May 2014 - openSUSE Commits - openSUSE Mailing Lists

commit translation-update-upstream for openSUSE:Factory
by root＠hilbert.suse.de 22 May '14

22 May '14

Hello community, here is the log from the commit of package translation-update-upstream for openSUSE:Factory checked in at 2014-05-22 20:37:32 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/translation-update-upstream (Old) and /work/SRC/openSUSE:Factory/.translation-update-upstream.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "translation-update-upstream" Changes: -------- --- /work/SRC/openSUSE:Factory/translation-update-upstream/translation-update-upstream.changes 2014-04-30 15:00:45.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.translation-update-upstream.new/translation-update-upstream.changes 2014-05-22 20:37:46.000000000 +0200 @@ -1,0 +2,16 @@ +Tue May 6 23:37:37 CEST 2014 - sbrabec(a)suse.cz + +- New supplementary script: check-translation-completeness.sh + that creates statistics of translation completeness. +- Merge latest upstream-collect.sh fixes from SLE11 SP3: + * Re-add all strings lost after removal from upstream + (bnc#807817#c15). + * Do incremental update by default to prevent loss of strings + removed from upstream (bnc#807817#c15). + * Fix errors in debug mode. +- Merge latest translation-update-upstream-to-translation-update.sh + fixes from SLE11 SP3: + * rewrote to include strings from gnome-patch-translation + (bnc#807817, bnc#811265). + +------------------------------------------------------------------- New: ---- check-translation-completeness.sh ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ translation-update-upstream.spec ++++++ --- /var/tmp/diff_new_pack.zP8mGo/_old 2014-05-22 20:37:48.000000000 +0200 +++ /var/tmp/diff_new_pack.zP8mGo/_new 2014-05-22 20:37:48.000000000 +0200 @@ -47,6 +47,7 @@ Source55: create-tlst.conf Source56: translation-update-upstream-to-translation-update.sh Source57: translation-update-static.tar.bz2 +Source58: check-translation-completeness.sh # Configuration files for package maintainer tools: Source60: upstream-gnome_gtp.tlst Source61: upstream-gnome_gtp.hook @@ -132,7 +133,7 @@ for LOCALE in $(set +x ; cd $RPM_BUILD_ROOT%{_datadir} ; ls -1 translation*/*/*/*.po | sed 's:.*/::;s:\.po$::' | sort -u) ; do if ! test -d /usr/share/locale/$LOCALE ; then for file in $RPM_BUILD_ROOT%{_datadir}/translation*/*/*/$LOCALE.po; do - # fake it so it looks like removed from %find_lang + # fake it so it looks like removed from %%find_lang package=$(echo $file | sed -e 's,.*translation[^/]*/po/,,; s,/[^/]*.po,,') echo -n "removing translation /usr/share/locale/$LOCALE/LC_MESSAGES/$package.mo: " msgfmt -o - $file | msgunfmt -o - -| msgfmt --statistics -o /dev/null - ++++++ check-translation-completeness.sh ++++++ #!/bin/bash set -o errexit # We need stable text format export LANG=C if ! test -d po-full ; then echo >&2 "$0: You need \"po-full\" directory. Call this script only after ./upstream-collect.sh" exit 1 fi cd po-full ALL_LNG="$( for PO in */*.po ; do LNG=${PO%.po} LNG=${LNG##*/} echo "$LNG" done | sort -u | tr '\n' ' ' )" #echo >&2 "$0 DBG: ALL_LNG=\"$ALL_LNG\"" for DOMAIN in * ; do for LNG in $ALL_LNG ; do # Sanitize to not contain "," or ".": LNG_SN=${LNG//,/__COMMA__} LNG_SN=${LNG_SN//./__PERIOD__} DOMAIN_SN=${DOMAIN//,/__COMMA__} DOMAIN_SN=${DOMAIN_SN//./__PERIOD__} echo -n "$LNG_SN,$DOMAIN_SN," PO=$DOMAIN/$LNG.po if test -f "$PO" ; then msgfmt --statistics -o /dev/null $PO 2>&1 else msgfmt --statistics -o /dev/null ../pot/$DOMAIN.pot 2>&1 fi done done | #tee ../check-translation-completeness-DBG1.log | ( # "F1 translated messages, F2 fuzzy translations, F3 untranslated messages." Some fields can be missing IFS=,. while read LNG DOMAIN F1 F2 F3 F4 ; do LNG=${LNG//__COMMA__/,} LNG=${LNG//__PERIOD__/.} DOMAIN=${DOMAIN//__COMMA__/,} DOMAIN=${DOMAIN//__PERIOD__/.} TRANSLATED=0 UNTRANSLATED=0 FUZZY=0 if test -n "$F4" ; then echo >&2 "$0: Too long output of \"msgfmt --statistics -o /dev/null po-full/$DOMAIN/$LNG.po\": \"$F4\"" exit 1 fi for STRING in "$F1" "$F2" "$F3" "$F4" ; do STRING=${STRING# } case "$STRING" in *" translated message" ) TRANSLATED=${STRING% translated message} ;; *" translated messages" ) TRANSLATED=${STRING% translated messages} ;; *" fuzzy translation" ) FUZZY=${STRING% fuzzy translation} ;; *" fuzzy translations" ) FUZZY=${STRING% fuzzy translations} ;; *" untranslated message" ) UNTRANSLATED=${STRING% untranslated message} ;; *" untranslated messages" ) UNTRANSLATED=${STRING% untranslated messages} ;; "" ) ;; * ) echo >&2 "$0: Unknown format of \"msgfmt --statistics -o /dev/null po-full/$DOMAIN/$LNG.po\": \"$STRING\"" exit 1 ;; esac done #echo >&2 -n "$0 DBG: LNG=$LNG DOMAIN=$DOMAIN F1=\"$F1\" F2=\"$F2\" F3=\"$F3\" F4=\"$F4\" TRANSLATED=$TRANSLATED UNTRANSLATED=$UNTRANSLATED FUZZY=$FUZZY" let UNTRANSLATED+=FUZZY || : let ALL=TRANSLATED+UNTRANSLATED || : #echo >&2 " DBG: ALL=$ALL all_UNTRANSLATED=$UNTRANSLATED" let PERCENTAGE=100"*"TRANSLATED/ALL || : echo "\"$LNG\",\"$DOMAIN\",$PERCENTAGE,$UNTRANSLATED,$ALL" done ) | #tee ../check-translation-completeness-DBG2.log | ( echo >../check-translation-completeness-by-domain.csv "\"Language\",\"Domain\",\"Translated %\",\"Untranslated #\",\"All #\"" tee -a ../check-translation-completeness-by-domain.csv ) | sort | ( echo >../check-translation-completeness-by-language.csv "\"Language\",\"Domain\",\"Translated %\",\"Untranslated #\",\"All #\"" tee -a ../check-translation-completeness-by-language.csv ) | ( IFS="," while read LNG DOMAIN PERCENTAGE UNTRANSLATED ALL ; do LNG=${LNG//\"} case $LNG in ar ) LNG_NAME="Arabic" ;; pt_BR ) LNG_NAME="Brazilian Portuguese" ;; zh_CN ) LNG_NAME="Chinese Simplified" ;; zh_TW ) LNG_NAME="Chinese Traditional" ;; cs ) LNG_NAME="Czech" ;; nl ) LNG_NAME="Dutch" ;; fr ) LNG_NAME="French" ;; de ) LNG_NAME="German" ;; hu ) LNG_NAME="Hungarian" ;; it ) LNG_NAME="Italian" ;; ja ) LNG_NAME="Japanese" ;; ko ) LNG_NAME="Korean" ;; pl ) LNG_NAME="Polish" ;; ru ) LNG_NAME="Russian" ;; es ) LNG_NAME="Spanish" ;; sv ) LNG_NAME="Swedish" ;; * ) continue ;; esac echo "\"$LNG_NAME\",$DOMAIN,$PERCENTAGE,$UNTRANSLATED,$ALL" done ) | sort | ( echo >../check-translation-completeness-supported.csv "\"Language\",\"Domain\",\"Translated %\",\"Untranslated #\",\"All #\"" cat >../check-translation-completeness-supported.csv ) cd .. zip check-translation-completeness.zip check-translation-completeness*.csv ++++++ create-tlst-step2-create-gnome_gtp.sh ++++++ --- /var/tmp/diff_new_pack.zP8mGo/_old 2014-05-22 20:37:48.000000000 +0200 +++ /var/tmp/diff_new_pack.zP8mGo/_new 2014-05-22 20:37:48.000000000 +0200 @@ -17,19 +17,19 @@ done | sort -u >create-tlst-temp-osc-projects.lst # branches tried for all apps: -KNOWN_BRANCHES="gnome-3-4" +KNOWN_BRANCHES="gnome-3-10" # branches tried apps with the same name base: # Do not forget hardcoded strings in the code below! -APP_BRANCHES="|gimp-2-8|gtk-3-6|gtk-2-24|glib-2-34" +APP_BRANCHES="|gimp-2-8|gtk-3-10|gtk-2-24|glib-2-38|glib-2-40" # FIXME: support for libgda:release-3-0-branch gnome-background:gnome-2-22 echo "# This file was generated $(LANG=C LC_ALL=C date) by create-tlst-step2-create-gnome_gtp.sh." >upstream-gnome_gtp.tlst -echo "# package domain method repository dir branch" >>upstream-gnome_gtp.tlst +echo "# package domain method repository dir branch" >>upstream-gnome_gtp.tlst SPACES=' ' # listing of all GNOME GTP projects -curl http://l10n.gnome.org/POT/ | sed -n 's:^.*href="$[^"]*$/".*$:\1:p' | sed '/^$/d' | +curl https://l10n.gnome.org/POT/ | sed -n 's:^.*href="$[^"]*$/".*$:\1:p' | sed '/^$/d' | ( while read ; do BRANCH=${REPLY##*.} @@ -46,12 +46,19 @@ for LBRANCH in $KNOWN_BRANCHES master ; do echo gconf gconf2 GConf2 $LBRANCH done + echo glib glib2 glib20 glib-2-38 echo glib glib2 glib20 master + echo gtk+ gtk2 gtk20 gtk-2-38 echo gtk+ gtk2 gtk20 master + echo gtk+ gtk2 gtk20-properties gtk-2-38 echo gtk+ gtk2 gtk20-properties master + echo gtk+ gtk3 gtk30 gtk-3-10 echo gtk+ gtk3 gtk30 master + echo gtk+ gtk3 gtk30-properties gtk-3-10 echo gtk+ gtk3 gtk30-properties master + echo libgweather libgweather libgweather-locations gnome-3-10 echo libgweather libgweather libgweather-locations master + echo gnome-phone-manager phonemgr gnome-phone-manager gnome-3-10 echo gnome-phone-manager phonemgr gnome-phone-manager master echo network-manager-applet NetworkManager-gnome nm-applet master # For other versions than sles10: @@ -120,7 +127,7 @@ esac" if $USE_IT ; then BRANCH=${BRANCH/master/zzzz_master} - echo "$PACKAGE${SPACES:0:28-${#PACKAGE}}$DOMAIN${SPACES:0:47-${#DOMAIN}}gtp l10n.gnome.org/POT $PROJECT/$PO_DIR${SPACES:0:36-${#PROJECT}-${#PO_DIR}}$BRANCH" + echo "$PACKAGE${SPACES:0:28-${#PACKAGE}}$DOMAIN${SPACES:0:47-${#DOMAIN}}gtp l10n.gnome.org/POT $PROJECT/$PO_DIR${SPACES:0:26-${#PROJECT}-${#PO_DIR}}$BRANCH" fi # Disabled for now. Final merge will happen in spec file. ++++++ translation-update-upstream-to-translation-update.sh ++++++ --- /var/tmp/diff_new_pack.zP8mGo/_old 2014-05-22 20:37:48.000000000 +0200 +++ /var/tmp/diff_new_pack.zP8mGo/_new 2014-05-22 20:37:48.000000000 +0200 @@ -14,12 +14,19 @@ exit 1 fi +if ! test -d gnome-patch-translation ; then + echo "Please provide directory gnome-patch-translation with contents of" + echo "/usr/share/gnome-patch-translation from gnome-patch-translation RPM" + echo "on the target system." + exit 1 +fi + source ${0%translation-update-upstream-to-translation-update.sh}upstream-collect.conf mkdir\ TRANSLATION_UPDATE TRANSLATION_UPDATE/translation-update TRANSLATION_UPDATE/TUU\ - TRANSLATION_UPDATE/NOT_UPDATED TRANSLATION_UPDATE/NOT_UPDATED/po TRANSLATION_UPDATE/NOT_UPDATED/po-mandatory\ - TRANSLATION_UPDATE/UPDATED TRANSLATION_UPDATE/UPDATED/po TRANSLATION_UPDATE/UPDATED/po-mandatory\ + TRANSLATION_UPDATE/NOT_UPDATED \ + TRANSLATION_UPDATE/UPDATED \ TRANSLATION_UPDATE/complete TRANSLATION_UPDATE/rebuilt # more tarballs are available => use the latest one @@ -40,11 +47,105 @@ SNAPSHOT=$MSNAPSHOT fi -cd TRANSLATION_UPDATE/TUU -cp -a ../../po-mandatory-full po-mandatory -cp -a ../../po-full po +# FIXME: It should list all gnome-patch-translation references, not only the first on the line. +# But there is a bug in the gnome-patch-translation: Only first reference contain domain. +# Hopefully, the output is complete even with it. +sed -n 's%^#: $[^/]*$.*$%\1%p' gnome-patch-translation/gnome-patch-translation.pot | sort -u >${0%.sh}-gpt.lst + +# Process translations to get complete sets of strings. +cd po-full +for DOMAIN in * ; do + if grep -q "^$DOMAIN\$" ../${0%.sh}-gpt.lst ; then + SUPPORTS_GPT=true + else + SUPPORTS_GPT=false + fi + for PO in $DOMAIN/*.po ; do + LNG=${PO##*/} + LNG=${LNG%.po} + mkdir -p "../TRANSLATION_UPDATE/complete/translation-update/$DOMAIN/$LNG" + + if test -f "../po-mandatory-full/$PO" ; then + if $SUPPORTS_GPT && test -f "../gnome-patch-translation/$LNG.po" ; then + # mandatory strings take precedence over gnome-patch-translation, but gnome-patch-translation takes precedence over upstream. + msgcat --use-first "../po-mandatory-full/$PO" "../gnome-patch-translation/$LNG.po" "$PO" -o "../TRANSLATION_UPDATE/complete/translation-update/$DOMAIN/$LNG/$LNG.po.p1" + # There are mandatory strings. We must update. + mkdir -p "../TRANSLATION_UPDATE/complete/stamp-force/$DOMAIN" + echo "po-mandatory-full/$PO" >"../TRANSLATION_UPDATE/complete/stamp-force/$DOMAIN/$LNG" + else + msgcat --use-first "../po-mandatory-full/$PO" "$PO" -o "../TRANSLATION_UPDATE/complete/translation-update/$DOMAIN/$LNG/$LNG.po" + # There are mandatory strings. We must update. + mkdir -p "../TRANSLATION_UPDATE/complete/stamp-force/$DOMAIN" + touch "../TRANSLATION_UPDATE/complete/stamp-force/$DOMAIN/$LNG" + fi + else + if $SUPPORTS_GPT && test -f "../gnome-patch-translation/$LNG.po" ; then + msgcat --use-first "../gnome-patch-translation/$LNG.po" "$PO" -o "../TRANSLATION_UPDATE/complete/translation-update/$DOMAIN/$LNG/$LNG.po.p1" + # We don't know, whether strings from gnome-patch-translation were updated. There is no check yet. We must update. + mkdir -p "../TRANSLATION_UPDATE/complete/stamp-force/$DOMAIN" + echo "po-full/$PO" >"../TRANSLATION_UPDATE/complete/stamp-force/$DOMAIN/$LNG" + else + ln "$PO" "../TRANSLATION_UPDATE/complete/translation-update/$DOMAIN/$LNG/$LNG.po" + fi + fi + done +done + +cd ../po-mandatory-full +for DOMAIN in * ; do + if grep -q "^$DOMAIN\$" ../${0%.sh}-gpt.lst ; then + SUPPORTS_GPT=true + else + SUPPORTS_GPT=false + fi + for PO in $DOMAIN/*.po ; do + LNG=${PO##*/} + LNG=${LNG%.po} + # There are mandatory strings. We must update. + mkdir -p "../TRANSLATION_UPDATE/complete/translation-update/$DOMAIN/$LNG" + # Handle only po files not processed above. + if ! test -f "../po-full/$PO" ; then + mkdir -p "../TRANSLATION_UPDATE/complete/stamp-force/$DOMAIN" + if $SUPPORTS_GPT -a -f "../gnome-patch-translation/$LNG.po" ; then + # mandatory strings take precedence over gnome-patch-translation, but gnome-patch-translation