August 2016 - openSUSE Commits - openSUSE Mailing Lists

commit patchinfo.5539 for openSUSE:13.2:Update
by root＠hilbert.suse.de 31 Aug '16

31 Aug '16

Hello community, here is the log from the commit of package patchinfo.5539 for openSUSE:13.2:Update checked in at 2016-08-31 17:48:57 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:13.2:Update/patchinfo.5539 (Old) and /work/SRC/openSUSE:13.2:Update/.patchinfo.5539.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "patchinfo.5539" Changes: -------- New Changes file: NO CHANGES FILE!!! New: ---- _patchinfo ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ _patchinfo ++++++ <patchinfo incident="5539"> <issue id="994157" tracker="bnc">VUL-0: CVE-2016-6313: libgcrypt,gpg: RNG prediction vulnerability</issue> <issue id="2016-6313" tracker="cve" /> <category>security</category> <rating>moderate</rating> <packager>pjanouch</packager> <description> This update for libgcrypt fixes the following issues: - RNG prediction vulnerability (boo#994157, CVE-2016-6313) </description> <summary>Security update for libgcrypt</summary> </patchinfo>

1 0

commit libgcrypt for openSUSE:13.2:Update
by root＠hilbert.suse.de 31 Aug '16

31 Aug '16

Hello community, here is the log from the commit of package libgcrypt for openSUSE:13.2:Update checked in at 2016-08-31 17:48:56 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:13.2:Update/libgcrypt (Old) and /work/SRC/openSUSE:13.2:Update/.libgcrypt.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "libgcrypt" Changes: -------- New Changes file: NO CHANGES FILE!!! ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ _link ++++++ --- /var/tmp/diff_new_pack.brS51q/_old 2016-08-31 17:48:57.000000000 +0200 +++ /var/tmp/diff_new_pack.brS51q/_new 2016-08-31 17:48:57.000000000 +0200 @@ -1 +1 @@ -<link package='libgcrypt.5091' cicount='copy' /> +<link package='libgcrypt.5539' cicount='copy' />

1 0

commit patchinfo.5538 for openSUSE:13.2:Update
by root＠hilbert.suse.de 31 Aug '16

31 Aug '16

Hello community, here is the log from the commit of package patchinfo.5538 for openSUSE:13.2:Update checked in at 2016-08-31 16:17:47 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:13.2:Update/patchinfo.5538 (Old) and /work/SRC/openSUSE:13.2:Update/.patchinfo.5538.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "patchinfo.5538" Changes: -------- New Changes file: NO CHANGES FILE!!! New: ---- _patchinfo ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ _patchinfo ++++++ <patchinfo incident="5538"> <issue id="995034" tracker="bnc">VUL-0: CVE-2016-6905: gd: Out-of-bounds read in function read_image_tga in gd_tga.c</issue> <issue id="2016-6905" tracker="cve" /> <category>security</category> <rating>moderate</rating> <packager>pgajdos</packager> <description> This update for gd fixes the following issues: - Out-of-bounds read in function read_image_tga in gd_tga.c (CVE-2016-6905, boo#995034) </description> <summary>Security update for gd</summary> </patchinfo>

1 0

commit gd for openSUSE:13.2:Update
by root＠hilbert.suse.de 31 Aug '16

31 Aug '16

Hello community, here is the log from the commit of package gd for openSUSE:13.2:Update checked in at 2016-08-31 16:17:42 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:13.2:Update/gd (Old) and /work/SRC/openSUSE:13.2:Update/.gd.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "gd" Changes: -------- New Changes file: NO CHANGES FILE!!! ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ _link ++++++ --- /var/tmp/diff_new_pack.XPjPSx/_old 2016-08-31 16:17:45.000000000 +0200 +++ /var/tmp/diff_new_pack.XPjPSx/_new 2016-08-31 16:17:45.000000000 +0200 @@ -1 +1 @@ -<link package='gd.5490' cicount='copy' /> +<link package='gd.5538' cicount='copy' />

