From d71010e4dbbcb1a20ac0e69884078c7154c947fa Mon Sep 17 00:00:00 2001 From: Michael J Gruber Date: Wed, 16 Apr 2025 12:17:08 +0200 Subject: [PATCH 01/11] exclude i686 arch for i686 leaf package https://fedoraproject.org/wiki/Changes/EncourageI686LeafRemoval --- aerc.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/aerc.spec b/aerc.spec index 6bf15b9..4e320db 100644 --- a/aerc.spec +++ b/aerc.spec @@ -9,7 +9,7 @@ %global goipath git.sr.ht/~rjarry/aerc %global version0 0.20.1 -%gometa -L +%gometa -L -f %global common_description %{expand: Aerc is an email client that runs in your terminal. It is highly From eadf8f930e4137da58966eebff524f29b3d0d2a8 Mon Sep 17 00:00:00 2001 From: Robin Jarry Date: Thu, 5 Jun 2025 09:15:40 +0200 Subject: [PATCH 02/11] Fix CVE-2025-49466 (fedora#2370376) --- aerc.spec | 3 ++ open-fix-opening-text-html-messages.patch | 38 ++++++++++++++++ ...only-use-part-basename-for-temp-file.patch | 45 +++++++++++++++++++ 3 files changed, 86 insertions(+) create mode 100644 open-fix-opening-text-html-messages.patch create mode 100644 open-only-use-part-basename-for-temp-file.patch diff --git a/aerc.spec b/aerc.spec index 4e320db..789eb80 100644 --- a/aerc.spec +++ b/aerc.spec @@ -29,6 +29,9 @@ Source0: %{gosource} Source1: %{archivename}-vendor.tar.bz2 Source2: go-vendor-tools.toml +Patch0: open-only-use-part-basename-for-temp-file.patch +Patch1: open-fix-opening-text-html-messages.patch + BuildRequires: desktop-file-utils # wrap and colorize filters are written in C BuildRequires: gcc diff --git a/open-fix-opening-text-html-messages.patch b/open-fix-opening-text-html-messages.patch new file mode 100644 index 0000000..e810860 --- /dev/null +++ b/open-fix-opening-text-html-messages.patch @@ -0,0 +1,38 @@ +From 2bbe75fe0bc87ab4c1e16c5a18c6200224391629 Mon Sep 17 00:00:00 2001 +From: Nicole Patricia Mazzuca +Date: Fri, 9 May 2025 09:32:21 +0200 +Subject: [PATCH aerc] open: fix opening text/html messages + +This fixes a bug introduced in 93bec0de8ed5ab3d6b1f01026fe2ef20fa154329: +aerc started using `path.Base()`, which returns `"."` on an empty +path, but still checked for `""` two lines later. + +On macOS, the result is that aerc attempts to open the directory: + +``` +open /var/folders/vn/hs0zvdsx3vq6svvry8s1bnym0000gn/T/aerc-4229266673: is a directory +``` + +Signed-off-by: Nicole Patricia Mazzuca +Acked-by: Robin Jarry +--- + + commands/msgview/open.go | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/commands/msgview/open.go b/commands/msgview/open.go +index a6e43cb8da5f..7c770d4a90b7 100644 +--- a/commands/msgview/open.go ++++ b/commands/msgview/open.go +@@ -59,7 +59,7 @@ func (o Open) Execute(args []string) error { + } + filename := path.Base(part.FileName()) + var tmpFile *os.File +- if filename == "" { ++ if filename == "." { + extension := "" + if exts, _ := mime.ExtensionsByType(mimeType); len(exts) > 0 { + extension = exts[0] +-- +2.49.0 + diff --git a/open-only-use-part-basename-for-temp-file.patch b/open-only-use-part-basename-for-temp-file.patch new file mode 100644 index 0000000..04333ef --- /dev/null +++ b/open-only-use-part-basename-for-temp-file.patch @@ -0,0 +1,45 @@ +From 93bec0de8ed5ab3d6b1f01026fe2ef20fa154329 Mon Sep 17 00:00:00 2001 +From: Robin Jarry +Date: Wed, 9 Apr 2025 10:49:24 +0200 +Subject: [PATCH aerc] open: only use part basename for temp file + +When an attachment part has a name such as "/tmp/55208186_AllDocs.pdf", +aerc creates a temp folder and tries to store the file by blindly +concatenating the path as follows: + + /tmp/aerc-3444057757/tmp/55208186_AllDocs.pdf + +And when writing to this path, it gets a "No such file or directory" +error because the intermediate "tmp" subfolder isn't created. + +Reported-by: Erik Colson +Signed-off-by: Robin Jarry +--- + + commands/msgview/open.go | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/commands/msgview/open.go b/commands/msgview/open.go +index 4293b7e4892c..a6e43cb8da5f 100644 +--- a/commands/msgview/open.go ++++ b/commands/msgview/open.go +@@ -5,6 +5,7 @@ import ( + "io" + "mime" + "os" ++ "path" + "path/filepath" + + "git.sr.ht/~rjarry/aerc/app" +@@ -56,7 +57,7 @@ func (o Open) Execute(args []string) error { + app.PushError(err.Error()) + return + } +- filename := part.FileName() ++ filename := path.Base(part.FileName()) + var tmpFile *os.File + if filename == "" { + extension := "" +-- +2.49.0 + From 57ead0b6f28f7f8bbc3813f8dcb66cd243c2f6cf Mon Sep 17 00:00:00 2001 From: Maxwell G Date: Thu, 12 Jun 2025 14:29:19 -0500 Subject: [PATCH 03/11] Remove redundant manual dependency on notmuch The binary links to libnotmuch.so, so the RPM dependency generator already generates a dependency for it. ... $ fedrq pkgs -S aerc -F requires | grep libnotmuch libnotmuch.so.5()(64bit) --- aerc.spec | 2 -- 1 file changed, 2 deletions(-) diff --git a/aerc.spec b/aerc.spec index 789eb80..d38ca6e 100644 --- a/aerc.spec +++ b/aerc.spec @@ -41,8 +41,6 @@ BuildRequires: gnupg BuildRequires: notmuch-devel BuildRequires: scdoc -# for libnotmuch.so -Requires: notmuch # used in the builtin `html` filter Requires: w3m # aerc is mainly targeted at developers using a git+email workflow From 7594891867cc15650438b808dc07362d7f79ab1d Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 23 Jul 2025 16:48:31 +0000 Subject: [PATCH 04/11] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild From 7e766529bfe09e875528ad370651ab806effdc45 Mon Sep 17 00:00:00 2001 From: Maxwell G Date: Thu, 24 Jul 2025 23:45:24 -0500 Subject: [PATCH 05/11] Rebuild From e5f5c0e032ebf2d54371fc928f597ffe2f5c016f Mon Sep 17 00:00:00 2001 From: Maxwell G Date: Fri, 15 Aug 2025 14:18:59 -0500 Subject: [PATCH 06/11] Rebuild for golang-1.25.0 --- aerc.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/aerc.spec b/aerc.spec index d38ca6e..e67c9a6 100644 --- a/aerc.spec +++ b/aerc.spec @@ -17,7 +17,7 @@ efficient and extensible, perfect for the discerning hacker.} Name: aerc Version: %{forgeversion} -Release: %autorelease +Release: %autorelease.1 Summary: Email client for your terminal SourceLicense: MIT @@ -111,4 +111,7 @@ LANG=en_US.UTF-8 ./filters/test.sh %{_mandir}/man7/aerc-*.7.