takes precedence over upstream. + msgcat --use-first "$PO" "../gnome-patch-translation/$LNG.po" -o "../TRANSLATION_UPDATE/complete/translation-update/$DOMAIN/$LNG/$LNG.po.p1" + echo "po-mandatory-full/$PO" >"../TRANSLATION_UPDATE/complete/stamp-force/$DOMAIN/$LNG" + else + ln "$PO" "../TRANSLATION_UPDATE/complete/translation-update/$DOMAIN/$LNG/$LNG.po" + touch "../TRANSLATION_UPDATE/complete/stamp-force/$DOMAIN/$LNG" + fi + fi + done +done + +# Finish processing of po files that included strings from gnome-patch-translation. +cd ../TRANSLATION_UPDATE/complete/translation-update +for POP1 in */*/*.po.p1 ; do + PO=${POP1%.p1} + DOMAIN=${PO%%/*} + LNG=${PO%/*} + LNG=${LNG#*/} + + # Include only gnome-patch-translation strings from particular domain. + msgmerge --no-fuzzy-matching "$POP1" ../../../pot/$DOMAIN.pot -o "$PO.p2" + msgattrib --no-obsolete "$PO.p2" -o "$PO.p3" + + # Put header from the most important source stored into stamp-force. + # Extract header. Broken pipe is an expected behavior. Redirect stderr to /dev/null. + msgmerge --quiet --force-po ../../../$(<"../stamp-force/$DOMAIN/$LNG") ../../../msgheadermerge-empty.pot -o "$PO.p4" + msgattrib --no-obsolete --force-po "$PO.p4" -o "$PO.p5" + msgcat --use-first --force-po "$PO.p5" "$PO.p3" -o "$PO" + + rm "$PO.p"* +done + cd ../.. +# Now create a copy of all files to TUU (they will be moved later to particular directories). +cp -al complete/translation-update/* TUU/ + +cd .. + osc ${OSC_APIURL:+--apiurl=$OSC_APIURL} ls "${OSC_REPOSITORIES[OSC_MAIN_INDEX]}" >${0%.sh}-rebuilt.lst if test -n "$OSC_PROPOSED_INDEX" ; then osc ${OSC_APIURL:+--apiurl=$OSC_APIURL} ls "${OSC_REPOSITORIES[OSC_PROPOSED_INDEX]}" >${0%.sh}-outdated.lst @@ -52,7 +153,6 @@ echo -n '' >${0%.sh}-outdated.lst fi -SERIAL=0 for TLST in *.tlst ; do exec <$WORK_DIR/$TLST @@ -86,20 +186,14 @@ case $STATUS in OK*) echo " domain $REAL_DOMAIN is correctly updated, OK" - if test -d TRANSLATION_UPDATE/TUU/po/$REAL_DOMAIN ; then - mv TRANSLATION_UPDATE/TUU/po/$REAL_DOMAIN TRANSLATION_UPDATE/UPDATED/po/ - fi - if test -d TRANSLATION_UPDATE/TUU/po-mandatory/$REAL_DOMAIN ; then - mv TRANSLATION_UPDATE/TUU/po-mandatory/$REAL_DOMAIN TRANSLATION_UPDATE/UPDATED/po-mandatory/ + if test -d TRANSLATION_UPDATE/TUU/$REAL_DOMAIN ; then + mv TRANSLATION_UPDATE/TUU/$REAL_DOMAIN TRANSLATION_UPDATE/UPDATED/ fi ;; *) echo " domain $REAL_DOMAIN is not correctly updated, needs to be added" - if test -d TRANSLATION_UPDATE/TUU/po/$REAL_DOMAIN ; then - mv TRANSLATION_UPDATE/TUU/po/$REAL_DOMAIN TRANSLATION_UPDATE/NOT_UPDATED/po/ - fi - if test -d TRANSLATION_UPDATE/TUU/po-mandatory/$REAL_DOMAIN ; then - mv TRANSLATION_UPDATE/TUU/po-mandatory/$REAL_DOMAIN TRANSLATION_UPDATE/NOT_UPDATED/po-mandatory/ + if test -d TRANSLATION_UPDATE/TUU/$REAL_DOMAIN ; then + mv TRANSLATION_UPDATE/TUU/$REAL_DOMAIN TRANSLATION_UPDATE/NOT_UPDATED/ fi ;; esac @@ -109,11 +203,8 @@ cat ${0%translation-update-upstream-to-translation-update.sh}upstream-collect.domain-map | while read PACKAGE_ REAL_DOMAIN STATUS ; do if test "$PACKAGE" = "$PACKAGE_" ; then - if test -d TRANSLATION_UPDATE/TUU/po/$REAL_DOMAIN ; then - mv TRANSLATION_UPDATE/TUU/po/$REAL_DOMAIN TRANSLATION_UPDATE/NOT_UPDATED/po/ - fi - if test -d TRANSLATION_UPDATE/TUU/po-mandatory/$REAL_DOMAIN ; then - mv TRANSLATION_UPDATE/TUU/po-mandatory/$REAL_DOMAIN TRANSLATION_UPDATE/NOT_UPDATED/po-mandatory/ + if test -d TRANSLATION_UPDATE/TUU/$REAL_DOMAIN ; then + mv TRANSLATION_UPDATE/TUU/$REAL_DOMAIN TRANSLATION_UPDATE/NOT_UPDATED/ fi fi done @@ -125,81 +216,48 @@ # If files remain in TUU, there is something wrong. Move them to NOT_UPDATED and hope that domain is correct. # It can happen when domain mapping process failed. cd TRANSLATION_UPDATE/TUU -for DIR in */* ; do - if test "${DIR%/*}" = "po" ; then - MANDATORY=false - else - MANDATORY=true - fi - echo "$(tput setf 4)Something went wrong, domain=${DIR#*/} mandatory=$MANDATORY was not listed and processed$(tput init)" +for DIR in * ; do + echo "$(tput setf 4)Something went wrong, domain=${DIR#*/} was not listed and processed$(tput init)" echo " assuming that it was not updated" mv $DIR ../NOT_UPDATED/$DIR done -cd ../../TRANSLATION_UPDATE/NOT_UPDATED/po -for PO in */*.po ; do - LNG=${PO##*/} - LNG=${LNG%.po} - mkdir -p "../../complete/translation-update/${PO%/*}/$LNG" - if test -f "../po-mandatory/$PO" ; then - msgcat --use-first "../po-mandatory/$PO" "$PO" -o "../../complete/translation-update/${PO%/*}/$LNG/${PO##*/}" - else - ln "$PO" "../../complete/translation-update/${PO%/*}/$LNG/${PO##*/}" - fi +cd ../NOT_UPDATED +for PO in */*/*.po ; do + DOMAIN=${PO%%/*} + LNG=${PO%/*} + LNG=${LNG#*/} # Standard update: Pick only files with changes. - if grep -q "^po/$PO\$" ../../../${0%.sh}-updates.lst ; then - mkdir -p "../../translation-update/${PO%/*}/$LNG" - ln "../../complete/translation-update/${PO%/*}/$LNG/${PO##*/}" "../../translation-update/${PO%/*}/$LNG/${PO##*/}" + if grep -q "^po/$DOMAIN/$LNG.po\$" ../../${0%.sh}-updates.lst ; then + mkdir -p "../translation-update/$DOMAIN/$LNG" + ln "../complete/translation-update/$PO" "../translation-update/$PO" fi -done -cd ../po-mandatory -for PO in */*.po ; do - LNG=${PO##*/} - LNG=${LNG%.po} # Mandatory update: Pick all files. - if ! test -f "../../complete/translation-update/${PO%/*}/$LNG/${PO##*/}" ; then - mkdir -p "../../complete/translation-update/${PO%/*}/$LNG" - ln "$PO" "../../complete/translation-update/${PO%/*}/$LNG/${PO##*/}" - fi - if ! test -f "../../translation-update/${PO%/*}/$LNG/${PO##*/}" ; then - mkdir -p "../../translation-update/${PO%/*}/$LNG" - ln "../../complete/translation-update/${PO%/*}/$LNG/${PO##*/}" "../../translation-update/${PO%/*}/$LNG/${PO##*/}" - fi -done -cd ../../../TRANSLATION_UPDATE/UPDATED/po -for PO in */*.po ; do - LNG=${PO##*/} - LNG=${LNG%.po} - mkdir -p "../../complete/translation-update/${PO%/*}/$LNG" - if test -f "../po-mandatory/$PO" ; then - msgcat --use-first "../po-mandatory/$PO" "$PO" -o "../../complete/translation-update/${PO%/*}/$LNG/${PO##*/}" - else - ln "$PO" "../../complete/translation-update/${PO%/*}/$LNG/${PO##*/}" + if test -f "../complete/stamp-force/$DOMAIN/$LNG" ; then + mkdir -p "../translation-update/$DOMAIN/$LNG" + ln -f "../complete/translation-update/$PO" "../translation-update/$PO" fi +done +cd ../UPDATED +for PO in */*/*.po ; do + DOMAIN=${PO%%/*} + LNG=${PO%/*} + LNG=${LNG#*/} # Standard update: Pick only files with changes. - if grep -q "^po/$PO\$" ../../../${0%.sh}-updates.lst ; then - mkdir -p "../../rebuilt/translation-update/${PO%/*}/$LNG" - ln "../../complete/translation-update/${PO%/*}/$LNG/${PO##*/}" "../../rebuilt/translation-update/${PO%/*}/$LNG/${PO##*/}" + if grep -q "^po/$DOMAIN/$LNG.po\$" ../../${0%.sh}-updates.lst ; then + mkdir -p "../rebuilt/translation-update/$DOMAIN/$LNG" + ln "../complete/translation-update/$PO" "../rebuilt/translation-update/$PO" fi -done -cd ../po-mandatory -for PO in */*.po ; do - LNG=${PO##*/} - LNG=${LNG%.po} # Mandatory update: Pick all files. - if ! test -f "../../complete/translation-update/${PO%/*}/$LNG/${PO##*/}" ; then - mkdir -p "../../complete/translation-update/${PO%/*}/$LNG" - ln "$PO" "../../complete/translation-update/${PO%/*}/$LNG/${PO##*/}" - fi - if ! test -f "../../rebuilt/translation-update/${PO%/*}/$LNG/${PO##*/}" ; then - mkdir -p "../../rebuilt/translation-update/${PO%/*}/$LNG" - ln "../../complete/translation-update/${PO%/*}/$LNG/${PO##*/}" "../../rebuilt/translation-update/${PO%/*}/$LNG/${PO##*/}" + if test -f "../complete/stamp-force/$DOMAIN/$LNG" ; then + mkdir -p "../rebuilt/translation-update/$DOMAIN/$LNG" + ln -f "../complete/translation-update/$PO" "../rebuilt/translation-update/$PO" fi done -cd ../.. +cd .. tar -jcf ../translation-update-from-translation-update-upstream-$SNAPSHOT.tar.bz2 translation-update echo "Generated translation-update-from-translation-update-upstream-$SNAPSHOT.tar.bz2 Please add it to the package translation-update" ++++++ upstream-collect.sh ++++++ --- /var/tmp/diff_new_pack.zP8mGo/_old 2014-05-22 20:37:48.000000000 +0200 +++ /var/tmp/diff_new_pack.zP8mGo/_new 2014-05-22 20:37:48.000000000 +0200 @@ -8,6 +8,11 @@ # Debug mode. Set to true if you want to keep working directories. DEBUG=false +# Incremental mode. With exception of bootstrapping or resetting the memory, it should be true. +# Non-incremental update cannot process a single package. +# FIXME: The incremental mode does not drop obsolete packages. You +# need to delete them manually afterwards using time stamp. +INCREMENTAL=true # Set to false to generate only pot files, true to collect po files. COLLECT_UPSTREAM=true # Number of CPUs. When > 1, then parallel processing of more po files is possible. @@ -100,7 +105,7 @@ rm -rf UPSTREAM mkdir UPSTREAM if ! test -d STAMPS ; then - mkdir -p pot pot-tuu pot-diff po-full po-mandatory-full + mkdir -p pot pot-tuu pot-diff mkdir OSC PACKAGES UPDATE STAMPS rm -f upstream-collect.log rm -f upstream-collect.domain-map.tmp @@ -144,7 +149,7 @@ export PATH=~/.upstream-collect.tmp:$PATH -if ! $FULL_PROCESS ; then +if $INCREMENTAL ; then # more tarballs are available => use the latest one # FIXME: Fix 20090213.10 < 20090213.9 # (but it should not happen for people who update and submit) @@ -153,44 +158,50 @@ done if ! test -f STAMPS/UPDATE_old_tarball ; then cd UPDATE + echo "$(tput setf 3)Unpacking: $ARCHIVE$(tput init)" tar -jxf ../$ARCHIVE # If it is not a full process, increment only release # SNAPSHOT 20090213 -> 20090213.1, 20090213.1 -> 20090213.2 cd .. touch STAMPS/UPDATE_old_tarball fi - SNAPSHOT=${ARCHIVE#translation-update-upstream-} - SNAPSHOT=${SNAPSHOT%.tar.bz2} - SNAPSHOT_PART1=${SNAPSHOT%.*} - SNAPSHOT_PART2=${SNAPSHOT#*.} - if test "$SNAPSHOT_PART1" = "$SNAPSHOT" ; then - SNAPSHOT_PART2=1 + SNAPSHOT_RELEASE=${ARCHIVE#translation-update-upstream-} + SNAPSHOT_RELEASE=${SNAPSHOT_RELEASE%.tar.bz2} + SNAPSHOT_RELEASE_PART1=${SNAPSHOT_RELEASE%.*} + SNAPSHOT_RELEASE_PART2=${SNAPSHOT_RELEASE#*.} + if test "$SNAPSHOT_RELEASE_PART1" = "$SNAPSHOT_RELEASE" ; then + SNAPSHOT_RELEASE_PART2=1 else - let SNAPSHOT_PART2++ + let SNAPSHOT_RELEASE_PART2++ fi - SNAPSHOT=$SNAPSHOT_PART1.$SNAPSHOT_PART2 + SNAPSHOT_RELEASE=$SNAPSHOT_RELEASE_PART1.$SNAPSHOT_RELEASE_PART2 for ARCHIVE_ in translation-update-mandatory-*.tar.bz2 ; do ARCHIVE=$ARCHIVE_ done if ! test -f STAMPS/UPDATE_old_mtarball ; then cd UPDATE + echo "$(tput setf 3)Unpacking: $ARCHIVE$(tput init)" tar -jxf ../$ARCHIVE # If it is not a full process, increment only release # SNAPSHOT 20090213 -> 20090213.1, 20090213.1 -> 20090213.2 cd .. touch STAMPS/UPDATE_old_mtarball fi - MSNAPSHOT=${ARCHIVE#translation-update-mandatory-} - MSNAPSHOT=${MSNAPSHOT%.tar.bz2} - SNAPSHOT_PART1=${MSNAPSHOT%.*} - SNAPSHOT_PART2=${MSNAPSHOT#*.} - if test "$SNAPSHOT_PART1" = "$MSNAPSHOT" ; then - SNAPSHOT_PART2=1 + MSNAPSHOT_RELEASE=${ARCHIVE#translation-update-mandatory-} + MSNAPSHOT_RELEASE=${MSNAPSHOT_RELEASE%.tar.bz2} + SNAPSHOT_RELEASE_PART1=${MSNAPSHOT_RELEASE%.*} + SNAPSHOT_RELEASE_PART2=${MSNAPSHOT_RELEASE#*.} + if test "$SNAPSHOT_RELEASE_PART1" = "$MSNAPSHOT_RELEASE" ; then + SNAPSHOT_RELEASE_PART2=1 else - let SNAPSHOT_PART2++ + let SNAPSHOT_RELEASE_PART2++ fi - MSNAPSHOT=$SNAPSHOT_PART1.$SNAPSHOT_PART2 + MSNAPSHOT_RELEASE=$SNAPSHOT_RELEASE_PART1.$SNAPSHOT_RELEASE_PART2 +fi +if ! $FULL_PROCESS ; then + SNAPSHOT=$SNAPSHOT_RELEASE + MSNAPSHOT=$MSNAPSHOT_RELEASE fi SERIAL=0 @@ -322,6 +333,8 @@ echo >>$WORK_DIR/upstream-collect.log "package=$PACKAGE domain=$DOMAIN method=$METHOD repository=$REPO directory=$DIR branch=${BRANCH:(default)}: pot file update error, no way to update" STATUS=POT_ERROR mkdir -p $WORK_DIR/STAMPS/$PACKAGE/$DOMAIN/$METHOD/${REPO//[\/:.]/_}/$REPODIR/${BRANCH:-__HEAD__} + # However we cannot do anything, build dir is successfully processed. + touch $WORK_DIR/STAMPS/$PACKAGE/.builddir_ok continue fi fi @@ -338,6 +351,8 @@ echo >>$WORK_DIR/upstream-collect.log "package=$PACKAGE domain=$DOMAIN method=$METHOD repository=$REPO directory=$DIR branch=${BRANCH:(default)}: packaging error, package does not call translation-update-upstream properly and intltool-update fails, no way to update" STATUS=TUU_BROKEN mkdir -p $WORK_DIR/STAMPS/$PACKAGE/$DOMAIN/$METHOD/${REPO//[\/:.]/_}/$REPODIR/${BRANCH:-__HEAD__} + # However we cannot do anything, build dir is successfully processed. + touch $WORK_DIR/STAMPS/$PACKAGE/.builddir_ok continue fi fi @@ -388,7 +403,7 @@ CGIT_BRANCH=${BRANCH:+?id=$BRANCH} CGIT_SERVER=${CGIT_URI#http://} CGIT_SERVER=${CGIT_SERVER%%/*} - curl $CGIT_URI/tree/${REPODIR#*/}$CGIT_BRANCH | sed -n 's:^.*src="/icons/text\.gif" .* href="$[^"]*$".*$:\1:p' | + curl $CGIT_URI/tree/${REPODIR#*/}$CGIT_BRANCH | sed -n 's:^.*class='\''ls-blob[^'\'']*'\'' href='\''$[^'\'']*$'\''.*$:\1:p' | while read ; do wget -N http://$CGIT_SERVER${REPLY/\/tree\///plain/} done -- To unsubscribe, e-mail: opensuse-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-commit+help(a)opensuse.org

