July 2018 - openSUSE Commits - openSUSE Mailing Lists

commit 000product for openSUSE:Factory
by root 31 Jul '18

31 Jul '18

Hello community, here is the log from the commit of package 000product for openSUSE:Factory checked in at 2018-07-31 16:04:22 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/000product (Old) and /work/SRC/openSUSE:Factory/.000product.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "000product" Tue Jul 31 16:04:22 2018 rev:403 rq: version:unknown Tue Jul 31 16:04:21 2018 rev:402 rq: version:unknown Changes: -------- New Changes file: NO CHANGES FILE!!! ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ _service:product_converter:openSUSE-Addon-NonOss-ftp-ftp-i586_x86_64.kiwi: same change _service:product_converter:openSUSE-Addon-NonOss-release.spec: same change ++++++ _service:product_converter:openSUSE-Tumbleweed-Kubic-dvd5-dvd-x86_64.kiwi ++++++ --- /var/tmp/diff_new_pack.hcRCnq/_old 2018-07-31 16:05:07.956131697 +0200 +++ /var/tmp/diff_new_pack.hcRCnq/_new 2018-07-31 16:05:07.956131697 +0200 @@ -1,4 +1,4 @@ -<image name="OBS__openSUSE-Tumbleweed-Kubic___20180728" schemaversion="4.1"> +<image name="OBS__openSUSE-Tumbleweed-Kubic___20180731" schemaversion="4.1"> <description type="system"> <author>The SUSE Team</author> <contact>build(a)opensuse.org</contact> @@ -35,9 +35,9 @@ <productvar name="SEPARATE_MEDIA">true</productvar> <productvar name="SHA1OPT">-x -2</productvar> <productvar name="VENDOR">openSUSE</productvar> - <productvar name="VERSION">20180728</productvar> + <productvar name="VERSION">20180731</productvar> <productinfo name="CONTENTSTYLE">11</productinfo> - <productinfo name="DISTRO">cpe:/o:opensuse:opensuse-tumbleweed-kubic:20180728,openSUSE Tumbleweed Kubic</productinfo> + <productinfo name="DISTRO">cpe:/o:opensuse:opensuse-tumbleweed-kubic:20180731,openSUSE Tumbleweed Kubic</productinfo> <productinfo name="LINGUAS">en_US </productinfo> <productinfo name="VENDOR">openSUSE</productinfo> <productoption name="INI_DIR">/usr/share/kiwi/modules/plugins/suse-tumbleweed</productoption> ++++++ _service:product_converter:openSUSE-Tumbleweed-Kubic-release.spec ++++++ --- /var/tmp/diff_new_pack.hcRCnq/_old 2018-07-31 16:05:07.976131731 +0200 +++ /var/tmp/diff_new_pack.hcRCnq/_new 2018-07-31 16:05:07.980131738 +0200 @@ -17,7 +17,7 @@ Name: openSUSE-Tumbleweed-Kubic-release -Version: 20180728 +Version: 20180731 Release: 0 Summary: openSUSE Tumbleweed Kubic License: GPL-2.0-or-later @@ -38,9 +38,9 @@ ExclusiveArch: %ix86 x86_64 ppc64le s390x aarch64 Provides: %name-%version Provides: product() = openSUSE-Tumbleweed-Kubic -Provides: product(openSUSE-Tumbleweed-Kubic) = 20180728-0 +Provides: product(openSUSE-Tumbleweed-Kubic) = 20180731-0 Provides: product-label() = openSUSE%20Tumbleweed%20Kubic -Provides: product-cpeid() = cpe%3A%2Fo%3Aopensuse%3Aopensuse%2Dtumbleweed%2Dkubic%3A20180728 +Provides: product-cpeid() = cpe%3A%2Fo%3Aopensuse%3Aopensuse%2Dtumbleweed%2Dkubic%3A20180731 Provides: product-url(releasenotes) = http%3A%2F%2Fdoc.opensuse.org%2Frelease%2Dnotes%2Fx86_64%2FopenSUSE%2FTumbleweed%2Frelease%2Dnotes%2DopenSUSE.rpm Provides: product-endoflife() Requires: product_flavor(openSUSE-Tumbleweed-Kubic) @@ -61,7 +61,7 @@ Group: System/Fhs Provides: product_flavor() Provides: flavor(dvd) -Provides: product_flavor(openSUSE-Tumbleweed-Kubic) = 20180728-0 +Provides: product_flavor(openSUSE-Tumbleweed-Kubic) = 20180731-0 Summary: openSUSE Tumbleweed Kubic %description dvd @@ -123,11 +123,11 @@ <product schemeversion="0"> <vendor>openSUSE</vendor> <name>openSUSE-Tumbleweed-Kubic</name> - <version>20180728</version> + <version>20180731</version> <release>0</release> <endoflife></endoflife> <arch>%{_target_cpu}</arch> - <cpeid>cpe:/o:opensuse:opensuse-tumbleweed-kubic:20180728</cpeid> + <cpeid>cpe:/o:opensuse:opensuse-tumbleweed-kubic:20180731</cpeid> <productline>openSUSE-Tumbleweed-Kubic</productline> <register> <pool> ++++++ _service:product_converter:openSUSE-cd-mini-i586.kiwi ++++++ --- /var/tmp/diff_new_pack.hcRCnq/_old 