From 71eb843837c7ad2f8dfff8b07092e379ab547bb8 Mon Sep 17 00:00:00 2001 From: Mark H Weaver Date: Thu, 22 Oct 2015 14:54:43 -0400 Subject: gnu: unzip: Reorganize security fixes for improved clarity. * gnu/packages/patches/unzip-fix-overflows-and-infloop.patch: Delete file. Its contents are now split into the following new files: * gnu/packages/patches/unzip-CVE-2015-7696.patch, gnu/packages/patches/unzip-CVE-2015-7697.patch, gnu/packages/patches/unzip-overflow-on-invalid-input.patch: New files. * gnu-system.am (dist_patch_DATA): Adjust accordingly. * gnu/packages/zip.scm (unzip)[source]: Adjust patches accordingly. --- gnu-system.am | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'gnu-system.am') diff --git a/gnu-system.am b/gnu-system.am index e62fe18c97..c4810661a2 100644 --- a/gnu-system.am +++ b/gnu-system.am @@ -647,9 +647,11 @@ dist_patch_DATA = \ gnu/packages/patches/unzip-CVE-2014-8140.patch \ gnu/packages/patches/unzip-CVE-2014-8141.patch \ gnu/packages/patches/unzip-CVE-2014-9636.patch \ + gnu/packages/patches/unzip-CVE-2015-7696.patch \ + gnu/packages/patches/unzip-CVE-2015-7697.patch \ gnu/packages/patches/unzip-allow-greater-hostver-values.patch \ gnu/packages/patches/unzip-attribs-overflow.patch \ - gnu/packages/patches/unzip-fix-overflows-and-infloop.patch \ + gnu/packages/patches/unzip-overflow-on-invalid-input.patch \ gnu/packages/patches/unzip-format-secure.patch \ gnu/packages/patches/unzip-initialize-symlink-flag.patch \ gnu/packages/patches/unzip-overflow-long-fsize.patch \ -- cgit v1.2.3 From 9eb681a02dc7bc675576cce00c4ad56615ef71f0 Mon Sep 17 00:00:00 2001 From: Ludovic Courtès Date: Sat, 7 Nov 2015 22:01:04 +0100 Subject: gnu: grep: Update to 2.22. * gnu/packages/base.scm (grep): Upgrade to 2.22. Remove 'grep-CVE-2015-1345.patch'. * gnu/packages/patches/grep-CVE-2015-1345.patch: Remove. * gnu-system.am (dist_patch_DATA): Adjust accordingly. --- gnu-system.am | 1 - gnu/packages/base.scm | 5 ++--- gnu/packages/patches/grep-CVE-2015-1345.patch | 17 ----------------- 3 files changed, 2 insertions(+), 21 deletions(-) delete mode 100644 gnu/packages/patches/grep-CVE-2015-1345.patch (limited to 'gnu-system.am') diff --git a/gnu-system.am b/gnu-system.am index c4810661a2..d43358df86 100644 --- a/gnu-system.am +++ b/gnu-system.am @@ -482,7 +482,6 @@ dist_patch_DATA = \ gnu/packages/patches/gobject-introspection-absolute-shlib-path.patch \ gnu/packages/patches/gobject-introspection-cc.patch \ gnu/packages/patches/gobject-introspection-girepository.patch \ - gnu/packages/patches/grep-CVE-2015-1345.patch \ gnu/packages/patches/grub-gets-undeclared.patch \ gnu/packages/patches/grub-freetype.patch \ gnu/packages/patches/gsl-poly-test-fix-pt1.patch \ diff --git a/gnu/packages/base.scm b/gnu/packages/base.scm index f951e28b3b..179d535f20 100644 --- a/gnu/packages/base.scm +++ b/gnu/packages/base.scm @@ -73,15 +73,14 @@ command-line arguments, multiple languages, and so on.") (define-public grep (package (name "grep") - (version "2.21") + (version "2.22") (source (origin (method url-fetch) (uri (string-append "mirror://gnu/grep/grep-" version ".tar.xz")) (sha256 (base32 - "1pp5n15qwxrw1pibwjhhgsibyv5cafhamf8lwzjygs6y00fa2i2j")) - (patches (list (search-patch "grep-CVE-2015-1345.patch"))))) + "1srn321x7whlhs5ks36zlcrrmj4iahll8fxwsh1vbz3v04px54fa")))) (build-system gnu-build-system) (synopsis "Print lines matching a pattern") (description diff --git a/gnu/packages/patches/grep-CVE-2015-1345.patch b/gnu/packages/patches/grep-CVE-2015-1345.patch deleted file mode 100644 index b0d0c8e5dc..0000000000 --- a/gnu/packages/patches/grep-CVE-2015-1345.patch +++ /dev/null @@ -1,17 +0,0 @@ -Fix CVE-2015-1345. From upstream commit -83a95bd8c8561875b948cadd417c653dbe7ef2e2 -by Yuliy Pisetsky . - -diff --git a/src/kwset.c b/src/kwset.c -index 4003c8d..376f7c3 100644 ---- a/src/kwset.c -+++ b/src/kwset.c -@@ -643,6 +643,8 @@ bmexec_trans (kwset_t kwset, char const *text, size_t size) - if (! tp) - return -1; - tp++; -+ if (ep <= tp) -+ break; - } - } - } -- cgit v1.2.3 From 6f4b23e674cefebf0ccefc301974e50db04ce5db Mon Sep 17 00:00:00 2001 From: Alex Kost Date: Wed, 21 Oct 2015 15:59:23 +0300 Subject: gnu: emacs: Honor 'SOURCE_DATE_EPOCH'. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Suggested by Ludovic Courtès . * gnu/packages/patches/emacs-source-date-epoch.patch: New patch. * gnu-system.am (dist_patch_DATA): Add it. * gnu/packages/emacs.scm (emacs)[source]: Use it. --- gnu-system.am | 1 + gnu/packages/emacs.scm | 3 ++- gnu/packages/patches/emacs-source-date-epoch.patch | 20 ++++++++++++++++++++ 3 files changed, 23 insertions(+), 1 deletion(-) create mode 100644 gnu/packages/patches/emacs-source-date-epoch.patch (limited to 'gnu-system.am') diff --git a/gnu-system.am b/gnu-system.am index d43358df86..92370a2517 100644 --- a/gnu-system.am +++ b/gnu-system.am @@ -437,6 +437,7 @@ dist_patch_DATA = \ gnu/packages/patches/duplicity-test_selection-tmp.patch \ gnu/packages/patches/elfutils-tests-ptrace.patch \ gnu/packages/patches/emacs-exec-path.patch \ + gnu/packages/patches/emacs-source-date-epoch.patch \ gnu/packages/patches/eudev-rules-directory.patch \ gnu/packages/patches/expat-CVE-2015-1283.patch \ gnu/packages/patches/fastcap-mulGlobal.patch \ diff --git a/gnu/packages/emacs.scm b/gnu/packages/emacs.scm index 6416b00ee0..9751125113 100644 --- a/gnu/packages/emacs.scm +++ b/gnu/packages/emacs.scm @@ -70,7 +70,8 @@ (sha256 (base32 "0kn3rzm91qiswi0cql89kbv6mqn27rwsyjfb8xmwy9m5s8fxfiyx")) - (patches (list (search-patch "emacs-exec-path.patch"))))) + (patches (list (search-patch "emacs-exec-path.patch") + (search-patch "emacs-source-date-epoch.patch"))))) (build-system glib-or-gtk-build-system) (arguments '(#:phases (alist-cons-before diff --git a/gnu/packages/patches/emacs-source-date-epoch.patch b/gnu/packages/patches/emacs-source-date-epoch.patch new file mode 100644 index 0000000000..41c03ef514 --- /dev/null +++ b/gnu/packages/patches/emacs-source-date-epoch.patch @@ -0,0 +1,20 @@ +Honor SOURCE_DATE_EPOCH variable to avoid non-determinism in generated +"autoloads" files. + +--- a/lisp/emacs-lisp/autoload.el ++++ b/lisp/emacs-lisp/autoload.el +@@ -378,8 +378,12 @@ + "Insert the section-header line, + which lists the file name and which functions are in it, etc." + (insert generate-autoload-section-header) +- (prin1 `(autoloads ,autoloads ,load-name ,file ,time) +- outbuf) ++ (let* ((env (getenv "SOURCE_DATE_EPOCH")) ++ (time (if env ++ (seconds-to-time (string-to-number env)) ++ time))) ++ (prin1 `(autoloads ,autoloads ,load-name ,file ,time) ++ outbuf)) + (terpri outbuf) + ;; Break that line at spaces, to avoid very long lines. + ;; Make each sub-line into a comment. -- cgit v1.2.3 From 0cc2284819468701dec93559bda7ef9939edaf19 Mon Sep 17 00:00:00 2001 From: 宋文武 Date: Wed, 16 Sep 2015 21:17:43 +0800 Subject: gnu: procps: Update to 3.3.11. procps-ng is the new upstream. * gnu/packages/procps.scm (procps): Update to 3.3.11. [source]: Adjust formatting. Remove patches. [home-page]: Update URL. * gnu/packages/patches/procps-make-3.82.patch: Remove file. * gnu-system.am (dist_patch_DATA): Remove it. --- gnu-system.am | 1 - gnu/packages/linux.scm | 70 +++++++++-------------------- gnu/packages/patches/procps-make-3.82.patch | 14 ------ 3 files changed, 21 insertions(+), 64 deletions(-) delete mode 100644 gnu/packages/patches/procps-make-3.82.patch (limited to 'gnu-system.am') diff --git a/gnu-system.am b/gnu-system.am index 92370a2517..4363e615b0 100644 --- a/gnu-system.am +++ b/gnu-system.am @@ -603,7 +603,6 @@ dist_patch_DATA = \ gnu/packages/patches/portaudio-audacity-compat.patch \ gnu/packages/patches/preseq-1.0.2-install-to-PREFIX.patch \ gnu/packages/patches/preseq-1.0.2-link-with-libbam.patch \ - gnu/packages/patches/procps-make-3.82.patch \ gnu/packages/patches/pt-scotch-build-parallelism.patch \ gnu/packages/patches/pulseaudio-fix-mult-test.patch \ gnu/packages/patches/pulseaudio-longer-test-timeout.patch \ diff --git a/gnu/packages/linux.scm b/gnu/packages/linux.scm index 4ee42349f8..77cf865c54 100644 --- a/gnu/packages/linux.scm +++ b/gnu/packages/linux.scm @@ -457,62 +457,34 @@ providing the system administrator with some help in common tasks.") (define-public procps (package (name "procps") - (version "3.2.8") + (version "3.3.11") (source (origin - (method url-fetch) - ;; A mirror://sourceforge URI doesn't work, presumably becuase - ;; the SourceForge project is misconfigured. - (uri (string-append "http://procps.sourceforge.net/procps-" - version ".tar.gz")) - (sha256 - (base32 - "0d8mki0q4yamnkk4533kx8mc0jd879573srxhg6r2fs3lkc6iv8i")) - (patches (list (search-patch "procps-make-3.82.patch"))))) + (method url-fetch) + (uri (string-append "mirror://sourceforge/procps-ng/Production/" + "procps-ng-" version ".tar.xz")) + (sha256 + (base32 + "1va4n0mpsq327ca9dqp4hnrpgs6821rp0f2m0jyc1bfjl9lk2jg9")))) (build-system gnu-build-system) - (inputs `(("ncurses" ,ncurses))) (arguments '(#:modules ((guix build utils) (guix build gnu-build-system) (srfi srfi-1) (srfi srfi-26)) - #:phases (alist-replace - 'configure - (lambda* (#:key outputs #:allow-other-keys) - ;; No `configure', just a single Makefile. - (let ((out (assoc-ref outputs "out"))) - (substitute* "Makefile" - (("/usr/") "/") - (("--(owner|group) 0") "") - (("ldconfig") "true") - (("^LDFLAGS[[:blank:]]*:=(.*)$" _ value) - ;; Add libproc to the RPATH. - (string-append "LDFLAGS := -Wl,-rpath=" - out "/lib" value)))) - (setenv "CC" "gcc")) - (alist-replace - 'install - (lambda* (#:key outputs #:allow-other-keys) - (let ((out (assoc-ref outputs "out"))) - (and (zero? - (system* "make" "install" - (string-append "DESTDIR=" out))) - - ;; Remove commands and man pages redundant with - ;; Coreutils. - (let ((dup (append-map (cut find-files out <>) - '("^kill" "^uptime")))) - (for-each delete-file dup) - #t) - - ;; Sanity check. - (zero? - (system* (string-append out "/bin/ps") - "--version"))))) - %standard-phases)) - - ;; What did you expect? Tests? - #:tests? #f)) - (home-page "http://procps.sourceforge.net/") + #:phases + (modify-phases %standard-phases + (add-after + 'install 'post-install + ;; Remove commands and man pages redudant with + ;; Coreutils. + (lambda* (#:key outputs #:allow-other-keys) + (let* ((out (assoc-ref outputs "out")) + (dup (append-map (cut find-files out <>) + '("^kill" "^uptime")))) + (for-each delete-file dup) + #t)))))) + (inputs `(("ncurses" ,ncurses))) + (home-page "https://gitlab.com/procps-ng/procps/") (synopsis "Utilities that give information about processes") (description "Procps is the package that has a bunch of small useful utilities diff --git a/gnu/packages/patches/procps-make-3.82.patch b/gnu/packages/patches/procps-make-3.82.patch deleted file mode 100644 index 7bf53e2ccc..0000000000 --- a/gnu/packages/patches/procps-make-3.82.patch +++ /dev/null @@ -1,14 +0,0 @@ -Fix compilation with GNU Make 3.82 (patch from Nixpkgs). - -diff --git a/Makefile b/Makefile -index 09fb3ed..59eba16 100644 ---- a/Makefile -+++ b/Makefile -@@ -174,7 +174,7 @@ INSTALL := $(BINFILES) $(MANFILES) - # want this rule first, use := on ALL, and ALL not filled in yet - all: do_all - ---include */module.mk -+-include proc/module.mk ps/module.mk - - do_all: $(ALL) -- cgit v1.2.3 From e414a7dec365233ad505595bbebaff5d30e72f19 Mon Sep 17 00:00:00 2001 From: Andreas Enge Date: Wed, 2 Dec 2015 20:03:51 +0100 Subject: gnu: gmp: Drop patch included in release 6.1.0. * gnu/packages/multiprecision.scm (gmp)[source]: Drop patch. * gnu/packages/patches/gmp-arm-asm-nothumb.patch: Remove patch. * gnu-system.am (dist_patch_DATA): Unregister patch. --- gnu-system.am | 1 - gnu/packages/multiprecision.scm | 3 +-- gnu/packages/patches/gmp-arm-asm-nothumb.patch | 21 --------------------- 3 files changed, 1 insertion(+), 24 deletions(-) delete mode 100644 gnu/packages/patches/gmp-arm-asm-nothumb.patch (limited to 'gnu-system.am') diff --git a/gnu-system.am b/gnu-system.am index 4363e615b0..0eb2f28739 100644 --- a/gnu-system.am +++ b/gnu-system.am @@ -476,7 +476,6 @@ dist_patch_DATA = \ gnu/packages/patches/glibc-locale-incompatibility.patch \ gnu/packages/patches/glibc-o-largefile.patch \ gnu/packages/patches/glibc-versioned-locpath.patch \ - gnu/packages/patches/gmp-arm-asm-nothumb.patch \ gnu/packages/patches/gmp-faulty-test.patch \ gnu/packages/patches/gnucash-price-quotes-perl.patch \ gnu/packages/patches/gnutls-doc-fix.patch \ diff --git a/gnu/packages/multiprecision.scm b/gnu/packages/multiprecision.scm index 77f69f7b33..008d8c074f 100644 --- a/gnu/packages/multiprecision.scm +++ b/gnu/packages/multiprecision.scm @@ -40,8 +40,7 @@ (base32 "12b9s4jn48gbar6dbs5qrlmljdmnq43xy3ji9yjzic0mwp6dmnk8")) (patches (map search-patch - '("gmp-arm-asm-nothumb.patch" - "gmp-faulty-test.patch"))))) + '("gmp-faulty-test.patch"))))) (build-system gnu-build-system) (native-inputs `(("m4" ,m4))) (outputs '("out" "debug")) diff --git a/gnu/packages/patches/gmp-arm-asm-nothumb.patch b/gnu/packages/patches/gmp-arm-asm-nothumb.patch deleted file mode 100644 index 666cf58cf6..0000000000 --- a/gnu/packages/patches/gmp-arm-asm-nothumb.patch +++ /dev/null @@ -1,21 +0,0 @@ - -# HG changeset patch -# User Torbjorn Granlund -# Date 1396602422 -7200 -# Node ID 676e2d0f0e4dd301a7066079d2c9326c25c34a40 -# Parent 0194a75b56b21a9196626430af86c5bd9110c42d -Conditionalise ARM asm on !__thumb__. - -diff -r 0194a75b56b2 -r 676e2d0f0e4d mpn/generic/div_qr_1n_pi1.c ---- a/mpn/generic/div_qr_1n_pi1.c Thu Apr 03 23:58:51 2014 +0200 -+++ b/mpn/generic/div_qr_1n_pi1.c Fri Apr 04 11:07:02 2014 +0200 -@@ -130,7 +130,7 @@ - "%2" ((UDItype)(a0)), "r" ((UDItype)(b0)) __CLOBBER_CC) - #endif - --#if defined (__arm__) && W_TYPE_SIZE == 32 -+#if defined (__arm__) && !defined (__thumb__) && W_TYPE_SIZE == 32 - #define add_mssaaaa(m, sh, sl, ah, al, bh, bl) \ - __asm__ ( "adds %2, %5, %6\n\t" \ - "adcs %1, %3, %4\n\t" \ - -- cgit v1.2.3 From 6a4db3f3612d0c0b0b425d01ff5b311f9b485f8c Mon Sep 17 00:00:00 2001 From: Ludovic Courtès Date: Wed, 9 Dec 2015 23:10:10 +0100 Subject: gnu: libarchive: Fix test failure on SELinux systems. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reported by Jan Synáček at . * gnu/packages/patches/libarchive-bsdtar-test.patch: New file. * gnu/packages/backup.scm (libarchive)[source]: Use it. * gnu-system.am (dist_patch_DATA): Add it. --- gnu-system.am | 1 + gnu/packages/backup.scm | 3 +- gnu/packages/patches/libarchive-bsdtar-test.patch | 74 +++++++++++++++++++++++ 3 files changed, 77 insertions(+), 1 deletion(-) create mode 100644 gnu/packages/patches/libarchive-bsdtar-test.patch (limited to 'gnu-system.am') diff --git a/gnu-system.am b/gnu-system.am index 0eb2f28739..463f98c0e9 100644 --- a/gnu-system.am +++ b/gnu-system.am @@ -514,6 +514,7 @@ dist_patch_DATA = \ gnu/packages/patches/liba52-link-with-libm.patch \ gnu/packages/patches/liba52-set-soname.patch \ gnu/packages/patches/liba52-use-mtune-not-mcpu.patch \ + gnu/packages/patches/libarchive-bsdtar-test.patch \ gnu/packages/patches/libarchive-CVE-2013-0211.patch \ gnu/packages/patches/libarchive-fix-lzo-test-case.patch \ gnu/packages/patches/libarchive-mtree-filename-length-fix.patch \ diff --git a/gnu/packages/backup.scm b/gnu/packages/backup.scm index 84d27c08a6..287438e035 100644 --- a/gnu/packages/backup.scm +++ b/gnu/packages/backup.scm @@ -145,7 +145,8 @@ backups (called chunks) to allow easy burning to CD/DVD.") (patches (list (search-patch "libarchive-mtree-filename-length-fix.patch") (search-patch "libarchive-fix-lzo-test-case.patch") - (search-patch "libarchive-CVE-2013-0211.patch"))))) + (search-patch "libarchive-CVE-2013-0211.patch") + (search-patch "libarchive-bsdtar-test.patch"))))) (build-system gnu-build-system) (inputs `(("zlib" ,zlib) diff --git a/gnu/packages/patches/libarchive-bsdtar-test.patch b/gnu/packages/patches/libarchive-bsdtar-test.patch new file mode 100644 index 0000000000..6a533a9a07 --- /dev/null +++ b/gnu/packages/patches/libarchive-bsdtar-test.patch @@ -0,0 +1,74 @@ +commit b539b2e597b566fe3c4b49cb61c9eef83e5e052d +Author: Pavel Raiskup +Date: Thu Jun 27 16:01:30 2013 +0200 + + Use ustar format in the test_option_b test + + .. because the ustar archive does not store SELinux context. As the default + format for bsdtar is "restricted pax" (trying to store xattrs and other + things by default), the test failed on Fedora because our files have by + default SELinux context set. This results in additional data in tested + archive ~> and the test failed because the archive was unexpectedly big: + + tar/test/test_option_b.c:41: File archive1.tar has size 3072, expected 2048 + + Reviewed by Konrad Kleine + +diff --git a/tar/test/test_option_b.c b/tar/test/test_option_b.c +index be2ae65..6fea474 100644 +--- a/tar/test/test_option_b.c ++++ b/tar/test/test_option_b.c +@@ -25,8 +25,14 @@ + #include "test.h" + __FBSDID("$FreeBSD$"); + ++#define USTAR_OPT " --format=ustar" ++ + DEFINE_TEST(test_option_b) + { ++ char *testprog_ustar = malloc(strlen(testprog) + sizeof(USTAR_OPT) + 1); ++ strcpy(testprog_ustar, testprog); ++ strcat(testprog_ustar, USTAR_OPT); ++ + assertMakeFile("file1", 0644, "file1"); + if (systemf("cat file1 > test_cat.out 2> test_cat.err") != 0) { + skipping("Platform doesn't have cat"); +@@ -36,7 +42,7 @@ DEFINE_TEST(test_option_b) + /* + * Bsdtar does not pad if the output is going directly to a disk file. + */ +- assertEqualInt(0, systemf("%s -cf archive1.tar file1 >test1.out 2>test1.err", testprog)); ++ assertEqualInt(0, systemf("%s -cf archive1.tar file1 >test1.out 2>test1.err", testprog_ustar)); + failure("bsdtar does not pad archives written directly to regular files"); + assertFileSize("archive1.tar", 2048); + assertEmptyFile("test1.out"); +@@ -46,24 +52,24 @@ DEFINE_TEST(test_option_b) + * Bsdtar does pad to the block size if the output is going to a socket. + */ + /* Default is -b 20 */ +- assertEqualInt(0, systemf("%s -cf - file1 2>test2.err | cat >archive2.tar ", testprog)); ++ assertEqualInt(0, systemf("%s -cf - file1 2>test2.err | cat >archive2.tar ", testprog_ustar)); + failure("bsdtar does pad archives written to pipes"); + assertFileSize("archive2.tar", 10240); + assertEmptyFile("test2.err"); + +- assertEqualInt(0, systemf("%s -cf - -b 20 file1 2>test3.err | cat >archive3.tar ", testprog)); ++ assertEqualInt(0, systemf("%s -cf - -b 20 file1 2>test3.err | cat >archive3.tar ", testprog_ustar)); + assertFileSize("archive3.tar", 10240); + assertEmptyFile("test3.err"); + +- assertEqualInt(0, systemf("%s -cf - -b 10 file1 2>test4.err | cat >archive4.tar ", testprog)); ++ assertEqualInt(0, systemf("%s -cf - -b 10 file1 2>test4.err | cat >archive4.tar ", testprog_ustar)); + assertFileSize("archive4.tar", 5120); + assertEmptyFile("test4.err"); + +- assertEqualInt(0, systemf("%s -cf - -b 1 file1 2>test5.err | cat >archive5.tar ", testprog)); ++ assertEqualInt(0, systemf("%s -cf - -b 1 file1 2>test5.err | cat >archive5.tar ", testprog_ustar)); + assertFileSize("archive5.tar", 2048); + assertEmptyFile("test5.err"); + +- assertEqualInt(0, systemf("%s -cf - -b 8192 file1 2>test6.err | cat >archive6.tar ", testprog)); ++ assertEqualInt(0, systemf("%s -cf - -b 8192 file1 2>test6.err | cat >archive6.tar ", testprog_ustar)); + assertFileSize("archive6.tar", 4194304); + assertEmptyFile("test6.err"); + -- cgit v1.2.3 From 7dda44a6b965b2349e3b27b588fac72a02eae487 Mon Sep 17 00:00:00 2001 From: Ludovic Courtès Date: Sat, 12 Dec 2015 11:50:59 +0100 Subject: build: Add missing patches to the distribution. * gnu-system.am (dist_patch_DATA): Add glibc-hurd-extern-inline.patch and plink-1.07-unclobber-i.patch. --- gnu-system.am | 2 ++ 1 file changed, 2 insertions(+) (limited to 'gnu-system.am') diff --git a/gnu-system.am b/gnu-system.am index ef4db3c302..14b8fdf501 100644 --- a/gnu-system.am +++ b/gnu-system.am @@ -485,6 +485,7 @@ dist_patch_DATA = \ gnu/packages/patches/glib-tests-timer.patch \ gnu/packages/patches/glib-tests-gapplication.patch \ gnu/packages/patches/glibc-bootstrap-system.patch \ + gnu/packages/patches/glibc-hurd-extern-inline.patch \ gnu/packages/patches/glibc-ldd-x86_64.patch \ gnu/packages/patches/glibc-locales.patch \ gnu/packages/patches/glibc-locale-incompatibility.patch \ @@ -623,6 +624,7 @@ dist_patch_DATA = \ gnu/packages/patches/perl-tk-x11-discover.patch \ gnu/packages/patches/pidgin-add-search-path.patch \ gnu/packages/patches/pingus-sdl-libs-config.patch \ + gnu/packages/patches/plink-1.07-unclobber-i.patch \ gnu/packages/patches/plotutils-libpng-jmpbuf.patch \ gnu/packages/patches/polkit-drop-test.patch \ gnu/packages/patches/portaudio-audacity-compat.patch \ -- cgit v1.2.3 From 4de35074833742e45237464bb1727ce1a55f3336 Mon Sep 17 00:00:00 2001 From: Ludovic Courtès Date: Sat, 12 Dec 2015 22:14:57 +0100 Subject: gnu: perl: Update to 5.22.0. * gnu/packages/perl.scm (perl)[source]: Update to 5.22.0. Remove "perl-module-pluggable-search.patch" since Module::Pluggable appears to be gone. [arguments] : Adjust Cwd.pm file name. Replace -std=c89 with -std=gnu89. * gnu/packages/commencement.scm (perl-boot0): Add 'disable-pthreads' phase. * gnu/packages/patches/perl-no-sys-dirs.patch: Update. * gnu/packages/patches/perl-module-pluggable-search.patch: Remove. * gnu-system.am (dist_patch_DATA): Adjust accordingly. --- gnu-system.am | 1 - gnu/packages/commencement.scm | 23 +++- .../patches/perl-module-pluggable-search.patch | 25 ---- gnu/packages/patches/perl-no-sys-dirs.patch | 152 +++++++++++++++++---- gnu/packages/perl.scm | 17 ++- 5 files changed, 154 insertions(+), 64 deletions(-) delete mode 100644 gnu/packages/patches/perl-module-pluggable-search.patch (limited to 'gnu-system.am') diff --git a/gnu-system.am b/gnu-system.am index 14b8fdf501..1db9d51ca2 100644 --- a/gnu-system.am +++ b/gnu-system.am @@ -617,7 +617,6 @@ dist_patch_DATA = \ gnu/packages/patches/perl-autosplit-default-time.patch \ gnu/packages/patches/perl-finance-quote-unuse-mozilla-ca.patch \ gnu/packages/patches/perl-gd-options-passthrough-and-fontconfig.patch \ - gnu/packages/patches/perl-module-pluggable-search.patch \ gnu/packages/patches/perl-net-amazon-s3-moose-warning.patch \ gnu/packages/patches/perl-net-ssleay-disable-ede-test.patch \ gnu/packages/patches/perl-no-sys-dirs.patch \ diff --git a/gnu/packages/commencement.scm b/gnu/packages/commencement.scm index 1b0497227f..3ddaa98c2f 100644 --- a/gnu/packages/commencement.scm +++ b/gnu/packages/commencement.scm @@ -260,11 +260,24 @@ (package-native-inputs gcc)))))) (define perl-boot0 - (package-with-bootstrap-guile - (package-with-explicit-inputs perl - %boot0-inputs - (current-source-location) - #:guile %bootstrap-guile))) + (let ((perl (package + (inherit perl) + (arguments + (substitute-keyword-arguments (package-arguments perl) + ((#:phases phases) + `(modify-phases ,phases + ;; Pthread support is missing in the bootstrap compiler + ;; (broken spec file), so disable it. + (add-before 'configure 'disable-pthreads + (lambda _ + (substitute* "Configure" + (("^libswanted=(.*)pthread" _ before) + (string-append "libswanted=" before)))))))))))) + (package-with-bootstrap-guile + (package-with-explicit-inputs perl + %boot0-inputs + (current-source-location) + #:guile %bootstrap-guile)))) (define (linux-libre-headers-boot0) "Return Linux-Libre header files for the bootstrap environment." diff --git a/gnu/packages/patches/perl-module-pluggable-search.patch b/gnu/packages/patches/perl-module-pluggable-search.patch deleted file mode 100644 index bb2a57f7e5..0000000000 --- a/gnu/packages/patches/perl-module-pluggable-search.patch +++ /dev/null @@ -1,25 +0,0 @@ -Fix core Perl module Module::Pluggable such that it can find plugins that live -in symlinked directories. - -Patch borrowed/adapted from Nixpkgs. - ---- perl-5.16.1/cpan/Module-Pluggable/lib/Module/Pluggable/Object.pm 2015-04-08 23:28:48.120164135 -0500 -+++ perl-5.16.1/cpan/Module-Pluggable/lib/Module/Pluggable/Object.pm 2015-04-08 23:30:27.032166704 -0500 -@@ -164,7 +164,7 @@ - my $sp = catdir($dir, (split /::/, $searchpath)); - - # if it doesn't exist or it's not a dir then skip it -- next unless ( -e $sp && -d _ ); # Use the cached stat the second time -+ next unless ( -e $sp ); - - my @files = $self->find_files($sp); - -@@ -279,7 +279,7 @@ - (my $path = $File::Find::name) =~ s#^\\./##; - push @files, $path; - } -- }, $search_path ); -+ }, "$search_path/." ); - } - #chdir $cwd; - return @files; diff --git a/gnu/packages/patches/perl-no-sys-dirs.patch b/gnu/packages/patches/perl-no-sys-dirs.patch index 3aba4d7529..da91fef3b4 100644 --- a/gnu/packages/patches/perl-no-sys-dirs.patch +++ b/gnu/packages/patches/perl-no-sys-dirs.patch @@ -1,10 +1,10 @@ -Don't long for headers and libraries in "traditional" locations. +Don't look for headers and libraries in "traditional" locations. Patch from Nixpkgs by Eelco Dolstra . -diff -ru -x '*~' perl-5.14.2-orig/Configure perl-5.14.2/Configure ---- perl-5.14.2-orig/Configure 2011-09-26 11:44:34.000000000 +0200 -+++ perl-5.14.2/Configure 2012-01-20 17:05:23.089223129 +0100 +diff -ru -x '*~' -x '*.rej' perl-5.20.0-orig/Configure perl-5.20.0/Configure +--- perl-5.20.0-orig/Configure 2014-05-26 15:34:18.000000000 +0200 ++++ perl-5.20.0/Configure 2014-06-25 10:43:35.368285986 +0200 @@ -106,15 +106,7 @@ fi @@ -22,7 +22,7 @@ diff -ru -x '*~' perl-5.14.2-orig/Configure perl-5.14.2/Configure for p in $paths do -@@ -1311,8 +1303,7 @@ +@@ -1337,8 +1329,7 @@ archname='' : Possible local include directories to search. : Set locincpth to "" in a hint file to defeat local include searches. @@ -32,8 +32,8 @@ diff -ru -x '*~' perl-5.14.2-orig/Configure perl-5.14.2/Configure : : no include file wanted by default inclwanted='' -@@ -1328,17 +1319,12 @@ - archobjs='' +@@ -1349,17 +1340,12 @@ + libnames='' : change the next line if compiling for Xenix/286 on Xenix/386 -xlibpth='/usr/lib/386 /lib/386' @@ -53,7 +53,7 @@ diff -ru -x '*~' perl-5.14.2-orig/Configure perl-5.14.2/Configure : Private path used by Configure to find libraries. Its value : is prepended to libpth. This variable takes care of special -@@ -1371,8 +1357,6 @@ +@@ -1391,8 +1377,6 @@ libswanted="$libswanted m crypt sec util c cposix posix ucb bsd BSD" : We probably want to search /usr/shlib before most other libraries. : This is only used by the lib/ExtUtils/MakeMaker.pm routine extliblist. @@ -62,27 +62,27 @@ diff -ru -x '*~' perl-5.14.2-orig/Configure perl-5.14.2/Configure : Do not use vfork unless overridden by a hint file. usevfork=false -@@ -2380,7 +2364,6 @@ +@@ -2446,7 +2430,6 @@ zip " pth=`echo $PATH | sed -e "s/$p_/ /g"` --pth="$pth /lib /usr/lib" +-pth="$pth $sysroot/lib $sysroot/usr/lib" for file in $loclist; do eval xxx=\$$file case "$xxx" in -@@ -4785,7 +4768,7 @@ +@@ -4936,7 +4919,7 @@ : Set private lib path case "$plibpth" in '') if ./mips; then -- plibpth="$incpath/usr/lib /usr/local/lib /usr/ccs/lib" -+ plibpth="$incpath/usr/lib" - fi;; +- plibpth="$incpath/usr/lib $sysroot/usr/local/lib $sysroot/usr/ccs/lib" ++ plibpth="$incpath/usr/lib" + fi;; esac case "$libpth" in -@@ -8390,13 +8373,8 @@ +@@ -8600,13 +8583,8 @@ echo " " case "$sysman" in - '') + '') - syspath='/usr/share/man/man1 /usr/man/man1' - syspath="$syspath /usr/man/mann /usr/man/manl /usr/man/local/man1" - syspath="$syspath /usr/man/u_man/man1" @@ -95,7 +95,7 @@ diff -ru -x '*~' perl-5.14.2-orig/Configure perl-5.14.2/Configure ;; esac if $test -d "$sysman"; then -@@ -19721,9 +19699,10 @@ +@@ -19900,9 +19878,10 @@ case "$full_ar" in '') full_ar=$ar ;; esac @@ -107,10 +107,11 @@ diff -ru -x '*~' perl-5.14.2-orig/Configure perl-5.14.2/Configure : see what type gids are declared as in the kernel echo " " -diff -ru -x '*~' perl-5.14.2-orig/ext/Errno/Errno_pm.PL perl-5.14.2/ext/Errno/Errno_pm.PL ---- perl-5.14.2-orig/ext/Errno/Errno_pm.PL 2011-09-26 11:44:34.000000000 +0200 -+++ perl-5.14.2/ext/Errno/Errno_pm.PL 2012-01-20 17:02:07.938138311 +0100 -@@ -137,11 +137,7 @@ +Only in perl-5.20.0/: Configure.orig +diff -ru -x '*~' -x '*.rej' perl-5.20.0-orig/ext/Errno/Errno_pm.PL perl-5.20.0/ext/Errno/Errno_pm.PL +--- perl-5.20.0-orig/ext/Errno/Errno_pm.PL 2014-05-26 15:34:20.000000000 +0200 ++++ perl-5.20.0/ext/Errno/Errno_pm.PL 2014-06-25 10:31:24.317970047 +0200 +@@ -126,11 +126,7 @@ if ($dep =~ /(\S+errno\.h)/) { $file{$1} = 1; } @@ -120,13 +121,14 @@ diff -ru -x '*~' perl-5.14.2-orig/ext/Errno/Errno_pm.PL perl-5.14.2/ext/Errno/Er - # might be using, say, Intel's icc - ) { + } elsif (0) { + # When cross-compiling we may store a path for gcc's "sysroot" option: + my $sysroot = $Config{sysroot} || ''; # Some Linuxes have weird errno.hs which generate - # no #file or #line directives - my $linux_errno_h = -e '/usr/include/errno.h' ? -diff -ru -x '*~' perl-5.14.2-orig/hints/freebsd.sh perl-5.14.2/hints/freebsd.sh ---- perl-5.14.2-orig/hints/freebsd.sh 2011-09-19 15:18:22.000000000 +0200 -+++ perl-5.14.2/hints/freebsd.sh 2012-01-20 17:10:37.267924044 +0100 -@@ -118,21 +118,21 @@ +Only in perl-5.20.0/ext/Errno: Errno_pm.PL.orig +diff -ru -x '*~' -x '*.rej' perl-5.20.0-orig/hints/freebsd.sh perl-5.20.0/hints/freebsd.sh +--- perl-5.20.0-orig/hints/freebsd.sh 2014-01-31 22:55:51.000000000 +0100 ++++ perl-5.20.0/hints/freebsd.sh 2014-06-25 10:25:53.263964680 +0200 +@@ -119,21 +119,21 @@ objformat=`/usr/bin/objformat` if [ x$objformat = xaout ]; then if [ -e /usr/lib/aout ]; then @@ -154,3 +156,99 @@ diff -ru -x '*~' perl-5.14.2-orig/hints/freebsd.sh perl-5.14.2/hints/freebsd.sh ldflags="-Wl,-E " lddlflags="-shared " cccdlflags='-DPIC -fPIC' +diff -ru -x '*~' -x '*.rej' perl-5.20.0-orig/hints/linux.sh perl-5.20.0/hints/linux.sh +--- perl-5.20.0-orig/hints/linux.sh 2014-05-26 15:34:20.000000000 +0200 ++++ perl-5.20.0/hints/linux.sh 2014-06-25 10:33:47.354883843 +0200 +@@ -150,25 +150,6 @@ + ;; + esac + +-# Ubuntu 11.04 (and later, presumably) doesn't keep most libraries +-# (such as -lm) in /lib or /usr/lib. So we have to ask gcc to tell us +-# where to look. We don't want gcc's own libraries, however, so we +-# filter those out. +-# This could be conditional on Unbuntu, but other distributions may +-# follow suit, and this scheme seems to work even on rather old gcc's. +-# This unconditionally uses gcc because even if the user is using another +-# compiler, we still need to find the math library and friends, and I don't +-# know how other compilers will cope with that situation. +-# Morever, if the user has their own gcc earlier in $PATH than the system gcc, +-# we don't want its libraries. So we try to prefer the system gcc +-# Still, as an escape hatch, allow Configure command line overrides to +-# plibpth to bypass this check. +-if [ -x /usr/bin/gcc ] ; then +- gcc=/usr/bin/gcc +-else +- gcc=gcc +-fi +- + case "$plibpth" in + '') plibpth=`LANG=C LC_ALL=C $gcc $ccflags $ldflags -print-search-dirs | grep libraries | + cut -f2- -d= | tr ':' $trnl | grep -v 'gcc' | sed -e 's:/$::'` +@@ -178,32 +159,6 @@ + ;; + esac + +-case "$libc" in +-'') +-# If you have glibc, then report the version for ./myconfig bug reporting. +-# (Configure doesn't need to know the specific version since it just uses +-# gcc to load the library for all tests.) +-# We don't use __GLIBC__ and __GLIBC_MINOR__ because they +-# are insufficiently precise to distinguish things like +-# libc-2.0.6 and libc-2.0.7. +- for p in $plibpth +- do +- for trylib in libc.so.6 libc.so +- do +- if $test -e $p/$trylib; then +- libc=`ls -l $p/$trylib | awk '{print $NF}'` +- if $test "X$libc" != X; then +- break +- fi +- fi +- done +- if $test "X$libc" != X; then +- break +- fi +- done +- ;; +-esac +- + # Are we using ELF? Thanks to Kenneth Albanowski + # for this test. + cat >try.c <<'EOM' +@@ -367,33 +322,6 @@ + ;; + esac + +-# SuSE8.2 has /usr/lib/libndbm* which are ld scripts rather than +-# true libraries. The scripts cause binding against static +-# version of -lgdbm which is a bad idea. So if we have 'nm' +-# make sure it can read the file +-# NI-S 2003/08/07 +-case "$nm" in +- '') ;; +- *) +- for p in $plibpth +- do +- if $test -r $p/libndbm.so; then +- if $nm $p/libndbm.so >/dev/null 2>&1 ; then +- echo 'Your shared -lndbm seems to be a real library.' +- _libndbm_real=1 +- break +- fi +- fi +- done +- if $test "X$_libndbm_real" = X; then +- echo 'Your shared -lndbm is not a real library.' +- set `echo X "$libswanted "| sed -e 's/ ndbm / /'` +- shift +- libswanted="$*" +- fi +- ;; +-esac +- + # Linux on Synology. + if [ -f /etc/synoinfo.conf -a -d /usr/syno ]; then + # Tested on Synology DS213 and DS413 diff --git a/gnu/packages/perl.scm b/gnu/packages/perl.scm index 95aa596cf5..8fec270b61 100644 --- a/gnu/packages/perl.scm +++ b/gnu/packages/perl.scm @@ -1,5 +1,5 @@ ;;; GNU Guix --- Functional package management for GNU -;;; Copyright © 2012, 2013, 2014 Ludovic Courtès +;;; Copyright © 2012, 2013, 2014, 2015 Ludovic Courtès ;;; Copyright © 2013 Andreas Enge ;;; Copyright © 2015 Ricardo Wurmus ;;; Copyright © 2015 Eric Bavier @@ -37,18 +37,17 @@ ;; Yeah, Perl... It is required early in the bootstrap process by Linux. (package (name "perl") - (version "5.16.1") + (version "5.22.0") (source (origin (method url-fetch) (uri (string-append "http://www.cpan.org/src/5.0/perl-" version ".tar.gz")) (sha256 (base32 - "15qxzba3a50c9nik5ydgyfp62x7h9vxxn12yd1jgl93hb1wj96km")) + "0g5bl8sdpzx9gx2g5jq3py4bj07z2ylk7s1qn0fvsss2yl3hhs8c")) (patches (map search-patch '("perl-no-sys-dirs.patch" - "perl-autosplit-default-time.patch" - "perl-module-pluggable-search.patch"))))) + "perl-autosplit-default-time.patch"))))) (build-system gnu-build-system) (arguments '(#:tests? #f @@ -60,10 +59,16 @@ (let ((out (assoc-ref outputs "out")) (libc (assoc-ref inputs "libc"))) ;; Use the right path for `pwd'. - (substitute* "dist/Cwd/Cwd.pm" + (substitute* "dist/PathTools/Cwd.pm" (("/bin/pwd") (which "pwd"))) + ;; Build in GNU89 mode to tolerate C++-style comment in libc's + ;; . + (substitute* "cflags.SH" + (("-std=c89") + "-std=gnu89")) + (zero? (system* "./Configure" (string-append "-Dprefix=" out) -- cgit v1.2.3 From 4187fe750f128f934bd6030912133d13d19baafd Mon Sep 17 00:00:00 2001 From: Ludovic Courtès Date: Sun, 13 Dec 2015 11:25:24 +0100 Subject: gnu: perl: Build deterministically, and make byproducts deterministic. With this, a --rounds=2 build passes, and timestamps in POD files can be controlled with 'SOURCE_DATE_EPOCH'. * gnu/packages/patches/perl-deterministic-ordering.patch, gnu/packages/patches/perl-no-build-time.patch, gnu/packages/patches/perl-source-date-epoch.patch: New files. * gnu/packages/perl.scm (perl)[source]: Use them. * gnu-system.am (dist_patch_DATA): Add them. --- gnu-system.am | 3 +++ .../patches/perl-deterministic-ordering.patch | 29 ++++++++++++++++++++++ gnu/packages/patches/perl-no-build-time.patch | 26 +++++++++++++++++++ gnu/packages/patches/perl-source-date-epoch.patch | 19 ++++++++++++++ gnu/packages/perl.scm | 5 +++- 5 files changed, 81 insertions(+), 1 deletion(-) create mode 100644 gnu/packages/patches/perl-deterministic-ordering.patch create mode 100644 gnu/packages/patches/perl-no-build-time.patch create mode 100644 gnu/packages/patches/perl-source-date-epoch.patch (limited to 'gnu-system.am') diff --git a/gnu-system.am b/gnu-system.am index 1db9d51ca2..0fff8def1d 100644 --- a/gnu-system.am +++ b/gnu-system.am @@ -615,11 +615,14 @@ dist_patch_DATA = \ gnu/packages/patches/patchutils-xfail-gendiff-tests.patch \ gnu/packages/patches/patch-hurd-path-max.patch \ gnu/packages/patches/perl-autosplit-default-time.patch \ + gnu/packages/patches/perl-deterministic-ordering.patch \ gnu/packages/patches/perl-finance-quote-unuse-mozilla-ca.patch \ gnu/packages/patches/perl-gd-options-passthrough-and-fontconfig.patch \ gnu/packages/patches/perl-net-amazon-s3-moose-warning.patch \ gnu/packages/patches/perl-net-ssleay-disable-ede-test.patch \ + gnu/packages/patches/perl-no-build-time.patch \ gnu/packages/patches/perl-no-sys-dirs.patch \ + gnu/packages/patches/perl-source-date-epoch.patch \ gnu/packages/patches/perl-tk-x11-discover.patch \ gnu/packages/patches/pidgin-add-search-path.patch \ gnu/packages/patches/pingus-sdl-libs-config.patch \ diff --git a/gnu/packages/patches/perl-deterministic-ordering.patch b/gnu/packages/patches/perl-deterministic-ordering.patch new file mode 100644 index 0000000000..92e33ef135 --- /dev/null +++ b/gnu/packages/patches/perl-deterministic-ordering.patch @@ -0,0 +1,29 @@ +From . + +From c01f602d1926b0671fd2c8d91f7e52c4e4c9fb24 Mon Sep 17 00:00:00 2001 +From: Niko Tyni +Date: Sun, 11 Oct 2015 19:27:56 +0300 +Subject: [PATCH] Sort the list of XS code files when generating RealPPPort.xs + +all_files_in_dir() uses readdir() ordering to make the list of +input files. This can vary between build systems, breaking build +reproducibility. +--- + cpan/Devel-PPPort/PPPort_xs.PL | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/cpan/Devel-PPPort/PPPort_xs.PL b/cpan/Devel-PPPort/PPPort_xs.PL +index 5f18940..149f2fe 100644 +--- a/cpan/Devel-PPPort/PPPort_xs.PL ++++ b/cpan/Devel-PPPort/PPPort_xs.PL +@@ -38,7 +38,7 @@ END + my $file; + my $sec; + +-for $file (all_files_in_dir('parts/inc')) { ++for $file (sort(all_files_in_dir('parts/inc'))) { + my $spec = parse_partspec($file); + + my $msg = 0; +-- +2.5.1 diff --git a/gnu/packages/patches/perl-no-build-time.patch b/gnu/packages/patches/perl-no-build-time.patch new file mode 100644 index 0000000000..5d78e8f462 --- /dev/null +++ b/gnu/packages/patches/perl-no-build-time.patch @@ -0,0 +1,26 @@ +Do not record the configuration and build time so that builds can be +reproduced bit-for-bit. + +--- perl-5.22.0/Configure 1970-01-01 01:00:00.000000000 +0100 ++++ perl-5.22.0/Configure 2015-12-13 00:14:43.148165080 +0100 +@@ -3834,6 +3817,7 @@ esac + + : who configured the system + cf_time=`LC_ALL=C; LANGUAGE=C; export LC_ALL; export LANGUAGE; $date 2>&1` ++cf_time='Thu Jan 1 00:00:01 UTC 1970' + case "$cf_by" in + "") + cf_by=`(logname) 2>/dev/null` + +--- perl-5.22.0/perl.c 2015-12-13 00:25:30.269156627 +0100 ++++ perl-5.22.0/perl.c 2015-12-13 00:25:38.265218175 +0100 +@@ -1795,7 +1795,7 @@ S_Internals_V(pTHX_ CV *cv) + PUSHs(Perl_newSVpvn_flags(aTHX_ non_bincompat_options, + sizeof(non_bincompat_options) - 1, SVs_TEMP)); + +-#ifdef __DATE__ ++#if 0 + # ifdef __TIME__ + PUSHs(Perl_newSVpvn_flags(aTHX_ + STR_WITH_LEN("Compiled at " __DATE__ " " __TIME__), + diff --git a/gnu/packages/patches/perl-source-date-epoch.patch b/gnu/packages/patches/perl-source-date-epoch.patch new file mode 100644 index 0000000000..37330c9537 --- /dev/null +++ b/gnu/packages/patches/perl-source-date-epoch.patch @@ -0,0 +1,19 @@ +Adapted from . +Make Pod::Man honor the SOURCE_DATE_EPOCH environment variable. + +--- perl-5.22.0/cpan/podlators/lib/Pod/Man.pm 2015-12-12 22:33:03.321787590 +0100 ++++ perl-5.22.0/cpan/podlators/lib/Pod/Man.pm 2015-12-12 22:36:33.367361338 +0100 +@@ -884,7 +884,12 @@ sub devise_date { + my ($self) = @_; + my $input = $self->source_filename; + my $time; +- if ($input) { ++ ++ if (defined($ENV{SOURCE_DATE_EPOCH}) && ++ $ENV{SOURCE_DATE_EPOCH} !