1 0

commit gd.5538 for openSUSE:13.2:Update
by root＠hilbert.suse.de 31 Aug '16

31 Aug '16

Hello community, here is the log from the commit of package gd.5538 for openSUSE:13.2:Update checked in at 2016-08-31 16:17:34 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:13.2:Update/gd.5538 (Old) and /work/SRC/openSUSE:13.2:Update/.gd.5538.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "gd.5538" Changes: -------- New Changes file: --- /dev/null 2016-07-07 10:01:34.856033756 +0200 +++ /work/SRC/openSUSE:13.2:Update/.gd.5538.new/gd.changes 2016-08-31 16:17:35.000000000 +0200 @@ -0,0 +1,435 @@ +------------------------------------------------------------------- +Tue Aug 23 12:58:16 UTC 2016 - pgajdos(a)suse.com + +- security update: + * CVE-2016-6905 [bsc#995034] + + gd-CVE-2016-6905.patch + +------------------------------------------------------------------- +Mon Aug 8 10:47:51 UTC 2016 - pgajdos(a)suse.com + +- security update: + * CVE-2016-6214 [bsc#991436] + + gd-CVE-2016-6214.patch + * CVE-2016-6132 [bsc#987577] + + gd-CVE-2016-6132.patch + * CVE-2016-6128 [bsc#991710] + + gd-CVE-2016-6128.patch + * CVE-2016-6207 [bsc#991622] + + gd-CVE-2016-6207.patch + * CVE-2016-6161 [bsc#988032] + + gd-CVE-2016-6161.patch + +------------------------------------------------------------------- +Mon May 30 13:20:20 UTC 2016 - pgajdos(a)suse.com + +- security update: + * CVE-2016-5116 [bsc#982176] + + gd-CVE-2016-5116.patch + +------------------------------------------------------------------- +Tue Mar 24 14:04:11 UTC 2015 - pgajdos(a)suse.com + +- fixed CVE-2014-9709 [bnc#923945] + + gd-CVE-2014-9709.patch + +------------------------------------------------------------------- +Tue Aug 26 05:58:53 UTC 2014 - jengelh(a)inai.de + +- Resolve build failure with automake-1.14 + +------------------------------------------------------------------- +Fri Jun 27 12:05:59 UTC 2014 - meissner(a)suse.com + +- split out libgd3, so libgd2 could be installed in parallel. + +------------------------------------------------------------------- +Thu Apr 17 17:51:34 UTC 2014 - tchvatal(a)suse.com + +- Add tiff and vpx to the devel deps as it is in .pc file. + +------------------------------------------------------------------- +Thu Apr 10 07:08:18 UTC 2014 - pgajdos(a)suse.com + +- build against libtiff and libvpx + +------------------------------------------------------------------- +Fri Apr 4 12:21:22 UTC 2014 - pgajdos(a)suse.com + +- fixed NULL ptr deref in GD XPM decoder [bnc#868624] + * CVE-2014-2497.patch + +------------------------------------------------------------------- +Fri Dec 27 07:42:11 UTC 2013 - tchvatal(a)suse.com + +- Cleanup here&there to parallelize everything +- Remove bogus cmake dependency + +------------------------------------------------------------------- +Tue Dec 17 14:30:38 UTC 2013 - pgajdos(a)suse.com + +- updated to 2.1.0 +- removed warn.patch (not needed) +- removed ppc64.patch (upstreamed) +- removed gd-png_check_sig.patch (upstreamed) + +------------------------------------------------------------------- +Sun Feb 3 14:57:17 UTC 2013 - crrodriguez(a)opensuse.org + +- gd-autoconf.patch fix up compile file so gd can handle + large files on 32 bit + +------------------------------------------------------------------- +Sun Feb 5 16:31:39 UTC 2012 - jengelh(a)medozas.de + +- Remove redundant tags/sections +- Parallel build with %_smp_mflags +- Remove pointless INSTALL file from rpm package + (it's just the default autotools INSTALL blurb) + +------------------------------------------------------------------- +Wed Oct 5 12:05:47 UTC 2011 - uli(a)suse.com + +- cross-build fix: use libpng from sysroot + +------------------------------------------------------------------- +Sat Oct 1 05:39:10 UTC 2011 - coolo(a)suse.com + +- add libtool as buildrequire to make the spec file more reliable + +------------------------------------------------------------------- +Tue Jun 14 15:00:32 UTC 2011 - aj(a)suse.de + +- Devel package needs zlib-devel and libpng-devel. + +------------------------------------------------------------------- +Tue Apr 6 18:27:56 CEST 2010 - ro(a)suse.de + +- add baselibs.conf (for libpghoto2) + +------------------------------------------------------------------- +Sun Apr 4 18:39:19 CEST 2010 - ro(a)suse.de + +- replace png_check_sig by negated png_sig_cmp for libpng14 + +------------------------------------------------------------------- +Wed Nov 12 16:18:34 CET 2008 - crrodriguez(a)suse.de + +- QA Results: Regression on PPC64 only, detected by PHP test suite, + the system libgd part, fix by IBM + +------------------------------------------------------------------- +Mon Mar 10 01:43:39 CET 2008 - crrodriguez(a)suse.de + +- fix rpm version number, otherwise it wont upgrade later. + +------------------------------------------------------------------- +Fri Jan 18 15:51:13 CET 2008 - anosek(a)suse.cz + +- updated to version 2.0.36RC1 + * Fixed gdImageCopy with true color image, the transparent color was ignored + * Fixed support of PNG grayscale image with alpha channel + * Added Netware builds script + * ease the creation of regexp to match symbols/functions in the sources + * _gdCreateFromFile() can crash if gdImageCreate fails + * gdImageCreateFrom*Ptr() can crash if gdNewDynamicCtxEx() fails + * gdImageRectangle draws 1x1 rectangles as 1x3 rectangles + * Possible integer overflow in gdImageFill() + * Optimization for single pixel line not in correct order + * gdImageColorDeallocate can write outside buffer + * gdImageColorTransparent can write outside buffer + * gdImageWBMPCtx can crash when createwbmp fails + * Fixed decoding of the html entity &thetasym; + * Fixed configure script ignoring --with-png=DIR option +- dropped obsoleted security.patch + +------------------------------------------------------------------- +Thu Dec 20 04:22:14 CET 2007 - crrodriguez(a)suse.de + +- remove static libraries and "la" files +- devel package dependency cleanup + +------------------------------------------------------------------- +Mon Jul 9 09:09:51 CEST 2007 - anosek(a)suse.cz + +- updated to version 2.0.35 + * Fix valgrind error in gdImageFillTiled (Nuno Lopes) + * Add missing custom cmake macros (required for the tests suite) + * Avoid signature buffer copy in gd_gif_c (Nuno Lopes) + * Race condition in gdImageStringFTEx (Antony Dogval, Pierre + Scott MacVicar) + * Reading GIF images is not thread safe (static usage in private + functions) (Roman Nemecek, Nuno Lopes, Pierre) + * GIF Local palette is read twice + * GIF, Use local frame dimension when possible instead of the + logical screen size (Pierre) + * GIF, do not try to use the global colmap if it does not exist + (Nuno Lopes, Pierre) + * gdImageAALine draws axis lines with two pixels width (Pierre) + * gdImageArc CPU usage with large angles (Pierre) + * gdImageFilledRectangle regression fixed when used with reversed + edges (Pierre) + * Possible infinite loop in libgd/gd_png.c, flaw found by Xavier + Roche (Pierre) + * Fixed segfault when an invalid color index is present in a GIF + image data, reported by Elliot <wccode at gmail dot com> (Pierre) + * Possible integer overflow in gdImageCreateTrueColor (Pierre) + gdImageCreateXbm can crash if gdImageCreate fails (Pierre) +- dropped obsolete patches (png-loop-CVE-2007-2756.patch) + +------------------------------------------------------------------- +Tue May 29 17:16:32 CEST 2007 - nadvornik(a)suse.cz + +- fixed infinite loop on truncated png images + CVE-2007-2756 [#276525] + +------------------------------------------------------------------- +Thu May 3 17:54:51 CEST 2007 - prusnak(a)suse.cz + +- changed expat to libexpat-devel in Requires of devel subpackage + +------------------------------------------------------------------- +Tue Feb 20 11:47:45 CET 2007 - nadvornik(a)suse.cz + +- updated to 2.0.34: + * security fixes merged upstream + * various other bugfixes + ++++ 238 more lines (skipped) ++++ between /dev/null ++++ and /work/SRC/openSUSE:13.2:Update/.gd.5538.new/gd.changes New: ---- baselibs.conf gd-2.1.0-CVE-2014-2497.patch gd-CVE-2014-9709.patch gd-CVE-2016-5116.patch gd-CVE-2016-6128.patch gd-CVE-2016-6132.patch gd-CVE-2016-6161.patch gd-CVE-2016-6207.patch gd-CVE-2016-6214.patch gd-CVE-2016-6905.patch gd-aliasing.patch gd-autoconf.patch gd-config.patch gd-fontpath.patch gd-format.patch gd.changes gd.spec libgd-2.1.0.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ gd.spec ++++++ # # spec file for package gd # # Copyright (c) 2016 SUSE LINUX GmbH, Nuernberg, Germany. # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed # upon. The license for this file, and modifications and additions to the # file, is the same license as for the pristine package itself (unless the # license for the pristine package is not an Open Source License, in which # case the license is the MIT License). An "Open Source License" is a # license that conforms to the Open Source Definition (Version 1.9) # published by the Open Source Initiative. # Please submit bugfixes or comments via http://bugs.opensuse.org/ # %define prjname libgd %define lname libgd3 Name: gd Version: 2.1.0 Release: 0 Summary: A Drawing Library for Programs That Use PNG and JPEG Output License: MIT Group: System/Libraries Url: http://libgd.bitbucket.org/ Source: https://bitbucket.org/libgd/gd-libgd/downloads/libgd-%{version}.tar.xz Source1: baselibs.conf # to be upstreamed, gdlib-config --libs to return the same as pkg-config --libs gdlib Patch0: gd-config.patch # might be upstreamed, but could be suse specific also (/usr/share/fonts/Type1 font dir) Patch1: gd-fontpath.patch # could be upstreamed, but not in this form (need ac check for attribute format printf, etc.) Patch2: gd-format.patch # could be upstreamed Patch3: gd-aliasing.patch # could be upstreamed? Patch4: gd-autoconf.patch Patch5: gd-2.1.0-CVE-2014-2497.patch Patch6: gd-CVE-2014-9709.patch Patch7: gd-CVE-2016-5116.patch Patch8: gd-CVE-2016-6214.patch Patch9: gd-CVE-2016-6905.patch Patch10: gd-CVE-2016-6128.patch Patch11: gd-CVE-2016-6207.patch Patch12: gd-CVE-2016-6161.patch Patch13: gd-CVE-2016-6132.patch BuildRequires: fontconfig-devel BuildRequires: freetype2-devel BuildRequires: libjpeg-devel BuildRequires: libpng-devel BuildRequires: libtiff-devel BuildRequires: libtool BuildRequires: libvpx-devel BuildRequires: pkg-config BuildRequires: xorg-x11-libX11-devel BuildRequires: xorg-x11-libXau-devel BuildRequires: xorg-x11-libXdmcp-devel BuildRequires: xorg-x11-libXpm-devel Provides: gdlib = %{version} Obsoletes: gdlib < %{version} BuildRoot: %{_tmppath}/%{name}-%{version}-build %description Gd allows your code to quickly draw images complete with lines, arcs, text, and multiple colors. It supports cut and paste from other images and flood fills. It outputs PNG, JPEG, and WBMP (for wireless devices) and is supported by PHP. %package -n %lname Summary: A Drawing Library for Programs That Use PNG and JPEG Output Group: System/Libraries %description -n %lname Gd allows your code to quickly draw images complete with lines, arcs, text, and multiple colors. It supports cut and paste from other images and flood fills. It outputs PNG, JPEG, and WBMP (for wireless devices) and is supported by PHP. %package devel Summary: Drawing Library for Programs with PNG and JPEG Output Group: Development/Libraries/C and C++ Requires: %lname = %{version} Requires: glibc-devel Requires: libpng-devel Requires: libtiff-devel Requires: libvpx-devel Requires: zlib-devel %description devel gd allows code to quickly draw images complete with lines, arcs, text, multiple colors, cut and paste from other images, and flood fills. gd writes out the result as a PNG or JPEG file. This is particularly useful in World Wide Web applications, where PNG and JPEG are two of the formats accepted for inline images by most browsers. %prep %setup -q -n %{prjname}-%{version} %patch0 %patch1 %patch2 %patch3 %patch4 -p1 %patch5 %patch6 %patch7 -p1 %patch8 -p1 %patch9 -p1 %patch10 -p1 %patch11 -p1 %patch12 -p1 %patch13 -p1 %build autoreconf -fiv # without-x -- useless switch which just mangles cflags %configure \ --without-x \ --with-fontconfig \ --with-freetype \ --with-jpeg \ --with-png \ --with-xpm \ --disable-static \ --with-pic make %{?_smp_mflags} %check make check %{?_smp_mflags} %install make DESTDIR=%{buildroot} install %{?_smp_mflags} find %{buildroot} -type f -name "*.la" -delete -print %post -n %lname -p /sbin/ldconfig %postun -n %lname -p /sbin/ldconfig %files %defattr(-,root,root) %doc COPYING NEWS examples %{_bindir}/annotate %{_bindir}/bdftogd %{_bindir}/gd2copypal %{_bindir}/gd2togif %{_bindir}/gd2topng %{_bindir}/gdcmpgif %{_bindir}/gdparttopng %{_bindir}/gdtopng %{_bindir}/giftogd2 %{_bindir}/pngtogd %{_bindir}/pngtogd2 %{_bindir}/webpng %files -n %lname %defattr(-,root,root) %doc COPYING %{_libdir}/*.so.* %files devel %defattr(-,root,root) %doc COPYING %{_bindir}/gdlib-config %{_includedir}/* %{_libdir}/*.so %{_libdir}/pkgconfig/gdlib.pc %changelog ++++++ baselibs.conf ++++++ libgd3 ++++++ gd-2.1.0-CVE-2014-2497.patch ++++++ Description: Patch to fix PHP bug 66901. Author: Andres Mejia <mejiaa(a)amazon.com> Forwarded: no Index: src/gdxpm.c =================================================================== --- src/gdxpm.c.orig 2014-04-04 12:56:02.570160501 +0200 +++ src/gdxpm.c 2014-04-04 13:01:24.031976322 +0200 @@ -62,6 +62,14 @@ for(i = 0; i < number; i++) { char *c_color = image.colorTable[i].c_color; + if (!image.colorTable[i].c_color) + { + /* unsupported color key or color key not defined */ + gdImageDestroy(im); + gdFree(colors); + im = 0; + goto done; + } if(strcmp(c_color, "None") == 0) { colors[i] = gdImageGetTransparent(im); if(colors[i] == -1) colors[i] = gdImageColorAllocate(im, 0, 0, 0); ++++++ gd-CVE-2014-9709.patch ++++++ >From 47eb44b2e90ca88a08dca9f9a1aa9041e9587f43 Mon Sep 17 00:00:00 2001 From: Remi Collet <fedora(a)famillecollet.com> Date: Sat, 13 Dec 2014 08:48:18 +0100 Subject: [PATCH] Fix possible buffer read overflow detected by -fsanitize=address, thanks to Jan Bee --- src/gd_gif_in.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) Index: src/gd_gif_in.c =================================================================== --- src/gd_gif_in.c.orig 2013-06-25 11:58:23.000000000 +0200 +++ src/gd_gif_in.c 2015-03-24 15:02:44.776580918 +0100 @@ -75,8 +75,10 @@ #define STACK_SIZE ((1<<(MAX_LWZ_BITS))*2) +#define CSD_BUF_SIZE 280 + typedef struct { - unsigned char buf[280]; + unsigned char buf[CSD_BUF_SIZE]; int curbit; int lastbit; int done; @@ -408,9 +410,13 @@ scd->lastbit = (2 + count) * 8; } - ret = 0; - for (i = scd->curbit, j = 0; j < code_size; ++i, ++j) { - ret |= ((scd->buf[i / 8] & (1 << (i % 8))) != 0) << j; + if ((scd->curbit + code_size - 1) >= (CSD_BUF_SIZE * 8)) { + ret = -1; + } else { + ret = 0; + for (i = scd->curbit, j = 0; j < code_size; ++i, ++j) { + ret |= ((scd->buf[i / 8] & (1 << (i % 8))) != 0) << j; + } } scd->curbit += code_size; ++++++ gd-CVE-2016-5116.patch ++++++ >From 4dc1a2d7931017d3625f2d7cff70a17ce58b53b4 Mon Sep 17 00:00:00 2001 From: Mike Frysinger <vapier(a)gentoo.org> Date: Sat, 14 May 2016 01:38:18 -0400 Subject: [PATCH] xbm: avoid stack overflow (read) with large names #211 We use the name passed in to printf into a local stack buffer which is limited to 4000 bytes. So given a large enough value, lots of stack data is leaked. Rewrite the code to do simple memory copies with most of the strings to avoid that issue, and only use stack buffer for small numbers of constant size. This closes #211. --- src/gd_xbm.c | 34 +++++++++++++++++++++++++++------- 1 file changed, 27 insertions(+), 7 deletions(-) diff --git a/src/gd_xbm.c b/src/gd_xbm.c index 74d839b..d28fdfc 100644 --- a/src/gd_xbm.c +++ b/src/gd_xbm.c @@ -180,7 +180,7 @@ BGD_DECLARE(gdImagePtr) gdImageCreateFromXbm(FILE * fd) /* {{{ gdCtxPrintf */ static void gdCtxPrintf(gdIOCtx * out, const char *format, ...) { - char buf[4096]; + char buf[1024]; int len; va_list args; @@ -191,6 +191,9 @@ static void gdCtxPrintf(gdIOCtx * out, const char *format, ...) } /* }}} */ +/* The compiler will optimize strlen(constant) to a constant number. */ +#define gdCtxPuts(out, s) out->putBuf(out, s, strlen(s)) + /* {{{ gdImageXbmCtx */ BGD_DECLARE(void) gdImageXbmCtx(gdImagePtr image, char* file_name, int fg, gdIOCtx * out) { @@ -215,9 +218,26 @@ BGD_DECLARE(void) gdImageXbmCtx(gdImagePtr image, char* file_name, int fg, gdIOC } } - gdCtxPrintf(out, "#define %s_width %d\n", name, gdImageSX(image)); - gdCtxPrintf(out, "#define %s_height %d\n", name, gdImageSY(image)); - gdCtxPrintf(out, "static unsigned char %s_bits[] = {\n ", name); + /* Since "name" comes from the user, run it through a direct puts. + * Trying to printf it into a local buffer means we'd need a large + * or dynamic buffer to hold it all. */ + + /* #define <name>_width 1234 */ + gdCtxPuts(out, "#define "); + gdCtxPuts(out, name); + gdCtxPuts(out, "_width "); + gdCtxPrintf(out, "%d\n", gdImageSX(image)); + + /* #define <name>_height 1234 */ + gdCtxPuts(out, "#define "); + gdCtxPuts(out, name); + gdCtxPuts(out, "_height "); + gdCtxPrintf(out, "%d\n", gdImageSY(image)); + + /* static unsigned char <name>_bits[] = {\n */ + gdCtxPuts(out, "static unsigned char "); + gdCtxPuts(out, name); + gdCtxPuts(out, "_bits[] = {\n "); free(name); @@ -234,9 +254,9 @@ BGD_DECLARE(void) gdImageXbmCtx(gdImagePtr image, char* file_name, int fg, gdIOC if ((b == 128) || (x == sx && y == sy)) { b = 1; if (p) { - gdCtxPrintf(out, ", "); + gdCtxPuts(out, ", "); if (!(p%12)) { - gdCtxPrintf(out, "\n "); + gdCtxPuts(out, "\n "); p = 12; } } @@ -248,6 +268,6 @@ BGD_DECLARE(void) gdImageXbmCtx(gdImagePtr image, char* file_name, int fg, gdIOC } } } - gdCtxPrintf(out, "};\n"); + gdCtxPuts(out, "};\n"); } /* }}} */ ++++++ gd-CVE-2016-6128.patch ++++++ --- a/src/gd_crop.c +++ b/src/gd_crop.c @@ -136,6 +136,10 @@ BGD_DECLARE(gdImagePtr) gdImageCropThreshold(gdImagePtr im, const unsigned int c return NULL; } + if (!gdImageTrueColor(im) && color >= gdImageColorsTotal(im)) { + return NULL; + } + /* TODO: Add gdImageGetRowPtr and works with ptr at the row level * for the true color and palette images * new formats will simply work with ptr ++++++ gd-CVE-2016-6132.patch ++++++ >From 921e590565deb033acafcfa9063b4563200b14b5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej(a)sury.org> Date: Tue, 12 Jul 2016 11:24:09 +0200 Subject: [PATCH] Fix #247, A read out-of-bands was found in the parsing of TGA files --- src/gd_tga.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/src/gd_tga.c b/src/gd_tga.c index ef20f86..07f3c86 100644 --- a/src/gd_tga.c +++ b/src/gd_tga.c @@ -237,7 +237,10 @@ int read_image_tga( gdIOCtx *ctx, oTga *tga ) return -1; } - gdGetBuf(conversion_buffer, image_block_size, ctx); + if (gdGetBuf(conversion_buffer, image_block_size, ctx) != image_block_size) { + gdFree(conversion_buffer); + return -1; + } while (buffer_caret < image_block_size) { tga->bitmap[buffer_caret] = (int) conversion_buffer[buffer_caret]; @@ -261,7 +264,11 @@ int read_image_tga( gdIOCtx *ctx, oTga *tga ) return -1; } - gdGetBuf( conversion_buffer, image_block_size, ctx ); + if (gdGetBuf(conversion_buffer, image_block_size, ctx) != image_block_size) { + gdFree(conversion_buffer); + gdFree(decompression_buffer); + return -1; + } buffer_caret = 0; ++++++ gd-CVE-2016-6161.patch ++++++ >From 82b80dcb70a7ca8986125ff412bceddafc896842 Mon Sep 17 00:00:00 2001 From: Mike Frysinger <vapier(a)gentoo.org> Date: Sat, 14 May 2016 02:13:15 -0400 Subject: [PATCH] gif: avoid out-of-bound reads of masks array #209 When given invalid inputs, we might be fed the EOF marker before it is actually the EOF. The gif logic assumes once it sees the EOF marker, there won't be any more data, so it leaves the cur_bits index possibly negative. So when we get more data, we underflow the masks array. Flag it so we don't try to output anything more. The image is invalid, so we shouldn't be truncating any valid inputs. This fixes #209. --- src/gd_gif_out.