Add fixed CVE to the changelog

(cherry picked from commit 971863248c)
Upgrade to fossil 2.14.2
2021-07-18 23:17:56 +02:00 · 2021-07-18 23:17:25 +02:00 · 2021-07-18 23:15:55 +02:00 · 2021-01-28 07:34:47 -07:00 · 2020-12-14 20:03:38 -07:00
4 changed files with 120 additions and 149 deletions
--- a/.gitignore
+++ b/.gitignore
@ -6,12 +6,4 @@
 /fossil-src-2.8.tar.gz
 /fossil-src-2.12.1.tar.gz
 /fossil-src-2.14.tar.gz
-/fossil-2.16.tar.gz
-/fossil-src-2.17.tar.gz
-/fossil-src-2.18.tar.gz
-/fossil-src-2.19.tar.gz
-/fossil-src-2.20.tar.gz
-/fossil-src-2.23.tar.gz
-/fossil-src-2.24.tar.gz
-/fossil-src-2.25.tar.gz
-/fossil-src-2.26.tar.gz
+/fossil-2.14.2.tar.gz
--- a/130
+++ b/130
@ -1,130 +0,0 @@
-* Sun Jul 24 2022 Sheng Mao <shngmao@gmail.com> - 2.19-1
- New upstream release 2.19
-
-* Thu Feb 24 2022 Dan Čermák <dan.cermak@cgc-instruments.com> - 2.18-1
- New upstream release 2.18
-
-* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.17-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
-
-* Sat Dec 04 2021 Jonathan Schleifer <js@nil.im> - 2.17-1
- Upgrade to fossil 2.17
- Change upstream URL to match FreeBSD, Homebrew, pkgsrc etc. so hashes can be
-  compared
- Switch to vendored SQLite as Fossil releases regularly require unreleased
-  SQLite versions and both are from the same upstream anyway
-
-* Tue Sep 14 2021 Sahana Prasad <sahana@redhat.com> - 2.16-3
- Rebuilt with OpenSSL 3.0.0
-
-* Wed Jul 21 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.16-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
-
-* Sun Jul 04 2021 Sheng Mao <shngmao@gmail.com> - 2.16-1
- Upgrade to fossil 2.16
- Fixes rhbz#1921136, rhbz#1980049
-
-* Wed Jan 27 2021 Sheng Mao <shngmao@gmail.com> - 2.14-1
- Upgrade to fossil 2.14
-
-* Wed Dec 16 2020 Sheng Mao <shngmao@gmail.com> - 2.13-2
- Enable fossil-doc with searching feature
-
-* Mon Dec 14 2020 Sheng Mao <shngmao@gmail.com> - 2.13-1
- Upgrade to fossil 2.13
-
-* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.12.1-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
-
-* Wed Nov 25 2020 Sheng Mao <shngmao@gmail.com> - 2.12.1-2
- Organize fossil documents in fossil repository format rhbz#1839024
-
-* Mon Oct 19 2020 Sheng Mao <shngmao@gmail.com> - 2.12.1-1
- Upgrade to fossil 2.12.1 after adding FTS4 to system-wide sqlite (rhbz#1887106)
-  rhbz#1863577, rhbz#1870790
-
-* Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.8-5
- Second attempt - Rebuilt for
-  https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
-
-* Mon Jul 27 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.8-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
-
-* Tue Jan 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.8-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
-
-* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.8-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
-
-* Thu Jul 04 2019 Filipe Rosset <rosset.filipe@gmail.com> - 2.8-1
- Update to 2.8 fixes rhbz#1581180 rhbz#1603993 rhbz#1674893 and rhbz#1524335
- Removed upstreamed patch
