diff --git a/.gitignore b/.gitignore index 2bc3e8e..0b0f2de 100644 --- a/.gitignore +++ b/.gitignore @@ -54,10 +54,3 @@ /R-4.3.1.tar.gz /R-4.3.2.tar.gz /R-4.3.3.tar.gz -/R-4.4.0.tar.gz -/R-4.4.1.tar.gz -/R-4.4.2.tar.gz -/R-4.4.3.tar.gz -/R-4.5.0.tar.gz -/R-4.5.1.tar.gz -/R-4.5.2.tar.gz diff --git a/R-CVE-2024-27322.patch b/R-CVE-2024-27322.patch new file mode 100644 index 0000000..a342697 --- /dev/null +++ b/R-CVE-2024-27322.patch @@ -0,0 +1,49 @@ +From f7c46500f455eb4edfc3656c3fa20af61b16abb7 Mon Sep 17 00:00:00 2001 +From: luke +Date: Sun, 31 Mar 2024 19:35:58 +0000 +Subject: [PATCH] readRDS() and unserialize() now signal an errorr instead of + returning a PROMSXP. + +git-svn-id: https://svn.r-project.org/R/trunk@86235 00db46b3-68df-0310-9c12-caf00c1e9a41 +--- + src/main/serialize.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/src/main/serialize.c b/src/main/serialize.c +index a389f713116..a190fbf8f3c 100644 +--- a/src/main/serialize.c ++++ b/src/main/serialize.c +@@ -2650,6 +2650,13 @@ do_serializeToConn(SEXP call, SEXP op, SEXP args, SEXP env) + return R_NilValue; + } + ++static SEXP checkNotPromise(SEXP val) ++{ ++ if (TYPEOF(val) == PROMSXP) ++ error(_("cannot return a promise (PROMSXP) object")); ++ return val; ++} ++ + /* unserializeFromConn(conn, hook) used from readRDS(). + It became public in R 2.13.0, and that version added support for + connections internally */ +@@ -2699,7 +2706,7 @@ do_unserializeFromConn(SEXP call, SEXP op, SEXP args, SEXP env) + con->close(con); + UNPROTECT(1); + } +- return ans; ++ return checkNotPromise(ans); + } + + /* +@@ -3330,8 +3337,8 @@ attribute_hidden SEXP + do_serialize(SEXP call, SEXP op, SEXP args, SEXP env) + { + checkArity(op, args); +- if (PRIMVAL(op) == 2) return R_unserialize(CAR(args), CADR(args)); +- ++ if (PRIMVAL(op) == 2) //return R_unserialize(CAR(args), CADR(args)); ++ return checkNotPromise(R_unserialize(CAR(args), CADR(args))); + SEXP object, icon, type, ver, fun; + object = CAR(args); args = CDR(args); + icon = CAR(args); args = CDR(args); diff --git a/R.spec b/R.spec index a5aa2d1..82695ba 100644 --- a/R.spec +++ b/R.spec @@ -27,15 +27,15 @@ # Should be the previous version, to make mass-rebuilds easier %bcond_with bootstrap -%global bootstrap_abi 4.4 +%global bootstrap_abi 4.2 %global major_version 4 -%global minor_version 5 -%global patch_version 2 +%global minor_version 3 +%global patch_version 3 Name: R Version: %{major_version}.%{minor_version}.%{patch_version} -Release: 1%{?dist} +Release: 2%{?dist} Summary: A language for data analysis and graphics License: GPL-2.0-or-later @@ -43,6 +43,9 @@ URL: https://www.r-project.org Source0: https://cran.r-project.org/src/base/R-4/R-%{version}.tar.gz # see https://bugzilla.redhat.com/show_bug.cgi?id=1324145 Patch0: R-3.3.0-fix-java_path-in-javareconf.patch +# see https://bugzilla.redhat.com/show_bug.cgi?id=2277884 +# https://github.com/r-devel/r-svn/commit/f7c46500f455eb4edfc3656c3fa20af61b16abb7 +Patch1: R-CVE-2024-27322.patch