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/src/gd_gif_out.c b/src/gd_gif_out.c index 51ceb75..3099d49 100644 --- a/src/gd_gif_out.c +++ b/src/gd_gif_out.c @@ -1442,15 +1442,23 @@ static void compress(int init_bits, gdIOCtxPtr outfile, gdImagePtr im, GifCtx *c * code in turn. When the buffer fills up empty it and start over. */ -static unsigned long masks[] = { +static const unsigned long masks[] = { 0x0000, 0x0001, 0x0003, 0x0007, 0x000F, 0x001F, 0x003F, 0x007F, 0x00FF, 0x01FF, 0x03FF, 0x07FF, 0x0FFF, 0x1FFF, 0x3FFF, 0x7FFF, 0xFFFF }; +/* Arbitrary value to mark output is done. When we see EOFCode, then we don't + * expect to see any more data. If we do (e.g. corrupt image inputs), cur_bits + * might be negative, so flag it to return early. + */ +#define CUR_BITS_FINISHED -1000 + static void output(code_int code, GifCtx *ctx) { + if (ctx->cur_bits == CUR_BITS_FINISHED) + return; ctx->cur_accum &= masks[ctx->cur_bits]; if(ctx->cur_bits > 0) { @@ -1492,6 +1500,8 @@ static void output(code_int code, GifCtx *ctx) ctx->cur_accum >>= 8; ctx->cur_bits -= 8; } + /* Flag that it's done to prevent re-entry. */ + ctx->cur_bits = CUR_BITS_FINISHED; flush_char(ctx); } ++++++ gd-CVE-2016-6207.patch ++++++ Index: libgd-2.1.0/src/gd.c =================================================================== --- libgd-2.1.0.orig/src/gd.c 2013-06-25 11:58:23.000000000 +0200 +++ libgd-2.1.0/src/gd.c 2016-08-08 15:04:29.487691217 +0200 @@ -207,7 +207,7 @@ BGD_DECLARE(gdImagePtr) gdImageCreateTru return 0; } - if (overflow2(sizeof(int), sx)) { + if (overflow2(sizeof(int *), sx)) { return NULL; } Index: libgd-2.1.0/src/gd_interpolation.c =================================================================== --- libgd-2.1.0.orig/src/gd_interpolation.c 2013-06-25 11:58:23.000000000 +0200 +++ libgd-2.1.0/src/gd_interpolation.c 2016-08-08 15:05:50.725062244 +0200 @@ -901,6 +901,7 @@ static inline LineContribType * _gdContr { unsigned int u = 0; LineContribType *res; + int overflow_error = 0; res = (LineContribType *) gdMalloc(sizeof(LineContribType)); if (!res) { @@ -908,10 +909,31 @@ static inline LineContribType * _gdContr } res->WindowSize = windows_size; res->LineLength = line_length; + if (overflow2(line_length, sizeof(ContributionType))) { + gdFree(res); + return NULL; + } res->ContribRow = (ContributionType *) gdMalloc(line_length * sizeof(ContributionType)); - + if (res->ContribRow == NULL) { + gdFree(res); + return NULL; + } for (u = 0 ; u < line_length ; u++) { - res->ContribRow[u].Weights = (double *) gdMalloc(windows_size * sizeof(double)); + if (overflow2(windows_size, sizeof(double))) { + overflow_error = 1; + } else { + res->ContribRow[u].Weights = (double *) gdMalloc(windows_size * sizeof(double)); + } + if (overflow_error == 1 || res->ContribRow[u].Weights == NULL) { + unsigned int i; + u--; + for (i=0;i<=u;i++) { + gdFree(res->ContribRow[i].Weights); + } + gdFree(res->ContribRow); + gdFree(res); + return NULL; + } } return res; } @@ -944,7 +966,9 @@ static inline LineContribType *_gdContri windows_size = 2 * (int)ceil(width_d) + 1; res = _gdContributionsAlloc(line_size, windows_size); - + if (res == NULL) { + return NULL; + } for (u = 0; u < line_size; u++) { const double dCenter = (double)u / scale_d; /* get the significant edge points affecting the pixel */ ++++++ gd-CVE-2016-6214.patch ++++++ --- a/src/gd_tga.c +++ b/src/gd_tga.c @@ -99,7 +99,7 @@ BGD_DECLARE(gdImagePtr) gdImageCreateFromTgaCtx(gdIOCtx* ctx) if (tga->bits == TGA_BPP_24) { *tpix = gdTrueColor(tga->bitmap[bitmap_caret + 2], tga->bitmap[bitmap_caret + 1], tga->bitmap[bitmap_caret]); bitmap_caret += 3; - } else if (tga->bits == TGA_BPP_32 || tga->alphabits) { + } else if (tga->bits == TGA_BPP_32 && tga->alphabits) { register int a = tga->bitmap[bitmap_caret + 3]; *tpix = gdTrueColorAlpha(tga->bitmap[bitmap_caret + 2], tga->bitmap[bitmap_caret + 1], tga->bitmap[bitmap_caret], gdAlphaMax - (a >> 1)); @@ -159,16 +159,12 @@ int read_header_tga(gdIOCtx *ctx, oTga *tga) printf("wxh: %i %i\n", tga->width, tga->height); #endif - switch(tga->bits) { - case 8: - case 16: - case 24: - case 32: - break; - default: - gd_error("bps %i not supported", tga->bits); + if (!((tga->bits == TGA_BPP_24 && tga->alphabits == 0) + || (tga->bits == TGA_BPP_32 && tga->alphabits == 8))) + { + gd_error_ex(GD_WARNING, "gd-tga: %u bits per pixel with %u alpha bits not supported\n", + tga->bits, tga->alphabits); return -1; - break; } tga->ident = NULL; ++++++ gd-CVE-2016-6905.patch ++++++ 6aa343e6e195bf65fb47 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej(a)sury.org> Date: Tue, 12 Jul 2016 14:20:16 +0200 Subject: [PATCH] bug #248, fix Out-Of-Bounds Read in read_image_tga --- src/gd_tga.c | 34 ++++++++++++++++++++++++++-------- 1 file changed, 26 insertions(+), 8 deletions(-) Index: libgd-2.1.0/src/gd_tga.c =================================================================== --- libgd-2.1.0.orig/src/gd_tga.c 2016-08-08 13:15:15.053952732 +0200 +++ libgd-2.1.0/src/gd_tga.c 2016-08-08 13:16:53.639592199 +0200 @@ -196,7 +196,6 @@ int read_image_tga( gdIOCtx *ctx, oTga * int buffer_caret = 0; int bitmap_caret = 0; int i = 0; - int j = 0; uint8_t encoded_pixels; if(overflow2(tga->width, tga->height)) { @@ -281,27 +280,36 @@ int read_image_tga( gdIOCtx *ctx, oTga * buffer_caret = 0; while( bitmap_caret < image_block_size ) { - + if ((decompression_buffer[buffer_caret] & TGA_RLE_FLAG) == TGA_RLE_FLAG) { - encoded_pixels = ( ( decompression_buffer[ buffer_caret ] & 127 ) + 1 ); + encoded_pixels = ( ( decompression_buffer[ buffer_caret ] & !TGA_RLE_FLAG ) + 1 ); buffer_caret++; + if ((bitmap_caret + (encoded_pixels * pixel_block_size)) >= image_block_size) { + gdFree( decompression_buffer ); + gdFree( conversion_buffer ); + return -1; + } + for (i = 0; i < encoded_pixels; i++) { - for (j = 0; j < pixel_block_size; j++, bitmap_caret++) { - tga->bitmap[ bitmap_caret ] = decompression_buffer[ buffer_caret + j ]; - } + memcpy(tga->bitmap + bitmap_caret, decompression_buffer + buffer_caret, pixel_block_size); + bitmap_caret += pixel_block_size; } buffer_caret += pixel_block_size; + } else { encoded_pixels = decompression_buffer[ buffer_caret ] + 1; buffer_caret++; - for (i = 0; i < encoded_pixels; i++) { - for( j = 0; j < pixel_block_size; j++, bitmap_caret++ ) { - tga->bitmap[ bitmap_caret ] = decompression_buffer[ buffer_caret + j ]; - } - buffer_caret += pixel_block_size; + if ((bitmap_caret + (encoded_pixels * pixel_block_size)) >= image_block_size) { + gdFree( decompression_buffer ); + gdFree( conversion_buffer ); + return -1; } + + memcpy(tga->bitmap + bitmap_caret, decompression_buffer + buffer_caret, encoded_pixels * pixel_block_size); + bitmap_caret += (encoded_pixels * pixel_block_size); + buffer_caret += (encoded_pixels * pixel_block_size); } } ++++++ gd-aliasing.patch ++++++ Index: src/fontwheeltest.c =================================================================== --- src/fontwheeltest.c.orig 2013-12-18 11:49:47.041577398 +0100 +++ src/fontwheeltest.c 2013-12-18 11:53:52.575496376 +0100 @@ -32,6 +32,8 @@ doerr (err, "------------------------------------------"); for (curang = 0.0; curang < 360.0; curang += angle) { + gdPoint points[4]; + curangrads = DEGTORAD(curang); x0 = x + cos (curangrads) * offset; y0 = y - sin (curangrads) * offset; @@ -47,7 +49,15 @@ if (cp) doerr (err, cp); - gdImagePolygon (im, (gdPointPtr)brect, 4, color); + points[0].x = brect[0]; + points[0].y = brect[1]; + points[1].x = brect[2]; + points[1].y = brect[3]; + points[2].x = brect[4]; + points[2].y = brect[5]; + points[3].x = brect[6]; + points[3].y = brect[7]; + gdImagePolygon (im, points, 4, color); } fclose (err); ++++++ gd-autoconf.patch ++++++ --- configure.ac | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) Index: libgd-2.1.0/configure.ac =================================================================== --- libgd-2.1.0.orig/configure.ac +++ libgd-2.1.0/configure.ac @@ -45,7 +45,7 @@ AC_SUBST(GDLIB_AGE) FEATURES="GD_GIF GD_GIFANIM GD_OPENPOLYGON" AC_SUBST(FEATURES) -AM_INIT_AUTOMAKE([foreign dist-bzip2 dist-xz -Wall -Werror]) +AM_INIT_AUTOMAKE([foreign dist-bzip2 dist-xz -Wall]) AC_CONFIG_HEADERS([src/config.h:src/config.hin]) dnl newer automake wants this, but we still want to work with older @@ -53,6 +53,9 @@ m4_ifndef([AM_PROG_AR],[m4_define([AM_PR AM_PROG_AR AC_PROG_CC_STDC +AC_USE_SYSTEM_EXTENSIONS +AC_SYS_LARGEFILE + AM_PROG_CC_C_O AC_PROG_INSTALL AC_PROG_LIBTOOL ++++++ gd-config.patch ++++++ Index: config/gdlib-config.in =================================================================== --- config/gdlib-config.in.orig 2013-06-25 11:58:23.000000000 +0200 +++ config/gdlib-config.in 2013-12-18 10:00:24.635577307 +0100 @@ -71,7 +71,7 @@ echo @LDFLAGS@ ;; --libs) - echo -lgd @LIBS@ @LIBICONV@ + echo -lgd ;; --cflags|--includes) echo -I@includedir@ ++++++ gd-fontpath.patch ++++++ Index: src/gdft.c =================================================================== --- src/gdft.c.orig 2013-06-25 11:58:23.000000000 +0200 +++ src/gdft.c 2013-12-18 11:44:06.915533057 +0100 @@ -74,7 +74,7 @@ # define DEFAULT_FONTPATH "/usr/share/fonts/truetype:/System/Library/Fonts:/Library/Fonts" # else /* default fontpath for unix systems - whatever happened to standards ! */ -# define DEFAULT_FONTPATH "/usr/X11R6/lib/X11/fonts/TrueType:/usr/X11R6/lib/X11/fonts/truetype:/usr/X11R6/lib/X11/fonts/TTF:/usr/share/fonts/TrueType:/usr/share/fonts/truetype:/usr/openwin/lib/X11/fonts/TrueType:/usr/X11R6/lib/X11/fonts/Type1:/usr/lib/X11/fonts/Type1:/usr/openwin/lib/X11/fonts/Type1" +# define DEFAULT_FONTPATH "/usr/X11R6/lib/X11/fonts/TrueType:/usr/X11R6/lib/X11/fonts/truetype:/usr/X11R6/lib/X11/fonts/TTF:/usr/share/fonts/TrueType:/usr/share/fonts/truetype:/usr/openwin/lib/X11/fonts/TrueType:/usr/X11R6/lib/X11/fonts/Type1:/usr/lib/X11/fonts/Type1:/usr/openwin/lib/X11/fonts/Type1:/usr/share/fonts/Type1" # endif #endif ++++++ gd-format.patch ++++++ Index: src/gd_errors.h =================================================================== --- src/gd_errors.h.orig 2013-06-25 11:58:23.000000000 +0200 +++ src/gd_errors.h 2013-12-18 11:47:26.605907096 +0100 @@ -40,7 +40,7 @@ #define GD_INFO LOG_INFO #define GD_DEBUG LOG_DEBUG -void gd_error(const char *format, ...); -void gd_error_ex(int priority, const char *format, ...); +void gd_error(const char *format, ...) __attribute__((format(printf, 1, 2))); +void gd_error_ex(int priority, const char *format, ...) __attribute__((format(printf, 2, 3))); #endif

