Development July 2022

development@lists.ipfire.org

14 participants
75 discussions

[PATCH] gptfdisk: Update to version 1.0.9
by Adolf Belka 09 Jul '22

09 Jul '22

- Update from version 1.0.8 to 1.0.9 - No rootfile required - Changelog 1.0.9 (4/14/2022): - Removed stray debugging code that caused "partNum is {x}" to be printed when changing a partition's name with sgdisk (-c/--change-name). - Added support for aligning partitions' end points, as well as their start points. This support affects the default partition size when using 'n' in gdisk; it affects the default partition size in cgdisk; and it's activated by the new '-I' option in sgdisk. See the programs' respective man pages for details. This feature is intended to help with LUKS2 encryption, which reacts badly to partitions that are not sized as exact multiples of the encryption block size. - Added check for too-small disks (most likely to be an issue when trying to use a too-small disk image); program now aborts if this happens. - Added the ability to build sgdisk and cgdisk for Windows. - Added new type codes: * FreeBSD nandfs (0xa506) * Apple APFS Pre-Boot (0xaf0b) * Apple APFS Recovery (0xaf0c) * ChromeOS firmware (0x7f03) * ChromeOS mini-OS (0x7f04) * ChromeOS hibernate (0x7f05) * U-Boot boot loader (0xb000) * 27 (!) codes for Fuchsia (0xf100 to 0xf11a) - Fixed build problems with recent versions of ncurses. - Fixed bug that caused cgdisk to report incorrect partition attributes. - Consolidated Makefiles for Linux, FreeBSD, Solaris, macOS, and Windows (32- and 64-bit). The old OS-specific Makefiles remain in case the new consolidated Makefile has problems, but the old ones are deprecated. (The Solaris support in the new Makefile is untested.) Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/gptfdisk | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/gptfdisk b/lfs/gptfdisk index 7ec1923b8..eb1c60357 100644 --- a/lfs/gptfdisk +++ b/lfs/gptfdisk @@ -25,7 +25,7 @@ include Config -VER = 1.0.8 +VER = 1.0.9 THISAPP = gptfdisk-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -33,7 +33,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = gptfdisk -PAK_VER = 1 +PAK_VER = 2 DEPS = @@ -45,7 +45,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 03c74c43fead13e90ff6cd42405e15db726f527801a9e3f1d5f6a83d3fa58f0f8e58b35edc1b12b0b2e6c7849b657ce4493ac67204d25309e6f63fe7f57f766b +$(DL_FILE)_BLAKE2 = 1939ffd75972a4d7f92af2bfab90c7b0223825b5478b6b808dd35af943c687d38ba81663cd7ba5e0f9400656db4dac019c13a9f75d90b7bd716568c676c24dd2 install : $(TARGET) -- 2.37.0