1 0

commit screen for openSUSE:Factory
by root＠hilbert.suse.de 22 May '14

22 May '14

Hello community, here is the log from the commit of package screen for openSUSE:Factory checked in at 2014-05-22 20:37:31 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/screen (Old) and /work/SRC/openSUSE:Factory/.screen.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "screen" Changes: -------- --- /work/SRC/openSUSE:Factory/screen/screen.changes 2014-04-30 15:00:40.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.screen.new/screen.changes 2014-05-22 20:37:44.000000000 +0200 @@ -1,0 +2,17 @@ +Fri May 2 19:42:12 UTC 2014 - andreas.stieger(a)gmx.de + +- GNU screen 4.2.1: + * allow for terminal with long $TERM (up to 32 characters) + (already patched in this package previously) + * allow to use long logins + * documentation fixes + * runtime fixes +- packaging changes: + * use source URLs + * verify source signatures + * drop screen-man-loginshell.diff, equivalent change upstream + * drop term_too_long.diff, equivalent change upstream + * drop use_locale.diff, applied upstream + * drop msg_version_3.patch, obsolete after upstream changes + +------------------------------------------------------------------- Old: ---- msg_version_3.patch screen-4.2.0.tar.gz screen-man-loginshell.diff term_too_long.diff use_locale.diff New: ---- screen-4.2.1.tar.gz screen-4.2.1.tar.gz.sig screen.keyring ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ screen.spec ++++++ --- /var/tmp/diff_new_pack.YaaBEp/_old 2014-05-22 20:37:46.000000000 +0200 +++ /var/tmp/diff_new_pack.YaaBEp/_new 2014-05-22 20:37:46.000000000 +0200 @@ -38,25 +38,23 @@ BuildRequires: automake PreReq: %install_info_prereq PreReq: coreutils -Version: 4.2.0 +Version: 4.2.1 Release: 0 Summary: A program to allow multiple screens on a VT100/ANSI Terminal License: GPL-2.0+ Group: System/Console -Source: %{name}-%{version}.tar.gz +Source: http://ftp.gnu.org/gnu/screen/%{name}-%{version}.tar.gz Source1: screen.conf +Source2: http://ftp.gnu.org/gnu/screen/%{name}-%{version}.tar.gz.sig +Source3: https://savannah.gnu.org/project/memberlist-gpgkeys.php?group=screen&downlo… Patch0: global_screenrc.patch -Patch2: screen-man-loginshell.diff Patch3: screen-4.0.3-ipv6.patch # upstream savannah#30880 -Patch4: term_too_long.diff Patch5: sort_command.patch Patch6: libtinfo.diff -Patch9: use_locale.diff Patch10: screen-poll-zombies.patch Patch11: xX_string_escape.patch Patch12: screen_enhance_windows_list.patch -Patch13: msg_version_3.patch BuildRoot: %{_tmppath}/%{name}-%{version}-build %description @@ -70,26 +68,18 @@ %setup # global_screenrc.patch %patch0 -# screen-man-loginshell.diff -%patch2 -p1 # screen-4.0.3-ipv6.patch %patch3 -# term_too_long.diff -%patch4 -p1 # sort_command.patch %patch5 # libtinfo.diff %patch6 -# use_locale.diff -%patch9 -p1 # screen-poll-zombies.patch %patch10 -p1 # xX_string_escape.patch %patch11 # screen_enhance_windows_list.patch %patch12 -# msg_version_3.patch -%patch13 -p1 %build sh ./autogen.sh ++++++ screen-4.2.0.tar.gz -> screen-4.2.1.tar.gz ++++++ ++++ 39973 lines of diff (skipped) -- To unsubscribe, e-mail: opensuse-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-commit+help(a)opensuse.org

1 0

commit binutils for openSUSE:Factory
by root＠hilbert.suse.de 22 May '14

22 May '14

Hello community, here is the log from the commit of package binutils for openSUSE:Factory checked in at 2014-05-22 20:37:30 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/binutils (Old) and /work/SRC/openSUSE:Factory/.binutils.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "binutils" Changes: -------- --- /work/SRC/openSUSE:Factory/binutils/binutils.changes 2014-04-08 11:31:18.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.binutils.new/binutils.changes 2014-05-22 20:37:31.000000000 +0200 @@ -1,0 +2,6 @@ +Tue May 6 14:02:26 UTC 2014 - rguenther(a)suse.com + +- binutils-2.24-bso16746.diff: Fix bso#16746, spurious warnings + for warn annotated symbols with LTO. + +------------------------------------------------------------------- cross-aarch64-binutils.changes: same change cross-arm-binutils.changes: same change cross-avr-binutils.changes: same change cross-hppa-binutils.changes: same change cross-hppa64-binutils.changes: same change cross-i386-binutils.changes: same change cross-ia64-binutils.changes: same change cross-m68k-binutils.changes: same change cross-mips-binutils.changes: same change cross-ppc-binutils.changes: same change cross-ppc64-binutils.changes: same change cross-ppc64le-binutils.changes: same change cross-s390-binutils.changes: same change cross-s390x-binutils.changes: same change cross-sparc-binutils.changes: same change cross-sparc64-binutils.changes: same change cross-spu-binutils.changes: same change cross-x86_64-binutils.changes: same change New: ---- binutils-2.24-bso16746.diff ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ binutils.spec ++++++ --- /var/tmp/diff_new_pack.KYyBzp/_old 2014-05-22 20:37:41.000000000 +0200 +++ /var/tmp/diff_new_pack.KYyBzp/_new 2014-05-22 20:37:41.000000000 +0200 @@ -99,6 +99,7 @@ Patch23: pie-m68k.patch Patch24: binutils-2.24-auto-plugin.diff Patch25: ld-testsuite.patch +Patch26: binutils-2.24-bso16746.diff Patch90: cross-avr-nesc-as.patch Patch92: cross-avr-omit_section_dynsym.patch Patch93: cross-avr-size.patch @@ -172,6 +173,7 @@ %patch23 -p1 %patch24 -p1 %patch25 -p1 +%patch26 -p1 %if "%{TARGET}" == "avr" cp gas/config/tc-avr.h gas/config/tc-avr-nesc.h %patch90 ++++++ cross-aarch64-binutils.spec ++++++ --- /var/tmp/diff_new_pack.KYyBzp/_old 2014-05-22 20:37:41.000000000 +0200 +++ /var/tmp/diff_new_pack.KYyBzp/_new 2014-05-22 20:37:41.000000000 +0200 @@ -102,6 +102,7 @@ Patch23: pie-m68k.patch Patch24: binutils-2.24-auto-plugin.diff Patch25: ld-testsuite.patch +Patch26: binutils-2.24-bso16746.diff Patch90: cross-avr-nesc-as.patch Patch92: cross-avr-omit_section_dynsym.patch Patch93: cross-avr-size.patch @@ -175,6 +176,7 @@ %patch23 -p1 %patch24 -p1 %patch25 -p1 +%patch26 -p1 %if "%{TARGET}" == "avr" cp gas/config/tc-avr.h gas/config/tc-avr-nesc.h %patch90 cross-arm-binutils.spec: same change cross-avr-binutils.spec: same change cross-hppa-binutils.spec: same change cross-hppa64-binutils.spec: same change cross-i386-binutils.spec: same change cross-ia64-binutils.spec: same change cross-m68k-binutils.spec: same change cross-mips-binutils.spec: same change cross-ppc-binutils.spec: same change cross-ppc64-binutils.spec: same change cross-ppc64le-binutils.spec: same change cross-s390-binutils.spec: same change cross-s390x-binutils.spec: same change cross-sparc-binutils.spec: same change cross-sparc64-binutils.spec: same change cross-spu-binutils.spec: same change cross-x86_64-binutils.spec: same change ++++++ binutils-2.24-bso16746.diff ++++++ commit 26c2ff33f8fcd57d52194a159226b639a4fee00c Author: H.J. Lu <hjl.tools(a)gmail.com> Date: Tue Mar 25 13:33:51 2014 -0700 Don't issue a warning for reference in LTO IR References in LTO IR may be removed by LTO later. Instead, make a warning symbol if needed. Warnings will be handled after LTO resolves all references. bfd/ PR ld/16746 * linker.c (_bfd_generic_link_add_one_symbol): Don't issue a warning for reference in LTO IR which may be removed by LTO later. ld/testsuite/ PR ld/16746 * ld-plugin/lto.exp: Add 4 tests for PR ld/16746. * ld-plugin/pr16746a.c: New file. * ld-plugin/pr16746b.c: Likewise. * ld-plugin/pr16746c.c: Likewise. * ld-plugin/pr16746d.c: Likewise. Index: binutils-2.24/bfd/linker.c =================================================================== --- binutils-2.24.orig/bfd/linker.c 2014-05-06 16:08:45.649990914 +0200 +++ binutils-2.24/bfd/linker.c 2014-05-06 16:08:49.819990627 +0200 @@ -1904,8 +1904,10 @@ _bfd_generic_link_add_one_symbol (struct break; case WARNC: - /* Issue a warning and cycle. */ - if (h->u.i.warning != NULL) + /* Issue a warning and cycle. Don't issue a warning for + reference in LTO IR which may be removed by LTO later. */ + if (h->u.i.warning != NULL + && (abfd->flags & BFD_PLUGIN) == 0) { if (! (*info->callbacks->warning) (info, h->u.i.warning, h->root.string, abfd, @@ -1930,6 +1932,11 @@ _bfd_generic_link_add_one_symbol (struct break; case WARN: + /* Don't issue a warning for reference in LTO IR which may be + removed by LTO later. Make a warning symbol instead. */ + if ((hash_entry_bfd (h)->flags & BFD_PLUGIN) != 0) + goto mwarn; + /* Issue a warning. */ if (! (*info->callbacks->warning) (info, string, h->root.string, hash_entry_bfd (h), NULL, 0)) @@ -1951,6 +1958,7 @@ _bfd_generic_link_add_one_symbol (struct } /* Fall through. */ case MWARN: +mwarn: /* Make a warning symbol. */ { struct bfd_link_hash_entry *sub; Index: binutils-2.24/ld/testsuite/ld-plugin/lto.exp =================================================================== --- binutils-2.24.orig/ld/testsuite/ld-plugin/lto.exp 2014-05-06 16:08:45.649990914 +0200 +++ binutils-2.24/ld/testsuite/ld-plugin/lto.exp 2014-05-06 16:10:14.334984808 +0200 @@ -206,6 +206,18 @@ set lto_link_elf_tests { {"Build libpr15146d.a" "" "-flto -O2" {pr15146d.c} {} "lib15146d.a"} + {"Build libpr16746a.a" + "" "" + {pr16746a.c pr16746b.c} {} "lib16746a.a"} + {"Build libpr16746b.a" + "" "-O2 -flto" + {pr16746c.c pr16746d.c} {} "lib16746b.a"} + {"PR ld/16746 (1)" + "-O2 -flto -fuse-linker-plugin tmpdir/pr16746a.o tmpdir/pr16746c.o" "-O2 -flto" + {dummy.c} {} "pr16746a.exe"} + {"PR ld/16746 (2)" + "-O2 -flto -fuse-linker-plugin tmpdir/pr16746c.o tmpdir/pr16746a.o" "-O2 -flto" + {dummy.c} {} "pr16746b.exe"} } # Check final symbols in executables. @@ -309,6 +321,20 @@ if { [is_elf_format] pass $testname } { fail $testname + } + set testname "PR ld/16746 (3)" + set exec_output [run_host_cmd "$CC" "$gcc_gas_flag $gcc_ld_flag -O2 -flto -fuse-linker-plugin tmpdir/pr16746b.o tmpdir/pr16746d.o"] + if { [ regexp "warning: foobar" $exec_output ] && ![ regexp "symbol from plugin" $exec_output ] } { + pass $testname + } { + fail $testname + } + set testname "PR ld/16746 (4)" + set exec_output [run_host_cmd "$CC" "$gcc_gas_flag $gcc_ld_flag -O2 -flto -fuse-linker-plugin tmpdir/pr16746d.o tmpdir/pr16746b.o"] + if { [ regexp "warning: foobar" $exec_output ] && ![ regexp "symbol from plugin" $exec_output ] } { + pass $testname + } { + fail $testname } } Index: binutils-2.24/ld/testsuite/ld-plugin/pr16746a.c =================================================================== --- /dev/null 1970-01-01 00:00:00.000000000 +0000 +++ binutils-2.24/ld/testsuite/ld-plugin/pr16746a.c 2014-05-06 16:08:49.819990627 +0200 @@ -0,0 +1,3 @@ +static const char __evoke_link_warning_foobar[] + __attribute__ ((used, section (".gnu.warning.foobar\n\t#"))) + = "foobar"; Index: binutils-2.24/ld/testsuite/ld-plugin/pr16746b.c =================================================================== --- /dev/null 1970-01-01 00:00:00.000000000 +0000 +++ binutils-2.24/ld/testsuite/ld-plugin/pr16746b.c 2014-05-06 16:08:49.820990627 +0200 @@ -0,0 +1,5 @@ +static const char __evoke_link_warning_foobar[] + __attribute__ ((used, section (".gnu.warning.foobar\n\t#"))) + = "foobar"; + +void foobar (void) {} Index: binutils-2.24/ld/testsuite/ld-plugin/pr16746c.c =================================================================== --- /dev/null 1970-01-01 00:00:00.000000000 +0000 +++ binutils-2.24/ld/testsuite/ld-plugin/pr16746c.c 2014-05-06 16:08:49.820990627 +0200 @@ -0,0 +1,8 @@ +extern void foobar (void); +int +main (int argc, char **argv) +{ + if (__builtin_constant_p (argc)) + foobar (); + return 0; +} Index: binutils-2.24/ld/testsuite/ld-plugin/pr16746d.c =================================================================== --- /dev/null 1970-01-01 00:00:00.000000000 +0000 +++ binutils-2.24/ld/testsuite/ld-plugin/pr16746d.c 2014-05-06 16:08:49.820990627 +0200 @@ -0,0 +1,8 @@ +extern void foobar (void); +int +main (int argc, char **argv) +{ + if (!__builtin_constant_p (argc)) + foobar (); + return 0; +} -- To unsubscribe, e-mail: opensuse-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-commit+help(a)opensuse.org

1 0

commit rpmlint-Factory for openSUSE:Factory
by root＠hilbert.suse.de 22 May '14

22 May '14

Hello community, here is the log from the commit of package rpmlint-Factory for openSUSE:Factory checked in at 2014-05-22 20:37:27 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/rpmlint-Factory (Old) and /work/SRC/openSUSE:Factory/.rpmlint-Factory.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "rpmlint-Factory" Changes: -------- --- /work/SRC/openSUSE:Factory/rpmlint-Factory/rpmlint-Factory.changes 2014-01-31 20:11:23.000000000 +0100 +++ /work/SRC/openSUSE:Factory/.rpmlint-Factory.new/rpmlint-Factory.changes 2014-05-22 20:37:28.000000000 +0200 @@ -1,0 +2,6 @@ +Tue May 6 07:54:52 UTC 2014 - lnussel(a)suse.de + +- make dir-or-file-in-var-run resp dir-or-file-in-var-lock fatal +- non-ghost-in-var-run renamed to non-ghost-in-run + +------------------------------------------------------------------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ config ++++++ --- /var/tmp/diff_new_pack.emlXx3/_old 2014-05-22 20:37:29.000000000 +0200 +++ /var/tmp/diff_new_pack.emlXx3/_new 2014-05-22 20:37:29.000000000 +0200 @@ -58,8 +58,9 @@ #fatal checks #setBadness('files-attr-not-set', 10000) -setBadness('non-ghost-in-var-run', 10000) -setBadness('non-ghost-in-var-lock', 10000) +setBadness('non-ghost-in-run', 10000) +setBadness('dir-or-file-in-var-run', 10000) +setBadness('dir-or-file-in-var-lock', 10000) setBadness('percent-in-dependency', 10000) setBadness('percent-in-obsoletes', 10000) setBadness('percent-in-provides', 10000) -- To unsubscribe, e-mail: opensuse-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-commit+help(a)opensuse.org

1 0

commit subversion for openSUSE:13.1:Update
by root＠hilbert.suse.de 22 May '14

22 May '14

Hello community, here is the log from the commit of package subversion for openSUSE:13.1:Update checked in at 2014-05-22 11:18:35 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:13.1:Update/subversion (Old) and /work/SRC/openSUSE:13.1:Update/.subversion.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "subversion" Changes: -------- New Changes file: NO CHANGES FILE!!! ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ _link ++++++ --- /var/tmp/diff_new_pack.fKN5Ws/_old 2014-05-22 11:18:36.000000000 +0200 +++ /var/tmp/diff_new_pack.fKN5Ws/_new 2014-05-22 11:18:36.000000000 +0200 @@ -1 +1 @@ -<link package='subversion.2557' cicount='copy' /> +<link package='subversion.2816' cicount='copy' /> -- To unsubscribe, e-mail: opensuse-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-commit+help(a)opensuse.org

1 0

commit subversion.2816 for openSUSE:13.1:Update
by root＠hilbert.suse.de 22 May '14

