March 2011 - openSUSE Build Service - openSUSE Mailing Lists

[opensuse-buildservice] Should osc support global oscrc ?
by JF Ding 03 Mar '11

03 Mar '11

Hi all, As current code, osc/conf.py:722 os.chmod(conffile. 0600) the specified oscrc file, whether or not ~/.oscrc, should be writable for current user. But in some cases, users want to run osc as special user, e.g. nobody in some daemons, and there's no a proper place to store the writable oscrc. If osc can support global readonly oscrc for system wide configuration, the things can be easier. My question is: should osc support the readonly global oscrc? Is there any potential security issue? Thanks, - jf.ding -- To unsubscribe, e-mail: opensuse-buildservice+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-buildservice+help(a)opensuse.org

5 12

[opensuse-buildservice] Overriding release number
by Ann Davis 02 Mar '11

02 Mar '11

Hi, Sorry if this has been asked before, but is there a way to set the release number for built packages? Since I've made lots of changes, my built packages have a very high release number. Is there a way to reset it to "0" or "1" (without starting a new project/package)? TIA, Ann -- To unsubscribe, e-mail: opensuse-buildservice+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-buildservice+help(a)opensuse.org

2 1

[opensuse-buildservice] (Feature Request) Specify version in osc (what)depenson
by Cristian Morales Vega 02 Mar '11

02 Mar '11

$ osc dependson games megaglest openSUSE_11.3 x86_64 megaglest : SDL cmake curl jam libtheora openal-soft It's possible to make it output megaglest : SDL cmake curl >= 7.21 jam libtheora openal-soft ? I want this for the case a packageA is linked to a repository only because the newer version is needed to backport another packageB. I want to know when I can delete that link since all the current supported openSUSE versions already have a new enough packageA. TIA -- To unsubscribe, e-mail: opensuse-buildservice+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-buildservice+help(a)opensuse.org

2 1

[opensuse-buildservice] OBS 2.0.8 and 2.1.6 released
by Adrian Schröter 01 Mar '11

01 Mar '11

The openSUSE Build Service team has released verison 2.0.8 and 2.1.6. ===================================================================== Both versions are fixing a critical security leak which can be missused to modify projects or packages without having write permission there. We highly recommend to update your instance therefore. Thanks to Marcus Hüwe for reporting this issue. Version 1.7 is not affected by this issue. OBS 2.1.6 is fixing also security issues in LDAP mode and a possible crossite scripting attack vector on the login screen (full XSS protection in all webui interfaces will be part of OBS 2.3). Thanks to Dean Pierce from Intel for discussing these issues and possible solutions with us. Version 2.1.6 can be downloaded as usual from gitorious, openSUSE:Tools (or openSUSE:Tool:2.0 for version 2.0.8) project repositories or as appliance for testing and production systems: http://en.opensuse.org/openSUSE:Build_Service_Appliance OBS 2.1.6 contains also further changes, please read the release notes below: # # openSUSE Build Service 2.1.6 # Updaters from any OBS 2.1 release can just ugrade the packages and restart all services. Updaters from former releases should read the README.UPDATERS file. Security fixes: =============== * api: fix security leak which allowed to modify packages or projects without write access (CVE-2011-0466) * api: change password in LDAP mode was possible for foreign user (bnc #648982) * webui: Fix possible XSS attack vectors in login page (bnc #669909, CVE-2011-0462) Feature backports: ================== None Changes: ======== * openSUSE 11.4 and Debian 6.0 got added as default target. * adding reviewers or changing the review state is only allowed for requests which are in review state now. Bugfixes: ========= * webui: Fix link to moved OBS web forums * webui: Fix adding of repositories from remote projects in advanced repository interface * api and webui: Do not use (and fail with) rails 3 environment * api: allow admins to raise "sourceaccess" permissions on existing projects or packages * api: do not allow to create packages with invalid chars via branch command * api: do not fail on "mbranch" when a package gets found directly and indirectly via project link * backend: Allow browsing of repositories of remote projects (fixes advanced webui view for adding repos) ~ -- Adrian Schroeter SUSE Linux Products GmbH email: adrian(a)suse.de -- To unsubscribe, e-mail: opensuse-buildservice+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-buildservice+help(a)opensuse.org

1 0

[opensuse-buildservice] opensuse build service repositories and mandrivia?
by Paul Elliott 01 Mar '11

01 Mar '11

I remember that there used to be a problem with mandrivia not recognizing OBS reposotories. Has this been fixed? Is it a problem with OBS or Mandrivia? Thank You. -- Paul Elliott 1(512)837-1096 pelliott(a)BlackPatchPanel.com PMB 181, 11900 Metric Blvd Suite J http://www.free.blackpatchpanel.com/pme/ Austin TX 78758-3117

4 5