Upgrade urgency: SECURITY, contains fixes to security issues.
Security Fixes:
* (CVE-2023-28425) Specially crafted MSETNX command can lead to assertion and denial-of-service
Bug Fixes
=========
* Large blocks of replica client output buffer may lead to psync loops and unnecessary memory usage (#11666)
* Fix CLIENT REPLY OFF|SKIP to not silence push notifications (#11875)
* Trim excessive memory usage in stream nodes when exceeding `stream-node-max-bytes` (#11885)
* Fix module RM_Call commands failing with OOM when maxmemory is changed to zero (#11319)
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Under sysvinit when trying to restart redis-server using
service redis-server restart two calls are made to start-stop-daemon, first
with the --stop argument and then with --start argument consecutively.
Because the process doesn't immediately terminate when start-stop-daemon
--stop is called, the next call to start-stop-daemon --start finds the
process still running and does not attempt to start another one.
This leads to only a stop of the redis-server process when a restart is
requested. This behavior affects all redis versions using sysvinit only.
This can be fixed by using the --retry <timeout/schedule> argument with
start-stop-daemon --stop in order for the call to block until the process
terminates so that start-stop-daemon --start will attempt to start a new
process.
Unfortunately the --retry argument works only in the implementation of
start-stop-daemon provided by dpkg package and is ignored in the
implementation provided by busybox package.
A repeated check if the process is still running and another try with
another signal after a timeout will effectively simulate a stop with
--retry=TERM/5/KILL/5 schedule.
Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Update SRC_REV and change recipe name.
Modify patches to apply and remove unrecognized configure
option --without-python2. Retain --with-python3 even
though it is the default.
Signed-off-by: Joe Slater <joe.slater@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
To prevent naming collisions when BB_GENERATE_MIRROR_TARBALLS is used,
the packagename is used for the downloaded file.
Otherwise it would just be source-${PV}.tar.gz
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
==========
* test/yacc/ok_syntax1.tab.h, test/yacc/ok_syntax1.tab.c,
test/btyacc/ok_syntax1.tab.h, test/btyacc/ok_syntax1.tab.c:
regen
* test/ok_syntax1.y:
modify test for %union to add tag for testing reader.c
* reader.c:
provide for a named union, e.g., "%union foo" by detecting the name and
deferring the typedef in that case until the end of copying the union
definition
* VERSION, package/byacc.spec, package/debian/changelog,
package/mingw-byacc.spec, package/pkgsrc/Makefile:
bump
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
With DEBUG_BUILD = "1", the following error occurs:
src/relpsess.c:95:1: error:
inlining failed in call to 'relpSessFreePermittedPeers': function not considered for inlining [-Werror=inline]
so use the compiler flag '-Wno-error=inline' for DEBUG_OPTIMIZATION only.
Tracked by upstream bug: https://github.com/rsyslog/librelp/issues/256
but it's looking like a toolchain bug.
Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Add PACKAGECONFIG to enable dropping capabilities but leave it as disabled
to follow upstream and avoid a systemd issue described below.
rsyslog-8.2302 added a configure option to drop capabilities from
full to:
chown, dac_override, setgid, setuid, setpcap, net_bind_service,
net_admin, ipc_lock, sys_chroot, sys_admin, sys_resource, lease,
syslog, block_suspend
This works fine and passes ptests with sysvinit however
there is a bug when using systemd that breaks some tests:
https://github.com/rsyslog/rsyslog/issues/5091
Therefore only add a non-default PACKAGECONFIG option in keeping
with the rsyslog upstream.
One can install libcap-ng-bin to run pscap to see the capabilities.
Without this option the ptest result with systemd as init is:
Version | Passed | Failed | Skipped
8.2302 | 473 | 0 | 3
Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
1.15.3
Released: 2023-02-21
Build system:
Building this version of Flatpak with Meson is recommended. The source release flatpak-1.15.3.tar.xz no longer contains Autotools-generated files, although this version can still be built using Autotools after running ./autogen.sh. Future versions are likely to remove the Autotools build system.
