker_src_uri_depends)" - -src_configure() { - econf \ - CXX="$(tc-getCXX)" \ - CXXFLAGS="${CXXFLAGS}" \ - CPPFLAGS="${CPPFLAGS}" \ - LDFLAGS="${LDFLAGS}" -} diff --git a/app-arch/tarlz/tarlz-0.23.ebuild b/app-arch/tarlz/tarlz-0.23.ebuild index ac8108f138ea..173f51872685 100644 --- a/app-arch/tarlz/tarlz-0.23.ebuild +++ b/app-arch/tarlz/tarlz-0.23.ebuild @@ -11,7 +11,7 @@ SRC_URI="https://download.savannah.gnu.org/releases/lzip/${PN}/${P}.tar.lz" LICENSE="GPL-2+" SLOT="0" -KEYWORDS="~amd64" +KEYWORDS="amd64" RDEPEND=" >=app-arch/lzlib-1.12 diff --git a/app-arch/xz-utils/Manifest b/app-arch/xz-utils/Manifest index 976728752881..1307db7e5dfa 100644 --- a/app-arch/xz-utils/Manifest +++ b/app-arch/xz-utils/Manifest @@ -1,15 +1,11 @@ -AUX xz-utils-5.2.5-xzgrep-ZDI-CAN-16587.patch 3383 BLAKE2B c244f412f6d2bea84c5ef41b9f08d0f7be73cb9af1097e58169c9d9061b8eeff274903fbbc4b4639d06344bf9691f0d289671c4d07a4c5073efe9bc536e31a5a SHA512 97ba1bbe9fec7602d77e53961b94691d6551813ed9de5b6fde71f3724205848d2865c6085ace75b7df963d43b99c55c539547f028dd8d86da911aaa2b6a433cd -DIST xz-5.2.5.tar.gz 1791345 BLAKE2B aded57324e129572c41646b3cc3b0b59a459452d9338d9245663b63dac2a463fb1f1b2b1d2d4ad3c09cb71fb8439df52cd94f24db99e782fc899b94a288a3043 SHA512 7443674247deda2935220fbc4dfc7665e5bb5a260be8ad858c8bd7d7b9f0f868f04ea45e62eb17c0a5e6a2de7c7500ad2d201e2d668c48ca29bd9eea5a73a3ce -DIST xz-5.2.5.tar.gz.sig 566 BLAKE2B 8b40d8d7913eaebe2595ea41a735d972d1969d8b58f42b2bee6591b51e2e626473fc85d64f1bbbff3cba6b0e1b4423556d6ddaf16f646ccc18ba1bad5cf45d83 SHA512 3aa21484bef0282ed0b83e3fcd5cf3d87bf51fa68e24d55bb11f91bc96f0ac29f468949bc4c8cc20fbd6ad12f5735686fe09ee42efe2b8d728010da9668aa5a9 DIST xz-5.2.6.tar.gz 2069602 BLAKE2B 3cc160dc76944ad2a181fbfb23ce386dbbd04e75bbeb0b159aaaf82e2e8157ea8b2bb80b216d79a7c25339bfbd13bd9d8c261789829cc7c3cb86fc893a7b4b94 SHA512 090958dd6c202c989746686094c86707ad4ae835026640080fc0a9d0fad699821b7d5cb3a67e6700661a0938818ba153662366f89ab8ec47e0bae4a3fe9b1961 DIST xz-5.2.6.tar.gz.sig 566 BLAKE2B 7c6114d93b4e3c8553108da3985029fc4585bfea5d72fc5028024221e91cc43c3b6cd3b7d169e4c8afed445a6beef7c255ef8420c5266a22ee9449a57cacec5d SHA512 50a1ac0f8f87f8c04c25c69870ba054094abf20b668bdecd42ed247a2eff24b8e52178b6442da84c125a9401a6f98d40ca76b27453833a30807c83128ab70eee DIST xz-5.2.7.tar.gz 2105803 BLAKE2B 5363c5d0403e041c6d2e35b5d3321feeb8e63b8556496373c820975850b50e28e0da903446a49ba516fd9f40e0101dd39cfa9a9b8dd143c9849c84a715bb5d7b SHA512 06329fdbd1d897aa99dc96900c6246457288c586d02bb4869a92dd2f97973f95acb3a2fa9598a20613ea029f816836a8e3b65e36fec2b807b5e7553141429ab9 DIST xz-5.2.7.tar.gz.sig 566 BLAKE2B 00702dff24d655ebf30f2bf8bee94406e002164408b9eabb4f461a789482584c2b9c90675b8d1d5e030913e674946aa7392b73fcedf6ac62e3b1e3bc05bf92e6 SHA512 556e05107437fae2c75cc1a93465fce04426707e979403f41c6ee5b748fe7c3f985812a4e3b07785a84f68ef9d9f362ded470af1cceb9f4e8c80620a2699163f DIST xz-5.3.3alpha.tar.gz 2119150 BLAKE2B 031e1a1556cbbd49565c2b72676e46a22c00e0e25bca2938c21d56f2d7f585c294d2a3a5712a3ae5d62fe8fef6e7b2f411fcc3c0ccac4714786209599b599d25 SHA512 c780c6854cb7599ed97629dbf923f5c6802b48e12aa25638c863e2403e56557abffb2b501823d4d53c852b7d09360b9ede355989756fef1daa1fa8cd9395da8d DIST xz-5.3.3alpha.tar.gz.sig 566 BLAKE2B 2a02fd8a84c27967384021aa879efdf598b40ca9ff552080be2d057f402b3aace13bb0d98574e0185edd6ee3084793767f9941d4c1f21f5c5d55f886025cb845 SHA512 e6a849f2dd6f67ad3d51f50fe5f3e7f2a57e97e9d89499e2f88b94ab9716f1db5de34c3bb6f17b6fd55498ee5f4653d3d25e1a495b9c682b3200b2603a85479f -EBUILD xz-utils-5.2.5-r2.ebuild 2980 