2018-07-31 16:05:07.996131765 +0200 +++ /var/tmp/diff_new_pack.hcRCnq/_new 2018-07-31 16:05:08.000131772 +0200 @@ -1,4 +1,4 @@ -<image name="OBS__openSUSE___20180728" schemaversion="4.1"> +<image name="OBS__openSUSE___20180731" schemaversion="4.1"> <description type="system"> <author>The SUSE Team</author> <contact>build(a)opensuse.org</contact> @@ -32,9 +32,9 @@ <productvar name="SEPARATE_MEDIA">true</productvar> <productvar name="SHA1OPT">-x -2</productvar> <productvar name="VENDOR">openSUSE</productvar> - <productvar name="VERSION">20180728</productvar> + <productvar name="VERSION">20180731</productvar> <productinfo name="CONTENTSTYLE">11</productinfo> - <productinfo name="DISTRO">cpe:/o:opensuse:opensuse:20180728,openSUSE Tumbleweed</productinfo> + <productinfo name="DISTRO">cpe:/o:opensuse:opensuse:20180731,openSUSE Tumbleweed</productinfo> <productinfo name="LINGUAS">cs da de en en_GB en_US es fi fr hu it ja nb nl pl pt pt_BR ru sv zh zh_CN zh_TW </productinfo> <productinfo name="VENDOR">openSUSE</productinfo> <productoption name="INI_DIR">/usr/share/kiwi/modules/plugins/suse-tumbleweed</productoption> _service:product_converter:openSUSE-cd-mini-x86_64.kiwi: same change _service:product_converter:openSUSE-dvd5-dvd-i586.kiwi: same change _service:product_converter:openSUSE-dvd5-dvd-x86_64.kiwi: same change ++++++ _service:product_converter:openSUSE-ftp-ftp-i586_x86_64.kiwi ++++++ --- /var/tmp/diff_new_pack.hcRCnq/_old 2018-07-31 16:05:08.068131888 +0200 +++ /var/tmp/diff_new_pack.hcRCnq/_new 2018-07-31 16:05:08.068131888 +0200 @@ -1,4 +1,4 @@ -<image name="OBS__openSUSE___20180728" schemaversion="4.1"> +<image name="OBS__openSUSE___20180731" schemaversion="4.1"> <description type="system"> <author>The SUSE Team</author> <contact>build(a)opensuse.org</contact> @@ -24,7 +24,7 @@ <productvar name="DISTNAME">openSUSE</productvar> <productvar name="FLAVOR">ftp</productvar> <productvar name="MAKE_LISTINGS">true</productvar> - <productvar name="MEDIUM_NAME">openSUSE-20180728-i586-x86_64</productvar> + <productvar name="MEDIUM_NAME">openSUSE-20180731-i586-x86_64</productvar> <productvar name="MULTIPLE_MEDIA">true</productvar> <productvar name="PRODUCT_DIR">/</productvar> <productvar name="PRODUCT_NAME">$DISTNAME-$FLAVOR</productvar> @@ -36,9 +36,9 @@ <productvar name="SEPARATE_MEDIA">true</productvar> <productvar name="SHA1OPT">-x -2</productvar> <productvar name="VENDOR">openSUSE</productvar> - <productvar name="VERSION">20180728</productvar> + <productvar name="VERSION">20180731</productvar> <productinfo name="CONTENTSTYLE">11</productinfo> - <productinfo name="DISTRO">cpe:/o:opensuse:opensuse:20180728,openSUSE Tumbleweed</productinfo> + <productinfo name="DISTRO">cpe:/o:opensuse:opensuse:20180731,openSUSE Tumbleweed</productinfo> <productinfo name="LINGUAS">cs da de en en_GB en_US es fi fr hu it ja nb nl pl pt pt_BR ru sv zh zh_CN zh_TW </productinfo> <productinfo name="VENDOR">openSUSE</productinfo> <productoption name="DEBUGMEDIUM">2</productoption> ++++++ _service:product_converter:openSUSE-release.spec ++++++ --- /var/tmp/diff_new_pack.hcRCnq/_old 2018-07-31 16:05:08.100131942 +0200 +++ /var/tmp/diff_new_pack.hcRCnq/_new 2018-07-31 16:05:08.112131963 +0200 @@ -20,7 +20,7 @@ #define betaversion %{nil} %define codename Tumbleweed Name: openSUSE-release -Version: 20180728 +Version: 20180731 Release: 0 # 0 is the product release, not the build release of this package Summary: openSUSE Tumbleweed @@ -51,7 +51,7 @@ Obsoletes: aaa_version Obsoletes: openSUSE-Promo-release <= 11.1 Obsoletes: openSUSE-release-live <= 11.0 -Obsoletes: product_flavor(%{product}) < 20180728 +Obsoletes: product_flavor(%{product}) < 20180731 # bnc#826592 Provides: weakremover(kernel-default) < 3.11 Provides: weakremover(kernel-desktop) < 4.2 @@ -61,7 +61,7 @@ Provides: weakremover(kernel-xen) < 3.11 Provides: %name-%version Provides: product() = openSUSE -Provides: product(openSUSE) = 20180728-0 +Provides: product(openSUSE) = 20180731-0 %ifarch x86_64 Provides: product-register-target() = openSUSE%2DTumbleweed%2Dx86_64 %endif @@ -75,7 +75,7 @@ Provides: product-register-target() = openSUSE%2DTumbleweed%2Daarch64 %endif Provides: product-label() = openSUSE -Provides: product-cpeid() = cpe%3A%2Fo%3Aopensuse%3Aopensuse%3A20180728 +Provides: product-cpeid() = cpe%3A%2Fo%3Aopensuse%3Aopensuse%3A20180731 Provides: product-url(releasenotes) = http%3A%2F%2Fdoc.opensuse.org%2Frelease%2Dnotes%2Fx86_64%2FopenSUSE%2FTumbleweed%2Frelease%2Dnotes%2DopenSUSE.rpm Provides: product-url(repository) = http%3A%2F%2Fdownload.opensuse.org%2Ftumbleweed%2Frepo%2Foss%2F Requires: product_flavor(openSUSE) @@ -17291,7 +17291,7 @@ Group: System/Fhs Provides: product_flavor() Provides: flavor(ftp) -Provides: product_flavor(openSUSE) = 20180728-0 +Provides: product_flavor(openSUSE) = 20180731-0 Summary: openSUSE Tumbleweed %description ftp @@ -17306,7 +17306,7 @@ Group: System/Fhs Provides: product_flavor() Provides: flavor(mini) -Provides: product_flavor(openSUSE) = 20180728-0 +Provides: product_flavor(openSUSE) = 20180731-0 Summary: openSUSE Tumbleweed %description mini @@ -17321,7 +17321,7 @@ Group: System/Fhs Provides: product_flavor() Provides: flavor(dvd) -Provides: product_flavor(openSUSE) = 20180728-0 +Provides: product_flavor(openSUSE) = 20180731-0 Summary: openSUSE Tumbleweed %description dvd @@ -17336,7 +17336,7 @@ Group: System/Fhs Provides: product_flavor() Provides: flavor(livecd-kde) -Provides: product_flavor(openSUSE) = 20180728-0 +Provides: product_flavor(openSUSE) = 20180731-0 Summary: openSUSE Tumbleweed %description livecd-kde @@ -17351,7 +17351,7 @@ Group: System/Fhs Provides: product_flavor() Provides: flavor(livecd-x11) -Provides: product_flavor(openSUSE) = 20180728-0 +Provides: product_flavor(openSUSE) = 20180731-0 Summary: openSUSE Tumbleweed %description livecd-x11 @@ -17366,7 +17366,7 @@ Group: System/Fhs Provides: product_flavor() Provides: flavor(livecd-gnome) -Provides: product_flavor(openSUSE) = 20180728-0 +Provides: product_flavor(openSUSE) = 20180731-0 Summary: openSUSE Tumbleweed %description livecd-gnome @@ -17381,7 +17381,7 @@ Group: System/Fhs Provides: product_flavor() Provides: flavor(usb-kde) -Provides: product_flavor(openSUSE) = 20180728-0 +Provides: product_flavor(openSUSE) = 20180731-0 Summary: openSUSE Tumbleweed %description usb-kde @@ -17396,7 +17396,7 @@ Group: System/Fhs Provides: product_flavor() Provides: flavor(usb-gnome) -Provides: product_flavor(openSUSE) = 20180728-0 +Provides: product_flavor(openSUSE) = 20180731-0 Summary: openSUSE Tumbleweed %description usb-gnome @@ -17411,7 +17411,7 @@ Group: System/Fhs Provides: product_flavor() Provides: flavor(usb-x11) -Provides: product_flavor(openSUSE) = 20180728-0 +Provides: product_flavor(openSUSE) = 20180731-0 Summary: openSUSE Tumbleweed %description usb-x11 @@ -17484,10 +17484,10 @@ <product schemeversion="0"> <vendor>openSUSE</vendor> <name>openSUSE</name> - <version>20180728</version> + <version>20180731</version> <release>0</release> <arch>%{_target_cpu}</arch> - <cpeid>cpe:/o:opensuse:opensuse:20180728</cpeid> + <cpeid>cpe:/o:opensuse:opensuse:20180731</cpeid> <productline>openSUSE</productline> <register> <pool> openSUSE-release.spec: same change ++++++ openSUSE-Tumbleweed-Kubic.product ++++++ --- /var/tmp/diff_new_pack.hcRCnq/_old 2018-07-31 16:05:08.428132502 +0200 +++ /var/tmp/diff_new_pack.hcRCnq/_new 2018-07-31 16:05:08.428132502 +0200 @@ -6,7 +6,7 @@ <name>openSUSE-Tumbleweed-Kubic</name> <releasepkgname>openSUSE-Tumbleweed-Kubic-release</releasepkgname> <endoflife/> - <version>20180728</version> + <version>20180731</version>  <release>0</release> <productline>openSUSE-Tumbleweed-Kubic</productline> ++++++ openSUSE.product ++++++ --- /var/tmp/diff_new_pack.hcRCnq/_old 2018-07-31 16:05:08.444132529 +0200 +++ /var/tmp/diff_new_pack.hcRCnq/_new 2018-07-31 16:05:08.444132529 +0200 @@ -4,7 +4,7 @@ <product> <vendor>openSUSE</vendor> <name>openSUSE</name> - <version>20180728</version> + <version>20180731</version> <release>0</release> <productline>openSUSE</productline>

