May 2018 - crux-commits - lists.crux.nu

ports/opt (3.3): freetype: enable freetype-config to unbreak grub
by crux＠crux.nu 05 May '18

05 May '18

commit aa1a1715376300905a413985f9d401b6128da326 Author: Fredrik Rinnestam <fredrik(a)crux.nu> Date: Sat May 5 21:34:31 2018 +0200 freetype: enable freetype-config to unbreak grub diff --git a/freetype/.footprint b/freetype/.footprint index 5edb0dd26..82fdab776 100644 --- a/freetype/.footprint +++ b/freetype/.footprint @@ -1,4 +1,6 @@ drwxr-xr-x root/root usr/ +drwxr-xr-x root/root usr/bin/ +-rwxr-xr-x root/root usr/bin/freetype-config drwxr-xr-x root/root usr/include/ drwxr-xr-x root/root usr/include/freetype2/ drwxr-xr-x root/root usr/include/freetype2/freetype/ @@ -63,3 +65,6 @@ drwxr-xr-x root/root usr/lib/pkgconfig/ drwxr-xr-x root/root usr/share/ drwxr-xr-x root/root usr/share/aclocal/ -rw-r--r-- root/root usr/share/aclocal/freetype2.m4 +drwxr-xr-x root/root usr/share/man/ +drwxr-xr-x root/root usr/share/man/man1/ +-rw-r--r-- root/root usr/share/man/man1/freetype-config.1.gz diff --git a/freetype/.signature b/freetype/.signature index 032aa0e3c..5573a6aac 100644 --- a/freetype/.signature +++ b/freetype/.signature @@ -1,5 +1,5 @@ untrusted comment: verify with /etc/ports/opt.pub -RWSE3ohX2g5d/Yc308aODwcAPn1gO9MoadwJmSpHjkL04L9Z3xXubIZ9w0oufFwlub1H+b7FTL0LhqDKaoSviEzbaYgR/EW5FAc= -SHA256 (Pkgfile) = 86cc3e4f4c59fd975218a01f9216138407bb50d6fecdb601765a92b05c39a467 -SHA256 (.footprint) = 9e450e330caeb4edda03d403270d47137a72cdeed398c48e5337e1d884a01019 +RWSE3ohX2g5d/aV4GoQoPv8X006I75Z+M5xY6jp9SpXt+ZttDl7LdWh6tPy0nzUtjr4XQY2TX0S3mkRLFjmonrXDlxRBS4BNQQY= +SHA256 (Pkgfile) = d958dbb136b9925a071176bb8abe6afea822eb8bbe843aca7c127e24dbafd83d +SHA256 (.footprint) = f28d6c6cd430f2be29b5a5d856cbd76198119f587021ea9b4e2e612c88250402 SHA256 (freetype-2.9.1.tar.bz2) = db8d87ea720ea9d5edc5388fc7a0497bb11ba9fe972245e0f7f4c7e8b1e1e84d diff --git a/freetype/Pkgfile b/freetype/Pkgfile index 62f3e8c3f..925e9dfbb 100644 --- a/freetype/Pkgfile +++ b/freetype/Pkgfile @@ -5,14 +5,14 @@ name=freetype version=2.9.1 -release=1 +release=2 source=(http://download.savannah.gnu.org/releases/$name/$name-$version.tar.… build() { cd freetype-$version ./configure --prefix=/usr \ - --with-zlib + --with-zlib --enable-freetype-config # w/o breaks grub2 make make DESTDIR=$PKG install

1 0

ports/opt (3.3): [notify] python: update to 2.7.15, closes FS#1655
by crux＠crux.nu 05 May '18

