- openSUSE Packaging

KDE 3.5.1?
by Joseph M. Gaffney 01 Feb '06

01 Feb '06

Some people on suseforums are curious about KDE 3.5.1 builds... is there any intention to package these, or is the plan to let it just go into 10.1? Thanks Joseph M. Gaffney aka CuCullin

2 1

gstreamer010-ffmpeg/complete
by James Ogley 31 Jan '06

31 Jan '06

As I mentioned in my blog today, I've packaged up gstreamer010-ffmpeg. I'm going to create a gstreamer010-complete meta-package tomorrow, this will include gstreamer010, plugins-base, plugins-good, plugins-bad, plugins-ugly, gstreamer010-python and gstreamer010-ffmpeg. -- James Ogley james(a)usr-local-bin.org Packages for SUSE: http://usr-local-bin.org/rpms Make Poverty History: http://makepovertyhistory.org

1 0

no package provides libaprutil-1.so.0
by Marc 30 Jan '06

30 Jan '06

hi, seems that there is no package which provides libaprutil-1.so.0. I got an error while trying to install subversion. ws:~ # smart install subversion Loading cache... Updating cache... ############################################################## [100%] Computing transaction... error: Can't install subversion-1.3.0-2@i586: no package provides libaprutil-1.so.0 Also apache2 does not install (no libapr1 < 2.0). Happens with beta1 and beta2. Am I missing something here? marvin

5 5

More gtk-sharp packaging changes.
by Wade Berrier 24 Jan '06

24 Jan '06

More sub packages have been split out. This should have been done the first go around, but better now than later. The following packages have been added: art-sharp2 gnome-vfs-sharp2 gtkhtml-sharp2 rsvg-sharp2 And for gtk-sharp 1.0.10: art-sharp gda-sharp gnomedb-sharp gtkhtml-sharp rsvg-sharp If you're using gtk-sharp-complete or gtk-sharp2-complete in neededforbuild, you won't need any changes (thanks Rudi!). Wade

1 0

php binary with php5 package is not cli but cgi
by Lemuel Formacil 23 Jan '06

23 Jan '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello Everyone, The package information for 'php5' with openSuSE 10.0 says that it includes the "... PHP binary (CLI) ..." (/usr/bin/php5), however, running $ php5 -v says it's cgi: PHP 5.0.4 (cgi) (built: Sep 13 2005 02:24:00) Copyright (c) 1997-2004 The PHP Group Zend Engine v2.0.4-dev, Copyright (c) 1998-2004 Zend Technologies This makes some command line scripts behave differently (due to the difference with the way CGI and CLI handle paths), like PEAR's PHPUnit2, which we need to use for unit testing our applications. The 'php4' package, however, has the correct version of the binary--the CLI. Can we also have the CLI version with the 'php5' package? Regards, Lemuel -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) iD8DBQFD1MOqjqd6S/FOPpQRAlGtAKCZ3PmCtzvRBKn0bnt+etFVNk1j1gCdGKN1 ZTEh7IFsjdEmLUAW5BsC6iw= =zM5T -----END PGP SIGNATURE-----

4 4

[Fwd: Major gtk-sharp2 packaging changes]
by Wade Berrier 17 Jan '06

17 Jan '06

1 0

Lightweight buffer overflow handling in 10.0 / Factory
by Marcus Meissner 16 Jan '06