~ /\D/) { ++ $time = $ENV{SOURCE_DATE_EPOCH}; ++ } ++ elsif ($input) { + $time = (stat $input)[9] || time; + } else { + $time = time; diff --git a/gnu/packages/perl.scm b/gnu/packages/perl.scm index 8fec270b61..6afe0b73ec 100644 --- a/gnu/packages/perl.scm +++ b/gnu/packages/perl.scm @@ -47,7 +47,10 @@ "0g5bl8sdpzx9gx2g5jq3py4bj07z2ylk7s1qn0fvsss2yl3hhs8c")) (patches (map search-patch '("perl-no-sys-dirs.patch" - "perl-autosplit-default-time.patch"))))) + "perl-autosplit-default-time.patch" + "perl-source-date-epoch.patch" + "perl-deterministic-ordering.patch" + "perl-no-build-time.patch"))))) (build-system gnu-build-system) (arguments '(#:tests? #f -- cgit v1.2.3 From 8309c3899aee9429df51eba4566c67d0cc27f68c Mon Sep 17 00:00:00 2001 From: Ludovic Courtès Date: Fri, 18 Dec 2015 16:58:09 +0100 Subject: gnu: commencement: Use GMP 6.0.0a for bootstrapping. * gnu/packages/multiprecision.scm (gmp-6.0): New variable. * gnu/packages/commencement.scm (gcc-boot0, gcc-final): Use it. * gnu/packages/patches/gmp-arm-asm-nothumb.patch: New file, reinstated from before e414a7d. * gnu-system.am (dist_patch_DATA): Add it. --- gnu-system.am | 1 + gnu/packages/commencement.scm | 6 +++--- gnu/packages/multiprecision.scm | 18 ++++++++++++++++++ gnu/packages/patches/gmp-arm-asm-nothumb.patch | 21 +++++++++++++++++++++ 4 files changed, 43 insertions(+), 3 deletions(-) create mode 100644 gnu/packages/patches/gmp-arm-asm-nothumb.patch (limited to 'gnu-system.am') diff --git a/gnu-system.am b/gnu-system.am index 0fff8def1d..0e53ce229b 100644 --- a/gnu-system.am +++ b/gnu-system.am @@ -491,6 +491,7 @@ dist_patch_DATA = \ gnu/packages/patches/glibc-locale-incompatibility.patch \ gnu/packages/patches/glibc-o-largefile.patch \ gnu/packages/patches/glibc-versioned-locpath.patch \ + gnu/packages/patches/gmp-arm-asm-nothumb.patch \ gnu/packages/patches/gmp-faulty-test.patch \ gnu/packages/patches/gnucash-price-quotes-perl.patch \ gnu/packages/patches/gnutls-doc-fix.patch \ diff --git a/gnu/packages/commencement.scm b/gnu/packages/commencement.scm index 8aa32e859d..eda04325f0 100644 --- a/gnu/packages/commencement.scm +++ b/gnu/packages/commencement.scm @@ -231,7 +231,7 @@ (package-full-name lib) char-set:letter) ,(package-name lib))) - (list gmp mpfr mpc)))) + (list gmp-6.0 mpfr mpc)))) (alist-cons-after 'install 'symlink-libgcc_eh (lambda* (#:key outputs #:allow-other-keys) @@ -245,7 +245,7 @@ (symlink "libgcc.a" "libgcc_eh.a")))) ,phases)))))) - (inputs `(("gmp-source" ,(package-source gmp)) + (inputs `(("gmp-source" ,(package-source gmp-6.0)) ("mpfr-source" ,(package-source mpfr)) ("mpc-source" ,(package-source mpc)) ("binutils-cross" ,binutils-boot0) @@ -636,7 +636,7 @@ exec ~a/bin/~a-~a -B~a/lib -Wl,-dynamic-linker -Wl,~a/~a \"$@\"~%" ("static-bash" ,static-bash-for-glibc) ,@(package-native-inputs gcc-boot0))) - (inputs `(("gmp-source" ,(bootstrap-origin (package-source gmp))) + (inputs `(("gmp-source" ,(bootstrap-origin (package-source gmp-6.0))) ("mpfr-source" ,(package-source mpfr)) ("mpc-source" ,(package-source mpc)) ("ld-wrapper" ,ld-wrapper-boot3) diff --git a/gnu/packages/multiprecision.scm b/gnu/packages/multiprecision.scm index 3be612ae62..ad507706db 100644 --- a/gnu/packages/multiprecision.scm +++ b/gnu/packages/multiprecision.scm @@ -60,6 +60,24 @@ cryptography and computational algebra.") (license lgpl3+) (home-page "http://gmplib.org/"))) +(define-public gmp-6.0 + ;; We keep this one around to bootstrap GCC, to work around a compilation + ;; issue on ARM. See + ;; . + (package + (inherit gmp) + (version "6.0.0a") + (source (origin + (method url-fetch) + (uri (string-append "mirror://gnu/gmp/gmp-" + version ".tar.xz")) + (sha256 + (base32 + "0r5pp27cy7ch3dg5v0rsny8bib1zfvrza6027g2mp5f6v8pd6mli")) + (patches (map search-patch + '("gmp-arm-asm-nothumb.patch" + "gmp-faulty-test.patch"))))))) + (define-public mpfr (package (name "mpfr") diff --git a/gnu/packages/patches/gmp-arm-asm-nothumb.patch b/gnu/packages/patches/gmp-arm-asm-nothumb.patch new file mode 100644 index 0000000000..666cf58cf6 --- /dev/null +++ b/gnu/packages/patches/gmp-arm-asm-nothumb.patch @@ -0,0 +1,21 @@ + +# HG changeset patch +# User Torbjorn Granlund +# Date 1396602422 -7200 +# Node ID 676e2d0f0e4dd301a7066079d2c9326c25c34a40 +# Parent 0194a75b56b21a9196626430af86c5bd9110c42d +Conditionalise ARM asm on !__thumb__. + +diff -r 0194a75b56b2 -r 676e2d0f0e4d mpn/generic/div_qr_1n_pi1.c +--- a/mpn/generic/div_qr_1n_pi1.c Thu Apr 03 23:58:51 2014 +0200 ++++ b/mpn/generic/div_qr_1n_pi1.c Fri Apr 04 11:07:02 2014 +0200 +@@ -130,7 +130,7 @@ + "%2" ((UDItype)(a0)), "r" ((UDItype)(b0)) __CLOBBER_CC) + #endif + +-#if defined (__arm__) && W_TYPE_SIZE == 32 ++#if defined (__arm__) && !defined (__thumb__) && W_TYPE_SIZE == 32 + #define add_mssaaaa(m, sh, sl, ah, al, bh, bl) \ + __asm__ ( "adds %2, %5, %6\n\t" \ + "adcs %1, %3, %4\n\t" \ + -- cgit v1.2.3 From e80d2555f5dfa89cd44b261ead2c5fd397a51f56 Mon Sep 17 00:00:00 2001 From: Ludovic Courtès Date: Fri, 1 Jan 2016 00:55:24 +0100 Subject: gnu: findutils: Update to 4.6.0. * gnu/packages/patches/findutils-absolute-paths.patch: Remove. * gnu/packages/patches/findutils-test-xargs.patch: New file. * gnu-system.am (dist_patch_DATA): Adjust accordingly. * gnu/packages/base.scm (findutils): Update to 4.6.0. Remove 'findutils-absolute-paths.patch' and add 'findutils-test-xargs.patch'. --- gnu-system.am | 2 +- gnu/packages/base.scm | 10 ++++---- .../patches/findutils-absolute-paths.patch | 29 ---------------------- gnu/packages/patches/findutils-test-xargs.patch | 22 ++++++++++++++++ 4 files changed, 28 insertions(+), 35 deletions(-) delete mode 100644 gnu/packages/patches/findutils-absolute-paths.patch create mode 100644 gnu/packages/patches/findutils-test-xargs.patch (limited to 'gnu-system.am') diff --git a/gnu-system.am b/gnu-system.am index 0e53ce229b..b8a3e2b06b 100644 --- a/gnu-system.am +++ b/gnu-system.am @@ -461,8 +461,8 @@ dist_patch_DATA = \ gnu/packages/patches/fasthenry-spUtils.patch \ gnu/packages/patches/fasthenry-spSolve.patch \ gnu/packages/patches/fasthenry-spFactor.patch \ - gnu/packages/patches/findutils-absolute-paths.patch \ gnu/packages/patches/findutils-localstatedir.patch \ + gnu/packages/patches/findutils-test-xargs.patch \ gnu/packages/patches/flashrom-use-libftdi1.patch \ gnu/packages/patches/flex-bison-tests.patch \ gnu/packages/patches/flint-ldconfig.patch \ diff --git a/gnu/packages/base.scm b/gnu/packages/base.scm index ce7d1cdd77..a55711e9ea 100644 --- a/gnu/packages/base.scm +++ b/gnu/packages/base.scm @@ -1,5 +1,5 @@ ;;; GNU Guix --- Functional package management for GNU -;;; Copyright © 2012, 2013, 2014, 2015 Ludovic Courtès +;;; Copyright © 2012, 2013, 2014, 2015, 2016 Ludovic Courtès ;;; Copyright © 2014 Andreas Enge ;;; Copyright © 2012 Nikita Karetnikov ;;; Copyright © 2014, 2015 Mark H Weaver @@ -206,17 +206,17 @@ interactive means to merge two files.") (define-public findutils (package (name "findutils") - (version "4.4.2") + (version "4.6.0") (source (origin (method url-fetch) (uri (string-append "mirror://gnu/findutils/findutils-" version ".tar.gz")) (sha256 (base32 - "0amn0bbwqvsvvsh6drfwz20ydc2czk374lzw5kksbh6bf78k4ks3")) + "178nn4dl7wbcw499czikirnkniwnx36argdnqgz4ik9i6zvwkm6y")) (patches (map search-patch - '("findutils-absolute-paths.patch" - "findutils-localstatedir.patch"))))) + '("findutils-localstatedir.patch" + "findutils-test-xargs.patch"))))) (build-system gnu-build-system) (arguments `(#:configure-flags (list diff --git a/gnu/packages/patches/findutils-absolute-paths.patch b/gnu/packages/patches/findutils-absolute-paths.patch deleted file mode 100644 index 96341e281f..0000000000 --- a/gnu/packages/patches/findutils-absolute-paths.patch +++ /dev/null @@ -1,29 +0,0 @@ -Fix use of LFS-style absolute paths. - -Patches from Nixpkgs by Armijn Hemel -and Wouter den Breejen . - -diff -ruN findutils-4.2.20/locate/updatedb.sh findutils-4.2.20.new/locate/updatedb.sh ---- findutils-4.2.20/locate/updatedb.sh 2005-01-24 17:12:35.000000000 +0100 -+++ findutils-4.2.20.new/locate/updatedb.sh 2005-08-23 14:37:10.000000000 +0200 -@@ -141,7 +141,7 @@ - : ${code:=${LIBEXECDIR}/@code@} - - --PATH=/bin:/usr/bin:${BINDIR}; export PATH -+PATH=/bin:/usr/bin:${BINDIR}:${PATH}; export PATH - - : ${PRUNEFS="nfs NFS proc afs proc smbfs autofs iso9660 ncpfs coda devpts ftpfs devfs mfs sysfs shfs"} - -diff -Naur findutils-4.2.30/xargs/xargs.c findutils-4.2.30_new/xargs/xargs.c ---- findutils-4.2.30/xargs/xargs.c 2007-02-27 11:21:08.000000000 +0100 -+++ findutils-4.2.30_new/xargs/xargs.c 2007-07-17 19:02:05.000000000 +0200 -@@ -402,7 +402,7 @@ - int show_limits = 0; /* --show-limits */ - int always_run_command = 1; - char *input_file = "-"; /* "-" is stdin */ -- char *default_cmd = "/bin/echo"; -+ char *default_cmd = "echo"; - int (*read_args) PARAMS ((void)) = read_line; - void (*act_on_init_result)(void) = noop; - int env_too_big = 0; diff --git a/gnu/packages/patches/findutils-test-xargs.patch b/gnu/packages/patches/findutils-test-xargs.patch new file mode 100644 index 0000000000..10c7bed28d --- /dev/null +++ b/gnu/packages/patches/findutils-test-xargs.patch @@ -0,0 +1,22 @@ +This test relies on 'xargs' being available in $PATH, which is not +the case when we build the initial Findutils doing bootstrapping. +Reported at . + +--- findutils-4.6.0/find/testsuite/sv-34976-execdir-fd-leak.sh 2015-12-31 19:37:59.401526288 +0100 ++++ findutils-4.6.0/find/testsuite/sv-34976-execdir-fd-leak.sh 2015-12-31 19:38:36.061770693 +0100 +@@ -50,13 +50,14 @@ die() { + # Create test files, each 98 in the directories ".", "one" and "two". + make_test_data() { + d="$1" ++ xargs="`cd ../../xargs; pwd -P`/xargs" + ( + cd "$1" || exit 1 + mkdir one two || exit 1 + for i in ${three_to_hundred} ; do + printf "./%03d one/%03d two/%03d " $i $i $i + done \ +- | xargs touch || exit 1 ++ | "$xargs" touch || exit 1 + ) \ + || die "failed to set up the test in ${outdir}" + } -- cgit v1.2.3 From 1575dcd134f4fae7255787293f4988bbd043de95 Mon Sep 17 00:00:00 2001 From: Ludovic Courtès Date: Sun, 3 Jan 2016 14:49:55 +0100 Subject: gnu: grep: Skip timing-sensitive test. This avoids failures on loaded machines as seen at . * gnu/packages/patches/grep-timing-sensitive-test.patch: New file. * gnu-system.am (dist_patch_DATA): Add it. * gnu/packages/base.scm (grep): Use it. --- gnu-system.am | 3 ++- gnu/packages/base.scm | 4 +++- gnu/packages/patches/grep-timing-sensitive-test.patch | 15 +++++++++++++++ 3 files changed, 20 insertions(+), 2 deletions(-) create mode 100644 gnu/packages/patches/grep-timing-sensitive-test.patch (limited to 'gnu-system.am') diff --git a/gnu-system.am b/gnu-system.am index b8a3e2b06b..ce7b908b0a 100644 --- a/gnu-system.am +++ b/gnu-system.am @@ -1,5 +1,5 @@ # GNU Guix --- Functional package management for GNU -# Copyright © 2012, 2013, 2014, 2015 Ludovic Courtès +# Copyright © 2012, 2013, 2014, 2015, 2016 Ludovic Courtès # Copyright © 2013, 2014, 2015 Andreas Enge # Copyright © 2013, 2014, 2015 Mark H Weaver # @@ -498,6 +498,7 @@ dist_patch_DATA = \ gnu/packages/patches/gobject-introspection-absolute-shlib-path.patch \ gnu/packages/patches/gobject-introspection-cc.patch \ gnu/packages/patches/gobject-introspection-girepository.patch \ + gnu/packages/patches/grep-timing-sensitive-test.patch \ gnu/packages/patches/grub-gets-undeclared.patch \ gnu/packages/patches/grub-freetype.patch \ gnu/packages/patches/guile-1.8-cpp-4.5.patch \ diff --git a/gnu/packages/base.scm b/gnu/packages/base.scm index a55711e9ea..a7b74cfb93 100644 --- a/gnu/packages/base.scm +++ b/gnu/packages/base.scm @@ -80,7 +80,9 @@ command-line arguments, multiple languages, and so on.") version ".tar.xz")) (sha256 (base32 - "1srn321x7whlhs5ks36zlcrrmj4iahll8fxwsh1vbz3v04px54fa")))) + "1srn321x7whlhs5ks36zlcrrmj4iahll8fxwsh1vbz3v04px54fa")) + (patches + (list (search-patch "grep-timing-sensitive-test.patch"))))) (build-system gnu-build-system) (native-inputs `(("perl" ,perl))) ;some of the tests require it (synopsis "Print lines matching a pattern") diff --git a/gnu/packages/patches/grep-timing-sensitive-test.patch b/gnu/packages/patches/grep-timing-sensitive-test.patch new file mode 100644 index 0000000000..8cfcc848bc --- /dev/null +++ b/gnu/packages/patches/grep-timing-sensitive-test.patch @@ -0,0 +1,15 @@ +Skip this performance regression test. + +The test measures things on the order of 20ms. On a loaded machine, we +have seen enough variation that the test would fail. + +--- grep-2.22/tests/long-pattern-perf 2016-01-03 12:52:38.491575007 +0100 ++++ grep-2.22/tests/long-pattern-perf 2016-01-03 12:53:39.768464687 +0100 +@@ -16,6 +16,7 @@ + # You should have received a copy of the GNU General Public License + # along with this program. If not, see . + ++exit 77 + . "${srcdir=.}/init.sh"; path_prepend_ ../src + + fail=0 -- cgit v1.2.3 From 5a75865f9d6ae08251d789251aa1ea4eac23ab0f Mon Sep 17 00:00:00 2001 From: Efraim Flashner Date: Tue, 5 Jan 2016 18:10:38 +0200 Subject: gnu: gnutls: Update to 3.4.7. * gnu/packages/tls.scm (gnutls): Update to 3.4.7. [source]: Remove gnutls-doc-fix.patch. [arguments]: Remove delete-prebuilt-unfixed-info-file phase. [native-inputs]: Remove texinfo. * gnu-system.am (dist_patch_DATA): Remove gnutls-doc-fix.patch --- gnu-system.am | 1 - gnu/packages/patches/gnutls-doc-fix.patch | 546 ------------------------------ gnu/packages/tls.scm | 13 +- 3 files changed, 2 insertions(+), 558 deletions(-) delete mode 100644 gnu/packages/patches/gnutls-doc-fix.patch (limited to 'gnu-system.am') diff --git a/gnu-system.am b/gnu-system.am index 8bace7d423..7fb1089c66 100644 --- a/gnu-system.am +++ b/gnu-system.am @@ -492,7 +492,6 @@ dist_patch_DATA = \ gnu/packages/patches/gmp-arm-asm-nothumb.patch \ gnu/packages/patches/gmp-faulty-test.patch \ gnu/packages/patches/gnucash-price-quotes-perl.patch \ - gnu/packages/patches/gnutls-doc-fix.patch \ gnu/packages/patches/gobject-introspection-absolute-shlib-path.patch \ gnu/packages/patches/gobject-introspection-cc.patch \ gnu/packages/patches/gobject-introspection-girepository.patch \ diff --git a/gnu/packages/patches/gnutls-doc-fix.patch b/gnu/packages/patches/gnutls-doc-fix.patch deleted file mode 100644 index 170d2468bc..0000000000 --- a/gnu/packages/patches/gnutls-doc-fix.patch +++ /dev/null @@ -1,546 +0,0 @@ -diff -ru gnutls-3.4.4/doc/invoke-certtool.texi gnutls-3.4.4.1/doc/invoke-certtool.texi ---- gnutls-3.4.4.1/doc/invoke-certtool.texi 2015-08-10 13:43:52.000000000 -0400 -+++ gnutls-3.4.4/doc/invoke-certtool.texi 2015-07-31 15:44:21.000000000 -0400 -@@ -41,7 +41,97 @@ - - @exampleindent 0 - @example --certtool is unavailable - no --help -+certtool - GnuTLS certificate tool -+Usage: certtool [ - [] | --[@{=| @}] ]... -+ -+ -d, --debug=num Enable debugging -+ - it must be in the range: -+ 0 to 9999 -+ -V, --verbose More verbose output -+ - may appear multiple times -+ --infile=file Input file -+ - file must pre-exist -+ --outfile=str Output file -+ -s, --generate-self-signed Generate a self-signed certificate -+ -c, --generate-certificate Generate a signed certificate -+ --generate-proxy Generates a proxy certificate -+ --generate-crl Generate a CRL -+ -u, --update-certificate Update a signed certificate -+ -p, --generate-privkey Generate a private key -+ -q, --generate-request Generate a PKCS #10 certificate request -+ - prohibits the option 'infile' -+ -e, --verify-chain Verify a PEM encoded certificate chain -+ --verify Verify a PEM encoded certificate chain using a trusted list -+ --verify-crl Verify a CRL using a trusted list -+ - requires the option 'load-ca-certificate' -+ --generate-dh-params Generate PKCS #3 encoded Diffie-Hellman parameters -+ --get-dh-params Get the included PKCS #3 encoded Diffie-Hellman parameters -+ --dh-info Print information PKCS #3 encoded Diffie-Hellman parameters -+ --load-privkey=str Loads a private key file -+ --load-pubkey=str Loads a public key file -+ --load-request=str Loads a certificate request file -+ --load-certificate=str Loads a certificate file -+ --load-ca-privkey=str Loads the certificate authority's private key file -+ --load-ca-certificate=str Loads the certificate authority's certificate file -+ --password=str Password to use -+ --null-password Enforce a NULL password -+ --empty-password Enforce an empty password -+ --hex-numbers Print big number in an easier format to parse -+ --cprint In certain operations it prints the information in C-friendly format -+ -i, --certificate-info Print information on the given certificate -+ --certificate-pubkey Print certificate's public key -+ --pgp-certificate-info Print information on the given OpenPGP certificate -+ --pgp-ring-info Print information on the given OpenPGP keyring structure -+ -l, --crl-info Print information on the given CRL structure -+ --crq-info Print information on the given certificate request -+ --no-crq-extensions Do not use extensions in certificate requests -+ --p12-info Print information on a PKCS #12 structure -+ --p12-name=str The PKCS #12 friendly name to use -+ --p7-info Print information on a PKCS #7 structure -+ --smime-to-p7 Convert S/MIME to PKCS #7 structure -+ -k, --key-info Print information on a private key -+ --pgp-key-info Print information on an OpenPGP private key -+ --pubkey-info Print information on a public key -+ --v1 Generate an X.509 version 1 certificate (with no extensions) -+ -!, --to-p12 Generate a PKCS #12 structure -+ - requires the option 'load-certificate' -+ -", --to-p8 Generate a PKCS #8 structure -+ -8, --pkcs8 Use PKCS #8 format for private keys -+ -#, --rsa Generate RSA key -+ -$, --dsa Generate DSA key -+ -%, --ecc Generate ECC (ECDSA) key -+ -&, --ecdsa an alias for the 'ecc' option -+ -', --hash=str Hash algorithm to use for signing -+ -(, --inder Use DER format for input certificates, private keys, and DH parameters -+ - disabled as '--no-inder' -+ -), --inraw an alias for the 'inder' option -+ -*, --outder Use DER format for output certificates, private keys, and DH parameters -+ - disabled as '--no-outder' -+ -+, --outraw an alias for the 'outder' option -+ -,, --bits=num Specify the number of bits for key generate -+ --, --curve=str Specify the curve used for EC key generation -+ -., --sec-param=str Specify the security level [low, legacy, medium, high, ultra] -+ -/, --disable-quick-random No effect -+ -0, --template=str Template file to use for non-interactive operation -+ -1, --stdout-info Print information to stdout instead of stderr -+ -2, --ask-pass Enable interaction for entering password when in batch mode. -+ -3, --pkcs-cipher=str Cipher to use for PKCS #8 and #12 operations -+ -4, --provider=str Specify the PKCS #11 provider library -+ -v, --version[=arg] output version information and exit -+ -h, --help display extended usage information and exit -+ -!, --more-help extended usage information passed thru pager -+ -+Options are specified by doubled hyphens and their name or by a single -+hyphen and the flag character. -+ -+Tool to parse and generate X.509 certificates, requests and private keys. -+It can be used interactively or non interactively by specifying the -+template command line option. -+ -+The tool accepts files or URLs supported by GnuTLS. In case PIN is -+required for the URL access you can provide it using the environment -+variables GNUTLS_PIN and GNUTLS_SO_PIN. -+ - @end example - @exampleindent 4 - -diff -ru gnutls-3.4.4/doc/invoke-gnutls-cli-debug.texi gnutls-3.4.4.1/doc/invoke-gnutls-cli-debug.texi ---- gnutls-3.4.4.1/doc/invoke-gnutls-cli-debug.texi 2015-08-10 13:43:50.000000000 -0400 -+++ gnutls-3.4.4/doc/invoke-gnutls-cli-debug.texi 2015-07-31 15:44:18.000000000 -0400 -@@ -40,7 +40,34 @@ - - @exampleindent 0 - @example --gnutls-cli-debug is unavailable - no --help -+gnutls-cli-debug - GnuTLS debug client -+Usage: gnutls-cli-debug [ - [] | --[@{=| @}] ]... -+ -+ -d, --debug=num Enable debugging -+ - it must be in the range: -+ 0 to 9999 -+ -V, --verbose More verbose output -+ - may appear multiple times -+ -p, --port=num The port to connect to -+ - it must be in the range: -+ 0 to 65536 -+ --app-proto=str The application protocol to be used to obtain the server's certificate -+(https, ftp, smtp, imap) -+ -v, --version[=arg] output version information and exit -+ -h, --help display extended usage information and exit -+ -!, --more-help extended usage information passed thru pager -+ -+Options are specified by doubled hyphens and their name or by a single -+hyphen and the flag character. -+Operands and options may be intermixed. They will be reordered. -+ -+TLS debug client. It sets up multiple TLS connections to a server and -+queries its capabilities. It was created to assist in debugging GnuTLS, -+but it might be useful to extract a TLS server's capabilities. It connects -+to a TLS server, performs tests and print the server's capabilities. If -+called with the `-v' parameter more checks will be performed. Can be used -+to check for servers with special needs or bugs. -+ - @end example - @exampleindent 4 - -diff -ru gnutls-3.4.4/doc/invoke-gnutls-cli.texi gnutls-3.4.4.1/doc/invoke-gnutls-cli.texi ---- gnutls-3.4.4.1/doc/invoke-gnutls-cli.texi 2015-08-10 13:43:49.000000000 -0400 -+++ gnutls-3.4.4/doc/invoke-gnutls-cli.texi 2015-07-31 15:44:17.000000000 -0400 -@@ -36,7 +36,95 @@ - - @exampleindent 0 - @example --gnutls-cli is unavailable - no --help -+gnutls-cli - GnuTLS client -+Usage: gnutls-cli [ - [] | --[@{=| @}] ]... [hostname] -+ -+ -d, --debug=num Enable debugging -+ - it must be in the range: -+ 0 to 9999 -+ -V, --verbose More verbose output -+ - may appear multiple times -+ --tofu Enable trust on first use authentication -+ - disabled as '--no-tofu' -+ --strict-tofu Fail to connect if a known certificate has changed -+ - disabled as '--no-strict-tofu' -+ --dane Enable DANE certificate verification (DNSSEC) -+ - disabled as '--no-dane' -+ --local-dns Use the local DNS server for DNSSEC resolving -+ - disabled as '--no-local-dns' -+ --ca-verification Disable CA certificate verification -+ - disabled as '--no-ca-verification' -+ - enabled by default -+ --ocsp Enable OCSP certificate verification -+ - disabled as '--no-ocsp' -+ -r, --resume Establish a session and resume -+ -e, --rehandshake Establish a session and rehandshake -+ -s, --starttls Connect, establish a plain session and start TLS -+ --app-proto=str an alias for the 'starttls-proto' option -+ --starttls-proto=str The application protocol to be used to obtain the server's certificate -+(https, ftp, smtp, imap) -+ - prohibits the option 'starttls' -+ -u, --udp Use DTLS (datagram TLS) over UDP -+ --mtu=num Set MTU for datagram TLS -+ - it must be in the range: -+ 0 to 17000 -+ --crlf Send CR LF instead of LF -+ --x509fmtder Use DER format for certificates to read from -+ -f, --fingerprint Send the openpgp fingerprint, instead of the key -+ --print-cert Print peer's certificate in PEM format -+ --dh-bits=num The minimum number of bits allowed for DH -+ --priority=str Priorities string -+ --x509cafile=str Certificate file or PKCS #11 URL to use -+ --x509crlfile=file CRL file to use -+ - file must pre-exist -+ --pgpkeyfile=file PGP Key file to use -+ - file must pre-exist -+ --pgpkeyring=file PGP Key ring file to use -+ - file must pre-exist -+ --pgpcertfile=file PGP Public Key (certificate) file to use -+ - file must pre-exist -+ --x509keyfile=str X.509 key file or PKCS #11 URL to use -+ --x509certfile=str X.509 Certificate file or PKCS #11 URL to use -+ --pgpsubkey=str PGP subkey to use (hex or auto) -+ --srpusername=str SRP username to use -+ --srppasswd=str SRP password to use -+ --pskusername=str PSK username to use -+ --pskkey=str PSK key (in hex) to use -+ -p, --port=str The port or service to connect to -+ --insecure Don't abort program if server certificate can't be validated -+ --ranges Use length-hiding padding to prevent traffic analysis -+ --benchmark-ciphers Benchmark individual ciphers -+ --benchmark-tls-kx Benchmark TLS key exchange methods -+ --benchmark-tls-ciphers Benchmark TLS ciphers -+ -l, --list Print a list of the supported algorithms and modes -+ - prohibits the option 'port' -+ --noticket Don't allow session tickets -+ -!, --srtp-profiles=str Offer SRTP profiles -+ -", --alpn=str Application layer protocol -+ - may appear multiple times -+ -b, --heartbeat Activate heartbeat support -+ -#, --recordsize=num The maximum record size to advertize -+ - it must be in the range: -+ 0 to 4096 -+ -$, --disable-sni Do not send a Server Name Indication (SNI) -+ -%, --disable-extensions Disable all the TLS extensions -+ -&, --inline-commands Inline commands of the form ^^ -+ -', --inline-commands-prefix=str Change the default delimiter for inline commands. -+ -(, --provider=file Specify the PKCS #11 provider library -+ - file must pre-exist -+ -), --fips140-mode Reports the status of the FIPS140-2 mode in gnutls library -+ -v, --version[=arg] output version information and exit -+ -h, --help display extended usage information and exit -+ -!, --more-help extended usage information passed thru pager -+ -+Options are specified by doubled hyphens and their name or by a single -+hyphen and the flag character. -+Operands and options may be intermixed. They will be reordered. -+ -+Simple client program to set up a TLS connection to some other computer. It -+sets up a TLS connection and forwards data from the standard input to the -+secured socket and vice versa. -+ - @end example - @exampleindent 4 - -diff -ru gnutls-3.4.4/doc/invoke-gnutls-serv.texi gnutls-3.4.4.1/doc/invoke-gnutls-serv.texi ---- gnutls-3.4.4.1/doc/invoke-gnutls-serv.texi 2015-08-10 13:43:51.000000000 -0400 -+++ gnutls-3.4.4/doc/invoke-gnutls-serv.texi 2015-07-31 15:44:20.000000000 -0400 -@@ -35,7 +35,69 @@ - - @exampleindent 0 - @example --gnutls-serv is unavailable - no --help -+gnutls-serv - GnuTLS server -+Usage: gnutls-serv [ - [] | --[@{=| @}] ]... -+ -+ -d, --debug=num Enable debugging -+ - it must be in the range: -+ 0 to 9999 -+ --noticket Don't accept session tickets -+ -g, --generate Generate Diffie-Hellman and RSA-export parameters -+ -q, --quiet Suppress some messages -+ --nodb Do not use a resumption database -+ --http Act as an HTTP server -+ --echo Act as an Echo server -+ -u, --udp Use DTLS (datagram TLS) over UDP -+ --mtu=num Set MTU for datagram TLS -+ - it must be in the range: -+ 0 to 17000 -+ --srtp-profiles=str Offer SRTP profiles -+ -a, --disable-client-cert Do not request a client certificate -+ -r, --require-client-cert Require a client certificate -+ --verify-client-cert If a client certificate is sent then verify it. -+ -b, --heartbeat Activate heartbeat support -+ --x509fmtder Use DER format for certificates to read from -+ --priority=str Priorities string -+ --dhparams=file DH params file to use -+ - file must pre-exist -+ --x509cafile=str Certificate file or PKCS #11 URL to use -+ --x509crlfile=file CRL file to use -+ - file must pre-exist -+ --pgpkeyfile=file PGP Key file to use -+ - file must pre-exist -+ --pgpkeyring=file PGP Key ring file to use -+ - file must pre-exist -+ --pgpcertfile=file PGP Public Key (certificate) file to use -+ - file must pre-exist -+ --x509keyfile=str X.509 key file or PKCS #11 URL to use -+ --x509certfile=str X.509 Certificate file or PKCS #11 URL to use -+ --x509dsakeyfile=str Alternative X.509 key file or PKCS #11 URL to use -+ --x509dsacertfile=str Alternative X.509 Certificate file or PKCS #11 URL to use -+ --x509ecckeyfile=str Alternative X.509 key file or PKCS #11 URL to use -+ --x509ecccertfile=str Alternative X.509 Certificate file or PKCS #11 URL to use -+ --pgpsubkey=str PGP subkey to use (hex or auto) -+ --srppasswd=file SRP password file to use -+ - file must pre-exist -+ --srppasswdconf=file SRP password configuration file to use -+ - file must pre-exist -+ --pskpasswd=file PSK password file to use -+ - file must pre-exist -+ --pskhint=str PSK identity hint to use -+ --ocsp-response=file The OCSP response to send to client -+ - file must pre-exist -+ -p, --port=num The port to connect to -+ -l, --list Print a list of the supported algorithms and modes -+ --provider=file Specify the PKCS #11 provider library -+ - file must pre-exist -+ -v, --version[=arg] output version information and exit -+ -h, --help display extended usage information and exit -+ -!, --more-help extended usage information passed thru pager -+ -+Options are specified by doubled hyphens and their name or by a single -+hyphen and the flag character. -+ -+Server program that listens to incoming TLS connections. -+ - @end example - @exampleindent 4 - -diff -ru gnutls-3.4.4/doc/invoke-ocsptool.texi gnutls-3.4.4.1/doc/invoke-ocsptool.texi ---- gnutls-3.4.4.1/doc/invoke-ocsptool.texi 2015-08-10 13:43:53.000000000 -0400 -+++ gnutls-3.4.4/doc/invoke-ocsptool.texi 2015-07-31 15:44:22.000000000 -0400 -@@ -37,7 +37,53 @@ - - @exampleindent 0 - @example --ocsptool is unavailable - no --help -+ocsptool - GnuTLS OCSP tool -+Usage: ocsptool [ - [] | --[@{=| @}] ]... -+ -+ -d, --debug=num Enable debugging -+ - it must be in the range: -+ 0 to 9999 -+ -V, --verbose More verbose output -+ - may appear multiple times -+ --infile=file Input file -+ - file must pre-exist -+ --outfile=str Output file -+ --ask[=arg] Ask an OCSP/HTTP server on a certificate validity -+ - requires these options: -+ load-cert -+ load-issuer -+ -e, --verify-response Verify response -+ -i, --request-info Print information on a OCSP request -+ -j, --response-info Print information on a OCSP response -+ -q, --generate-request Generate an OCSP request -+ --nonce Use (or not) a nonce to OCSP request -+ - disabled as '--no-nonce' -+ --load-issuer=file Read issuer certificate from file -+ - file must pre-exist -+ --load-cert=file Read certificate to check from file -+ - file must pre-exist -+ --load-trust=file Read OCSP trust anchors from file -+ - prohibits the option 'load-signer' -+ - file must pre-exist -+ --load-signer=file Read OCSP response signer from file -+ - prohibits the option 'load-trust' -+ - file must pre-exist -+ --inder Use DER format for input certificates and private keys -+ - disabled as '--no-inder' -+ -Q, --load-request=file Read DER encoded OCSP request from file -+ - file must pre-exist -+ -S, --load-response=file Read DER encoded OCSP response from file -+ - file must pre-exist -+ -v, --version[=arg] output version information and exit -+ -h, --help display extended usage information and exit -+ -!, --more-help extended usage information passed thru pager -+ -+Options are specified by doubled hyphens and their name or by a single -+hyphen and the flag character. -+ -+Ocsptool is a program that can parse and print information about OCSP -+requests/responses, generate requests and verify responses. -+ - @end example - @exampleindent 4 - -diff -ru gnutls-3.4.4/doc/invoke-p11tool.texi gnutls-3.4.4.1/doc/invoke-p11tool.texi ---- gnutls-3.4.4.1/doc/invoke-p11tool.texi 2015-08-10 13:43:58.000000000 -0400 -+++ gnutls-3.4.4/doc/invoke-p11tool.texi 2015-07-31 15:44:26.000000000 -0400 -@@ -45,7 +45,97 @@ - - @exampleindent 0 - @example --p11tool is unavailable - no --help -+p11tool - GnuTLS PKCS #11 tool -+Usage: p11tool [ - [] | --[@{=| @}] ]... [url] -+ -+ -d, --debug=num Enable debugging -+ - it must be in the range: -+ 0 to 9999 -+ --outfile=str Output file -+ --list-tokens List all available tokens -+ --export Export the object specified by the URL -+ --export-chain Export the certificate specified by the URL and its chain of trust -+ --list-mechanisms List all available mechanisms in a token -+ --info List information on an available object in a token -+ --list-all List all available objects in a token -+ --list-all-certs List all available certificates in a token -+ --list-certs List all certificates that have an associated private key -+ --list-all-privkeys List all available private keys in a token -+ --list-privkeys an alias for the 'list-all-privkeys' option -+ --list-keys an alias for the 'list-all-privkeys' option -+ --list-all-trusted List all available certificates marked as trusted -+ --write Writes the loaded objects to a PKCS #11 token -+ --delete Deletes the objects matching the PKCS #11 URL -+ --generate-random=num Generate random data -+ --generate-rsa Generate an RSA private-public key pair -+ --generate-dsa Generate an RSA private-public key pair -+ --generate-ecc Generate an RSA private-public key pair -+ --export-pubkey Export the public key for a private key -+ --label=str Sets a label for the write operation -+ --mark-wrap Marks the generated key to be a wrapping key -+ - disabled as '--no-mark-wrap' -+ --mark-trusted Marks the object to be written as trusted -+ - disabled as '--no-mark-trusted' -+ --mark-ca Marks the object to be written as a CA -+ - disabled as '--no-mark-ca' -+ --mark-private Marks the object to be written as private -+ - disabled as '--no-mark-private' -+ - enabled by default -+ --trusted an alias for the 'mark-trusted' option -+ --ca an alias for the 'mark-ca' option -+ --private an alias for the 'mark-private' option -+ - enabled by default -+ --login Force (user) login to token -+ - disabled as '--no-login' -+ --so-login Force security officer login to token -+ - disabled as '--no-so-login' -+ --admin-login an alias for the 'so-login' option -+ --detailed-url Print detailed URLs -+ - disabled as '--no-detailed-url' -+ -!, --secret-key=str Provide a hex encoded secret key -+ -", --load-privkey=file Private key file to use -+ - file must pre-exist -+ -#, --load-pubkey=file Public key file to use -+ - file must pre-exist -+ -$, --load-certificate=file Certificate file to use -+ - file must pre-exist -+ -8, --pkcs8 Use PKCS #8 format for private keys -+ -%, --bits=num Specify the number of bits for key generate -+ -&, --curve=str Specify the curve used for EC key generation -+ -', --sec-param=str Specify the security level -+ -(, --inder Use DER/RAW format for input -+ - disabled as '--no-inder' -+ -), --inraw an alias for the 'inder' option -+ -*, --outder Use DER format for output certificates, private keys, and DH parameters -+ - disabled as '--no-outder' -+ -+, --outraw an alias for the 'outder' option -+ -,, --initialize Initializes a PKCS #11 token -+ --, --set-pin=str Specify the PIN to use on token initialization -+ -., --set-so-pin=str Specify the Security Officer's PIN to use on token initialization -+ -/, --provider=file Specify the PKCS #11 provider library -+ - file must pre-exist -+ -0, --batch Disable all interaction with the tool. All parameters need to be -+specified on command