- CRUX - lists.crux.nu

ports/xorg (3.7): [notify] xorg-server: security update to version 21.1.11
by crux＠crux.nu 16 Jan '24

16 Jan '24

commit 9bcdb7fdd0e9a94ef717f37043c29881be41eaaf Author: Juergen Daubert <jue(a)jue.li> Date: Tue Jan 16 13:16:20 2024 +0100 [notify] xorg-server: security update to version 21.1.11 see - https://lists.x.org/archives/xorg-announce/2024-January/003442.html - https://lists.x.org/archives/xorg/2024-January/061525.html diff --git a/xorg-server/.signature b/xorg-server/.signature index 25f97e9e..0036862b 100644 --- a/xorg-server/.signature +++ b/xorg-server/.signature @@ -1,5 +1,5 @@ untrusted comment: verify with /etc/ports/xorg.pub -RWTSGWF5Q7TndAeEtNMkK3dq5P3J3i3w1Ny+ktg1X/L9hYrwdWou7z0zlRkkFaCs5SeL25dtMRgvwJVXMoIFv3kfSlQw85y2FgQ= -SHA256 (Pkgfile) = b58ae9de9d9c3bc203137f89eb267cfa8c99e6a3e65335c7f8275953f51555ae +RWTSGWF5Q7TndGL9AYiDyCWSBDXVfNU+OQFdAKWhLuSqdt9G3rWqDQ9FUk3F9E2JbyTQ3wlq92kZdkeGfOMH1wq8BDwykuZQ+wE= +SHA256 (Pkgfile) = 4b24800caf1582e34eca46df6d52e328cae5bf7be3dc994b74ef54cf9f213828 SHA256 (.footprint) = dc68ebbbcdee4d11d5cadac3f5a585be9acead28db713408e60222dd01d8c8c7 -SHA256 (xorg-server-21.1.10.tar.xz) = ceb0b3a2efc57ac3ccf388d3dc88b97615068639fb284d469689ae3d105611d0 +SHA256 (xorg-server-21.1.11.tar.xz) = 1d3dadbd57fb86b16a018e9f5f957aeeadf744f56c0553f55737628d06d326ef diff --git a/xorg-server/Pkgfile b/xorg-server/Pkgfile index 42eb632d..6cc0da3e 100644 --- a/xorg-server/Pkgfile +++ b/xorg-server/Pkgfile @@ -4,7 +4,7 @@ # Depends on: libepoxy nettle xorg-bdftopcf xorg-font-util xorg-libxaw xorg-libxcomposite xorg-libxcursor xorg-libxcvt xorg-libxfont2 xorg-libxft xorg-libxinerama xorg-libxres xorg-libxtst xorg-mkfontscale xorg-xcb-util-keysyms xorg-xkbcomp name=xorg-server -version=21.1.10 +version=21.1.11 release=1 source=(https://www.x.org/releases/individual/xserver/$name-$version.tar.xz)

1 0

ports/core (3.7): [notify] glibc: pulled commits from upstream, fix for CVE-2023-4806
by crux＠crux.nu 14 Jan '24