1 0

commit scap-workbench for openSUSE:Factory
by root 31 Jul '18

31 Jul '18

Hello community, here is the log from the commit of package scap-workbench for openSUSE:Factory checked in at 2018-07-31 16:04:19 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/scap-workbench (Old) and /work/SRC/openSUSE:Factory/.scap-workbench.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "scap-workbench" Tue Jul 31 16:04:19 2018 rev:10 rq:626684 version:1.1.5 Changes: -------- --- /work/SRC/openSUSE:Factory/scap-workbench/scap-workbench.changes 2018-01-03 13:39:32.371231584 +0100 +++ /work/SRC/openSUSE:Factory/.scap-workbench.new/scap-workbench.changes 2018-07-31 16:04:29.540066170 +0200 @@ -1,0 +2,6 @@ +Thu Jul 26 09:11:29 UTC 2018 - matthias.gerstner(a)suse.com + +- 0001-pkexec-avoid-potential-local-root-exploit-by-using-P.patch: + harden and sanitize the pkexec wrapper (bsc#1084706). + +------------------------------------------------------------------- New: ---- 0001-pkexec-avoid-potential-local-root-exploit-by-using-P.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ scap-workbench.spec ++++++ --- /var/tmp/diff_new_pack.1hVxZt/_old 2018-07-31 16:04:30.276067425 +0200 +++ /var/tmp/diff_new_pack.1hVxZt/_new 2018-07-31 16:04:30.276067425 +0200 @@ -1,7 +1,7 @@ # # spec file for package scap-workbench # -# Copyright (c) 2017 SUSE LINUX GmbH, Nuernberg, Germany. +# Copyright (c) 2018 SUSE LINUX GmbH, Nuernberg, Germany. # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -20,10 +20,11 @@ Version: 1.1.5 Release: 0 Summary: A SCAP scanner and SCAP content editor -License: GPL-3.0 +License: GPL-3.0-only Group: Productivity/Security Url: https://github.com/OpenSCAP/scap-workbench Source: https://github.com/OpenSCAP/scap-workbench/releases/download/%version/scap-… +Patch0: 0001-pkexec-avoid-potential-local-root-exploit-by-using-P.patch BuildRequires: cmake >= 2.6 BuildRequires: openscap-devel # SLE 11 SP3: libopenscap needs libxslt without requiring it @@ -57,6 +58,7 @@ %prep %setup -q +%patch0 -p1 %build %if 0%{?cmake} ++++++ 0001-pkexec-avoid-potential-local-root-exploit-by-using-P.patch ++++++ >From 2dff0925c5435d3bdb35186c015a89613ce4e3ad Mon Sep 17 00:00:00 2001 From: Matthias Gerstner <matthias.gerstner(a)suse.de> Date: Thu, 19 Jul 2018 12:27:46 +0200 Subject: [PATCH] pkexec: avoid potential local root exploit by using PKEXEC_UID and sudo If an admin relaxes the required polkit authentication for running scap-workbench-oscap.sh from auth_admin to auth_self or yes, then the current implementation of the wrapper script allows for a local root exploit. A command line like this would overwrite /etc/shadow with a file owned by the non-privileged user: pkexec --disable-internal-agent /usr/lib64/scap-workbench/scap-workbench-oscap.sh 1000 100 \ xccdf eval --profile Default --oval-results --results /etc/shadow \ --results-arf /tmp/scap.results.arf --report /tmp/scap.report \ --progress /usr/share/openscap/scap-yast2sec-xccdf.xml The copying of the target files needs to be done in the context of the unprivileged user to prevent any symlink attacks or maliciously specified paths. This is done by using sudo as a frontend to cp. Also the user should not pass his own uid and gid. This would allow to change ownership of files to arbitrary other users. Instead pkexec offers the PKEXEC_UID environment variable which contains the uid of the authenticated user. The gid can be derived from the uid. --- scap-workbench-oscap.sh | 32 ++++++++++++++++++++++++-------- scap-workbench-pkexec-oscap.sh | 7 ++----- 2 files changed, 26 insertions(+), 13 deletions(-) diff --git a/scap-workbench-oscap.sh b/scap-workbench-oscap.sh index 216376f..6f720de 100755 --- a/scap-workbench-oscap.sh +++ b/scap-workbench-oscap.sh @@ -25,14 +25,15 @@ trap "" SIGHUP SIGINT # valuable gets skipped echo "Dummy text" 1>&2 -wrapper_uid=$1 -shift -wrapper_gid=$1 -shift +# prevent world-readable files being created +umask 0007 real_uid=`id -u` real_gid=`id -g` +wrapper_uid=${PKEXEC_UID:-${real_uid}} +wrapper_gid=$(id -g ${wrapper_uid}) + TEMP_DIR=`mktemp -d` args=("$@") @@ -84,19 +85,34 @@ RET=$? popd > /dev/null +# only copy files with the target user's permissions via sudo if we're running +# privileged, otherwise he can trick us into overwriting arbitrary files +do_chown=false +if [ $wrapper_uid -ne $real_uid ] || [ $wrapper_gid -ne $real_gid ]; then + do_chown=true +fi + function chown_copy { local what="$1" local where="$2" - [ ! -f "$what" ] || cp "$what" "$where" + [ -f "$what" ] || return - # chown only required if wrapper_{uid,gid} differs from real_{uid,gid} - if [ $wrapper_uid -ne $real_uid ] || [ $wrapper_gid -ne $real_gid ]; then - chown $wrapper_uid:$wrapper_gid $where + if $do_chown; then + chown $wrapper_uid:$wrapper_gid "$what" + sudo -u "#${wrapper_uid}" cp "$what" "$where" + else + cp "$what" "$where" fi } +if $do_chown; then + # don't grant the user ownership of or write access to the directory, + # otherwise he could trick us by replacing the files with symlinks + chmod o+rx "${TEMP_DIR}" +fi + chown_copy "$TEMP_DIR/results-xccdf.xml" "$TARGET_RESULTS_XCCDF" chown_copy "$TEMP_DIR/results-arf.xml" "$TARGET_RESULTS_ARF" chown_copy "$TEMP_DIR/report.html" "$TARGET_REPORT" diff --git a/scap-workbench-pkexec-oscap.sh b/scap-workbench-pkexec-oscap.sh index 1ae8329..a8d9b2b 100755 --- a/scap-workbench-pkexec-oscap.sh +++ b/scap-workbench-pkexec-oscap.sh @@ -18,9 +18,6 @@ set -u -o pipefail -uid=`id -u` -gid=`id -g` - PARENT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )" PKEXEC_PATH="pkexec" @@ -29,7 +26,7 @@ SCAP_WORKBENCH_OSCAP="$PARENT_DIR/scap-workbench-oscap.sh" # We run unprivileged if pkexec was not found. #which $PKEXEC_PATH > /dev/null || exit 1 # fail if pkexec was not found -$PKEXEC_PATH --disable-internal-agent "$SCAP_WORKBENCH_OSCAP" $uid $gid "$@" 2> >(tail -n +2 1>&2) +$PKEXEC_PATH --disable-internal-agent "$SCAP_WORKBENCH_OSCAP" "$@" 2> >(tail -n +2 1>&2) EC=$? # 126 is a special exit code of pkexec when user dismisses the auth dialog @@ -38,7 +35,7 @@ EC=$? # This is common in niche desktop environments. if [ $EC -eq 126 ] || [ $EC -eq 127 ]; then # in case of dismissed dialog we run without super user rights - "$SCAP_WORKBENCH_OSCAP" $uid $gid "$@" 2> >(tail -n +2 1>&2); + "$SCAP_WORKBENCH_OSCAP" "$@" 2> >(tail -n +2 1>&2); exit $? fi -- 2.16.4