line. -+ -v, --version[=arg] output version information and exit -+ -h, --help display extended usage information and exit -+ -!, --more-help extended usage information passed thru pager -+ -+Options are specified by doubled hyphens and their name or by a single -+hyphen and the flag character. -+Operands and options may be intermixed. They will be reordered. -+ -+Program that allows operations on PKCS #11 smart cards and security -+modules. -+ -+To use PKCS #11 tokens with GnuTLS the p11-kit configuration files need to -+be setup. That is create a .module file in /etc/pkcs11/modules with the -+contents 'module: /path/to/pkcs11.so'. Alternatively the configuration -+file /etc/gnutls/pkcs11.conf has to exist and contain a number of lines of -+the form 'load=/usr/lib/opensc-pkcs11.so'. -+ -+You can provide the PIN to be used for the PKCS #11 operations with the -+environment variables GNUTLS_PIN and GNUTLS_SO_PIN. -+ - @end example - @exampleindent 4 - -diff -ru gnutls-3.4.4/doc/invoke-psktool.texi gnutls-3.4.4.1/doc/invoke-psktool.texi ---- gnutls-3.4.4.1/doc/invoke-psktool.texi 2015-08-10 13:43:57.000000000 -0400 -+++ gnutls-3.4.4/doc/invoke-psktool.texi 2015-07-31 15:44:25.000000000 -0400 -@@ -36,7 +36,27 @@ - - @exampleindent 0 - @example --psktool is unavailable - no --help -+psktool - GnuTLS PSK tool -+Usage: psktool [ - [] | --[@{=| @}] ]... -+ -+ -d, --debug=num Enable debugging -+ - it must be in the range: -+ 0 to 9999 -+ -s, --keysize=num specify the key size in bytes -+ - it must be in the range: -+ 0 to 512 -+ -u, --username=str specify a username -+ -p, --passwd=str specify a password file -+ -v, --version[=arg] output version information and exit -+ -h, --help display extended usage information and exit -+ -!, --more-help extended usage information passed thru pager -+ -+Options are specified by doubled hyphens and their name or by a single -+hyphen and the flag character. -+ -+Program that generates random keys for use with TLS-PSK. The keys are -+stored in hexadecimal format in a key file. -+ - @end example - @exampleindent 4 - -diff -ru gnutls-3.4.4/doc/invoke-srptool.texi gnutls-3.4.4.1/doc/invoke-srptool.texi ---- gnutls-3.4.4.1/doc/invoke-srptool.texi 2015-08-10 13:43:56.000000000 -0400 -+++ gnutls-3.4.4/doc/invoke-srptool.texi 2015-07-31 15:44:24.000000000 -0400 -@@ -41,7 +41,34 @@ - - @exampleindent 0 - @example --srptool is unavailable - no --help -+srptool - GnuTLS SRP tool -+Usage: srptool [ - [] | --[@{=| @}] ]... -+ -+ -d, --debug=num Enable debugging -+ - it must be in the range: -+ 0 to 9999 -+ -i, --index=num specify the index of the group parameters in tpasswd.conf to use -+ -u, --username=str specify a username -+ -p, --passwd=str specify a password file -+ -s, --salt=num specify salt size -+ --verify just verify the password. -+ -v, --passwd-conf=str specify a password conf file. -+ --create-conf=str Generate a password configuration file. -+ -v, --version[=arg] output version information and exit -+ -h, --help display extended usage information and exit -+ -!, --more-help extended usage information passed thru pager -+ -+Options are specified by doubled hyphens and their name or by a single -+hyphen and the flag character. -+ -+Simple program that emulates the programs in the Stanford SRP (Secure -+Remote Password) libraries using GnuTLS. It is intended for use in places -+where you don't expect SRP authentication to be the used for system users. -+ -+In brief, to use SRP you need to create two files. These are the password -+file that holds the users and the verifiers associated with them and the -+configuration file to hold the group parameters (called tpasswd.conf). -+ - @end example - @exampleindent 4 - diff --git a/gnu/packages/tls.scm b/gnu/packages/tls.scm index 494128eeae..c10d1cbfc7 100644 --- a/gnu/packages/tls.scm +++ b/gnu/packages/tls.scm @@ -107,7 +107,7 @@ living in the same process.") (define-public gnutls (package (name "gnutls") - (version "3.4.5") + (version "3.4.7") (source (origin (method url-fetch) (uri @@ -118,8 +118,7 @@ living in the same process.") "/gnutls-" version ".tar.xz")) (sha256 (base32 - "1bks1zpmhmnkz2v32dd9b44pz6x0a5w4yi9zzwsd0a078vhbi25g")) - (patches (list (search-patch "gnutls-doc-fix.patch"))))) + "0nifi3mr5jhz608pidkp8cjs4vwfj1m2qczsjrgpnp99615rxgn1")))) (build-system gnu-build-system) (arguments '(#:configure-flags @@ -142,13 +141,6 @@ living in the same process.") "--without-p11-kit") #:phases (modify-phases %standard-phases - (add-after - 'unpack 'delete-prebuilt-unfixed-info-file - (lambda _ - ;; XXX Delete the prebuilt info file, so that it will be - ;; rebuilt with the fixes in gnutls-doc-fix.patch. - (delete-file "doc/gnutls.info") - #t)) (add-after 'install 'move-doc (lambda* (#:key outputs #:allow-other-keys) @@ -166,7 +158,6 @@ living in the same process.") "doc")) ;4.1 MiB of man pages (native-inputs `(("pkg-config" ,pkg-config) - ("texinfo" ,texinfo) ; XXX needed only to replace prebuilt, unfixed docs. ("which" ,which))) (inputs `(("guile" ,guile-2.0) -- cgit v1.2.3 From 93b3a8b0eeabeca960a178754589c6461b38baf5 Mon Sep 17 00:00:00 2001 From: Efraim Flashner Date: Thu, 7 Jan 2016 08:42:15 +0200 Subject: gnu: flex: Update to 2.6.0. * gnu/packages/flex.scm (flex): Update to 2.6.0. [source]: Remove flex-bison-tests.patch. * gnu-system.am (dist_patch_DATA): Remove flex-bison-tests.patch. * gnu/packages/patches/flex-bison-tests.patch: Remove it. --- gnu-system.am | 1 - gnu/packages/flex.scm | 6 +++--- gnu/packages/patches/flex-bison-tests.patch | 24 ------------------------ 3 files changed, 3 insertions(+), 28 deletions(-) delete mode 100644 gnu/packages/patches/flex-bison-tests.patch (limited to 'gnu-system.am') diff --git a/gnu-system.am b/gnu-system.am index 7fb1089c66..0f0fabc302 100644 --- a/gnu-system.am +++ b/gnu-system.am @@ -463,7 +463,6 @@ dist_patch_DATA = \ gnu/packages/patches/findutils-localstatedir.patch \ gnu/packages/patches/findutils-test-xargs.patch \ gnu/packages/patches/flashrom-use-libftdi1.patch \ - gnu/packages/patches/flex-bison-tests.patch \ gnu/packages/patches/flint-ldconfig.patch \ gnu/packages/patches/fltk-shared-lib-defines.patch \ gnu/packages/patches/freeimage-CVE-2015-0852.patch \ diff --git a/gnu/packages/flex.scm b/gnu/packages/flex.scm index 7988e930e7..f8d5ccd032 100644 --- a/gnu/packages/flex.scm +++ b/gnu/packages/flex.scm @@ -1,5 +1,6 @@ ;;; GNU Guix --- Functional package management for GNU ;;; Copyright © 2012, 2013, 2014 Ludovic Courtès +;;; Copyright © 2016 Efraim Flashner ;;; ;;; This file is part of GNU Guix. ;;; @@ -31,15 +32,14 @@ (define flex (package (name "flex") - (version "2.5.37") + (version "2.6.0") (source (origin (method url-fetch) (uri (string-append "mirror://sourceforge/flex/flex-" version ".tar.bz2")) (sha256 (base32 - "0ah5mi4j62b85a9rllv1004mzjb5cd0mn4glvz13p88rpx77pahp")) - (patches (list (search-patch "flex-bison-tests.patch"))))) + "1sdqx63yadindzafrq1w31ajblf9gl1c301g068s20s7bbpi3ri4")))) (build-system gnu-build-system) (inputs (let ((bison-for-tests diff --git a/gnu/packages/patches/flex-bison-tests.patch b/gnu/packages/patches/flex-bison-tests.patch deleted file mode 100644 index 0f372f83bf..0000000000 --- a/gnu/packages/patches/flex-bison-tests.patch +++ /dev/null @@ -1,24 +0,0 @@ -The `test-bison-yyl{loc,val}' tests fail with "conflicting types for -'testparse'" because `YYPARSE_PARAM' is undefined; work around that. - ---- flex-2.5.37/tests/test-bison-yylloc/main.c 2012-11-22 18:17:01.000000000 +0100 -+++ flex-2.5.37/tests/test-bison-yylloc/main.c 2012-11-22 18:17:07.000000000 +0100 -@@ -21,6 +21,7 @@ - * PURPOSE. - */ - -+#define YYPARSE_PARAM scanner - #include "parser.h" - #include "scanner.h" - - ---- flex-2.5.37/tests/test-bison-yylval/main.c 2012-11-22 18:17:42.000000000 +0100 -+++ flex-2.5.37/tests/test-bison-yylval/main.c 2012-11-22 18:17:49.000000000 +0100 -@@ -21,6 +21,7 @@ - * PURPOSE. - */ - -+#define YYPARSE_PARAM scanner - #include "parser.h" - #include "scanner.h" - -- cgit v1.2.3 From 203795aceaabec0e0e5818e1650ad407d825d1b3 Mon Sep 17 00:00:00 2001 From: Mark H Weaver Date: Tue, 12 Jan 2016 13:12:07 -0500 Subject: gnu: perl: Add fix for CVE-2015-8607. * gnu/packages/patches/perl-CVE-2015-8607.patch: New file. * gnu-system.am (dist_patch_DATA): Add it. * gnu/packages/perl.scm (perl)[source]: Add patch. --- gnu-system.am | 3 +- gnu/packages/patches/perl-CVE-2015-8607.patch | 68 +++++++++++++++++++++++++++ gnu/packages/perl.scm | 3 +- 3 files changed, 72 insertions(+), 2 deletions(-) create mode 100644 gnu/packages/patches/perl-CVE-2015-8607.patch (limited to 'gnu-system.am') diff --git a/gnu-system.am b/gnu-system.am index 0f0fabc302..112e404ffb 100644 --- a/gnu-system.am +++ b/gnu-system.am @@ -1,7 +1,7 @@ # GNU Guix --- Functional package management for GNU # Copyright © 2012, 2013, 2014, 2015, 2016 Ludovic Courtès # Copyright © 2013, 2014, 2015 Andreas Enge -# Copyright © 2013, 2014, 2015 Mark H Weaver +# Copyright © 2013, 2014, 2015, 2016 Mark H Weaver # # This file is part of GNU Guix. # @@ -612,6 +612,7 @@ dist_patch_DATA = \ gnu/packages/patches/patchelf-rework-for-arm.patch \ gnu/packages/patches/patchutils-xfail-gendiff-tests.patch \ gnu/packages/patches/patch-hurd-path-max.patch \ + gnu/packages/patches/perl-CVE-2015-8607.patch \ gnu/packages/patches/perl-autosplit-default-time.patch \ gnu/packages/patches/perl-deterministic-ordering.patch \ gnu/packages/patches/perl-finance-quote-unuse-mozilla-ca.patch \ diff --git a/gnu/packages/patches/perl-CVE-2015-8607.patch b/gnu/packages/patches/perl-CVE-2015-8607.patch new file mode 100644 index 0000000000..4c25d41740 --- /dev/null +++ b/gnu/packages/patches/perl-CVE-2015-8607.patch @@ -0,0 +1,68 @@ +From 3a629609084d147838368262171b923f0770e564 Mon Sep 17 00:00:00 2001 +From: Tony Cook +Date: Tue, 15 Dec 2015 10:56:54 +1100 +Subject: ensure File::Spec::canonpath() preserves taint + +Previously the unix specific XS implementation of canonpath() would +return an untainted path when supplied a tainted path. + +For the empty string case, newSVpvs() already sets taint as needed on +its result. + +This issue was assigned CVE-2015-8607. + +Bug: https://rt.perl.org/Ticket/Display.html?id=126862 +Bug-Debian: https://bugs.debian.org/810719 +Origin: upstream +Patch-Name: fixes/CVE-2015-8607_file_spec_taint_fix.diff +--- + dist/PathTools/Cwd.xs | 1 + + dist/PathTools/t/taint.t | 19 ++++++++++++++++++- + 2 files changed, 19 insertions(+), 1 deletion(-) + +diff --git a/dist/PathTools/Cwd.xs b/dist/PathTools/Cwd.xs +index 9d4dcf0..3d018dc 100644 +--- a/dist/PathTools/Cwd.xs ++++ b/dist/PathTools/Cwd.xs +@@ -535,6 +535,7 @@ THX_unix_canonpath(pTHX_ SV *path) + *o = 0; + SvPOK_on(retval); + SvCUR_set(retval, o - SvPVX(retval)); ++ SvTAINT(retval); + return retval; + } + +diff --git a/dist/PathTools/t/taint.t b/dist/PathTools/t/taint.t +index 309b3e5..48f8c5b 100644 +--- a/dist/PathTools/t/taint.t ++++ b/dist/PathTools/t/taint.t +@@ -12,7 +12,7 @@ use Test::More; + BEGIN { + plan( + ${^TAINT} +- ? (tests => 17) ++ ? (tests => 21) + : (skip_all => "A perl without taint support") + ); + } +@@ -34,3 +34,20 @@ foreach my $func (@Functions) { + + # Previous versions of Cwd tainted $^O + is !tainted($^O), 1, "\$^O should not be tainted"; ++ ++{ ++ # [perl #126862] canonpath() loses taint ++ my $tainted = substr($ENV{PATH}, 0, 0); ++ # yes, getcwd()'s result should be tainted, and is tested above ++ # but be sure ++ ok tainted(File::Spec->canonpath($tainted . Cwd::getcwd)), ++ "canonpath() keeps taint on non-empty string"; ++ ok tainted(File::Spec->canonpath($tainted)), ++ "canonpath() keeps taint on empty string"; ++ ++ (Cwd::getcwd() =~ /^(.*)/); ++ my $untainted = $1; ++ ok !tainted($untainted), "make sure our untainted value is untainted"; ++ ok !tainted(File::Spec->canonpath($untainted)), ++ "canonpath() doesn't add taint to untainted string"; ++} diff --git a/gnu/packages/perl.scm b/gnu/packages/perl.scm index 86a979f9fc..162fc9b8f3 100644 --- a/gnu/packages/perl.scm +++ b/gnu/packages/perl.scm @@ -51,7 +51,8 @@ "perl-autosplit-default-time.patch" "perl-source-date-epoch.patch" "perl-deterministic-ordering.patch" - "perl-no-build-time.patch"))))) + "perl-no-build-time.patch" + "perl-CVE-2015-8607.patch"))))) (build-system gnu-build-system) (arguments '(#:tests? #f -- cgit v1.2.3 From 76002e54f2280f5a6416438c513aab14ecddb138 Mon Sep 17 00:00:00 2001 From: Ludovic Courtès Date: Thu, 14 Jan 2016 10:42:08 +0100 Subject: gnu: gawk: Protect against random failures of the 'fts' test. * gnu/packages/patches/gawk-fts-test.patch: New file. * gnu/packages/gawk.scm (gawk)[source]: Use it. * gnu-system.am (dist_patch_DATA): Add it. --- gnu-system.am | 1 + gnu/packages/gawk.scm | 6 ++-- gnu/packages/patches/gawk-fts-test.patch | 51 ++++++++++++++++++++++++++++++++ 3 files changed, 56 insertions(+), 2 deletions(-) create mode 100644 gnu/packages/patches/gawk-fts-test.patch (limited to 'gnu-system.am') diff --git a/gnu-system.am b/gnu-system.am index 0ce1a3f015..3eb01c3b1c 100644 --- a/gnu-system.am +++ b/gnu-system.am @@ -467,6 +467,7 @@ dist_patch_DATA = \ gnu/packages/patches/flint-ldconfig.patch \ gnu/packages/patches/fltk-shared-lib-defines.patch \ gnu/packages/patches/freeimage-CVE-2015-0852.patch \ + gnu/packages/patches/gawk-fts-test.patch \ gnu/packages/patches/gawk-shell.patch \ gnu/packages/patches/gcc-arm-link-spec-fix.patch \ gnu/packages/patches/gcc-cross-environment-variables.patch \ diff --git a/gnu/packages/gawk.scm b/gnu/packages/gawk.scm index 6bfea34667..8f2805cd4b 100644 --- a/gnu/packages/gawk.scm +++ b/gnu/packages/gawk.scm @@ -1,5 +1,5 @@ ;;; GNU Guix --- Functional package management for GNU -;;; Copyright © 2012, 2013, 2014, 2015 Ludovic Courtès +;;; Copyright © 2012, 2013, 2014, 2015, 2016 Ludovic Courtès ;;; Copyright © 2014, 2015 Mark H Weaver ;;; ;;; This file is part of GNU Guix. @@ -19,6 +19,7 @@ (define-module (gnu packages gawk) #:use-module (guix licenses) + #:use-module (gnu packages) #:use-module (gnu packages bash) #:use-module (gnu packages libsigsegv) #:use-module (guix packages) @@ -34,7 +35,8 @@ (uri (string-append "mirror://gnu/gawk/gawk-" version ".tar.xz")) (sha256 - (base32 "09d6pmx6h3i2glafm0jd1v1iyrs03vcyv2rkz12jisii3vlmbkz3")))) + (base32 "09d6pmx6h3i2glafm0jd1v1iyrs03vcyv2rkz12jisii3vlmbkz3")) + (patches (list (search-patch "gawk-fts-test.patch"))))) (build-system gnu-build-system) (arguments `(#:parallel-tests? #f ; test suite fails in parallel diff --git a/gnu/packages/patches/gawk-fts-test.patch b/gnu/packages/patches/gawk-fts-test.patch new file mode 100644 index 0000000000..de1f5c431c --- /dev/null +++ b/gnu/packages/patches/gawk-fts-test.patch @@ -0,0 +1,51 @@ +This is upstream commit c9a018c. We have observed random failures of +this test on i686 that seem related to load. + +2015-05-21 Arnold D. Robbins + + * fts.awk: Really remove atime from the output. + This avoids spurious failures on heavily loaded systems. + +diff --git a/test/fts.awk b/test/fts.awk +index b1df060..dea5b68 100644 +--- a/test/fts.awk ++++ b/test/fts.awk +@@ -50,6 +50,11 @@ function sort_traverse(data, sorted, i) + { + asorti(data, sorted) + for (i = 1; i in sorted; i++) { ++ # 5/2015: skip for atime, since there can ++ # occasionally be small differences. ++ if (sorted[i] == "atime") ++ continue ++ + indent() + printf("%s --> %s\n", sorted[i], data[sorted[i]]) > output + } +@@ -63,17 +68,20 @@ function traverse(data, i) + printf("%s:\n", i) > output + + Level++ +- if (("mtime" in data[i]) && ! isarray(data[i][mtime])) { ++ if (("mtime" in data[i]) && ! isarray(data[i]["mtime"])) { + sort_traverse(data[i]) + } else { + traverse(data[i]) + } + Level-- +- } else if (data[i] != "atime") { +- # 4/2015: skip for atime, since there can +- # occasionally be small differences. +- indent() +- printf("%s --> %s\n", i, data[i]) > output ++# } else { ++# JUNK = 1 ++# if (i != "atime") { ++# # 4/2015: skip for atime, since there can ++# # occasionally be small differences. ++# indent() ++# printf("%s --> %s\n", i, data[i]) > output ++# } + } + } + } -- cgit v1.2.3 From 89b48232f80d58e100ec7b73ee27ee513a58cfcc Mon Sep 17 00:00:00 2001 From: Ludovic Courtès Date: Fri, 15 Jan 2016 13:07:37 +0100 Subject: gnu: automake: Adjust to deal with Perl 5.22. Fixes . * gnu/packages/patches/automake-regexp-syntax.patch: New file. * gnu/packages/autotools.scm (automake)[source]: Use it. * gnu-system.am (dist_patch_DATA): Add it. --- gnu-system.am | 1 + gnu/packages/autotools.scm | 6 ++-- gnu/packages/patches/automake-regexp-syntax.patch | 34 +++++++++++++++++++++++ 3 files changed, 39 insertions(+), 2 deletions(-) create mode 100644 gnu/packages/patches/automake-regexp-syntax.patch (limited to 'gnu-system.am') diff --git a/gnu-system.am b/gnu-system.am index 3eb01c3b1c..0550e79f87 100644 --- a/gnu-system.am +++ b/gnu-system.am @@ -412,6 +412,7 @@ dist_patch_DATA = \ gnu/packages/patches/ath9k-htc-firmware-objcopy.patch \ gnu/packages/patches/audacity-fix-ffmpeg-binding.patch \ gnu/packages/patches/automake-skip-amhello-tests.patch \ + gnu/packages/patches/automake-regexp-syntax.patch \ gnu/packages/patches/avahi-localstatedir.patch \ gnu/packages/patches/avidemux-install-to-lib.patch \ gnu/packages/patches/avrdude-fix-libusb.patch \ diff --git a/gnu/packages/autotools.scm b/gnu/packages/autotools.scm index 0d9a5b5873..598624ccdc 100644 --- a/gnu/packages/autotools.scm +++ b/gnu/packages/autotools.scm @@ -1,6 +1,6 @@ ;;; GNU Guix --- Functional package management for GNU ;;; Copyright © 2012 Nikita Karetnikov -;;; Copyright © 2012, 2013, 2014, 2015 Ludovic Courtès +;;; Copyright © 2012, 2013, 2014, 2015, 2016 Ludovic Courtès ;;; Copyright © 2015 Mathieu Lirzin ;;; Copyright © 2014 Manolis Fragkiskos Ragkousis ;;; Copyright © 2015 Mark H Weaver @@ -195,7 +195,9 @@ output is indexed in many ways to simplify browsing.") (base32 "0dl6vfi2lzz8alnklwxzfz624b95hb1ipjvd3mk177flmddcf24r")) (patches - (list (search-patch "automake-skip-amhello-tests.patch"))))) + (map search-patch + '("automake-regexp-syntax.patch" + "automake-skip-amhello-tests.patch"))))) (build-system gnu-build-system) (native-inputs `(("autoconf" ,(autoconf-wrapper)) diff --git a/gnu/packages/patches/automake-regexp-syntax.patch b/gnu/packages/patches/automake-regexp-syntax.patch new file mode 100644 index 0000000000..2e965c8c50 --- /dev/null +++ b/gnu/packages/patches/automake-regexp-syntax.patch @@ -0,0 +1,34 @@ +From . +See also . + +From 34163794a58b5bd91c5d6bd9adf5437571c7a479 Mon Sep 17 00:00:00 2001 +From: Pavel Raiskup +Date: Tue, 7 Jul 2015 10:54:24 +0200 +Subject: [PATCH] bin/automake: escape '{' in regexp pattern + +Based on perlre(1) documentation: +.. in Perl v5.26, literal uses of a curly bracket will be required +to be escaped, say by preceding them with a backslash ("\{" ) or +enclosing them within square brackets ("[{]") .. + +References: +https://bugzilla.redhat.com/1239379 + +* bin/automake.in (substitute_ac_subst_variables): Escape the +occurrence of '{' character. +--- + bin/automake.in | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/bin/automake.in b/bin/automake.in +index 0c29184..c294ced 100644 +--- a/bin/automake.in ++++ b/bin/automake.in +@@ -3898,7 +3898,7 @@ sub substitute_ac_subst_variables_worker + sub substitute_ac_subst_variables + { + my ($text) = @_; +- $text =~ s/\${([^ \t=:+{}]+)}/substitute_ac_subst_variables_worker ($1)/ge; ++ $text =~ s/\$\{([^ \t=:+{}]+)}/substitute_ac_subst_variables_worker ($1)/ge; + return $text; + } -- cgit v1.2.3 From 8d9bae4ed7cb2bccf80037b5adb77a608deb4bbf Mon Sep 17 00:00:00 2001 From: Mark H Weaver Date: Fri, 15 Jan 2016 17:53:58 -0500 Subject: gnu: librsvg: Update to 2.40.13 [fixes CVE-2015-7558]. * gnu/packages/patches/librsvg-tests.patch: Delete file. * gnu-system.am (dist_patch_DATA): Remove it. * gnu/packages/gnome.scm (librsvg): Update to 2.40.13. [source]: Remove patch. --- gnu-system.am | 1 - gnu/packages/gnome.scm | 8 +++----- gnu/packages/patches/librsvg-tests.patch | 27 --------------------------- 3 files changed, 3 insertions(+), 33 deletions(-) delete mode 100644 gnu/packages/patches/librsvg-tests.patch (limited to 'gnu-system.am') diff --git a/gnu-system.am b/gnu-system.am index 0550e79f87..a40576583f 100644 --- a/gnu-system.am +++ b/gnu-system.am @@ -546,7 +546,6 @@ dist_patch_DATA = \ gnu/packages/patches/libmad-armv7-thumb-pt2.patch \ gnu/packages/patches/libmad-frame-length.patch \ gnu/packages/patches/libmad-mips-newgcc.patch \ - gnu/packages/patches/librsvg-tests.patch \ gnu/packages/patches/libtheora-config-guess.patch \ gnu/packages/patches/libtool-skip-tests2.patch \ gnu/packages/patches/libsndfile-CVE-2014-9496.patch \ diff --git a/gnu/packages/gnome.scm b/gnu/packages/gnome.scm index e88ee8d904..5d14550e8a 100644 --- a/gnu/packages/gnome.scm +++ b/gnu/packages/gnome.scm @@ -9,7 +9,7 @@ ;;; Copyright © 2015 Andy Wingo ;;; Copyright © 2015 David Hashe ;;; Copyright © 2015 Ricardo Wurmus -;;; Copyright © 2015 Mark H Weaver +;;; Copyright © 2015, 2016 Mark H Weaver ;;; Copyright © 2015 David Thompson ;;; Copyright © 2015 Efraim Flashner ;;; @@ -841,7 +841,7 @@ dealing with different structured file formats.") (define-public librsvg (package (name "librsvg") - (version "2.40.11") + (version "2.40.13") (source (origin (method url-fetch) (uri (string-append "mirror://gnome/sources/" name "/" @@ -849,9 +849,7 @@ dealing with different structured file formats.") name "-" version ".tar.xz")) (sha256 (base32 - "00ifd9wjjjsw0ybk5j6qs4yyh66jj34hjmggy6dhrgfy8ksw06k1")) - (patches - (list (search-patch "librsvg-tests.patch"))))) + "014q7gz6mgfa7pfn0lr13qqv568ad8j1sw9d4vksnpazq0zajvjd")))) (build-system gnu-build-system) (arguments `(#:phases diff --git a/gnu/packages/patches/librsvg-tests.patch b/gnu/packages/patches/librsvg-tests.patch deleted file mode 100644 index dc5b94e185..0000000000 --- a/gnu/packages/patches/librsvg-tests.patch +++ /dev/null @@ -1,27 +0,0 @@ -From e06fc71a57156123e4e50a39957100a651ab632b Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?=E5=AE=8B=E6=96=87=E6=AD=A6?= -Date: Sat, 17 Oct 2015 10:20:33 +0800 -Subject: [PATCH] tests/styles: Don't duplicate test names. - ---- - tests/styles.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/tests/styles.c b/tests/styles.c -index d09b1f2..a938835 100644 ---- a/tests/styles.c -+++ b/tests/styles.c -@@ -97,8 +97,8 @@ static const FixtureData fixtures[] = - {"/styles/selectors/2 or more selectors (stroke)", "592207", "styles/bug592207.svg", "#target", "stroke", .expected.color = 0xff0000ff}, - {"/styles/svg-element-style", "615701", "styles/svg-class.svg", "#svg", "fill", .expected.color = 0xff0000ff}, - {"/styles/presentation attribute in svg element", "620693", "styles/bug620693.svg", "#svg", "stroke", .expected.color = 0xffff0000}, -- {"/styles/!important", "379629", "styles/bug379629.svg", "#base_shadow", "stroke", .expected.color = 0xffffc0cb /* pink */}, -- {"/styles/!important", "379629", "styles/bug379629.svg", "#base_shadow", "stroke-width", .expected.length = {POINTS_LENGTH(5.), 'i'}}, -+ {"/styles/!important/1", "379629", "styles/bug379629.svg", "#base_shadow", "stroke", .expected.color = 0xffffc0cb /* pink */}, -+ {"/styles/!important/2", "379629", "styles/bug379629.svg", "#base_shadow", "stroke-width", .expected.length = {POINTS_LENGTH(5.), 'i'}}, - {"/styles/!important/class", "614606", "styles/bug614606.svg", "#path6306", "fill", .expected.color = 0xffff0000 /* red */ }, - {"/styles/!important/element", "614606", "styles/bug614606.svg", "#path6308", "fill", .expected.color = 0xff000000}, - {"/styles/!important/#id prior than class", NULL, "styles/important.svg", "#red", "fill", .expected.color = 0xffff0000 }, --- -2.5.0 - -- cgit v1.2.3 From 7c853c02b85f166ef9870e92ab656863f4aa2196 Mon Sep 17 00:00:00 2001 From: Andreas Enge Date: Wed, 20 Jan 2016 13:09:53 +0100 Subject: gnu: doxygen: Update to 1.8.11. * gnu/packages/doxygen.scm (doxygen)[source]: Update to 1.8.11. Drop one patch. [build-system]: Switch to cmake-build-system, since gnu-build-system is not supported any more. [arguments]: Adapt. [native-inputs]: Drop unused perl. * gnu/packages/patches/doxygen-tmake.patch: Remove file. * gnu/packages/patches/doxygen-test.patch: Adapt. * gnu-system.am (dist_patch_DATA): Unregister patch. --- gnu-system.am | 1 - gnu/packages/doxygen.scm | 27 +++++++-------------------- gnu/packages/patches/doxygen-test.patch | 4 ++-- gnu/packages/patches/doxygen-tmake.patch | 24 ------------------------ 4 files changed, 9 insertions(+), 47 deletions(-) delete mode 100644 gnu/packages/patches/doxygen-tmake.patch (limited to 'gnu-system.am') diff --git a/gnu-system.am b/gnu-system.am index 9c87ac89da..e2c12520b2 100644 --- a/gnu-system.am +++ b/gnu-system.am @@ -447,7 +447,6 @@ dist_patch_DATA = \ gnu/packages/patches/diffutils-gets-undeclared.patch \ gnu/packages/patches/dfu-programmer-fix-libusb.patch \ gnu/packages/patches/doxygen-test.patch \ - gnu/packages/patches/doxygen-tmake.patch \ gnu/packages/patches/duplicity-piped-password.patch \ gnu/packages/patches/duplicity-test_selection-tmp.patch \ gnu/packages/patches/elfutils-tests-ptrace.patch \ diff --git a/gnu/packages/doxygen.scm b/gnu/packages/doxygen.scm index 8b1a057724..ffbaab16ee 100644 --- a/gnu/packages/doxygen.scm +++ b/gnu/packages/doxygen.scm @@ -1,5 +1,5 @@ ;;; GNU Guix --- Functional package management for GNU -;;; Copyright © 2014 Andreas Enge +;;; Copyright © 2014, 2016 Andreas Enge ;;; ;;; This file is part of GNU Guix. ;;; @@ -20,7 +20,7 @@ #:use-module ((guix licenses) #:select (gpl3+)) #:use-module (guix packages) #:use-module (guix download) - #:use-module (guix build-system gnu) + #:use-module (guix build-system cmake) #:use-module (gnu packages) #:use-module (gnu packages bison) #:use-module (gnu packages flex) @@ -32,38 +32,25 @@ (define-public doxygen (package (name "doxygen") - (version "1.8.7") + (version "1.8.11") (source (origin (method url-fetch) (uri (string-append "http://ftp.stack.nl/pub/users/dimitri/" name "-" version ".src.tar.gz")) (sha256 (base32 - "1ng3dv5fninhfi2fj75ghkr5jwsl653fxv2sxhaswj11x2vcdsn6")) - (patches (list (search-patch "doxygen-tmake.patch") - (search-patch "doxygen-test.patch"))))) - (build-system gnu-build-system) + "0ja02pm3fpfhc5dkry00kq8mn141cqvdqqpmms373ncbwi38pl35")) + (patches (list (search-patch "doxygen-test.patch"))))) + (build-system cmake-build-system) (native-inputs `(("bison" ,bison) ("flex" ,flex) ("libxml2" ,libxml2) ; provides xmllint for the tests - ("perl" ,perl) ; for the tests ("python" ,python-2))) ; for creating the documentation (propagated-inputs `(("graphviz" ,graphviz))) (arguments - `(#:test-target "test" - #:phases - (alist-replace - 'configure - (lambda* (#:key outputs #:allow-other-keys) - (let ((out (assoc-ref outputs "out"))) - ;; do not pass "--enable-fast-install", which makes the - ;; configure process fail - (zero? (system* - "./configure" - "--prefix" out)))) - %standard-phases))) + `(#:test-target "tests")) (home-page "http://www.stack.nl/~dimitri/doxygen/") (synopsis "Generate documentation from annotated sources") (description "Doxygen is the de facto standard tool for generating diff --git a/gnu/packages/patches/doxygen-test.patch b/gnu/packages/patches/doxygen-test.patch index 7a7f4e963f..5ac063adbf 100644 --- a/gnu/packages/patches/doxygen-test.patch +++ b/gnu/packages/patches/doxygen-test.patch @@ -31,8 +31,8 @@ diff -u -r doxygen-1.8.7.orig/testing/012/indexpage.xml doxygen-1.8.7/testing/01 My Project - See [1] for more info. -+ See knuth79 for more info. ++ See knuth79 for more info. -Nur in doxygen-1.8.7/testing: test_output_012. + diff --git a/gnu/packages/patches/doxygen-tmake.patch b/gnu/packages/patches/doxygen-tmake.patch deleted file mode 100644 index 3579243702..0000000000 --- a/gnu/packages/patches/doxygen-tmake.patch +++ /dev/null @@ -1,24 +0,0 @@ -Fix the `check_unix' function, which looks for `/bin/uname' to determine -whether we're on a Unix-like system. -Taken from nixpkgs. - ---- doxygen-1.5.8/tmake/bin/tmake 2008-12-06 14:16:20.000000000 +0100 -+++ doxygen-1.5.8/tmake/bin/tmake 2009-03-05 11:29:55.000000000 +0100 -@@ -234,17 +234,7 @@ sub tmake_verb { - # - - sub check_unix { -- my($r); -- $r = 0; -- if ( -f "/bin/uname" ) { -- $r = 1; -- (-f "\\bin\\uname") && ($r = 0); -- } -- if ( -f "/usr/bin/uname" ) { -- $r = 1; -- (-f "\\usr\\bin\\uname") && ($r = 0); -- } -- return $r; -+ return 1; - } - -- cgit v1.2.3 From 97b07aaa419bfa069bb217fca2f158f6ea0804a1 Mon Sep 17 00:00:00 2001 From: Eric Bavier Date: Wed, 20 Jan 2016 17:12:53 -0600 Subject: gnu: Add perl-module-pluggable. This Perl module was moved out of Perl core in v5.19.0. * gnu/packages/perl.scm (perl-module-pluggable): New variable. * gnu/packages/patches/perl-module-pluggable-search.patch: New patch. * gnu-system.am (dist_patch_DATA): Add it. --- gnu-system.am | 1 + .../patches/perl-module-pluggable-search.patch | 25 ++++++++++++++++++++++ gnu/packages/perl.scm | 22 ++++++++++++++++++- 3 files changed, 47 insertions(+), 1 deletion(-) create mode 100755 gnu/packages/patches/perl-module-pluggable-search.patch (limited to 'gnu-system.am') diff --git a/gnu-system.am b/gnu-system.am index e2c12520b2..fe421a9569 100644 --- a/gnu-system.am +++ b/gnu-system.am @@ -627,6 +627,7 @@ dist_patch_DATA = \ gnu/packages/patches/perl-net-ssleay-disable-ede-test.patch \ gnu/packages/patches/perl-no-build-time.patch \ gnu/packages/patches/perl-no-sys-dirs.patch \ + gnu/packages/patches/perl-module-pluggable-search.patch \ gnu/packages/patches/perl-source-date-epoch.patch \ gnu/packages/patches/perl-tk-x11-discover.patch \ gnu/packages/patches/pidgin-add-search-path.patch \ diff --git a/gnu/packages/patches/perl-module-pluggable-search.patch b/gnu/packages/patches/perl-module-pluggable-search.patch new file mode 100755 index 0000000000..ec51abc35d --- /dev/null +++ b/gnu/packages/patches/perl-module-pluggable-search.patch @@ -0,0 +1,25 @@ +Fix Perl module Module::Pluggable such that it can find plugins that live in +symlinked directories. + +Patch borrowed/adapted from Nixpkgs. + +--- Module-Pluggable-5.2/lib/Module/Pluggable/Object.pm 2015-04-08 23:28:48.120164135 -0500 ++++ Module-Pluggable-5.2/lib/Module/Pluggable/Object.pm 2015-04-08 23:30:27.032166704 -0500 +@@ -164,7 +164,7 @@ + my $sp = catdir($dir, (split /::/, $searchpath)); + + # if it doesn't exist or it's not a dir then skip it +- next unless ( -e $sp && -d _ ); # Use the cached stat the second time ++ next unless ( -e $sp ); + + my @files = $self->find_files($sp); + +@@ -279,7 +279,7 @@ + (my $path = $File::Find::name) =~ s#^\\./##; + push @files, $path; + } +- }, $search_path ); ++ }, "$search_path/." ); + } + #chdir $cwd; + return @files; \ No newline at end of file diff --git a/gnu/packages/perl.scm b/gnu/packages/perl.scm index 51fb96516a..4d9806cf4b 100644 --- a/gnu/packages/perl.scm +++ b/gnu/packages/perl.scm @@ -2,7 +2,7 @@ ;;; Copyright © 2012, 2013, 2014, 2015, 2016 Ludovic Courtès ;;; Copyright © 2013 Andreas Enge ;;; Copyright © 2015 Ricardo Wurmus -;;; Copyright © 2015 Eric Bavier +;;; Copyright © 2015, 2016 Eric Bavier ;;; Copyright © 2015 Eric Dvorsak ;;; Copyright © 2016 Mark H Weaver ;;; @@ -3077,6 +3077,26 @@ strictly correct manner with ExtUtils::MakeMaker, and will run on any Perl installation version 5.005 or newer.") (license (package-license perl)))) +(define-public perl-module-pluggable + (package + (name "perl-module-pluggable") + (version "5.2") + (source + (origin + (method url-fetch) + (uri (string-append "mirror://cpan/authors/id/S/SI/SIMONW/" + "Module-Pluggable-" version ".tar.gz")) + (sha256 + (base32 + "1px6qmszmfc69v36vd8d92av4nkrif6xf4nrj3xv647xwi2svwmk")) + (patches (list (search-patch "perl-module-pluggable-search.patch"))))) + (build-system perl-build-system) + (home-page "http://search.cpan.org/dist/Module-Pluggable") + (synopsis "Give your Perl module the ability to have plugins") + (description "This module provides a simple but extensible way of having +'plugins' for your Perl module.") + (license (package-license perl)))) + (define-public perl-module-runtime (package (name "perl-module-runtime") -- cgit v1.2.3 From 86fa2ea92f431fe9d23d41aa22c198ec2ce9a5f1 Mon Sep 17 00:00:00 2001 From: Mark H Weaver Date: Thu, 21 Jan 2016 00:28:03 -0500 Subject: gnu: libtiff: Update to 4.0.6. Add fixes for CVE-2015-{8665,8683}. * gnu/packages/patches/libtiff-CVE-2015-8665+CVE-2015-8683.patch, gnu/packages/patches/libtiff-oob-accesses-in-decode.patch, gnu/packages/patches/libtiff-oob-write-in-nextdecode.patch: New files. * gnu-system.am (dist_patch_DATA): Add them. * gnu/packages/image.scm (libtiff): Update to 4.0.6. [source]: Add patches. --- gnu-system.am | 3 + gnu/packages/image.scm | 10 +- .../libtiff-CVE-2015-8665+CVE-2015-8683.patch | 107 +++++++++++++ .../patches/libtiff-oob-accesses-in-decode.patch | 171 +++++++++++++++++++++ .../patches/libtiff-oob-write-in-nextdecode.patch | 49 ++++++ 5 files changed, 337 insertions(+), 3 deletions(-) create mode 100644 gnu/packages/patches/libtiff-CVE-2015-8665+CVE-2015-8683.patch create mode 100644 gnu/packages/patches/libtiff-oob-accesses-in-decode.patch create mode 100644 gnu/packages/patches/libtiff-oob-write-in-nextdecode.patch (limited to 'gnu-system.am') diff --git a/gnu-system.am b/gnu-system.am index fe421a9569..d37775d235 100644 --- a/gnu-system.am +++ b/gnu-system.am @@ -547,6 +547,9 @@ dist_patch_DATA = \ gnu/packages/patches/libmad-frame-length.patch \ gnu/packages/patches/libmad-mips-newgcc.patch \ gnu/packages/patches/libtheora-config-guess.patch \ + gnu/packages/patches/libtiff-CVE-2015-8665+CVE-2015-8683.patch \ + gnu/packages/patches/libtiff-oob-accesses-in-decode.patch \ + gnu/packages/patches/libtiff-oob-write-in-nextdecode.patch \ gnu/packages/patches/libtool-skip-tests2.patch \ gnu/packages/patches/libsndfile-CVE-2014-9496.patch \ gnu/packages/patches/libsndfile-CVE-2015-7805.patch \ diff --git a/gnu/packages/image.scm b/gnu/packages/image.scm index d3ed92fde8..bf120f0184 100644 --- a/gnu/packages/image.scm +++ b/gnu/packages/image.scm @@ -1,6 +1,6 @@ ;;; GNU Guix --- Functional package management for GNU ;;; Copyright © 2013, 2015 Andreas Enge -;;; Copyright © 2014, 2015 Mark H Weaver +;;; Copyright © 2014, 2015, 2016 Mark H Weaver ;;; Copyright © 2014, 2015 Alex Kost ;;; Copyright © 2014 Ricardo Wurmus ;;; Copyright © 2015 Taylan Ulrich Bayırlı/Kammer @@ -131,13 +131,17 @@ maximum quality factor.") (define-public libtiff (package (name "libtiff") - (version "4.0.5") + (version "4.0.6") (source (origin (method url-fetch) (uri (string-append "ftp://ftp.remotesensing.org/pub/libtiff/tiff-" version ".tar.gz")) (sha256 (base32 - "171hgy4mylwmvdm7gp6ffjva81m4j56v3fbqsbfl7avzxn1slpp2")))) + "136nf1rj9dp5jgv1p7z4dk0xy3wki1w0vfjbk82f645m0w4samsd")) + (patches (map search-patch + '("libtiff-oob-accesses-in-decode.patch" + "libtiff-oob-write-in-nextdecode.patch" + "libtiff-CVE-2015-8665+CVE-2015-8683.patch"))))) (build-system gnu-build-system) (outputs '("out" "doc")) ;1.3 MiB of HTML documentation diff --git a/gnu/packages/patches/libtiff-CVE-2015-8665+CVE-2015-8683.patch b/gnu/packages/patches/libtiff-CVE-2015-8665+CVE-2015-8683.patch new file mode 100644 index 0000000000..811516dbe9 --- /dev/null +++ b/gnu/packages/patches/libtiff-CVE-2015-8665+CVE-2015-8683.patch @@ -0,0 +1,107 @@ +2015-12-26 Even Rouault + + * libtiff/tif_getimage.c: fix out-of-bound reads in TIFFRGBAImage + interface in case of unsupported values of SamplesPerPixel/ExtraSamples + for LogLUV / CIELab. Add explicit call to TIFFRGBAImageOK() in + TIFFRGBAImageBegin(). Fix CVE-2015-8665 reported by limingxing and + CVE-2015-8683 reported by zzf of Alibaba. + +diff -u -r1.93 -r1.94 +--- libtiff/libtiff/tif_getimage.c 22 Nov 2015 15:31:03 -0000 1.93 ++++ libtiff/libtiff/tif_getimage.c 26 Dec 2015 17:32:03 -0000 1.94 +@@ -182,20 +182,22 @@ + "Planarconfiguration", td->td_planarconfig); + return (0); + } +- if( td->td_samplesperpixel != 3 ) ++ if( td->td_samplesperpixel != 3 || colorchannels != 3 ) + { + sprintf(emsg, +- "Sorry, can not handle image with %s=%d", +- "Samples/pixel", td->td_samplesperpixel); ++ "Sorry, can not handle image with %s=%d, %s=%d", ++ "Samples/pixel", td->td_samplesperpixel, ++ "colorchannels", colorchannels); + return 0; + } + break; + case PHOTOMETRIC_CIELAB: +- if( td->td_samplesperpixel != 3 || td->td_bitspersample != 8 ) ++ if( td->td_samplesperpixel != 3 || colorchannels != 3 || td->td_bitspersample != 8 ) + { + sprintf(emsg, +- "Sorry, can not handle image with %s=%d and %s=%d", ++ "Sorry, can not handle image with %s=%d, %s=%d and %s=%d", + "Samples/pixel", td->td_samplesperpixel, ++ "colorchannels", colorchannels, + "Bits/sample", td->td_bitspersample); + return 0; + } +@@ -255,6 +257,9 @@ + int