- Bug 1524335 - CVE-2017-17459 fossil: Command injection via malicious ssh URLs [fedora-all]
- Bug 1581180 - Update fossil version to 2.6 (currently is 2.2)
- Bug 1603993 - fossil: FTBFS in Fedora rawhide
- Bug 1674893 - fossil: FTBFS in Fedora rawhide/f30
-
-* Thu Jan 31 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.2-7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
-
-* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.2-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
-
-* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.2-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
-
-* Wed Aug 02 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.2-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
-
-* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.2-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
-
-* Fri Apr 28 2017 Patrick Uiterwijk <puiterwijk@redhat.com> - 2.2-2
- Update source URL
- Add patch to drop extra groups
-
-* Fri Apr 28 2017 Patrick Uiterwijk <puiterwijk@redhat.com> - 2.2-1
- Rebase to 2.2
-
-* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.34-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
-
-* Sun Mar 20 2016 Divya Cote <divya.hariomtatsat@gmail.com> - 1.34-1
- Update to latest release
-
-* Wed Feb 03 2016 Fedora Release Engineering <releng@fedoraproject.org> - 1.33-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
-
-* Wed Jun 17 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.33-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
-
-* Wed May 27 2015 Patrick Uiterwijk <puiterwijk@redhat.com> - 1.33-1
- Update to latest release
-
-* Sat Aug 16 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.28-4.20140127173344
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
-
-* Mon Jun 16 2014 Peter Robinson <pbrobinson@fedoraproject.org> 1.28-3.20140127173344
- Update config.guess/sub to fix ftbfs on new architectures (aarch64/ppc64le)
-
-* Sat Jun 07 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.28-2.20140127173344
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
-
-* Wed Jan 29 2014 Patrick Uiterwijk <puiterwijk@redhat.com> - 1.28-1.20140127173344
- Update to 1.28
- Remove patch to use system sqlite
-
-* Sat Aug 03 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.25-3.20130216000435
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
-
-* Tue May 07 2013 Patrick Uiterwijk <puiterwijk@gmail.com> - 1.25-2.20130216000435
- Update file permissions for bin/fossil
-
-* Fri May 03 2013 Patrick Uiterwijk <puiterwijk@gmail.com> - 1.25-1.20130216000435
- Update packaging
-
-* Tue Sep 08 2009 Silas Sewell <silas@sewell.ch> - 0.0-0.2.20090828225927
- Add doc subpackage and make optflags
-
-* Mon Sep 07 2009 Silas Sewell <silas@sewell.ch> - 0.0-0.1.20090828225927
- Initial package
--- a/fossil.spec
+++ b/fossil.spec
@ -1,23 +1,23 @@
 %bcond_without tests
 Name:             fossil
-Version:          2.26
-Release:          %autorelease
+Version:          2.14.2
+Release:          1%{?dist}
 Summary:          A distributed SCM with bug tracking and wiki