1 0

commit complexity for openSUSE:Factory
by root 31 Jul '18

31 Jul '18

Hello community, here is the log from the commit of package complexity for openSUSE:Factory checked in at 2018-07-31 16:04:16 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/complexity (Old) and /work/SRC/openSUSE:Factory/.complexity.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "complexity" Tue Jul 31 16:04:16 2018 rev:2 rq:626678 version:1.10 Changes: -------- --- /work/SRC/openSUSE:Factory/complexity/complexity.changes 2017-12-02 13:11:53.703696621 +0100 +++ /work/SRC/openSUSE:Factory/.complexity.new/complexity.changes 2018-07-31 16:04:28.780064875 +0200 @@ -1,0 +2,11 @@ +Tue Jul 31 10:57:56 UTC 2018 - mpluskal(a)suse.com + +- Add gpg signature +- Run tests during build + +------------------------------------------------------------------- +Tue Jul 31 08:54:21 UTC 2018 - schwab(a)suse.de + +- Require pkgconfig(autoopts) for building + +------------------------------------------------------------------- New: ---- complexity-1.10.tar.xz.sig complexity.keyring ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ complexity.spec ++++++ --- /var/tmp/diff_new_pack.kT19yv/_old 2018-07-31 16:04:29.368065877 +0200 +++ /var/tmp/diff_new_pack.kT19yv/_new 2018-07-31 16:04:29.368065877 +0200 @@ -1,7 +1,7 @@ # # spec file for package complexity # -# Copyright (c) 2017 SUSE LINUX GmbH, Nuernberg, Germany. +# Copyright (c) 2018 SUSE LINUX GmbH, Nuernberg, Germany. # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -20,12 +20,16 @@ Version: 1.10 Release: 0 Summary: Compute the complexity of C source code -License: GPL-3.0+ +License: GPL-3.0-or-later Group: Development/Tools/Other URL: https://www.gnu.org/software/complexity/ -Source: https://ftp.gnu.org/gnu/complexity/%{name}-%{version}.tar.xz +Source0: https://ftp.gnu.org/gnu/complexity/%{name}-%{version}.tar.xz +Source1: https://ftp.gnu.org/gnu/complexity/%{name}-%{version}.tar.xz.sig +Source2: %{name}.keyring Patch0: complexity-1.10-avoid-random-return-in-nonvoid-function.patch BuildRequires: autogen +BuildRequires: pkgconfig +BuildRequires: pkgconfig(autoopts) Requires(post): %{install_info_prereq} Requires(preun): %{install_info_prereq} @@ -46,6 +50,9 @@ %install %make_install +%check +make %{?_smp_mflags} check + %post %install_info --info-dir=%{_infodir} %{_infodir}/%{name}.info.gz @@ -53,10 +60,11 @@ %install_info_delete --info-dir=%{_infodir} %{_infodir}/%{name}.info.gz %files -%doc AUTHORS ChangeLog README COPYING NEWS +%license COPYING +%doc AUTHORS ChangeLog README NEWS %{_bindir}/complexity %{_bindir}/cx-vs-mc -%{_infodir}/complexity.info%{ext_info} -%{_mandir}/man1/complexity.1%{ext_man} +%{_infodir}/complexity.info%{?ext_info} +%{_mandir}/man1/complexity.1%{?ext_man} %changelog

1 0

commit Botan for openSUSE:Factory
by root 31 Jul '18

31 Jul '18

Hello community, here is the log from the commit of package Botan for openSUSE:Factory checked in at 2018-07-31 16:04:14 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/Botan (Old) and /work/SRC/openSUSE:Factory/.Botan.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "Botan" Tue Jul 31 16:04:14 2018 rev:51 rq:626674 version:2.7.0 Changes: -------- --- /work/SRC/openSUSE:Factory/Botan/Botan.changes 2018-04-13 12:52:59.136562750 +0200 +++ /work/SRC/openSUSE:Factory/.Botan.new/Botan.changes 2018-07-31 16:04:27.568062808 +0200 @@ -1,0 +2,102 @@ +Tue Jul 31 10:44:02 UTC 2018 - daniel.molkentin(a)suse.com + +- Fix version in baselibs.conf + +------------------------------------------------------------------- +Tue Jul 10 09:27:35 UTC 2018 - daniel.molkentin(a)suse.com + +- Update to Botan 2.7 + + * CVE-2018-12435 Avoid a side channel in ECDSA signature generation (GH + #1604) + + * Avoid a side channel in RSA key generation due to use of a non-constant + time gcd algorithm. (GH #1542 #1556) + + * Optimize prime generation, especially improving RSA key generation. (GH + #1542) + + * Make Karatsuba multiplication, Montgomery field operations, Barrett + reduction and Montgomery exponentiation const time (GH #1540 #1606 #1609 + #1610) + + * Optimizations for elliptic curve operations especially improving reductions + and inversions modulo NIST primes (GH #1534 #1538 #1545 #1546 #1547 #1550) + + * Add 24 word wide Comba multiplication, improving 3072-bit RSA and DH by + ~25%. (GH #1564) + + * Unroll Montgomery reduction for specific sizes (GH #1603) + + * Improved performance of signature verification in ECGDSA, ECKCDSA, SM2 and + GOST by 10-15%. + + * XMSS optimizations (GH #1583 #1585) + + * Fix an error that meant XMSS would only sign half as many signatures as is + allowed (GH #1582) + + * Add support for base32 encoding/decoding (GH #1541) + + * Add BMI2 optimized version of SHA-256, 40% faster on Skylake (GH #1584) + + * Allow the year to be up to 2200 in ASN.1 time objects. Previously this was + limited to 2100. (GH #1536) + + * Add support for Scrypt password hashing (GH #1570) + + * Add support for using Scrypt for private key encryption (GH #1574) + + * Optimizations for DES/3DES, approx 50% faster when used in certain modes + such as CBC decrypt or CTR. + + * XMSS signature verification did not check that the signature was of the + expected length which could lead to a crash. (GH #1537) + + * The bcrypt variants 2b and 2y are now supported. + + * Support for 192-bit Suite B TLS profile is now implemented, as the 128-bit + Suite B is since 2015 not allowed anymore. + + * Previously botan allowed GCM to be used with an empty nonce, which is not + allowed by the specification. Now such nonces are rejected. + + * Avoid problems on Windows when compiling in Unicode mode (GH #1615 #1616) + + * Previously for ASN.1 encoded signatures (eg ECDSA) Botan would accept any + valid BER encoding. Now only the single valid DER encoding is accepted. + + * Correct an error that could in rare cases cause an internal error exception + when doing computations with the P-224 curve. + + * Optimizations to reduce allocations/copies during DER encoding and BER + decoding (GH #1571 #1572 #1600) + + * Botan generates X.509 subject key IDs by hashing the public key with + whatever hash function is being used to sign the certificate. However + especially for SHA-512 this caused SKIDs that were far longer than + necessary. Now all SKIDs are truncated to 192 bits. + + * In the test suite use mkstemp to create temporary files instead of creating + them in the current working directory. (GH #1533 #1530) + + * It is now possible to safely override CXX when invoking make in addition to + when configure.py is run. (GH #1579) + + * OIDs for Camellia and SM4 in CBC and GCM mode are now defined, making it + possible to use this algorithms for private key encryption. + + * Avoid creating symlinks to the shared object on OpenBSD (#1535) + + * The factor command runs much faster on larger inputs now. + + * Support for Windows Phone/UWP was deprecated starting in 2.5. This + deprecation has been reversed as it seems UWP is still actively used. (GH + #1586 #1587) + + * Support for Visual C++ 2013 is deprecated, and will be removed in Jan 2019. + + * Added support for GCC’s –sysroot option to configure.py for + cross-compiling. + +------------------------------------------------------------------- Old: ---- Botan-2.6.0.tgz Botan-2.6.0.tgz.asc New: ---- Botan-2.7.0.tgz Botan-2.7.0.tgz.asc ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ Botan.spec ++++++ --- /var/tmp/diff_new_pack.jKArC2/_old 2018-07-31 16:04:28.600064568 +0200 +++ /var/tmp/diff_new_pack.jKArC2/_new 2018-07-31 16:04:28.604064574 +0200 @@ -16,10 +16,10 @@ # -%define version_suffix 2-5 +%define version_suffix 2-7 %define short_version 2 Name: Botan -Version: 2.6.0 +Version: 2.7.0 Release: 0 Summary: A C++ Crypto Library License: BSD-2-Clause ++++++ Botan-2.6.0.tgz -> Botan-2.7.0.tgz ++++++ /work/SRC/openSUSE:Factory/Botan/Botan-2.6.0.tgz /work/SRC/openSUSE:Factory/.Botan.new/Botan-2.7.0.tgz differ: char 5, line 1 ++++++ baselibs.conf ++++++ --- /var/tmp/diff_new_pack.jKArC2/_old 2018-07-31 16:04:28.668064684 +0200 +++ /var/tmp/diff_new_pack.jKArC2/_new 2018-07-31 16:04:28.668064684 +0200 @@ -1,4 +1,4 @@ -libbotan-2-5 +libbotan-2-7 libbotan-devel requires -libbotan-<targettype> = <version> - requires "libbotan-2-5-<targettype> = <version>" + requires "libbotan-2-7-<targettype> = <version>"