22 May '14

Hello community, here is the log from the commit of package subversion.2816 for openSUSE:13.1:Update checked in at 2014-05-22 11:18:28 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:13.1:Update/subversion.2816 (Old) and /work/SRC/openSUSE:13.1:Update/.subversion.2816.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "subversion.2816" Changes: -------- New Changes file: --- /dev/null 2014-05-19 01:51:27.372033255 +0200 +++ /work/SRC/openSUSE:13.1:Update/.subversion.2816.new/subversion.changes 2014-05-22 11:18:30.000000000 +0200 @@ -0,0 +1,3478 @@ +------------------------------------------------------------------- +Tue May 13 17:34:59 UTC 2014 - andreas.stieger(a)gmx.de + +- Apache Subversion 1.8.9 [bnc#877555] +- Client-side bugfixes: + * log: use proper peg revision over DAV + * upgrade: allow upgrading from 1.7 with exclusive locks + * proplist: resolve inconsitent inherited property results + * increase minimal timestamp sleep from 1ms to 10ms + * merge: automatic merge confused by subtree merge + * propget: report proper error on invalid revision for url + * commit: fix an assertion when committing a deleted descendant + * merge: resolve segfault when '--force' merges a directory + delete + * resolve: prevent interactive conflict resolution when nothing + has been done to resolve the conflict + * update: fix locks lost from wc with pre-1.6.17 servers + * merge: honor the 'preserved-conflict-file-exts' setting + * list: fix '--verbose' against older servers + * unlock: fix ability to remove locks with timeouts + * copy: fix 'svn copy URL WC' on relocated working copies + * export: allow file externals to be exported + * move: fix working copy db inconsistency in cert scenarios + * commit: fix an issue where mixed revision copy with non copy + descendants that shadow a not present node couldn't be committed + * delete: properly remove move_to info when the node in its + original location is removed + * status; fix an issue where output would vary based on if the + target was the node itself or its parent +- Server-side bugfixes: + * svnadmin dump: don't let invalid mergeinfo stop dump + * svnserve: resolve performance regression caused by iprops + * reduce size of memory buffer when reading config files + * remove dead transaction if commit was blocked by hook + * svnrdump load: fix crash when svn:* normalization + * fix memcached support + * svndumpfilter: fix order of node record headers + * mod_dav_svn: allow generic DAV clients to refresh locks + * mod_dav_svn: detect out of dateness correctly during commit +- Developer-visible changes: + * improve consistency checks of DAV inherited property requests + * fix ocassional failure in autoprop_tests.py + * avoid duplicate sqlite analyze information rows + * add Mavericks to our sysinfo output + * bump copyright years to 2014 + * unbreak test suite when running as root + * resolve buffer overflow in testcode + * fix libmagic detection with custom LDFLAGS + * fix an out of scope variable use in merge + * javahl: fix crash from resolve callback throwing an exception + * ruby: fix two memory lifetime bugs + * fix a missing null byte when handling old pre-1.4 deltas + * fix building with APR 0.9.x + * make svn_ra_get_locks() and svn_ra_get_lock() report not locked + nodes with a NULL svn_lock_t *, as documented + * fix tests for compiler flags +- Packaging changes: + * adds subversion-1.8.9-allow-httpd-2.4.6.patch to allow building + against blacklisted httpd 2.4.6 which has the required patches + * update subversion-no-build-date.patch for context changes + +------------------------------------------------------------------- +Thu Feb 20 23:44:35 UTC 2014 - andreas.stieger(a)gmx.de + +- Apache Subversion 1.8.8 + fix a remotely triggerable segfault in mod_dav_svn when svn is + handling the server root and SVNListParentPath is on + [bnc#862459] CVE-2014-0032 +- Client-side bugfixes: + * fix automatic relocate for wcs not at repository root + * wc: improve performance when used with SQLite 3.8 + * copy: fix some scenarios that broke the working copy + * move: fix errors when moving files between an external and the + parent working copy + * log: resolve performance regression in certain scenarios + * merge: decrease work to detect differences between 3 files + * commit: don't change file permissions inappropriately + * commit: fix assertion due to invalid pool lifetime + * version: don't cut off the distribution version on Linux + * flush stdout before exiting to avoid information being lost + * status: fix missing sentinel value on warning codes + * update/switch: improve some WC db queries that may return + incorrect results depending on how SQLite is built +- Server-side bugfixes: + * reduce memory usage during checkout and export + * fsfs: create rep-cache.db with proper permissions + * mod_dav_svn: prevent crashes with SVNListParentPath on + [bnc#862459] CVE-2014-0032 + * mod_dav_svn: fix SVNAllowBulkUpdates directive merging + * mod_dav_svn: include requested property changes in reports + * svnserve: correct default cache size in help text + * svnadmin dump: reduce size of dump files with '--deltas' + * resolve integer underflow that resulted in infinite loops +- developer visible changes: + * fix ocassional failure of check_tests.py 12 + * fix failure with SQLite 3.8.1-3.8.3 when built with + SQLITE_ENABLE_STAT3/4 due to bug in SQLite + * specify SQLite defaults that can be changed when SQLite is + built to avoid unexpected behavior with Subversion + * numerous documentation fixes + * svn_client_commit_item3_dup() fix pool lifetime issues + * ra_serf: properly ask multiple certificate validation providers + for acceptance of certificate failures + * release internal fs objects when closing commit editor + * svn_client_proplist4() don't call the callback multiple times + for the same path in order to deliver inherited properties +- Bindings: + * swig-pl: fix with --enable-sqlite-compatibility-version + * swig: fix building from tarball with an out-of-tree build +- removed patches: + * subversion-1.8.x-fix-ppc-tests.patch, committed upstream +- packaging changes: + * only require and build with junit when building with java and + running regression tests +- 1.8.6 and 1.8.7 were not released + +------------------------------------------------------------------- +Mon Nov 25 00:00:00 UTC 2013 - andreas.stieger(a)gmx.de + +- update to 1.8.5 [bnc#850747] + - Client-side bugfixes: + * fix externals that point at redirected locations + * diff: fix assertion with move inside a copy + - Server-side bugfixes: + * mod_dav_svn: Prevent crashes with some 3rd party modules + * mod_dav_svn: canonicalize paths properly + * mod_authz_svn: fix crash of mod_authz_svn with invalid config + * hotcopy: fix hotcopy losing revprop files in packed repos + - Other tool improvements and bugfixes: + * mod_dontdothat: Fix the uri parser + - Developer-visible changes: + * fix compilation with '--enable-optimize' with clang + * add test to fail when built against broken ZLib + - Bindings: + * ctypes-python: build with compiler selected via configure +- require python-sqlite when running regression tests for all + targets, no longer pulled in implicitly +- print error logs on on regression test failures +- fix regression tests for ppc/ppc64 architectures, found in + openSUSE package build and fixed with upstream developers, adding + subversion-1.8.x-fix-ppc-tests.patch +- if running regression tests, also run them against bdb backend +- update keyring, use Subversion Project Management Committee + keyring rather than all committers + +------------------------------------------------------------------- +Tue Oct 29 18:27:53 UTC 2013 - andreas.stieger(a)gmx.de + +- update to 1.8.4 [bnc#847103] + - Client- and server-side bugfixes: + * fix assertion on urls of the form 'file://./' + * translation updates for Swedish + - Client-side bugfixes: + * revert: fix problems reverting moves + * update: fix assertion when file external access is denied + * merge: reduce network connections for automatic merge + * merge: fix path corruption during reintegration + * mergeinfo: fix crash + * ra_serf: verify the result of xml parsing + * ra_serf: improve error messages during commit + * ra_local: fix error with repository in Windows drive root + * fix crash on windows when piped command is interrupted + * fix assertion when upgrading old working copies + - Server-side bugfixes: + * hotcopy: cleanup unpacked revprops with '--incremental' + * fix OOM on concurrent requests at threaded server start + * fsfs: improve error message when unsupported fsfs format found + * fix memory problem in 3rd party FS module loader + - Developer-visible changes - Bindings: + * javahl: canonicalize path for streaFileContent method +- packaging changes: + * update keyring + +------------------------------------------------------------------- +Fri Aug 30 16:00:16 UTC 2013 - andreas.stieger(a)gmx.de + +- update to 1.8.3 + CVE-2013-4246: fsfs: corruption from editing packed revision properties + CVE-2013-4262: admin-side tools: symlink attack against pid file + CVE-2013-4277: svnserve: symlink attack against pid file +- User-visible changes: + - Client- and server-side bugfixes: + * translation updates for Swedish + * enforce strict version equality between tools and libraries + * consistently output revisions as "r%ld" in error messags + - Client-side bugfixes: + * status: always use absolute paths in XML output + * ra_serf: 'svn log -v' fails with a 1.2.x server + * ra_serf: fix crash when committing cp with deep deletion + * diff: issue an error for files that can't fit in memory + * svnmucc: generate proper error for mismatched URLs + * update: fix a crash when a temp file doesn't exist + * commit & update: improve sleep for timestamps performance + * diff: continue on missing or obstructing files + * ra_serf: use runtime serf version for User-Agent + * ra_serf: ignore case when checking certificate common names + * ra_serf: format distinguished names properly ++++ 3281 more lines (skipped) ++++ between /dev/null ++++ and /work/SRC/openSUSE:13.1:Update/.subversion.2816.new/subversion.changes New: ---- contrib-1485350.tar.bz2 sqlite-amalgamation-3071501.zip subversion-1.8.9-allow-httpd-2.4.6.patch subversion-1.8.9.tar.bz2 subversion-1.8.9.tar.bz2.asc subversion-no-build-date.patch subversion-swig-perl-install_vendor.patch subversion.README.SuSE subversion.changes subversion.conf subversion.keyring subversion.libtool-pie-flags.patch subversion.libtool-verbose.patch subversion.perl.LD_RUN_PATH.patch subversion.rcsvnserve subversion.rpmlintrc subversion.spec subversion.svndiff.sh subversion.svngrep.sh subversion.sysconfig.svnserve subversion.sysconfig.svnserve.remoteaccess subversion.xinetd.svnserve svnserve.service svnserve.tmpfiles swig-1.3.36.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ subversion.spec ++++++ ++++ 836 lines (skipped) ++++++ subversion-1.8.9-allow-httpd-2.4.6.patch ++++++ From: Andreas Stieger <andreas.stieger(a)gmx.de> Date: Wed, 07 May 2014 20:55:04 +0100 Subject: Allow building against blacklisted Apache httpd 2.4.6 References: [bnc#864308] Upstream: no Apache httpd in openSUSE 13.1 is 2.4.6. The mod_dav in this version is problematic for Apache Subversion and it is blacklisted in via configure macros in the 1.8.9 release of svn and up. The relevant patches have been applied to the apache2 package in openSUSE:13.1:Update and the update has been released, [bnc#864308]. This patch enables building Subversion against this fixed package. --- build/ac-macros/apache.m4 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Index: subversion-1.8.9/build/ac-macros/apache.m4 =================================================================== --- subversion-1.8.9.orig/build/ac-macros/apache.m4 2014-04-24 05:01:08.000000000 +0100 +++ subversion-1.8.9/build/ac-macros/apache.m4 2014-05-07 20:52:04.000000000 +0100 @@ -128,7 +128,7 @@ if test -n "$APXS" && test "$APXS" != "n AC_MSG_CHECKING([mod_dav version]) old_CPPFLAGS="$CPPFLAGS" CPPFLAGS="$CPPFLAGS $SVN_APR_INCLUDES" - blacklisted_versions_regex=["\"2\" \"\.\" (\"2\" \"\.\" \"25\"|\"4\" \"\.\" \"[56]\")"] + blacklisted_versions_regex=["\"2\" \"\.\" (\"2\" \"\.\" \"25\"|\"4\" \"\.\" \"[5]\")"] AC_EGREP_CPP([apache_version= *$blacklisted_versions_regex], [ #include "$APXS_INCLUDE/ap_release.h" ++++++ subversion-no-build-date.patch ++++++ From: Andreas Stieger <andreas.stieger(a)gmx.de> Date: Wed, 06 Mar 2013 00:05:08 +0000 Subject: Remove volatile build information Upstream: never Prevent unneccessary rebuilds of binary packages differing only by date, time and build host. --- subversion/bindings/javahl/tests/org/apache/subversion/javahl/BasicTests.java | 4 ++-- subversion/libsvn_subr/opt.c | 8 ++------ subversion/libsvn_subr/version.c | 4 ++-- subversion/tests/cmdline/getopt_tests_data/svn--version--verbose_stdout | 1 - subversion/tests/cmdline/getopt_tests_data/svn--version_stdout | 1 - 5 files changed, 6 insertions(+), 12 deletions(-) Index: subversion-1.8.9/subversion/bindings/javahl/tests/org/apache/subversion/javahl/BasicTests.java =================================================================== --- subversion-1.8.9.orig/subversion/bindings/javahl/tests/org/apache/subversion/javahl/BasicTests.java 2014-05-07 20:10:17.000000000 +0100 +++ subversion-1.8.9/subversion/bindings/javahl/tests/org/apache/subversion/javahl/BasicTests.java 2014-05-07 20:10:26.000000000 +0100 @@ -140,10 +140,10 @@ public class BasicTests extends SVNTests { VersionExtended vx = client.getVersionExtended(false); String result = vx.getBuildDate(); - if (result == null || result.trim().length() == 0) + if (result == null) throw new Exception("Build date empty"); result = vx.getBuildTime(); - if (result == null || result.trim().length() == 0) + if (result == null) throw new Exception("Build time empty"); result = vx.getBuildHost(); if (result == null || result.trim().length() == 0) Index: subversion-1.8.9/subversion/libsvn_subr/opt.c =================================================================== --- subversion-1.8.9.orig/subversion/libsvn_subr/opt.c 2014-05-07 20:10:17.000000000 +0100 +++ subversion-1.8.9/subversion/libsvn_subr/opt.c 2014-05-07 20:10:26.000000000 +0100 @@ -1114,12 +1114,8 @@ svn_opt__print_version_info(const char * if (quiet) return svn_cmdline_printf(pool, "%s\n", SVN_VER_NUMBER); - SVN_ERR(svn_cmdline_printf(pool, _("%s, version %s\n" - " compiled %s, %s on %s\n\n"), - pgm_name, SVN_VERSION, - svn_version_ext_build_date(info), - svn_version_ext_build_time(info), - svn_version_ext_build_host(info))); + SVN_ERR(svn_cmdline_printf(pool, _("%s, version %s\n\n"), + pgm_name, SVN_VERSION)); SVN_ERR(svn_cmdline_printf(pool, "%s\n", svn_version_ext_copyright(info))); if (footer) Index: subversion-1.8.9/subversion/libsvn_subr/version.c =================================================================== --- subversion-1.8.9.orig/subversion/libsvn_subr/version.c 2014-05-07 20:10:17.000000000 +0100 +++ subversion-1.8.9/subversion/libsvn_subr/version.c 2014-05-07 20:10:26.000000000 +0100 @@ -132,8 +132,8 @@ svn_version_extended(svn_boolean_t verbo { svn_version_extended_t *info = apr_pcalloc(pool, sizeof(*info)); - info->build_date = __DATE__; - info->build_time = __TIME__; + info->build_date = ""; + info->build_time = ""; info->build_host = SVN_BUILD_HOST; info->copyright = apr_pstrdup (pool, _("Copyright (C) 2014 The Apache Software Foundation.\n" Index: subversion-1.8.9/subversion/tests/cmdline/getopt_tests_data/svn--version--verbose_stdout =================================================================== --- subversion-1.8.9.orig/subversion/tests/cmdline/getopt_tests_data/svn--version--verbose_stdout 2014-05-07 20:10:17.000000000 +0100 +++ subversion-1.8.9/subversion/tests/cmdline/getopt_tests_data/svn--version--verbose_stdout 2014-05-07 20:10:26.000000000 +0100 @@ -1,5 +1,4 @@ svn, version 1.8.0-dev (under development) - compiled Sep 10 2012, 14:00:24 on i386-apple-darwin11.4.0 Copyright (C) 2012 The Apache Software Foundation. This software consists of contributions made by many people; Index: subversion-1.8.9/subversion/tests/cmdline/getopt_tests_data/svn--version_stdout =================================================================== --- subversion-1.8.9.orig/subversion/tests/cmdline/getopt_tests_data/svn--version_stdout 2014-05-07 20:10:17.000000000 +0100 +++ subversion-1.8.9/subversion/tests/cmdline/getopt_tests_data/svn--version_stdout 2014-05-07 20:10:26.000000000 +0100 @@ -1,5 +1,4 @@ svn, version 0.16.0 (r3987) - compiled Dec 5 2002, 00:02:51 Copyright (C) 2010 The Apache Software Foundation. This software consists of contributions made by many people; ++++++ subversion-swig-perl-install_vendor.patch ++++++ Makefile.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Index: subversion-1.8.0-rc2/Makefile.in =================================================================== --- subversion-1.8.0-rc2.orig/Makefile.in 2013-05-14 20:24:53.000000000 +0100 +++ subversion-1.8.0-rc2/Makefile.in 2013-05-14 20:24:54.000000000 +0100 @@ -780,7 +780,7 @@ check-swig-pl: swig-pl swig-pl-lib cd $(SWIG_PL_DIR)/native; $(MAKE) test install-swig-pl: swig-pl install-swig-pl-lib - cd $(SWIG_PL_DIR)/native; $(MAKE) install + cd $(SWIG_PL_DIR)/native; $(MAKE) install_vendor EXTRACLEAN_SWIG_PL=rm -f $(SWIG_PL_SRC_DIR)/native/svn_*.c \ $(SWIG_PL_SRC_DIR)/native/core.c ++++++ subversion.README.SuSE ++++++ Quickstart document for Apache Subversion on openSUSE. For the full documentation, install the package subversion-doc and see /usr/share/doc/packages/subversion/html/book/svn-book.html An online version can be found at http://svnbook.red-bean.com/ Topics: 0. upgrading to Apache Subversion 1.8 1. mini-howto 2. allowing anonymous read access 3. serving several repositories with SVNParentPath 4. serving the repositories at "/" 5. running svnserve 6. quickstart for mod_dontdothat ================================================================================ 0. upgrading to Apache Subversion 1.8 - concerns when upgrading from earlier versions * Upgrading the Working Copy 1.8 introduces a new working copy format. One-time execution of "svn upgrade" required. After that, clients earlier than 1.8 will be unable to use the working copy. Working copy must have been created using 1.6 or 1.7. For details, please see: https://subversion.apache.org/docs/release-notes/1.8.html#wc-upgrade * Upgrading the Repository 1.8 can read and write repositories created by earlier versions. "svnadmin upgrade" may be used to upgrade to FSFS format 6 of 1.8, after which the repository will be no longer be usable for 1.7 servers. An optional dump/load cycle may be used to apply FSFS improvements to past revisions. https://subversion.apache.org/docs/release-notes/1.8.html#compatibility https://subversion.apache.org/docs/release-notes/1.8.html#fsfs-enhancements * Required configuration changes when using mod_dav_svn with Apache httpd2: The MaxKeepAliveRequests option in httpd.conf needs to be increased from 100 (the default) to at least 1000 (there is no reason why it could not be 10000). This will improve performance by allowing serf clients to use fewer TCP connections to the server. Clients using neon will also work fine with this configuration. ================================================================================ 1. mini-howto To run a subversion server, you need to configure apache2 to load two modules: mod_dav and mod_dav_svn. zypper in subversion-server a2enmod dav a2enmod dav_svn A default/example configuration of the dav_svn module can be found in /etc/apache2/conf.d/subversion.conf. The current default configuration automatically includes this file the default server configuration. The MaxKeepAliveRequests option in httpd.conf needs to be increased from 100 (the default) to at least 1000 (there is no reason why it could not be 10000). This will improve performance by allowing serf clients to use fewer TCP connections to the server. Clients using neon will also work fine with this configuration. Create some directories to contain the repositories and other files: mkdir -p /srv/svn/repos mkdir -p /srv/svn/user_access mkdir -p /srv/svn/html Edit /etc/apache2/conf.d/subversion.conf and uncomment the desired sections. The first section "project related HTML files" is optional and will allow you to return some static content when /repos is accessed alone. If you do not need this, discard this section. If instead you wish to show a list of repositories, set "SVNListParentPath on" later. See for details: http://svnbook.red-bean.com/en/1.8/svn.serverconfig.httpd.html#svn.serverco… The section following that will configure a repository to be served out of the path /srv/svn/repos/myproject1. Note that the location "/repo/myproject1" and "SVNPath" is specified explicitly, see section 3 for an alternative. To create the repository itself: cd /srv/svn/repos svnadmin create project1 chown -R wwwrun:www project1/{db,locks} If using svnserve is not planned, /srv/svn/repos may be owned by wwrun:www. Otherwise see instruction in the svnserve section on how to use the user and group svn. The webserver must be (re)started: rcapache2 restart To create the user access files: touch /srv/svn/user_access/project1_passwdfile chown root:www /srv/svn/user_access/project1_passwdfile chmod 640 /srv/svn/user_access/project1_passwdfile htpasswd2 /srv/svn/user_access/project1_passwdfile user1 htpasswd2 /srv/svn/user_access/project1_passwdfile user2 Create the group file for project1: /srv/svn/user_access/project1_groupfile project1_committers: user2 project1_readers: user1 user2 You can test access by: svn info http://127.0.0.1/repos/project1 ================================================================================ 2. allowing anonymous read access To allow anonymous read access, remove the <Limit GET...