1 0

commit perl-Mojolicious-Plugin-CHI for openSUSE:Factory
by root＠hilbert.suse.de 31 Aug '16

31 Aug '16

Hello community, here is the log from the commit of package perl-Mojolicious-Plugin-CHI for openSUSE:Factory checked in at 2016-08-31 14:31:53 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/perl-Mojolicious-Plugin-CHI (Old) and /work/SRC/openSUSE:Factory/.perl-Mojolicious-Plugin-CHI.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "perl-Mojolicious-Plugin-CHI" Changes: -------- --- /work/SRC/openSUSE:Factory/perl-Mojolicious-Plugin-CHI/perl-Mojolicious-Plugin-CHI.changes 2016-04-12 19:33:43.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.perl-Mojolicious-Plugin-CHI.new/perl-Mojolicious-Plugin-CHI.changes 2016-08-31 14:31:55.000000000 +0200 @@ -1,0 +2,9 @@ +Wed Aug 31 05:59:30 UTC 2016 - coolo(a)suse.com + +- updated to 0.14 + see /usr/share/doc/packages/perl-Mojolicious-Plugin-CHI/Changes + + 0.14 2016-08-30 + - Fixed META_MERGE in Makefile. + +------------------------------------------------------------------- Old: ---- Mojolicious-Plugin-CHI-0.13.tar.gz New: ---- Mojolicious-Plugin-CHI-0.14.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ perl-Mojolicious-Plugin-CHI.spec ++++++ --- /var/tmp/diff_new_pack.mHW0RI/_old 2016-08-31 14:31:56.000000000 +0200 +++ /var/tmp/diff_new_pack.mHW0RI/_new 2016-08-31 14:31:56.000000000 +0200 @@ -17,7 +17,7 @@ Name: perl-Mojolicious-Plugin-CHI -Version: 0.13 +Version: 0.14 Release: 0 %define cpan_name Mojolicious-Plugin-CHI Summary: Use CHI Caches in Mojolicious ++++++ Mojolicious-Plugin-CHI-0.13.tar.gz -> Mojolicious-Plugin-CHI-0.14.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/Mojolicious-Plugin-CHI-0.13/Changes new/Mojolicious-Plugin-CHI-0.14/Changes --- old/Mojolicious-Plugin-CHI-0.13/Changes 2016-04-01 11:42:35.000000000 +0200 +++ new/Mojolicious-Plugin-CHI-0.14/Changes 2016-08-30 19:59:20.000000000 +0200 @@ -1,46 +1,49 @@ +0.14 2016-08-30 + - Fixed META_MERGE in Makefile. + 0.13 2016-04-01 - Added dependency of Digest::JHash, - as there seem to be broken builds of CHI out there - (dependencies in CHI are correkt; cpantesters). + as there seem to be broken builds of CHI out there + (dependencies in CHI are correkt; cpantesters). 0.12 2015-11-14 - Removed smartmatch in tests. - - Made dependencies more concrete. + - Made dependencies more concrete. 0.11 2015-01-16 - Improve error handling in commands. 0.10 2015-01-16 - Improve documentation regarding precedence of configuration. - - Improve config check. - - Improve license information in M::P::CHI::chi. - - Update year. + - Improve config check. + - Improve license information in M::P::CHI::chi. + - Update year. 0.09 2014-04-20 - Bugfix test suite. 0.08 2014-04-17 - Logging now defaults to application log. - - Update requirements. - - Added commands. + - Update requirements. + - Added commands. 0.07 2014-04-01 - Update year. - - Documentation tweaks on CHI. - - Fixed License issue (now coherent Artistic License 2.0; max). + - Documentation tweaks on CHI. + - Fixed License issue (now coherent Artistic License 2.0; max). 0.06 2013-03-08 - Update year. - - Update description. - - Documentation tweaks. - - Namespaces parameter now set by default - (the opposite was deprecated in 0.04). - - Improve test suite. - - Warn regarding non-unique cache handles. + - Update description. + - Documentation tweaks. + - Namespaces parameter now set by default + (the opposite was deprecated in 0.04). + - Improve test suite. + - Warn regarding non-unique cache handles. 0.05 2012-12-07 - Fix for never started IOLoops. - - Removed IOLoop dependency (reneeb). + - Removed IOLoop dependency (reneeb). 0.04 2012-11-26 - Introduced 'namespaces' parameter. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/Mojolicious-Plugin-CHI-0.13/META.json new/Mojolicious-Plugin-CHI-0.14/META.json --- old/Mojolicious-Plugin-CHI-0.13/META.json 2016-04-01 12:14:38.000000000 +0200 +++ new/Mojolicious-Plugin-CHI-0.14/META.json 2016-08-30 21:29:18.000000000 +0200 @@ -4,7 +4,7 @@ "Nils Diewald" ], "dynamic_config" : 1, - "generated_by" : "ExtUtils::MakeMaker version 7.04, CPAN::Meta::Converter version 2.150005", + "generated_by" : "ExtUtils::MakeMaker version 7.1001, CPAN::Meta::Converter version 2.150005", "license" : [ "artistic_2" ], @@ -43,17 +43,17 @@ "release_status" : "stable", "resources" : { "bugtracker" : { - "web" : "https://github.com/Akron/XML-Loy/issues" + "web" : "https://github.com/Akron/Mojolicious-Plugin-CHI/issues" }, "license" : [ "http://www.opensource.org/licenses/artistic-license-2.0" ], "repository" : { "type" : "git", - "url" : "https://github.com/Akron/XML-Loy.git", - "web" : "https://github.com/Akron/XML-Loy" + "url" : "https://github.com/Akron/Mojolicious-Plugin-CHI.git", + "web" : "https://github.com/Akron/Mojolicious-Plugin-CHI" } }, - "version" : "0.13", - "x_serialization_backend" : "JSON::PP version 2.27203" + "version" : "0.14", + "x_serialization_backend" : "JSON::PP version 2.27300" } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/Mojolicious-Plugin-CHI-0.13/META.yml new/Mojolicious-Plugin-CHI-0.14/META.yml --- old/Mojolicious-Plugin-CHI-0.13/META.yml 2016-04-01 12:14:38.000000000 +0200 +++ new/Mojolicious-Plugin-CHI-0.14/META.yml 2016-08-30 21:29:17.000000000 +0200 @@ -8,7 +8,7 @@ configure_requires: ExtUtils::MakeMaker: '0' dynamic_config: 1 -generated_by: 'ExtUtils::MakeMaker version 7.04, CPAN::Meta::Converter version 2.150005' +generated_by: 'ExtUtils::MakeMaker version 7.1001, CPAN::Meta::Converter version 2.150005' license: artistic_2 meta-spec: url: http://module-build.sourceforge.net/META-spec-v1.4.html @@ -24,8 +24,8 @@ Mojolicious: '4.77' perl: '5.010001' resources: - bugtracker: https://github.com/Akron/XML-Loy/issues + bugtracker: https://github.com/Akron/Mojolicious-Plugin-CHI/issues license: http://www.opensource.org/licenses/artistic-license-2.0 - repository: https://github.com/Akron/XML-Loy.git -version: '0.13' -x_serialization_backend: 'CPAN::Meta::YAML version 0.012' + repository: https://github.com/Akron/Mojolicious-Plugin-CHI.git +version: '0.14' +x_serialization_backend: 'CPAN::Meta::YAML version 0.018' diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/Mojolicious-Plugin-CHI-0.13/Makefile.PL new/Mojolicious-Plugin-CHI-0.14/Makefile.PL --- old/Mojolicious-Plugin-CHI-0.13/Makefile.PL 2016-04-01 12:14:20.000000000 +0200 +++ new/Mojolicious-Plugin-CHI-0.14/Makefile.PL 2016-08-30 19:56:13.000000000 +0200 @@ -27,11 +27,11 @@ license => 'http://www.opensource.org/licenses/artistic-license-2.0', repository => { type => 'git', - web => 'https://github.com/Akron/XML-Loy', - url => 'https://github.com/Akron/XML-Loy.git', + web => 'https://github.com/Akron/Mojolicious-Plugin-CHI', + url => 'https://github.com/Akron/Mojolicious-Plugin-CHI.git', }, bugtracker => { - web => 'https://github.com/Akron/XML-Loy/issues', + web => 'https://github.com/Akron/Mojolicious-Plugin-CHI/issues', }, } }) : (), diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/Mojolicious-Plugin-CHI-0.13/lib/Mojolicious/Plugin/CHI/chi.pm new/Mojolicious-Plugin-CHI-0.14/lib/Mojolicious/Plugin/CHI/chi.pm --- old/Mojolicious-Plugin-CHI-0.13/lib/Mojolicious/Plugin/CHI/chi.pm 2016-04-01 11:40:34.000000000 +0200 +++ new/Mojolicious-Plugin-CHI-0.14/lib/Mojolicious/Plugin/CHI/chi.pm 2016-08-30 20:01:07.000000000 +0200 @@ -46,8 +46,8 @@ # Do not modify non-persistant in-process caches! if ($chi->short_driver_name =~ /^(?:Raw)?Memory$/) { $log->warn("You are trying to $command a ". - $chi->short_driver_name . - '-Cache'); + $chi->short_driver_name . + '-Cache'); }; $chi->$command(); @@ -73,21 +73,21 @@ # Do not modify non-persistant in-process caches! if ($chi->short_driver_name =~ /^(?:Raw)?Memory$/) { - $log->warn("You are trying to $command " . - 'a key from a '. - $chi->short_driver_name . - '-Cache'); + $log->warn("You are trying to $command " . + 'a key from a '. + $chi->short_driver_name . + '-Cache'); }; # Remove or expire key if ($chi->$command($key)) { - print qq{Key "$key" from cache "$cache" was } . $command . "d.\n\n"; + print qq{Key "$key" from cache "$cache" was } . $command . "d.\n\n"; } # Not successful else { - print 'Unable to ' . $command . - qq{ key "$key" from cache "$cache".\n\n}; + print 'Unable to ' . $command . + qq{ key "$key" from cache "$cache".\n\n}; }; return 1; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/Mojolicious-Plugin-CHI-0.13/lib/Mojolicious/Plugin/CHI.pm new/Mojolicious-Plugin-CHI-0.14/lib/Mojolicious/Plugin/CHI.pm --- old/Mojolicious-Plugin-CHI-0.13/lib/Mojolicious/Plugin/CHI.pm 2016-04-01 11:40:20.000000000 +0200 +++ new/Mojolicious-Plugin-CHI-0.14/lib/Mojolicious/Plugin/CHI.pm 2016-08-30 20:00:29.000000000 +0200 @@ -3,7 +3,7 @@ use Scalar::Util 'weaken'; use CHI; -our $VERSION = '0.13'; +our $VERSION = '0.14'; # Register Plugin sub register { @@ -22,7 +22,7 @@ unless ($mojo->can('chi_handles')) { $mojo->attr( chi_handles => sub { - return ($caches //= {}); + return ($caches //= {}); } ); }

1 0

commit armadillo for openSUSE:Factory
by root＠hilbert.suse.de 31 Aug '16

31 Aug '16

Hello community, here is the log from the commit of package armadillo for openSUSE:Factory checked in at 2016-08-31 14:31:50 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/armadillo (Old) and /work/SRC/openSUSE:Factory/.armadillo.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "armadillo" Changes: -------- --- /work/SRC/openSUSE:Factory/armadillo/armadillo.changes 2016-08-05 18:17:14.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.armadillo.new/armadillo.changes 2016-08-31 14:31:52.000000000 +0200 @@ -1,0 +2,7 @@ +Mon Aug 29 11:42:41 UTC 2016 - badshah400(a)gmail.com + +- Update to version 7.400.2: + + Added expmat_sym(), logmat_sympd(), sqrtmat_sympd(). + + Added .replace(). + +------------------------------------------------------------------- Old: ---- armadillo-7.300.1.tar.xz New: ---- armadillo-7.400.2.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ armadillo.spec ++++++ --- /var/tmp/diff_new_pack.YMylGU/_old 2016-08-31 14:31:53.000000000 +0200 +++ /var/tmp/diff_new_pack.YMylGU/_new 2016-08-31 14:31:53.000000000 +0200 @@ -19,7 +19,7 @@ %define soname libarmadillo7 Name: armadillo -Version: 7.300.1 +Version: 7.400.2 Release: 0 Summary: Fast C++ matrix library with interfaces to LAPACK and ATLAS License: MPL-2.0 ++++++ armadillo-7.300.1.tar.xz -> armadillo-7.400.2.tar.xz ++++++ ++++ 3223 lines of diff (skipped)