2 1

[PATCH] gnutls: Update to version 3.7.6
by Adolf Belka 09 Jul '22

09 Jul '22

- Update from version 3.6.16 to 3.7.6 - Update of rootfile - find-dependencies run on sobump libs. No dependencies flagged for the old or new libs - Changelog * Version 3.7.6 (released 2022-05-27) ** libgnutls: Fixed invalid write when gnutls_realloc_zero() is called with new_size < old_size. This bug caused heap corruption when gnutls_realloc_zero() has been set as gmp reallocfunc (!1592, #1367, #1368, #1369). ** API and ABI modifications: No changes since last version. * Version 3.7.5 (released 2022-05-15) ** libgnutls: The GNUTLS_NO_TICKETS_TLS12 flag and %NO_TICKETS_TLS12 priority modifier have been added to disable session ticket usage in TLS 1.2 because it does not provide forward secrecy (#477). On the other hand, since session tickets in TLS 1.3 do provide forward secrecy, the PFS priority string now only disables session tickets in TLS 1.2. Future backward incompatibility: in the next major release of GnuTLS, we plan to remove those flag and modifier, and make GNUTLS_NO_TICKETS and %NO_TICKETS only affect TLS 1.2. ** gnutls-cli, gnutls-serv: Channel binding for printing information has been changed from tls-unique to tls-exporter as tls-unique is not supported in TLS 1.3. ** libgnutls: Certificate sanity checks has been enhanced to make gnutls more RFC 5280 compliant (!1583). Following changes were included: - critical extensions are parsed when loading x509 certificate to prohibit any random octet strings. Requires strict-x509 configure option to be enabled - garbage bits in Key Usage extension are prohibited - empty DirectoryStrings in Distinguished name structures of Issuer and Subject name are prohibited ** libgnutls: Removed 3DES from FIPS approved algorithms (#1353). According to the section 2 of SP800-131A Rev.2, 3DES algorithm will be disallowed for encryption after December 31, 2023: https://csrc.nist.gov/publications/detail/sp/800-131a/rev-2/final ** libgnutls: Optimized support for AES-SIV-CMAC algorithms (#1217, #1312). The existing AEAD API that works in a scatter-gather fashion (gnutls_aead_cipher_encryptv2) has been extended to support AES-SIV-CMAC. For further optimization, new function (gnutls_aead_cipher_set_key) has been added to set key on the existing AEAD handle without re-allocation. ** libgnutls: HKDF and AES-GCM algorithms are now approved in FIPS-140 mode when used in TLS (#1311). ** The configure arguments for Brotli and Zstandard (zstd) support have changed to reflect the previous help text: they are now --with-brotli/--with-zstd respectively (#1342). ** Detecting the Zstandard (zstd) library in configure has been fixed (#1343). ** API and ABI modifications: GNUTLS_NO_TICKETS_TLS12: New flag gnutls_aead_cipher_set_key: New function * Version 3.7.4 (released 2022-03-17) ** libgnutls: Added support for certificate compression as defined in RFC8879 (#1301). New API functions (gnutls_compress_certificate_get_selected_method and gnutls_compress_certificate_set_methods) allow client and server to set their preferences. ** certtool: Added option --compress-cert that allows user to specify compression methods for certificate compression. ** libgnutls: GnuTLS can now be compiled with --enable-strict-x509 configure option to enforce stricter certificate sanity checks that are compliant with RFC5280. ** libgnutls: Removed IA5String type from DirectoryString within issuer and subject name to make DirectoryString RFC5280 compliant. ** libgnutls: Added function (gnutls_record_send_file) to send file content from open file descriptor (!1486). The implementation is optimized if KTLS (kernel TLS) is enabled. ** libgnutls: Added function (gnutls_ciphersuite_get) to retrieve the name of current ciphersuite from TLS session (#1291). ** libgnutls: The run-time dependency on tpm2-tss is now re-implemented using dlopen, so GnuTLS does not indirectly link to other crypto libraries until TPM2 functionality is utilized (!1544). ** API and ABI modifications: GNUTLS_COMP_BROTLI: New gnutls_compression_method_t enum member GNUTLS_COMP_ZSTD: New gnutls_compression_method_t enum member gnutls_compress_certificate_get_selected_method: Added gnutls_compress_certificate_set_methods: Added gnutls_ciphersuite_get: New function gnutls_record_send_file: New function libgnutlsxx: Soname bumped due to ABI breakage introduced in 3.7.1 * Version 3.7.3 (released 2022-01-17) ** libgnutls: The allowlisting configuration mode has been added to the system-wide settings. In this mode, all the algorithms are initially marked as insecure or disabled, while the applications can re-enable them either through the [overrides] section of the configuration file or the new API (#1172). ** The build infrastructure no longer depends on GNU AutoGen for generating command-line option handling, template file parsing in certtool, and documentation generation (#773, #774). This change also removes run-time or bundled dependency on the libopts library, and requires Python 3.6 or later to regenerate the distribution tarball. Note that this brings in known backward incompatibility in command-line tools, such as long options are now case sensitive, while previously they were treated in a case insensitive manner: for example --RSA is no longer a valid option of certtool. The existing scripts using GnuTLS tools may need adjustment for this change. ** libgnutls: The tpm2-tss-engine compatible private blobs can be loaded and used as a gnutls_privkey_t (#594). The code was originally written for the OpenConnect VPN project by David Woodhouse. To generate such blobs, use the tpm2tss-genkey tool from tpm2-tss-engine: https://github.com/tpm2-software/tpm2-tss-engine/#rsa-operations or the tpm2_encodeobject tool from unreleased tpm2-tools. ** libgnutls: The library now transparently enables Linux KTLS (kernel TLS) when the feature is compiled in with --enable-ktls configuration option (#1113). If the KTLS initialization fails it automatically falls back to the user space implementation. ** certtool: The certtool command can now read the Certificate Transparency (RFC 6962) SCT extension (#232). New API functions are also provided to access and manipulate the extension values. ** certtool: The certtool command can now generate, manipulate, and evaluate x25519 and x448 public keys, private keys, and certificates. ** libgnutls: Disabling a hashing algorithm through "insecure-hash" configuration directive now also disables TLS ciphersuites that use it as a PRF algorithm. ** libgnutls: PKCS#12 files are now created with modern algorithms by default (!1499). Previously certtool used PKCS12-3DES-SHA1 for key derivation and HMAC-SHA1 as an integity measure in PKCS#12. Now it uses AES-128-CBC with PBKDF2 and SHA-256 for both key derivation and MAC algorithms, and the default PBKDF2 iteration count has been increased to 600000. ** libgnutls: PKCS#12 keys derived using GOST algorithm now uses HMAC_GOSTR3411_2012_512 instead of HMAC_GOSTR3411_2012_256 for integrity, to conform with the latest TC-26 requirements (#1225). ** libgnutls: The library now provides a means to report the status of approved cryptographic operations (!1465). To adhere to the FIPS140-3 IG 2.4.C., this complements the existing mechanism to prohibit the use of unapproved algorithms by making the library unusable state. ** gnutls-cli: The gnutls-cli command now provides a --list-config option to print the library configuration (!1508). ** libgnutls: Fixed possible race condition in gnutls_x509_trust_list_verify_crt2 