diff --git a/.gitignore b/.gitignore index a3e5f6d..4c01de0 100644 --- a/.gitignore +++ b/.gitignore @@ -86,3 +86,9 @@ /go1.14.3.src.tar.gz /go1.14.4.src.tar.gz /go1.14.6.src.tar.gz +/go1.14.7.src.tar.gz +/go1.14.9.src.tar.gz +/go1.14.10.src.tar.gz +/go1.14.12.src.tar.gz +/go1.14.13.src.tar.gz +/go1.14.15.src.tar.gz diff --git a/0004-fix-cve-2020-14040.patch b/0004-fix-cve-2020-14040.patch new file mode 100644 index 0000000..e26e039 --- /dev/null +++ b/0004-fix-cve-2020-14040.patch @@ -0,0 +1,109 @@ +diff --git a/src/go.mod b/src/go.mod +index faf848d5df..e0bdfd3268 100644 +--- a/src/go.mod ++++ b/src/go.mod +@@ -6,5 +6,5 @@ require ( + golang.org/x/crypto v0.0.0-20200128174031-69ecbb4d6d5d + golang.org/x/net v0.0.0-20210129194117-4acb7895a057 + golang.org/x/sys v0.0.0-20200201011859-915c9c3d4ccf // indirect +- golang.org/x/text v0.3.3-0.20191031172631-4b67af870c6f // indirect ++ golang.org/x/text v0.3.4 // indirect + ) +diff --git a/src/go.sum b/src/go.sum +index 58d6621a2f..1e434470a6 100644 +--- a/src/go.sum ++++ b/src/go.sum +@@ -9,6 +9,6 @@ golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7w + golang.org/x/sys v0.0.0-20200201011859-915c9c3d4ccf h1:+4j7oujXP478CVb/AFvHJmVX5+Pczx2NGts5yirA0oY= + golang.org/x/sys v0.0.0-20200201011859-915c9c3d4ccf/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= + golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= +-golang.org/x/text v0.3.3-0.20191031172631-4b67af870c6f h1:wYBuYA3M/ZC3iBpL1jKHNRNEK7d8D3JoJmM+zx6rLVQ= +-golang.org/x/text v0.3.3-0.20191031172631-4b67af870c6f/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= ++golang.org/x/text v0.3.4 h1:0YWbFKbhXG/wIiuHDSKpS0Iy7FSA+u45VtBMfQcFTTc= ++golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= + golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= +diff --git a/src/vendor/golang.org/x/text/transform/transform.go b/src/vendor/golang.org/x/text/transform/transform.go +index 520b9ada0e..48ec64b40c 100644 +--- a/src/vendor/golang.org/x/text/transform/transform.go ++++ b/src/vendor/golang.org/x/text/transform/transform.go +@@ -648,7 +648,8 @@ func String(t Transformer, s string) (result string, n int, err error) { + // Transform the remaining input, growing dst and src buffers as necessary. + for { + n := copy(src, s[pSrc:]) +- nDst, nSrc, err := t.Transform(dst[pDst:], src[:n], pSrc+n == len(s)) ++ atEOF := pSrc+n == len(s) ++ nDst, nSrc, err := t.Transform(dst[pDst:], src[:n], atEOF) + pDst += nDst + pSrc += nSrc + +@@ -659,6 +660,9 @@ func String(t Transformer, s string) (result string, n int, err error) { + dst = grow(dst, pDst) + } + } else if err == ErrShortSrc { ++ if atEOF { ++ return string(dst[:pDst]), pSrc, err ++ } + if nSrc == 0 { + src = grow(src, 0) + } +diff --git a/src/vendor/golang.org/x/text/unicode/bidi/core.go b/src/vendor/golang.org/x/text/unicode/bidi/core.go +index 48d144008a..50deb6600a 100644 +--- a/src/vendor/golang.org/x/text/unicode/bidi/core.go ++++ b/src/vendor/golang.org/x/text/unicode/bidi/core.go +@@ -480,15 +480,15 @@ func (s *isolatingRunSequence) resolveWeakTypes() { + + // Rule W1. + // Changes all NSMs. +- preceedingCharacterType := s.sos ++ precedingCharacterType := s.sos + for i, t := range s.types { + if t == NSM { +- s.types[i] = preceedingCharacterType ++ s.types[i] = precedingCharacterType + } else { + if t.in(LRI, RLI, FSI, PDI) { +- preceedingCharacterType = ON ++ precedingCharacterType = ON + } +- preceedingCharacterType = t ++ precedingCharacterType = t + } + } + +diff --git a/src/vendor/golang.org/x/text/unicode/bidi/tables12.0.0.go b/src/vendor/golang.org/x/text/unicode/bidi/tables12.0.0.go +index 7ffa365121..647f2d4279 100644 +--- a/src/vendor/golang.org/x/text/unicode/bidi/tables12.0.0.go ++++ b/src/vendor/golang.org/x/text/unicode/bidi/tables12.0.0.go +@@ -1,6 +1,6 @@ + // Code generated by running "go generate" in golang.org/x/text. DO NOT EDIT. + +-// +build go1.14 ++// +build go1.14,!go1.16 + + package bidi + +diff --git a/src/vendor/golang.org/x/text/unicode/norm/tables12.0.0.go b/src/vendor/golang.org/x/text/unicode/norm/tables12.0.0.go +index 10f5202c69..7e1ae096e5 100644 +--- a/src/vendor/golang.org/x/text/unicode/norm/tables12.0.0.go ++++ b/src/vendor/golang.org/x/text/unicode/norm/tables12.0.0.go +@@ -1,6 +1,6 @@ + // Code generated by running "go generate" in golang.org/x/text. DO NOT EDIT. + +-// +build go1.14 ++// +build go1.14,!go1.16 + + package norm + +diff --git a/src/vendor/modules.txt b/src/vendor/modules.txt +index 7c6c478b12..547b21f885 100644 +--- a/src/vendor/modules.txt ++++ b/src/vendor/modules.txt +@@ -21,7 +21,7 @@ golang.org/x/net/route + # golang.org/x/sys v0.0.0-20200201011859-915c9c3d4ccf + ## explicit + golang.org/x/sys/cpu +-# golang.org/x/text v0.3.3-0.20191031172631-4b67af870c6f ++# golang.org/x/text v0.3.4 + ## explicit + golang.org/x/text/secure/bidirule + golang.org/x/text/transform diff --git a/golang.spec b/golang.spec index e0509cf..e8faec0 100644 --- a/golang.spec +++ b/golang.spec @@ -105,11 +105,11 @@ %endif %global go_api 1.14 -%global go_version 1.14.6 +%global go_version 1.14.15 Name: golang -Version: 1.14.6 -Release: 1%{?dist} +Version: 1.14.15 +Release: 3%{?dist} Summary: The Go Programming Language # source tree includes several copies of Mark.Twain-Tom.Sawyer.txt under Public Domain License: BSD and Public Domain @@ -220,6 +220,7 @@ Requires: go-srpm-macros Patch1: 0001-Don-t-use-the-bundled-tzdata-at-runtime-except-for-t.patch Patch2: 0002-syscall-expose-IfInfomsg.X__ifi_pad-on-s390x.patch Patch3: 0003-cmd-go-disable-Google-s-proxy-and-sumdb.patch +Patch4: 0004-fix-cve-2020-14040.patch # Having documentation separate was broken Obsoletes: %{name}-docs < 1.1-4 @@ -591,6 +592,29 @@ fi %endif %changelog +* Tue Mar 02 2021 Alejandro Sáez - 1.14.15-3 +- rebuilt + +* Wed Feb 24 2021 Alejandro Sáez - 1.14.15-2 +- Bump up the global label + +* Wed Feb 24 2021 Alejandro Sáez - 1.14.15-1 +- Rebase to go1.14.15 + +* Sun Dec 6 19:02:58 CET 2020 Alejandro Sáez - 1.14.13-1 +- Rebase to go1.14.13 + +* Thu Oct 22 2020 Alejandro Sáez - 1.14.10-1 +- Rebase to go1.14.10 + +* Thu Sep 10 2020 Alejandro Sáez - 1.14.9-1 +- Rebase to go1.14.9 + +* Mon Aug 10 2020 Alejandro Sáez - 1.14.7-1 +- Rebase to go1.14.7 +- Security fix for CVE-2020-14040 and CVE-2020-15586 +- Resolves: BZ#1853654, BZ#1867100, BZ#1866892 + * Mon Jul 20 2020 Jakub Čajka - 1.14.6-1 - Rebase to go1.14.6 - Security fix for CVE-2020-14040 and CVE-2020-15586 diff --git a/sources b/sources index 8fc8da6..487c331 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (go1.14.6.src.tar.gz) = 5c865c8272fb0dc8eab1514732b0200dbc867276512714dd30afc658a0d2afac6bd758e00c6f576d8d254e411418a52a564c895399b56cfe06c2b1785271a8fd +SHA512 (go1.14.15.src.tar.gz) = 94cacf8c86789600fae09a1da4055b9a436977b18488d85bb91494eece8a8e012e1b68924a8a50714c2d17db19d1e84a4a6bec91fa10fd8415c9739c9a348dc1