March 2024 - CRUX - lists.crux.nu

ports/core (3.7): [notify] xz: 5.6.1 -> 5.4.6; cautious measure: downgraded due to CVE-2024-3094, see https://tukaani.org/xz-backdoor/
by crux＠crux.nu 30 Mar '24

30 Mar '24

Commit hash: eaf4f3daa760252966577d3fde803dbfda90b2d2 Author: Tim Biermann <tbier(a)posteo.de> Date: Sat Mar 30 06:42:37 2024 UTC+01:00 URL: https://git.crux.nu/ports/core/commit/eaf4f3daa760252966577d3fde803dbfda90b… Commit message: [notify] xz: 5.6.1 -> 5.4.6; cautious measure: downgraded due to CVE-2024-3094, see https://tukaani.org/xz-backdoor/

1 0

pkgutils .. and zst(d)
by Steffen Nurpmeso 29 Mar '24

29 Mar '24

Hello. Works fine, and zstd:threads=0 seems to at least have an issue. Please do this! Super fast by default, and almost as good compression as xz with -22. Btw.: #?0|kent:core$ git grep -i http:|grep -v ^COPY|grep :source=|wc -l 12 ^ Especially this would be nice, since who really does check GPG or whatever signature of upstream when updating the package. #?0|kent:core$ cd ../opt/ #?0|kent:opt$ git grep -i http:|grep -v ^COPY|grep :source=|wc -l 59 #?0|kent:opt$ cd ../contrib/ #?0|kent:contrib$ git grep -i http:|grep -v ^COPY|grep :source=|wc -l 52 Thanks for CRUX everybody! I love it each and every day!! diff -u pkgutils-5.40.10.old/pkgmk.8.in pkgutils-5.40.10/pkgmk.8.in --- pkgutils-5.40.10.old/pkgmk.8.in 2023-02-03 17:32:32.000000000 +0100 +++ pkgutils-5.40.10/pkgmk.8.in 2024-03-29 23:19:17.967541141 +0100 @@ -5,7 +5,8 @@ \fBpkgmk [options]\fP .SH DESCRIPTION \fBpkgmk\fP is a \fIpackage management\fP utility, which makes -a software package. A \fIpackage\fP is an archive of files (.pkg.tar.gz, .pkg.tar.bz2 or .pkg.tar.xz) +a software package. A \fIpackage\fP is an archive of files +(.pkg.tar.gz, .pkg.tar.bz2, .pkg.tar.xz, or .pkg.tar.zst) that can be installed using pkgadd(8). To prepare to use pkgmk, you must write a file named \fIPkgfile\fP @@ -151,6 +152,7 @@ .SH SEE ALSO pkgmk.conf(5), pkgadd(8), pkgrm(8), pkginfo(8), rejmerge(8), signify(1), curl(1), wget(1) .SH COPYRIGHT -pkgmk (pkgutils) is Copyright (c) 2000-2005 Per Liden and Copyright (c) 2006-2021 CRUX team (http://crux.nu) +pkgmk (pkgutils) is Copyright (c) 2000-2005 Per Liden +and Copyright (c) 2006-2024 CRUX team (https://crux.nu) pkgmk (pkgutils) is licensed through the GNU General Public License. Read the COPYING file for the complete license. diff -u pkgutils-5.40.10.old/pkgmk.conf pkgutils-5.40.10/pkgmk.conf --- pkgutils-5.40.10.old/pkgmk.conf 2023-02-03 17:32:32.000000000 +0100 +++ pkgutils-5.40.10/pkgmk.conf 2024-03-29 23:15:47.774211828 +0100 @@ -38,4 +38,10 @@ # PKGMK_CURL_OPTS="" # PKGMK_COMPRESSION_MODE="gz" +#if [ "$PKGMK_COMPRESSION_MODE" = xz ]; then +# export TAR_WRITER_OPTIONS=xz:threads=${JOBS} +#elif [ "$PKGMK_COMPRESSION_MODE" = zst ]; then +# export TAR_WRITER_OPTIONS=zstd:threads=${JOBS},zstd:compression-level=22 +#fi + # End of file diff -u pkgutils-5.40.10.old/pkgmk.conf.5.in pkgutils-5.40.10/pkgmk.conf.5.in --- pkgutils-5.40.10.old/pkgmk.conf.5.in 2023-02-03 17:32:32.000000000 +0100 +++ pkgutils-5.40.10/pkgmk.conf.5.in 2024-03-29 23:19:01.924208113 +0100 @@ -84,12 +84,14 @@ Default: 'no' .TP \fBPKGMK_COMPRESSION_MODE='STRING'\fP -Option to select the mode used to compress the packages. Valid strings are gz, bz2, xz and lz. +Option to select the mode used to compress the packages. +Valid strings are gz, bz2, xz, lz and zst. .br Default: 'gz' .SH SEE ALSO pkgmk(8) .SH COPYRIGHT -pkgmk (pkgutils) is Copyright (c) 2000-2005 Per Liden and Copyright (c) 2006-2021 CRUX team (http://crux.nu) +pkgmk (pkgutils) is Copyright (c) 2000-2005 Per Liden +and Copyright (c) 2006-2024 CRUX team (https://crux.nu) pkgmk (pkgutils) is licensed through the GNU General Public License. Read the COPYING file for the complete license. diff -u pkgutils-5.40.10.old/pkgmk.in pkgutils-5.40.10/pkgmk.in --- pkgutils-5.40.10.old/pkgmk.in 2023-02-03 17:32:32.000000000 +0100 +++ pkgutils-5.40.10/pkgmk.in 2024-03-29 23:18:13.227542376 +0100 @@ -3,7 +3,7 @@ # pkgutils # # Copyright (c) 2000-2005 Per Liden -# Copyright (c) 2006-2021 by CRUX team (http://crux.nu) +# Copyright (c) 2006-2024 by CRUX team (https://crux.nu) # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by @@ -208,7 +208,7 @@ RENAME="${renames[$srcind]}" [ -n "$RENAME" -a "$RENAME" != "SKIP" ] && LOCAL_FILE="$PKGMK_SOURCE_DIR/$RENAME" case $LOCAL_FILE in - *.tar|*.tar.gz|*.tar.Z|*.tgz|*.tar.bz2|*.tbz2|*.tar.xz|*.txz|*.tar.lzma|*.tar.lz|*.zip|*.rpm|*.7z) + *.tar|*.tar.gz|*.tar.Z|*.tgz|*.tar.bz2|*.tbz2|*.tar.xz|*.txz|*.tar.lzma|*.tar.lz|*.tar.zst|*.tzst|**.zip|*.rpm|*.7z) COMMAND="bsdtar -p -o -C $SRC -xf $LOCAL_FILE" ;; *) COMMAND="cp $LOCAL_FILE $SRC" ;; @@ -591,6 +591,7 @@ bz2) COMPRESSION="-j" ;; xz) COMPRESSION="-J" ;; lz) COMPRESSION="--lzip" ;; + zst) COMPRESSION=--zstd;; esac bsdtar --format=gnutar -c $COMPRESSION -f $TARGET * && bsdtar -t -v -f $TARGET @@ -879,7 +880,7 @@ check_pkgfile case $PKGMK_COMPRESSION_MODE in - gz|bz2|xz|lz) + gz|bz2|xz|lz|zst) TARGET="$PKGMK_PACKAGE_DIR/$name#$version-$release.pkg.tar.$PKGMK_COMPRESSION_MODE" ;; *) diff -u pkgutils-5.40.10.old/pkgutil.cc pkgutils-5.40.10/pkgutil.cc --- pkgutils-5.40.10.old/pkgutil.cc 2023-02-03 17:32:32.000000000 +0100 +++ pkgutils-5.40.10/pkgutil.cc 2024-03-29 23:17:45.570876238 +0100 @@ -2,7 +2,7 @@ // pkgutils // // Copyright (c) 2000-2005 Per Liden -// Copyright (c) 2006-2021 by CRUX team (http://crux.nu) +// Copyright (c) 2006-2024 by CRUX team (https://crux.nu) // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -48,6 +48,7 @@ archive_read_support_filter_bzip2((ar)); \ archive_read_support_filter_xz((ar)); \ archive_read_support_filter_lzip((ar)); \ + archive_read_support_filter_zstd((ar)); \ archive_read_support_format_tar((ar)) #define DEFAULT_BYTES_PER_BLOCK (20 * 512) --steffen | |Der Kragenbaer, The moon bear, |der holt sich munter he cheerfully and one by one |einen nach dem anderen runter wa.ks himself off |(By Robert Gernhardt)