Bug fixes:
When splitting an upgrade into two steps (download without installing, and then upgrade without allowing further downloads) like GNOME Software does, if an app is marked EOL and superseded by a replacement, don't remove the superseded app in the first step, which would result in the replacement incorrectly not being installed (#5172)
Fix a crash when --socket=gpg-agent is used (#5095)
Fix a crash when listing apps if one of them is broken or misconfigured (#5293)
If an app has invalid syntax in its overrides or metadata, mention the filename in the error message (#5293)
Unset $GDK_BACKEND for apps, ensuring GTK apps with --socket=fallback-x11 can work (#5303)
Fix a deprecation warning when compiled with curl >= 7.85 (#5284)
Translation updates: es, ru (#5266, #5312, #5313)
Internal changes:
Better diagnostic messages for why runtimes are or are not considered unused (#5237)
1.15.2
Released: 2023-02-06
Bug fixes:
Never try to export a parent of reserved directories as a --filesystem,
for example /run, which would prevent the app from starting (#5205, #5207)
Never try to export a --filesystem below /run/flatpak or /run/host,
which could similarly prevent the app from starting
The above change also fixes apps not starting if a --filesystem is a
symlink to the root directory (#1357)
Show a warning when the --filesystem exists but cannot be shared with
the sandbox (#1357, #5035, #5205, #5207)
Display the intended messages for flatpak repair (#5204)
Exporting an app to an existing repository on a CIFS filesystem
now works as intended (#5257)
Unset $GIO_EXTRA_MODULES for apps, avoiding misbehaviour in some GLib
apps when set to a path on the host (#5206)
Unset $XKB_CONFIG_ROOT for apps, avoiding crashes in GTK and Qt apps
under Wayland when this variable is set to a path not available in the
sandbox (#5194)
When using the fish shell, avoid duplicate XDG_DATA_DIRS entries if the
profile script is sourced more than once (#5198)
Update included copy of bubblewrap to 0.7.0 for better error messages
Install SELinux files correctly when building with Meson
Translation updates: ru, tr (#5256, #5262)
Internal changes:
Update included copy of libglnx
flatpak -v now uses the INFO log level, and flatpak -vv uses the
DEBUG log level in the flatpak log domain. Previously, the extra
messages that were logged by flatpak -vv were in a separate "flatpak2"
log domain. G_MESSAGES_DEBUG=flatpak previously had an effect similar to
flatpak -v, and is now more similar to flatpak -vv.
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Drop upstreamed patches, switch to github-releases for upstream checks,
update comments regarding making ptest pass as C.UTF-8 is default in
glibc now.
Alex Kiernan (2):
lib/repo-checkout: Add ALLPERMS for musl
tests: Handle musl's ERANGE mapping
Benno Rice (1):
Replace the radix64 crate with base64
Colin Walters (5):
fetcher: Avoid too large queues for metadata processing
configure: post-release version bump
rust: Bump to 0.17
bindings: Consistently check for `dox` feature
Release 2023.1
Dan Nicholson (16):
tests/inst: Update hyper-staticfile to 0.9.4
Strip trailing whitespace on all C files
repo: Add API to regenerate and sign repo metadata
bin/summary: Use ostree_repo_regenerate_metadata
commit: Allow skipping automatic summary generation
repo: Create metadata commit in ostree_repo_regenerate_metadata
lib: Provide internal summary signing with separate directory
repo: Prevent publishing summary without matching signature
bin: Cleanup documentation of --cache-dir option
bin/refs: Sort listing
bin/refs: Add option to print revisions
bin/remote-refs: Add option to print revisions
bin/show: Add options to list metadata keys
ostree/dump: Add support for summary metadata keys
bin/summary: Add options to show metadata
bin/remote-summary: Add options to show metadata
Eric Curtin (1):
bootloader: Add an aboot (Android) bootloader backend
Jonathan Lebon (1):
ostree/prune: Calculate reachability under exclusive lock
Luca BRUNO (4):
lib: assert more invariants
configure: use pkg-config with newer gpgme and gpg-error
lib/repo: fix an 'unused-function' warning
lib/sysroot-upgrader: add some 'nullable' annotations
Tareque Md Hanif (1):
docs: Fix link to ostree-rs
Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Also fixed --with-libxml2=no case in configure.ac
The CF3_WITH_LIBRARY and AC_CHECK_HEADERS were moved to outside of the check for with-libxml2=no
This fix is already merged in cfengine master but will need some time to cherry-pick and arrive in a 3.21.x LTS release.
Ticket: CFE-4023
Changelog: title
Signed-off-by: Craig Comstock <craig@unreasonablefarm.org>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
==========
* command_mode.cc (do_commands): Fix flush stdout after each command.
(Reported by Jeffrey Bosboom).
* New option '-W, --compare-before-write'.
(Suggested by Kajetan Harald Hinner and Petr Slansky).
* main_common.cc (show_option_error):
New function showing argument and option name.
* main.cc: Remove synonym '--direct'.
* Use 'long long' instead of 'long' for time variables.
* loggers.cc: Missing '#include <cstdlib>'.
* Fix two compiler warnings reported by Christian Franke.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
liblockfile do_install task will fail when ldconfig is not installed
on the host. Delete the useless line to fix the issue.
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
It uses python3-config during build to grok the python specific
includedirs, therefore its important to ensure that target specific
python3-config is used, otherwise currently it defaults to native
python3-config which ends up adding native python3 include paths
which might work out ok but is exposed when target is 32bit + lfs
enabled, the headers don't match between native and target python
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Upgrade urgency: SECURITY, contains fixes to security issues.
Security Fixes:
(CVE-2022-35977) Integer overflow in the Redis SETRANGE and SORT/SORT_RO
commands can drive Redis to OOM panic
(CVE-2023-22458) Integer overflow in the Redis HRANDFIELD and
ZRANDMEMBER
commands can lead to denial-of-service
Bug Fixes:
Avoid possible hang when client issues long KEYS, SRANDMEMBER,
HRANDFIELD,
and ZRANDMEMBER commands and gets disconnected by client output buffer
limit (#11676)
Fix sentinel issue if replica changes IP (#11590)
Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