1 0

commit python3-twine for openSUSE:Factory
by root＠hilbert.suse.de 31 Aug '16

31 Aug '16

Hello community, here is the log from the commit of package python3-twine for openSUSE:Factory checked in at 2016-08-31 14:31:47 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python3-twine (Old) and /work/SRC/openSUSE:Factory/.python3-twine.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "python3-twine" Changes: -------- --- /work/SRC/openSUSE:Factory/python3-twine/python3-twine.changes 2016-07-15 12:51:11.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.python3-twine.new/python3-twine.changes 2016-08-31 14:31:48.000000000 +0200 @@ -1,0 +2,25 @@ +Wed Aug 31 03:32:31 UTC 2016 - arun(a)gmx.de + +- update to version 1.8.1: + * Check if a package exists for several download urls + +- changes from version 1.8.0: + * :feature:`201` Switch from upload.pypi.io to upload.pypi.org. + * :feature:`144` Retrieve configuration from the environment as a + default. + + Repository URL will default to TWINE_REPOSITORY + + Username will default to TWINE_USERNAME + + Password will default to TWINE_PASSWORD + * :feature:`166` Allow the Repository URL to be provided on the + command-line (--repository-url) or via an environment variable + (TWINE_REPOSITORY_URL). + * Generate SHA256 digest for all packages by default. + * :feature:`171` Generate Blake2b 256 digests for packages if + pyblake2 is installed. Users can use python -m pip install + twine[with-blake2] to have pyblake2 installed with Twine. + * Stop testing on Python 2.6. 2.6 support will be "best effort" + until 2.0.0 + * Warn users if they receive a 500 error when uploading to + *pypi.python.org + +------------------------------------------------------------------- Old: ---- twine-1.7.4.tar.gz New: ---- twine-1.8.1.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python3-twine.spec ++++++ --- /var/tmp/diff_new_pack.vwdi6z/_old 2016-08-31 14:31:49.000000000 +0200 +++ /var/tmp/diff_new_pack.vwdi6z/_new 2016-08-31 14:31:49.000000000 +0200 @@ -17,7 +17,7 @@ Name: python3-twine -Version: 1.7.4 +Version: 1.8.1 Release: 0 Summary: Collection of utilities for interacting with PyPI License: Apache-2.0 ++++++ twine-1.7.4.tar.gz -> twine-1.8.1.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/twine-1.7.4/PKG-INFO new/twine-1.8.1/PKG-INFO --- old/twine-1.7.4/PKG-INFO 2016-07-09 13:22:23.000000000 +0200 +++ new/twine-1.8.1/PKG-INFO 2016-08-08 17:02:29.000000000 +0200 @@ -1,6 +1,6 @@ Metadata-Version: 1.1 Name: twine -Version: 1.7.4 +Version: 1.8.1 Summary: Collection of utilities for interacting with PyPI Home-page: https://github.com/pypa/twine Author: Donald Stufft and individual contributors @@ -172,7 +172,6 @@ Classifier: Operating System :: Microsoft :: Windows Classifier: Programming Language :: Python Classifier: Programming Language :: Python :: 2 -Classifier: Programming Language :: Python :: 2.6 Classifier: Programming Language :: Python :: 2.7 Classifier: Programming Language :: Python :: 3 Classifier: Programming Language :: Python :: 3.2 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/twine-1.7.4/docs/changelog.rst new/twine-1.8.1/docs/changelog.rst --- old/twine-1.7.4/docs/changelog.rst 2016-07-09 13:21:25.000000000 +0200 +++ new/twine-1.8.1/docs/changelog.rst 2016-08-08 17:01:12.000000000 +0200 @@ -4,6 +4,43 @@ Changelog ========= +* :release:`1.8.1 <2016-08-09>` + + * Check if a package exists if the URL is one of: + + - ``https://pypi.python.org/pypi/`` + - ``https://upload.pypi.org/`` + - ``https://upload.pypi.io/`` + + This helps people with ``https://upload.pypi.io`` still in their .pypirc + file. + +* :release:`1.8.0 <2016-08-08>` + + * :feature:`201` Switch from upload.pypi.io to upload.pypi.org. + + * :feature:`144` Retrieve configuration from the environment as a default. + + - Repository URL will default to ``TWINE_REPOSITORY`` + + - Username will default to ``TWINE_USERNAME`` + + - Password will default to ``TWINE_PASSWORD`` + + * :feature:`166` Allow the Repository URL to be provided on the command-line + (``--repository-url``) or via an environment variable + (``TWINE_REPOSITORY_URL``). + + * Generate SHA256 digest for all packages by default. + + * :feature:`171` Generate Blake2b 256 digests for packages *if* ``pyblake2`` + is installed. Users can use ``python -m pip install twine[with-blake2]`` + to have ``pyblake2`` installed with Twine. + + * Stop testing on Python 2.6. 2.6 support will be "best effort" until 2.0.0 + + * Warn users if they receive a 500 error when uploading to \*pypi.python.org + * :release:`1.7.4 <2016-07-09>` * Correct a packaging error. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/twine-1.7.4/setup.cfg new/twine-1.8.1/setup.cfg --- old/twine-1.7.4/setup.cfg 2016-07-09 13:22:23.000000000 +0200 +++ new/twine-1.8.1/setup.cfg 2016-08-08 17:02:29.000000000 +0200 @@ -14,6 +14,7 @@ pkginfo >= 1.0 setuptools >= 0.7.0 argparse; python_version == '2.6' + pyblake2; extra == 'with-blake2' [egg_info] tag_build = diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/twine-1.7.4/setup.py new/twine-1.8.1/setup.py --- old/twine-1.7.4/setup.py 2016-06-15 03:16:21.000000000 +0200 +++ new/twine-1.8.1/setup.py 2016-08-08 17:01:12.000000000 +0200 @@ -55,7 +55,6 @@ "Operating System :: Microsoft :: Windows", "Programming Language :: Python", "Programming Language :: Python :: 2", - "Programming Language :: Python :: 2.6", "Programming Language :: Python :: 2.7", "Programming Language :: Python :: 3", "Programming Language :: Python :: 3.2", @@ -79,4 +78,9 @@ }, install_requires=install_requires, + extras_require={ + 'with-blake2': [ + 'pyblake2', + ] + }, ) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/twine-1.7.4/tests/helpers.py new/twine-1.8.1/tests/helpers.py --- old/twine-1.7.4/tests/helpers.py 1970-01-01 01:00:00.000000000 +0100 +++ new/twine-1.8.1/tests/helpers.py 2016-08-08 17:01:12.000000000 +0200 @@ -0,0 +1,40 @@ +# Copyright 2016 Ian Cordasco +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +"""Test functions useful across twine's tests.""" + +import contextlib +import os + + +(a)contextlib.contextmanager +def set_env(**environ): + """Set the process environment variables temporarily. + + >>> with set_env(PLUGINS_DIR=u'test/plugins'): + ... "PLUGINS_DIR" in os.environ + True + + >>> "PLUGINS_DIR" in os.environ + False + + :param environ: Environment variables to set + :type environ: dict[str, unicode] + """ + old_environ = dict(os.environ) + os.environ.update(environ) + try: + yield + finally: + os.environ.clear() + os.environ.update(old_environ) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/twine-1.7.4/tests/test_upload.py new/twine-1.8.1/tests/test_upload.py --- old/twine-1.7.4/tests/test_upload.py 2016-06-15 03:16:21.000000000 +0200 +++ new/twine-1.8.1/tests/test_upload.py 2016-08-08 17:01:12.000000000 +0200 @@ -20,8 +20,10 @@ import pytest from twine.commands import upload -from twine import package +from twine import package, cli +import twine +import helpers WHEEL_FIXTURE = 'tests/fixtures/twine-1.5.0-py2.py3-none-any.whl' @@ -48,7 +50,8 @@ def test_find_dists_expands_globs(): files = sorted(upload.find_dists(['twine/__*.py'])) - expected = ['twine/__init__.py', 'twine/__main__.py'] + expected = [os.path.join('twine', '__init__.py'), + os.path.join('twine', '__main__.py')] assert expected == files @@ -79,10 +82,13 @@ upload.upload(dists=dists, repository="pypi", sign=None, identity=None, username=None, password=None, comment=None, cert=None, client_cert=None, - sign_with=None, config_file=pypirc, skip_existing=False) + sign_with=None, config_file=pypirc, skip_existing=False, + repository_url=None, + ) except KeyError as err: assert err.args[0] == ( - "Missing 'pypi' section from the configuration file.\n" + "Missing 'pypi' section from the configuration file\n" + "or not a complete URL in --repository.\n" "Maybe you have a out-dated '{0}' format?\n" "more info: " "https://docs.python.org/distutils/packageindex.html#pypirc\n" @@ -124,3 +130,22 @@ assert upload.skip_upload(response=response, skip_existing=False, package=pkg) is False + + +def test_password_and_username_from_env(monkeypatch): + def none_upload(*args, **kwargs): + pass + + replaced_upload = pretend.call_recorder(none_upload) + monkeypatch.setattr(twine.commands.upload, "upload", replaced_upload) + testenv = {"TWINE_USERNAME": "pypiuser", + "TWINE_PASSWORD": "pypipassword"} + with helpers.set_env(**testenv): + cli.dispatch(["upload", "path/to/file"]) + cli.dispatch(["upload", "path/to/file"]) + result_kwargs = replaced_upload.calls[0].kwargs + assert "pypipassword" == result_kwargs["password"] + assert "pypiuser" == result_kwargs["username"] + result_kwargs = replaced_upload.calls[1].kwargs + assert None is result_kwargs["password"] + assert None is result_kwargs["username"] diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/twine-1.7.4/tests/test_utils.py new/twine-1.8.1/tests/test_utils.py --- old/twine-1.7.4/tests/test_utils.py 2014-12-21 21:11:38.000000000 +0100 +++ new/twine-1.8.1/tests/test_utils.py 2016-08-08 17:01:12.000000000 +0200 @@ -16,9 +16,12 @@ import os.path import textwrap + import pytest -from twine.utils import DEFAULT_REPOSITORY, get_config, get_userpass_value +from twine import utils + +import helpers def test_get_config(tmpdir): @@ -34,9 +37,9 @@ password = testpassword """)) - assert get_config(pypirc) == { + assert utils.get_config(pypirc) == { "pypi": { - "repository": DEFAULT_REPOSITORY, + "repository": utils.DEFAULT_REPOSITORY, "username": "testuser", "password": "testpassword", }, @@ -53,9 +56,9 @@ password = testpassword """)) - assert get_config(pypirc) == { + assert utils.get_config(pypirc) == { "pypi": { - "repository": DEFAULT_REPOSITORY, + "repository": utils.DEFAULT_REPOSITORY, "username": "testuser", "password": "testpassword", }, @@ -75,9 +78,9 @@ password = testpassword """)) - assert get_config(pypirc) == { + assert utils.get_config(pypirc) == { "pypi": { - "repository": DEFAULT_REPOSITORY, + "repository": utils.DEFAULT_REPOSITORY, "username": "testuser", "password": "testpassword", }, @@ -87,23 +90,47 @@ def test_get_config_missing(tmpdir): pypirc = os.path.join(str(tmpdir), ".pypirc") - assert get_config(pypirc) == { + assert utils.get_config(pypirc) == { "pypi": { - "repository": DEFAULT_REPOSITORY, + "repository": utils.DEFAULT_REPOSITORY, "username": None, "password": None, }, + "pypitest": { + "repository": utils.TEST_REPOSITORY, + "username": None, + "password": None + }, } +def test_get_repository_config_missing(tmpdir): + pypirc = os.path.join(str(tmpdir), ".pypirc") + + repository_url = "https://notexisting.python.org/pypi" + exp = { + "repository": repository_url, + "username": None, + "password": None, + } + assert (utils.get_repository_from_config(pypirc, 'foo', repository_url) == + exp) + exp = { + "repository": utils.DEFAULT_REPOSITORY, + "username": None, + "password": None, + } + assert utils.get_repository_from_config(pypirc, "pypi") == exp + + def test_get_config_deprecated_pypirc(): tests_dir = os.path.dirname(os.path.abspath(__file__)) deprecated_pypirc_path = os.path.join(tests_dir, 'fixtures', 'deprecated-pypirc') - assert get_config(deprecated_pypirc_path) == { + assert utils.get_config(deprecated_pypirc_path) == { "pypi": { - "repository": DEFAULT_REPOSITORY, + "repository": utils.DEFAULT_REPOSITORY, "username": 'testusername', "password": 'testpassword', }, @@ -119,5 +146,29 @@ ), ) def test_get_userpass_value(cli_value, config, key, strategy, expected): - ret = get_userpass_value(cli_value, config, key, strategy) + ret = utils.get_userpass_value(cli_value, config, key, strategy) assert ret == expected + + +(a)pytest.mark.parametrize( + ('env_name', 'default', 'environ', 'expected'), + [ + ('MY_PASSWORD', None, {}, None), + ('MY_PASSWORD', None, {'MY_PASSWORD': 'foo'}, 'foo'), + ('URL', 'https://example.org', {}, 'https://example.org'), + ('URL', 'https://example.org', {'URL': 'https://pypi.org'}, + 'https://pypi.org'), + ], +) +def test_default_to_environment_action(env_name, default, environ, expected): + option_strings = ('-x', '--example') + dest = 'example' + with helpers.set_env(**environ): + action = utils.EnvironmentDefault( + env=env_name, + default=default, + option_strings=option_strings, + dest=dest, + ) + assert action.env == env_name + assert action.default == expected diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/twine-1.7.4/twine/__init__.py new/twine-1.8.1/twine/__init__.py --- old/twine-1.7.4/twine/__init__.py 2016-07-09 13:21:34.000000000 +0200 +++ new/twine-1.8.1/twine/__init__.py 2016-08-08 17:01:12.000000000 +0200 @@ -23,7 +23,7 @@ __summary__ = "Collection of utilities for interacting with PyPI" __uri__ = "https://github.com/pypa/twine" -__version__ = "1.7.4" +__version__ = "1.8.1" __author__ = "Donald Stufft and individual contributors" __email__ = "donald(a)stufft.io" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/twine-1.7.4/twine/commands/register.py new/twine-1.8.1/twine/commands/register.py --- old/twine-1.7.4/twine/commands/register.py 2015-12-17 00:37:02.000000000 +0100 +++ new/twine-1.8.1/twine/commands/register.py 2016-08-08 17:01:12.000000000 +0200 @@ -24,8 +24,12 @@ def register(package, repository, username, password, comment, config_file, - cert, client_cert): - config = utils.get_repository_from_config(config_file, repository) + cert, client_cert, repository_url): + config = utils.get_repository_from_config( + config_file, + repository, + repository_url, + ) config["repository"] = utils.normalize_repository_url( config["repository"] ) @@ -62,17 +66,38 @@ parser = argparse.ArgumentParser(prog="twine register") parser.add_argument( "-r", "--repository", + action=utils.EnvironmentDefault, + env="TWINE_REPOSITORY", default="pypi", - help="The repository to register the package to (default: " + help="The repository to register the package to. Can be a section in " + "the config file or a full URL to the repository (default: " "%(default)s)", ) parser.add_argument( + "--repository-url", + action=utils.EnvironmentDefault, + env="TWINE_REPOSITORY_URL", + default=None, + required=False, + help="The repository URL to upload the package to. This can be " + "specified with --repository because it will be used if there is " + "no configuration for the value passed to --repository." + ) + parser.add_argument( "-u", "--username", - help="The username to authenticate to the repository as", + action=utils.EnvironmentDefault, + env="TWINE_USERNAME", + required=False, help="The username to authenticate to the repository " + "as (can also be set via %(env)s environment " + "variable)", ) parser.add_argument( "-p", "--password", - help="The password to authenticate to the repository with", + action=utils.EnvironmentDefault, + env="TWINE_PASSWORD", + required=False, help="The password to authenticate to the repository " + "with (can also be set via %(env)s environment " + "variable)", ) parser.add_argument( "-c", "--comment", diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/twine-1.7.4/twine/commands/upload.py new/twine-1.8.1/twine/commands/upload.py --- old/twine-1.7.4/twine/commands/upload.py 2016-07-09 13:20:09.000000000 +0200 +++ new/twine-1.8.1/twine/commands/upload.py 2016-08-08 17:01:12.000000000 +0200 @@ -72,7 +72,8 @@ def upload(dists, repository, sign, identity, username, password, comment, - sign_with, config_file, skip_existing, cert, client_cert): + sign_with, config_file, skip_existing, cert, client_cert, + repository_url): # Check that a nonsensical option wasn't given if not sign and identity: raise ValueError("sign must be given along with identity") @@ -85,7 +86,11 @@ ) uploads = [i for i in dists if not i.endswith(".asc")] - config = utils.get_repository_from_config(config_file, repository) + config = utils.get_repository_from_config( + config_file, + repository, + repository_url, + ) config["repository"] = utils.normalize_repository_url( config["repository"] @@ -138,7 +143,7 @@ print(skip_message) continue - resp.raise_for_status() + utils.check_status_code(resp) # Bug 28. Try to silence a ResourceWarning by clearing the connection # pool. @@ -149,8 +154,22 @@ parser = argparse.ArgumentParser(prog="twine upload") parser.add_argument( "-r", "--repository", + action=utils.EnvironmentDefault, + env="TWINE_REPOSITORY", default="pypi", - help="The repository to upload the files to (default: %(default)s)", + help="The repository to register the package to. Can be a section in " + "the config file or a full URL to the repository (default: " + "%(default)s)", + ) + parser.add_argument( + "--repository-url", + action=utils.EnvironmentDefault, + env="TWINE_REPOSITORY_URL", + default=None, + required=False, + help="The repository URL to upload the package to. This can be " + "specified with --repository because it will be used if there is " + "no configuration for the value passed to --repository." ) parser.add_argument( "-s", "--sign", @@ -169,11 +188,19 @@ ) parser.add_argument( "-u", "--username", - help="The username to authenticate to the repository as", + action=utils.EnvironmentDefault, + env="TWINE_USERNAME", + required=False, help="The username to authenticate to the repository " + "as (can also be set via %(env)s environment " + "variable)", ) parser.add_argument( "-p", "--password", - help="The password to authenticate to the repository with", + action=utils.EnvironmentDefault, + env="TWINE_PASSWORD", + required=False, help="The password to authenticate to the repository " + "with (can also be set via %(env)s environment " + "variable)", ) parser.add_argument( "-c", "--comment", diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/twine-1.7.4/twine/package.py new/twine-1.8.1/twine/package.py --- old/twine-1.7.4/twine/package.py 2016-02-05 00:23:50.000000000 +0100 +++ new/twine-1.8.1/twine/package.py 2016-08-08 17:01:12.000000000 +0200 @@ -13,12 +13,18 @@ # limitations under the License. from __future__ import absolute_import, unicode_literals, print_function import hashlib +import io import os import subprocess import pkginfo import pkg_resources +try: + import pyblake2 +except ImportError: + pyblake2 = None + from twine.wheel import Wheel from twine.wininst import WinInst @@ -52,17 +58,24 @@ self.signed_basefilename = self.basefilename + '.asc' self.gpg_signature = None + blake2_256_hash = None + if pyblake2 is not None: + blake2_256_hash = pyblake2.blake2b(digest_size=256 // 8) + # NOTE(sigmavirus24): We may or may not be able to use blake2 so let's + # either use the methods or lambdas to do nothing. + blake_update = getattr(blake2_256_hash, 'update', lambda *args: None) + blake_hexdigest = getattr(blake2_256_hash, 'hexdigest', lambda: None) md5_hash = hashlib.md5() sha2_hash = hashlib.sha256() with open(filename, "rb") as fp: - content = fp.read(4096) - while content: + for content in iter(lambda: fp.read(io.DEFAULT_BUFFER_SIZE), b''): md5_hash.update(content) sha2_hash.update(content) - content = fp.read(4096) + blake_update(content) self.md5_digest = md5_hash.hexdigest() self.sha2_digest = sha2_hash.hexdigest() + self.blake2_256_digest = blake_hexdigest() @classmethod def from_filename(cls, filename, comment): @@ -117,11 +130,8 @@ "supported_platform": meta.supported_platforms, "comment": self.comment, "md5_digest": self.md5_digest, - - # When https://github.com/pypa/warehouse/issues/681 is closed and - # warehouse is deployed, uncomment the line below to start sending - # a more up-to-date digest. - # "sha256_digest": self.sha256_digest, + "sha256_digest": self.sha2_digest, + "blake2_256_digest": self.blake2_256_digest, # PEP 314 "provides": meta.provides, diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/twine-1.7.4/twine/repository.py new/twine-1.8.1/twine/repository.py --- old/twine-1.7.4/twine/repository.py 2016-07-09 13:20:09.000000000 +0200 +++ new/twine-1.8.1/twine/repository.py 2016-08-08 17:01:12.000000000 +0200 @@ -29,7 +29,8 @@ KEYWORDS_TO_NOT_FLATTEN = set(["gpg_signature", "content"]) LEGACY_PYPI = 'https://pypi.python.org/' -WAREHOUSE = 'https://upload.pypi.io/' +WAREHOUSE = 'https://upload.pypi.org/' +OLD_WAREHOUSE = 'https://upload.pypi.io/' class Repository(object): @@ -158,7 +159,7 @@ def package_is_uploaded(self, package, bypass_cache=False): # NOTE(sigmavirus24): Not all indices are PyPI and pypi.io doesn't # have a similar interface for finding the package versions. - if not self.url.startswith((LEGACY_PYPI, WAREHOUSE)): + if not self.url.startswith((LEGACY_PYPI, WAREHOUSE, OLD_WAREHOUSE)): return False safe_name = package.safe_name diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/twine-1.7.4/twine/utils.py new/twine-1.8.1/twine/utils.py --- old/twine-1.7.4/twine/utils.py 2016-07-04 21:45:58.000000000 +0200 +++ new/twine-1.8.1/twine/utils.py 2016-08-08 17:01:12.000000000 +0200 @@ -19,6 +19,8 @@ import functools import getpass import sys +import argparse + try: import configparser @@ -37,7 +39,8 @@ input_func = raw_input -DEFAULT_REPOSITORY = "https://upload.pypi.io/legacy/" +DEFAULT_REPOSITORY = "https://upload.pypi.org/legacy/" +TEST_REPOSITORY = "https://test.pypi.org/legacy/" def get_config(path="~/.pypirc"): @@ -48,7 +51,11 @@ return {"pypi": {"repository": DEFAULT_REPOSITORY, "username": None, "password": None - } + }, + "pypitest": {"repository": TEST_REPOSITORY, + "username": None, + "password": None + }, } # Parse the rc file @@ -92,13 +99,22 @@ return config -def get_repository_from_config(config_file, repository): +def get_repository_from_config(config_file, repository, repository_url=None): # Get our config from the .pypirc file try: return get_config(config_file)[repository] except KeyError: + if repository_url and "://" in repository_url: + # assume that the repsoitory is actually an URL and just sent + # them a dummy with the repo set + return { + "repository": repository_url, + "username": None, + "password": None, + } msg = ( - "Missing '{repo}' section from the configuration file.\n" + "Missing '{repo}' section from the configuration file\n" + "or not a complete URL in --repository.\n" "Maybe you have a out-dated '{cfg}' format?\n" "more info: " "https://docs.python.org/distutils/packageindex.html#pypirc\n" @@ -109,13 +125,29 @@ raise KeyError(msg) +_HOSTNAMES = set(["pypi.python.org", "testpypi.python.org", "upload.pypi.org", + "test.pypi.org"]) + + def normalize_repository_url(url): parsed = urlparse(url) - if parsed.netloc in ["pypi.python.org", "testpypi.python.org"]: + if parsed.netloc in _HOSTNAMES: return urlunparse(("https",) + parsed[1:]) return urlunparse(parsed) +def check_status_code(response): + if (response.status_code == 500 and + response.url.startswith(("https://pypi.python.org", + "https://testpypi.python.org"))): + print("It appears you're uploading to pypi.python.org (or testpypi) " + "you've recieved a 500 error response. PyPI is being phased " + "out for pypi.org. Try using https://upload.pypi.org/legacy/ " + "(or https://test.pypi.org/legacy/) to upload your packages " + "instead. These are the default URLs for Twine now.") + response.raise_for_status() + + def get_userpass_value(cli_value, config, key, prompt_strategy=None): """Gets the username / password from config. @@ -172,3 +204,21 @@ get_userpass_value, key='client_cert', ) + + +class EnvironmentDefault(argparse.Action): + """Get values from environment variable.""" + + def __init__(self, env, required=True, default=None, **kwargs): + default = os.environ.get(env, default) + self.env = env + if default: + required = False + super(EnvironmentDefault, self).__init__( + default=default, + required=required, + **kwargs + ) + + def __call__(self, parser, namespace, values, option_string=None): + setattr(namespace, self.dest, values) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/twine-1.7.4/twine.egg-info/PKG-INFO new/twine-1.8.1/twine.egg-info/PKG-INFO --- old/twine-1.7.4/twine.egg-info/PKG-INFO 2016-07-09 13:22:22.000000000 +0200 +++ new/twine-1.8.1/twine.egg-info/PKG-INFO 2016-08-08 17:02:28.000000000 +0200 @@ -1,6 +1,6 @@ Metadata-Version: 1.1 Name: twine -Version: 1.7.4 +Version: 1.8.1 Summary: Collection of utilities for interacting with PyPI Home-page: https://github.com/pypa/twine Author: Donald Stufft and individual contributors @@ -172,7 +172,6 @@ Classifier: Operating System :: Microsoft :: Windows Classifier: Programming Language :: Python Classifier: Programming Language :: Python :: 2 -Classifier: Programming Language :: Python :: 2.6 Classifier: Programming Language :: Python :: 2.7 Classifier: Programming Language :: Python :: 3 Classifier: Programming Language :: Python :: 3.2 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/twine-1.7.4/twine.egg-info/SOURCES.txt new/twine-1.8.1/twine.egg-info/SOURCES.txt --- old/twine-1.7.4/twine.egg-info/SOURCES.txt 2016-07-09 13:22:23.000000000 +0200 +++ new/twine-1.8.1/twine.egg-info/SOURCES.txt 2016-08-08 17:02:29.000000000 +0200 @@ -10,6 +10,7 @@ docs/index.rst docs/make.bat docs/_static/.empty +tests/helpers.py tests/test_cli.py tests/test_package.py tests/test_repository.py @@ -30,6 +31,7 @@ twine.egg-info/SOURCES.txt twine.egg-info/dependency_links.txt twine.egg-info/entry_points.txt +twine.egg-info/pbr.json twine.egg-info/requires.txt twine.egg-info/top_level.txt twine/commands/__init__.py diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/twine-1.7.4/twine.egg-info/pbr.json new/twine-1.8.1/twine.egg-info/pbr.json --- old/twine-1.7.4/twine.egg-info/pbr.json 1970-01-01 01:00:00.000000000 +0100 +++ new/twine-1.8.1/twine.egg-info/pbr.json 2015-10-01 17:27:14.000000000 +0200 @@ -0,0 +1 @@ +{"is_release": true, "git_version": "5c06ed2"} \ No newline at end of file diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/twine-1.7.4/twine.egg-info/requires.txt new/twine-1.8.1/twine.egg-info/requires.txt --- old/twine-1.7.4/twine.egg-info/requires.txt 2016-07-09 13:22:22.000000000 +0200 +++ new/twine-1.8.1/twine.egg-info/requires.txt 2016-08-08 17:02:28.000000000 +0200 @@ -3,3 +3,6 @@ requests >= 2.5.0 requests-toolbelt >= 0.5.1 setuptools >= 0.7.0 + +[with-blake2] +pyblake2

