From 0ee266a745e9fb5dc24d02ccb35dde16a29288a8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Fri, 19 Aug 2022 10:28:25 +0200 Subject: [PATCH 1/5] Update to version 3.0.5 --- .gitignore | 2 + bashls-fix-CVE-2022-0613.patch | 77 +++++++++++++------------------- nodejs-bash-language-server.spec | 11 ++++- sources | 4 +- 4 files changed, 43 insertions(+), 51 deletions(-) diff --git a/.gitignore b/.gitignore index dd034c4..626ffca 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,5 @@ /bash-language-server-1.17.0.tar.gz /bash-language-server-2.0.0.tar.gz /bash-language-server-2.0.0-vendor.tar.xz +/bash-language-server-3.0.5.tar.gz +/bash-language-server-3.0.5-vendor.tar.xz diff --git a/bashls-fix-CVE-2022-0613.patch b/bashls-fix-CVE-2022-0613.patch index ae09185..79c6f1e 100644 --- a/bashls-fix-CVE-2022-0613.patch +++ b/bashls-fix-CVE-2022-0613.patch @@ -1,55 +1,38 @@ -Index: bash-language-server-server-2.0.0/server/package.json -=================================================================== ---- bash-language-server-server-2.0.0.orig/server/package.json -+++ bash-language-server-server-2.0.0/server/package.json +From 5a4920cf4f49c29aade36682a17a38cb979bdfd1 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 19 Aug 2022 10:10:31 +0200 +Subject: [PATCH] CVE-2022-0613: Update urijs to v1.19.11 + +There is a Authorization Bypass Through User-Controlled Key in NPM +urijs prior to 1.19.8. +--- + server/package.json | 2 +- + server/yarn.lock | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/server/package.json b/server/package.json +index 51f565a4..5f3ba0fb 100644 +--- a/server/package.json ++++ b/server/package.json @@ -23,7 +23,7 @@ "request": "^2.83.0", "request-promise-native": "^1.0.5", - "turndown": "^4.0.2", + "turndown": "^7.0.0", - "urijs": "^1.19.1", -+ "urijs": "^1.19.8", ++ "urijs": "^1.19.11", "vscode-languageserver": "^6.1.1", "vscode-languageserver-textdocument": "^1.0.1", - "web-tree-sitter": "^0.19.4" -@@ -36,6 +36,6 @@ - "@types/glob": "^7.1.1", - "@types/request-promise-native": "^1.0.17", - "@types/turndown": "^5.0.0", -- "@types/urijs": "^1.19.4" -+ "@types/urijs": "^1.19.8" - } - } -Index: bash-language-server-server-2.0.0/server/yarn.lock -=================================================================== ---- bash-language-server-server-2.0.0.orig/server/yarn.lock -+++ bash-language-server-server-2.0.0/server/yarn.lock -@@ -63,10 +63,10 @@ - resolved "https://registry.yarnpkg.com/@types/turndown/-/turndown-5.0.0.tgz#2b763b36f783e4e237cea62cdc8f8592b72b9285" - integrity sha512-Y7KZn6SfSv1vzjByJGijrM9w99HoUbLiAgYwe+sGH6RYi5diIGLYOcr4Z1YqR2biFs9K5PnxKv/Fbkmh57pvzg== - --"@types/urijs@^1.19.4": -- version "1.19.4" -- resolved "https://registry.yarnpkg.com/@types/urijs/-/urijs-1.19.4.tgz#29c4a694d4842d7f95e359a26223fc1865f1ab13" -- integrity sha512-uHUvuLfy4YkRHL4UH8J8oRsINhdEHd9ymag7KJZVT94CjAmY1njoUzhazJsZjwfy+IpWKQKGVyXCwzhZvg73Fg== -+"@types/urijs@^1.19.8": -+ version "1.19.18" -+ resolved "https://registry.yarnpkg.com/@types/urijs/-/urijs-1.19.18.tgz#bf92d5b7c32bf41fc161c3660b8e3a78a9a4333e" -+ integrity sha512-tjftsOLuIWFLJxcpgFeehNnMhpMIv0ELJl0/i31jiV3au1GQpnd3/pTTDQg2zO5cSGJxtrDzMgebOH7+cqh3Vg== - - abab@^1.0.4: - version "1.0.4" -@@ -721,10 +721,10 @@ type-check@~0.3.2: - dependencies: - prelude-ls "~1.1.2" + "web-tree-sitter": "^0.20.5" +diff --git a/server/yarn.lock