when a single trust list object is shared among multiple threads (#1277). [GNUTLS-SA-2022-01-17, CVSS: low] ** API and ABI modifications: GNUTLS_PRIVKEY_FLAG_RSA_PSS_FIXED_SALT_LENGTH: new flag in gnutls_privkey_flags_t GNUTLS_VERIFY_RSA_PSS_FIXED_SALT_LENGTH: new flag in gnutls_certificate_verify_flags gnutls_ecc_curve_set_enabled: Added. gnutls_sign_set_secure: Added. gnutls_sign_set_secure_for_certs: Added. gnutls_digest_set_secure: Added. gnutls_protocol_set_enabled: Added. gnutls_fips140_context_init: New function gnutls_fips140_context_deinit: New function gnutls_fips140_push_context: New function gnutls_fips140_pop_context: New function gnutls_fips140_get_operation_state: New function gnutls_fips140_operation_state_t: New enum gnutls_transport_is_ktls_enabled: New function gnutls_get_library_configuration: New function * Version 3.7.2 (released 2021-05-29) ** libgnutls: The priority string option %DISABLE_TLS13_COMPAT_MODE was added to disable TLS 1.3 middlebox compatibility mode ** libgnutls: The Linux kernel AF_ALG based acceleration has been added. This can be enabled with --enable-afalg configure option, when libkcapi package is installed (#308). ** libgnutls: Fixed timing of early data exchange. Previously, the client was sending early data after receiving Server Hello, which not only negates the benefit of 0-RTT, but also works under certain assumptions hold (e.g., the same ciphersuite is selected in initial and resumption handshake) (#1146). ** certtool: When signing a CSR, CRL distribution point (CDP) is no longer copied from the signing CA by default (#1126). ** libgnutls: The GNUTLS_NO_EXPLICIT_INIT envvar has been renamed to GNUTLS_NO_IMPLICIT_INIT to reflect the purpose (#1178). The former is now deprecated and will be removed in the future releases. ** certtool: When producing certificates and certificate requests, subject DN components that are provided individually will now be ordered by assumed scale (e.g. Country before State, Organization before OrganizationalUnit). This change also affects the order in which certtool prompts interactively. Please rely on the template mechanism for automated use of certtool! (#1243) ** API and ABI modifications: gnutls_early_cipher_get: Added gnutls_early_prf_hash_get: Added ** guile: Writes to a session record port no longer throw an exception upon GNUTLS_E_AGAIN or GNUTLS_E_INTERRUPTED. * Version 3.7.1 (released 2021-03-10) ** libgnutls: Fixed potential use-after-free in sending "key_share" and "pre_shared_key" extensions. When sending those extensions, the client may dereference a pointer no longer valid after realloc. This happens only when the client sends a large Client Hello message, e.g., when HRR is sent in a resumed session previously negotiated large FFDHE parameters, because the initial allocation of the buffer is large enough without having to call realloc (#1151). [GNUTLS-SA-2021-03-10, CVSS: low] ** libgnutls: Fixed a regression in handling duplicated certs in a chain (#1131). ** libgnutls: Fixed sending of session ID in TLS 1.3 middlebox compatibiltiy mode. In that mode the client shall always send a non-zero session ID to make the handshake resemble the TLS 1.2 resumption; this was not true in the previous versions (#1074). ** libgnutls: W32 performance improvement with a new sendmsg()-like transport implementation (!1377). ** libgnutls: Removed dependency on the external 'fipscheck' package, when compiled with --enable-fips140-mode (#1101). ** libgnutls: Added padlock acceleration for AES-192-CBC (#1004). ** API and ABI modifications: No changes since last version. * Version 3.7.0 (released 2020-12-02) ** libgnutls: Depend on nettle 3.6 (!1322). ** libgnutls: Added a new API that provides a callback function to retrieve missing certificates from incomplete certificate chains (#202, #968, #1100). ** libgnutls: Added a new API that provides a callback function to output the complete path to the trusted root during certificate chain verification (#1012). ** libgnutls: OIDs exposed as gnutls_datum_t no longer account for the terminating null bytes, while the data field is null terminated. The affected API functions are: gnutls_ocsp_req_get_extension, gnutls_ocsp_resp_get_response, and gnutls_ocsp_resp_get_extension (#805). ** libgnutls: Added a new set of API to enable QUIC implementation (#826, #849, #850). ** libgnutls: The crypto implementation override APIs deprecated in 3.6.9 are now no-op (#790). ** libgnutls: Added MAGMA/KUZNYECHIK CTR-ACPKM and CMAC support (!1161). ** libgnutls: Support for padlock has been fixed to make it work with Zhaoxin CPU (#1079). ** libgnutls: The maximum PIN length for PKCS #11 has been increased from 31 bytes to 255 bytes (#932). ** API and ABI modifications: gnutls_x509_trust_list_set_getissuer_function: Added gnutls_x509_trust_list_get_ptr: Added gnutls_x509_trust_list_set_ptr: Added gnutls_session_set_verify_output_function: Added gnutls_record_encryption_level_t: New enum gnutls_handshake_read_func: New callback type gnutls_handshake_set_read_function: New function gnutls_handshake_write: New function gnutls_handshake_secret_func: New callback type gnutls_handshake_set_secret_function: New function gnutls_alert_read_func: New callback type gnutls_alert_set_read_function: New function gnutls_crypto_register_cipher: Deprecated; no-op gnutls_crypto_register_aead_cipher: Deprecated; no-op gnutls_crypto_register_mac: Deprecated; no-op gnutls_crypto_register_digest: Deprecated; no-op Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/gnutls | 42 +++++++++++++++++++++++++++++++--- lfs/gnutls | 4 ++-- 2 files changed, 41 insertions(+), 5 deletions(-) diff --git a/config/rootfiles/common/gnutls b/config/rootfiles/common/gnutls index e59c1a84f..25173efd3 100644 --- a/config/rootfiles/common/gnutls +++ b/config/rootfiles/common/gnutls @@ -33,15 +33,16 @@ usr/lib/libgnutls-dane.so.0.4.1 #usr/lib/libgnutls.la #usr/lib/libgnutls.so usr/lib/libgnutls.so.30 -usr/lib/libgnutls.so.30.28.2 +usr/lib/libgnutls.so.30.33.1 #usr/lib/libgnutlsxx.la #usr/lib/libgnutlsxx.so -usr/lib/libgnutlsxx.so.28 -usr/lib/libgnutlsxx.so.28.1.0 +usr/lib/libgnutlsxx.so.30 +usr/lib/libgnutlsxx.so.30.0.0 #usr/lib/pkgconfig/gnutls-dane.pc #usr/lib/pkgconfig/gnutls.pc #usr/share/doc/gnutls #usr/share/doc/gnutls/gnutls-client-server-use-case.png +#usr/share/doc/gnutls/gnutls-crypto-layers.png #usr/share/doc/gnutls/gnutls-handshake-sequence.png #usr/share/doc/gnutls/gnutls-handshake-state.png #usr/share/doc/gnutls/gnutls-internals.png @@ -51,6 +52,7 @@ usr/lib/libgnutlsxx.so.28.1.0 #usr/share/doc/gnutls/gnutls-x509.png #usr/share/doc/gnutls/pkcs11-vision.png #usr/share/info/gnutls-client-server-use-case.png +#usr/share/info/gnutls-crypto-layers.png #usr/share/info/gnutls-guile.info #usr/share/info/gnutls-handshake-sequence.png #usr/share/info/gnutls-handshake-state.png @@ -119,11 +121,13 @@ usr/lib/libgnutlsxx.so.28.1.0 #usr/share/man/man3/gnutls_aead_cipher_encryptv.3 #usr/share/man/man3/gnutls_aead_cipher_encryptv2.3 #usr/share/man/man3/gnutls_aead_cipher_init.3 +#usr/share/man/man3/gnutls_aead_cipher_set_key.3 #usr/share/man/man3/gnutls_alert_get.3 #usr/share/man/man3/gnutls_alert_get_name.3 #usr/share/man/man3/gnutls_alert_get_strname.3 #usr/share/man/man3/gnutls_alert_send.3 #usr/share/man/man3/gnutls_alert_send_appropriate.3 +#usr/share/man/man3/gnutls_alert_set_read_function.3 #usr/share/man/man3/gnutls_alpn_get_selected_protocol.3 #usr/share/man/man3/gnutls_alpn_set_protocols.3 #usr/share/man/man3/gnutls_anon_allocate_client_credentials.3 @@ -234,6 +238,9 @@ usr/lib/libgnutlsxx.so.28.1.0 #usr/share/man/man3/gnutls_cipher_suite_get_name.3 #usr/share/man/man3/gnutls_cipher_suite_info.3 #usr/share/man/man3/gnutls_cipher_tag.3 +#usr/share/man/man3/gnutls_ciphersuite_get.3 +#usr/share/man/man3/gnutls_compress_certificate_get_selected_method.3 +#usr/share/man/man3/gnutls_compress_certificate_set_methods.3 #usr/share/man/man3/gnutls_compression_get.3 #usr/share/man/man3/gnutls_compression_get_id.3 #usr/share/man/man3/gnutls_compression_get_name.3 @@ -282,6 +289,7 @@ usr/lib/libgnutlsxx.so.28.1.0 #usr/share/man/man3/gnutls_digest_get_name.3 #usr/share/man/man3/gnutls_digest_get_oid.3 #usr/share/man/man3/gnutls_digest_list.3 +#usr/share/man/man3/gnutls_digest_set_secure.3 #usr/share/man/man3/gnutls_dtls_cookie_send.3 #usr/share/man/man3/gnutls_dtls_cookie_verify.3 #usr/share/man/man3/gnutls_dtls_get_data_mtu.3 @@ -291,6 +299,8 @@ usr/lib/libgnutlsxx.so.28.1.0 #usr/share/man/man3/gnutls_dtls_set_data_mtu.3 #usr/share/man/man3/gnutls_dtls_set_mtu.3 #usr/share/man/man3/gnutls_dtls_set_timeouts.3 +#usr/share/man/man3/gnutls_early_cipher_get.3 +#usr/share/man/man3/gnutls_early_prf_hash_get.3 #usr/share/man/man3/gnutls_ecc_curve_get.3 #usr/share/man/man3/gnutls_ecc_curve_get_id.3 #usr/share/man/man3/gnutls_ecc_curve_get_name.3 @@ -298,6 +308,7 @@ usr/lib/libgnutlsxx.so.28.1.0 #usr/share/man/man3/gnutls_ecc_curve_get_pk.3 #usr/share/man/man3/gnutls_ecc_curve_get_size.3 #usr/share/man/man3/gnutls_ecc_curve_list.3 +#usr/share/man/man3/gnutls_ecc_curve_set_enabled.3 #usr/share/man/man3/gnutls_encode_ber_digest_info.3 #usr/share/man/man3/gnutls_encode_gost_rs_value.3 #usr/share/man/man3/gnutls_encode_rs_value.3 @@ -312,8 +323,14 @@ usr/lib/libgnutlsxx.so.28.1.0 #usr/share/man/man3/gnutls_ext_register.3 #usr/share/man/man3/gnutls_ext_set_data.3 #usr/share/man/man3/gnutls_fingerprint.3 +#usr/share/man/man3/gnutls_fips140_context_deinit.3 +#usr/share/man/man3/gnutls_fips140_context_init.3 +#usr/share/man/man3/gnutls_fips140_get_operation_state.3 #usr/share/man/man3/gnutls_fips140_mode_enabled.3 +#usr/share/man/man3/gnutls_fips140_pop_context.3 +#usr/share/man/man3/gnutls_fips140_push_context.3 #usr/share/man/man3/gnutls_fips140_set_mode.3 +#usr/share/man/man3/gnutls_get_library_config.3 #usr/share/man/man3/gnutls_get_system_config_file.3 #usr/share/man/man3/gnutls_global_deinit.3 #usr/share/man/man3/gnutls_global_init.3 @@ -338,7 +355,10 @@ usr/lib/libgnutlsxx.so.28.1.0 #usr/share/man/man3/gnutls_handshake_set_post_client_hello_function.3 #usr/share/man/man3/gnutls_handshake_set_private_extensions.3 #usr/share/man/man3/gnutls_handshake_set_random.3 +#usr/share/man/man3/gnutls_handshake_set_read_function.3 +#usr/share/man/man3/gnutls_handshake_set_secret_function.3 #usr/share/man/man3/gnutls_handshake_set_timeout.3 +#usr/share/man/man3/gnutls_handshake_write.3 #usr/share/man/man3/gnutls_hash.3 #usr/share/man/man3/gnutls_hash_copy.3 #usr/share/man/man3/gnutls_hash_deinit.3 @@ -655,6 +675,7 @@ usr/lib/libgnutlsxx.so.28.1.0 #usr/share/man/man3/gnutls_protocol_get_name.3 #usr/share/man/man3/gnutls_protocol_get_version.3 #usr/share/man/man3/gnutls_protocol_list.3 +#usr/share/man/man3/gnutls_protocol_set_enabled.3 #usr/share/man/man3/gnutls_psk_allocate_client_credentials.3 #usr/share/man/man3/gnutls_psk_allocate_server_credentials.3 #usr/share/man/man3/gnutls_psk_client_get_hint.3 @@ -738,6 +759,7 @@ usr/lib/libgnutlsxx.so.28.1.0 #usr/share/man/man3/gnutls_record_send.3 #usr/share/man/man3/gnutls_record_send2.3 #usr/share/man/man3/gnutls_record_send_early_data.3 +#usr/share/man/man3/gnutls_record_send_file.3 #usr/share/man/man3/gnutls_record_send_range.3 #usr/share/man/man3/gnutls_record_set_max_early_data_size.3 #usr/share/man/man3/gnutls_record_set_max_recv_size.3 @@ -783,6 +805,7 @@ usr/lib/libgnutlsxx.so.28.1.0 #usr/share/man/man3/gnutls_session_set_verify_cert.3 #usr/share/man/man3/gnutls_session_set_verify_cert2.3 #usr/share/man/man3/gnutls_session_set_verify_function.3 +#usr/share/man/man3/gnutls_session_set_verify_output_function.3 #usr/share/man/man3/gnutls_session_supplemental_register.3 #usr/share/man/man3/gnutls_session_ticket_enable_client.3 #usr/share/man/man3/gnutls_session_ticket_enable_server.3 @@ -801,6 +824,8 @@ usr/lib/libgnutlsxx.so.28.1.0 #usr/share/man/man3/gnutls_sign_is_secure.3 #usr/share/man/man3/gnutls_sign_is_secure2.3 #usr/share/man/man3/gnutls_sign_list.3 +#usr/share/man/man3/gnutls_sign_set_secure.3 +#usr/share/man/man3/gnutls_sign_set_secure_for_certs.3 #usr/share/man/man3/gnutls_sign_supports_pk_algorithm.3 #usr/share/man/man3/gnutls_srp_allocate_client_credentials.3 #usr/share/man/man3/gnutls_srp_allocate_server_credentials.3 @@ -857,6 +882,7 @@ usr/lib/libgnutlsxx.so.28.1.0 #usr/share/man/man3/gnutls_transport_get_int2.3 #usr/share/man/man3/gnutls_transport_get_ptr.3 #usr/share/man/man3/gnutls_transport_get_ptr2.3 +#usr/share/man/man3/gnutls_transport_is_ktls_enabled.3 #usr/share/man/man3/gnutls_transport_set_errno.3 #usr/share/man/man3/gnutls_transport_set_errno_function.3 #usr/share/man/man3/gnutls_transport_set_fastopen.3 @@ -1113,6 +1139,8 @@ usr/lib/libgnutlsxx.so.28.1.0 #usr/share/man/man3/gnutls_x509_crt_sign2.3 #usr/share/man/man3/gnutls_x509_crt_verify.3 #usr/share/man/man3/gnutls_x509_crt_verify_data2.3 +#usr/share/man/man3/gnutls_x509_ct_sct_get.3 +#usr/share/man/man3/gnutls_x509_ct_sct_get_version.3 #usr/share/man/man3/gnutls_x509_dn_deinit.3 #usr/share/man/man3/gnutls_x509_dn_export.3 #usr/share/man/man3/gnutls_x509_dn_export2.3 @@ -1124,6 +1152,10 @@ usr/lib/libgnutlsxx.so.28.1.0 #usr/share/man/man3/gnutls_x509_dn_oid_known.3 #usr/share/man/man3/gnutls_x509_dn_oid_name.3 #usr/share/man/man3/gnutls_x509_dn_set_str.3 +#usr/share/man/man3/gnutls_x509_ext_ct_export_scts.3 +#usr/share/man/man3/gnutls_x509_ext_ct_import_scts.3 +#usr/share/man/man3/gnutls_x509_ext_ct_scts_deinit.3 +#usr/share/man/man3/gnutls_x509_ext_ct_scts_init.3 #usr/share/man/man3/gnutls_x509_ext_deinit.3 #usr/share/man/man3/gnutls_x509_ext_export_aia.3 #usr/share/man/man3/gnutls_x509_ext_export_authority_key_id.3 @@ -1233,12 +1265,16 @@ usr/lib/libgnutlsxx.so.28.1.0 #usr/share/man/man3/gnutls_x509_trust_list_get_issuer.3 #usr/share/man/man3/gnutls_x509_trust_list_get_issuer_by_dn.3 #usr/share/man/man3/gnutls_x509_trust_list_get_issuer_by_subject_key_id.3 +#usr/share/man/man3/gnutls_x509_trust_list_get_ptr.3 #usr/share/man/man3/gnutls_x509_trust_list_init.3 #usr/share/man/man3/gnutls_x509_trust_list_iter_deinit.3 #usr/share/man/man3/gnutls_x509_trust_list_iter_get_ca.3 #usr/share/man/man3/gnutls_x509_trust_list_remove_cas.3 #usr/share/man/man3/gnutls_x509_trust_list_remove_trust_file.3 #usr/share/man/man3/gnutls_x509_trust_list_remove_trust_mem.3 +#usr/share/man/man3/gnutls_x509_trust_list_set_getissuer_function.3 +#usr/share/man/man3/gnutls_x509_trust_list_set_ptr.3 #usr/share/man/man3/gnutls_x509_trust_list_verify_crt.3 #usr/share/man/man3/gnutls_x509_trust_list_verify_crt2.3 #usr/share/man/man3/gnutls_x509_trust_list_verify_named_crt.3 + diff --git a/lfs/gnutls b/lfs/gnutls index 169c8ce85..9c418890a 100644 --- a/lfs/gnutls +++ b/lfs/gnutls @@ -24,7 +24,7 @@ include Config -VER = 3.6.16 +VER = 3.7.6 THISAPP = gnutls-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 2c40e199e4e107a81d22b84305cf27b3ca2a2b5d505a3fbd398dcfaec0ae30c71cae8a8b290523d3ad8636b2fb6b9da2a496315c20555265c681225b9b6bf6a4 +$(DL_FILE)_BLAKE2 = 9f3cce8dfc0b88f2c42d1d2633417dac649a265407b620b6d15967e5210debb99d287ef31d2b9dc37a527ac1e5b9db4c240b98a63293078fbd2e26ac694bf3d3 install : $(TARGET) -- 2.37.0

2 1

Fwd: Merge request for ipblocklist
by Charles Brown 08 Jul '22

08 Jul '22

Hello Stefan, For those of us running your test version from "https://people.ipfire.org/~stevee/ipblocklist", is there any cleanup that needs to be done when transitioning from your test version to the new Core Update 170 baseline version? -Charles > On 7 Jul 2022, at 17:42, Stefan Schantl<stefan.schantl(a)ipfire.org> wrote: > > Hello Peter, hello list followers, > > this is a merge request for the ipblocklist feature to get part of core > update 170. > > The development for the main parts has been done, the feature works > stable and several testing feedback for the testing releases is > available. > > I've rebased the branch against the current next and pushed it into my > personal git repository as "ipblocklist-final". > > Peter please have a look on it and if everything is okay, please merge > it so we finally can release it. > > Thanks in advance, > > -Stefan > >

1 0

[PATCH] openssl: Update to version 1.1.1q
by Adolf Belka 08 Jul '22

08 Jul '22

- Update from version 1.1.1p to 1.1.1q - Update of rootfile not required - Changelog Changes between 1.1.1p and 1.1.1q [5 Jul 2022] (CVE-2022-2097) Severity: Moderate AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation would not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/openssl | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/openssl b/lfs/openssl index 88f533323..28a92a6b3 100644 --- a/lfs/openssl +++ b/lfs/openssl @@ -24,7 +24,7 @@ include Config -VER = 1.1.1p +VER = 1.1.1q THISAPP = openssl-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -74,7 +74,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 4354753a5e52393c9cc4569954c2cac6d89a1e204fa4f9ca00a60492782d29f8952fb92664cdbb3576c6443d3cb2eacebea51db584738589f3598b40df579b12 +$(DL_FILE)_BLAKE2 = fc8fd6a62dc291d0bda328a051e253175fb04442cc4b8f45d67c3a5027748a0fc5fb372d0483bc9024ae0bff119c4fac8f1e982a182612427696d6d09f5935f5 install : $(TARGET) -- 2.37.0

2 1

[PATCH] Core Update 170: Harden mount options of /boot on existing installations
by Peter Müller 07 Jul '22