BuildRequires: gcc-gfortran BuildRequires: gcc-c++ @@ -60,8 +63,6 @@ BuildRequires: libcurl-devel BuildRequires: bzip2-devel BuildRequires: xz-devel BuildRequires: zlib-devel -BuildRequires: libdeflate-devel -BuildRequires: libzstd-devel BuildRequires: tre-devel BuildRequires: %{blaslib}-devel BuildRequires: libSM-devel @@ -80,7 +81,6 @@ BuildRequires: java-devel BuildRequires: autoconf BuildRequires: automake BuildRequires: libtool -BuildRequires: less BuildRequires: tex(latex) BuildRequires: texinfo-tex BuildRequires: tex(upquote.sty) @@ -112,8 +112,6 @@ and called at run time. %package core Summary: The minimal R components necessary for a functional runtime Requires: libRmath%{?_isa} = %{version}-%{release} -Requires: tzdata -Requires: less Requires: xdg-utils Requires: zip, unzip @@ -140,32 +138,32 @@ Provides: R(ABI) = %{bootstrap_abi} print("Provides: R(" .. name .. ") = " .. rpm_version) } %add_submodule base %{version} -%add_submodule boot 1.3-32 -%add_submodule class 7.3-23 -%add_submodule cluster 2.1.8.1 -%add_submodule codetools 0.2-20 +%add_submodule boot 1.3-29 +%add_submodule class 7.3-22 +%add_submodule cluster 2.1.6 +%add_submodule codetools 0.2-19 %add_submodule compiler %{version} %add_submodule datasets %{version} -%add_submodule foreign 0.8-90 +%add_submodule foreign 0.8-86 %add_submodule graphics %{version} %add_submodule grDevices %{version} %add_submodule grid %{version} -%add_submodule KernSmooth 2.23-26 -%add_submodule lattice 0.22-7 -%add_submodule MASS 7.3-65 -%add_submodule Matrix 1.7-4 +%add_submodule KernSmooth 2.23-22 +%add_submodule lattice 0.22-5 +%add_submodule MASS 7.3-60.0.1 +%add_submodule Matrix 1.6-5 Obsoletes: R-Matrix < 0.999375-7 %add_submodule methods %{version} -%add_submodule mgcv 1.9-3 -%add_submodule nlme 3.1-168 -%add_submodule nnet 7.3-20 +%add_submodule mgcv 1.9-1 +%add_submodule nlme 3.1-164 +%add_submodule nnet 7.3-19 %add_submodule parallel %{version} -%add_submodule rpart 4.1.24 -%add_submodule spatial 7.3-18 +%add_submodule rpart 4.1.23 +%add_submodule spatial 7.3-17 %add_submodule splines %{version} %add_submodule stats %{version} %add_submodule stats4 %{version} -%add_submodule survival 3.8-3 +%add_submodule survival 3.5-8 %add_submodule tcltk %{version} %add_submodule tools %{version} %add_submodule translations %{version} @@ -196,12 +194,12 @@ Requires: gcc-gfortran Requires: gcc-c++ Requires: make Requires: pkgconfig +Requires: tcl-devel +Requires: tk-devel Requires: pcre2-devel Requires: bzip2-devel Requires: xz-devel Requires: zlib-devel -Requires: libdeflate-devel -Requires: libzstd-devel Requires: tre-devel Requires: %{blaslib}-devel Requires: libX11-devel @@ -219,7 +217,7 @@ Recommends: tex(inconsolata.sty) Recommends: qpdf %endif -Provides: R-Matrix-devel = 1.7.4 +Provides: R-Matrix-devel = 1.6.5 Obsoletes: R-Matrix-devel < 0.999375-7 %ifarch %{java_arches} @@ -308,15 +306,12 @@ from the R project. This package provides the static libRmath library. %prep %setup -q %patch -P0 -p1 -b .fixpath -# A bunch of macOS stuff in v4.5.2's archive -find . -name '._*' -delete +%patch -P1 -p1 -b .fixcve %build # Comment out default R_LIBS_SITE (since R 4.2) and set our own as always sed -i -e '/R_LIBS_SITE=/s/^/#/g' etc/Renviron.in -# Only packages which are needed as runtime dependencies are rebuilt for -# flatpaks in /app, build dependencies are from buildroot in /usr -echo 'R_LIBS_SITE=${R_LIBS_SITE-'"'/usr/local/lib/R/site-library:/usr/local/lib/R/library:%{_libdir}/R/library:%{_datadir}/R/library%{?flatpak::/usr/%{_lib}/R/library:/usr/share/R/library}'"'}' >> etc/Renviron.in +echo 'R_LIBS_SITE=${R_LIBS_SITE-'"'/usr/local/lib/R/site-library:/usr/local/lib/R/library:%{_libdir}/R/library:%{_datadir}/R/library'"'}' >> etc/Renviron.in # No inconsolata on RHEL tex %if 0%{?rhel} export R_RD4PDF="times,hyper" @@ -336,8 +331,8 @@ export JAVA_HOME=%{_jvmdir}/jre --with-system-tre \ --with-blas=%{blaslib}%{blasvar} \ --with-lapack \ - --with-tcl-config=/usr/%{_lib}/tclConfig.sh \ - --with-tk-config=/usr/%{_lib}/tkConfig.sh \ + --with-tcl-config=%{_libdir}/tclConfig.sh \ + --with-tk-config=%{_libdir}/tkConfig.sh \ --enable-R-shlib \ --enable-prebuilt-html \ --enable-R-profiling \ @@ -404,12 +399,6 @@ for i in tex/latex bibtex/bib bibtex/bst; do (cd %{buildroot}%{_texdist}/$i && ln -s %{_datadir}/R/texmf/$i R) done -%if 0%{?flatpak} -# keep compatibility with shebang dependencies -mkdir -p %{buildroot}/usr/bin -ln -s /app/bin/Rscript %{buildroot}/usr/bin/Rscript -%endif - %check %if %{with tests} # Needed by tests/ok-error.R, which will smash the stack on PPC64. @@ -449,30 +438,21 @@ TZ="Europe/Paris" make check %dir %{_libdir}/R/library/ %dir %{_libdir}/R/library/translations/ %{_libdir}/R/library/translations/DESCRIPTION -%lang(ar) %{_libdir}/R/library/translations/ar/ -%lang(bn) %{_libdir}/R/library/translations/bn/ -%lang(ca) %{_libdir}/R/library/translations/ca/ %lang(da) %{_libdir}/R/library/translations/da/ %lang(de) %{_libdir}/R/library/translations/de/ %lang(en) %{_libdir}/R/library/translations/en*/ %lang(es) %{_libdir}/R/library/translations/es/ %lang(fa) %{_libdir}/R/library/translations/fa/ %lang(fr) %{_libdir}/R/library/translations/fr/ -%lang(hi) %{_libdir}/R/library/translations/hi/ -%lang(hu) %{_libdir}/R/library/translations/hu/ -%lang(id) %{_libdir}/R/library/translations/id/ %lang(it) %{_libdir}/R/library/translations/it/ %lang(ja) %{_libdir}/R/library/translations/ja/ %lang(ko) %{_libdir}/R/library/translations/ko/ %lang(lt) %{_libdir}/R/library/translations/lt/ -%lang(ne) %{_libdir}/R/library/translations/ne/ %lang(nn) %{_libdir}/R/library/translations/nn/ %lang(pl) %{_libdir}/R/library/translations/pl/ %lang(pt) %{_libdir}/R/library/translations/pt*/ %lang(ru) %{_libdir}/R/library/translations/ru/ -%lang(sq) %{_libdir}/R/library/translations/sq/ %lang(tr) %{_libdir}/R/library/translations/tr/ -%lang(ur) %{_libdir}/R/library/translations/ur/ %lang(zh) %{_libdir}/R/library/translations/zh*/ # base %dir %{_libdir}/R/library/base/ @@ -711,7 +691,6 @@ TZ="Europe/Paris" make check %lang(lt) %{_libdir}/R/library/Matrix/po/lt/ %lang(pl) %{_libdir}/R/library/Matrix/po/pl/ %{_libdir}/R/library/Matrix/R/ -%{_libdir}/R/library/Matrix/scripts/ %{_libdir}/R/library/Matrix/test-tools.R %{_libdir}/R/library/Matrix/test-tools-1.R %{_libdir}/R/library/Matrix/test-tools-Matrix.R @@ -904,7 +883,6 @@ TZ="Europe/Paris" make check %{_libdir}/R/library/tools/Meta/ %{_libdir}/R/library/tools/NAMESPACE %{_libdir}/R/library/tools/R/ -%{_libdir}/R/library/tools/wre.txt # utils %dir %{_libdir}/R/library/utils/ %{_libdir}/R/library/utils/DESCRIPTION @@ -929,9 +907,6 @@ TZ="Europe/Paris" make check %{_pkgdocdir} %docdir %{_pkgdocdir} %{_sysconfdir}/ld.so.conf.d/* -%if 0%{?flatpak} -/usr/bin/Rscript -%endif %files core-devel %{_libdir}/pkgconfig/libR.pc @@ -962,66 +937,8 @@ TZ="Europe/Paris" make check %{_libdir}/libRmath.a %changelog -* Fri Oct 31 2025 Iñaki Úcar - 4.5.2-1 -- Update to 4.5.2 - -* Tue Aug 05 2025 František Zatloukal - 4.5.1-3 -- Rebuilt for icu 77.1 - -* Wed Jul 23 2025 Fedora Release Engineering - 4.5.1-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild - -* Fri Jun 13 2025 Iñaki Úcar - 4.5.1-1 -- Update to 4.5.1 - -* Wed Apr 23 2025 Yaakov Selkowitz - 4.5.0-4 -- Fix flatpak build - -* Fri Apr 18 2025 Iñaki Úcar - 4.5.0-3 -- Add libzstd-devel to Requires - -* Fri Apr 18 2025 Iñaki Úcar - 4.5.0-2 -- Add tzdata to Requires - -* Fri Apr 18 2025 Iñaki Úcar - 4.5.0-1 -- Update to 4.5.0 - -* Fri Feb 28 2025 Iñaki Úcar - 4.4.3-1 -- Update to 4.4.3 - -* Thu Feb 27 2025 Iñaki Úcar - 4.4.2-5 -- Remove requirement on tck/tk devel packages - -* Thu Jan 16 2025 Fedora Release Engineering - 4.4.2-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild - -* Wed Jan 15 2025 Iñaki Úcar - 4.4.2-3 -- Depend on compat tcl/tk 8 for now -- Apply upstream patch for gcc15 compatibility - -* Sun Dec 08 2024 Pete Walter - 4.4.2-2 -- Rebuild for ICU 76 - -* Fri Nov 01 2024 Iñaki Úcar - 4.4.2-1 -- Update to 4.4.2 - -* Mon Jul 22 2024 Iñaki Úcar - 4.4.1-5 -- Add less back as default PAGER - -* Wed Jul 17 2024 Fedora Release Engineering - 4.4.1-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - -* Fri Jul 05 2024 Iñaki Úcar - 4.4.1-3 -- Add libdeflate to Requires too - -* Thu Jul 04 2024 Iñaki Úcar - 4.4.1-2 -- Enable libdeflate - -* Mon Jun 17 2024 Iñaki Úcar - 4.4.1-1 -- Update to 4.4.1 - -* Thu Apr 25 2024 Iñaki Úcar - 4.4.0-1 -- Update to 4.4.0 +* Tue Apr 30 2024 Iñaki Úcar - 4.3.3-2 +- Security fix for CVE-2024-27322 * Thu Feb 29 2024 Iñaki Úcar - 4.3.3-1 - Update to 4.3.3 diff --git a/sources b/sources index b50315f..79df057 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (R-4.5.2.tar.gz) = abc4ff1a1b18a1f480e7bceb3267074e30453b5a571034b4c2a1c53e1650a1bafaf86bc6ca37f117a2e4f6617039dedeedef4ba8743f38720fc70e4bed2ff0a4 +SHA512 (R-4.3.3.tar.gz) = 26291590d935ea5678771cdcaea013a6c030897eb762b0204e42b34b0f1d33aac1ec933f36caa18d2a31a057a4456bf629222e4f5679f24bc48a7a764b1aedbe