1 1

ports/core (3.7): [notify] curl: updated to version 8.7.1, several security fixes
by crux＠crux.nu 27 Mar '24

27 Mar '24

Commit hash: 4bc15030b32a7531145baab6623bb828601238fc Author: Juergen Daubert <jue(a)jue.li> Date: Wed Mar 27 10:44:30 2024 UTC+01:00 URL: https://git.crux.nu/ports/core/commit/4bc15030b32a7531145baab6623bb82860123… Commit message: [notify] curl: updated to version 8.7.1, several security fixes

1 0

ports/core (3.7): [notify] python3: updated to version 3.10.14, security fixes
by crux＠crux.nu 25 Mar '24

25 Mar '24

Commit hash: 7b602bebcdaf050ca1f79a324f458ac9f60f1848 Author: Juergen Daubert <jue(a)jue.li> Date: Mon Mar 25 10:43:20 2024 UTC+01:00 URL: https://git.crux.nu/ports/core/commit/7b602bebcdaf050ca1f79a324f458ac9f60f1… Commit message: [notify] python3: updated to version 3.10.14, security fixes see https://pythoninsider.blogspot.com/2024/03/python-31014-3919-and-3819-is-no…

1 0

Thoughts on making Crux more `alive' and `attractive'.
by Hans Bezemer 16 Mar '24

16 Mar '24

Dear fellow Crux-users, Recently there was some discussion in the IRC channel about how to make crux more `alive' and `attractive'. Being a relative new user I would like to share my thoughts. First of all, Crux has a lot of good things to offer: It's simplicity and script based orientation are unique. The package management through ports is simple but effective. Also there is some good documentation (but may be improved). And (last but not least) there's a friendly and helpful community. When I started out with Crux it took a while before I had everything up and running. Although I had used Arch for some while, went through the LFS-book twice, there was still a lot of ground to make up before I had my laptop configured the same way when using Arch. I had to hone several skills: building my own kernel, creating some udev rules, setting up networking using wpa_supplicant only (I know nm is at hand) and so on. Although the somewhat steep learning curve belongs to the way Crux works, there can be some minor improvements made which may help newcomers finding their way around more easily. First of, maybe Crux can become a rolling distro, with a new iso every month / 2 months. In practice it already seems to be. There are unofficial updated iso's and once you got everything installed everything can be kept up-to-date. As a new user I used the official iso (which is good practice I think), but after building the kernel, running a sysup was a bit of a showstopper. Almost all of the packages needed to be updated. When using the more recent unofficial iso, this is obvious not the case. Secondly, there is a lot of good documentation -especially on the Crux specific parts- but having two sources (Handbook and wiki) is somewhat confusing sometimes. Maybe merge the handbook into the wiki with an entry for installing Crux (like the installation guide on the Arch wiki)? The guide will walk the new user through a basic installation with links to several options (e.q. encrypting harddrive, using different bootloaders). At the end of the guide there can be some links to other entry (how to install packages, e.d.). It would be helpful if there is a basic `how to compile your own kernel'-tutorial. Something along the lines of `make defconfig', enabling audio and video support, untick some of the wlan firmware drivers, etc. Copying the bzImage and System.map and updating the boatloader. Lastly a guide on creating and maintaining your own repo (which is part of the charm of using Crux I think), would be very helpful. Beerman / Tim's guide would be a great starting point IMHO. https://gist.github.com/TimB87/6cf010c0c10d67faf98ae03e62ffb029 As for the documentation, for the most part it's a matter of reorganizing. Maybe a `further reading' section can be added at the end of an entry, with links to useful sources like the Arch wiki / offical kernel documentation and so on. The goal here is to keep it simple (of course ;-)) I'll be happy to help out with (re)writing some parts. What do you think? Would this be helpful? Or are there other / better options? Kind regards, Hans