14 Jan '24

commit 1d82db8751afdc62d4598cc0b3e27aa5900fe92c Author: Tim Biermann <tbier(a)posteo.de> Date: Sun Jan 14 11:36:33 2024 +0100 [notify] glibc: pulled commits from upstream, fix for CVE-2023-4806 diff --git a/glibc/.signature b/glibc/.signature index 0af7bcbe..cc09fd96 100644 --- a/glibc/.signature +++ b/glibc/.signature @@ -1,10 +1,10 @@ untrusted comment: verify with /etc/ports/core.pub -RWRJc1FUaeVeqpoW2OjCDQ3pK1hhqCCUSYuX9ciV1KAwTYdVuCv2RJf3OhZnimlfsBVUR/o0d8Asuyu4xcDxPYBt7fy7gMe/BAI= -SHA256 (Pkgfile) = a7ea5f73724ac39fc56dda2879c73fd72c04e378b5694035d5ca8feea914ac92 +RWRJc1FUaeVeqnXAHCjzBaV3UybbGrGs0ZsT2e5IygAmAXt1moVQwX7ieVJChxNrbMTmAPexHOWHS6nLiYNWoNmGnb619GvU+wE= +SHA256 (Pkgfile) = fa3878caf7961200bf8479e2b6d2144782ab58a63f92da278bf529ff957336d0 SHA256 (.footprint) = 9eff4b9e8478995dd0aceacfe9301a250827c8b27cb1d4605c696ac55eec873c SHA256 (glibc-2.36.tar.xz) = 1c959fea240906226062cb4b1e7ebce71a9f0e3c0836c09e7e3423d434fcfe75 SHA256 (linux-5.15.55.tar.xz) = 1ef6bd508b6c3af3bef2d5b337e4477254dba284c79e329aa38f9763ae3bfdcc -SHA256 (glibc-2.36-7.patch) = c167ddd1eb9e63fade7e60a2dc612a18e0900519d8c0ec1e0cf06fa92fca638a +SHA256 (glibc-2.36-8.patch) = df6b79339aa767fa3bea1443e1908ea124084b8eeee9e94ab03cc3afab0e4354 SHA256 (hosts) = 5c02b256c105f1d4a12fb738d71c1bab9eb126533074d7a0c8a14b92670c9431 SHA256 (resolv.conf) = 72ccb58768a72a771ec37142bc361a18478a07ec9de6e925a20760794389bf51 SHA256 (nsswitch.conf) = 859b8984e5e90aff3cce8f9779996ae4033b280d2122840e9411e2f44a1c2e61 diff --git a/glibc/Pkgfile b/glibc/Pkgfile index c2e731d7..be247780 100644 --- a/glibc/Pkgfile +++ b/glibc/Pkgfile @@ -4,12 +4,12 @@ name=glibc version=2.36 -release=7 +release=8 _kernel_version=5.15.55 source=(https://ftp.gnu.org/gnu/glibc/glibc-$version.tar.xz https://www.kernel.org/pub/linux/kernel/v5.x/linux-$_kernel_version.tar.xz - glibc-$version-7.patch + glibc-$version-8.patch hosts resolv.conf nsswitch.conf host.conf ld.so.conf locale-gen locale.gen.in) @@ -19,7 +19,7 @@ build() { make -C $SRC/linux-$_kernel_version INSTALL_HDR_PATH=$PKG/usr headers_install chown root:root $PKG/usr - patch -p1 -d $SRC/$name-${version:0:4} -i $SRC/$name-$version-7.patch + patch -p1 -d $SRC/$name-${version:0:4} -i $SRC/$name-$version-8.patch mkdir $SRC/build cd $SRC/build diff --git a/glibc/glibc-2.36-7.patch b/glibc/glibc-2.36-8.patch similarity index 94% rename from glibc/glibc-2.36-7.patch rename to glibc/glibc-2.36-8.patch index ad5972b3..df41fa4b 100644 --- a/glibc/glibc-2.36-7.patch +++ b/glibc/glibc-2.36-8.patch @@ -66,10 +66,10 @@ index d1e139d03c..09c0cf8357 100644 else # -s verbose := diff --git a/NEWS b/NEWS -index f61e521fc8..5358e0cbe3 100644 +index f61e521fc8..0f0ebce3f0 100644 --- a/NEWS +++ b/NEWS -@@ -5,6 +5,90 @@ See the end for copying conditions. +@@ -5,6 +5,94 @@ See the end for copying conditions. Please send GNU C library bug reports via <https://sourceware.org/bugzilla/> using `glibc' in the "product" field. @@ -116,6 +116,7 @@ index f61e521fc8..5358e0cbe3 100644 + [24816] Fix tst-nss-files-hosts-long on single-stack hosts + [27576] gmon: improve mcount overflow handling + [28846] CMSG_NXTHDR may trigger -Wstrict-overflow warning ++ [29039] Corrupt DTV after reuse of a TLS module ID following dlclose with unused TLS + [29444] gmon: Fix allocated buffer overflow (bug 29444) + [29864] libc: __libc_start_main() should obtain program headers + address (_dl_phdr) from the auxv, not the ELF header. @@ -152,10 +153,13 @@ index f61e521fc8..5358e0cbe3 100644 + [30305] x86_64: Fix asm constraints in feraiseexcept + [30477] libc: [RISCV]: time64 does not work on riscv32 + [30515] _dl_find_object incorrectly returns 1 during early startup -+ [30785] Always call destructors in reverse constructor order ++ [30745] Slight bug in cache info codes for x86 + [30804] F_GETLK, F_SETLK, and F_SETLKW value change for powerpc64 with + -D_FILE_OFFSET_BITS=64 + [30842] Stack read overflow in getaddrinfo in no-aaaa mode (CVE-2023-4527) ++ [30843] potential use-after-free in getcanonname (CVE-2023-4806) ++ [31184] FAIL: elf/tst-tlsgap ++ [31185] Incorrect thread point access in _dl_tlsdesc_undefweak and _dl_tlsdesc_dynamic + Version 2.36 @@ -504,7 +508,7 @@ index 0000000000..9e7ba10fa2 + DL_CALL_DT_FINI (map, ((void *) map->l_addr + fini->d_un.d_ptr)); +} diff --git a/elf/dl-close.c b/elf/dl-close.c -index bcd6e206e9..640bbd88c3 100644 +index bcd6e206e9..14deca2e2b 100644 --- a/elf/dl-close.c +++ b/elf/dl-close.c @@ -36,11 +36,6 @@ @@ -551,126 +555,10 @@ index bcd6e206e9..640bbd88c3 100644 void _dl_close_worker (struct link_map *map, bool force) { -@@ -168,30 +138,31 @@ _dl_close_worker (struct link_map *map, bool force) - - bool any_tls = false; - const unsigned int nloaded = ns->_ns_nloaded; -- struct link_map *maps[nloaded]; - -- /* Run over the list and assign indexes to the link maps and enter -- them into the MAPS array. */ -+ /* Run over the list and assign indexes to the link maps. */ - int idx = 0; - for (struct link_map *l = ns->_ns_loaded; l != NULL; l = l->l_next) - { - l->l_map_used = 0; - l->l_map_done = 0; - l->l_idx = idx; -- maps[idx] = l; - ++idx; - } - assert (idx == nloaded); - -- /* Keep track of the lowest index link map we have covered already. */ -- int done_index = -1; -- while (++done_index < nloaded) -+ /* Keep marking link maps until no new link maps are found. */ -+ for (struct link_map *l = ns->_ns_loaded; l != NULL; ) - { -- struct link_map *l = maps[done_index]; -+ /* next is reset to earlier link maps for remarking. */ -+ struct link_map *next = l->l_next; -+ int next_idx = l->l_idx + 1; /* next->l_idx, but covers next == NULL. */ - - if (l->l_map_done) -- /* Already handled. */ -- continue; -+ { -+ /* Already handled. */ -+ l = next; -+ continue; -+ } - - /* Check whether this object is still used. */ - if (l->l_type == lt_loaded -@@ -201,7 +172,10 @@ _dl_close_worker (struct link_map *map, bool force) - acquire is sufficient and correct. */ - && atomic_load_acquire (&l->l_tls_dtor_count) == 0 - && !l->l_map_used) -- continue; -+ { -+ l = next; -+ continue; -+ } - - /* We need this object and we handle it now. */ - l->l_map_used = 1; -@@ -228,8 +202,11 @@ _dl_close_worker (struct link_map *map, bool force) - already processed it, then we need to go back - and process again from that point forward to - ensure we keep all of its dependencies also. */ -- if ((*lp)->l_idx - 1 < done_index) -- done_index = (*lp)->l_idx - 1; -+ if ((*lp)->l_idx < next_idx) -+ { -+ next = *lp; -+ next_idx = next->l_idx; -+ } - } - } - -@@ -249,54 +226,65 @@ _dl_close_worker (struct link_map *map, bool force) - if (!jmap->l_map_used) - { - jmap->l_map_used = 1; -- if (jmap->l_idx - 1 < done_index) -- done_index = jmap->l_idx - 1; -+ if (jmap->l_idx < next_idx) -+ { -+ next = jmap; -+ next_idx = next->l_idx; -+ } - } - } - } -- } - -- /* Sort the entries. We can skip looking for the binary itself which is -- at the front of the search list for the main namespace. */ -- _dl_sort_maps (maps, nloaded, (nsid == LM_ID_BASE), true); -+ l = next; -+ } - -- /* Call all termination functions at once. */ -- bool unload_any = false; -- bool scope_mem_left = false; -- unsigned int unload_global = 0; -- unsigned int first_loaded = ~0; -- for (unsigned int i = 0; i < nloaded; ++i) -+ /* Call the destructors in reverse constructor order, and remove the -+ closed link maps from the list. */ -+ for (struct link_map **init_called_head = &_dl_init_called_list; -+ *init_called_head != NULL; ) - { -- struct link_map *imap = maps[i]; -- -- /* All elements must be in the same namespace. */ -- assert (imap->l_ns == nsid); -+ struct link_map *imap = *init_called_head; - -- if (!imap->l_map_used) -+ /* _dl_init_called_list is global, to produce a global odering. -+ Ignore the other namespaces (and link maps that are still used). */ -+ if (imap->l_ns != nsid || imap->l_map_used) -+ init_called_head = &imap->l_init_called_next; -+ else - { - assert (imap->l_type == lt_loaded && !imap->l_nodelete_active); - -- /* Call its termination function. Do not do it for -- half-cooked objects. Temporarily disable exception -- handling, so that errors are fatal. */ -- if (imap->l_init_called) +@@ -280,17 +250,7 @@ _dl_close_worker (struct link_map *map, bool force) + half-cooked objects. Temporarily disable exception + handling, so that errors are fatal. */ + if (imap->l_init_called) - { - /* When debugging print a message first. */ - if (__builtin_expect (GLRO(dl_debug_mask) & DL_DEBUG_IMPCALLS, @@ -682,88 +570,10 @@ index bcd6e206e9..640bbd88c3 100644 - || imap->l_info[DT_FINI] != NULL) - _dl_catch_exception (NULL, call_destructors, imap); - } -+ /* _dl_init_called_list is updated at the same time as -+ l_init_called. */ -+ assert (imap->l_init_called); -+ -+ if (imap->l_info[DT_FINI_ARRAY] != NULL -+ || imap->l_info[DT_FINI] != NULL) + _dl_catch_exception (NULL, _dl_call_fini, imap); #ifdef SHARED /* Auditing checkpoint: we remove an object. */ - _dl_audit_objclose (imap); - #endif -+ /* Unlink this link map. */ -+ *init_called_head = imap->l_init_called_next; -+ } -+ } -+ - -+ bool unload_any = false; -+ bool scope_mem_left = false; -+ unsigned int unload_global = 0; -+ -+ /* For skipping un-unloadable link maps in the second loop. */ -+ struct link_map *first_loaded = ns->_ns_loaded; -+ -+ /* Iterate over the namespace to find objects to unload. Some -+ unloadable objects may not be on _dl_init_called_list due to -+ dlopen failure. */ -+ for (struct link_map *imap = first_loaded; imap != NULL; imap = imap->l_next) -+ { -+ if (!imap->l_map_used) -+ { - /* This object must not be used anymore. */ - imap->l_removed = 1; - -@@ -307,8 +295,8 @@ _dl_close_worker (struct link_map *map, bool force) - ++unload_global; - - /* Remember where the first dynamically loaded object is. */ -- if (i < first_loaded) -- first_loaded = i; -+ if (first_loaded == NULL) -+ first_loaded = imap; - } - /* Else imap->l_map_used. */ - else if (imap->l_type == lt_loaded) -@@ -444,8 +432,8 @@ _dl_close_worker (struct link_map *map, bool force) - imap->l_loader = NULL; - - /* Remember where the first dynamically loaded object is. */ -- if (i < first_loaded) -- first_loaded = i; -+ if (first_loaded == NULL) -+ first_loaded = imap; - } - } - -@@ -516,10 +504,11 @@ _dl_close_worker (struct link_map *map, bool force) - - /* Check each element of the search list to see if all references to - it are gone. */ -- for (unsigned int i = first_loaded; i < nloaded; ++i) -+ for (struct link_map *imap = first_loaded; imap != NULL; ) - { -- struct link_map *imap = maps[i]; -- if (!imap->l_map_used) -+ if (imap->l_map_used) -+ imap = imap->l_next; -+ else - { - assert (imap->l_type == lt_loaded); - -@@ -730,7 +719,9 @@ _dl_close_worker (struct link_map *map, bool force) - if (imap == GL(dl_initfirst)) - GL(dl_initfirst) = NULL; - -+ struct link_map *next = imap->l_next; - free (imap); -+ imap = next; - } - } - diff --git a/elf/dl-find_object.c b/elf/dl-find_object.c index 4d5831b6f4..2e5b456c11 100644 --- a/elf/dl-find_object.c @@ -778,10 +588,10 @@ index 4d5831b6f4..2e5b456c11 100644 /* Object not found. */ diff --git a/elf/dl-fini.c b/elf/dl-fini.c -index 030b1fcbcd..50087a1bfc 100644 +index 030b1fcbcd..50ff94db16 100644 --- a/elf/dl-fini.c +++ b/elf/dl-fini.c -@@ -21,155 +21,71 @@ +@@ -21,11 +21,6 @@ #include <ldsodefs.h> #include <elf-initfini.h> @@ -793,122 +603,10 @@ index 030b1fcbcd..50087a1bfc 100644 void _dl_fini (void) { -- /* Lots of fun ahead. We have to call the destructors for all still -- loaded objects, in all namespaces. The problem is that the ELF -- specification now demands that dependencies between the modules -- are taken into account. I.e., the destructor for a module is -- called before the ones for any of its dependencies. -- -- To make things more complicated, we cannot simply use the reverse -- order of the constructors. Since the user might have loaded objects -- using `dlopen' there are possibly several other modules with its -- dependencies to be taken into account. Therefore we have to start -- determining the order of the modules once again from the beginning. */ -- -- /* We run the destructors of the main namespaces last. As for the -- other namespaces, we pick run the destructors in them in reverse -- order of the namespace ID. */ -+ /* Call destructors strictly in the reverse order of constructors. -+ This causes fewer surprises than some arbitrary reordering based -+ on new (relocation) dependencies. None of the objects are -+ unmapped, so applications can deal with this if their DSOs remain -+ in a consistent state after destructors have run. */ -+ -+ /* Protect against concurrent loads and unloads. */ -+ __rtld_lock_lock_recursive (GL(dl_load_lock)); -+ -+ /* Ignore objects which are opened during shutdown. */ -+ struct link_map *local_init_called_list = _dl_init_called_list; -+ -+ for (struct link_map *l = local_init_called_list; l != NULL; -+ l = l->l_init_called_next) -+ /* Bump l_direct_opencount of all objects so that they -+ are not dlclose()ed from underneath us. */ -+ ++l->l_direct_opencount; -+ -+ /* After this point, everything linked from local_init_called_list -+ cannot be unloaded because of the reference counter update. */ -+ __rtld_lock_unlock_recursive (GL(dl_load_lock)); -+ -+ /* Perform two passes: One for non-audit modules, one for audit -+ modules. This way, audit modules receive unload notifications -+ for non-audit objects, and the destructors for audit modules -+ still run. */ - #ifdef SHARED -- int do_audit = 0; -- again: -+ int last_pass = GLRO(dl_naudit) > 0; -+ Lmid_t last_ns = -1; -+ for (int do_audit = 0; do_audit <= last_pass; ++do_audit) - #endif -- for (Lmid_t ns = GL(dl_nns) - 1; ns >= 0; --ns) -- { -- /* Protect against concurrent loads and unloads. */ -- __rtld_lock_lock_recursive (GL(dl_load_lock)); -- -- unsigned int nloaded = GL(dl_ns)[ns]._ns_nloaded; -- /* No need to do anything for empty namespaces or those used for -- auditing DSOs. */ -- if (nloaded == 0 --#ifdef SHARED -- || GL(dl_ns)[ns]._ns_loaded->l_auditing != do_audit --#endif -- ) -- __rtld_lock_unlock_recursive (GL(dl_load_lock)); -- else -- { --#ifdef SHARED -- _dl_audit_activity_nsid (ns, LA_ACT_DELETE); --#endif -- -- /* Now we can allocate an array to hold all the pointers and -- copy the pointers in. */ -- struct link_map *maps[nloaded]; -- -- unsigned int i; -- struct link_map *l; -- assert (nloaded != 0 || GL(dl_ns)[ns]._ns_loaded == NULL); -- for (l = GL(dl_ns)[ns]._ns_loaded, i = 0; l != NULL; l = l->l_next) -- /* Do not handle ld.so in secondary namespaces. */ -- if (l == l->l_real) -- { -- assert (i < nloaded); -- -- maps[i] = l; -- l->l_idx = i; -- ++i; -- -- /* Bump l_direct_opencount of all objects so that they -- are not dlclose()ed from underneath us. */ -- ++l->l_direct_opencount; -- } -- assert (ns != LM_ID_BASE || i == nloaded); -- assert (ns == LM_ID_BASE || i == nloaded || i == nloaded - 1); -- unsigned int nmaps = i; -- -- /* Now we have to do the sorting. We can skip looking for the -- binary itself which is at the front of the search list for -- the main namespace. */ -- _dl_sort_maps (maps, nmaps, (ns == LM_ID_BASE), true); -- -- /* We do not rely on the linked list of loaded object anymore -- from this point on. We have our own list here (maps). The -- various members of this list cannot vanish since the open -- count is too high and will be decremented in this loop. So -- we release the lock so that some code which might be called -- from a destructor can directly or indirectly access the -- lock. */ -- __rtld_lock_unlock_recursive (GL(dl_load_lock)); -- -- /* 'maps' now contains the objects in the right order. Now -- call the destructors. We have to process this array from -- the front. */ -- for (i = 0; i < nmaps; ++i) -- { -- struct link_map *l = maps[i]; -- -- if (l->l_init_called) -- { +@@ -116,38 +111,7 @@ _dl_fini (void) + + if (l->l_init_called) + { - /* Make sure nothing happens if we are called twice. */ - l->l_init_called = 0; - @@ -941,54 +639,10 @@ index 030b1fcbcd..50087a1bfc 100644 - (l, l->l_addr + l->l_info[DT_FINI]->d_un.d_ptr); - } - -+ for (struct link_map *l = local_init_called_list; l != NULL; -+ l = l->l_init_called_next) -+ { - #ifdef SHARED -- /* Auditing checkpoint: another object closed. */ -- _dl_audit_objclose (l); -+ if (GL(dl_ns)[l->l_ns]._ns_loaded->l_auditing != do_audit) -+ continue; -+ -+ /* Avoid back-to-back calls of _dl_audit_activity_nsid for the -+ same namespace. */ -+ if (last_ns != l->l_ns) -+ { -+ if (last_ns >= 0) -+ _dl_audit_activity_nsid (last_ns, LA_ACT_CONSISTENT); -+ _dl_audit_activity_nsid (l->l_ns, LA_ACT_DELETE); -+ last_ns = l->l_ns; -+ } - #endif -- } - -- /* Correct the previous increment. */ -- --l->l_direct_opencount; -- } -+ /* There is no need to re-enable exceptions because _dl_fini -+ is not called from a context where exceptions are caught. */ -+ _dl_call_fini (l); - ++ _dl_call_fini (l); #ifdef SHARED -- _dl_audit_activity_nsid (ns, LA_ACT_CONSISTENT); -+ /* Auditing checkpoint: another object closed. */ -+ _dl_audit_objclose (l); - #endif -- } -- } -+ } - - #ifdef SHARED -- if (! do_audit && GLRO(dl_naudit) > 