05 May '18

commit f7e71aa7eb2ec6c091397a3bfc9d4d0d749d2b0a Author: Juergen Daubert <jue(a)jue.li> Date: Sat May 5 15:14:09 2018 +0200 [notify] python: update to 2.7.15, closes FS#1655 several security fixes, see https://github.com/python/cpython/blob/2.7/Misc/NEWS.d/2.7.15rc1.rst diff --git a/python/.footprint b/python/.footprint index bb48ad2c5..83c9aa625 100644 --- a/python/.footprint +++ b/python/.footprint @@ -1036,8 +1036,8 @@ drwxr-xr-x root/root usr/lib/python2.7/ensurepip/ -rw-r--r-- root/root usr/lib/python2.7/ensurepip/__main__.pyc -rw-r--r-- root/root usr/lib/python2.7/ensurepip/__main__.pyo drwxr-xr-x root/root usr/lib/python2.7/ensurepip/_bundled/ --rw-r--r-- root/root usr/lib/python2.7/ensurepip/_bundled/pip-9.0.1-py2.py3-none-any.whl --rw-r--r-- root/root usr/lib/python2.7/ensurepip/_bundled/setuptools-28.8.0-py2.py3-none-any.whl +-rw-r--r-- root/root usr/lib/python2.7/ensurepip/_bundled/pip-9.0.3-py2.py3-none-any.whl +-rw-r--r-- root/root usr/lib/python2.7/ensurepip/_bundled/setuptools-39.0.1-py2.py3-none-any.whl -rw-r--r-- root/root usr/lib/python2.7/ensurepip/_uninstall.py -rw-r--r-- root/root usr/lib/python2.7/ensurepip/_uninstall.pyc -rw-r--r-- root/root usr/lib/python2.7/ensurepip/_uninstall.pyo @@ -1440,7 +1440,7 @@ drwxr-xr-x root/root usr/lib/python2.7/json/ -rw-r--r-- root/root usr/lib/python2.7/keyword.pyc -rw-r--r-- root/root usr/lib/python2.7/keyword.pyo drwxr-xr-x root/root usr/lib/python2.7/lib-dynload/ --rw-r--r-- root/root usr/lib/python2.7/lib-dynload/Python-2.7.14-py2.7.egg-info +-rw-r--r-- root/root usr/lib/python2.7/lib-dynload/Python-2.7.15-py2.7.egg-info -rwxr-xr-x root/root usr/lib/python2.7/lib-dynload/_bisect.so -rwxr-xr-x root/root usr/lib/python2.7/lib-dynload/_bsddb.so -rwxr-xr-x root/root usr/lib/python2.7/lib-dynload/_codecs_cn.so @@ -1614,9 +1614,9 @@ drwxr-xr-x root/root usr/lib/python2.7/lib-tk/test/test_ttk/ -rw-r--r-- root/root usr/lib/python2.7/lib-tk/turtle.pyo drwxr-xr-x root/root usr/lib/python2.7/lib2to3/ -rw-r--r-- root/root usr/lib/python2.7/lib2to3/Grammar.txt --rw-r--r-- root/root usr/lib/python2.7/lib2to3/Grammar2.7.14.final.0.pickle +-rw-r--r-- root/root usr/lib/python2.7/lib2to3/Grammar2.7.15.final.0.pickle -rw-r--r-- root/root usr/lib/python2.7/lib2to3/PatternGrammar.txt --rw-r--r-- root/root usr/lib/python2.7/lib2to3/PatternGrammar2.7.14.final.0.pickle +-rw-r--r-- root/root usr/lib/python2.7/lib2to3/PatternGrammar2.7.15.final.0.pickle -rw-r--r-- root/root usr/lib/python2.7/lib2to3/__init__.py -rw-r--r-- root/root usr/lib/python2.7/lib2to3/__init__.pyc -rw-r--r-- root/root usr/lib/python2.7/lib2to3/__init__.pyo @@ -2540,7 +2540,6 @@ drwxr-xr-x root/root usr/lib/python2.7/test/imghdrdata/ -rw-r--r-- root/root usr/lib/python2.7/test/seq_tests.pyc -rw-r--r-- root/root usr/lib/python2.7/test/seq_tests.pyo -rw-r--r-- root/root usr/lib/python2.7/test/sgml_input.html --rw-r--r-- root/root usr/lib/python2.7/test/sha256.pem -rw-r--r-- root/root usr/lib/python2.7/test/sortperf.py -rw-r--r-- root/root usr/lib/python2.7/test/sortperf.pyc -rw-r--r-- root/root usr/lib/python2.7/test/sortperf.pyo @@ -3828,6 +3827,7 @@ drwxr-xr-x root/root usr/lib/python2.7/test/tracedmodules/ -rw-r--r-- root/root usr/lib/python2.7/test/win_console_handler.pyo -rw-r--r-- root/root usr/lib/python2.7/test/wrongcert.pem drwxr-xr-x root/root usr/lib/python2.7/test/xmltestdata/ +-rw-r--r-- root/root usr/lib/python2.7/test/xmltestdata/expat224_utf8_bug.xml -rw-r--r-- root/root usr/lib/python2.7/test/xmltestdata/simple-ns.xml -rw-r--r-- root/root usr/lib/python2.7/test/xmltestdata/simple.xml -rw-r--r-- root/root usr/lib/python2.7/test/xmltestdata/test.xml diff --git a/python/.md5sum b/python/.md5sum index 2522becf5..ce21c0a0b 100644 --- a/python/.md5sum +++ b/python/.md5sum @@ -1,3 +1,2 @@ -ff653e9e002ca0e3d4a828988e52edd3 CVE-2018-1000030.patch -1f6db41ad91d9eb0a6f0c769b8613c5b Python-2.7.14.tar.xz +a80ae3cc478460b922242f43a1b4094d Python-2.7.15.tar.xz 387d5f6d00d2be01ecb87216cac0f88c pyconfig.h diff --git a/python/.signature b/python/.signature index 660b6eece..699fd46d7 100644 --- a/python/.signature +++ b/python/.signature @@ -1,7 +1,6 @@ untrusted comment: verify with /etc/ports/opt.pub -RWSE3ohX2g5d/boQipBgLcfxZlqFZR09X30s/Z5MGSa539QoTYA6+7gBtc/kPgMKpF6e8opocX6wAQjcf9trsFzX4XMdoJaRFwY= -SHA256 (Pkgfile) = 68fdadc03201267d440d69f8cd2e02a028887cf0b274d02ca17c52095aa8c663 -SHA256 (.footprint) = cad0b763c2deaad518b7c81ea32fbbe025df03c1548002336ef818ca9f4cf7ce -SHA256 (Python-2.7.14.tar.xz) = 