> section and move the three Auth* statements into the <LimitExcept GET...> section. ================================================================================ 3. serving several repositories with SVNParentPath When serving several repositories, instead of specifying each location with SVNPath in a separate location, you can use SVNParentPath with a single location. Change the <Location ...> directive form the template to start with the following: <Location /repos/> DAV svn SVNParentPath /srv/svn/repos SVNListParentPath on Do not forget to restart the apache service to make the configuration effective. service apache2 restart ================================================================================ 4. serving the repositories at "/" Include the configuration into the relevant vhost configuration. Uncomment the section in the template files labeled 'Hosting svn at "/"' and adjust as required. Note that this example uses "SVNParentPath" as given in the previous section. ================================================================================ 5. running svnserve Subversion repositories can be via the svnserve daemon and a special network protocol. svnserve should not run as root user. The startup scripts expects a user/group named 'svn', configureable via /etc/sysconfig/svnserve. The subversion package now creates a user and group svn. If you want to expose the repository via both svnserve and mod_dav_svn (Apache httpd) in parallel, ensure that the apache user is part of the svn group. usermod -A svn wwwrun This requires a restart of the apache2 service to become effective. Change the permissions to let the svn group write, and set the setgid flag on the repositories. chown -R svn:svn /srv/svn/repos chmod -R g+ws /srv/svn/repos Then proceed to create repositories using svnadmin create described above. In either case, if using svnserve, ensure that the repositories are owned by svn:svn. The settings files with the options passed to the daemon is is located in: /etc/sysconfig/svnserve To start, ensure proper ownership of repositories and run: service svnserve start For further information about multi-method repository access, see http://svnbook.red-bean.com/en/1.8/svn.serverconfig.multimethod.html You can test repository access by: svn info svn://127.0.0.1/project1 Please note that by default, svnserve is configured to be started with -R, meaning read-only access only. Remove to allow write access, after you have configured access via /srv/svn/repos/repo1/conf/svnserve.conf To configue authentication for svnserve, see http://svnbook.red-bean.com/en/1.8/svn.serverconfig.svnserve.html#svn.serve… ================================================================================ 6. quickstart for mod_dontdothat The apache module mod_dontdothat can be used to prevent users from causing high load on the server, e.g. checking out the root of the tree or the tags or branches directories. Make sure mod_dontdothat is loaded: $ a2enmod dontdothat Add configuration for the module, e.g. <Location /> DAV svn SVNParentPath /srv/svn/repos/ SVNListParentPath on # [...other configuration...] <IfModule mod_dontdothat.c> DontDoThatConfigFile /srv/svn/mod_dontdothat.config DontDoThatDisallowReplay off </IfModule> </Location> Restart apache to make the change effective. A fairly standard file /srv/svn/mod_dontdothat.config may contain: [recursive-actions] /*/trunk = allow / = deny /* = deny /*/tags = deny /*/branches = deny /*/* = deny /*/*/tags = deny /*/*/branches = deny This allows checking out of /trunk and each branch, but disallows checking out all branches or the complete repository at once. ++++++ subversion.conf ++++++ # Example configuration for a subversion repository # Install the package subversion-doc and see # /usr/share/doc/packages/subversion for the full documentation # An online version can be found at http://svnbook.red-bean.com/ # <IfModule mod_dav_svn.c> ## ## project related HTML files ## #<IfModule mod_alias.c> #Alias /repos /srv/svn/html #</IfModule> #<Directory /srv/svn/html> # Options +Indexes +Multiviews -FollowSymLinks # IndexOptions FancyIndexing \ # ScanHTMLTitles \ # NameWidth=* \ # DescriptionWidth=* \ # SuppressLastModified \ # SuppressSize # # order allow,deny # allow from all #</Directory> #<Location /repos/myproject1> # DAV svn # SVNPath /srv/svn/repos/myproject1 # # AuthType Basic # AuthName "Authorization Realm" # AuthUserFile /srv/svn/user_access/myproject1_passwdfile # # # Limit read access to certain people # <Limit GET PROPFIND OPTIONS REPORT> # # uncomment to require SSL connection for password protection. # # SSLRequireSSL # Require group project1_committers # Require group project1_readers # </Limit> # # # Limit write permission to list of valid users. # <LimitExcept GET PROPFIND OPTIONS REPORT> # # uncomment to require SSL connection for password protection. # # SSLRequireSSL # Require project1_committers # </LimitExcept> # #</Location> ## ## Hosting svn at "/" ## #<VirtualHost *> # ServerName svn.example.com # ErrorLog /var/log/apache2/svn.example.com-error_log # TransferLog /var/log/apache2/svn.example.com-access_log # # # # Do not set DocumentRoot. It is not needed here and just causes trouble. # # # # Map the error documents back to their defaults. # # Otherwise mod_dav_svn tries to find a "error" repository. # # # ErrorDocument 400 default # ErrorDocument 401 default # ErrorDocument 403 default # ErrorDocument 404 default # ErrorDocument 405 default # ErrorDocument 408 default # ErrorDocument 410 default # ErrorDocument 411 default # ErrorDocument 412 default # ErrorDocument 413 default # ErrorDocument 414 default # ErrorDocument 415 default # ErrorDocument 500 default # ErrorDocument 501 default # ErrorDocument 502 default # ErrorDocument 503 default # # # <Location /> # DAV svn # SVNParentPath /srv/svn/repos/ # SVNListParentPath on # AuthType Basic # AuthName "subversion repository" # AuthBasicProvider file # AuthUserFile /srv/svn/auth/svn.example.org.htpasswd # SetOutputFilter DEFLATE # <LimitExcept GET PROPFIND OPTIONS REPORT> # Require valid-user # </LimitExcept> # # # # Optional configuration for mod_dontdothat # # prevent users from causing high load on the server, e.g. checking out # # the root of the tree or the tags or branches directories # # # #<IfModule mod_dontdothat.c> # # DontDoThatConfigFile /srv/svn/mod_dontdothat.config # # DontDoThatDisallowReplay off # #</IfModule> # </Location> #</VirtualHost> </IfModule> ++++++ subversion.keyring ++++++ ++++ 13754 lines (skipped) ++++++ subversion.libtool-pie-flags.patch ++++++ --- Makefile.in | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) Index: subversion-nightly/Makefile.in =================================================================== --- subversion-nightly.orig/Makefile.in 2013-03-17 20:02:10.000000000 +0000 +++ subversion-nightly/Makefile.in 2013-03-17 20:02:15.000000000 +0000 @@ -228,8 +228,8 @@ libsvn_subr_LDFLAGS = @libsvn_subr_LDFLA libsvn_wc_LDFLAGS = @libsvn_wc_LDFLAGS@ # Compilation of SWIG-generated C source code -COMPILE_PY_WRAPPER = $(LIBTOOL) $(LTFLAGS) --mode=compile $(SWIG_PY_COMPILE) $(LT_CFLAGS) $(CPPFLAGS) $(SWIG_PY_INCLUDES) -prefer-pic -c -o $@ -COMPILE_RB_WRAPPER = $(LIBTOOL) $(LTFLAGS) --mode=compile $(SWIG_RB_COMPILE) $(LT_CFLAGS) $(CPPFLAGS) $(SWIG_RB_INCLUDES) -prefer-pic -c -o $@ +COMPILE_PY_WRAPPER = $(LIBTOOL) $(LTFLAGS) --mode=compile $(SWIG_PY_COMPILE) $(LT_CFLAGS) $(CPPFLAGS) $(SWIG_PY_INCLUDES) -fpie -fPIE -prefer-pic -c -o $@ +COMPILE_RB_WRAPPER = $(LIBTOOL) $(LTFLAGS) --mode=compile $(SWIG_RB_COMPILE) $(LT_CFLAGS) $(CPPFLAGS) $(SWIG_RB_INCLUDES) -fpie -fPIE -prefer-pic -c -o $@ # these commands link the wrapper objects into an extension library/module LINK_PY_WRAPPER = $(LIBTOOL) $(LTFLAGS) --mode=link $(SWIG_PY_LINK) $(SWIG_LDFLAGS) -rpath $(swig_pydir) -avoid-version -module ++++++ subversion.libtool-verbose.patch ++++++ --- Makefile.in | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) Index: subversion-nightly/Makefile.in =================================================================== --- subversion-nightly.orig/Makefile.in 2013-03-15 12:21:46.000000000 +0000 +++ subversion-nightly/Makefile.in 2013-03-17 20:02:04.000000000 +0000 @@ -112,8 +112,8 @@ EXEEXT = @EXEEXT@ SHELL = @SHELL@ LIBTOOL = @SVN_LIBTOOL@ -LTFLAGS = --tag=CC --silent -LTCXXFLAGS = --tag=CXX --silent +LTFLAGS = --tag=CC +LTCXXFLAGS = --tag=CXX LT_CFLAGS = @LT_CFLAGS@ LT_LDFLAGS = @LT_LDFLAGS@ LT_SO_VERSION = @SVN_LT_SOVERSION@ ++++++ subversion.perl.LD_RUN_PATH.patch ++++++ clear LD_RUN_PATH, it will end up as RPATH in ELF binaries ERROR: RPATH "/usr/src/packages/BUILD/subversion-1.5.x/subversion/libsvn_subr/.libs" on /var/tmp/subversion-1.5.0-build/usr/lib/perl5/vendor_perl/5.10.0/ppc-linux-thread-multi-64int/auto/SVN/_Wc/_Wc.so is not allowed --- Makefile.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Index: subversion-1.8.0-rc2/Makefile.in =================================================================== --- subversion-1.8.0-rc2.orig/Makefile.in 2013-05-14 20:25:00.000000000 +0100 +++ subversion-1.8.0-rc2/Makefile.in 2013-05-14 20:25:01.000000000 +0100 @@ -760,7 +760,7 @@ $(SWIG_PL_DIR)/native/Makefile.PL: $(SWI ./config.status subversion/bindings/swig/perl/native/Makefile.PL $(SWIG_PL_DIR)/native/Makefile: $(SWIG_PL_DIR)/native/Makefile.PL - cd $(SWIG_PL_DIR)/native; $(PERL) Makefile.PL + cd $(SWIG_PL_DIR)/native; $(PERL) Makefile.PL ; for i in `grep -wl ^LD_RUN_PATH Makefile Makefile.[^P]*` ; do sed -i 's@^LD_RUN_PATH.*@LD_RUN_PATH=@' $$i ; done # There is a "readlink -f" command on some systems for the same purpose, # but it's not as portable (e.g. Mac OS X doesn't have it). These should ++++++ subversion.rcsvnserve ++++++ #! /bin/sh # Copyright (c) 1995-2011 SuSE Linux AG, Nuernberg, Germany. # All rights reserved. # # /etc/init.d/svnserve # and its symbolic link # /usr/sbin/rcsvnserve # # LSB compatible service control script; see http://www.linuxbase.org/spec/ # # Note: This script uses functions rc_XXX defined in /etc/rc.status on # UnitedLinux (UL) based Linux distributions. If you want to base your # script on this template and ensure that it works on non UL based LSB # compliant Linux distributions, you either have to provide the rc.status # functions from UL or change the script to work without them. ### BEGIN INIT INFO # Provides: svnserve # Required-Start: # Should-Start: $time ypbind sendmail $syslog $remote_fs # Required-Stop: $syslog $remote_fs # Should-Stop: $time ypbind sendmail # Default-Start: 3 5 # Default-Stop: 0 1 2 6 # Short-Description: svnserve # Description: readonly access to a subversion repository ### END INIT INFO # Note on runlevels: # 0 - halt/poweroff 6 - reboot # 1 - single user 2 - multiuser without network exported # 3 - multiuser w/ network (text mode) 5 - multiuser w/ network and X11 (xdm) # # Note on script names: # http://www.linuxbase.org/spec/refspecs/LSB_1.2.0/gLSB/scrptnames.html # A registry has been set up to manage the init script namespace. # http://www.lanana.org/ # Please use the names already registered or register one or use a # vendor prefix. # Check for missing binaries (stale symlinks should not happen) SVNSERVE_BIN=/usr/bin/svnserve test -x $SVNSERVE_BIN || exit 5 # Check for existence of needed config file and read it SVNSERVE_CONFIG=/etc/sysconfig/svnserve test -r $SVNSERVE_CONFIG || exit 6 . $SVNSERVE_CONFIG # Source LSB init functions # providing start_daemon, killproc, pidofproc, # log_success_msg, log_failure_msg and log_warning_msg. # This is currently not used by UnitedLinux based distributions and # not needed for init scripts for UnitedLinux only. If it is used, # the functions from rc.status should not be sourced or used. #. /lib/lsb/init-functions # Shell functions sourced from /etc/rc.status: # rc_check check and set local and overall rc status # rc_status check and set local and overall rc status # rc_status -v be verbose in local rc status and clear it afterwards # rc_status -v -r ditto and clear both the local and overall rc status # rc_status -s display "skipped" and exit with status 3 # rc_status -u display "unused" and exit with status 3 # rc_failed set local and overall rc status to failed # rc_failed <num> set local and overall rc status to <num> # rc_reset clear both the local and overall rc status # rc_exit exit appropriate to overall rc status # rc_active checks whether a service is activated by symlinks # rc_splash arg sets the boot splash screen to arg (if active) . /etc/rc.status # Reset status of this service rc_reset # Return values acc. to LSB for all commands but status: # 0 - success # 1 - generic or unspecified error # 2 - invalid or excess argument(s) # 3 - unimplemented feature (e.g. "reload") # 4 - user had insufficient privileges # 5 - program is not installed # 6 - program is not configured # 7 - program is not running # 8--199 - reserved (8--99 LSB, 100--149 distrib, 150--199 appl) # # Note that starting an already running service, stopping # or restarting a not-running service as well as the restart # with force-reload (in case signaling is not supported) are # considered a success. case "$1" in start) echo -n "Starting svnserve " ## Start daemon with startproc(8). If this fails ## the return value is set appropriately by startproc. UID_ENT="$(/usr/bin/getent passwd $SVNSERVE_USERID)" GID_ENT="$(/usr/bin/getent group $SVNSERVE_GROUPID)" if test -z "$SVNSERVE_USERID" -o -z "$UID_ENT" then echo echo "User $SVNSERVE_USERID does not exist." echo "Please check $SVNSERVE_CONFIG before starting this service." rc_failed elif test -z "$SVNSERVE_GROUPID" -o -z "$GID_ENT" then echo echo "Group $SVNSERVE_GROUPID does not exist." echo "Please check $SVNSERVE_CONFIG before starting this service." rc_failed else startproc -u "$SVNSERVE_USERID" -g "$SVNSERVE_GROUPID" -e $SVNSERVE_BIN $SVNSERVE_OPTIONS fi # Remember status and be verbose rc_status -v ;; stop) echo -n "Shutting down svnserve " ## Stop daemon with killproc(8) and if this fails ## killproc sets the return value according to LSB. killproc -TERM $SVNSERVE_BIN # Remember status and be verbose rc_status -v ;; try-restart) ## Do a restart only if the service was active before. ## Note: try-restart is not (yet) part of LSB (as of 1.2) $0 status >/dev/null && $0 restart # Remember status and be quiet rc_status ;; restart) ## Stop the service and regardless of whether it was ## running or not, start it again. $0 stop $0 start # Remember status and be quiet rc_status ;; force-reload) echo -n "Reload service svnserve " $0 stop && $0 start #rc_status ;; status) echo -n "Checking for service svnserve " ## Check status with checkproc(8), if process is running ## checkproc will return with exit status 0. # Return value is slightly different for the status command: # 0 - service up and running # 1 - service dead, but /var/run/ pid file exists # 2 - service dead, but /var/lock/ lock file exists # 3 - service not running (unused) # 4 - service status unknown :-( # 5--199 reserved (5--99 LSB, 100--149 distro, 150--199 appl.) # NOTE: checkproc returns LSB compliant status values. checkproc $SVNSERVE_BIN # NOTE: rc_status knows that we called this init script with # "status" option and adapts its messages accordingly. rc_status -v ;; *) echo "Usage: $0 {start|stop|status|try-restart|restart|force-reload}" exit 1 ;; esac rc_exit ++++++ subversion.rpmlintrc ++++++ # libsvn_subr calls exit as part of the default malfunction handler. # That's OK. Library users are expected to override the default handler. addFilter("subversion.*shared-lib-calls-exit.*libsvn_subr-1.so.*") ++++++ subversion.svndiff.sh ++++++ #!/bin/bash # stupid svn has no 'svn diff -v -R $bignum' to grab all info for a single patch export TZ=UTC export LANG=C export LC_ALL=C shopt -s extglob case "$1" in r+([0-9])) rev=${1#?} shift ;; +([0-9])) rev=$1 shift ;; esac if test -z "$rev" then echo "Usage: $0 <svnrepo revision number>" exit 1 fi revprev=$(($rev - 1 )) svn log -v -r $rev "$@" svn diff -r $revprev:$rev "$@" ++++++ subversion.svngrep.sh ++++++ #!/bin/sh find $ -path '*/.pc' -o -path '*/.svn' -o -path '*/.git' -o -path '*/.hg' $ -prune -o -type f -print0 | xargs -0 grep "$@" ++++++ subversion.sysconfig.svnserve ++++++ ## Path: Network/Subversion/svnserve ## Description: Basic configuration for svnserve ## Type: string ## Default "-d -R -r /srv/svn/repos" # # Default options for the svnserve process. # The -R option enforces read-only access, i.e. write operations to the # repository (such as commits) will not be allowed. # Authentication should be configured before allowing write access. # See http://svnbook.red-bean.com/en/1.8/svn.serverconfig.svnserve.html#svn.serve… # SVNSERVE_OPTIONS="-d -R -r /srv/svn/repos" ## Type: string ## Default "svn" # # svnserve should run as unprivileged user. # If you want to expose the repository via both svnserve and mod_dav_svn # (Apache httpd) in parallel, ensure that the apache user is part of the # svn group and the setgid flag is set on the repositories # usermod -A svn wwwrun # chmod -R g+s /srv/svn/repos # See http://svnbook.red-bean.com/en/1.8/svn.serverconfig.multimethod.html # SVNSERVE_USERID="svn" ## Type: string ## Default "svn" # # svnserve should run as unprivileged user. # If you want to expose the repository via both svnserve and mod_dav_svn # (Apache httpd) in parallel, ensure that the apache user is part of the # svn group and the setgid flag is set on the repositories # usermod -A svn wwwrun # chmod -R g+s /srv/svn/repos # See http://svnbook.red-bean.com/en/1.8/svn.serverconfig.multimethod.html # SVNSERVE_GROUPID="svn" ++++++ subversion.sysconfig.svnserve.remoteaccess ++++++ ## Name: svnserve ## Description: Open ports for svnserve TCP="svn" ++++++ subversion.xinetd.svnserve ++++++ # default: off # description: readonly access to a subversion repository service svn { disable = yes socket_type = stream protocol = tcp wait = no user = svn group = svn groups = yes server = /usr/bin/svnserve server_args = --read-only --root=/srv/svn/repos --inetd } ++++++ svnserve.service ++++++ [Unit] Description=Subversion protocol daemon After=syslog.target network.target [Service] Type=forking EnvironmentFile=/etc/sysconfig/svnserve User=svn Group=svn PIDFile=/var/run/svnserve/svnserve.pid ExecStart=/usr/bin/svnserve --daemon --pid-file=/var/run/svnserve/svnserve.pid $SVNSERVE_OPTIONS [Install] WantedBy=multi-user.target ++++++ svnserve.tmpfiles ++++++ D /var/run/svnserve 0755 svn svn - -- To unsubscribe, e-mail: opensuse-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-commit+help(a)opensuse.org