0) -- { -- do_audit = 1; -- goto again; -- } -+ if (last_ns >= 0) -+ _dl_audit_activity_nsid (last_ns, LA_ACT_CONSISTENT); - - if (__glibc_unlikely (GLRO(dl_debug_mask) & DL_DEBUG_STATISTICS)) - _dl_debug_printf ("\nruntime linker statistics:\n" + /* Auditing checkpoint: another object closed. */ + _dl_audit_objclose (l); diff --git a/elf/dl-hwcaps.c b/elf/dl-hwcaps.c index 6f161f6ad5..92eb53790e 100644 --- a/elf/dl-hwcaps.c @@ -1026,15 +680,10 @@ index 6f161f6ad5..92eb53790e 100644 = malloc (*sz * sizeof (*result) + total); if (overall_result == NULL) diff --git a/elf/dl-init.c b/elf/dl-init.c -index deefeb099a..77b2edd838 100644 +index deefeb099a..fca8e3a05e 100644 --- a/elf/dl-init.c +++ b/elf/dl-init.c -@@ -21,14 +21,19 @@ - #include <ldsodefs.h> - #include <elf-initfini.h> - -+struct link_map *_dl_init_called_list; - +@@ -25,10 +25,14 @@ static void call_init (struct link_map *l, int argc, char **argv, char **env) { @@ -1051,70 +700,6 @@ index deefeb099a..77b2edd838 100644 if (l->l_init_called) /* This object is all done. */ -@@ -38,6 +43,21 @@ call_init (struct link_map *l, int argc, char **argv, char **env) - dependency. */ - l->l_init_called = 1; - -+ /* Help an already-running dlclose: The just-loaded object must not -+ be removed during the current pass. (No effect if no dlclose in -+ progress.) */ -+ l->l_map_used = 1; -+ -+ /* Record execution before starting any initializers. This way, if -+ the initializers themselves call dlopen, their ELF destructors -+ will eventually be run before this object is destructed, matching -+ that their ELF constructors have run before this object was -+ constructed. _dl_fini uses this list for audit callbacks, so -+ register objects on the list even if they do not have a -+ constructor. */ -+ l->l_init_called_next = _dl_init_called_list; -+ _dl_init_called_list = l; -+ - /* Check for object which constructors we do not run here. */ - if (__builtin_expect (l->l_name[0], 'a') == '\0' - && l->l_type == lt_executable) -diff --git a/elf/dl-load.c b/elf/dl-load.c -index 1ad0868dad..cb59c21ce7 100644 ---- a/elf/dl-load.c -+++ b/elf/dl-load.c -@@ -1263,7 +1263,7 @@ _dl_map_object_from_fd (const char *name, const char *origname, int fd, - - /* Now process the load commands and map segments into memory. - This is responsible for filling in: -- l_map_start, l_map_end, l_addr, l_contiguous, l_text_end, l_phdr -+ l_map_start, l_map_end, l_addr, l_contiguous, l_phdr - */ - errstring = _dl_map_segments (l, fd, header, type, loadcmds, nloadcmds, - maplength, has_holes, loader); -diff --git a/elf/dl-load.h b/elf/dl-load.h -index f98d264e90..ebf7d74cd0 100644 ---- a/elf/dl-load.h -+++ b/elf/dl-load.h -@@ -83,14 +83,11 @@ struct loadcmd - - /* This is a subroutine of _dl_map_segments. It should be called for each - load command, some time after L->l_addr has been set correctly. It is -- responsible for setting up the l_text_end and l_phdr fields. */ -+ responsible for setting the l_phdr fields */ - static __always_inline void - _dl_postprocess_loadcmd (struct link_map *l, const ElfW(Ehdr) *header, - const struct loadcmd *c) - { -- if (c->prot & PROT_EXEC) -- l->l_text_end = l->l_addr + c->mapend; -- - if (l->l_phdr == 0 - && c->mapoff <= header->e_phoff - && ((size_t) (c->mapend - c->mapstart + c->mapoff) -@@ -103,7 +100,7 @@ _dl_postprocess_loadcmd (struct link_map *l, const ElfW(Ehdr) *header, - - /* This is a subroutine of _dl_map_object_from_fd. It is responsible - for filling in several fields in *L: l_map_start, l_map_end, l_addr, -- l_contiguous, l_text_end, l_phdr. On successful return, all the -+ l_contiguous, l_phdr. On successful return, all the - segments are mapped (or copied, or whatever) from the file into their - final places in the address space, with the correct page permissions, - and any bss-like regions already zeroed. It returns a null pointer diff --git a/elf/dl-lookup.c b/elf/dl-lookup.c index 4c86dc694e..67fb2e31e2 100644 --- a/elf/dl-lookup.c @@ -1314,6 +899,18 @@ index 4af0b5b2ce..f45b630ba5 100644 call_function_static_weak (_dl_find_object_init); +diff --git a/elf/dl-tls.c b/elf/dl-tls.c +index 093cdddb7e..bf0ff0d9e8 100644 +--- a/elf/dl-tls.c ++++ b/elf/dl-tls.c +@@ -160,6 +160,7 @@ _dl_assign_tls_modid (struct link_map *l) + { + /* Mark the entry as used, so any dependency see it. */ + atomic_store_relaxed (&runp->slotinfo[result - disp].map, l); ++ atomic_store_relaxed (&runp->slotinfo[result - disp].gen, 0); + break; + } + diff --git a/elf/dl-tunables.c b/elf/dl-tunables.c index 8e7ee9df10..76cf8b9da3 100644 --- a/elf/dl-tunables.c @@ -1373,34 +970,20 @@ index e6a56b3070..9fa3b484cf 100644 + } } diff --git a/elf/dso-sort-tests-1.def b/elf/dso-sort-tests-1.def -index 5f7f18ef27..61dc54f8ae 100644 +index 5f7f18ef27..4bf9052db1 100644 --- a/elf/dso-sort-tests-1.def +++ b/elf/dso-sort-tests-1.def -@@ -53,14 +53,14 @@ tst-dso-ordering10: {}->a->b->c;soname({})=c - output: b>a>{}<a<b - - # Complex example from Bugzilla #15311, under-linked and with circular --# relocation(dynamic) dependencies. While this is technically unspecified, the --# presumed reasonable practical behavior is for the destructor order to respect --# the static DT_NEEDED links (here this means the a->b->c->d order). --# The older dynamic_sort=1 algorithm does not achieve this, while the DFS-based --# dynamic_sort=2 algorithm does, although it is still arguable whether going --# beyond spec to do this is the right thing to do. --# The below expected outputs are what the two algorithms currently produce --# respectively, for regression testing purposes. -+# relocation(dynamic) dependencies. For both sorting algorithms, the -+# destruction order is the reverse of the construction order, and -+# relocation dependencies are not taken into account. +@@ -64,3 +64,10 @@ output: b>a>{}<a<b tst-bz15311: {+a;+e;+f;+g;+d;%d;-d;-g;-f;-e;-a};a->b->c->d;d=>[ba];c=>a;b=>e=>a;c=>f=>b;d=>g=>c --output(glibc.rtld.dynamic_sort=1): {+a[d>c>b>a>];+e[e>];+f[f>];+g[g>];+d[];%d(b(e(a()))a()g(c(a()f(b(e(a()))))));-d[];-g[];-f[];-e[];-a[<a<c<d<g<f<b<e];} --output(glibc.rtld.dynamic_sort=2): {+a[d>c>b>a>];+e[e>];+f[f>];+g[g>];+d[];%d(b(e(a()))a()g(c(a()f(b(e(a()))))));-d[];-g[];-f[];-e[];-a[<g<f<a<b<c<d<e];} -+output: {+a[d>c>b>a>];+e[e>];+f[f>];+g[g>];+d[];%d(b(e(a()))a()g(c(a()f(b(e(a()))))));-d[];-g[];-f[];-e[];-a[<g<f<e<a<b<c<d];} + output(glibc.rtld.dynamic_sort=1): {+a[d>c>b>a>];+e[e>];+f[f>];+g[g>];+d[];%d(b(e(a()))a()g(c(a()f(b(e(a()))))));-d[];-g[];-f[];-e[];-a[<a<c<d<g<f<b<e];} + output(glibc.rtld.dynamic_sort=2): {+a[d>c>b>a>];+e[e>];+f[f>];+g[g>];+d[];%d(b(e(a()))a()g(c(a()f(b(e(a()))))));-d[];-g[];-f[];-e[];-a[<g<f<a<b<c<d<e];} + +# Test that even in the presence of dependency loops involving dlopen'ed +# object, that object is initialized last (and not unloaded prematurely). -+# Final destructor order is the opposite of constructor order. ++# Final destructor order is indeterminate due to the cycle. +tst-bz28937: {+a;+b;-b;+c;%c};a->a1;a->a2;a2->a;b->b1;c->a1;c=>a1 -+output: {+a[a2>a1>a>];+b[b1>b>];-b[<b<b1];+c[c>];%c(a1());}<c<a<a1<a2 ++output(glibc.rtld.dynamic_sort=1): {+a[a2>a1>a>];+b[b1>b>];-b[<b<b1];+c[c>];%c(a1());}<a<a2<c<a1 ++output(glibc.rtld.dynamic_sort=2): {+a[a2>a1>a>];+b[b1>b>];-b[<b<b1];+c[c>];%c(a1());}<a2<a<c<a1 diff --git a/elf/elf.h b/elf/elf.h index 02a1b3f52f..014393f3cc 100644 --- a/elf/elf.h @@ -1433,44 +1016,10 @@ index ca00dd1fe2..3c5e273f2b 100644 else # -s verbose := diff --git a/elf/rtld.c b/elf/rtld.c -index cbbaf4a331..dd45930ff7 100644 +index cbbaf4a331..3e771a93d8 100644 --- a/elf/rtld.c +++ b/elf/rtld.c -@@ -479,7 +479,6 @@ _dl_start_final (void *arg, struct dl_start_final_info *info) - GL(dl_rtld_map).l_real = &GL(dl_rtld_map); - GL(dl_rtld_map).l_map_start = (ElfW(Addr)) &__ehdr_start; - GL(dl_rtld_map).l_map_end = (ElfW(Addr)) _end; -- GL(dl_rtld_map).l_text_end = (ElfW(Addr)) _etext; - /* Copy the TLS related data if necessary. */ - #ifndef DONT_USE_BOOTSTRAP_MAP - # if NO_TLS_OFFSET != 0 -@@ -1124,7 +1123,6 @@ rtld_setup_main_map (struct link_map *main_map) - bool has_interp = false; - - main_map->l_map_end = 0; -- main_map->l_text_end = 0; - /* Perhaps the executable has no PT_LOAD header entries at all. */ - main_map->l_map_start = ~0; - /* And it was opened directly. */ -@@ -1216,8 +1214,6 @@ rtld_setup_main_map (struct link_map *main_map) - allocend = main_map->l_addr + ph->p_vaddr + ph->p_memsz; - if (main_map->l_map_end < allocend) - main_map->l_map_end = allocend; -- if ((ph->p_flags & PF_X) && allocend > main_map->l_text_end) -- main_map->l_text_end = allocend; - - /* The next expected address is the page following this load - segment. */ -@@ -1277,8 +1273,6 @@ rtld_setup_main_map (struct link_map *main_map) - = (char *) main_map->l_tls_initimage + main_map->l_addr; - if (! main_map->l_map_end) - main_map->l_map_end = ~0; -- if (! main_map->l_text_end) -- main_map->l_text_end = ~0; - if (! GL(dl_rtld_map).l_libname && GL(dl_rtld_map).l_name) - { - /* We were invoked directly, so the program might not have a -@@ -2122,6 +2116,12 @@ dl_main (const ElfW(Phdr) *phdr, +@@ -2122,6 +2122,12 @@ dl_main (const ElfW(Phdr) *phdr, if (l->l_faked) /* The library was not found. */ _dl_printf ("\t%s => not found\n", l->l_libname->name); @@ -1483,127 +1032,6 @@ index cbbaf4a331..dd45930ff7 100644 else _dl_printf ("\t%s => %s (0x%0*Zx)\n", DSO_FILENAME (l->l_libname->name), -diff --git a/elf/setup-vdso.h b/elf/setup-vdso.h -index c0807ea82b..415d5057c3 100644 ---- a/elf/setup-vdso.h -+++ b/elf/setup-vdso.h -@@ -51,9 +51,6 @@ setup_vdso (struct link_map *main_map __attribute__ ((unused)), - l->l_addr = ph->p_vaddr; - if (ph->p_vaddr + ph->p_memsz >= l->l_map_end) - l->l_map_end = ph->p_vaddr + ph->p_memsz; -- if ((ph->p_flags & PF_X) -- && ph->p_vaddr + ph->p_memsz >= l->l_text_end) -- l->l_text_end = ph->p_vaddr + ph->p_memsz; - } - else - /* There must be no TLS segment. */ -@@ -62,7 +59,6 @@ setup_vdso (struct link_map *main_map __attribute__ ((unused)), - l->l_map_start = (ElfW(Addr)) GLRO(dl_sysinfo_dso); - l->l_addr = l->l_map_start - l->l_addr; - l->l_map_end += l->l_addr; -- l->l_text_end += l->l_addr; - l->l_ld = (void *) ((ElfW(Addr)) l->l_ld + l->l_addr); - elf_get_dynamic_info (l, false, false); - _dl_setup_hash (l); -diff --git a/elf/tst-audit23.c b/elf/tst-audit23.c -index 4904cf1340..f40760bd70 100644 ---- a/elf/tst-audit23.c -+++ b/elf/tst-audit23.c -@@ -98,6 +98,8 @@ do_test (int argc, char *argv[]) - char *lname; - uintptr_t laddr; - Lmid_t lmid; -+ uintptr_t cookie; -+ uintptr_t namespace; - bool closed; - } objs[max_objs] = { [0 ... max_objs-1] = { .closed = false } }; - size_t nobjs = 0; -@@ -117,6 +119,9 @@ do_test (int argc, char *argv[]) - size_t buffer_length = 0; - while (xgetline (&buffer, &buffer_length, out)) - { -+ *strchrnul (buffer, '\n') = '\0'; -+ printf ("info: subprocess output: %s\n", buffer); -+ - if (startswith (buffer, "la_activity: ")) - { - uintptr_t cookie; -@@ -125,29 +130,26 @@ do_test (int argc, char *argv[]) - &cookie); - TEST_COMPARE (r, 2); - -- /* The cookie identifies the object at the head of the link map, -- so we only add a new namespace if it changes from the previous -- one. This works since dlmopen is the last in the test body. */ -- if (cookie != last_act_cookie && last_act_cookie != -1) -- TEST_COMPARE (last_act, LA_ACT_CONSISTENT); -- - if (this_act == LA_ACT_ADD && acts[nacts] != cookie) - { -+ /* The cookie identifies the object at the head of the -+ link map, so we only add a new namespace if it -+ changes from the previous one. This works since -+ dlmopen is the last in the test body. */ -+ if (cookie != last_act_cookie && last_act_cookie != -1) -+ TEST_COMPARE (last_act, LA_ACT_CONSISTENT); -+ - acts[nacts++] = cookie; - last_act_cookie = cookie; - } -- /* The LA_ACT_DELETE is called in the reverse order of LA_ACT_ADD -- at program termination (if the tests adds a dlclose or a library -- with extra dependencies this will need to be adapted). */ -+ /* LA_ACT_DELETE is called multiple times for each -+ namespace, depending on destruction order. */ - else if (this_act == LA_ACT_DELETE) -- { -- last_act_cookie = acts[--nacts]; -- TEST_COMPARE (acts[nacts], cookie); -- acts[nacts] = 0; -- } -+ last_act_cookie = cookie; - else if (this_act == LA_ACT_CONSISTENT) - { - TEST_COMPARE (cookie, last_act_cookie); -+ last_act_cookie = -1; - - /* LA_ACT_DELETE must always be followed by an la_objclose. */ - if (last_act == LA_ACT_DELETE) -@@ -179,6 +181,8 @@ do_test (int argc, char *argv[]) - objs[nobjs].lname = lname; - objs[nobjs].laddr = laddr; - objs[nobjs].lmid = lmid; -+ objs[nobjs].cookie = cookie; -+ objs[nobjs].namespace = last_act_cookie; - objs[nobjs].closed = false; - nobjs++; - -@@ -201,6 +205,12 @@ do_test (int argc, char *argv[]) - if (strcmp (lname, objs[i].lname) == 0 && lmid == objs[i].lmid) - { - TEST_COMPARE (objs[i].closed, false); -+ TEST_COMPARE (objs[i].cookie, cookie); -+ if (objs[i].namespace == -1) -+ /* No LA_ACT_ADD before the first la_objopen call. */ -+ TEST_COMPARE (acts[0], last_act_cookie); -+ else -+ TEST_COMPARE (objs[i].namespace, last_act_cookie); - objs[i].closed = true; - break; - } -@@ -209,11 +219,7 @@ do_test (int argc, char *argv[]) - /* la_objclose should be called after la_activity(LA_ACT_DELETE) for - the closed object's namespace. */ - TEST_COMPARE (last_act, LA_ACT_DELETE); -- if (!seen_first_objclose) -- { -- TEST_COMPARE (last_act_cookie, cookie); -- seen_first_objclose = true; -- } -+ seen_first_objclose = true; - } - } - diff --git a/elf/tst-auditmod28.c b/elf/tst-auditmod28.c index db7ba95abe..9e0a122c38 100644 --- a/elf/tst-auditmod28.c @@ -2602,22 +2030,20 @@ index 0000000000..00b1b93342 @@ -0,0 +1 @@ +#include <wcsmbs/bits/wchar2-decl.h> diff --git a/include/link.h b/include/link.h -index 0ac82d7c77..4eb8fe0d96 100644 +index 0ac82d7c77..87966e8397 100644 --- a/include/link.h +++ b/include/link.h -@@ -253,8 +253,10 @@ struct link_map - /* Start and finish of memory map for this object. l_map_start - need not be the same as l_addr. */ - ElfW(Addr) l_map_start, l_map_end; -- /* End of the executable part of the mapping. */ -- ElfW(Addr) l_text_end; -+ +@@ -278,6 +278,10 @@ struct link_map + /* List of object in order of the init and fini calls. */ + struct link_map **l_initfini; + + /* Linked list of objects in reverse ELF constructor execution + order. Head of list is stored in _dl_init_called_list. */ + struct link_map *l_init_called_next; - - /* Default array for 'l_scope'. */ - struct r_scope_elem *l_scope_mem[4]; ++ + /* List of the dependencies introduced through symbol binding. */ + struct link_map_reldeps + { diff --git a/include/resolv.h b/include/resolv.h index 3590b6f496..4dbbac3800 100644 --- a/include/resolv.h @@ -8197,7 +7623,7 @@ index 909b208578..d66f0b9c45 100644 ldp q2, q3, [x29, #OFFSET_RV + DL_OFFSET_RV_V0 + 32*1] ldp q4, q5, [x29, #OFFSET_RV + DL_OFFSET_RV_V0 + 32*2] diff --git a/sysdeps/generic/ldsodefs.h b/sysdeps/generic/ldsodefs.h -index 050a3032de..ab8a7fbf84 100644 +index 050a3032de..c2627fced7 100644 --- a/sysdeps/generic/ldsodefs.h +++ b/sysdeps/generic/ldsodefs.h @@ -105,6 +105,9 @@ typedef struct link_map *lookup_t; @@ -8210,15 +7636,7 @@ index 050a3032de..ab8a7fbf84 100644 /* On some architectures a pointer to a function is not just a pointer to the actual code of the function but rather an architecture specific descriptor. */ -@@ -1044,13 +1047,24 @@ extern int _dl_check_map_versions (struct link_map *map, int verbose, - extern void _dl_init (struct link_map *main_map, int argc, char **argv, - char **env) attribute_hidden; - -+/* List of ELF objects in reverse order of their constructor -+ invocation. */ -+extern struct link_map *_dl_init_called_list attribute_hidden; -+ - /* Call the finalizer functions of all shared objects whose +@@ -1048,9 +1051,16 @@ extern void _dl_init (struct link_map *main_map, int argc, char **argv, initializer functions have completed. */ extern void _dl_fini (void) attribute_hidden; @@ -10696,6 +10114,37 @@ index 3c4480aba7..06f6c9663e 100644 #define MOVBE_X86_ISA_LEVEL 3 /* ISA level >= 2 guaranteed includes. */ +diff --git a/sysdeps/x86_64/dl-tlsdesc.S b/sysdeps/x86_64/dl-tlsdesc.S +index 0db2cb4152..7619e743e1 100644 +--- a/sysdeps/x86_64/dl-tlsdesc.S ++++ b/sysdeps/x86_64/dl-tlsdesc.S +@@ -61,7 +61,7 @@ _dl_tlsdesc_return: + _dl_tlsdesc_undefweak: + _CET_ENDBR + movq 8(%rax), %rax +- subq %fs:0, %rax ++ sub %fs:0, %RAX_LP + ret + cfi_endproc + .size _dl_tlsdesc_undefweak, .-_dl_tlsdesc_undefweak +@@ -102,7 +102,7 @@ _dl_tlsdesc_dynamic: + /* Preserve call-clobbered registers that we modify. + We need two scratch regs anyway. */ + movq %rsi, -16(%rsp) +- movq %fs:DTV_OFFSET, %rsi ++ mov %fs:DTV_OFFSET, %RSI_LP + movq %rdi, -8(%rsp) + movq TLSDESC_ARG(%rax), %rdi + movq (%rsi), %rax +@@ -116,7 +116,7 @@ _dl_tlsdesc_dynamic: + addq TLSDESC_MODOFF(%rdi), %rax + .Lret: + movq -16(%rsp), %rsi +- subq %fs:0, %rax ++ sub %fs:0, %RAX_LP + movq -8(%rsp), %rdi + ret + .Lslow: diff --git a/sysdeps/x86_64/fpu/fraiseexcpt.c b/sysdeps/x86_64/fpu/fraiseexcpt.c index 864f4777a2..23446ff4ac 100644 --- a/sysdeps/x86_64/fpu/fraiseexcpt.c