1 0

commit python-ZEO for openSUSE:Factory
by root 31 Jul '18

31 Jul '18

Hello community, here is the log from the commit of package python-ZEO for openSUSE:Factory checked in at 2018-07-31 16:04:11 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python-ZEO (Old) and /work/SRC/openSUSE:Factory/.python-ZEO.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "python-ZEO" Tue Jul 31 16:04:11 2018 rev:8 rq:626664 version:5.2.0 Changes: -------- --- /work/SRC/openSUSE:Factory/python-ZEO/python-ZEO.changes 2018-05-11 14:27:44.189266140 +0200 +++ /work/SRC/openSUSE:Factory/.python-ZEO.new/python-ZEO.changes 2018-07-31 16:04:26.116060333 +0200 @@ -1,0 +2,5 @@ +Tue Jul 31 09:11:23 UTC 2018 - tchvatal(a)suse.com + +- Add zdaemon as test dependency + +------------------------------------------------------------------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python-ZEO.spec ++++++ --- /var/tmp/diff_new_pack.paTiWd/_old 2018-07-31 16:04:26.672061281 +0200 +++ /var/tmp/diff_new_pack.paTiWd/_new 2018-07-31 16:04:26.676061287 +0200 @@ -31,9 +31,9 @@ Source99: %{name}-rpmlintrc BuildRequires: %{python_module ZConfig} BuildRequires: %{python_module ZODB >= 5.1.1} -BuildRequires: %{python_module devel} BuildRequires: %{python_module setuptools} BuildRequires: %{python_module six} +BuildRequires: %{python_module zdaemon} BuildRequires: fdupes BuildRequires: python-rpm-macros Requires: python-ZConfig

1 0

commit acpid for openSUSE:Factory
by root 31 Jul '18

31 Jul '18

Hello community, here is the log from the commit of package acpid for openSUSE:Factory checked in at 2018-07-31 16:04:07 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/acpid (Old) and /work/SRC/openSUSE:Factory/.acpid.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "acpid" Tue Jul 31 16:04:07 2018 rev:78 rq:626643 version:2.0.29 Changes: -------- --- /work/SRC/openSUSE:Factory/acpid/acpid.changes 2018-06-19 12:05:17.442407101 +0200 +++ /work/SRC/openSUSE:Factory/.acpid.new/acpid.changes 2018-07-31 16:04:25.120058634 +0200 @@ -1,0 +2,5 @@ +Sun Jul 29 09:09:55 UTC 2018 - jengelh(a)inai.de + +- Use noun phrase in summary. + +------------------------------------------------------------------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ acpid.spec ++++++ --- /var/tmp/diff_new_pack.xv8rzh/_old 2018-07-31 16:04:25.832059848 +0200 +++ /var/tmp/diff_new_pack.xv8rzh/_new 2018-07-31 16:04:25.836059855 +0200 @@ -19,7 +19,7 @@ Name: acpid Version: 2.0.29 Release: 0 -Summary: Executes Actions at ACPI Events +Summary: Daemon to execute actions on ACPI events License: GPL-2.0-or-later Group: System/Daemons Url: http://sourceforge.net/projects/acpid2/