-License:          BSD-2-Clause
+License:          BSD
 URL:              https://www.fossil-scm.org/
-Source0:          %{URL}home/tarball/version-%{version}/fossil-src-%{version}.tar.gz
+Source0:          %{URL}home/tarball/version-%{version}/fossil-%{version}.tar.gz
 Source1:          template.config
 Source2:          fossil-doc
 Source3:          fossil-doc-README

 BuildRequires:    gcc-c++
 BuildRequires:    zlib-devel
+BuildRequires:    sqlite
+BuildRequires:    sqlite-devel >= 3.34.0
 BuildRequires:    openssl-devel
 BuildRequires:    tcl
 BuildRequires:    make
-BuildRequires:    sqlite
-Provides:         bundled(sqlite) = 3.38.0

 %description
 Fossil is a simple, high-reliability, distributed software configuration
@ -34,7 +34,8 @@ Documentation in repository format for %{name}. Users can run `fossil ui`
 in %{_docdir}/%{name}-doc folder to view documents in browser.

 %prep
-%autosetup -p0 -n fossil-src-%{version}
+%autosetup
+rm -f src/sqlite3.c

 # Update config.guess/sub to fix builds on new architectures (aarch64/ppc64le)
 for conf in /usr/lib/rpm/config.*; do [ -z "${f}" ] && break; cp "${f}" autosetup; done
@ -58,6 +59,7 @@ for conf in /usr/lib/rpm/config.*; do [ -z "${f}" ] && break; cp "${f}" autosetu
  --sharedstatedir=%{_sharedstatedir} \
  --mandir=%{_mandir} \
  --infodir=%{_infodir} \
+  --disable-internal-sqlite \
  --with-openssl=auto \
  --json

@ -80,12 +82,13 @@ tclsh test/tester.tcl %{buildroot}%{_bindir}/%name

 # create a fossil repository for documents with default settings
 %{buildroot}%{_bindir}/%name init --admin-user %name %name-doc.fossil
-%{buildroot}%{_bindir}/%name open --force %name-doc.fossil
+%{buildroot}%{_bindir}/%name open --empty --force %name-doc.fossil
 %{buildroot}%{_bindir}/%name configuration import %{SOURCE1}
 sqlite3 %name-doc.fossil "REPLACE INTO config(name,value,mtime) VALUES('doc-glob','*.wiki,*.html,*.md,*.txt',1608172730);"
 %{buildroot}%{_bindir}/%name add www
 %{buildroot}%{_bindir}/%name commit --user %name --force --comment '%name-doc initial commit'
 %{buildroot}%{_bindir}/%name fts-config enable d
+%{buildroot}%{_bindir}/%name fts-config stemmer on
 %{buildroot}%{_bindir}/%name fts-config index on

 install -m 0755 -p -D %{SOURCE2} %{buildroot}%{_bindir}
@ -102,4 +105,110 @@ cp %{SOURCE3} README
 %doc README