1 0

ports/opt (3.7): [notify] postfix: updated to version 3.8.4 (security update)
by crux＠crux.nu 23 Dec '23

23 Dec '23

commit 85bc29bad25946b644692b6ebdd4a52d9d4865cd Author: Matt Housh <jaeger(a)crux.ninja> Date: Sat Dec 23 12:54:06 2023 -0600 [notify] postfix: updated to version 3.8.4 (security update) See the following for details: https://www.postfix.org/smtp-smuggling.html http://www.postfix.org/announcements/postfix-3.8.4.html diff --git a/postfix/.signature b/postfix/.signature index 705c32b64..2bd364ab9 100644 --- a/postfix/.signature +++ b/postfix/.signature @@ -1,7 +1,7 @@ untrusted comment: verify with /etc/ports/opt.pub -RWSE3ohX2g5d/fQ8x/NqS+fQ8SuBZeZ60jc2bGTNBtsdBlB/MXA3lZm+YNb/sOcWQ7ce9hXhCjCMmlYZgzPVqr25Edw6M4OQawM= -SHA256 (Pkgfile) = 8de71aad9024366c2b397ca12585447f42b314300098bfbb82f95135aa970faf +RWSE3ohX2g5d/dsCl2TRjYcp0cCblVlbm7mPjsJiq/N3+FpCTNniYA4cjG2spdA03BRQSLaTWmwIWZW1YvPwB4GkmoOpN9NU+wA= +SHA256 (Pkgfile) = e6d8412e6f5ba0c9a0ecc3f7b56ef8556ee4f6c4a37540e3b84b8fada5c29d30 SHA256 (.footprint) = 0c117e4d6ca42a13ef6f2c030aff896a140958e8b6e96fe1ae7c682f70e588aa -SHA256 (postfix-3.8.3.tar.gz) = 16946c9874a786a09f53b17d1c83dc1faae35cbf80bab34ab01798b70420968b +SHA256 (postfix-3.8.4.tar.gz) = 6f5848c5d8b6a7d2c5af0a9f75b0bd3f103451e912591464ab867fde085e6236 SHA256 (aliases) = b6de629cce43ed5dc06086c5742ebe85ccc7b59d085f0fec71d97e0e73a50271 SHA256 (postfix.rc) = 78059f334abcf0f1662107f5b9542fba26f489d2cb0ca05cdc61a816f4e96dc7 diff --git a/postfix/Pkgfile b/postfix/Pkgfile index b2c93c463..bf246a968 100644 --- a/postfix/Pkgfile +++ b/postfix/Pkgfile @@ -4,7 +4,7 @@ # Depends on: cyrus-sasl name=postfix -version=3.8.3 +version=3.8.4 release=1 source=(http://ftp.porcupine.org/mirrors/postfix-release/official/${name}-$… aliases postfix.rc)

1 0

rsync proxy via squid
by cruxnu＠huskmail.com 23 Dec '23

23 Dec '23

I would like to setup a squid server to proxy rsync requests so that I can more efficiently sync repos for several crux installs on a slow network. What would be the best way to make sure the ports command uses the squid proxy? I am already using the source mirror in /etc/pkgmk.conf and that works great.

1 0

linux-firmware: rdfind should now be optional
by Steffen Nurpmeso 16 Dec '23

16 Dec '23

i think you need to pass --ignore-duplicates via $COPYOPTS. maybe i find time and can send them a patch to split "make dist" and "make install" as such (or what the names were), to overcome it as such. and maybe they take it. --steffen | |Der Kragenbaer, The moon bear, |der holt sich munter he cheerfully and one by one |einen nach dem anderen runter wa.ks himself off |(By Robert Gernhardt) | | Only in December: lightful Dubai COP28 Narendra Modi quote: | A small part of humanity has ruthlessly exploited nature. | But the entire humanity is bearing the cost of it, | especially the inhabitants of the Global South. | The selfishness of a few will lead the world into darkness, | not just for themselves but for the entire world. | [Christians might think of Revelation 11:18 | The nations were angry, and your wrath has come[.] | [.]for destroying those who destroy the earth. | But i find the above more kind, and much friendlier]

1 1

ports/xorg (3.7): [notify] xorg-server: security update to 21.1.10
by crux＠crux.nu 13 Dec '23