colorchannels; + uint16 *red_orig, *green_orig, *blue_orig; + int n_color; ++ ++ if( !TIFFRGBAImageOK(tif, emsg) ) ++ return 0; + + /* Initialize to normal values */ + img->row_offset = 0; +@@ -2509,29 +2514,33 @@ + case PHOTOMETRIC_RGB: + switch (img->bitspersample) { + case 8: +- if (img->alpha == EXTRASAMPLE_ASSOCALPHA) ++ if (img->alpha == EXTRASAMPLE_ASSOCALPHA && ++ img->samplesperpixel >= 4) + img->put.contig = putRGBAAcontig8bittile; +- else if (img->alpha == EXTRASAMPLE_UNASSALPHA) ++ else if (img->alpha == EXTRASAMPLE_UNASSALPHA && ++ img->samplesperpixel >= 4) + { + if (BuildMapUaToAa(img)) + img->put.contig = putRGBUAcontig8bittile; + } +- else ++ else if( img->samplesperpixel >= 3 ) + img->put.contig = putRGBcontig8bittile; + break; + case 16: +- if (img->alpha == EXTRASAMPLE_ASSOCALPHA) ++ if (img->alpha == EXTRASAMPLE_ASSOCALPHA && ++ img->samplesperpixel >=4 ) + { + if (BuildMapBitdepth16To8(img)) + img->put.contig = putRGBAAcontig16bittile; + } +- else if (img->alpha == EXTRASAMPLE_UNASSALPHA) ++ else if (img->alpha == EXTRASAMPLE_UNASSALPHA && ++ img->samplesperpixel >=4 ) + { + if (BuildMapBitdepth16To8(img) && + BuildMapUaToAa(img)) + img->put.contig = putRGBUAcontig16bittile; + } +- else ++ else if( img->samplesperpixel >=3 ) + { + if (BuildMapBitdepth16To8(img)) + img->put.contig = putRGBcontig16bittile; +@@ -2540,7 +2549,7 @@ + } + break; + case PHOTOMETRIC_SEPARATED: +- if (buildMap(img)) { ++ if (img->samplesperpixel >=4 && buildMap(img)) { + if (img->bitspersample == 8) { + if (!img->Map) + img->put.contig = putRGBcontig8bitCMYKtile; +@@ -2636,7 +2645,7 @@ + } + break; + case PHOTOMETRIC_CIELAB: +- if (buildMap(img)) { ++ if (img->samplesperpixel == 3 && buildMap(img)) { + if (img->bitspersample == 8) + img->put.contig = initCIELabConversion(img); + break; diff --git a/gnu/packages/patches/libtiff-oob-accesses-in-decode.patch b/gnu/packages/patches/libtiff-oob-accesses-in-decode.patch new file mode 100644 index 0000000000..3fea745056 --- /dev/null +++ b/gnu/packages/patches/libtiff-oob-accesses-in-decode.patch @@ -0,0 +1,171 @@ +2015-12-27 Even Rouault + + * libtiff/tif_luv.c: fix potential out-of-bound writes in decode + functions in non debug builds by replacing assert()s by regular if + checks (bugzilla #2522). + Fix potential out-of-bound reads in case of short input data. + +diff -u -r1.40 -r1.41 +--- libtiff/libtiff/tif_luv.c 21 Jun 2015 01:09:09 -0000 1.40 ++++ libtiff/libtiff/tif_luv.c 27 Dec 2015 16:25:11 -0000 1.41 +@@ -1,4 +1,4 @@ +-/* $Id: tif_luv.c,v 1.40 2015-06-21 01:09:09 bfriesen Exp $ */ ++/* $Id: tif_luv.c,v 1.41 2015-12-27 16:25:11 erouault Exp $ */ + + /* + * Copyright (c) 1997 Greg Ward Larson +@@ -202,7 +202,11 @@ + if (sp->user_datafmt == SGILOGDATAFMT_16BIT) + tp = (int16*) op; + else { +- assert(sp->tbuflen >= npixels); ++ if(sp->tbuflen < npixels) { ++ TIFFErrorExt(tif->tif_clientdata, module, ++ "Translation buffer too short"); ++ return (0); ++ } + tp = (int16*) sp->tbuf; + } + _TIFFmemset((void*) tp, 0, npixels*sizeof (tp[0])); +@@ -211,9 +215,11 @@ + cc = tif->tif_rawcc; + /* get each byte string */ + for (shft = 2*8; (shft -= 8) >= 0; ) { +- for (i = 0; i < npixels && cc > 0; ) ++ for (i = 0; i < npixels && cc > 0; ) { + if (*bp >= 128) { /* run */ +- rc = *bp++ + (2-128); /* TODO: potential input buffer overrun when decoding corrupt or truncated data */ ++ if( cc < 2 ) ++ break; ++ rc = *bp++ + (2-128); + b = (int16)(*bp++ << shft); + cc -= 2; + while (rc-- && i < npixels) +@@ -223,6 +229,7 @@ + while (--cc && rc-- && i < npixels) + tp[i++] |= (int16)*bp++ << shft; + } ++ } + if (i != npixels) { + #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__)) + TIFFErrorExt(tif->tif_clientdata, module, +@@ -268,13 +275,17 @@ + if (sp->user_datafmt == SGILOGDATAFMT_RAW) + tp = (uint32 *)op; + else { +- assert(sp->tbuflen >= npixels); ++ if(sp->tbuflen < npixels) { ++ TIFFErrorExt(tif->tif_clientdata, module, ++ "Translation buffer too short"); ++ return (0); ++ } + tp = (uint32 *) sp->tbuf; + } + /* copy to array of uint32 */ + bp = (unsigned char*) tif->tif_rawcp; + cc = tif->tif_rawcc; +- for (i = 0; i < npixels && cc > 0; i++) { ++ for (i = 0; i < npixels && cc >= 3; i++) { + tp[i] = bp[0] << 16 | bp[1] << 8 | bp[2]; + bp += 3; + cc -= 3; +@@ -325,7 +336,11 @@ + if (sp->user_datafmt == SGILOGDATAFMT_RAW) + tp = (uint32*) op; + else { +- assert(sp->tbuflen >= npixels); ++ if(sp->tbuflen < npixels) { ++ TIFFErrorExt(tif->tif_clientdata, module, ++ "Translation buffer too short"); ++ return (0); ++ } + tp = (uint32*) sp->tbuf; + } + _TIFFmemset((void*) tp, 0, npixels*sizeof (tp[0])); +@@ -334,11 +349,13 @@ + cc = tif->tif_rawcc; + /* get each byte string */ + for (shft = 4*8; (shft -= 8) >= 0; ) { +- for (i = 0; i < npixels && cc > 0; ) ++ for (i = 0; i < npixels && cc > 0; ) { + if (*bp >= 128) { /* run */ ++ if( cc < 2 ) ++ break; + rc = *bp++ + (2-128); + b = (uint32)*bp++ << shft; +- cc -= 2; /* TODO: potential input buffer overrun when decoding corrupt or truncated data */ ++ cc -= 2; + while (rc-- && i < npixels) + tp[i++] |= b; + } else { /* non-run */ +@@ -346,6 +363,7 @@ + while (--cc && rc-- && i < npixels) + tp[i++] |= (uint32)*bp++ << shft; + } ++ } + if (i != npixels) { + #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__)) + TIFFErrorExt(tif->tif_clientdata, module, +@@ -413,6 +431,7 @@ + static int + LogL16Encode(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s) + { ++ static const char module[] = "LogL16Encode"; + LogLuvState* sp = EncoderState(tif); + int shft; + tmsize_t i; +@@ -433,7 +452,11 @@ + tp = (int16*) bp; + else { + tp = (int16*) sp->tbuf; +- assert(sp->tbuflen >= npixels); ++ if(sp->tbuflen < npixels) { ++ TIFFErrorExt(tif->tif_clientdata, module, ++ "Translation buffer too short"); ++ return (0); ++ } + (*sp->tfunc)(sp, bp, npixels); + } + /* compress each byte string */ +@@ -506,6 +529,7 @@ + static int + LogLuvEncode24(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s) + { ++ static const char module[] = "LogLuvEncode24"; + LogLuvState* sp = EncoderState(tif); + tmsize_t i; + tmsize_t npixels; +@@ -521,7 +545,11 @@ + tp = (uint32*) bp; + else { + tp = (uint32*) sp->tbuf; +- assert(sp->tbuflen >= npixels); ++ if(sp->tbuflen < npixels) { ++ TIFFErrorExt(tif->tif_clientdata, module, ++ "Translation buffer too short"); ++ return (0); ++ } + (*sp->tfunc)(sp, bp, npixels); + } + /* write out encoded pixels */ +@@ -553,6 +581,7 @@ + static int + LogLuvEncode32(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s) + { ++ static const char module[] = "LogLuvEncode32"; + LogLuvState* sp = EncoderState(tif); + int shft; + tmsize_t i; +@@ -574,7 +603,11 @@ + tp = (uint32*) bp; + else { + tp = (uint32*) sp->tbuf; +- assert(sp->tbuflen >= npixels); ++ if(sp->tbuflen < npixels) { ++ TIFFErrorExt(tif->tif_clientdata, module, ++ "Translation buffer too short"); ++ return (0); ++ } + (*sp->tfunc)(sp, bp, npixels); + } + /* compress each byte string */ diff --git a/gnu/packages/patches/libtiff-oob-write-in-nextdecode.patch b/gnu/packages/patches/libtiff-oob-write-in-nextdecode.patch new file mode 100644 index 0000000000..50657b667c --- /dev/null +++ b/gnu/packages/patches/libtiff-oob-write-in-nextdecode.patch @@ -0,0 +1,49 @@ +2015-12-27 Even Rouault + + * libtiff/tif_next.c: fix potential out-of-bound write in NeXTDecode() + triggered by http://lcamtuf.coredump.cx/afl/vulns/libtiff5.tif + (bugzilla #2508) + +diff -u -r1.16 -r1.18 +--- libtiff/libtiff/tif_next.c 29 Dec 2014 12:09:11 -0000 1.16 ++++ libtiff/libtiff/tif_next.c 27 Dec 2015 17:14:52 -0000 1.18 +@@ -1,4 +1,4 @@ +-/* $Id: tif_next.c,v 1.16 2014-12-29 12:09:11 erouault Exp $ */ ++/* $Id: tif_next.c,v 1.18 2015-12-27 17:14:52 erouault Exp $ */ + + /* + * Copyright (c) 1988-1997 Sam Leffler +@@ -37,7 +37,7 @@ + case 0: op[0] = (unsigned char) ((v) << 6); break; \ + case 1: op[0] |= (v) << 4; break; \ + case 2: op[0] |= (v) << 2; break; \ +- case 3: *op++ |= (v); break; \ ++ case 3: *op++ |= (v); op_offset++; break; \ + } \ + } + +@@ -103,6 +103,7 @@ + } + default: { + uint32 npixels = 0, grey; ++ tmsize_t op_offset = 0; + uint32 imagewidth = tif->tif_dir.td_imagewidth; + if( isTiled(tif) ) + imagewidth = tif->tif_dir.td_tilewidth; +@@ -122,10 +123,15 @@ + * bounds, potentially resulting in a security + * issue. + */ +- while (n-- > 0 && npixels < imagewidth) ++ while (n-- > 0 && npixels < imagewidth && op_offset < scanline) + SETPIXEL(op, grey); + if (npixels >= imagewidth) + break; ++ if (op_offset >= scanline ) { ++ TIFFErrorExt(tif->tif_clientdata, module, "Invalid data for scanline %ld", ++ (long) tif->tif_row); ++ return (0); ++ } + if (cc == 0) + goto bad; + n = *bp++, cc--; -- cgit v1.2.3 From 29a780147d066d5ce218d1fa2678a0a36a1145e3 Mon Sep 17 00:00:00 2001 From: Mark H Weaver Date: Thu, 28 Jan 2016 00:22:49 -0500 Subject: gnu: icecat: Add fixes for CVE-2016-{1930,1935} and other bugs. * gnu/packages/patches/icecat-CVE-2016-1930-pt01.patch, gnu/packages/patches/icecat-CVE-2016-1930-pt02.patch, gnu/packages/patches/icecat-CVE-2016-1930-pt03.patch, gnu/packages/patches/icecat-CVE-2016-1930-pt04.patch, gnu/packages/patches/icecat-CVE-2016-1930-pt05.patch, gnu/packages/patches/icecat-CVE-2016-1930-pt06.patch, gnu/packages/patches/icecat-CVE-2016-1930-pt07.patch, gnu/packages/patches/icecat-CVE-2016-1930-pt08.patch, gnu/packages/patches/icecat-CVE-2016-1930-pt09.patch, gnu/packages/patches/icecat-CVE-2016-1930-pt10.patch, gnu/packages/patches/icecat-CVE-2016-1930-pt11.patch, gnu/packages/patches/icecat-CVE-2016-1930-pt12.patch, gnu/packages/patches/icecat-CVE-2016-1930-pt13.patch, gnu/packages/patches/icecat-CVE-2016-1930-pt14.patch, gnu/packages/patches/icecat-CVE-2016-1930-pt15.patch, gnu/packages/patches/icecat-CVE-2016-1935.patch, gnu/packages/patches/icecat-bug-1146335-pt1.patch, gnu/packages/patches/icecat-bug-1146335-pt2.patch, gnu/packages/patches/icecat-limit-max-buffers-size-for-ANGLE.patch: New files. * gnu-system.am (dist_patch_DATA): Add them. * gnu/packages/gnuzilla.scm (icecat)[source]: Add patches. --- gnu-system.am | 19 ++ gnu/packages/gnuzilla.scm | 24 +- .../patches/icecat-CVE-2016-1930-pt01.patch | 34 +++ .../patches/icecat-CVE-2016-1930-pt02.patch | 33 +++ .../patches/icecat-CVE-2016-1930-pt03.patch | 308 +++++++++++++++++++++ .../patches/icecat-CVE-2016-1930-pt04.patch | 47 ++++ .../patches/icecat-CVE-2016-1930-pt05.patch | 51 ++++ .../patches/icecat-CVE-2016-1930-pt06.patch | 170 ++++++++++++ .../patches/icecat-CVE-2016-1930-pt07.patch | 56 ++++ .../patches/icecat-CVE-2016-1930-pt08.patch | 48 ++++ .../patches/icecat-CVE-2016-1930-pt09.patch | 189 +++++++++++++ .../patches/icecat-CVE-2016-1930-pt10.patch | 33 +++ .../patches/icecat-CVE-2016-1930-pt11.patch | 183 ++++++++++++ .../patches/icecat-CVE-2016-1930-pt12.patch | 91 ++++++ .../patches/icecat-CVE-2016-1930-pt13.patch | 34 +++ .../patches/icecat-CVE-2016-1930-pt14.patch | 83 ++++++ .../patches/icecat-CVE-2016-1930-pt15.patch | 35 +++ gnu/packages/patches/icecat-CVE-2016-1935.patch | 77 ++++++ gnu/packages/patches/icecat-bug-1146335-pt1.patch | 141 ++++++++++ gnu/packages/patches/icecat-bug-1146335-pt2.patch | 43 +++ .../icecat-limit-max-buffers-size-for-ANGLE.patch | 73 +++++ 21 files changed, 1770 insertions(+), 2 deletions(-) create mode 100644 gnu/packages/patches/icecat-CVE-2016-1930-pt01.patch create mode 100644 gnu/packages/patches/icecat-CVE-2016-1930-pt02.patch create mode 100644 gnu/packages/patches/icecat-CVE-2016-1930-pt03.patch create mode 100644 gnu/packages/patches/icecat-CVE-2016-1930-pt04.patch create mode 100644 gnu/packages/patches/icecat-CVE-2016-1930-pt05.patch create mode 100644 gnu/packages/patches/icecat-CVE-2016-1930-pt06.patch create mode 100644 gnu/packages/patches/icecat-CVE-2016-1930-pt07.patch create mode 100644 gnu/packages/patches/icecat-CVE-2016-1930-pt08.patch create mode 100644 gnu/packages/patches/icecat-CVE-2016-1930-pt09.patch create mode 100644 gnu/packages/patches/icecat-CVE-2016-1930-pt10.patch create mode 100644 gnu/packages/patches/icecat-CVE-2016-1930-pt11.patch create mode 100644 gnu/packages/patches/icecat-CVE-2016-1930-pt12.patch create mode 100644 gnu/packages/patches/icecat-CVE-2016-1930-pt13.patch create mode 100644 gnu/packages/patches/icecat-CVE-2016-1930-pt14.patch create mode 100644 gnu/packages/patches/icecat-CVE-2016-1930-pt15.patch create mode 100644 gnu/packages/patches/icecat-CVE-2016-1935.patch create mode 100644 gnu/packages/patches/icecat-bug-1146335-pt1.patch create mode 100644 gnu/packages/patches/icecat-bug-1146335-pt2.patch create mode 100644 gnu/packages/patches/icecat-limit-max-buffers-size-for-ANGLE.patch (limited to 'gnu-system.am') diff --git a/gnu-system.am b/gnu-system.am index 297f40a50e..45511d2eb8 100644 --- a/gnu-system.am +++ b/gnu-system.am @@ -517,7 +517,26 @@ dist_patch_DATA = \ gnu/packages/patches/hop-linker-flags.patch \ gnu/packages/patches/hydra-automake-1.15.patch \ gnu/packages/patches/hydra-disable-darcs-test.patch \ + gnu/packages/patches/icecat-CVE-2016-1930-pt01.patch \ + gnu/packages/patches/icecat-CVE-2016-1930-pt02.patch \ + gnu/packages/patches/icecat-CVE-2016-1930-pt03.patch \ + gnu/packages/patches/icecat-CVE-2016-1930-pt04.patch \ + gnu/packages/patches/icecat-CVE-2016-1930-pt05.patch \ + gnu/packages/patches/icecat-CVE-2016-1930-pt06.patch \ + gnu/packages/patches/icecat-CVE-2016-1930-pt07.patch \ + gnu/packages/patches/icecat-CVE-2016-1930-pt08.patch \ + gnu/packages/patches/icecat-CVE-2016-1930-pt09.patch \ + gnu/packages/patches/icecat-CVE-2016-1930-pt10.patch \ + gnu/packages/patches/icecat-CVE-2016-1930-pt11.patch \ + gnu/packages/patches/icecat-CVE-2016-1930-pt12.patch \ + gnu/packages/patches/icecat-CVE-2016-1930-pt13.patch \ + gnu/packages/patches/icecat-CVE-2016-1930-pt14.patch \ + gnu/packages/patches/icecat-CVE-2016-1930-pt15.patch \ + gnu/packages/patches/icecat-CVE-2016-1935.patch \ gnu/packages/patches/icecat-avoid-bundled-includes.patch \ + gnu/packages/patches/icecat-bug-1146335-pt1.patch \ + gnu/packages/patches/icecat-bug-1146335-pt2.patch \ + gnu/packages/patches/icecat-limit-max-buffers-size-for-ANGLE.patch \ gnu/packages/patches/icu4c-CVE-2014-6585.patch \ gnu/packages/patches/icu4c-CVE-2015-1270.patch \ gnu/packages/patches/icu4c-CVE-2015-4760.patch \ diff --git a/gnu/packages/gnuzilla.scm b/gnu/packages/gnuzilla.scm index 03ca0b7ca0..62010dbf6b 100644 --- a/gnu/packages/gnuzilla.scm +++ b/gnu/packages/gnuzilla.scm @@ -1,7 +1,7 @@ ;;; GNU Guix --- Functional package management for GNU ;;; Copyright © 2013, 2015 Andreas Enge ;;; Copyright © 2013, 2014, 2015 Ludovic Courtès -;;; Copyright © 2014, 2015 Mark H Weaver +;;; Copyright © 2014, 2015, 2016 Mark H Weaver ;;; Copyright © 2015 Sou Bunnbu ;;; ;;; This file is part of GNU Guix. @@ -287,7 +287,27 @@ standards.") (sha256 (base32 "0m18xyb0rd02yaw9xd5z4bab1wr2599iszzqhm86c134jv5vk6cg")) - (patches (map search-patch '("icecat-avoid-bundled-includes.patch"))) + (patches (map search-patch + '("icecat-avoid-bundled-includes.patch" + "icecat-CVE-2016-1930-pt01.patch" + "icecat-CVE-2016-1930-pt02.patch" + "icecat-CVE-2016-1930-pt03.patch" + "icecat-CVE-2016-1930-pt04.patch" + "icecat-CVE-2016-1930-pt05.patch" + "icecat-CVE-2016-1930-pt06.patch" + "icecat-CVE-2016-1930-pt07.patch" + "icecat-CVE-2016-1930-pt08.patch" + "icecat-CVE-2016-1930-pt09.patch" + "icecat-CVE-2016-1930-pt10.patch" + "icecat-CVE-2016-1930-pt11.patch" + "icecat-CVE-2016-1930-pt12.patch" + "icecat-CVE-2016-1930-pt13.patch" + "icecat-bug-1146335-pt1.patch" + "icecat-bug-1146335-pt2.patch" + "icecat-CVE-2016-1935.patch" + "icecat-CVE-2016-1930-pt14.patch" + "icecat-CVE-2016-1930-pt15.patch" + "icecat-limit-max-buffers-size-for-ANGLE.patch"))) (modules '((guix build utils))) (snippet '(begin diff --git a/gnu/packages/patches/icecat-CVE-2016-1930-pt01.patch b/gnu/packages/patches/icecat-CVE-2016-1930-pt01.patch new file mode 100644 index 0000000000..27768fa1ac --- /dev/null +++ b/gnu/packages/patches/icecat-CVE-2016-1930-pt01.patch @@ -0,0 +1,34 @@ +Copied from: https://hg.mozilla.org/releases/mozilla-esr38/rev/925215cae26f +Security advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2016-01/ +Mozilla Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1233346 + +# HG changeset patch +# User Nils Ohlmeier +# Date 1451439902 18000 +# Node ID 925215cae26f9c0ccff07ef403a5b3194a4c45c4 +# Parent ff8e52467d793e935b80bf22a722a71a96fe2d63 +Bug 1233346 - r=ekr a=abillings + +diff --git a/media/mtransport/third_party/nICEr/src/stun/addrs.c b/media/mtransport/third_party/nICEr/src/stun/addrs.c +--- a/media/mtransport/third_party/nICEr/src/stun/addrs.c ++++ b/media/mtransport/third_party/nICEr/src/stun/addrs.c +@@ -530,16 +530,18 @@ stun_get_win32_addrs(nr_local_addr addrs + + for (tmpAddress = AdapterAddresses; tmpAddress != NULL; tmpAddress = tmpAddress->Next) { + char *c; + + if (tmpAddress->OperStatus != IfOperStatusUp) + continue; + + snprintf(munged_ifname, IFNAMSIZ, "%S%c", tmpAddress->FriendlyName, 0); ++ munged_ifname[IFNAMSIZ-1] = '\0'; ++ + /* replace spaces with underscores */ + c = strchr(munged_ifname, ' '); + while (c != NULL) { + *c = '_'; + c = strchr(munged_ifname, ' '); + } + c = strchr(munged_ifname, '.'); + while (c != NULL) { + diff --git a/gnu/packages/patches/icecat-CVE-2016-1930-pt02.patch b/gnu/packages/patches/icecat-CVE-2016-1930-pt02.patch new file mode 100644 index 0000000000..fa1804eb82 --- /dev/null +++ b/gnu/packages/patches/icecat-CVE-2016-1930-pt02.patch @@ -0,0 +1,33 @@ +Copied from: https://hg.mozilla.org/releases/mozilla-esr38/rev/fc78180165a8 +Security advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2016-01/ +Mozilla Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1223670 + +# HG changeset patch +# User Karl Tomlinson +# Date 1449117514 -46800 +# Node ID fc78180165a8262c80bbb722ed99b2e0c27b02d0 +# Parent 925215cae26f9c0ccff07ef403a5b3194a4c45c4 +bug 1223670 assert that connected streams have the same graph r=padenot a=abillings + +diff --git a/dom/media/MediaStreamGraph.cpp b/dom/media/MediaStreamGraph.cpp +--- a/dom/media/MediaStreamGraph.cpp ++++ b/dom/media/MediaStreamGraph.cpp +@@ -2696,16 +2696,17 @@ ProcessedMediaStream::AllocateInputPort( + unused << mPort.forget(); + } + virtual void RunDuringShutdown() + { + Run(); + } + nsRefPtr mPort; + }; ++ MOZ_ASSERT(aStream->GraphImpl() == GraphImpl()); + nsRefPtr port = new