 %changelog
-%autochangelog
+* Sun Jul 04 2021 Sheng Mao <shngmao@gmail.com> - 2.14.2-1
+- Upgrade to fossil 2.14.2
+- Verifies that the server hostname matches its certificate
+- Fix a data exfiltration bug in the server
+- Fixes CVE-2021-36377, rhbz#1980049
+
+* Wed Jan 27 2021 Sheng Mao <shngmao@gmail.com> - 2.14-1
+- Upgrade to fossil 2.14
+
+* Wed Dec 16 2020 Sheng Mao <shngmao@gmail.com> - 2.13-2
+- Enable fossil-doc with searching feature
+
+* Mon Dec 14 2020 Sheng Mao <shngmao@gmail.com> - 2.13-1
+- Upgrade to fossil 2.13
+
+* Wed Nov 25 2020 Sheng Mao <shngmao@gmail.com> - 2.12.1-2
+- Organize fossil documents in fossil repository format rhbz#1839024
+
+* Mon Oct 19 2020 Sheng Mao <shngmao@gmail.com> - 2.12.1-1
+- Upgrade to fossil 2.12.1 after adding FTS4 to system-wide sqlite (rhbz#1887106)
+  rhbz#1863577, rhbz#1870790
+
+* Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.8-5
+- Second attempt - Rebuilt for
+  https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Mon Jul 27 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.8-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Tue Jan 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.8-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
+* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.8-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
+* Thu Jul 04 2019 Filipe Rosset <rosset.filipe@gmail.com> - 2.8-1
+- Update to 2.8 fixes rhbz#1581180 rhbz#1603993 rhbz#1674893 and rhbz#1524335
+- Removed upstreamed patch
+- Bug 1524335 - CVE-2017-17459 fossil: Command injection via malicious ssh URLs [fedora-all]
+- Bug 1581180 - Update fossil version to 2.6 (currently is 2.2)
+- Bug 1603993 - fossil: FTBFS in Fedora rawhide
+- Bug 1674893 - fossil: FTBFS in Fedora rawhide/f30
+
+* Thu Jan 31 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.2-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.2-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+
+* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.2-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
+
+* Wed Aug 02 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.2-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
+
+* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.2-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
+
+* Fri Apr 28 2017 Patrick Uiterwijk <puiterwijk@redhat.com> - 2.2-2
+- Update source URL
+- Add patch to drop extra groups
+
+* Fri Apr 28 2017 Patrick Uiterwijk <puiterwijk@redhat.com> - 2.2-1
+- Rebase to 2.2
+
+* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.34-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
+
+* Sun Mar 20 2016 Divya Cote <divya.hariomtatsat@gmail.com> - 1.34-1
+- Update to latest release
+
+* Wed Feb 03 2016 Fedora Release Engineering <releng@fedoraproject.org> - 1.33-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
+
+* Wed Jun 17 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.33-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
+
+* Wed May 27 2015 Patrick Uiterwijk <puiterwijk@redhat.com> - 1.33-1
+- Update to latest release
+
+* Sat Aug 16 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.28-4.20140127173344
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
+
+* Mon Jun 16 2014 Peter Robinson <pbrobinson@fedoraproject.org> 1.28-3.20140127173344
+- Update config.guess/sub to fix ftbfs on new architectures (aarch64/ppc64le)
+
+* Sat Jun 07 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.28-2.20140127173344
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
+
+* Wed Jan 29 2014 Patrick Uiterwijk <puiterwijk@redhat.com> - 1.28-1.20140127173344
+- Update to 1.28
+- Remove patch to use system sqlite
+
+* Sat Aug 03 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.25-3.20130216000435
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
+
+* Tue May 07 2013 Patrick Uiterwijk <puiterwijk@gmail.com> - 1.25-2.20130216000435
+- Update file permissions for bin/fossil
+
+* Fri May 03 2013 Patrick Uiterwijk <puiterwijk@gmail.com> - 1.25-1.20130216000435
+- Update packaging
+
+* Tue Sep 08 2009 Silas Sewell <silas@sewell.ch> - 0.0-0.2.20090828225927
+- Add doc subpackage and make optflags
+
+* Mon Sep 07 2009 Silas Sewell <silas@sewell.ch> - 0.0-0.1.20090828225927
+- Initial package
--- a/2
+++ b/2
@ -1 +1 @@
-SHA512 (fossil-src-2.26.tar.gz) = 356a3b51adde40aedb094743eb978b78961c4216152000ecd800e22b69f1e3a11330259b627628fb6e9a594b1969f0351a73af717b500b4f12d109108fa82b61
+SHA512 (fossil-2.14.2.tar.gz) = b7df35e7443966fafdc36242d4aab9e56ee63801134ad323ede6ec43168dc9807238323302ae7d04d24fcbc271b39cac7801eee9d6d24e3ce88301e38677a284
Author	SHA1	Message	Date
Dan Čermák	1916c8588f	Add fixed CVE to the changelog (cherry picked from commit `971863248c`)	2021-07-18 23:17:56 +02:00
Sheng Mao	020348a439	Upgrade to fossil 2.14.2 Fossil 2.14.2 instead of 2.16 is packaed for f34. 2.15+ needs SQLite 3.35, which is available to rawhide/main. Introduce two bug fixes from 2.14.1 and 2.14.2: - Verifies that the server hostname matches its certificate - Fix a data exfiltration bug in the server As the hosting site changed to fossil 2.15+, the download URL changed too: fossil's hash is appended to the URL. The unpacked folder name is changed too, so autosetup is updated. (cherry picked from commit `45610650d6`)	2021-07-18 23:17:25 +02:00
Dan Čermák	a81024a9e5	Update gitignore (cherry picked from commit `ad25011cca`)	2021-07-18 23:15:55 +02:00
Sheng Mao	bbfcd6b636	Upgrade to fossil 2.14	2021-01-28 07:34:47 -07:00
Sheng Mao	af03cfe00a	Organize fossil documents in fossil repository format rhbz#1839024	2020-12-14 20:03:38 -07:00