1 0

commit strongswan.2814 for openSUSE:12.3:Update
by root＠hilbert.suse.de 22 May '14

22 May '14

Hello community, here is the log from the commit of package strongswan.2814 for openSUSE:12.3:Update checked in at 2014-05-22 11:17:57 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:12.3:Update/strongswan.2814 (Old) and /work/SRC/openSUSE:12.3:Update/.strongswan.2814.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "strongswan.2814" Changes: -------- New Changes file: --- /dev/null 2014-05-19 01:51:27.372033255 +0200 +++ /work/SRC/openSUSE:12.3:Update/.strongswan.2814.new/strongswan.changes 2014-05-22 11:18:00.000000000 +0200 @@ -0,0 +1,980 @@ +------------------------------------------------------------------- +Wed May 14 06:53:36 UTC 2014 - mt(a)suse.de + +- Applied fix for DoS vulnerability by a crafted ID_DER_ASN1_DN ID + payload caused by a NULL-pointer dereference when such identities + are parsed (bnc#876449, CVE-2014-2891). + [+0007-strongswan-4.3.3-5.1.1_asn1_unwrap-CVE-2014-2891.patch] + +------------------------------------------------------------------- +Wed Apr 2 05:53:21 UTC 2014 - mt(a)suse.de + +- Applied fix for a authentication bypass vulnerability in the + strongSwan IKEv2 code. The bug can be triggered by rekeying an + unestablished IKE_SA while it gets actively initiated allowing + an attacker to trick a peer's IKE_SA state to established. + IKEv1 is not not affected. (CVE-2014-2338, bnc#870572). + [+0006-strongswan-CVE-2014-2338-5.x.patch] + +------------------------------------------------------------------- +Thu Oct 31 10:13:24 UTC 2013 - mt(a)suse.de + +- Applied upstream fix for a denial-of-service and authorization + bypass vulnerability via crafted ID payload in strongswan 4.3.3 + up to 5.1.0 (CVE-2013-6075, bnc#847506). + [0005-strongswan-4.3.3_5.1.0-bnc-847506-CVE-2013-6075.patch] +- Added missed references to patch file 0003. + +------------------------------------------------------------------- +Mon Aug 5 11:58:03 UTC 2013 - mt(a)suse.de + +- Applied upstream fix for a denial-of-service vulnerability, that + could be triggered by special XAuth usernames and EAP identities + (affected by this are 5.0.3 and 5.0.4), and local PEM files (all + versions since 4.1.11) (CVE-2013-5018,bnc#833278). + [0004-strongswan-4.3.0-5.0.4_is_asn1-CVE-2013-5018.bnc833278.patch] + +------------------------------------------------------------------- +Tue Apr 30 12:23:23 UTC 2013 - mt(a)suse.de + +- Applied upstream patch for security vulnerability discovered by + Kevin Wojtysiak in ECDSA signature verification of the strongswan + openssl plugin (bnc#815236, CVE-2013-2944) + [0003-Check-return-value-of-ECDSA_Verify-correctly.patch] + +------------------------------------------------------------------- +Thu Nov 29 19:13:40 CET 2012 - sbrabec(a)suse.cz + +- Verify GPG signature. + +------------------------------------------------------------------- +Fri Nov 16 04:02:32 UTC 2012 - crrodriguez(a)opensuse.org + +- Fix systemd unit dir + +------------------------------------------------------------------- +Wed Oct 31 15:25:16 UTC 2012 - mt(a)suse.de + +- Updated to strongSwan 5.0.1 release. Changes digest: + - Introduced the sending of the standard IETF Assessment Result + PA-TNC attribute by all strongSwan Integrity Measurement Verifiers. + - Extended PTS Attestation IMC/IMV pair to provide full evidence of + the Linux IMA measurement process. All pertinent file information + of a Linux OS can be collected and stored in an SQL database. + - The PA-TNC and PB-TNC protocols can now process huge data payloads. + - The xauth-pam backend can authenticate IKEv1 XAuth and Hybrid + authenticated clients against any PAM service. + - The new unity plugin brings support for some parts of the IKEv1 + Cisco Unity Extensions. + - The kernel-netlink plugin supports the new strongswan.conf option + charon.install_virtual_ip_on. + - Job handling in controller_t was fixed, which occasionally caused + crashes on ipsec up/down. + - Fixed transmission EAP-MSCHAPv2 user name if it contains a domain + part. + Changes digest from strongSwan 5.0.0 version: + * The charon IKE daemon gained experimental support for the IKEv1 + protocol. Pluto has been removed from the 5.x series. + * The NetworkManager charon plugin of previous releases is now + provided by a separate executable (charon-nm) and it should work + again with NM 0.9. + * scepclient was updated and it now works fine with Windows Server + 2008 R2. + For full list of the changes, please read the NEWS file shipped + in the strongswan-doc package or online: + http://wiki.strongswan.org/projects/strongswan/wiki/Changelog50 +- Adopted spec file, enabled several plugins, e.g.: ccm, certexpire, + coupling, ctr, duplicheck, eap-dynamic, eap-peap, eap-tls, eap-tnc, + eap-ttls, gcm, nonce, radattr, tnc, tnccs, unity, xauth-eap and pam. +- Changed to install strongswan.service with alias to ipsec.service + instead of the /etc/init.d/ipsec init script on openSUSE > 12.2. + +------------------------------------------------------------------- +Fri Sep 7 08:36:57 UTC 2012 - mt(a)suse.de + +- Applied upstream patch adjusting an internal thread id causing + charon keying daemon start failure (bnc#779038,strongswan#198): + openssl: Ensure the thread ID is never zero + This might otherwise cause problems because OpenSSL tries to + lock mutexes recursively if it assumes the lock is held by a + different thread e.g. during FIPS initialization. + See http://wiki.strongswan.org/issues/198 for more informations. + +------------------------------------------------------------------- +Thu May 31 16:08:43 UTC 2012 - mt(a)suse.com + +- Updated to strongSwan 4.6.4 release: + - Fixed a security vulnerability in the gmp plugin. If this + plugin was used for RSA signature verification an empty or + zeroed signature was handled as a legitimate one + (bnc#761325, CVE-2012-2388). + - Fixed several issues with reauthentication and address updates. + +------------------------------------------------------------------- +Thu May 10 09:15:38 UTC 2012 - mt(a)suse.com + +- Updated to strongSwan 4.6.3 release: + - The tnc-pdp plugin implements a RADIUS server interface allowing + a strongSwan TNC server to act as a Policy Decision Point. + - The eap-radius authentication backend enforces Session-Timeout + attributes using RFC4478 repeated authentication and acts upon + RADIUS Dynamic Authorization extensions, RFC 5176. Currently + supported are disconnect requests and CoA messages containing + a Session-Timeout. + - The eap-radius plugin can forward arbitrary RADIUS attributes + from and to clients using custom IKEv2 notify payloads. The new + radattr plugin reads attributes to include from files and prints + received attributes to the console. + - Added support for untruncated MD5 and SHA1 HMACs in ESP as used + in RFC 4595. + - The cmac plugin implements the AES-CMAC-96 and AES-CMAC-PRF-128 + algorithms as defined in RFC 4494 and RFC 4615, respectively. + - The resolve plugin automatically installs nameservers via + resolvconf(8), if it is installed, instead of modifying + /etc/resolv.conf directly. + - The IKEv2 charon daemon supports now raw RSA public keys in RFC + 3110 DNSKEY and PKCS#1 file format. + - The farp plugin sends ARP responses for any tunneled address, + not only virtual IPs. + - Charon resolves hosts again during additional keying tries. + - Fixed switching back to original address pair during MOBIKE. + - When resending IKE_SA_INIT with a COOKIE charon reuses the previous + DH value, as specified in RFC 5996. + This has an effect on the lifecycle of diffie_hellman_t, see + source:src/libcharon/sa/keymat.h#39 for details. + - COOKIEs are now kept enabled a bit longer to avoid certain race + conditions the commit message to 1b7debcc has some details. + - The new stroke user-creds command allows to set username/password + for a connection. + - strongswan.conf option added to set identifier for syslog(3) logging. + - Added a workaround for null-terminated XAuth secrets (as sent by + Android 4). + +------------------------------------------------------------------- +Sat Mar 3 00:10:34 UTC 2012 - tabraham(a)novell.com + +- Updated to strongSwan 4.6.2 release: + Changes in 4.6.2: + - Upgraded the TCG IF-IMC and IF-IMV C API to the upcoming version 1.3 + which supports IF-TNCCS 2.0 long message types, the exclusive flags + and multiple IMC/IMV IDs. Both the TNC Client and Server as well as + the "Test", "Scanner", and "Attestation" IMC/IMV pairs were updated. + - Fully implemented the "TCG Attestation PTS Protocol: Binding to IF-M" + standard (TLV-based messages only). TPM-based remote attestation of + Linux IMA (Integrity Measurement Architecture) possible. Measurement + reference values are automatically stored in an SQLite database. + - The EAP-RADIUS authentication backend supports RADIUS accounting. It sends + start/stop messages containing Username, Framed-IP and Input/Output-Octets + attributes and has been tested against FreeRADIUS and Microsoft NPS. + - Added support for PKCS#8 encoded private keys via the libstrongswan + pkcs8 plugin. This is the default format used by some OpenSSL tools since + version 1.0.0 (e.g. openssl req with -keyout). + - Added session resumption support to the strongSwan TLS stack. + +------------------------------------------------------------------- +Wed Feb 15 13:31:40 UTC 2012 - mt(a)suse.com + +- Updated to strongSwan 4.6.1 release: + Changes in 4.6.1: + - Because of changing checksums before and after installation which caused + the integrity tests to fail we avoided directly linking libsimaka, + libtls and libtnccs to those libcharon plugins which make use of these + dynamiclibraries. + Instead we linked the libraries to the charon daemon. Unfortunately + Ubuntu 11.10 activated the --as-needed ld option which discards explicit + links to dynamic libraries that are not actually used by the charon + daemon itself, thus causing failures during the loading of the plugins + which depend on these libraries for resolving external symbols. + - Therefore our approach of computing integrity checksums for plugins had + to be changed radically by moving the hash generation from the + compilation to the post-installation phase. + Changes in 4.6.0: + - The new libstrongswan certexpire plugin collects expiration information + of all used certificates and exports them to CSV files. It either + directly exports them or uses cron style scheduling for batch exports. + - Starter passes unresolved hostnames to charon, allowing it to do name + resolution not before the connection attempt. This is especially useful + with connections between hosts using dynamic IP addresses. ++++ 783 more lines (skipped) ++++ between /dev/null ++++ and /work/SRC/openSUSE:12.3:Update/.strongswan.2814.new/strongswan.changes New: ---- 0003-Check-return-value-of-ECDSA_Verify-correctly.patch 0004-strongswan-4.3.0-5.0.4_is_asn1-CVE-2013-5018.bnc833278.patch 0005-strongswan-4.3.3_5.1.0-bnc-847506-CVE-2013-6075.patch 0006-strongswan-CVE-2014-2338-5.x.patch 0007-strongswan-4.3.3-5.1.1_asn1_unwrap-CVE-2014-2891.patch README.SUSE strongswan-5.0.1-rpmlintrc strongswan-5.0.1.tar.bz2 strongswan-5.0.1.tar.bz2.sig strongswan.changes strongswan.init.in strongswan.keyring strongswan.spec strongswan_ipsec_service.patch strongswan_modprobe_syslog.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ strongswan.spec ++++++ ++++ 606 lines (skipped) ++++++ 0003-Check-return-value-of-ECDSA_Verify-correctly.patch ++++++ >From 0faaab20cd9c4a519fb6269ab6c8be15d0b61864 Mon Sep 17 00:00:00 2001 From: Martin Willi <martin(a)revosec.ch> Date: Tue, 9 Apr 2013 10:56:09 +0200 References: bnc#815236, CVE-2013-2944 Upstream: yes Subject: Check return value of ECDSA_Verify() correctly --- src/libstrongswan/plugins/openssl/openssl_ec_public_key.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/libstrongswan/plugins/openssl/openssl_ec_public_key.c b/src/libstrongswan/plugins/openssl/openssl_ec_public_key.c index c8a45f7..38cc8be 100644 --- a/src/libstrongswan/plugins/openssl/openssl_ec_public_key.c +++ b/src/libstrongswan/plugins/openssl/openssl_ec_public_key.c @@ -124,7 +124,7 @@ static bool verify_der_signature(private_openssl_ec_public_key_t *this, if (openssl_hash_chunk(nid_hash, data, &hash)) { valid = ECDSA_verify(0, hash.ptr, hash.len, - signature.ptr, signature.len, this->ec); + signature.ptr, signature.len, this->ec) == 1; free(hash.ptr); } return valid; -- 1.7.10.4 ++++++ 0004-strongswan-4.3.0-5.0.4_is_asn1-CVE-2013-5018.bnc833278.patch ++++++ References: CVE-2013-5018,bnc#833278 Upstream: yes >From 057265e0183ddf52d56f21adaf0db0f3dc6585a4 Mon Sep 17 00:00:00 2001 From: Tobias Brunner <tobias(a)strongswan.org> Date: Mon, 29 Jul 2013 23:45:38 +0200 Subject: [PATCH] asn1: Fix handling of invalid ASN.1 length in is_asn1() Fixes CVE-2013-5018. --- src/libstrongswan/asn1/asn1.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/libstrongswan/asn1/asn1.c b/src/libstrongswan/asn1/asn1.c index 68f37f4..d860ad9 100644 --- a/src/libstrongswan/asn1/asn1.c +++ b/src/libstrongswan/asn1/asn1.c @@ -642,6 +642,11 @@ bool is_asn1(chunk_t blob) len = asn1_length(&blob); + if (len == ASN1_INVALID_LENGTH) + { + return FALSE; + } + /* exact match */ if (len == blob.len) { -- 1.7.10.4 ++++++ 0005-strongswan-4.3.3_5.1.0-bnc-847506-CVE-2013-6075.patch ++++++ >From aa277adfc204b6bda2c3792710138f9a8723a8f1 Mon Sep 17 00:00:00 2001 From: Martin Willi <martin(a)revosec.ch> Date: Mon, 7 Oct 2013 14:21:57 +0200 References: CVE-2013-6075,bnc#847506 Upstream: yes Subject: [PATCH] identification: Properly check length before comparing for binary DN equality Fixes CVE-2013-6075. --- src/libstrongswan/utils/identification.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/libstrongswan/utils/identification.c b/src/libstrongswan/utils/identification.c index 5df3e5f..9c43ad5 100644 --- a/src/libstrongswan/utils/identification.c +++ b/src/libstrongswan/utils/identification.c @@ -602,7 +602,7 @@ static bool compare_dn(chunk_t t_dn, chunk_t o_dn, int *wc) } } /* try a binary compare */ - if (memeq(t_dn.ptr, o_dn.ptr, t_dn.len)) + if (chunk_equals(t_dn, o_dn)) { return TRUE; } -- 1.8.1.2 ++++++ 0006-strongswan-CVE-2014-2338-5.x.patch ++++++ >From b980ba7757dcfedd756aa055b3271ea58cf85aa6 Mon Sep 17 00:00:00 2001 From: Martin Willi <martin(a)revosec.ch> Date: Thu, 20 Feb 2014 16:08:43 +0100 Upstream: yes References: CVE-2014-2338, bnc#870572 Subject: [PATCH] ikev2: Reject CREATE_CHILD_SA exchange on unestablished IKE_SAs Prevents a responder peer to trick us into established state by starting IKE_SA rekeying before the IKE_SA has been authenticated during IKE_AUTH. Fixes CVE-2014-2338 for 5.x versions of strongSwan. --- src/libcharon/sa/ikev2/task_manager_v2.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/libcharon/sa/ikev2/task_manager_v2.c b/src/libcharon/sa/ikev2/task_manager_v2.c index ac3be90..a5252ab 100644 --- a/src/libcharon/sa/ikev2/task_manager_v2.c +++ b/src/libcharon/sa/ikev2/task_manager_v2.c @@ -778,6 +778,15 @@ static status_t process_request(private_task_manager_t *this, case CREATE_CHILD_SA: { /* FIXME: we should prevent this on mediation connections */ bool notify_found = FALSE, ts_found = FALSE; + + if (this->ike_sa->get_state(this->ike_sa) == IKE_CREATED || + this->ike_sa->get_state(this->ike_sa) == IKE_CONNECTING) + { + DBG1(DBG_IKE, "received CREATE_CHILD_SA request for " + "unestablished IKE_SA, rejected"); + return FAILED; + } + enumerator = message->create_payload_enumerator(message); while (enumerator->enumerate(enumerator, &payload)) { -- 1.8.1.2 ++++++ 0007-strongswan-4.3.3-5.1.1_asn1_unwrap-CVE-2014-2891.patch ++++++ >From 4609d5384c187aef2e58f91f53f5889f25faeaeb Mon Sep 17 00:00:00 2001 From: Tobias Brunner <tobias(a)strongswan.org> Date: Thu, 24 Apr 2014 17:04:10 +0200 Upstream: yes References: bnc#876449,CVE-2014-2891 Subject: [PATCH] asn1: Properly check length in asn1_unwrap() Fixes CVE-2014-2891 in strongSwan releases 4.3.3-5.1.1. --- src/libstrongswan/asn1/asn1.