* %changelog +* Fri Aug 15 2025 Maxwell G - 0.20.1-1.1 +- Rebuild for golang-1.25.0 + %autochangelog From a84788c31750e0f364263bc4288d0de019582126 Mon Sep 17 00:00:00 2001 From: Maxwell G Date: Fri, 15 Aug 2025 15:24:36 -0500 Subject: [PATCH 07/11] Revert "Rebuild for golang-1.25.0" This reverts commit e5f5c0e032ebf2d54371fc928f597ffe2f5c016f. --- aerc.spec | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/aerc.spec b/aerc.spec index e67c9a6..d38ca6e 100644 --- a/aerc.spec +++ b/aerc.spec @@ -17,7 +17,7 @@ efficient and extensible, perfect for the discerning hacker.} Name: aerc Version: %{forgeversion} -Release: %autorelease.1 +Release: %autorelease Summary: Email client for your terminal SourceLicense: MIT @@ -111,7 +111,4 @@ LANG=en_US.UTF-8 ./filters/test.sh %{_mandir}/man7/aerc-*.7.* %changelog -* Fri Aug 15 2025 Maxwell G - 0.20.1-1.1 -- Rebuild for golang-1.25.0 - %autochangelog From c550d46275d5555b5a51dfbe2da728b380d9de74 Mon Sep 17 00:00:00 2001 From: Maxwell G Date: Fri, 15 Aug 2025 15:59:48 -0500 Subject: [PATCH 08/11] Rebuild for golang-1.25.0 From 7433fc6280999422de764b67b5206f7cb2a115f1 Mon Sep 17 00:00:00 2001 From: Robin Jarry Date: Thu, 28 Aug 2025 13:55:13 +0200 Subject: [PATCH 09/11] New upstream release 0.21.0 (fedora#2391452) --- .gitignore | 2 + aerc.spec | 5 +-- open-fix-opening-text-html-messages.patch | 38 ---------------- ...only-use-part-basename-for-temp-file.patch | 45 ------------------- sources | 4 +- 5 files changed, 5 insertions(+), 89 deletions(-) delete mode 100644 open-fix-opening-text-html-messages.patch delete mode 100644 open-only-use-part-basename-for-temp-file.patch diff --git a/.gitignore b/.gitignore index 70f398a..72db243 100644 --- a/.gitignore +++ b/.gitignore @@ -21,3 +21,5 @@ /aerc-0.20.0-vendor.tar.bz2 /aerc-0.20.1.tar.gz /aerc-0.20.1-vendor.tar.bz2 +/aerc-0.21.0.tar.gz +/aerc-0.21.0-vendor.tar.bz2 diff --git a/aerc.spec b/aerc.spec index d38ca6e..d3ceec8 100644 --- a/aerc.spec +++ b/aerc.spec @@ -7,7 +7,7 @@ # https://git.sr.ht/~rjarry/aerc %global goipath git.sr.ht/~rjarry/aerc -%global version0 0.20.1 +%global version0 0.21.0 %gometa -L -f @@ -29,9 +29,6 @@ Source0: %{gosource} Source1: %{archivename}-vendor.tar.bz2 Source2: go-vendor-tools.toml -Patch0: open-only-use-part-basename-for-temp-file.patch -Patch1: open-fix-opening-text-html-messages.patch - BuildRequires: desktop-file-utils # wrap and colorize filters are written in C BuildRequires: gcc diff --git a/open-fix-opening-text-html-messages.patch b/open-fix-opening-text-html-messages.patch deleted file mode 100644 index e810860..0000000 --- a/open-fix-opening-text-html-messages.patch +++ /dev/null @@ -1,38 +0,0 @@ -From 2bbe75fe0bc87ab4c1e16c5a18c6200224391629 Mon Sep 17 00:00:00 2001 -From: Nicole Patricia Mazzuca -Date: Fri, 9 May 2025 09:32:21 +0200 -Subject: [PATCH aerc] open: fix opening text/html messages - -This fixes a bug introduced in 93bec0de8ed5ab3d6b1f01026fe2ef20fa154329: -aerc started using `path.Base()`, which returns `"."