1 0

commit sendmail for openSUSE:Factory
by root 31 Jul '18

31 Jul '18

Hello community, here is the log from the commit of package sendmail for openSUSE:Factory checked in at 2018-07-31 16:04:01 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/sendmail (Old) and /work/SRC/openSUSE:Factory/.sendmail.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "sendmail" Tue Jul 31 16:04:01 2018 rev:86 rq:626642 version:8.15.2 Changes: -------- --- /work/SRC/openSUSE:Factory/sendmail/sendmail.changes 2018-07-17 09:43:35.149028727 +0200 +++ /work/SRC/openSUSE:Factory/.sendmail.new/sendmail.changes 2018-07-31 16:04:23.560055974 +0200 @@ -1,0 +2,5 @@ +Fri Jul 27 07:56:17 UTC 2018 - jengelh(a)inai.de + +- Replace exec rm by delete/print. + +------------------------------------------------------------------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ sendmail.spec ++++++ --- /var/tmp/diff_new_pack.qieznl/_old 2018-07-31 16:04:24.828058136 +0200 +++ /var/tmp/diff_new_pack.qieznl/_new 2018-07-31 16:04:24.832058143 +0200 @@ -408,7 +408,7 @@ -name '*.mrbl' -o -name '*.util' -o \ -name '*.p0' -o -name '*.auth2' -o \ -name '*.dif' -o -name '*.orig' -o \ - -name '*.reproducible' ")" -exec rm -vf '{}' \+ + -name '*.reproducible' ")" -print -delete cd suse/ # etc/aliases and %{_sysconfdir}/aliases.d are in other packages #install -m 0644 aliases %{buildroot}%{_sysconfdir}/

1 0

commit libuev for openSUSE:Factory
by root 31 Jul '18

31 Jul '18

Hello community, here is the log from the commit of package libuev for openSUSE:Factory checked in at 2018-07-31 16:03:58 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/libuev (Old) and /work/SRC/openSUSE:Factory/.libuev.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "libuev" Tue Jul 31 16:03:58 2018 rev:2 rq:626641 version:2.1.2 Changes: -------- --- /work/SRC/openSUSE:Factory/libuev/libuev.changes 2018-06-29 22:32:00.142228031 +0200 +++ /work/SRC/openSUSE:Factory/.libuev.new/libuev.changes 2018-07-31 16:04:21.712052823 +0200 @@ -1,0 +2,5 @@ +Sun Jul 29 10:35:02 UTC 2018 - jengelh(a)inai.de + +- Ensure neutrality of descriptions. + +------------------------------------------------------------------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libuev.spec ++++++ --- /var/tmp/diff_new_pack.rUo9Wi/_old 2018-07-31 16:04:22.172053608 +0200 +++ /var/tmp/diff_new_pack.rUo9Wi/_new 2018-07-31 16:04:22.172053608 +0200 @@ -1,6 +1,7 @@ # # spec file for package libuev # +# Copyright (c) 2018 SUSE LINUX GmbH, Nuernberg, Germany. # Copyright (c) 2018, Martin Hauke <mardnh(a)gmx.de> # # All modifications and additions to the file contributed by third parties @@ -20,7 +21,7 @@ Name: libuev Version: 2.1.2 Release: 0 -Summary: Lightweight event loop library +Summary: Event loop library License: MIT Group: Development/Languages/C and C++ URL: https://github.com/troglobit/libuev/ @@ -31,28 +32,24 @@ BuildRequires: pkgconfig %description -libuEv is a simple event loop in the style of the more established -libevent, libev and the venerable Xt(3) event loop. The u (micro) in the -name refers to both the small feature set and the small size overhead -impact of the library. - -Experienced developers may appreciate that libuEv is built on top of -modern Linux APIs: epoll, timerfd and signalfd. Note however, a certain -amount of care is needed when dealing with APIs that employ signalfd. +libuEv is an event loop in the style of libevent, libev and the Xt(3) +event loop. It has a small feature set. + +libuEv is built on top of the Linux APIs epoll, timerfd and signalfd. +Note however, a certain amount of care is needed when dealing with +APIs that employ signalfd. %package -n libuev%{sover} -Summary: Lightweight event loop library +Summary: Event loop library Group: System/Libraries %description -n libuev%{sover} -libuEv is a simple event loop in the style of the more established -libevent, libev and the venerable Xt(3) event loop. The u (micro) in the -name refers to both the small feature set and the small size overhead -impact of the library. - -Experienced developers may appreciate that libuEv is built on top of -modern Linux APIs: epoll, timerfd and signalfd. Note however, a certain -amount of care is needed when dealing with APIs that employ signalfd. +libuEv is an event loop in the style of libevent, libev and the Xt(3) +event loop. It has a small feature set. + +libuEv is built on top of the Linux APIs epoll, timerfd and signalfd. +Note however, a certain amount of care is needed when dealing with +APIs that employ signalfd. %package devel Summary: Header files for libuEv