71ffb26e09e78650e424929b2b457b9c912ac216576e6bd9e7d204ed03296a66 -SHA256 (CVE-2018-1000030.patch) = f7ff89ad24d529532b4dfa6bd601d8f7368c3ae3950dae539ecc11e5e09b3ecb +RWSE3ohX2g5d/QL9azCD8wrAyLYz7OIZz45ib254f7ONHFsMdZTkv/eshI8AxHtmbP0Nr59Mwf0D7Rm+UB866dHroOwADn7Vmgw= +SHA256 (Pkgfile) = cd669df4f421b7406cbca94fb69daf8128bdd018e2039c4ecec8724da3f709ea +SHA256 (.footprint) = 31c574d370b644955bc7d95e69f2b234ac56ecb5b4934bdeb27f99637137fcb9 +SHA256 (Python-2.7.15.tar.xz) = 22d9b1ac5b26135ad2b8c2901a9413537e08749a753356ee913c84dbd2df5574 SHA256 (pyconfig.h) = 081426cb9524c2e156a71bb035c25a67e44d389afc6f7e091bcf86a7f4e2002f diff --git a/python/CVE-2018-1000030.patch b/python/CVE-2018-1000030.patch deleted file mode 100644 index efec47684..000000000 --- a/python/CVE-2018-1000030.patch +++ /dev/null @@ -1,258 +0,0 @@ ---- a/Lib/test/test_file2k.py 2018-02-16 17:49:45.180147747 -0500 -+++ b/Lib/test/test_file2k.py 2018-02-16 17:51:06.870149602 -0500 -@@ -652,6 +652,33 @@ class FileThreadingTests(unittest.TestCa - self.f.writelines('') - self._test_close_open_io(io_func) - -+ def test_iteration_torture(self): -+ # bpo-31530 -+ with open(self.filename, "wb") as fp: -+ for i in xrange(2**20): -+ fp.write(b"0"*50 + b"\n") -+ with open(self.filename, "rb") as f: -+ def it(): -+ for l in f: -+ pass -+ self._run_workers(it, 10) -+ -+ def test_iteration_seek(self): -+ # bpo-31530: Crash when concurrently seek and iterate over a file. -+ with open(self.filename, "wb") as fp: -+ for i in xrange(10000): -+ fp.write(b"0"*50 + b"\n") -+ with open(self.filename, "rb") as f: -+ it = iter([1] + [0]*10) # one thread reads, others seek -+ def iterate(): -+ if next(it): -+ for l in f: -+ pass -+ else: -+ for i in xrange(100): -+ f.seek(i*100, 0) -+ self._run_workers(iterate, 10) -+ - - @unittest.skipUnless(os.name == 'posix', 'test requires a posix system.') - class TestFileSignalEINTR(unittest.TestCase): ---- a/Objects/fileobject.c 2018-02-16 17:49:45.304147750 -0500 -+++ b/Objects/fileobject.c 2018-02-16 17:51:06.872149603 -0500 -@@ -430,7 +430,7 @@ close_the_file(PyFileObject *f) - if (f->ob_refcnt > 0) { - PyErr_SetString(PyExc_IOError, - "close() called during concurrent " -- "operation on the same file object."); -+ "operation on the same file object"); - } else { - /* This should not happen unless someone is - * carelessly playing with the PyFileObject -@@ -438,7 +438,7 @@ close_the_file(PyFileObject *f) - * pointer. */ - PyErr_SetString(PyExc_SystemError, - "PyFileObject locking error in " -- "destructor (refcnt <= 0 at close)."); -+ "destructor (refcnt <= 0 at close)"); - } - return NULL; - } -@@ -604,7 +604,12 @@ err_iterbuffered(void) - return NULL; - } - --static void drop_readahead(PyFileObject *); -+static void -+drop_file_readahead(PyFileObject *f) -+{ -+ PyMem_FREE(f->f_buf); -+ f->f_buf = NULL; -+} - - /* Methods */ - -@@ -627,7 +632,7 @@ file_dealloc(PyFileObject *f) - Py_XDECREF(f->f_mode); - Py_XDECREF(f->f_encoding); - Py_XDECREF(f->f_errors); -- drop_readahead(f); -+ drop_file_readahead(f); - Py_TYPE(f)->tp_free((PyObject *)f); - } - -@@ -762,7 +767,7 @@ file_seek(PyFileObject *f, PyObject *arg - - if (f->f_fp == NULL) - return err_closed(); -- drop_readahead(f); -+ drop_file_readahead(f); - whence = 0; - if (!PyArg_ParseTuple(args, "O|i:seek", &offobj, &whence)) - return NULL; -@@ -2221,12 +2226,16 @@ static PyGetSetDef file_getsetlist[] = { - {0}, - }; - -+typedef struct { -+ char *buf, *bufptr, *bufend; -+} readaheadbuffer; -+ - static void --drop_readahead(PyFileObject *f) -+drop_readaheadbuffer(readaheadbuffer *rab) - { -- if (f->f_buf != NULL) { -- PyMem_Free(f->f_buf); -- f->f_buf = NULL; -+ if (rab->buf != NULL) { -+ PyMem_FREE(rab->buf); -+ rab->buf = NULL; - } - } - -@@ -2234,35 +2243,34 @@ drop_readahead(PyFileObject *f) - (unless at EOF) and no more than bufsize. Returns negative value on - error, will set MemoryError if bufsize bytes cannot be allocated. */ - static int --readahead(PyFileObject *f, Py_ssize_t bufsize) -+readahead(PyFileObject *f, readaheadbuffer *rab, Py_ssize_t bufsize) - { - Py_ssize_t chunksize; - -- if (f->f_buf != NULL) { -- if( (f->f_bufend - f->f_bufptr) >= 1) -+ if (rab->buf != NULL) { -+ if ((rab->bufend - rab->bufptr) >= 1) - return 0; - else -- drop_readahead(f); -+ drop_readaheadbuffer(rab); - } -- if ((f->f_buf = (char *)PyMem_Malloc(bufsize)) == NULL) { -+ if ((rab->buf = PyMem_MALLOC(bufsize)) == NULL) { - PyErr_NoMemory(); - return -1; - } - FILE_BEGIN_ALLOW_THREADS(f) - errno = 0; -- chunksize = Py_UniversalNewlineFread( -- f->f_buf, bufsize, f->f_fp, (PyObject *)f); -+ chunksize = Py_UniversalNewlineFread(rab->buf, bufsize, f->f_fp, (PyObject *)f); - FILE_END_ALLOW_THREADS(f) - if (chunksize == 0) { - if (ferror(f->f_fp)) { - PyErr_SetFromErrno(PyExc_IOError); - clearerr(f->f_fp); -- drop_readahead(f); -+ drop_readaheadbuffer(rab); - return -1; - } - } -- f->f_bufptr = f->f_buf; -- f->f_bufend = f->f_buf + chunksize; -+ rab->bufptr = rab->buf; -+ rab->bufend = rab->buf + chunksize; - return 0; - } - -@@ -2272,45 +2280,43 @@ readahead(PyFileObject *f, Py_ssize_t bu - logarithmic buffer growth to about 50 even when reading a 1gb line. */ - - static PyStringObject * --readahead_get_line_skip(PyFileObject *f, Py_ssize_t skip, Py_ssize_t bufsize) -+readahead_get_line_skip(PyFileObject *f, readaheadbuffer *rab, Py_ssize_t skip, Py_ssize_t bufsize) - { - PyStringObject* s; - char *bufptr; - char *buf; - Py_ssize_t len; - -- if (f->f_buf == NULL) -- if (readahead(f, bufsize) < 0) -+ if (rab->buf == NULL) -+ if (readahead(f, rab, bufsize) < 0) - return NULL; - -- len = f->f_bufend - f->f_bufptr; -+ len = rab->bufend - rab->bufptr; - if (len == 0) -- return (PyStringObject *) -- PyString_FromStringAndSize(NULL, skip); -- bufptr = (char *)memchr(f->f_bufptr, '\n', len); -+ return (PyStringObject *)PyString_FromStringAndSize(NULL, skip); -+ bufptr = (char *)memchr(rab->bufptr, '\n', len); - if (bufptr != NULL) { - bufptr++; /* Count the '\n' */ -- len = bufptr - f->f_bufptr; -- s = (PyStringObject *) -- PyString_FromStringAndSize(NULL, skip + len); -+ len = bufptr - rab->bufptr; -+ s = (PyStringObject *)PyString_FromStringAndSize(NULL, skip + len); - if (s == NULL) - return NULL; -- memcpy(PyString_AS_STRING(s) + skip, f->f_bufptr, len); -- f->f_bufptr = bufptr; -- if (bufptr == f->f_bufend) -- drop_readahead(f); -+ memcpy(PyString_AS_STRING(s) + skip, rab->bufptr, len); -+ rab->bufptr = bufptr; -+ if (bufptr == rab->bufend) -+ drop_readaheadbuffer(rab); - } else { -- bufptr = f->f_bufptr; -- buf = f->f_buf; -- f->f_buf = NULL; /* Force new readahead buffer */ -+ bufptr = rab->bufptr; -+ buf = rab->buf; -+ rab->buf = NULL; /* Force new readahead buffer */ - assert(len <= PY_SSIZE_T_MAX - skip); -- s = readahead_get_line_skip(f, skip + len, bufsize + (bufsize>>2)); -+ s = readahead_get_line_skip(f, rab, skip + len, bufsize + (bufsize>>2)); - if (s == NULL) { -- PyMem_Free(buf); -+ PyMem_FREE(buf); - return NULL; - } - memcpy(PyString_AS_STRING(s) + skip, bufptr, len); -- PyMem_Free(buf); -+ PyMem_FREE(buf); - } - return s; - } -@@ -2328,7 +2334,30 @@ file_iternext(PyFileObject *f) - if (!f->readable) - return err_mode("reading"); - -- l = readahead_get_line_skip(f, 0, READAHEAD_BUFSIZE); -+ { -+ /* -+ Multiple threads can enter this method while the GIL is released -+ during file read and wreak havoc on the file object's readahead -+ buffer. To avoid dealing with cross-thread coordination issues, we -+ cache the file buffer state locally and only set it back on the file -+ object when we're done. -+ */ -+ readaheadbuffer rab = {f->f_buf, f->f_bufptr, f->f_bufend}; -+ f->f_buf = NULL; -+ l = readahead_get_line_skip(f, &rab, 0, READAHEAD_BUFSIZE); -+ /* -+ Make sure the file's internal read buffer is cleared out. This will -+ only do anything if some other thread interleaved with us during -+ readahead. We want to drop any changeling buffer, so we don't leak -+ memory. We may lose data, but that's what you get for reading the same -+ file object in multiple threads. -+ */ -+ drop_file_readahead(f); -+ f->f_buf = rab.buf; -+ f->f_bufptr = rab.bufptr; -+ f->f_bufend = rab.bufend; -+ } -+ - if (l == NULL || PyString_GET_SIZE(l) == 0) { - Py_XDECREF(l); - return NULL; -@@ -2692,7 +2721,7 @@ int PyObject_AsFileDescriptor(PyObject * - } - else { - PyErr_SetString(PyExc_TypeError, -- "argument must be an int, or have a fileno() method."); -+ "argument must be an int, or have a fileno() method"); - return -1; - } diff --git a/python/Pkgfile b/python/Pkgfile index 3120ef84a..f3784af0f 100644 --- a/python/Pkgfile +++ b/python/Pkgfile @@ -4,18 +4,13 @@ # Depends on: db gdbm openssl bzip2 zlib sqlite3 name=python -version=2.7.14 -release=2 +version=2.7.15 +release=1 source=(http://www.python.org/ftp/$name/$version/Python-$version.tar.xz \ - CVE-2018-1000030.patch pyconfig.h) build () { cd Python-$version - - # fix for CVE-2018-1000030 - # see https://bugs.python.org/issue31530 - patch -p1 -i $SRC/CVE-2018-1000030.patch # set OPT to the python default without -O3 # our CFLAGS are used as well