07 Jul '22

Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/rootfiles/core/170/update.sh | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/config/rootfiles/core/170/update.sh b/config/rootfiles/core/170/update.sh index 8edb5ff2e..c9744f5f5 100644 --- a/config/rootfiles/core/170/update.sh +++ b/config/rootfiles/core/170/update.sh @@ -49,8 +49,11 @@ ldconfig # Start services +# Harden mount options of /boot +sed -e -i "s/[[:space:]]*\/boot[[:space:]]*auto[[:space:]]*defaults[[:space:]]*/ \/boot auto defaults,nodev,noexec,nosuid /g" /etc/fstab + # This update needs a reboot... -#touch /var/run/need_reboot +touch /var/run/need_reboot # Finish /etc/init.d/fireinfo start -- 2.35.3

2 2

Call for small translation (for [PATCH 1/9] pakfire: Refactor dblist seperating UI and logic)
by Robin Roevens 07 Jul '22

07 Jul '22

Hi All For the changes in "[PATCH 1/9] pakfire: Refactor dblist seperating UI and logic", Michael pointed out that we should take advantage of the code change to translate a few extra strings: 'core update' => 'Core-Update', 'pak update' => 'Update', 'release' => 'Release', 'version' => 'Version', As used on pakfire.cgi listing the available updates: $Lang::tr{'core update'} -- $pakfire_status{'CoreVersion'} -- $Lang::tr{'release'}: $pakfire_status{'Release'} -> $pakfire_status{'AvailableRelease'} For example: Core-Update -- 2.27-x86-64 -- Release: 163 -> 164 and $Lang::tr{'pak update'}: $pak -- $Lang::tr{'version'}: $upgradelist{$pak}{'ProgVersion'} -> $upgradelist{$pak}{'AvailableProgVersion'} -- $Lang::tr{'release'}: $upgradelist{$pak}{'Release'} -> $upgradelist{$pak}{'AvailableRelease'} For example: Update: zabbix-agentd -- Version: 4.2.6 -> 5.0.21 -- Release: 4 -> 5 Could anyone on this list capable of translating these 4 strings in any other language please reply with translations, so that I can immediately integrate them in the patch. I already have translations for Dutch. Many thanks Robin -- Dit bericht is gescanned op virussen en andere gevaarlijke inhoud door MailScanner en lijkt schoon te zijn.

5 12

[PATCH v5 0/6] zabbix_agentd: Update to v6.0.6 (LTS)
by Robin Roevens 06 Jul '22

06 Jul '22

Hi all A renewal of this patchset, now for zabbix_agentd 6.0.6, the latest LTS version at the moment. Except for the version nothing has changed in this set since my previous submission. So please see https://lists.ipfire.org/pipermail/development/2022-March/012624.html for the summary of this patch set. Hopefully this can be included in Core 170?.. Regards Robin Roevens -- Dit bericht is gescanned op virussen en andere gevaarlijke inhoud door MailScanner en lijkt schoon te zijn.