13 Dec '23

commit f9800155bb1694a65f015a7809949b2004b80789 Author: Juergen Daubert <jue(a)jue.li> Date: Wed Dec 13 09:51:32 2023 +0100 [notify] xorg-server: security update to 21.1.10 https://lists.x.org/archives/xorg-announce/2023-December/003435.html diff --git a/xorg-server/.signature b/xorg-server/.signature index b0cd5bd2..25f97e9e 100644 --- a/xorg-server/.signature +++ b/xorg-server/.signature @@ -1,5 +1,5 @@ untrusted comment: verify with /etc/ports/xorg.pub -RWTSGWF5Q7TndI6pjt3WcznAsa+kH6dws5mKSIF9AsaoGKdg10XwoDtcTcBfmIfirBsUUjY83ddorOJLg5egyfuWXXeDNfTavwc= -SHA256 (Pkgfile) = 4f3b7171ef7719220a7c3383c613bc69ed347824b9fd6b1f99bb076f0a2d9c41 +RWTSGWF5Q7TndAeEtNMkK3dq5P3J3i3w1Ny+ktg1X/L9hYrwdWou7z0zlRkkFaCs5SeL25dtMRgvwJVXMoIFv3kfSlQw85y2FgQ= +SHA256 (Pkgfile) = b58ae9de9d9c3bc203137f89eb267cfa8c99e6a3e65335c7f8275953f51555ae SHA256 (.footprint) = dc68ebbbcdee4d11d5cadac3f5a585be9acead28db713408e60222dd01d8c8c7 -SHA256 (xorg-server-21.1.9.tar.xz) = ff697be2011b4c4966b7806929e51b7a08e9d33800d505305d26d9ccde4b533a +SHA256 (xorg-server-21.1.10.tar.xz) = ceb0b3a2efc57ac3ccf388d3dc88b97615068639fb284d469689ae3d105611d0 diff --git a/xorg-server/Pkgfile b/xorg-server/Pkgfile index 00f63243..42eb632d 100644 --- a/xorg-server/Pkgfile +++ b/xorg-server/Pkgfile @@ -4,7 +4,7 @@ # Depends on: libepoxy nettle xorg-bdftopcf xorg-font-util xorg-libxaw xorg-libxcomposite xorg-libxcursor xorg-libxcvt xorg-libxfont2 xorg-libxft xorg-libxinerama xorg-libxres xorg-libxtst xorg-mkfontscale xorg-xcb-util-keysyms xorg-xkbcomp name=xorg-server -version=21.1.9 +version=21.1.10 release=1 source=(https://www.x.org/releases/individual/xserver/$name-$version.tar.xz)

1 0

CruxEX Build 231208 with Refracta Snapshot
by C A Exton 08 Dec '23

08 Dec '23

A new updated version of CruxEX 3.7 (CRUX 3.7) with LXDE, Refracta Snapshot, Refracta Installer and kernel 6.6.1-amd64-exton :: Build 231208 CruxEX 2024/2022 64 bit Linux Live CD/USB is based on CRUX 3.7 (latest version, released 220926), which is all Linux enthusiasts/nerds favorite OS. ("CRUX is a lightweight Linux distribution for the x86_64 architecture targeted at experienced Linux users. The primary focus of this distribution is keep it simple, which is reflected in a straightforward tar.gz-based package system, BSD-style initscripts, and a relatively small collection of trimmed packages. The secondary focus is utilization of new Linux features and recent tools and libraries. CRUX also has a ports system which makes it easy to install and upgrade applications"). CruxEX 3.7 2024/2022 uses the LXDE Desktop environment. I have replaced the original CRUX kernel 5.15 with “my” special kernel 6.6.1-amd64-exton respectively 6.0.6-aufs-exton, with support for “extra everything”. NEWS ABOUT CruxEX BUILD 231208 I’ve made a new extra version of CruxEX which I call CruxEX Linux Live CD. It is distributed as a “normal” ISO file. (Build 221031 is distributed as a Zip file only to be installed on a USB stick). I have kept CruxEX Build 221031 on SourceForge’s server because that version can run from a USB stick with PERSISTENCE. I.e. all system changes will be saved directly on the USB stick. In CruxEX Build 231208 I have managed to install Refracta Snapshot and Refracta Installer. With Refracta Snapshot you can very easy create you own CRUX Live Installable System. I mean change everything to your liking and then create a new ISO. That can be done after a hard drive installation using Refracta Installer. If you have plenty of RAM you can even create a new ISO while running CruxEX live! UNIQUE CruxEX 3.7 2024/2022 Build 231208/221031 is – as my previous CRUX-remasters – unique in the world. I.e. there is no other CRUX Live CD/USB (as far as I know). In any case, not for downloading. The good thing with CruxEX is that it is a live system (which CRUX original isn’t) and that you can run CruxEX super fast from RAM. Also that you can install CruxEX to hard drive in about 5 minutes and then have a ready-to-go CRUX desktop system. You can after that install any (extra) desktop environment you like. NOTE: You can (of course) install new Desktops environments and other stuff also when running CruxEX from a USB stick – PERSISTENCE! (Only as regards Build 221031). Note also: To make CRUX original ready for everyday use will normally take 2 – 3 days! Study ALL INSTALLED packages in CruxEX 3.7 1) Build 231208: https://cruxex.exton.se/cruxex-231208/cruxex-3.7-installed-packages-231208.… <https://cruxex.exton.se/cruxex-231208/cruxex-3.7-installed-packages-231208.…> 2) Build 221031: https://cruxex.exton.se/cruxex-3.7-installed-packages-221031.txt <https://cruxex.exton.se/cruxex-3.7-installed-packages-221031.txt> Study ALL UPDATED packages in Build 231208: https://cruxex.exton.se/cruxex-231208/cruxex-3.7-updated-packages-231208.txt <https://cruxex.exton.se/cruxex-231208/cruxex-3.7-updated-packages-231208.txt> SCREENSHOTS 1. The LXDE Desktop for the live user in Build 231208: https://cruxex.exton.se/cruxex-231208/cruxex-live-user-desktop-231208.jpg <https://cruxex.exton.se/cruxex-231208/cruxex-live-user-desktop-231208.jpg> 2. The LXDE Desktop for root in Build 231208: https://cruxex.exton.se/cruxex-231208/cruxex-root-desktop-vbox-231208.jpg <https://cruxex.exton.se/cruxex-231208/cruxex-root-desktop-vbox-231208.jpg> 3. A Wireless connection in Build 231208: https://cruxex.exton.se/cruxex-231208/cruxex-wifi-conn-231208-2.jpg <https://cruxex.exton.se/cruxex-231208/cruxex-wifi-conn-231208-2.jpg> 4. CruxEX running in full screen in VirtualBox – Build 231208: https://cruxex.exton.se/cruxex-231208/cruxex-live-user-desktop-vbox-231208.… <https://cruxex.exton.se/cruxex-231208/cruxex-live-user-desktop-vbox-231208.…> READ MORE: https://cruxex.exton.se/ <https://cruxex.exton.se/> --

1 0

ports/contrib (3.7): [notify] go: updated to version 1.21.5, security fixes
by crux＠crux.nu 06 Dec '23