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/libstrongswan/asn1/asn1.c b/src/libstrongswan/asn1/asn1.c index d860ad9..9a5f5c5 100644 --- a/src/libstrongswan/asn1/asn1.c +++ b/src/libstrongswan/asn1/asn1.c @@ -296,7 +296,7 @@ int asn1_unwrap(chunk_t *blob, chunk_t *inner) else { /* composite length, determine number of length octets */ len &= 0x7f; - if (len == 0 || len > sizeof(res.len)) + if (len == 0 || len > blob->len || len > sizeof(res.len)) { return ASN1_INVALID; } -- 1.7.10.4 ++++++ README.SUSE ++++++ Dear Customer, please note, that the strongswan release 4.5 changes the keyexchange mode to IKEv2 as default -- from strongswan-4.5.0/NEWS: "[...] IMPORTANT: the default keyexchange mode 'ike' is changing with release 4.5 from 'ikev1' to 'ikev2', thus commemorating the five year anniversary of the IKEv2 RFC 4306 and its mature successor RFC 5996. The time has definitively come for IKEv1 to go into retirement and to cede its place to the much more robust, powerful and versatile IKEv2 protocol! [...]" This requires adoption of either the "conn %default" or all other IKEv1 "conn" sections in the /etc/ipsec.conf to use explicit: keyexchange=ikev1 The strongswan package does no provide any files any more, but triggers the installation of both, IKEv1 (pluto) and IKEv2 (charon) daemons and the traditional starter scripts inclusive of the /etc/init.d/ipsec init script and /etc/ipsec.conf file. There is a new strongswan-nm package with a NetworkManager plugin to control the charon IKEv2 daemon through D-Bus, designed to work using the NetworkManager-strongswan graphical user interface. It does not depend on the traditional starter scripts, but on the IKEv2 charon daemon and plugins only. Have a lot of fun... ++++++ strongswan-5.0.1-rpmlintrc ++++++ ### Known warnings: # - traditional name addFilter("strongswan.* incoherent-init-script-name ipsec") # - readme only, triggers full ipsec + ikev1&ikev2 install addFilter("strongswan.* no-binary") # - link to init script, covered by service(8) addFilter("strongswan.* no-manual-page-for-binary rcipsec") # - no, restating tunnels on update may break the update addFilter("strongswan.*restart_on_update-postun /etc/init.d/ipsec") ++++++ strongswan.init.in ++++++ #!/bin/bash # # SUSE/LSB system startup script for strongswan ipsec # # Copyright (C) 2007 Marius Tomaschewski, SUSE / Novell Inc. # based on /etc/init.d/skeleton.compat by Kurt Garloff. # # This library is free software; you can redistribute it and/or modify it # under the terms of the GNU Lesser General Public License as published by # the Free Software Foundation; either version 2.1 of the License, or (at # your option) any later version. # # This library is distributed in the hope that it will be useful, but # WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU # Lesser General Public License for more details. # # You should have received a copy of the GNU Lesser General Public # License along with this library; if not, write to the Free Software # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, # USA. # # /etc/init.d/ipsec # and its symbolic link # /usr/sbin/rcipsec # # LSB compatible service control script; see http://www.linuxbase.org/spec/ # Please send feedback to http://www.suse.de/feedback/ # # Note: This script uses functions rc_XXX defined in /etc/rc.status on # UnitedLinux/SUSE/Novell based Linux distributions. However, it shoule # work on other distributions as well, by using the LSB (Linux Standard # Base) or RH functions or by open coding the needed functions. # # chkconfig: 345 99 00 # description: StrongSwan IPsec # ### BEGIN INIT INFO # Provides: ipsec # Required-Start: $syslog $remote_fs $named # Should-Start: $time # Required-Stop: $syslog $remote_fs $named # Should-Stop: $time # Default-Start: 3 5 # Default-Stop: 0 1 2 6 # Short-Description: StrongSwan IPsec # Description: StrongSwan IPsec provides encrypted and authenticated # communication via a unsafe network, such as the internet. # This scripts loads the kernel modules and starts the user-space setup. ### END INIT INFO # Check for missing binaries (stale symlinks should not happen) # Note: Special treatment of stop for LSB conformance IPSEC_CMD="/usr/sbin/ipsec" test -x $IPSEC_CMD || { echo "$IPSEC_CMD not installed"; if [ "$1" = "stop" ]; then exit 0; else exit 5; fi; } IPSEC_STARTER="@libexecdir@/ipsec/starter" test -x $IPSEC_STARTER || { echo "$IPSEC_STARTER not installed"; if [ "$1" = "stop" ]; then exit 0; else exit 5; fi; } # The pid file of the ipsec starter IPSEC_PIDFILE="/var/run/starter.pid" # Check for existence of needed config files IPSEC_CONFIG="/etc/ipsec.conf" test -r $IPSEC_CONFIG || { echo "$IPSEC_CONFIG not existing"; if [ "$1" = "stop" ]; then exit 0; else exit 6; fi; } IPSEC_SECRET="/etc/ipsec.secrets" test -r $IPSEC_SECRET || { echo "$IPSEC_SECRET not existing"; if [ "$1" = "stop" ]; then exit 0; else exit 6; fi; } # Source LSB init functions # providing start_daemon, killproc, pidofproc, # log_success_msg, log_failure_msg and log_warning_msg. # This is currently not used by UnitedLinux based distributions and # not needed for init scripts for UnitedLinux only. If it is used, # the functions from rc.status should not be sourced or used. #. /lib/lsb/init-functions # Shell functions sourced from /etc/rc.status: # rc_check check and set local and overall rc status # rc_status check and set local and overall rc status # rc_status -v be verbose in local rc status and clear it afterwards # rc_status -v -r ditto and clear both the local and overall rc status # rc_status -s display "skipped" and exit with status 3 # rc_status -u display "unused" and exit with status 3 # rc_failed set local and overall rc status to failed # rc_failed <num> set local and overall rc status to <num> # rc_reset clear both the local and overall rc status # rc_exit exit appropriate to overall rc status # rc_active checks whether a service is activated by symlinks # Use the SUSE rc_ init script functions; # emulate them on LSB, RH and other systems # Default: Assume sysvinit binaries exist start_daemon() { /sbin/start_daemon ${1+"$@"}; } killproc() { /sbin/killproc ${1+"$@"}; } pidofproc() { /sbin/pidofproc ${1+"$@"}; } checkproc() { /sbin/checkproc ${1+"$@"}; } if test -e /etc/rc.status; then # SUSE rc script library . /etc/rc.status else export LC_ALL=POSIX _cmd=$1 declare -a _SMSG if test "${_cmd}" = "status"; then _SMSG=(running dead dead unused unknown reserved) _RC_UNUSED=3 else _SMSG=(done failed failed missed failed skipped unused failed failed reserved) _RC_UNUSED=6 fi if test -e /lib/lsb/init-functions; then # LSB . /lib/lsb/init-functions echo_rc() { if test ${_RC_RV} = 0; then log_success_msg " [${_SMSG[${_RC_RV}]}] " else log_failure_msg " [${_SMSG[${_RC_RV}]}] " fi } # TODO: Add checking for lockfiles checkproc() { pidofproc ${1+"$@"} >/dev/null 2>&1; } elif test -e /etc/init.d/functions; then # RHAT . /etc/init.d/functions echo_rc() { #echo -n " [${_SMSG[${_RC_RV}]}] " if test ${_RC_RV} = 0; then success " [${_SMSG[${_RC_RV}]}] " else failure " [${_SMSG[${_RC_RV}]}] " fi } checkproc() { status ${1+"$@"}; } start_daemon() { daemon ${1+"$@"}; } else # emulate it echo_rc() { echo " [${_SMSG[${_RC_RV}]}] "; } fi rc_reset() { _RC_RV=0; } rc_failed() { if test -z "$1"; then _RC_RV=1; elif test "$1" != "0"; then _RC_RV=$1; fi return ${_RC_RV} } rc_check() { rc_failed $? } rc_status() { rc_failed $? if test "$1" = "-r"; then _RC_RV=0; shift; fi if test "$1" = "-s"; then rc_failed 5; echo_rc; rc_failed 3; shift; fi if test "$1" = "-u"; then rc_failed ${_RC_UNUSED}; echo_rc; rc_failed 3; shift; fi if test "$1" = "-v"; then echo_rc; shift; fi if test "$1" = "-r"; then _RC_RV=0; shift; fi return ${_RC_RV} } rc_exit() { exit ${_RC_RV}; } rc_active() { local x for x in /etc/rc.d/rc[0-9].d/S[0-9][0-9]${1} ; do test -e $x && return 0 || break done return 1 } fi # Reset status of this service rc_reset # Return values acc. to LSB for all commands but status: # 0 - success # 1 - generic or unspecified error # 2 - invalid or excess argument(s) # 3 - unimplemented feature (e.g. "reload") # 4 - user had insufficient privileges # 5 - program is not installed # 6 - program is not configured # 7 - program is not running # 8--199 - reserved (8--99 LSB, 100--149 distrib, 150--199 appl) # # Note that starting an already running service, stopping # or restarting a not-running service as well as the restart # with force-reload (in case signaling is not supported) are # considered a success. case "$1" in start) $IPSEC_CMD start 2>&1 rc_status -v1 ;; stop) $IPSEC_CMD stop 2>&1 rc_status -v1 ;; try-restart|condrestart) ## Do a restart only if the service was active before. ## Note: try-restart is now part of LSB (as of 1.9). ## RH has a similar command named condrestart. if test "$1" = "condrestart"; then echo "${attn} Use try-restart ${done}(LSB)${attn} rather than condrestart ${warn}(RH)${norm}" fi $0 status if test $? = 0; then $0 restart else rc_reset # Not running is not a failure. fi # Remember status and be quiet rc_status ;; restart) ## Stop the service and regardless of whether it was ## running or not, start it again. $0 stop sleep 2 $0 start # Remember status and be quiet rc_status ;; reload|force-reload) $IPSEC_CMD reload rc_status -v1 ;; status) # Return value is slightly different for the status command: # 0 - service up and running # 1 - service dead, but /var/run/ pid file exists # 2 - service dead, but /var/lock/ lock file exists # 3 - service not running (unused) # 4 - service status unknown :-( # 5--199 reserved (5--99 LSB, 100--149 distro, 150--199 appl.) echo -n "Checking for service strongSwan IPsec " #checkproc $IPSEC_STARTER $IPSEC_CMD status 2>&1 >/dev/null # NOTE: rc_status knows that we called this init script with # "status" option and adapts its messages accordingly. rc_status -v ;; probe) ## Optional: Probe for the necessity of a reload, print out the ## argument to this init script which is required for a reload. ## Note: probe is not (yet) part of LSB (as of 1.9) test $IPSEC_CONFIG -nt $IPSEC_PIDFILE || \ test $IPSEC_SECRET -nt $IPSEC_PIDFILE && echo reload ;; *) echo "Usage: $0 {start|stop|status|try-restart|restart|force-reload|reload|probe}" exit 1 ;; esac rc_exit ++++++ strongswan.keyring ++++++ pub 3072R/B34DBA77 2009-06-12 uid Andreas Steffen <andreas.steffen(a)strongswan.org> sub 3072g/0E10E91A 2009-08-20 -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v2.0.19 (GNU/Linux) mQGNBEoycP0BDACzL8ymURD7gnaNbGx2VGieNQr/gNISWhqgHaeUxuSkrInxl89A ClvN7DoF2cD7slEqIMQh/8t6xVzmh9teu5uyeV1eyG/CuFMUqawXqpn/sYa2SkgX C/qHB2hIbFg2K4k5LJHxzqHb1OdtOcU6lHg9yrvYcoO+FTVR+rYaVgYbbbziTB/v hAAzvdTdgwMgoQMSXA7FsJ0mALny4IeiCoi6S6qRVDm4zcu11UFT9g1VmhmeHqtU SQso72bPKKhYvu7ZaQrLhkvY9inWr6m9dxV8Zgb1ivZGhzsNzrhGAsz9jmiB5POF Mfph0hREMiS33ph/YMJducGQHYGEza9mKBdUaaAAEL3fCpde7vRa+c5Gc/Y5RUB7 iUsb2KQY+7xTiSUnCHbsMwhndG0dJspVXcz6X+2S3Ty4GaiqkvxI9KLiwiECNl0I oLX5s/FIW6KW+GnxJTp/3h6vvqm8i0+yIwk+ETM4XfhHMwuPkDyf6km1ag3nIUw6 pSSfnQMPhj5rXIMAEQEAAbQwQW5kcmVhcyBTdGVmZmVuIDxhbmRyZWFzLnN0ZWZm ZW5Ac3Ryb25nc3dhbi5vcmc+iQG3BBMBAgAhBQJKMnD9AhsDBwsJCAcDAgEEFQII AwQWAgMBAh4BAheAAAoJEN9CwXCzTbp3t5AL/jrXnnGIHLn8M9rmyoeNe7JQUE5A GSV3UFaZHgHmjbvIHA+dRvh1MPlHuWbaZkHVPtRFvFtEgksc944+XcKoNoExKGKr wLQcUExUiQ0IyNwH70u7f1uFNcbY85Oue5ASzm+wAntnmIlNsN+MHewRWC6f6gYn 1aHwsvh09fz0A34v9wdtim2ek/Voxe3AIDIw2MTNmwF61pXEsrH0wqYnGhYLZ7Qb thnDnHQaUd3IPSa6uAgOOiCoCbKCvP4u/iVm0rmXN9uzmm/i4Y0cE3DopGsqrR5D fWYJjgP4KBCln0LgWtYI8pcYcmA5E+l+fijNcMidtzWHMW2Mj0oZZsO+wlRUYLGh /jRASgq7rXuxV+oGKcBn4RqSHlZ5/BYlvowUxnNFC4tLLlneHidS8TurjacM3fwR MP5NMmcS5d9sVLG1uxl+/g2cRMtphHiziz+79jDc+tSxqRO5lhqyItAD6LC2GxB3 iC5afnMx49+YWzhUTeL/KfkrD9w3/n7O00kLtLkDDQRKjOHDEAwAxdh8W7j/QhE3 KZNmJGsK/QtJ72zZRGRcdUPH6GG//GaAG5hSCjM8q+0MR/G+31uk32RbzRIj1sHQ 8fY0znxPmaeD1wow0hCbDTq+Ep3K8ouaqoqjlP4rd+I94OtxNfXgmllf7BDOZ6lI wUY8ba8cFCPYsv8ZvRXo82XfwFYevQ9kTLqkJT52mMyPZLwYx4DNwuqFtQQEBLKg IVXVgpK6SE72MFP8vyFsdrL0ORgxoWI6PIHbnIRY1KiWUzOSrqirZUHH9MPuzFuB R0+jEAajeKoxycn0ILLM5PBAEFXFgBdtNNCtshe1fR5aPsXcGZsZRjc7mbAHLRqa pVhk7oX31WrGqGHkSM/GAnf3aAzsnCkO5+Tje2iyuoG5OhQbHsvMBOtdvQrwnorl 56EguzuK1mGDsczNsuAYRcKiasCWpsjoytDH+dGEQmKXydD9r06cxPx+mWmWKLo4 w+k4mMC0lFRYKi83cwTpaMpHOeW4+3d1tJfkCQy+vjUz4aZJ/WSXAAMFDACqmeXA Al7WssHkjVZ/vwQfHLHNMZsGEEucvV7KNqMF4Fe6nRbbE6GJOuz6taeFkJIppBqV xhSNOsf5soOXfGp0IgYoC37GPI6AAb4UnG5GVcaAMQAXUYcwfDGGuV/EO5pPrEyP jy++GvjhxcKV3HmUuAfcgyhTGhDOVPxU28Roz3+8Eig085v+lyqAsgFduBrf+ZV+ lHjIOSXSWmTiT8EVSA3fpN14/qhltudhdGIZ/pCW303H9Bd9c4Uc9OzYhRr1VpO6 lpYfTFNey8KQL4z9Kjt0RPscz2hYDOJ1cTFWs/4Z+9mBJODwrnIiORLlgV2NlP5E ZY4MccVFd9K7E/OPQdt3Uv6+6BjYRntY7wsX617T5Rmj8n6AhbpngmWg2D6wRfm7 TyI0Wtz5icCoJIEHQwB/3EhBzQl7tBc0cClwCYm7nTYRt+SL2tfylWy9Leail+ay M6zwMW0klV42E4u8DCy/aJrwmEiVwuwGbXL6z46M9EZguof38MTEmLsHls+JAZ8E GAECAAkFAkqM4cMCGwwACgkQ30LBcLNNunffBgv/b/v3eQoZTWgOB5MnXhIrg/Ki kYTYbnEG9wWM7XIST8bpP7f/UKyD44CCVJH7SVTGAXeyjglnuYXy4FwaTdFmm6al W0sCp4rnmADi5BLLzQlCUa5J0iZ+oAZnAH60BezUM+CYz/QBW3NJmP3323PeM4H4 MZ0vLv3wgaLkFlaK/eASBoC7KuZWAnvsNOdLQ29L4BYgW2Jwk1+PxszjT369DsMU Y3iY6gM9rM71Ajd8x98hd1r26LILGntAEEXxs+13Kka7J4GCqf8/J9ZR01dDp8QM +M9EHFLnthpAyUuSXm5Qlglavnf7tU6AA0SFuA0pP5CXVLG1DLT1fJvNOqjdzPsf u/48AM2Lpxj0gKt1yDQc890GxwnOL1iZ6+XMh9/ujWy7Q7dI4M2mthwYFXldWrPS CmMToWfl62BxPdY5FIECXeRwTIO9sI0LQVc2eAG8lDsge05q1nJFxo9WKr7ewAdF b/fMIr7XMwoMj2SQSy/tZVCBnDXR5Gw5HSxRnIAS =ze82 -----END PGP PUBLIC KEY BLOCK----- ++++++ strongswan_ipsec_service.patch ++++++ --- init/systemd/strongswan.service.in +++ init/systemd/strongswan.service.in 2012/10/31 15:21:11 @@ -8,3 +8,4 @@ StandardOutput=syslog [Install] WantedBy=multi-user.target +Alias=ipsec.service ++++++ strongswan_modprobe_syslog.patch ++++++ --- src/starter/klips.c +++ src/starter/klips.c 2012/10/30 17:07:23 @@ -30,7 +30,7 @@ bool starter_klips_init(void) /* ipsec module makes the pf_key proc interface visible */ if (stat(PROC_MODULES, &stb) == 0) { - ignore_result(system("modprobe -qv ipsec")); + ignore_result(system("modprobe -s ipsec")); } /* now test again */ @@ -42,9 +42,9 @@ bool starter_klips_init(void) } /* load crypto algorithm modules */ - ignore_result(system("modprobe -qv ipsec_aes")); - ignore_result(system("modprobe -qv ipsec_blowfish")); - ignore_result(system("modprobe -qv ipsec_sha2")); + ignore_result(system("modprobe -s ipsec_aes")); + ignore_result(system("modprobe -s ipsec_blowfish")); + ignore_result(system("modprobe -s ipsec_sha2")); DBG2(DBG_APP, "found KLIPS IPsec stack"); return TRUE; --- src/starter/netkey.c +++ src/starter/netkey.c 2012/10/30 17:07:02 @@ -31,7 +31,7 @@ bool starter_netkey_init(void) /* af_key module makes the netkey proc interface visible */ if (stat(PROC_MODULES, &stb) == 0) { - ignore_result(system("modprobe -qv af_key")); + ignore_result(system("modprobe -s af_key")); } /* now test again */ @@ -45,11 +45,11 @@ bool starter_netkey_init(void) /* make sure that all required IPsec modules are loaded */ if (stat(PROC_MODULES, &stb) == 0) { - ignore_result(system("modprobe -qv ah4")); - ignore_result(system("modprobe -qv esp4")); - ignore_result(system("modprobe -qv ipcomp")); - ignore_result(system("modprobe -qv xfrm4_tunnel")); - ignore_result(system("modprobe -qv xfrm_user")); + ignore_result(system("modprobe -s ah4")); + ignore_result(system("modprobe -s esp4")); + ignore_result(system("modprobe -s ipcomp")); + ignore_result(system("modprobe -s xfrm4_tunnel")); + ignore_result(system("modprobe -s xfrm_user")); } DBG2(DBG_APP, "found netkey IPsec stack"); -- To unsubscribe, e-mail: opensuse-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-commit+help(a)opensuse.org