1 0

commit shairport-sync for openSUSE:Factory
by root 31 Jul '18

31 Jul '18

Hello community, here is the log from the commit of package shairport-sync for openSUSE:Factory checked in at 2018-07-31 16:03:55 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/shairport-sync (Old) and /work/SRC/openSUSE:Factory/.shairport-sync.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "shairport-sync" Tue Jul 31 16:03:55 2018 rev:2 rq:626639 version:3.1.99.10 Changes: -------- --- /work/SRC/openSUSE:Factory/shairport-sync/shairport-sync.changes 2018-06-19 11:56:24.434197117 +0200 +++ /work/SRC/openSUSE:Factory/.shairport-sync.new/shairport-sync.changes 2018-07-31 16:04:21.080051746 +0200 @@ -1,0 +2,5 @@ +Mon Jul 30 18:15:58 UTC 2018 - jengelh(a)inai.de + +- Avoid repeating name in summary (rpmlint). + +------------------------------------------------------------------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ shairport-sync.spec ++++++ --- /var/tmp/diff_new_pack.rPdBaX/_old 2018-07-31 16:04:21.560052565 +0200 +++ /var/tmp/diff_new_pack.rPdBaX/_new 2018-07-31 16:04:21.560052565 +0200 @@ -1,7 +1,7 @@ - +# # spec file for package shairport-sync # -# Copyright (c) 2017 SUSE LINUX GmbH, Nuernberg, Germany. +# Copyright (c) 2018 SUSE LINUX GmbH, Nuernberg, Germany. # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -15,14 +15,19 @@ # Please submit bugfixes or comments via http://bugs.opensuse.org/ # + +# Please submit bugfixes or comments via http://bugs.opensuse.org/ +# + %define rcversion RC10 %define _version 3.2 Name: shairport-sync Version: 3.1.99.10 Release: 0 -Summary: Shairport Sync is an AirPlay audio player -License: GPL-3.0 +Summary: An AirPlay audio player +License: GPL-3.0-only +Group: Productivity/Multimedia/Sound/Utilities URL: https://github.com/mikebrady/shairport-sync Source0: https://github.com/mikebrady/shairport-sync/archive/%{_version}%{rcversion}… Source1: airplay-server.xml @@ -30,21 +35,20 @@ # PATCH-FIX-OPENSUSE drop-user-config.patch hillwood(a)opensuse.org -- Move configuring user account to rpm spec. # Move configuring user account to rpm spec. Patch0: drop-user-config.patch -Group: Productivity/Multimedia/Sound/Utilities +BuildRequires: fdupes +BuildRequires: firewall-macros +BuildRequires: gcc-c++ +BuildRequires: gnome-common +BuildRequires: systemd +BuildRequires: pkgconfig(alsa) +BuildRequires: pkgconfig(avahi-client) +BuildRequires: pkgconfig(libconfig) +BuildRequires: pkgconfig(libdaemon) BuildRequires: pkgconfig(libpulse) BuildRequires: pkgconfig(openssl) -BuildRequires: pkgconfig(libdaemon) -BuildRequires: pkgconfig(libconfig) BuildRequires: pkgconfig(popt) -BuildRequires: pkgconfig(alsa) -BuildRequires: pkgconfig(soxr) BuildRequires: pkgconfig(sndfile) -BuildRequires: pkgconfig(avahi-client) -BuildRequires: gnome-common -BuildRequires: systemd -BuildRequires: gcc-c++ -BuildRequires: fdupes -BuildRequires: firewall-macros +BuildRequires: pkgconfig(soxr) Requires(pre): shadow Requires: firewalld %{?systemd_requires}

1 0

commit docker-kubic for openSUSE:Factory
by root 31 Jul '18

31 Jul '18

Hello community, here is the log from the commit of package docker-kubic for openSUSE:Factory checked in at 2018-07-31 16:03:52 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/docker-kubic (Old) and /work/SRC/openSUSE:Factory/.docker-kubic.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "docker-kubic" Tue Jul 31 16:03:52 2018 rev:14 rq:626557 version:17.09.1_ce Changes: -------- --- /work/SRC/openSUSE:Factory/docker-kubic/docker-kubic.changes 2018-06-29 22:36:58.105972238 +0200 +++ /work/SRC/openSUSE:Factory/.docker-kubic.new/docker-kubic.changes 2018-07-31 16:04:19.732049448 +0200 @@ -1,0 +2,7 @@ +Mon Jul 30 09:44:47 UTC 2018 - asarai(a)suse.com + +- Build the client binary with -buildmode=pie to fix issues on POWER. + bsc#1100727 + + bsc1100727-0001-build-add-buildmode-pie.patch + +------------------------------------------------------------------- New: ---- bsc1100727-0001-build-add-buildmode-pie.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ docker-kubic.spec ++++++ --- /var/tmp/diff_new_pack.wb1XYh/_old 2018-07-31 16:04:20.664051037 +0200 +++ /var/tmp/diff_new_pack.wb1XYh/_new 2018-07-31 16:04:20.668051043 +0200 @@ -72,6 +72,8 @@ Patch402: bsc1073877-0001-apparmor-allow-receiving-of-signals-from-docker-kill.patch # SUSE-BACKPORT: Backport of https://github.com/moby/moby/pull/37353. bsc#1099277 Patch403: bsc1073877-0002-apparmor-clobber-docker-default-profile-on-start.patch +# SUSE-BACKPORT: Backport of https://github.com/docker/cli/pull/1242. bsc#1100727 +Patch404: bsc1100727-0001-build-add-buildmode-pie.patch # SUSE-FEATURE: Add support to mirror inofficial/private registries # (https://github.com/moby/moby/pull/34319) Patch500: private-registry-0001-Add-private-registry-mirror-support.patch @@ -228,6 +230,8 @@ %patch402 -p1 # bsc#1099277 %patch403 -p1 +# bsc#1100727 +%patch404 -p1 # PATCH-SUSE: Mirror patch. %patch500 -p1 ++++++ bsc1100727-0001-build-add-buildmode-pie.patch ++++++ >From d39172ffc6b245f02da1898793ccaef20bb6858a Mon Sep 17 00:00:00 2001 From: Aleksa Sarai <asarai(a)suse.de> Date: Mon, 30 Jul 2018 19:34:01 +1000 Subject: [PATCH] build: add -buildmode=pie Make all dynbinary builds be position-independent (this adds both security benefits and can help with flaky builds on POWER architectures). Signed-off-by: Aleksa Sarai <asarai(a)suse.de> --- components/cli/scripts/build/dynbinary | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/components/cli/scripts/build/dynbinary b/components/cli/scripts/build/dynbinary index 3c32ed342ef7..4feb7e71d852 100755 --- a/components/cli/scripts/build/dynbinary +++ b/components/cli/scripts/build/dynbinary @@ -9,6 +9,6 @@ source ./scripts/build/.variables echo "Building dynamically linked $TARGET" export CGO_ENABLED=1 -go build -o "${TARGET}" -tags pkcs11 --ldflags "${LDFLAGS}" "${SOURCE}" +go build -o "${TARGET}" -tags pkcs11 --ldflags "${LDFLAGS}" -buildmode=pie "${SOURCE}" ln -sf "$(basename "${TARGET}")" build/docker -- 2.18.0

1 0