1 0

ports/xorg (3.4): Merge branch '3.3' into 3.4
by crux＠crux.nu 04 May '18

04 May '18

commit 1120d056b8c1430f42c13421e97a886fecba768d Merge: f7a36d5 61e1aee Author: Juergen Daubert <jue(a)jue.li> Date: Fri May 4 11:28:40 2018 +0200 Merge branch '3.3' into 3.4

1 0

ports/xorg (3.4): mesa3d: update to 18.0.2
by crux＠crux.nu 04 May '18

04 May '18

commit 61e1aeebebb6b0c528a669e0f223d026dea7830c Author: Juergen Daubert <jue(a)jue.li> Date: Fri May 4 11:04:14 2018 +0200 mesa3d: update to 18.0.2 diff --git a/mesa3d/.md5sum b/mesa3d/.md5sum index 456ad75..8f01456 100644 --- a/mesa3d/.md5sum +++ b/mesa3d/.md5sum @@ -1 +1 @@ -b8042f9970ea70a36da1ee1fae27c448 mesa-17.3.9.tar.xz +3c303da98ec2ce37c795baeba5aee31e mesa-18.0.2.tar.xz diff --git a/mesa3d/.signature b/mesa3d/.signature index 16fc834..cffe4af 100644 --- a/mesa3d/.signature +++ b/mesa3d/.signature @@ -1,5 +1,5 @@ untrusted comment: verify with /etc/ports/xorg.pub -RWTSGWF5Q7TndH2RjAZ22PaSPVvESWIRumZ5oM+9XWmjO5PuyhKNzxg4708CgtDIzjBmWWlStcfNQ/DAKuG/BBVQTzdU38ka/gU= -SHA256 (Pkgfile) = f554f9b20d7f2138efb653494c5717ab5aaea385d748076ce21948b292294fbf +RWTSGWF5Q7TndHJQ+7BRztR428h3MpdvRAADtM7oExmcaKfCfvgUCoVnY29SPeDoZkP+tK2FEzeaO0L+gMP2tuTUC5+fpqDUlAM= +SHA256 (Pkgfile) = ae1699ad295140c99dd6c36febb6345658f761414160264996b99f160e1abb81 SHA256 (.footprint) = 4ece9b6ea6f54fd29a47c920761938bd4f61b2cdf8cd5f1b4841574f3aed78eb -SHA256 (mesa-17.3.9.tar.xz) = c5beb5fc05f0e0c294fefe1a393ee118cb67e27a4dca417d77c297f7d4b6e479 +SHA256 (mesa-18.0.2.tar.xz) = 98fa159768482dc568b9f8bf0f36c7acb823fa47428ffd650b40784f16b9e7b3 diff --git a/mesa3d/Pkgfile b/mesa3d/Pkgfile index 39f7076..82b3dea 100644 --- a/mesa3d/Pkgfile +++ b/mesa3d/Pkgfile @@ -4,7 +4,7 @@ # Depends on: elfutils libdrm libvdpau llvm xorg-dri3proto xorg-glproto xorg-libxdamage xorg-libxshmfence xorg-libxvmc xorg-presentproto xorg-libxxf86vm name=mesa3d -version=17.3.9 +version=18.0.2 release=1 source=(https://mesa.freedesktop.org/archive/mesa-$version.tar.xz)

1 0

ports/xorg (3.4): libinput: update to 1.10.6
by crux＠crux.nu 04 May '18

04 May '18

commit 12f82f2662c6bfd33025cc3e9e9b183ffe75cc60 Author: Juergen Daubert <jue(a)jue.li> Date: Wed May 2 19:34:00 2018 +0200 libinput: update to 1.10.6 diff --git a/libinput/.md5sum b/libinput/.md5sum index 5dddeb3..f4a4c54 100644 --- a/libinput/.md5sum +++ b/libinput/.md5sum @@ -1 +1 @@ -3d37aa6292b7e34847811a47f3ddc860 libinput-1.10.5.tar.xz +9f47bb451a4a823014a0ad6125099b7e libinput-1.10.6.tar.xz diff --git a/libinput/.signature b/libinput/.signature index 7661f4c..66386c2 100644 --- a/libinput/.signature +++ b/libinput/.signature @@ -1,5 +1,5 @@ untrusted comment: verify with /etc/ports/xorg.pub -RWTSGWF5Q7TndEIZSRtLMe4tbXuO9QFMPTHh7RCspsdWV3QCOExyencg893ZbJCAkdkhEb94nrkoh8TnKf50fYi6zYsuyQeGoA0= -SHA256 (Pkgfile) = a0efff4d0d39ec664c7d9316279699ef86405626a5add0bae1c0aebd09016eef +RWTSGWF5Q7TndL1145bf0UAfM8DWpKbVe70vvkKUoERaOll57UOnyM7oWfG3YmeTNc5vRp7jDy6uEe5LBwefuKbBztNPc9YJPgo= +SHA256 (Pkgfile) = e59a4a61ce4debec7dfd4644b28294901c89e58351e09f129e92a0a67a8cd880 SHA256 (.footprint) = 2ef36b00bae08e2b61ada6f7900073debae3335eeb708be2dacfd5d66fa8cc31 -SHA256 (libinput-1.10.5.tar.xz) = cbb1c03b8fb4b1d3781db5c8c66cdc1e754c0354037bcf39b2d8d08710077b2e +SHA256 (libinput-1.10.6.tar.xz) = 4207742c96980584112b19090413f2d390c6acaaf51c4aac1df9edbbcdfb9b39 diff --git a/libinput/Pkgfile b/libinput/Pkgfile index f36fdfa..a9adb68 100644 --- a/libinput/Pkgfile +++ b/libinput/Pkgfile @@ -4,7 +4,7 @@ # Depends on: mtdev xorg-libevdev meson ninja name=libinput -version=1.10.5 +version=1.10.6 release=1 source=(http://www.freedesktop.org/software/$name/$name-$version.tar.xz)