BLAKE2B a84114ae0f3f8c76822059aed6880073befa57f27f2384410316063094da31372dbe7ef3c0086ac53ba678566d32b12421a8fa7702ebc30d65b519ffbf3d5732 SHA512 eeba7fd7474a0a868d3579fb472172834c9ccf8c7fcf33e47b6130526dc17cd53251864c19beb06bb4fa94cb8fb79958225e79957d5ec1bcea1a9594125c992b EBUILD xz-utils-5.2.6.ebuild 2951 BLAKE2B fe70288d4b6b9582600339ef3800546aacb734665593cafa8ece0cc2781262906ad8dffaeabe5610e2769d7a006bc08763634822c6d9f978ac3463ddd460a1d8 SHA512 caddd665690b8acb03c3697566a9e977eed8a003e3f56bf25dc77ab74877994bfec86965334ce6683f582e07e4c6d53b6bab10f3322880b6d6342a92ad726f94 EBUILD xz-utils-5.2.7.ebuild 2855 BLAKE2B 2c19431300aaa009d555ed79110b8d72468514508c665743ccb90704b372a742397b07f6ca0500fc0c2941a0cbb93d8478dcae65adbc0b2ce25edaefd12baacd SHA512 e80b77aea4996a5671b7cf07e74923013a2e8a45fa9848409d6b8eb123cd713d4b40ab98cdf2757fb470f74d00e8067bc557af42568b358caf7d41336645938c EBUILD xz-utils-5.3.3_alpha.ebuild 2885 BLAKE2B 00cedd70d450943dd489e6b9e05ce1d7a0f5f4472b501f4587cf482c2294fcd7f86d5811a7325b6812f468738a0144838291033eb83afb79aaaba640b34800d1 SHA512 8172456c5fcfd424a4f2bf7e6993fc67b782dc8a7fc3c4c433610cae31252acb2a022cde8a128d5e20d5842ceee4a3b5eeeff9f8a4e9c0f667505d7397a37398 -EBUILD xz-utils-9999.ebuild 2855 BLAKE2B 2c19431300aaa009d555ed79110b8d72468514508c665743ccb90704b372a742397b07f6ca0500fc0c2941a0cbb93d8478dcae65adbc0b2ce25edaefd12baacd SHA512 e80b77aea4996a5671b7cf07e74923013a2e8a45fa9848409d6b8eb123cd713d4b40ab98cdf2757fb470f74d00e8067bc557af42568b358caf7d41336645938c +EBUILD xz-utils-9999.ebuild 2761 BLAKE2B 909cd4550713dd2eaae9f242ec5c45e5aedcaa78748569bfcaeac3c867638bfe2f0e8ecc0a7dbd0b1220f7a2860cfe1430545e272c0a97cbf9877ebc5190cc27 SHA512 88b9523cb3c31be766d78198716489fc9b26ac39897b20ded7c775c9c74969028a84241af1ee688149442ab9c333f1ec25f7d134a8182bfd4396c8f17995b3ad MISC metadata.xml 539 BLAKE2B 57809a0b57c640a42eca00c3cfbec8a549647b82afc6229b904c769b94b3ee109610d412af69cefe6b86c7cce9a7c363cf376bb87c19b5cee96b45bdd980cddc SHA512 5b86a0f7c76d5b33f32e5db91dafe675dc01399659c5304fafd77adf83b403c936019afadeed1f075834bbb31169d60c87c9d9e69783e7c7a720890f512172a7 diff --git a/app-arch/xz-utils/files/xz-utils-5.2.5-xzgrep-ZDI-CAN-16587.patch b/app-arch/xz-utils/files/xz-utils-5.2.5-xzgrep-ZDI-CAN-16587.patch deleted file mode 100644 index 7293a982c269..000000000000 --- a/app-arch/xz-utils/files/xz-utils-5.2.5-xzgrep-ZDI-CAN-16587.patch +++ /dev/null @@ -1,88 +0,0 @@ -https://bugs.gentoo.org/837155 -https://git.tukaani.org/?p=xz.git;a=commitdiff;h=69d1b3fc29677af8ade8dc15dba83f0589cb63d6;hp=bd93b776c1bd15e90661033c918cdeb354dbcc38 - -From: Lasse Collin -Date: Tue, 29 Mar 2022 19:19:12 +0300 -Subject: [PATCH 1/1] xzgrep: Fix escaping of malicious filenames - (ZDI-CAN-16587). - -Malicious filenames can make xzgrep to write to arbitrary files -or (with a GNU sed extension) lead to arbitrary code execution. - -xzgrep from XZ Utils versions up to and including 5.2.5 are -affected. 5.3.1alpha and 5.3.2alpha are affected as well. -This patch works for all of them. - -This bug was inherited from gzip's zgrep. gzip 1.12 includes -a fix for zgrep. - -The issue with the old sed script is that with multiple newlines, -the N-command will read the second line of input, then the -s-commands will be skipped because it's not the end of the -file yet, then a new sed cycle starts and the pattern space -is printed and emptied. So only the last line or two get escaped. - -One way to fix this would be to read all lines into the pattern -space first. However, the included fix is even