3 10

[PATCH] lsof: Update to version 4.95.0
by Adolf Belka 06 Jul '22

06 Jul '22

- Update from version 4.91 to 4.95.0 - version 4.91 was the last version provided bia purdue.edu after which they stopped maintaining it. It is now taken over ny the lsof-org team at Github. https://github.com/lsof-org/lsof - Update of rootfile not required - only one line in the rootfile - Changelog lsof-4.95.0-linux [n+obsd] fix syntax error Corrected end of comment. This change closes #138. @albert-github reported this issue in #138, and provided the fix in #140 Don't ignore failures in test/Makefile Tobias Geerinckx-Rice <me(a)tobias.gr> provides the fix. Update perl scripts for the past few decades of progress Generally, perl is available on base systems - people who are manually installing perl into /usr/local/bin are the exception rather than the rule. In addition, Perl 5 was release in 1994, so Perl 4 isn't relevant any more. We've also standardized on the .pl extension, rather than .perl5 or whatever. Provided by @dilinger (Andres Salomon) in #149. A commit in the pull request includes work of Nicholas Bamber. Drop LSOF_CCDATE across all dialects to ensure reproducible builds Simplify things for reproducible builds by just getting rid of the embedded date/time string. With LSOF_CCDATE gone, keeping SOURCE_DATE_EPOCH around doesn't make much sense, so drop that as well. Folks doing reproducible builds should still override the LSOF_HOST, LSOF_LOGNAME, LSOF_SYSINFO, and LSOF_USER variables (as they were previously doing before SOURCE_DATE_EPOCH). Provided by @dilinger (Andres Salomon) in #150. [FreeBSD] get the ISO9660 filesystem working again The ISO9660 filesystem broke starting with FreeBSD 7 due to the header location changing. Fix the header search path to get it to be detected again. Fix the header inclusion order. Also add the new way of finding dev_t on more recent FreeBSD versions. Provided by Damjan Jovanovic in #151. [FreeBSD] add support for msdosfs on FreeBSD Provided by Damjan Jovanovic in #151. Fix FD field description. In 811dc78 the output format was changed to not printf the `f` field by default, however the field description in `lsof_fields.h`, as seen in `-F?` output still included the `(always selected)` text. Provided by @algorythmic (Grisha Levit) in #158. Adjust alignment of buffer passed to stat(). The original code passes char[] buffer to stat(). This can be cause a SIGBUS. #160 reported an actual crash on armv7a + glibc-2.33 platform. See also https://sourceware.org/bugzilla/show_bug.cgi?id=27993. Reported by @10ne1 in #160. Clean up source code and documentats. - remove trailing whitespace, - fix some issues in scripts found through shellcheck, and - fix spelling Provided by @a1346054 in #163. man page: fix hyphen issues Properly use '-' and '\-' in the man page, ensuring that users can cut & paste commandline options without issue. Original patch from Raoul Gunnar Borenius <borenius(a)dfn.de>, and submitted/expanded by @dilinger (Andres Salomon) in #168. [FreeBSD] update for FreeBSD 13 & 14, and various internal changes submitted by @DmitryAndric & @emaste. [FreeBSD] remove various old FreeBSD versions from support submitted by @emaste [FreeBSD] configure: suggest variable to set if FreeBSD sys not found submitted by @emaste Fix broken LSOF_CFLAGS_OVERRIDE. Provided by Fabrice Fontaine in #172. [linux] Remove sysvlegacy function. Provided by Fabrice Fontaine in #195. [linux] use close_range instead of calling close repeatedly At the starting up, lsof closes its file descriptors greater than 2 by calling close(2) repeatedly. As reported in #186, it can take long time. Linux 5.9 introduced close_range(2). The new system call can close multiple file descriptors faster. @qianzhangyl reported the original issue (#186). Add -Q option for adjusting exit status when failed to find a search item (#129) In the original code, lsof returned 1 when it failed to find a search item. With the new option, lsof returns 0 in the case. Document -Q option in manpage/00QUICKSTART, and adjust -h output by @dilinger (Andres Salomon) in #129. Improve readability of complex adverbial clause by adding a comma. Provided by Danny Fowler in #156. lsof-4.94.0-linux (All changes in this version are ported from lsof-org/lsof-linux repository at GitHub). Introduced a new test harness. The harness can run test cases specific to a dialect. It is designed for running test cases on CI environment like Travis-CI. However, it is runnable locally with following command line: $ ./check.sh DIALECT after making lsof executable. [linux] Fixed a bug +|-E options output for pipe. If two processes use the same fd number for a pipe connecting them, the option didn't print the information about it. [linux] Fixed a bug +|-E options output for PTY. If two processes use the same fd number for a PTY connecting them, the option didn't print the information about it. [linux] Fixed a bug +|-E options output for PTY. The code for detecting a slave device was incorrect. [linux] Fixed a potential bug +|-E options output for PTY. A structure field for the feature was not initialized. [linux] Added a code for decoding O_PATH flag in +fg option. [linux] Added a code for decoding O_CLOEXEC flag as CX in +fg option. [linux] Added a code for decoding O_TMPFILE flag as TMPF in +fg option. [linux] Added Linux display of INET socket endpoint information with +|-E option. The option handles INET sockets using IPC. [linux] Added support for POSIX MQ of Linux implementation. A POSIX message queue (MQ) is represented in a fd on Linux. lsof reported it as a regular file. lsof with this change reports it as a file with PSXMQ type if mqueue file system is mounted. [linux] Added Linux display of POSIX message queue endpoint information with +|-E option. mqueue file system must be mounted to display the information. [linux] Added Linux display of INET6 socket endpoint information with +|-E option. The option handles INET6 sockets using IPC. [FreeBSD] update to include <sys/_lock.h> on recent -CURRENT since it is no longer implicitly included via header pollution. [linux] Added Linux display of eventfd endpoint information with +|-E option. The option handles eventfd using IPC. [FreeBSD] include <stdbool.h> for recent change requiring refcount(9). Enhanced -r option. With `c<N>' specifier, lsof can stop itself when the number of iterations reaches at <N>. [linux] Fixed accessing an uninitialized local variable. Detected by valgrind. [linux] fix a crash when printing the endpoint for unaccepted unix socket with +E option. This closes the github issue #74 reported by @jolmg. [linux] abort execution when failing in memory allocation for socket private data. [linux] decode the name of DCCP socket type. [linux] decode more netlink protocol numbers (RDMA, CRYPTO, and SMC). [linux] print the connection state of unix domain socket Lsof can print the state of TCP socket like: nc 22247 yamato 3u IPv4 471409 0t0 TCP localhost:38802->localhost:9999 (ESTABLISHED) This change exnteds this feature to support unix domain sockets. LISTEN, UNCONNECTED, CONNECTING, CONNECTED, DISCONNECTING, and UNKNOWN can be taken as a state. An example of output: evince 17333 yamato 1u unix 0x0000000054183795 0t0 89141 type=STREAM (CONNECTED) This feature is enabled by default. To turn off printing state information, use -T option. Don't display command usage even when a file (or directory) listed in command line doesn't exist. This closes the github issue #90 reported by @rowlap. [FreeBSD] merge all the FreeBSD specific fixes from the FreeBSD sysutils/lsof port [linux] allow reproducible builds In a reproducible build all varied information is removed. This change does so, by checking if the standard SOURCE_DATE_EPOCH variable is set. If it is, we are attempting a reproducible build and will strip varying information. About the standard, see https://reproducible-builds.org/specs/source-date-epoch/ Provided in github pull request #93 by @T4cC0re. [freebsd] update for r363214 - no user visible changes Added the way to include (or exclude) all numbered file descriptors in -d option. "fd" is a pseudo file descriptor name for the purpose. See the following output on Linux; lsof doesn't print cwd, rtd, txt, and mem files. # ./lsof -p $$ -a -d fd COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME bash 866421 root 0u CHR 136,1 0t0 4 /dev/pts/1 bash 866421 root 1u CHR 136,1 0t0 4 /dev/pts/1 bash 866421 root 2u CHR 136,1 0t0 4 /dev/pts/1 bash 866421 root 255u CHR 136,1 0t0 4 /dev/pts/1 docs: fixed minor grammatical error in instructions in Customize file The change is provided by @hardikpnsp. man page: improve phrasing and add examples The change is provided by Martin D Kealey. man page: improve explanation of -t implying -w The change is provided by Martin D Kealey. test cases, [linux]: fix tests for large inode-numbers (i >= 2^32) The change is provided by Henry Peteet. [linux] handle ffff:ffff in ipv6 addr correctly The listen address and port of an AF_INET6 socket were not display if the socket listened at an ipv6 address including ffff:ffff. Here is a command session demonstrating the bug: # ip -6 addr add abcd:ef10:ffff:ffff:ffff:ffff:ffff:ff62 dev lo # nc -6 -l abcd:ef10:ffff:ffff:ffff:ffff:ffff:ff62 8888 & [1] 6762 # ./lsof -p 6762 -a -d fd -P -n COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME nc 6762 yamato 0u CHR 136,6 0t0 9 /dev/pts/6 nc 6762 yamato 1u CHR 136,6 0t0 9 /dev/pts/6 nc 6762 yamato 2u CHR 136,6 0t0 9 /dev/pts/6 nc 6762 yamato 3u sock 0,9 0t0 5833594 protocol: TCPv6 The last line should be: nc 6762 yamato 3u IPv6 5833594 0t0 TCP [abcd:ef10:ffff:ffff:ffff:ffff:ffff:ff62]:8888 (LISTEN) The original code decoding an ipv6 address uses UINT32_MAX constant incorrect way. @zhrf2020 reported this bug in #102. @zhrf2020 provided the initial version of fix, #109. man page,[linux]: enumerate abbreviated flags printed with '+f g' option Make -Fo option work -Fo option is for printing file offset. For regular files, the option didn't work. Here is a command session demonstrating the fix: # ./lsof -Fo -o0| grep ^o | sort | uniq -c 90586 o0t0 87 o0t101 84 o0t103 ... @JustAnotherArchivist reported this bug in #118. man page: fix definition of the `o` field on programmatic output The change is provided by @JustAnotherArchivist who reported the original issue in #118. [linux]: show the pid monitored by a pidfd With this change, lsof prints pidfd in the following form: [pidfd:%d] where %d represents the pid monitored by the pidfd. Example output: # ./lsof -p 12573 -p 12710 | grep pidfd dbus-brok 12573 jet 11u a_inode 0,13 0 13312 [pidfd:12575] dbus-brok 12710 jet 10u a_inode 0,13 0 13312 [pidfd:12711] fd 11 of pid 12573 monitors pid 12575. fd 10 of pid 12710 monitors pid 12711. This change closed #116. Don't select the file descriptor field by default. The version 4.88 introduced the change for selecting the file descriptor field by default. However, the change is not suitable for users who wants to print only PID field. @po5857 suggests the use case and the way to improve the man page. [linux]: enumerate fds monitored by an eventpoll fd With this change, lsof prints an eventpoll fd in the following form: [eventpoll:<fd0>,<fd1>,...,<fdn>...] Here fdX is a file descriptor monitored by the eventpoll fd. If an eventpoll fd monitors too many file descriptors, lsof truncates the list of fds. "..." at the end of list implies the truncation. Example output: # sudo ./lsof -p 1 -a -d 10,11,12 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME systemd 1 root 10u a_inode 0,13 0 11624 [eventpoll:11,12] systemd 1 root 11r REG 0,4 0 17680 /proc/1/mountinfo systemd 1 root 12r a_inode 0,13 0 11624 inotify systemd monitors fd 11 and fd 12 via eventpoll fd 10. [linux]: implement "make check" The target runs check.bash. 4.93.2 May 8, 2019 Update the version number embedded in lsof executable. lsof-4.93.1 4.93.0 May 7, 2019 [freebsd] Made FreeBSD 13 adjustment. [darwin] Fix a typo causing a build error. Fix a potential memory leak. [linux] use tirpc for rpc if libc doesn't provide rpc.h. Fix a typo in man page. [linux] fix memory leaks detected by valgrind about unix endpoint information. Update the description about -fg and -fG options on linux. 4.93.1 May 7, 2019 Fix a broken symbolic link. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/lsof | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/lfs/lsof b/lfs/lsof index 8ea9e6c56..eefaf35f5 100644 --- a/lfs/lsof +++ b/lfs/lsof @@ -24,10 +24,10 @@ include Config -VER = 4.91 +VER = 4.95.0.linux THISAPP = lsof_$(VER) -DL_FILE = $(THISAPP).tar.gz +DL_FILE = $(THISAPP).tar.bz2 DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = b727acd6064b1c1d20b13311756c8bcb1cf20f5d68b4295b2a5fe8fcc0dbf35a2957017763212b48c338f5ac251d905f648a9c0df1babd30809676b1aa657b5c +$(DL_FILE)_BLAKE2 = 6a7d6353ec7f0f1e14416bff98867e64009c3f3901110c947f845bb3dcf9af3d40755c7ac6d586412a61778bc8ac355d2388cf2cfa8a975dbf4870c339c75a8c install : $(TARGET) @@ -70,9 +70,8 @@ $(subst %,%_BLAKE2,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) - cd $(DIR_APP) && tar axf lsof_$(VER)_src.tar - cd $(DIR_APP)/lsof_$(VER)_src && ./Configure linux -n - cd $(DIR_APP)/lsof_$(VER)_src && make $(MAKETUNING) CC="cc $(CFLAGS) $(LDFLAGS)" - cd $(DIR_APP)/lsof_$(VER)_src && install -m 755 -o root -g root lsof /usr/bin + cd $(DIR_APP) && ./Configure linux + cd $(DIR_APP) && make $(MAKETUNING) CC="cc $(CFLAGS) $(LDFLAGS)" + cd $(DIR_APP) && install -m 755 -o root -g root lsof /usr/bin @rm -rf $(DIR_APP) @$(POSTBUILD) -- 2.36.0