1 0

ports/opt (3.4): Merge branch '3.3' into 3.4
by crux＠crux.nu 04 May '18

04 May '18

commit 3a945e85db8a6862e71301768b0a5f97623f9e58 Merge: af94d837d da48bdbcb Author: Juergen Daubert <jue(a)jue.li> Date: Fri May 4 11:23:21 2018 +0200 Merge branch '3.3' into 3.4

1 0

ports/opt (3.4): xterm: update to 333
by crux＠crux.nu 04 May '18

04 May '18

commit da48bdbcb44439706aad889d6b40da63418df748 Author: Juergen Daubert <jue(a)jue.li> Date: Fri May 4 10:49:46 2018 +0200 xterm: update to 333 diff --git a/xterm/.md5sum b/xterm/.md5sum index 4ffb83c8a..edc779fa4 100644 --- a/xterm/.md5sum +++ b/xterm/.md5sum @@ -1 +1 @@ -4bbc75ecc68d100547662958cda346ae xterm-332.tgz +32a810c436db81775706f9cbe7efc290 xterm-333.tgz diff --git a/xterm/.signature b/xterm/.signature index 397a5e509..248d6b09f 100644 --- a/xterm/.signature +++ b/xterm/.signature @@ -1,5 +1,5 @@ untrusted comment: verify with /etc/ports/opt.pub -RWSE3ohX2g5d/dBKvxXT15uQh+BP8N3rtABGb+OITyMBrkliowobVSR7zMEsSBRi4Wns9yZixNIbp9rC/Y30d8QabnLjKxL/og8= -SHA256 (Pkgfile) = cd8599033d6340c86d026fab720cb4fef0ea45a72b38fdba3918b80d60a9adf0 +RWSE3ohX2g5d/VizA3q/yU07HtF3SAKKWoVhihbJt3FPGG+I6vw1kIafLHFsAiRXVlJRppT1FBbQ++lvjYVbj1OyC7dU4z/+dQg= +SHA256 (Pkgfile) = 8e1a0878811c4a2f6b5f69e05bc7322ca0025689818df6e7ccbda192cc248e43 SHA256 (.footprint) = 8e636d56693b8e10b9082b4fec4726bc62f13dbdcc40fd018059ac95abeb1377 -SHA256 (xterm-332.tgz) = 5d4b112717e62032826082bec523aff2ab9d9b1531b1d2e81f6cab4c668cb27d +SHA256 (xterm-333.tgz) = 2f1d42014e55c8036c6b29a847b31d3b5c1a3a35b126993ae6d3f05e8da0ef78 diff --git a/xterm/Pkgfile b/xterm/Pkgfile index 44cdc9aa6..11f8500c9 100644 --- a/xterm/Pkgfile +++ b/xterm/Pkgfile @@ -4,7 +4,7 @@ # Depends on: xorg-libxaw xorg-font-alias xorg-font-misc-misc name=xterm -version=332 +version=333 release=1 source=(ftp://ftp.invisible-island.net/$name/$name-$version.tgz)

1 0

ports/opt (3.4): unbound: update to 1.7.1
by crux＠crux.nu 04 May '18

04 May '18

commit c513d033bc3b7257adafbeea0e6fe8acd03172ef Author: Juergen Daubert <jue(a)jue.li> Date: Fri May 4 10:49:30 2018 +0200 unbound: update to 1.7.1 diff --git a/unbound/.md5sum b/unbound/.md5sum index b90c11ad0..b4e7256ad 100644 --- a/unbound/.md5sum +++ b/unbound/.md5sum @@ -1,2 +1,2 @@ 5bf1cabac23d0c2d89d2696039064d0a unbound -49937b5f99a6fc2de8c5f3bb22a54390 unbound-1.7.0.tar.gz +e3614d9746e1fd45f191a2b88ad8df04 unbound-1.7.1.tar.gz diff --git a/unbound/.signature b/unbound/.signature index f60768784..6801e891c 100644 --- a/unbound/.signature +++ b/unbound/.signature @@ -1,6 +1,6 @@ untrusted comment: verify with /etc/ports/opt.pub -RWSE3ohX2g5d/UoXSIh2Ueq9Eh2xfQ6KOws8YrKVnR/vUcJ+YPkWTlI/QvnDGAwTtck2ldg+1Oh+NMZ0DM62KbdL2ZE65Vi/lAA= -SHA256 (Pkgfile) = a9b90b403a032f04a0184dcda6fe0e03b2e0c9e92e436ebca2fdf34dd5983852 +RWSE3ohX2g5d/U9sHexBaJ3/EfAIfuL/eeF4Qpud9irKiJcOkJD40mu8cNft+2u/16qbFb4YzXFEsWEypdcss9Pa+j7bKgOGBQ8= +SHA256 (Pkgfile) = 38c73dbb5f7af7e50f8e8bb3450c8fb8060ac010823f768c43c10a8fac244fd8 SHA256 (.footprint) = 55dae6262dda05e002b80b843c0e57553a93a9e770d86630d104c04e3efaced7 -SHA256 (unbound-1.7.0.tar.gz) = 94dd9071fb13d8ccd122a3ac67c4524a3324d0e771fc7a8a7c49af8abfb926a2 +SHA256 (unbound-1.7.1.tar.gz) = 56e085ef582c5372a20207de179d0edb4e541e59f87be7d4ee1d00d12008628d SHA256 (unbound) = 54c94f1813c00c7faac51bde904b879b73d043e87c49cf8aff63de565368a095 diff --git a/unbound/Pkgfile b/unbound/Pkgfile index eeaed69f0..a24e183ea 100644 --- a/unbound/Pkgfile +++ b/unbound/Pkgfile @@ -4,7 +4,7 @@ # Depends on: openssl expat name=unbound -version=1.7.0 +version=1.7.1 release=1 source=(https://unbound.net/downloads/$name-$version.tar.gz unbound)