06 Dec '23

commit a57e8e4a45f51989c57325b4507e792319708120 Author: Matt Housh <jaeger(a)crux.ninja> Date: Wed Dec 6 09:57:19 2023 -0600 [notify] go: updated to version 1.21.5, security fixes See the following for details: https://go.dev/doc/devel/release#go1.21.5 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39326 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45285 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45283 diff --git a/go/.footprint b/go/.footprint index be3dd837c..4c747b578 100644 --- a/go/.footprint +++ b/go/.footprint @@ -2670,6 +2670,7 @@ drwxr-xr-x root/root usr/lib/go/src/cmd/go/testdata/script/ -rw-r--r-- root/root usr/lib/go/src/cmd/go/testdata/script/mod_dot.txt -rw-r--r-- root/root usr/lib/go/src/cmd/go/testdata/script/mod_download.txt -rw-r--r-- root/root usr/lib/go/src/cmd/go/testdata/script/mod_download_concurrent_read.txt +-rw-r--r-- root/root usr/lib/go/src/cmd/go/testdata/script/mod_download_exec_toolchain.txt -rw-r--r-- root/root usr/lib/go/src/cmd/go/testdata/script/mod_download_git_bareRepository.txt -rw-r--r-- root/root usr/lib/go/src/cmd/go/testdata/script/mod_download_git_decorate_full.txt -rw-r--r-- root/root usr/lib/go/src/cmd/go/testdata/script/mod_download_hash.txt @@ -2797,6 +2798,7 @@ drwxr-xr-x root/root usr/lib/go/src/cmd/go/testdata/script/ -rw-r--r-- root/root usr/lib/go/src/cmd/go/testdata/script/mod_init_invalid_major.txt -rw-r--r-- root/root usr/lib/go/src/cmd/go/testdata/script/mod_init_path.txt -rw-r--r-- root/root usr/lib/go/src/cmd/go/testdata/script/mod_init_tidy.txt +-rw-r--r-- root/root usr/lib/go/src/cmd/go/testdata/script/mod_insecure_issue63845.txt -rw-r--r-- root/root usr/lib/go/src/cmd/go/testdata/script/mod_install_hint.txt -rw-r--r-- root/root usr/lib/go/src/cmd/go/testdata/script/mod_install_pkg_version.txt -rw-r--r-- root/root usr/lib/go/src/cmd/go/testdata/script/mod_install_versioned.txt @@ -12815,6 +12817,8 @@ drwxr-xr-x root/root usr/lib/go/test/fixedbugs/issue6295.dir/ -rw-r--r-- root/root usr/lib/go/test/fixedbugs/issue6295.dir/p2.go -rw-r--r-- root/root usr/lib/go/test/fixedbugs/issue6295.go -rw-r--r-- root/root usr/lib/go/test/fixedbugs/issue6298.go +-rw-r--r-- root/root usr/lib/go/test/fixedbugs/issue63657.go +-rw-r--r-- root/root usr/lib/go/test/fixedbugs/issue63955.go -rw-r--r-- root/root usr/lib/go/test/fixedbugs/issue6399.go -rw-r--r-- root/root usr/lib/go/test/fixedbugs/issue6402.go -rw-r--r-- root/root usr/lib/go/test/fixedbugs/issue6403.go diff --git a/go/.signature b/go/.signature index ba66ad2ab..d06a3bb81 100644 --- a/go/.signature +++ b/go/.signature @@ -1,6 +1,6 @@ untrusted comment: verify with /etc/ports/contrib.pub -RWSagIOpLGJF339RON06yB8csIP4Jpw+dR8nGRci6UVBPsBtqTB0zdilE34tQptGjrppENoLGLk0VyTIVG2yERdBJHgPymPivQQ= -SHA256 (Pkgfile) = 0de1771f656feb8263d58fe8039badb05a144d93fd1be3b75b277aa4bbeb9c42 -SHA256 (.footprint) = 0d6a52fd1507090282988500b182135ed69e3d293811305e9d2c1a836b2318c5 -SHA256 (go1.21.4.src.tar.gz) = 47b26a83d2b65a3c1c1bcace273b69bee49a7a7b5168a7604ded3d26a37bd787 -SHA256 (go1.21.4.linux-amd64.tar.gz) = 73cac0215254d0c7d1241fa40837851f3b9a8a742d0b54714cbdfb3feaf8f0af +RWSagIOpLGJF3/U0G6m5CuosQhX0Yjjy//9B4+uExmC38Ai+ypQ6EpVdRHnnY0MAPeTwM5tbFjZqSirmOMvTlOKA3I9l7cX4RQI= +SHA256 (Pkgfile) = 54cc54331dcbd95cccc0a044890a8692fd6a1586639627701a7d037fedc39999 +SHA256 (.footprint) = 13612f6137a50a6f0fa88e1fa44a42099ede95bd51015a6210172201136f4ab4 +SHA256 (go1.21.5.src.tar.gz) = 285cbbdf4b6e6e62ed58f370f3f6d8c30825d6e56c5853c66d3c23bcdb09db19 +SHA256 (go1.21.5.linux-amd64.tar.gz) = e2bc0b3e4b64111ec117295c088bde5f00eeed1567999ff77bc859d7df70078e diff --git a/go/Pkgfile b/go/Pkgfile index 7391ae79d..8021497b0 100644 --- a/go/Pkgfile +++ b/go/Pkgfile @@ -3,7 +3,7 @@ # Maintainer: Matt Housh, jaeger at crux dot ninja name=go -version=1.21.4 +version=1.21.5 release=1 source=(https://golang.org/dl/go${version}.src.tar.gz \ https://golang.org/dl/go${version}.linux-amd64.tar.gz)

1 0

ports/opt (3.7): [notify] samba: update to 4.19.3, security fix
by crux＠crux.nu 28 Nov '23

28 Nov '23

commit fe8aa80595bc589ba1230dc64f6626cfad74ccb3 Author: Juergen Daubert <jue(a)jue.li> Date: Tue Nov 28 11:21:29 2023 +0100 [notify] samba: update to 4.19.3, security fix https://www.samba.org/samba/history/samba-4.19.3.html diff --git a/samba/.signature b/samba/.signature index 4e81555d7..dfa5880d3 100644 --- a/samba/.signature +++ b/samba/.signature @@ -1,7 +1,7 @@ untrusted comment: verify with /etc/ports/opt.pub -RWSE3ohX2g5d/W+oJnwAfFjrZmf9QsjDOGC7oxIjnX8NW5LeJRM+rp6DHioFZ130IdjvKbWHpwpH0wD+7QlXhHhcatPmOHLbIAg= -SHA256 (Pkgfile) = fe8cf42378e7e8fe4fe67497ddd03d7dd4c791c5ec8cef4a91607d8f3814fee2 +RWSE3ohX2g5d/RVXABm7G6leglI1DU4TU6iDIwQnpVfPcKRJxZVGJjsIYmmACjMnofJwqZUOlCF7dchazxEcR3H2typIeVPAvAQ= +SHA256 (Pkgfile) = 47342d5b5b3cef6058a365ac6e7d5410400fc541fca853ab2e63e6f88891d777 SHA256 (.footprint) = 354a40a9a06b67b4389752dc892625faf7b24e79010c5226cb448167982dca45 -SHA256 (samba-4.19.2.tar.gz) = 9e63f0505e1c631f1db0b7a9349a51e925c026ca03af3fd5d812228bb597d393 +SHA256 (samba-4.19.3.tar.gz) = 280553b90f131b1940580df293653c9e9bd8906201f5def6e5e8c160f0bfac96 SHA256 (samba.rc) = 0ab5a29dd85d5107cea902c21dd8426d20c3bcb2ce28a5add10d572bb88adc63 SHA256 (samba.pam) = c872a9efb2f7151e51e10fada4a75d69f5f5bd5afb1db29b64e8288c7cdc8b20 diff --git a/samba/Pkgfile b/samba/Pkgfile index a4a160001..32f394e62 100644 --- a/samba/Pkgfile +++ b/samba/Pkgfile @@ -5,7 +5,7 @@ # Optional: brotli cups libidn2 name=samba -version=4.19.2 +version=4.19.3 release=1 source=(https://www.samba.org/samba/ftp/stable/$name-$version.tar.gz \ samba.rc samba.pam)

1 0

ports/opt (3.7): [notify] icu: 73.2 -> 74.1; may break a lot things, use revdep and rebuild accordingly
by crux＠crux.nu 27 Nov '23

27 Nov '23

commit ad9b6f2a4e6f4a241e572bdd44ec4f269c329691 Author: Tim Biermann <tbier(a)posteo.de> Date: Mon Nov 27 20:53:22 2023 +0100 [notify] icu: 73.2 -> 74.1; may break a lot things, use revdep and rebuild accordingly diff --git a/icu/.signature b/icu/.signature index fa57cec74..1424790bf 100644 --- a/icu/.signature +++ b/icu/.signature @@ -1,5 +1,5 @@ untrusted comment: verify with /etc/ports/opt.pub -RWSE3ohX2g5d/cBSm1DbLayVzr/RnY81K3F1Gwbmfv5bYcjIIhS4U3wRPB89iOuJWBF1/lUdw9ty03GXtV5+vPIbvgYPWCDkOg0= -SHA256 (Pkgfile) = 94129b071699229134f51480412d5d5eb9cdf60394b7fcec5a0ac030ac4632bc +RWSE3ohX2g5d/YBG6M3uc0zPV3qtYW3mhHiPh3T80h2KvrOHx2oQ8Gw3cK1y0nNqOlV6qHwmkEpyJCHp29Zt2c9sUD1JxihRvAA= +SHA256 (Pkgfile) = 8d82ce0e0630039e7d15d526f5ccf998fe844ea3429ce70bd87c39b410edc946 SHA256 (.footprint) = 81486d66dd80ef1347f504fc11ad31c013574a6456e34cca246eebd8ae85da7c -SHA256 (icu4c-73_2-src.tgz) = 818a80712ed3caacd9b652305e01afc7fa167e6f2e94996da44b90c2ab604ce1 +SHA256 (icu4c-74_1-src.tgz) = 86ce8e60681972e60e4dcb2490c697463fcec60dd400a5f9bffba26d0b52b8d0 diff --git a/icu/Pkgfile b/icu/Pkgfile index c7df99068..b80a1608b 100644 --- a/icu/Pkgfile +++ b/icu/Pkgfile @@ -4,7 +4,7 @@ # Optional: clang lld name=icu -version=73.2 +version=74.1 release=1 source=(https://github.com/unicode-org/icu/releases/download/release-${vers…

1 0