MediaInputPort(aStream, this, aFlags, + aInputNumber, aOutputNumber); + port->SetGraphImpl(GraphImpl()); + GraphImpl()->AppendMessage(new Message(port)); + return port.forget(); + } + + void + diff --git a/gnu/packages/patches/icecat-CVE-2016-1930-pt03.patch b/gnu/packages/patches/icecat-CVE-2016-1930-pt03.patch new file mode 100644 index 0000000000..cf0843b8b3 --- /dev/null +++ b/gnu/packages/patches/icecat-CVE-2016-1930-pt03.patch @@ -0,0 +1,308 @@ +Copied from: https://hg.mozilla.org/releases/mozilla-esr38/rev/f746c38d160e +Security advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2016-01/ +Mozilla Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1223670 + +# HG changeset patch +# User Karl Tomlinson +# Date 1449764754 18000 +# Node ID f746c38d160ea29088c15cacae44f3662befaec5 +# Parent fc78180165a8262c80bbb722ed99b2e0c27b02d0 +bug 1223670 replace public constructors with fallible factory methods r=baku a=abillings + +diff --git a/dom/media/webaudio/AudioContext.cpp b/dom/media/webaudio/AudioContext.cpp +--- a/dom/media/webaudio/AudioContext.cpp ++++ b/dom/media/webaudio/AudioContext.cpp +@@ -299,32 +299,29 @@ AudioContext::CreateMediaElementSource(H + aRv.Throw(NS_ERROR_DOM_NOT_SUPPORTED_ERR); + return nullptr; + } + #endif + nsRefPtr stream = aMediaElement.MozCaptureStream(aRv); + if (aRv.Failed()) { + return nullptr; + } +- nsRefPtr mediaElementAudioSourceNode = +- new MediaElementAudioSourceNode(this, stream); +- return mediaElementAudioSourceNode.forget(); ++ return MediaElementAudioSourceNode::Create(this, stream, aRv); + } + + already_AddRefed + AudioContext::CreateMediaStreamSource(DOMMediaStream& aMediaStream, + ErrorResult& aRv) + { + if (mIsOffline) { + aRv.Throw(NS_ERROR_DOM_NOT_SUPPORTED_ERR); + return nullptr; + } +- nsRefPtr mediaStreamAudioSourceNode = +- new MediaStreamAudioSourceNode(this, &aMediaStream); +- return mediaStreamAudioSourceNode.forget(); ++ ++ return MediaStreamAudioSourceNode::Create(this, &aMediaStream, aRv); + } + + already_AddRefed + AudioContext::CreateGain() + { + nsRefPtr gainNode = new GainNode(this); + return gainNode.forget(); + } +diff --git a/dom/media/webaudio/AudioNode.cpp b/dom/media/webaudio/AudioNode.cpp +--- a/dom/media/webaudio/AudioNode.cpp ++++ b/dom/media/webaudio/AudioNode.cpp +@@ -61,34 +61,29 @@ AudioNode::AudioNode(AudioContext* aCont + ChannelInterpretation aChannelInterpretation) + : DOMEventTargetHelper(aContext->GetParentObject()) + , mContext(aContext) + , mChannelCount(aChannelCount) + , mChannelCountMode(aChannelCountMode) + , mChannelInterpretation(aChannelInterpretation) + , mId(gId++) + , mPassThrough(false) +-#ifdef DEBUG +- , mDemiseNotified(false) +-#endif + { + MOZ_ASSERT(aContext); + DOMEventTargetHelper::BindToOwner(aContext->GetParentObject()); + aContext->UpdateNodeCount(1); + } + + AudioNode::~AudioNode() + { + MOZ_ASSERT(mInputNodes.IsEmpty()); + MOZ_ASSERT(mOutputNodes.IsEmpty()); + MOZ_ASSERT(mOutputParams.IsEmpty()); +-#ifdef DEBUG +- MOZ_ASSERT(mDemiseNotified, ++ MOZ_ASSERT(!mStream, + "The webaudio-node-demise notification must have been sent"); +-#endif + if (mContext) { + mContext->UpdateNodeCount(-1); + } + } + + size_t + AudioNode::SizeOfExcludingThis(MallocSizeOf aMallocSizeOf) const + { +@@ -399,19 +394,16 @@ AudioNode::DestroyMediaStream() + mStream = nullptr; + + nsCOMPtr obs = services::GetObserverService(); + if (obs) { + nsAutoString id; + id.AppendPrintf("%u", mId); + obs->NotifyObservers(nullptr, "webaudio-node-demise", id.get()); + } +-#ifdef DEBUG +- mDemiseNotified = true; +-#endif + } + } + + void + AudioNode::RemoveOutputParam(AudioParam* aParam) + { + mOutputParams.RemoveElement(aParam); + } +diff --git a/dom/media/webaudio/AudioNode.h b/dom/media/webaudio/AudioNode.h +--- a/dom/media/webaudio/AudioNode.h ++++ b/dom/media/webaudio/AudioNode.h +@@ -239,19 +239,14 @@ private: + nsTArray > mOutputParams; + uint32_t mChannelCount; + ChannelCountMode mChannelCountMode; + ChannelInterpretation mChannelInterpretation; + const uint32_t mId; + // Whether the node just passes through its input. This is a devtools API that + // only works for some node types. + bool mPassThrough; +-#ifdef DEBUG +- // In debug builds, check to make sure that the node demise notification has +- // been properly sent before the node is destroyed. +- bool mDemiseNotified; +-#endif + }; + + } + } + + #endif +diff --git a/dom/media/webaudio/MediaElementAudioSourceNode.cpp b/dom/media/webaudio/MediaElementAudioSourceNode.cpp +--- a/dom/media/webaudio/MediaElementAudioSourceNode.cpp ++++ b/dom/media/webaudio/MediaElementAudioSourceNode.cpp +@@ -5,22 +5,36 @@ + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + + #include "MediaElementAudioSourceNode.h" + #include "mozilla/dom/MediaElementAudioSourceNodeBinding.h" + + namespace mozilla { + namespace dom { + +-MediaElementAudioSourceNode::MediaElementAudioSourceNode(AudioContext* aContext, +- DOMMediaStream* aStream) +- : MediaStreamAudioSourceNode(aContext, aStream) ++MediaElementAudioSourceNode::MediaElementAudioSourceNode(AudioContext* aContext) ++ : MediaStreamAudioSourceNode(aContext) + { + } + ++/* static */ already_AddRefed ++MediaElementAudioSourceNode::Create(AudioContext* aContext, ++ DOMMediaStream* aStream, ErrorResult& aRv) ++{ ++ nsRefPtr node = ++ new MediaElementAudioSourceNode(aContext); ++ ++ node->Init(aStream, aRv); ++ if (aRv.Failed()) { ++ return nullptr; ++ } ++ ++ return node.forget(); ++} ++ + JSObject* + MediaElementAudioSourceNode::WrapObject(JSContext* aCx) + { + return MediaElementAudioSourceNodeBinding::Wrap(aCx, this); + } + + } + } +diff --git a/dom/media/webaudio/MediaElementAudioSourceNode.h b/dom/media/webaudio/MediaElementAudioSourceNode.h +--- a/dom/media/webaudio/MediaElementAudioSourceNode.h ++++ b/dom/media/webaudio/MediaElementAudioSourceNode.h +@@ -10,28 +10,30 @@ + #include "MediaStreamAudioSourceNode.h" + + namespace mozilla { + namespace dom { + + class MediaElementAudioSourceNode : public MediaStreamAudioSourceNode + { + public: +- MediaElementAudioSourceNode(AudioContext* aContext, +- DOMMediaStream* aStream); ++ static already_AddRefed ++ Create(AudioContext* aContext, DOMMediaStream* aStream, ErrorResult& aRv); + + virtual JSObject* WrapObject(JSContext* aCx) override; + + virtual const char* NodeType() const override + { + return "MediaElementAudioSourceNode"; + } + + virtual size_t SizeOfIncludingThis(MallocSizeOf aMallocSizeOf) const override + { + return aMallocSizeOf(this) + SizeOfExcludingThis(aMallocSizeOf); + } ++private: ++ explicit MediaElementAudioSourceNode(AudioContext* aContext); + }; + + } + } + + #endif +diff --git a/dom/media/webaudio/MediaStreamAudioSourceNode.cpp b/dom/media/webaudio/MediaStreamAudioSourceNode.cpp +--- a/dom/media/webaudio/MediaStreamAudioSourceNode.cpp ++++ b/dom/media/webaudio/MediaStreamAudioSourceNode.cpp +@@ -25,26 +25,45 @@ NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_ + NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END + + NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION_INHERITED(MediaStreamAudioSourceNode) + NS_INTERFACE_MAP_END_INHERITING(AudioNode) + + NS_IMPL_ADDREF_INHERITED(MediaStreamAudioSourceNode, AudioNode) + NS_IMPL_RELEASE_INHERITED(MediaStreamAudioSourceNode, AudioNode) + +-MediaStreamAudioSourceNode::MediaStreamAudioSourceNode(AudioContext* aContext, +- DOMMediaStream* aMediaStream) ++MediaStreamAudioSourceNode::MediaStreamAudioSourceNode(AudioContext* aContext) + : AudioNode(aContext, + 2, + ChannelCountMode::Max, +- ChannelInterpretation::Speakers), +- mInputStream(aMediaStream) ++ ChannelInterpretation::Speakers) + { ++} ++ ++/* static */ already_AddRefed ++MediaStreamAudioSourceNode::Create(AudioContext* aContext, ++ DOMMediaStream* aStream, ErrorResult& aRv) ++{ ++ nsRefPtr node = ++ new MediaStreamAudioSourceNode(aContext); ++ ++ node->Init(aStream, aRv); ++ if (aRv.Failed()) { ++ return nullptr; ++ } ++ ++ return node.forget(); ++} ++ ++void ++MediaStreamAudioSourceNode::Init(DOMMediaStream* aMediaStream, ErrorResult& aRv) ++{ ++ mInputStream = aMediaStream; + AudioNodeEngine* engine = new MediaStreamAudioSourceNodeEngine(this); +- mStream = aContext->Graph()->CreateAudioNodeExternalInputStream(engine); ++ mStream = Context()->Graph()->CreateAudioNodeExternalInputStream(engine); + ProcessedMediaStream* outputStream = static_cast(mStream.get()); + mInputPort = outputStream->AllocateInputPort(aMediaStream->GetStream(), + MediaInputPort::FLAG_BLOCK_INPUT); + mInputStream->AddConsumerToKeepAlive(static_cast(this)); + + PrincipalChanged(mInputStream); // trigger enabling/disabling of the connector + mInputStream->AddPrincipalChangeObserver(this); + } +diff --git a/dom/media/webaudio/MediaStreamAudioSourceNode.h b/dom/media/webaudio/MediaStreamAudioSourceNode.h +--- a/dom/media/webaudio/MediaStreamAudioSourceNode.h ++++ b/dom/media/webaudio/MediaStreamAudioSourceNode.h +@@ -38,17 +38,18 @@ public: + private: + bool mEnabled; + }; + + class MediaStreamAudioSourceNode : public AudioNode, + public DOMMediaStream::PrincipalChangeObserver + { + public: +- MediaStreamAudioSourceNode(AudioContext* aContext, DOMMediaStream* aMediaStream); ++ static already_AddRefed ++ Create(AudioContext* aContext, DOMMediaStream* aStream, ErrorResult& aRv); + + NS_DECL_ISUPPORTS_INHERITED + NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(MediaStreamAudioSourceNode, AudioNode) + + virtual JSObject* WrapObject(JSContext* aCx) override; + + virtual void DestroyMediaStream() override; + +@@ -60,16 +61,18 @@ public: + } + + virtual size_t SizeOfExcludingThis(MallocSizeOf aMallocSizeOf) const override; + virtual size_t SizeOfIncludingThis(MallocSizeOf aMallocSizeOf) const override; + + virtual void PrincipalChanged(DOMMediaStream* aMediaStream) override; + + protected: ++ explicit MediaStreamAudioSourceNode(AudioContext* aContext); ++ void Init(DOMMediaStream* aMediaStream, ErrorResult& aRv); + virtual ~MediaStreamAudioSourceNode(); + + private: + nsRefPtr mInputPort; + nsRefPtr mInputStream; + }; + + } + diff --git a/gnu/packages/patches/icecat-CVE-2016-1930-pt04.patch b/gnu/packages/patches/icecat-CVE-2016-1930-pt04.patch new file mode 100644 index 0000000000..b212a70d4a --- /dev/null +++ b/gnu/packages/patches/icecat-CVE-2016-1930-pt04.patch @@ -0,0 +1,47 @@ +Copied from: https://hg.mozilla.org/releases/mozilla-esr38/rev/6d43ff33bd55 +Security advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2016-01/ +Mozilla Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1223670 + +# HG changeset patch +# User Karl Tomlinson +# Date 1451362442 -46800 +# Node ID 6d43ff33bd552b8f7a34e4105cf5bcc0a8c8ea8c +# Parent f746c38d160ea29088c15cacae44f3662befaec5 +bug 1223670 throw not supported when creating a node from a stream with different channel r=baku a=abillings + +diff --git a/dom/media/webaudio/MediaStreamAudioSourceNode.cpp b/dom/media/webaudio/MediaStreamAudioSourceNode.cpp +--- a/dom/media/webaudio/MediaStreamAudioSourceNode.cpp ++++ b/dom/media/webaudio/MediaStreamAudioSourceNode.cpp +@@ -51,21 +51,29 @@ MediaStreamAudioSourceNode::Create(Audio + } + + return node.forget(); + } + + void + MediaStreamAudioSourceNode::Init(DOMMediaStream* aMediaStream, ErrorResult& aRv) + { ++ MOZ_ASSERT(aMediaStream); ++ MediaStream* inputStream = aMediaStream->GetStream(); ++ MediaStreamGraph* graph = Context()->Graph(); ++ if (NS_WARN_IF(graph != inputStream->Graph())) { ++ aRv.Throw(NS_ERROR_DOM_NOT_SUPPORTED_ERR); ++ return; ++ } ++ + mInputStream = aMediaStream; + AudioNodeEngine* engine = new MediaStreamAudioSourceNodeEngine(this); +- mStream = Context()->Graph()->CreateAudioNodeExternalInputStream(engine); ++ mStream = graph->CreateAudioNodeExternalInputStream(engine); + ProcessedMediaStream* outputStream = static_cast(mStream.get()); +- mInputPort = outputStream->AllocateInputPort(aMediaStream->GetStream(), ++ mInputPort = outputStream->AllocateInputPort(inputStream, + MediaInputPort::FLAG_BLOCK_INPUT); + mInputStream->AddConsumerToKeepAlive(static_cast(this)); + + PrincipalChanged(mInputStream); // trigger enabling/disabling of the connector + mInputStream->AddPrincipalChangeObserver(this); + } + + MediaStreamAudioSourceNode::~MediaStreamAudioSourceNode() + diff --git a/gnu/packages/patches/icecat-CVE-2016-1930-pt05.patch b/gnu/packages/patches/icecat-CVE-2016-1930-pt05.patch new file mode 100644 index 0000000000..3e62c9c5f1 --- /dev/null +++ b/gnu/packages/patches/icecat-CVE-2016-1930-pt05.patch @@ -0,0 +1,51 @@ +Copied from: https://hg.mozilla.org/releases/mozilla-esr38/rev/4f6e81673f69 +Security advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2016-01/ +Mozilla Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1223670 + +# HG changeset patch +# User Karl Tomlinson +# Date 1449145091 -46800 +# Node ID 4f6e81673f6938719c86516606f2fda493e8c23c +# Parent 6d43ff33bd552b8f7a34e4105cf5bcc0a8c8ea8c +bug 1223670 make SetMozAudioChannelType() private because the type will not change after construction r=baku a=abillings + +diff --git a/dom/media/webaudio/AudioDestinationNode.h b/dom/media/webaudio/AudioDestinationNode.h +--- a/dom/media/webaudio/AudioDestinationNode.h ++++ b/dom/media/webaudio/AudioDestinationNode.h +@@ -57,17 +57,16 @@ public: + void StartRendering(Promise* aPromise); + + void OfflineShutdown(); + + // nsIDOMEventListener - by proxy + NS_IMETHOD HandleEvent(nsIDOMEvent* aEvent) override; + + AudioChannel MozAudioChannelType() const; +- void SetMozAudioChannelType(AudioChannel aValue, ErrorResult& aRv); + + virtual void NotifyMainThreadStateChanged() override; + void FireOfflineCompletionEvent(); + + // An amount that should be added to the MediaStream's current time to + // get the AudioContext.currentTime. + double ExtraCurrentTime(); + +@@ -86,16 +85,17 @@ public: + + void InputMuted(bool aInputMuted); + void ResolvePromise(AudioBuffer* aRenderedBuffer); + + protected: + virtual ~AudioDestinationNode(); + + private: ++ void SetMozAudioChannelType(AudioChannel aValue, ErrorResult& aRv); + bool CheckAudioChannelPermissions(AudioChannel aValue); + + void SetCanPlay(bool aCanPlay); + + void NotifyStableState(); + void ScheduleStableStateNotification(); + + SelfReference mOfflineRenderingRef; + diff --git a/gnu/packages/patches/icecat-CVE-2016-1930-pt06.patch b/gnu/packages/patches/icecat-CVE-2016-1930-pt06.patch new file mode 100644 index 0000000000..ec1f479ee4 --- /dev/null +++ b/gnu/packages/patches/icecat-CVE-2016-1930-pt06.patch @@ -0,0 +1,170 @@ +Copied from: https://hg.mozilla.org/releases/mozilla-esr38/rev/93617c30c0df +Security advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2016-01/ +Mozilla Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1230686 + +# HG changeset patch +# User Lee Salzman +# Date 1451932822 18000 +# Node ID 93617c30c0df35f719dead526b78649d564f5ac3 +# Parent 4f6e81673f6938719c86516606f2fda493e8c23c +Bug 1230686 - use RefPtr& instead of DrawTarget* to track changes in SurfaceFromElement a=ritu + +diff --git a/layout/base/nsLayoutUtils.cpp b/layout/base/nsLayoutUtils.cpp +--- a/layout/base/nsLayoutUtils.cpp ++++ b/layout/base/nsLayoutUtils.cpp +@@ -6494,17 +6494,17 @@ nsLayoutUtils::IsReallyFixedPos(nsIFrame + nsIAtom *parentType = aFrame->GetParent()->GetType(); + return parentType == nsGkAtoms::viewportFrame || + parentType == nsGkAtoms::pageContentFrame; + } + + nsLayoutUtils::SurfaceFromElementResult + nsLayoutUtils::SurfaceFromElement(nsIImageLoadingContent* aElement, + uint32_t aSurfaceFlags, +- DrawTarget* aTarget) ++ RefPtr& aTarget) + { + SurfaceFromElementResult result; + nsresult rv; + + nsCOMPtr imgRequest; + rv = aElement->GetRequest(nsIImageLoadingContent::CURRENT_REQUEST, + getter_AddRefs(imgRequest)); + if (NS_FAILED(rv) || !imgRequest) +@@ -6586,41 +6586,41 @@ nsLayoutUtils::SurfaceFromElement(nsIIma + result.mImageRequest = imgRequest.forget(); + + return result; + } + + nsLayoutUtils::SurfaceFromElementResult + nsLayoutUtils::SurfaceFromElement(HTMLImageElement *aElement, + uint32_t aSurfaceFlags, +- DrawTarget* aTarget) ++ RefPtr& aTarget) + { + return SurfaceFromElement(static_cast(aElement), + aSurfaceFlags, aTarget); + } + + nsLayoutUtils::SurfaceFromElementResult + nsLayoutUtils::SurfaceFromElement(HTMLCanvasElement* aElement, + uint32_t aSurfaceFlags, +- DrawTarget* aTarget) ++ RefPtr& aTarget) + { + SurfaceFromElementResult result; + + bool* isPremultiplied = nullptr; + if (aSurfaceFlags & SFE_PREFER_NO_PREMULTIPLY_ALPHA) { + isPremultiplied = &result.mIsPremultiplied; + } + + gfxIntSize size = aElement->GetSize(); + + result.mSourceSurface = aElement->GetSurfaceSnapshot(isPremultiplied); + if (!result.mSourceSurface) { + // If the element doesn't have a context then we won't get a snapshot. The canvas spec wants us to not error and just + // draw nothing, so return an empty surface. +- DrawTarget *ref = aTarget ? aTarget : gfxPlatform::GetPlatform()->ScreenReferenceDrawTarget(); ++ DrawTarget *ref = aTarget ? aTarget.get() : gfxPlatform::GetPlatform()->ScreenReferenceDrawTarget(); + RefPtr dt = ref->CreateSimilarDrawTarget(IntSize(size.width, size.height), + SurfaceFormat::B8G8R8A8); + if (dt) { + result.mSourceSurface = dt->Snapshot(); + } + } else if (aTarget) { + RefPtr opt = aTarget->OptimizeSourceSurface(result.mSourceSurface); + if (opt) { +@@ -6637,17 +6637,17 @@ nsLayoutUtils::SurfaceFromElement(HTMLCa + result.mIsWriteOnly = aElement->IsWriteOnly(); + + return result; + } + + nsLayoutUtils::SurfaceFromElementResult + nsLayoutUtils::SurfaceFromElement(HTMLVideoElement* aElement, + uint32_t aSurfaceFlags, +- DrawTarget* aTarget) ++ RefPtr& aTarget) + { + SurfaceFromElementResult result; + + NS_WARN_IF_FALSE((aSurfaceFlags & SFE_PREFER_NO_PREMULTIPLY_ALPHA) == 0, "We can't support non-premultiplied alpha for video!"); + + #ifdef MOZ_EME + if (aElement->ContainsRestrictedContent()) { + return result; +@@ -6689,17 +6689,17 @@ nsLayoutUtils::SurfaceFromElement(HTMLVi + result.mIsWriteOnly = false; + + return result; + } + + nsLayoutUtils::SurfaceFromElementResult + nsLayoutUtils::SurfaceFromElement(dom::Element* aElement, + uint32_t aSurfaceFlags, +- DrawTarget* aTarget) ++ RefPtr& aTarget) + { + // If it's a , we may be able to just grab its internal surface + if (HTMLCanvasElement* canvas = + HTMLCanvasElement::FromContentOrNull(aElement)) { + return SurfaceFromElement(canvas, aSurfaceFlags, aTarget); + } + + // Maybe it's