16 Jan '06

(This is a report of a pre-10.0 article from internal list). Hi folks, The gcc 4 introduction brings fortunately some enhancements in regards to better checks for security problems. One of them is light weight buffer overflow checking during compile and runtime. Technical Details: ================== If the C compiler define -D_FORTIFY_SOURCE=x is specified (x can be 1 or 2 currently), special versions of "memcpy", "strcpy", "sprintf", "gets", and so on are defined and compiled differently, so that code like this: char buf[10]; strcpy(buf,"Hello world!"); now generates warnings like: xx.c:5: warning: call to __builtin___strcpy_chk will always overflow destination buffer and runtime errors like: ./xx *** buffer overflow detected *** Those errors of course need to be fixed. This checking method can only detect overflows if the destination buffer size is known at compile time. The performance impact of this method is low. Current Status: =============== Introduced with 10.0 snapshot 2 we are now using "-D_FORTIFY_SOURCE=2" as default in the RPM_OPT_FLAGS. We have fixed all problems we found in the buildsystem already. Packager TODOs: =============== However, this requires the following from you: * Make sure that strcpy, memcpy and friends are not implicitly defined. If you see this warning: "implicit declaration of function #strcpy#" it will not detect those simple buffer overflows. To fix such cases, include the standard header: <string.h> (for *printf warnings, <stdio.h>) * Make sure your package uses RPM_OPT_FLAGS for compiling C and C++ code. There is still a number of package that does not do this. I have run a heuristics (grep ;) over all our autobuild logfiles to find such offenders. The logfile seperated by maintainer is in: <internalpath> the full warnings logfile is at <internalpath> NOTE! There might be reasons you can't use RPM_OPT_FLAGS, or that only matches for package internal buildtools where found. These are cases where the heuristic failed. This is no official endorsement of RPM_OPT_FLAGS (yet). Ciao, Marcus

5 8

Where to place template files
by Richard Bos 12 Jan '06

12 Jan '06

I have a whole bunch of template files, where to place/locate template files? Is this /etc/<package>/... or would it be better to put those in /usr/share/<package>/...? Below a list with files, perhaps it helps tp detemine the location? ./etc/kolab/amavisd/templates/en_US/charset ./etc/kolab/amavisd/templates/en_US/template-dsn.txt ./etc/kolab/amavisd/templates/en_US/template-spam-admin.txt ./etc/kolab/amavisd/templates/en_US/template-spam-sender.txt ./etc/kolab/amavisd/templates/en_US/template-virus-admin.txt ./etc/kolab/amavisd/templates/en_US/template-virus-recipient.txt ./etc/kolab/amavisd/templates/en_US/template-virus-sender.txt /etc/kolab/templates/amavisd.conf.template ./etc/kolab/templates/clamd.conf.template ./etc/kolab/templates/cyrus.conf.template ./etc/kolab/templates/DB_CONFIG.slapd.template ./etc/kolab/templates/fbview.conf.template ./etc/kolab/templates/freebusy.conf.template ./etc/kolab/templates/freshclam.conf.template ./etc/kolab/templates/httpd.conf.template ./etc/kolab/templates/httpd.local.template ./etc/kolab/templates/imapd.conf.template ./etc/kolab/templates/imapd.group.template ./etc/kolab/templates/kolab.conf.template ./etc/kolab/templates/kolab_smtpdpolicy.conf.template ./etc/kolab/templates/ldap.conf.template ./etc/kolab/templates/ldapdistlist.cf.template ./etc/kolab/templates/ldaptransport.cf.template -- Richard Bos Without a home the journey is endless