2 1

[PATCH] atk: Drop package.
by Stefan Schantl 06 Jul '22

06 Jul '22

Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- atk/atk.nm | 58 ------------------------------------------------------ 1 file changed, 58 deletions(-) delete mode 100644 atk/atk.nm diff --git a/atk/atk.nm b/atk/atk.nm deleted file mode 100644 index 4b7c16670..000000000 --- a/atk/atk.nm +++ /dev/null @@ -1,58 +0,0 @@ -############################################################################### -# IPFire.org - An Open Source Firewall Solution # -# Copyright (C) - IPFire Development Team <info(a)ipfire.org> # -############################################################################### - -name = atk -version = %{ver_major}.%{ver_minor} -ver_major = 2.20 -ver_minor = 0 -release = 2 - -groups = System/Libraries -url = http://www.gnome.org -license = LGPLv2+ -summary = Interfaces for accessibility support. - -description - The ATK library provides a set of interfaces for adding accessibility - support to applications and graphical user interface toolkits. -end - -source_dl = http://download.gnome.org/sources/%{name}/%{ver_major}/ -sources = %{thisapp}.tar.xz - -build - requires - glib2-devel >= 2.31.2 - gobject-introspection-devel >= 1.39.3 - end - - export LD_LIBRARY_PATH=%{DIR_APP}/atk/.libs - - configure_options += \ - --enable-introspection=yes \ - --disable-gtk-doc \ - --disable-gtk-doc-html \ - --disable-gtk-doc-pdf \ - --disable-static - - test - make check - end -end - -packages - package %{name} - - package %{name}-devel - template DEVEL - - files += \ - %{datadir}/gir*/ - end - - package %{name}-debuginfo - template DEBUGINFO - end -end -- 2.30.2

1 0

[PATCH] stripper: Strip any PIE executables
by Michael Tremer 06 Jul '22

06 Jul '22

Fixes: #12894 Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- src/stripper | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/stripper b/src/stripper index fadbc514b..4014f03a4 100755 --- a/src/stripper +++ b/src/stripper @@ -38,6 +38,10 @@ function _strip() { args+=( "--strip-all" ) ;; + *Type:*"DYN (Position-Independent Executable file)"*) + args+=( "--strip-all" ) + ;; + # Binaries *Type:*"EXEC (Executable file)"*) args+=( "--strip-all" ) -- 2.30.2

2 6

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development July 2022