1 0

commit i18nspector for openSUSE:Factory
by root＠hilbert.suse.de 31 Aug '16

31 Aug '16

Hello community, here is the log from the commit of package i18nspector for openSUSE:Factory checked in at 2016-08-31 14:31:45 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/i18nspector (Old) and /work/SRC/openSUSE:Factory/.i18nspector.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "i18nspector" Changes: -------- --- /work/SRC/openSUSE:Factory/i18nspector/i18nspector.changes 2016-07-14 09:50:10.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.i18nspector.new/i18nspector.changes 2016-08-31 14:31:47.000000000 +0200 @@ -1,0 +2,18 @@ +Tue Aug 30 04:51:42 UTC 2016 - lazy.kent(a)opensuse.org + +- Update to 0.25.3. + * Rewrite shebang at install time. + +------------------------------------------------------------------- +Thu Aug 25 05:48:46 UTC 2016 - lazy.kent(a)opensuse.org + +- Update to 0.25.2. + * Don't disable stdout line buffering. + * Make --version print also versions of Python and the libraries. + * Make --version print to stdout, not stderr. + * Use /usr/bin/env in shebangs. + * Fix compatibility with PyPy 3. + * Improve documentation about dependencies. + * Improve the test suite. + +------------------------------------------------------------------- Old: ---- i18nspector-0.25.1.tar.gz i18nspector-0.25.1.tar.gz.asc New: ---- i18nspector-0.25.3.tar.gz i18nspector-0.25.3.tar.gz.asc ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ i18nspector.spec ++++++ --- /var/tmp/diff_new_pack.utDfQ4/_old 2016-08-31 14:31:48.000000000 +0200 +++ /var/tmp/diff_new_pack.utDfQ4/_new 2016-08-31 14:31:48.000000000 +0200 @@ -17,7 +17,7 @@ Name: i18nspector -Version: 0.25.1 +Version: 0.25.3 Release: 0 Summary: Tool for Checking gettext POT/PO/MO Files License: MIT ++++++ i18nspector-0.25.1.tar.gz -> i18nspector-0.25.3.tar.gz ++++++ ++++ 1727 lines of diff (skipped)

1 0

commit geary for openSUSE:Factory
by root＠hilbert.suse.de 31 Aug '16

31 Aug '16

Hello community, here is the log from the commit of package geary for openSUSE:Factory checked in at 2016-08-31 14:31:42 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/geary (Old) and /work/SRC/openSUSE:Factory/.geary.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "geary" Changes: -------- --- /work/SRC/openSUSE:Factory/geary/geary.changes 2016-08-12 15:57:02.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.geary.new/geary.changes 2016-08-31 14:31:44.000000000 +0200 @@ -1,0 +2,30 @@ +Sun Aug 28 10:18:59 UTC 2016 - zaitor(a)opensuse.org + +- Update to version 0.11.2: + + Improve showing RTL email with no direction set as RTL + (bgo#713062). + + Improve composer not showing RTL messages as RTL (bgo#713607). + + Fix crash when archiving, deleting, etc. specific messages + (bgo#769010). + + Fix crash from invalid window sizes in settings (bgo#730356). + + Fix crash connecting to tiscali.it/poste.it & other Dovecot + (bgo#66509). + + Fix maximised state not being saved (bgo#755359). + + Fix unresponsive after sending long line starting with '>' + (bgo#768642). + + Fix warning/crash when unable to contact notification server + (bgo#768911). + + Fix using incorrect From address restoring from a draft + (bgo#768419). + + Fix format=flowed when sending non-Latin text (bgo#753528). + + Fix encoding problems with non ASCII/Latin-1/UTF-8 headers + (bgo#753870). + + Don't double spaces after address autocomplete in composer + (bgo#755589). + + Add Language headers to po files. + + Don't rely on a the GEdit app icon for the draft folder + (bgo#753672). + + Fix a number of edge-case critical warnings/errors. + + Updated translations. + +------------------------------------------------------------------- Old: ---- geary-0.11.1.tar.xz New: ---- geary-0.11.2.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ geary.spec ++++++ --- /var/tmp/diff_new_pack.62764D/_old 2016-08-31 14:31:45.000000000 +0200 +++ /var/tmp/diff_new_pack.62764D/_new 2016-08-31 14:31:45.000000000 +0200 @@ -17,7 +17,7 @@ Name: geary -Version: 0.11.1 +Version: 0.11.2 Release: 0 Summary: A lightweight email reader for the GNOME desktop License: LGPL-2.0+ ++++++ geary-0.11.1.tar.xz -> geary-0.11.2.tar.xz ++++++ ++++ 7193 lines of diff (skipped)

1 0