b/server/yarn.lock +index 0071aad2..7c752cf2 100644 +--- a/server/yarn.lock ++++ b/server/yarn.lock +@@ -489,7 +489,7 @@ tweetnacl@^0.14.3, tweetnacl@~0.14.0: + resolved "https://registry.yarnpkg.com/tweetnacl/-/tweetnacl-0.14.5.tgz#5ae68177f192d4456269d108afa93ff8743f4f64" + integrity sha1-WuaBd/GS1EViadEIr6k/+HQ/T2Q= -urijs@^1.19.1: -- version "1.19.7" -- resolved "https://registry.yarnpkg.com/urijs/-/urijs-1.19.7.tgz#4f594e59113928fea63c00ce688fb395b1168ab9" -- integrity sha512-Id+IKjdU0Hx+7Zx717jwLPsPeUqz7rAtuVBRLLs+qn+J2nf9NGITWVCxcijgYxBqe83C7sqsQPs6H1pyz3x9gA== -+urijs@^1.19.8: -+ version "1.19.8" -+ resolved "https://registry.yarnpkg.com/urijs/-/urijs-1.19.8.tgz#ee0407a18528934d3c383e691912f47043a58feb" -+ integrity sha512-iIXHrjomQ0ZCuDRy44wRbyTZVnfVNLVo3Ksz1yxNyE5wV1IDZW2S5Jszy45DTlw/UdsnRT7DyDhIz7Gy+vJumw== - - uuid@^3.1.0: - version "3.2.1" ++urijs@^1.19.11: + version "1.19.11" + resolved "https://registry.yarnpkg.com/urijs/-/urijs-1.19.11.tgz#204b0d6b605ae80bea54bea39280cdb7c9f923cc" + integrity sha512-HXgFDgDommxn5/bIv0cnQZsPhHDA90NPHD6+c/v21U5+Sx5hoP8+dP9IZXBU1gIfvdRfhG8cel9QNPeionfcCQ== diff --git a/nodejs-bash-language-server.spec b/nodejs-bash-language-server.spec index f3f87c8..6df8035 100644 --- a/nodejs-bash-language-server.spec +++ b/nodejs-bash-language-server.spec @@ -3,8 +3,8 @@ %define pkg_name bash-language-server Name: nodejs-bash-language-server -Version: 2.0.0 -Release: 4%{?dist} +Version: 3.0.5 +Release: 1%{?dist} Summary: A language server for Bash License: MIT Url: https://github.com/bash-lsp/bash-language-server @@ -21,6 +21,7 @@ BuildRequires: rsync BuildRequires: yarnpkg BuildArch: noarch ExclusiveArch: %{nodejs_arches} noarch +Recommends: ShellCheck %description Bash language server implementation based on Tree Sitter and its grammar for @@ -83,6 +84,12 @@ find %{buildroot}%{nodejs_sitelib}/%{pkg_name} -type f -name "\.*" -delete %{nodejs_sitelib}/%{pkg_name}/ %changelog +* Fri Aug 19 2022 Pavel Filipenský - 3.0.5-1 +- Update to version 3.0.5 + * https://github.com/bash-lsp/bash-language-server/blob/server-3.0.5/server/CHANGELOG.md +- Linting based on shellcheck +- Update bashls-fix-CVE-2022-0613.patch with content of https://patch-diff.githubusercontent.com/raw/bash-lsp/bash-language-server/pull/489.patch + * Fri Jul 22 2022 Fedora Release Engineering - 2.0.0-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild diff --git a/sources b/sources index 8851f0f..65cff0d 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bash-language-server-2.0.0.tar.gz) = e72df6f13ed4b861b81329059d41cdfada2729e9523e619ef26d6ed0a2a5400a3dda659b4f4af923a2a9fb2054b99b9d6db082508f2ba06ac0f9a421516e2ce9 -SHA512 (bash-language-server-2.0.0-vendor.tar.xz) = 14384d60661fb4973b22e18998a9b966aba9a9c252d9c2b139996ec8f208d9db54065f278f216c381f60e76b6fdc70979793d444b56016661bc8f6d4b76172e8 +SHA512 (bash-language-server-3.0.5.tar.gz) = fc0a92b905efcec22f4a7c7ee2f1318d56b2392851bffff67451d084ac784363c16cbef19fd17ffd5f54fb11d254a99f7ca3e62ff73ae98cb15d37b6b17325ed +SHA512 (bash-language-server-3.0.5-vendor.tar.xz) = 2017892eed1f0fab6ac1af110dc38ee995915f627c1e01a5f9f61be3ede90281172da041be3dd7131452234580119ba1d6545f828539e59411b80bb2a010343d From 3700191313b471c9cbeab19cef19ee61e6422acc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Mon, 28 Nov 2022 08:32:54 +0100 Subject: [PATCH 2/5] Update to version 3.2.0 --- .gitignore | 2 ++ bashls-fix-CVE-2022-0613.patch | 38 -------------------------------- nodejs-bash-language-server.spec | 3 +-- prepare_vendor.sh | 3 --- sources | 4 ++-- 5 files changed, 5 insertions(+), 45 deletions(-) delete mode 100644 bashls-fix-CVE-2022-0613.patch diff --git a/.gitignore b/.gitignore index 626ffca..4a78c39 100644 --- a/.gitignore +++ b/.gitignore @@ -4,3 +4,5 @@ /bash-language-server-2.0.0-vendor.tar.xz /bash-language-server-3.0.5.tar.gz /bash-language-server-3.0.5-vendor.tar.xz +/bash-language-server-3.2.0.tar.gz +/bash-language-server-3.2.0-vendor.tar.xz diff --git a/bashls-fix-CVE-2022-0613.patch b/bashls-fix-CVE-2022-0613.patch deleted file mode 100644 index 79c6f1e..0000000 --- a/bashls-fix-CVE-2022-0613.patch +++ /dev/null @@ -1,38 +0,0 @@ -From 5a4920cf4f49c29aade36682a17a38cb979bdfd1 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Fri, 19 Aug 2022 10:10:31 +0200 -Subject: [PATCH] CVE-2022-0613: Update urijs to v1.19.11 - -There is a Authorization Bypass Through User-Controlled Key in NPM -urijs prior to 1.19.8. ---- - server/package.json | 2 +- - server/yarn.lock | 2 +- - 2 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/server/package.json b/server/package.json -index 51f565a4..5f3ba0fb 100644 ---- a/server/package.json -+++ b/server/package.json -@@ -23,7 +23,7 @@ - "request": "^2.83.0", - "request-promise-native": "^1.0.5", - "turndown": "^7.0.0", -- "urijs": "^1.19.1", -+ "urijs": "^1.19.11", - "vscode-languageserver": "^6.1.1", - "vscode-languageserver-textdocument": "^1.0.1", - "web-tree-sitter": "^0.20.5" -diff --git a/server/yarn.lock b/server/yarn.lock -index 0071aad2..7c752cf2 100644 ---- a/server/yarn.lock -+++ b/server/yarn.lock -@@ -489,7 +489,7 @@ tweetnacl@^0.14.3, tweetnacl@~0.14.0: - resolved "https://registry.yarnpkg.com/tweetnacl/-/tweetnacl-0.14.5.tgz#5ae68177f192d4456269d108afa93ff8743f4f64" - integrity sha1-WuaBd/GS1EViadEIr6k/+HQ/T2Q= - --urijs@^1.19.1: -+urijs@^1.19.11: - version "1.19.11" - resolved "https://registry.yarnpkg.com/urijs/-/urijs-1.19.11.tgz#204b0d6b605ae80bea54bea39280cdb7c9f923cc" - integrity sha512-HXgFDgDommxn5/bIv0cnQZsPhHDA90NPHD6+c/v21U5+Sx5hoP8+dP9IZXBU1gIfvdRfhG8cel9QNPeionfcCQ== diff --git a/nodejs-bash-language-server.spec b/nodejs-bash-language-server.spec index 6df8035..5b47f19 100644 --- a/nodejs-bash-language-server.spec +++ b/nodejs-bash-language-server.spec @@ -3,7 +3,7 @@ %define pkg_name bash-language-server Name: nodejs-bash-language-server -Version: 3.0.5 +Version: 3.2.0 Release: 1%{?dist} Summary: A language server for Bash License: MIT @@ -11,7 +11,6 @@ Url: https://github.com/bash-lsp/bash-language-server Source0: %{url}/archive/server-%{version}/%{pkg_name}-%{version}.tar.gz # Create with `bash prepare_vendor.sh` Source1: %{pkg_name}-%{version}-vendor.tar.xz -Patch0: bashls-fix-CVE-2022-0613.patch BuildRequires: fdupes BuildRequires: nodejs-typescript BuildRequires: nodejs-packaging diff --git a/prepare_vendor.sh b/prepare_vendor.sh index 8a02610..d3eade3 100644 --- a/prepare_vendor.sh +++ b/prepare_vendor.sh @@ -39,9 +39,6 @@ tar -xf $BASHLS_TARBALL -C $BASHLS_TMPDIR pushd $BASHLS_PATH || cleanup_and_exit 1 -# TEMPORARY: Fix CVE-2022-0613 -patch -p1 < "${BASHLS_PKGDIR}/bashls-fix-CVE-2022-0613.patch" - export YARN_CACHE_FOLDER="$(pwd)/.package-cache" echo ">>>>>> Install npm modules" yarn install --frozen-lockfile diff --git a/sources b/sources index 65cff0d..cf68001 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bash-language-server-3.0.5.tar.gz) = fc0a92b905efcec22f4a7c7ee2f1318d56b2392851bffff67451d084ac784363c16cbef19fd17ffd5f54fb11d254a99f7ca3e62ff73ae98cb15d37b6b17325ed -SHA512 (bash-language-server-3.0.5-vendor.tar.xz) = 2017892eed1f0fab6ac1af110dc38ee995915f627c1e01a5f9f61be3ede90281172da041be3dd7131452234580119ba1d6545f828539e59411b80bb2a010343d +SHA512 (bash-language-server-3.2.0.tar.gz) = 83126bcc2ff16908a6a415dd1fe29afc8bb4ccb26b5070b5c0ea125169f6b32a4844aaedf76f1832b2a55c9b1e41351e35245525eba5bcf3245d2ed4a5b1c73e +SHA512 (bash-language-server-3.2.0-vendor.tar.xz) = d4e8cdd784ada8e11dd87a154aedae7f234004d452f3197315442b090b179d5d3e9b80c5c485984d467a4587fa60fc5c594888c91283e6f8f4790888f44b85d1 From e3b04d6e5f929f72c65d76b274b58c4d349931ac Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Mon, 30 Jan 2023 12:18:22 +0100 Subject: [PATCH 3/5] Update to version 4.6.1 --- .gitignore | 2 ++ nodejs-bash-language-server.spec | 6 +++++- sources | 4 ++-- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 4a78c39..ef0a06c 100644 --- a/.gitignore +++ b/.gitignore @@ -6,3 +6,5 @@ /bash-language-server-3.0.5-vendor.tar.xz /bash-language-server-3.2.0.tar.gz /bash-language-server-3.2.0-vendor.tar.xz +/bash-language-server-4.6.1.tar.gz +/bash-language-server-4.6.1-vendor.tar.xz diff --git a/nodejs-bash-language-server.spec b/nodejs-bash-language-server.spec index 5b47f19..0a220ef 100644 --- a/nodejs-bash-language-server.spec +++ b/nodejs-bash-language-server.spec @@ -3,7 +3,7 @@ %define pkg_name bash-language-server Name: nodejs-bash-language-server -Version: 3.2.0 +Version: 4.6.1 Release: 1%{?dist} Summary: A language server for Bash License: MIT @@ -83,6 +83,10 @@ find %{buildroot}%{nodejs_sitelib}/%{pkg_name} -type f -name "\.*" -delete %{nodejs_sitelib}/%{pkg_name}/ %changelog +* Mon Jan 30 2023 Pavel Filipenský - 4.6.1-1 +- Update to version 4.6.1 + * https://github.com/bash-lsp/bash-language-server/blob/server-4.6.1/server/CHANGELOG.md + * Fri Aug 19 2022 Pavel Filipenský - 3.0.5-1 - Update to version 3.0.5 * https://github.com/bash-lsp/bash-language-server/blob/server-3.0.5/server/CHANGELOG.md diff --git a/sources b/sources index cf68001..b65728d 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bash-language-server-3.2.0.tar.gz) = 83126bcc2ff16908a6a415dd1fe29afc8bb4ccb26b5070b5c0ea125169f6b32a4844aaedf76f1832b2a55c9b1e41351e35245525eba5bcf3245d2ed4a5b1c73e -SHA512 (bash-language-server-3.2.0-vendor.tar.xz) = d4e8cdd784ada8e11dd87a154aedae7f234004d452f3197315442b090b179d5d3e9b80c5c485984d467a4587fa60fc5c594888c91283e6f8f4790888f44b85d1 +SHA512 (bash-language-server-4.6.1.tar.gz) = 64f6e9f80ddf6b6cd4c6153b04490b1f91f0a57d2a472dadf8f55691952fe7c8907cba98d01e24ae8dfb761d3c3eb7bb7bd8623ff637ae723dac3b8e56870610 +SHA512 (bash-language-server-4.6.1-vendor.tar.xz) = 521dd2c863ba02f1a41f666e43dc0c4763bb4c12c61b9eeb6c8efee04ef2003c92f5137eba186545af60b8bbdc15b10b183464c55a5088e046da25a803c96e7b From b3820356f1b257c987292e10f6c594b0320c821d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Thu, 2 Feb 2023 19:20:48 +0100 Subject: [PATCH 4/5] Fix /usr/bin/bash-language-server Need to fix a broken link: $ ll /usr/bin/bash-language-server lrwxrwxrwx 1 root root 54 Jan 30 13:15 /usr/bin/bash-language-server -> /usr/lib/node_modules/bash-language-server/bin/main.js $ ll /usr/lib/node_modules/bash-language-server/bin/main.js ls: cannot access '/usr/lib/node_modules/bash-language-server/bin/main.js': No such file or directory --- nodejs-bash-language-server.spec | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/nodejs-bash-language-server.spec b/nodejs-bash-language-server.spec index 0a220ef..26e9f75 100644 --- a/nodejs-bash-language-server.spec +++ b/nodejs-bash-language-server.spec @@ -4,7 +4,7 @@ Name: nodejs-bash-language-server Version: 4.6.1 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A language server for Bash License: MIT Url: https://github.com/bash-lsp/bash-language-server @@ -61,7 +61,14 @@ for S in $(grep -l '#!.*node' \ done install -d -m 0755 %{buildroot}%{_bindir} -ln -s %{nodejs_sitelib}/%{pkg_name}/bin/main.js %{buildroot}%{_bindir}/%{pkg_name} + +cat << EOF > %{buildroot}%{_bindir}/%{pkg_name} +#!/bin/sh +export NODE_ENV=production + +exec /usr/bin/node %{nodejs_sitelib}/%{pkg_name}/out/cli.js "\$@" +EOF +chmod +x %{buildroot}%{_bindir}/%{pkg_name} install -d -m 0755 %{buildroot}%{nodejs_sitelib}/%{pkg_name}/ rsync -av server/ %{buildroot}%{nodejs_sitelib}/%{pkg_name}/ @@ -73,6 +80,7 @@ chmod 0644 %{buildroot}%{nodejs_sitelib}/%{pkg_name}/tree-sitter-bash.wasm \ find %{buildroot}%{nodejs_sitelib}/%{pkg_name} -name "*.bak" -delete find %{buildroot}%{nodejs_sitelib}/%{pkg_name} -type f -name "\.*" -delete + %fdupes %{buildroot}%{nodejs_sitelib}/%{pkg_name} %files @@ -83,6 +91,9 @@ find %{buildroot}%{nodejs_sitelib}/%{pkg_name} -type f -name "\.*" -delete %{nodejs_sitelib}/%{pkg_name}/ %changelog +* Thu Feb 02 2023 Pavel Filipenský - 4.6.1-2 +- Fix /usr/bin/bash-language-server + * Mon Jan 30 2023 Pavel Filipenský - 4.6.1-1 - Update to version 4.6.1 * https://github.com/bash-lsp/bash-language-server/blob/server-4.6.1/server/CHANGELOG.md From 6a2fd2bb89ec5ea36e815958f0d535810e98d1dd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 7 Mar 2023 15:25:44 +0100 Subject: [PATCH 5/5] Don't own /usr/lib/node_modules resolves: rhbz#2176048 As part of https://fedoraproject.org/wiki/Changes/NodejsRepackaging, the path `/usr/lib/node_modules` has been changed from a directory to a symlink. This causes a file conflict when trying to install this package in Fedora 38. Stop owning that path; it's already owned by Node.js. This is consistent with other packaged Node.js apps I've manually checked. --- nodejs-bash-language-server.spec | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/nodejs-bash-language-server.spec b/nodejs-bash-language-server.spec index 26e9f75..ed80a85 100644 --- a/nodejs-bash-language-server.spec +++ b/nodejs-bash-language-server.spec @@ -4,7 +4,7 @@ Name: nodejs-bash-language-server Version: 4.6.1 -Release: 2%{?dist} +Release: 3%{?dist} Summary: A language server for Bash License: MIT Url: https://github.com/bash-lsp/bash-language-server @@ -87,10 +87,12 @@ find %{buildroot}%{nodejs_sitelib}/%{pkg_name} -type f -name "\.*" -delete %license LICENSE %doc README.md %{_bindir}/%{pkg_name} -%dir %{nodejs_sitelib} %{nodejs_sitelib}/%{pkg_name}/ %changelog +* Tue Mar 07 2023 Pavel Filipenský - 4.6.1-3 +- resolves: rhbz#2176048 - Don't own /usr/lib/node_modules + * Thu Feb 02 2023 Pavel Filipenský - 4.6.1-2 - Fix /usr/bin/bash-language-server