1 0

commit strongswan for openSUSE:12.3:Update
by root＠hilbert.suse.de 22 May '14

22 May '14

Hello community, here is the log from the commit of package strongswan for openSUSE:12.3:Update checked in at 2014-05-22 11:17:59 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:12.3:Update/strongswan (Old) and /work/SRC/openSUSE:12.3:Update/.strongswan.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "strongswan" Changes: -------- New Changes file: NO CHANGES FILE!!! ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ _link ++++++ --- /var/tmp/diff_new_pack.PUhmiw/_old 2014-05-22 11:18:01.000000000 +0200 +++ /var/tmp/diff_new_pack.PUhmiw/_new 2014-05-22 11:18:01.000000000 +0200 @@ -1 +1 @@ -<link package='strongswan.2175' cicount='copy' /> +<link package='strongswan.2814' cicount='copy' /> -- To unsubscribe, e-mail: opensuse-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-commit+help(a)opensuse.org

1 0

commit ibus for openSUSE:Factory
by root＠hilbert.suse.de 22 May '14

22 May '14

Hello community, here is the log from the commit of package ibus for openSUSE:Factory checked in at 2014-05-22 09:04:37 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/ibus (Old) and /work/SRC/openSUSE:Factory/.ibus.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "ibus" Changes: -------- --- /work/SRC/openSUSE:Factory/ibus/ibus.changes 2014-03-20 07:05:54.000000000 +0100 +++ /work/SRC/openSUSE:Factory/.ibus.new/ibus.changes 2014-05-22 09:04:50.000000000 +0200 @@ -1,0 +2,13 @@ +Tue May 20 15:28:40 CEST 2014 - tiwai(a)suse.de + +- Fix the lost XIM input after GNOME screen lock (bnc#874969): + ibus-xim-fix-re-focus-after-lock.patch + +------------------------------------------------------------------- +Wed May 14 08:04:18 UTC 2014 - cxiong(a)suse.com + +- Let GNOME 3 handles ibus startup&setup. (bnc#873016) + * Changed xim.d-ibus-121. + * Reformatting the latter part of the xim.d-ibus-121. + +------------------------------------------------------------------- New: ---- ibus-xim-fix-re-focus-after-lock.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ ibus.spec ++++++ --- /var/tmp/diff_new_pack.xJMes7/_old 2014-05-22 09:04:51.000000000 +0200 +++ /var/tmp/diff_new_pack.xJMes7/_new 2014-05-22 09:04:51.000000000 +0200 @@ -42,6 +42,8 @@ %endif # PATCH-FIX-OPENSUSE reload-preload-engines-until-users-customize-the-list.patch ftake(a)geeko.jp Patch3: show-input-mode-icon.patch +# PATFH-FIX-SUSE ibus-xim-fix-re-focus-after-lock.patch bnc#874869 tiwa(a)suse.de -- Fix lost XIM input after screenlock +Patch4: ibus-xim-fix-re-focus-after-lock.patch BuildRoot: %{_tmppath}/%{name}-%{version}-build PreReq: /usr/bin/touch @@ -188,6 +190,7 @@ %endif %patch3 -p1 +%patch4 -p1 %build autoreconf -fi ++++++ ibus-xim-fix-re-focus-after-lock.patch ++++++ --- client/x11/main.c | 3 +++ 1 file changed, 3 insertions(+) --- a/client/x11/main.c +++ b/client/x11/main.c @@ -421,6 +421,9 @@ xim_set_ic_focus (XIMS xims, IMChangeFoc GINT_TO_POINTER ((gint) call_data->icid)); g_return_val_if_fail (x11ic != NULL, 0); + /* make sure that focus has been already out */ + ibus_input_context_focus_out (x11ic->context); + ibus_input_context_focus_in (x11ic->context); _xim_set_cursor_location (x11ic); ++++++ xim.d-ibus-121 ++++++ --- /var/tmp/diff_new_pack.xJMes7/_old 2014-05-22 09:04:51.000000000 +0200 +++ /var/tmp/diff_new_pack.xJMes7/_new 2014-05-22 09:04:51.000000000 +0200 @@ -7,9 +7,9 @@ return 1 fi -#when skim installed, Autostart must be "false". -#here we move $HOME/.kde/share/config/skimrc to skimrc.orig.ibus case "$WINDOWMANAGER" in + #when skim installed, Autostart must be "false". + #here we move $HOME/.kde/share/config/skimrc to skimrc.orig.ibus *kde*) if type -p skim > /dev/null 2>&1 \ && ! grep -i -q "^[[:space:]]*Autostart.*=.*false" $HOME/.kde/share/config/skimrc @@ -28,6 +28,16 @@ : fi ;; + # GNOME 3 Settings Daemon keyboard plugin manages all ibus settings itself, + # so don't do manual setup&startup of ibus otherwise it would conflict with + # G-S-D. see bnc#873016. + *gnome-session*) + # make sure G-S-D keyboard plugin is active + echo "ibus will be managed by GNOME." + gsettings set org.gnome.settings-daemon.plugins.keyboard active true + PATH=$OLD_PATH + return 0 + ;; *) # do nothing ;; @@ -35,26 +45,26 @@ # Force OOo to use gtk-immodule # Better way to fix cursor following problem (on_the_spot bug) under libreoffice-kde4 - export OOO_FORCE_DESKTOP=gnome +export OOO_FORCE_DESKTOP=gnome # Determine the LC_CTYPE locale category setting #tmplang=${LC_ALL-${LC_CTYPE-${LANG-en_US}}} - export LC_CTYPE=$LANG - export XMODIFIERS="@im=ibus" - export GTK_IM_MODULE=ibus - export QT_IM_SWITCHER=imsw-multi - if [ -e /usr/$SYS_LIB/qt4/plugins/inputmethods/libqtim-ibus.so ]; then - export QT_IM_MODULE=ibus - else - export QT_IM_MODULE=xim - fi +export LC_CTYPE=$LANG +export XMODIFIERS="@im=ibus" +export GTK_IM_MODULE=ibus +export QT_IM_SWITCHER=imsw-multi +if [ -e /usr/$SYS_LIB/qt4/plugins/inputmethods/libqtim-ibus.so ]; then + export QT_IM_MODULE=ibus +else + export QT_IM_MODULE=xim +fi - if [ -z $DBUS_SESSION_BUS_ADDRESS ]; then - eval `dbus-launch --sh-syntax --exit-with-session --close-stderr < /dev/null` - fi +if [ -z $DBUS_SESSION_BUS_ADDRESS ]; then + eval `dbus-launch --sh-syntax --exit-with-session --close-stderr < /dev/null` +fi - ibus-daemon --xim -d +ibus-daemon --xim -d PATH=$OLD_PATH -- To unsubscribe, e-mail: opensuse-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-commit+help(a)opensuse.org

1 0

commit rubygem-nokogiri for openSUSE:Factory
by root＠hilbert.suse.de 22 May '14

22 May '14

Hello community, here is the log from the commit of package rubygem-nokogiri for openSUSE:Factory checked in at 2014-05-22 09:04:35 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/rubygem-nokogiri (Old) and /work/SRC/openSUSE:Factory/.rubygem-nokogiri.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "rubygem-nokogiri" Changes: -------- --- /work/SRC/openSUSE:Factory/rubygem-nokogiri/rubygem-nokogiri.changes 2014-02-12 20:38:01.000000000 +0100 +++ /work/SRC/openSUSE:Factory/.rubygem-nokogiri.new/rubygem-nokogiri.changes 2014-05-22 09:04:48.000000000 +0200 @@ -1,0 +2,21 @@ +Wed May 21 11:43:48 UTC 2014 - coolo(a)suse.com + +- add more cleanup + +------------------------------------------------------------------- +Sun May 18 09:04:45 UTC 2014 - coolo(a)suse.com + +- updated to version 1.6.2.1 + * Fix statically-linked libxml2 installation when using universal builds of Ruby. #1104 + * Patching `mini_portile` to address the git dependency detailed in #1102. + * Library load fix to address segfault reported on some systems. #1097 + + A set of security and bugfix patches have been backported from the libxml2 and libxslt repositories onto the version of 2.8.0 packaged with Nokogiri, including these notable security fixes: + + * https://git.gnome.org/browse/libxml2/commit/?id=4629ee02ac649c27f9c0cf98ba0… + * CVE-2013-2877 https://git.gnome.org/browse/libxml2/commit/?id=e50ba8164eee06461c73cd8abb9… + * CVE-2014-0191 https://git.gnome.org/browse/libxml2/commit/?id=9cd1c3cfbd32655d60572c0a413… + + It is recommended that you upgrade from 1.6.x to this version as soon as possible. + +------------------------------------------------------------------- Old: ---- nokogiri-1.6.1.gem New: ---- nokogiri-1.6.2.1.gem ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ rubygem-nokogiri.spec ++++++ --- /var/tmp/diff_new_pack.1cR2T3/_old 2014-05-22 09:04:50.000000000 +0200 +++ /var/tmp/diff_new_pack.1cR2T3/_new 2014-05-22 09:04:50.000000000 +0200 @@ -17,7 +17,7 @@ Name: rubygem-nokogiri -Version: 1.6.1 +Version: 1.6.2.1 Release: 0 %define mod_name nokogiri %define mod_full_name %{mod_name}-%{version} @@ -31,7 +31,8 @@ BuildRequires: update-alternatives BuildRequires: rubygem(rdoc) > 3.10 # MANUAL BEGIN -BuildRequires: libxml2-devel +BuildRequires: libxml2-devel >= 2.6.21 +Requires: libxml2-2 >= 2.6.21 BuildRequires: libxslt-devel BuildRequires: rubygem(mini_portile) # MANUAL END @@ -79,6 +80,7 @@ %gem_cleanup # MANUAL rm -rf %{buildroot}%{gem_base}/gems/%{mod_full_name}/ports +rm %{buildroot}%{gem_base}/doc/extensions/*/*/%{mod_full_name}/page-mkmf_log.ri mkdir -p %{buildroot}%{_sysconfdir}/alternatives mv %{buildroot}%{_bindir}/nokogiri{,%{mod_branch}} -- To unsubscribe, e-mail: opensuse-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-commit+help(a)opensuse.org

1 0