1 0

ports/core (3.4): Merge branch '3.3' into 3.4
by crux＠crux.nu 04 May '18

04 May '18

commit 096975d867409368b0b18a8ee186243b6ce28ac0 Merge: 84c3c9e7 1e09cc14 Author: Juergen Daubert <jue(a)jue.li> Date: Fri May 4 11:21:46 2018 +0200 Merge branch '3.3' into 3.4

1 0

ports/core (3.4): shadow: update to 4.6
by crux＠crux.nu 04 May '18

04 May '18

commit 1e09cc142bb3326ba5b58b4548957bb2ffd9fe6d Author: Juergen Daubert <jue(a)jue.li> Date: Fri May 4 11:15:19 2018 +0200 shadow: update to 4.6 diff --git a/shadow/.md5sum b/shadow/.md5sum index 6424e4d5..9e93ef91 100644 --- a/shadow/.md5sum +++ b/shadow/.md5sum @@ -1,4 +1,3 @@ -aad42ace9b3d450717355010b9344c56 CVE-2018-7169.patch 80756b2d5b3351b3757f48ae69fe866d login.defs be8f69c2701118093af3d7f3bc02af16 pwck -c350da50c2120de6bb29177699d89fe3 shadow-4.5.tar.xz +b491fecbf1232632c32ff8f1437fd60e shadow-4.6.tar.xz diff --git a/shadow/.signature b/shadow/.signature index 6dbc8777..8a121d86 100644 --- a/shadow/.signature +++ b/shadow/.signature @@ -1,8 +1,7 @@ untrusted comment: verify with /etc/ports/core.pub -RWRJc1FUaeVeqqLpIS3LGM3rjoF0kUdbtuIDL1UilPze46/DVrHdo27qHiHPLOaN8GLLukQJFkQRq8XV9obslWlWtguLSW/uTwo= -SHA256 (Pkgfile) = 4647cbfe01446ff33de8393e0a6d9dff1a4ac199acd417e66e6623cf6a705507 +RWRJc1FUaeVeqpdbafEtEvgpRhYNzcGr9mzcyuw3nNoO7EawXtg05K/XdcDqIzBEs3WOrB5Vfcv/TmOkj/Q6uTF5sw+1FzJ9ZQQ= +SHA256 (Pkgfile) = 2a6884a5a14315e85f82c1cea46d43d5b9d61bd24f70fe64c9a4630d499ac2ed SHA256 (.footprint) = 196891826eef19be5e249380bc5c9560b10051556be4a3be5d33e099a56f23ae -SHA256 (shadow-4.5.tar.xz) = fc8c858381ad577a5c25ff5beb6ee60a34f8719c73e4e7c61e74188b4e54b741 -SHA256 (CVE-2018-7169.patch) = 3b8896d8ac400692af1e2da17b9b8a447aa668c09fe16c1b9cee55e923b64820 +SHA256 (shadow-4.6.tar.xz) = 0998c8d84242a231ab0acb7f8613927ff5bcff095f8aa6b79478893a03f05583 SHA256 (pwck) = c62f1bf5785c2bb93bb269156bfa02b06728a01ff5d6c2e09cf6285701a1fda0 SHA256 (login.defs) = a5c63da222b9dd921b60a21be8fc888726b557fd3fde9f60c8899376d0311b0b diff --git a/shadow/CVE-2018-7169.patch b/shadow/CVE-2018-7169.patch deleted file mode 100644 index 30ad9e61..00000000 --- a/shadow/CVE-2018-7169.patch +++ /dev/null @@ -1,180 +0,0 @@ -From fb28c99b8a66ff2605c5cb96abc0a4d975f92de0 Mon Sep 17 00:00:00 2001 -From: Aleksa Sarai <asarai(a)suse.de> -Date: Thu, 15 Feb 2018 23:49:40 +1100 -Subject: [PATCH] newgidmap: enforce setgroups=deny if self-mapping a group - -This is necessary to match the kernel-side policy of "self-mapping in a -user namespace is fine, but you cannot drop groups" -- a policy that was -created in order to stop user namespaces from allowing trivial privilege -escalation by dropping supplementary groups that were "blacklisted" from -certain paths. - -This is the simplest fix for the underlying issue, and effectively makes -it so that unless a user has a valid mapping set in /etc/subgid (which -only administrators can modify) -- and they are currently trying to use -that mapping -- then /proc/$pid/setgroups will be set to deny. This -workaround is only partial, because ideally it should be possible to set -an "allow_setgroups" or "deny_setgroups" flag in /etc/subgid to allow -administrators to further restrict newgidmap(1). - -We also don't write anything in the "allow" case because "allow" is the -default, and users may have already written "deny" even if they -technically are allowed to use setgroups. And we don't write anything if -the setgroups policy is already "deny". - -Ref: https://bugs.launchpad.net/ubuntu/+source/shadow/+bug/1729357 -Fixes: CVE-2018-7169 -Reported-by: Craig Furman <craig.furman89(a)gmail.com> -Signed-off-by: Aleksa Sarai <asarai(a)suse.de> ---- - src/newgidmap.c | 89 +++++++++++++++++++++++++++++++++++++++++++++++++++------ - 1 file changed, 80 insertions(+), 9 deletions(-) - -diff --git a/src/newgidmap.c b/src/newgidmap.c -index b1e33513..59a2e75c 100644 ---- a/src/newgidmap.c -+++ b/src/newgidmap.c -@@ -46,32 +46,37 @@ - */ - const char *Prog; - --static bool verify_range(struct passwd *pw, struct map_range *range) -+ -+static bool verify_range(struct passwd *pw, struct map_range *range, bool *allow_setgroups) - { - /* An empty range is invalid */ - if (range->count == 0) - return false; - -- /* Test /etc/subgid */ -- if (have_sub_gids(pw->pw_name, range->lower, range->count)) -+ /* Test /etc/subgid. If the mapping is valid then we allow setgroups. */ -+ if (have_sub_gids(pw->pw_name, range->lower, range->count)) { -+ *allow_setgroups = true; - return true; -+ } - -- /* Allow a process to map its own gid */ -- if ((range->count == 1) && (pw->pw_gid == range->lower)) -+ /* Allow a process to map its own gid. */ -+ if ((range->count == 1) && (pw->pw_gid == range->lower)) { -+ /* noop -- if setgroups is enabled already we won't disable it. */ - return true; -+ } - - return false; - } - - static void verify_ranges(struct passwd *pw, int ranges, -- struct map_range *mappings) -+ struct map_range *mappings, bool *allow_setgroups) - { - struct map_range *mapping; - int idx; - - mapping = mappings; - for (idx = 0; idx < ranges; idx++, mapping++) { -- if (!verify_range(pw, mapping)) { -+ if (!verify_range(pw, mapping, allow_setgroups)) { - fprintf(stderr, _( "%s: gid range [%lu-%lu) -> [%lu-%lu) not allowed\n"), - Prog, - mapping->upper, -@@ -89,6 +94,70 @@ static void usage(void) - exit(EXIT_FAILURE); - } - -+void write_setgroups(int proc_dir_fd, bool allow_setgroups) -+{ -+ int setgroups_fd; -+ char *policy, policy_buffer[4096]; -+ -+ /* -+ * Default is "deny", and any "allow" will out-rank a "deny". We don't -+ * forcefully write an "allow" here because the process we are writing -+ * mappings for may have already set themselves to "deny" (and "allow" -+ * is the default anyway). So allow_setgroups == true is a noop. -+ */ -+ policy = "deny\n"; -+ if (allow_setgroups) -+ return; -+ -+ setgroups_fd = openat(proc_dir_fd, "setgroups", O_RDWR|O_CLOEXEC); -+ if (setgroups_fd < 0) { -+ /* -+ * If it's an ENOENT then we are on too old a kernel for the setgroups -+ * code to exist. Emit a warning and bail on this. -+ */ -+ if (ENOENT == errno) { -+ fprintf(stderr, _("%s: kernel doesn't support setgroups restrictions\n"), Prog); -+ goto out; -+ } -+ fprintf(stderr, _("%s: couldn't open process setgroups: %s\n"), -+ Prog, -+ strerror(errno)); -+ exit(EXIT_FAILURE); -+ } -+ -+ /* -+ * Check whether the policy is already what we want. /proc/self/setgroups -+ * is write-once, so attempting to write after it's already written to will -+ * fail. -+ */ -+ if (read(setgroups_fd, policy_buffer, sizeof(policy_buffer)) < 0) { -+ fprintf(stderr, _("%s: failed to read setgroups: %s\n"), -+ Prog, -+ strerror(errno)); -+ exit(EXIT_FAILURE); -+ } -+ if (!strncmp(policy_buffer, policy, strlen(policy))) -+ goto out; -+ -+ /* Write the policy. */ -+ if (lseek(setgroups_fd, 0, SEEK_SET) < 0) { -+ fprintf(stderr, _("%s: failed to seek setgroups: %s\n"), -+ Prog, -+ strerror(errno)); -+ exit(EXIT_FAILURE); -+ } -+ if (dprintf(setgroups_fd, "%s", policy) < 0) { -+ fprintf(stderr, _("%s: failed to setgroups %s policy: %s\n"), -+ Prog, -+ policy, -+ strerror(errno)); -+ exit(EXIT_FAILURE); -+ } -+ -+out: -+ close(setgroups_fd); -+} -+ - /* - * newgidmap - Set the gid_map for the specified process - */ -@@ -103,6 +172,7 @@ int main(int argc, char **argv) - struct stat st; - struct passwd *pw; - int written; -+ bool allow_setgroups = false; - - Prog = Basename (argv[0]); - -@@ -145,7 +215,7 @@ int main(int argc, char **argv) - (unsigned long) getuid ())); - return EXIT_FAILURE; - } -- -+ - /* Get the effective uid and effective gid of the target process */ - if (fstat(proc_dir_fd, &st) < 0) { - fprintf(stderr, _("%s: Could not stat directory for target %u\n"), -@@ -177,8 +247,9 @@ int main(int argc, char **argv) - if (!mappings) - usage(); - -- verify_ranges(pw, ranges, mappings); -+ verify_ranges(pw, ranges, mappings, &allow_setgroups); - -+ write_setgroups(proc_dir_fd, allow_setgroups); - write_mapping(proc_dir_fd, ranges, mappings, "gid_map"); - sub_gid_close(); - diff --git a/shadow/Pkgfile b/shadow/Pkgfile index e793f3c5..ffb0dad1 100644 --- a/shadow/Pkgfile +++ b/shadow/Pkgfile @@ -4,18 +4,14 @@ # Depends on: acl name=shadow -version=4.5 -release=2 +version=4.6 +release=1 source=(https://github.com/shadow-maint/shadow/releases/download/$version/s… - CVE-2018-7169.patch pwck login.defs) build() { cd $name-$version - # https://bugs.launchpad.net/ubuntu/+source/shadow/+bug/1729357 - patch -p1 -i $SRC/CVE-2018-7169.patch - ./configure --prefix=/usr \ --sysconfdir=/etc \ --disable-shared \

1 0