9 13

ports/opt (3.7): [notify] qt6-base: moved a lot of dependencies to optionals, use pkgfoster and rebuild where you see fit
by crux＠crux.nu 13 Mar '24

13 Mar '24

Commit hash: fbd5a61644902bc899667321f7ab29ca472aefc4 Author: Tim Biermann <tbier(a)posteo.de> Date: Wed Mar 13 07:23:53 2024 UTC+01:00 URL: https://git.crux.nu/ports/opt/commit/fbd5a61644902bc899667321f7ab29ca472aef… Commit message: [notify] qt6-base: moved a lot of dependencies to optionals, use pkgfoster and rebuild where you see fit

1 0

ports/contrib (3.7): [notify] go: updated to version 1.22.1, security release
by crux＠crux.nu 09 Mar '24

09 Mar '24

Commit hash: cf42cdbc3e08a6e3233259157ac60dc319ec2f11 Author: Matt Housh <jaeger(a)crux.ninja> Date: Sat Mar 09 10:24:34 2024 UTC-06:00 URL: https://git.crux.nu/ports/contrib/commit/cf42cdbc3e08a6e3233259157ac60dc319… Commit message: [notify] go: updated to version 1.22.1, security release Fixes numerous CVEs, see the following for info: https://github.com/golang/go/issues?q=milestone%3AGo1.22.1+label%3ACherryPi… https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45289 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45290 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24783 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24784 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24785 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24786

1 0

ports/opt (3.7): [notify] glib: updated to version 2.80.0, new dependency python3-packaging
by crux＠crux.nu 08 Mar '24

08 Mar '24

Commit hash: efebae40d063d48b3bd798a75df17004c6166d97 Author: Juergen Daubert <jue(a)jue.li> Date: Fri Mar 08 12:57:43 2024 UTC+01:00 URL: https://git.crux.nu/ports/opt/commit/efebae40d063d48b3bd798a75df17004c6166d… Commit message: [notify] glib: updated to version 2.80.0, new dependency python3-packaging

1 0

ports/opt (3.7): [notify] unbound: updated to version 1.19.2, fix for CVE-2024-1931
by crux＠crux.nu 07 Mar '24

07 Mar '24

Commit hash: 44c6e5e93e8b6d29b573e458a139599fffc5470d Author: Juergen Daubert <jue(a)jue.li> Date: Thu Mar 07 11:40:07 2024 UTC+01:00 URL: https://git.crux.nu/ports/opt/commit/44c6e5e93e8b6d29b573e458a139599fffc547… Commit message: [notify] unbound: updated to version 1.19.2, fix for CVE-2024-1931 see https://lists.nlnetlabs.nl/pipermail/unbound-users/2024-March/008262.html

1 0

Package signatures and bin86
by Wawrzek Niewodniczanski 04 Mar '24

04 Mar '24

Hello, I noticed that the gnuplot and icu packages have problem with signatures (more details below). They are both from opt, so I don't want just ignore signatures. Also, the bin86 cannot be built. Seem that the author left GitHub. New location of the source is here: https://codeberg.org/jbruchon/dev86 . I created a ticket for the last issue and can create for another ones. Thanks, Wawrzek λ titan bin → prt-get update gnuplot prt-get: updating /usr/ports/opt/gnuplot =======> ERROR: Signature mismatch found: MISMATCH Pkgfile =======> ERROR: Building '/usr/ports/opt/gnuplot/gnuplot#6.0.0-1.pkg.tar.gz' failed. -- Packages where update failed gnuplot λ titan bin → prt-get update icu prt-get: updating /usr/ports/opt/icu =======> ERROR: Signature mismatch found: MISMATCH icu4c-74_2-src.tgz =======> ERROR: Building '/usr/ports/opt/icu/icu#74.2-1.pkg.tar.gz' failed. -- Packages where update failed icu -- Dr Wawrzyniec Niewodniczański or Wawrzek for short PhD in Quantum Chemistry & MSc in Molecular Engineering WWW: http://wawrzek.name E-MAIL: jobs(a)wawrzek.name Linux User #177124

1 0