2 1

Stack Protector for critical packages in Factory
by Marcus Meissner 12 Jan '06

12 Jan '06

(repost from internal mail from yesterday, i have removed only internal mailingaddresses referenced). Hi folks, We decided to offer and use an additional method of stack overflow protection for the next products. We are currently using the "Fortify Source" lightweight buffer overflow checking (you will know the -D_FORTIFY_SOURCE=2 defines that get used by autobuild). I explained it in my previous mail. With gcc 4.1 there is an new additional method of stack overflow detection. It was formerly called "ProPolice" or "Stack Smash Protection (SSP)" but is now usually refered to as "Stack Protector". It protects against stack based buffer overflows using following heuristics: - On function entry a canary ("Kanarienvogel") is put onto the stack. (Canary in tribute to the canary birds that early coalminers took into the mines to detect poisonous gases ... when the canaries die they still had time to leave.) x86 generated code: mov %gs:0x14,%eax (fetch random canary from TLS) mov %eax,0xffffffec(%ebp) (store on stack) xor %eax,%eax (clear value) - On function exit the canary is compared with the value on the stack. If it is no longer the same, the program is aborted. x86 generated code: mov 0xffffffec(%ebp),%edx (retrieve canary from stack) xor %gs:0x14,%edx (xor against original value, if same it will be 0 (equal)) jne ....aborting... (if not equal ... jump to abort) ... normal return assembler code... - The code will change the order of variables on the stack to put character arrays on top of the stack. This avoids overwrite of other function variables by stack overflows of character arrays which might go undetected by this protector otherwise. This checking code can be enabled in two modes: - normal (-fstack-protector) In this mode it will use a heuristic to determine the functions that need the above wrapper. The current heuristic is "uses a character array at least 8 byte long" This number of bytes can be changed by using this compiler option: --param ssp-buffer-size=8 - full (-fstack-protector-all) The wrapper will be generated for all functions. Performance loss: There will be some small performance loss (due to the approx 6 instructions added). But the number of functions with characters arrays is usually limited and not in the fast path. I have two apps already compiled with -fstack-protector: gaim has 76 functions out of 2022 instrumented. ethereal has 141 functions out of 1973 instrumented. What YOU need to do: If you think your application or library might have stack buffer overflows, you can add it to your global optflags. I have created a list of suggested RPMs to instrument, generated by the following criteria: - Had security updates in the last years. - Processes input got from the network, especially pdf, images, multimedia. - Might be used for local privilege escalation. Ciao, Marcus dcraw mDNSResponder rrdtool webalizer libopensync libsyncml gaim-otr novell-openwbem-authenticator novell-openwbem-authorizer novell-provider-base openwbem id3v2 hal snort abiword avahi banshee beagle dia epiphany-extensions epiphany evince evolution f-spot gaim-galago gaim galeon gdk-pixbuf gedit gobby gpdf gtk2 inkscape libsoup libsvg-cairo libsvg liferea NetworkManager obby poppler xchat sim grip libvisual libvisual-plugins ppp pure-ftpd qpopper vsftpd xntp konversation hp2xx hplip hp-officeJet imlib2 kdegraphics3 kdegraphics kdenetwork3 kdenetwork3 kipi-plugins koffice-wordprocessing ktorrent libkexif libextractor openh323 pwlib sfftobmp cups-backends cups-drivers cups foomatic-filters lynx unace licq unarj unrar xli zoo pdftohtml libmng pam_krb5 libexif freetype2 freetype2 uim xine-lib gnokii kismet tcpdump openslp curl cron mutt pcre wget irssi net-snmp gd giflib id3lib ImageMagick ImageMagick jpeg libpng libpng libtiff libtiff libwmf mc netpbm netpbm sox xpdf xpdf novell-ldapext novell-smash cvs librpcsecgss subversion OpenOffice_org OpenOffice_org dhcpcd dhcp dhcp-server openssl openvpn ethereal exif exiftool imgvtopgm openssh ufraw easytag imlib zip cyrus-imapd cyrus-sasl pam_ldap mailman at libosip2 libsidplay arc exifprobe fetchmail gftp ghostpcl lha libsidplay1 gawk openmotif21-libs openmotif imap gpsdrive cabextract freeradius MozillaFirefox MozillaThunderbird seamonkey dbus-1 libid3tag libogg libvorbis bind postfix a2ps enscript filters ghostscript-library lpdfilter lpdfilter man procmail texinfo xv sylpheed-claws performace critical perhaps: mysql postgresql apache2

1 0

Rebuilding xxx-32bit packages for x64_64
by Volker Kuhlmann 09 Jan '06

09 Jan '06

SUSE 10.0 ships packages for i586 and x86_64 built from the same .src.rpm. But there are also name-32bit-...x64_64.rpm, which contain only the shared libraries compiled as 32bit for use on an AMD64 system. These also claim to be built from the same single .src.rpm. What is the magic incantation to do so? There is nothing special in the spec file about it. For example: gpm-1.20.1-309.src.rpm dvd2 suse/src gpm-1.20.1-309.i586.rpm dvd1 suse/i586 gpm-1.20.1-309.x86_64.rpm dvd1 suse/x86_64 gpm-32bit-1.20.1-309.x86_64.rpm dvd1 suse/x86_64 Thanks, Volker -- Volker Kuhlmann is possibly list0570 with the domain in header http://volker.dnsalias.net/ Please do not CC list postings to me.

3 6