simpler: All lines -except the last line get a backslash appended at the end. To ensure -that shell command substitution doesn't eat a possible trailing -newline, a colon is appended to the filename before escaping. -The colon is later used to separate the filename from the grep -output so it is fine to add it here instead of a few lines later. - -The old code also wasn't POSIX compliant as it used \n in the -replacement section of the s-command. Using \ is the -POSIX compatible method. - -LC_ALL=C was added to the two critical sed commands. POSIX sed -manual recommends it when using sed to manipulate pathnames -because in other locales invalid multibyte sequences might -cause issues with some sed implementations. In case of GNU sed, -these particular sed scripts wouldn't have such problems but some -other scripts could have, see: - - info '(sed)Locale Considerations' - -This vulnerability was discovered by: -cleemy desu wayo working with Trend Micro Zero Day Initiative - -Thanks to Jim Meyering and Paul Eggert discussing the different -ways to fix this and for coordinating the patch release schedule -with gzip. ---- a/src/scripts/xzgrep.in -+++ b/src/scripts/xzgrep.in -@@ -180,22 +180,26 @@ for i; do - { test $# -eq 1 || test $no_filename -eq 1; }; then - eval "$grep" - else -+ # Append a colon so that the last character will never be a newline -+ # which would otherwise get lost in shell command substitution. -+ i="$i:" -+ -+ # Escape & \ | and newlines only if such characters are present -+ # (speed optimization). - case $i in - (*' - '* | *'&'* | *'\'* | *'|'*) -- i=$(printf '%s\n' "$i" | -- sed ' -- $!N -- $s/[&\|]/\\&/g -- $s/\n/\\n/g -- ');; -+ i=$(printf '%s\n' "$i" | LC_ALL=C sed 's/[&\|]/\\&/g; $!s/$/\\/');; - esac -- sed_script="s|^|$i:|" -+ -+ # $i already ends with a colon so don't add it here. -+ sed_script="s|^|$i|" - - # Fail if grep or sed fails. - r=$( - exec 4>&1 -- (eval "$grep" 4>&-; echo $? >&4) 3>&- | sed "$sed_script" >&3 4>&- -+ (eval "$grep" 4>&-; echo $? >&4) 3>&- | -+ LC_ALL=C sed "$sed_script" >&3 4>&- - ) || r=2 - exit $r - fi >&3 5>&- diff --git a/app-arch/xz-utils/xz-utils-5.2.5-r2.ebuild b/app-arch/xz-utils/xz-utils-5.2.5-r2.ebuild deleted file mode 100644 index 752953853e1d..000000000000 --- a/app-arch/xz-utils/xz-utils-5.2.5-r2.ebuild +++ /dev/null @@ -1,118 +0,0 @@ -# Copyright 1999-2022 Gentoo Authors -# Distributed under the terms of the GNU General Public License v2 - -# Remember: we cannot leverage autotools in this ebuild in order -# to avoid circular deps with autotools - -EAPI=7 - -inherit libtool multilib multilib-minimal preserve-libs usr-ldscript - -if [[ ${PV} == 9999 ]] ; then - EGIT_REPO_URI="https://git.tukaani.org/xz.git" - inherit git-r3 autotools - - # bug #272880 and bug #286068 - BDEPEND="sys-devel/gettext >=sys-devel/libtool-2" -else - VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/lassecollin.asc - inherit verify-sig - - MY_P="${PN/-utils}-${PV/_}" - SRC_URI="https://tukaani.org/xz/${MY_P}.tar.gz" - SRC_URI+=" verify-sig? ( https://tukaani.org/xz/${MY_P}.tar.gz.sig )" - - if [[ ${PV} != *_alpha* ]] && [[ ${PV} != *_beta* ]] ; then - KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris" - fi - S="${WORKDIR}/${MY_P}" -fi - -DESCRIPTION="Utils for managing LZMA compressed files" -HOMEPAGE="https://tukaani.org/xz/" - -# See top-level COPYING file as it outlines the various pieces and their licenses. -LICENSE="public-domain LGPL-2.1+ GPL-2+" -SLOT="0" -IUSE="+extra-filters nls static-libs" - -RDEPEND="!