` on an empty -path, but still checked for `""` two lines later. - -On macOS, the result is that aerc attempts to open the directory: - -``` -open /var/folders/vn/hs0zvdsx3vq6svvry8s1bnym0000gn/T/aerc-4229266673: is a directory -``` - -Signed-off-by: Nicole Patricia Mazzuca -Acked-by: Robin Jarry ---- - - commands/msgview/open.go | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/commands/msgview/open.go b/commands/msgview/open.go -index a6e43cb8da5f..7c770d4a90b7 100644 ---- a/commands/msgview/open.go -+++ b/commands/msgview/open.go -@@ -59,7 +59,7 @@ func (o Open) Execute(args []string) error { - } - filename := path.Base(part.FileName()) - var tmpFile *os.File -- if filename == "" { -+ if filename == "." { - extension := "" - if exts, _ := mime.ExtensionsByType(mimeType); len(exts) > 0 { - extension = exts[0] --- -2.49.0 - diff --git a/open-only-use-part-basename-for-temp-file.patch b/open-only-use-part-basename-for-temp-file.patch deleted file mode 100644 index 04333ef..0000000 --- a/open-only-use-part-basename-for-temp-file.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 93bec0de8ed5ab3d6b1f01026fe2ef20fa154329 Mon Sep 17 00:00:00 2001 -From: Robin Jarry -Date: Wed, 9 Apr 2025 10:49:24 +0200 -Subject: [PATCH aerc] open: only use part basename for temp file - -When an attachment part has a name such as "/tmp/55208186_AllDocs.pdf", -aerc creates a temp folder and tries to store the file by blindly -concatenating the path as follows: - - /tmp/aerc-3444057757/tmp/55208186_AllDocs.pdf - -And when writing to this path, it gets a "No such file or directory" -error because the intermediate "tmp" subfolder isn't created. - -Reported-by: Erik Colson -Signed-off-by: Robin Jarry ---- - - commands/msgview/open.go | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/commands/msgview/open.go b/commands/msgview/open.go -index 4293b7e4892c..a6e43cb8da5f 100644 ---- a/commands/msgview/open.go -+++ b/commands/msgview/open.go -@@ -5,6 +5,7 @@ import ( - "io" - "mime" - "os" -+ "path" - "path/filepath" - - "git.sr.ht/~rjarry/aerc/app" -@@ -56,7 +57,7 @@ func (o Open) Execute(args []string) error { - app.PushError(err.Error()) - return - } -- filename := part.FileName() -+ filename := path.Base(part.FileName()) - var tmpFile *os.File - if filename == "" { - extension := "" --- -2.49.0 - diff --git a/sources b/sources index eed1a8b..12ae86a 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (aerc-0.20.1.tar.gz) = 7221217b7f0e6f92b589864b2e214b3edad3a2f702ab1d6b83f11eba6bb443bf334e76dbb61a67a13a9673e5e5106428ea3ba0ade940dc7f2cf488076783f4a5 -SHA512 (aerc-0.20.1-vendor.tar.bz2) = 5c940f028f1701631dc9b293b462de1f5c260de781517e8b199a2e92da7d6532f76f675963459f917ff5535b90a4bb1084e9a19093690f9dcf7357d9a898f66a +SHA512 (aerc-0.21.0.tar.gz) = b58b3ba9fe36a22b5717d48d7b1caf37303003cb4f32138e79f9775a96dbc5d8b27700091dbfe56f31954be5881467a7c5d8c1895d9161eda19a0d7e5c4750aa +SHA512 (aerc-0.21.0-vendor.tar.bz2) = 5deb3e85cdeed9d0366e08ba851bbc4382dfafd3e2ecfb561cfc9b0afdd90183d72683a4c055d95a474144a2a5ba816c2946a1ade9acc85119d0e3242ef8af60 From 11af6f89f557f0f74afb65f67ffec30c414021b0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alejandro=20S=C3=A1ez?= Date: Fri, 10 Oct 2025 12:35:36 +0200 Subject: [PATCH 10/11] rebuild From 45d4b5450f085409c6fce5bb3ab3fecacfcbbb2f Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 16 Jan 2026 03:29:48 +0000 Subject: [PATCH 11/11] Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild