apply upstream fix for CVE-2023-32700, patch texmfcnf.lua, fix mptopdf.pl and thumbpdf.pl to have proper interpreter lines

texlive-2022-fedora-texmfcnf.lua.patch

@@ -0,0 +1,51 @@
+diff -up ./web2c/texmfcnf.lua.fedora ./web2c/texmfcnf.lua
+--- ./web2c/texmfcnf.lua.fedora	2023-05-25 12:49:38.564646026 -0400
++++ ./web2c/texmfcnf.lua	2023-05-25 12:52:19.524748814 -0400
+@@ -14,6 +14,7 @@ return {
+     time    = "12:12:12",
+     comment = "ConTeXt MkIV configuration file",
+     author  = "Hans Hagen, PRAGMA-ADE, Hasselt NL",
++    -- modified for Fedora, based on Preining Norbert's work in Debian
+ 
+     content = {
+ 
+@@ -44,7 +45,7 @@ return {
+ 
+             -- only used for FONTCONFIG_PATH & TEXMFCACHE in TeX Live
+ 
+-            TEXMFSYSVAR     = "selfautoparent:texmf-var",
++            TEXMFSYSVAR     = "/var/lib/texmf",
+             TEXMFVAR        = "home:.texlive2022/texmf-var",
+ 
+             -- We have only one cache path but there can be more. The first writable one
+@@ -61,13 +62,14 @@ return {
+             -- By using prefixes we don't get expanded paths in the cache __path__
+             -- entry. This makes the tex root relocatable.
+ 
+-            TEXMFOS         = "selfautodir:",
+-            TEXMFDIST       = "selfautoparent:texmf-dist",
+-
+-            TEXMFLOCAL      = texmflocal,
+-            TEXMFSYSCONFIG  = "selfautoparent:texmf-config",
+-            TEXMFFONTS      = "selfautoparent:texmf-fonts",
+-            TEXMFPROJECT    = "selfautoparent:texmf-project",
++            -- TEXMFOS         = "selfautodir:",
++            TEXMFDIST       = "/usr/share/texlive/texmf-dist",
++            TEXMFFEDORA     = "/usr/share/texmf",
++
++            TEXMFLOCAL      = "/usr/share/texlive/texmf-local",
++            TEXMFSYSCONFIG  = "/usr/share/texlive/texmf-config",
++         -- TEXMFFONTS      = "selfautoparent:texmf-fonts",
++         -- TEXMFPROJECT    = "selfautoparent:texmf-project",
+ 
+             TEXMFHOME       = "home:texmf",
+          -- TEXMFHOME       = os.name == "macosx" and "home:Library/texmf" or "home:texmf",
+@@ -75,7 +77,7 @@ return {
+             -- We need texmfos for a few rare files but as I have a few more bin trees
+             -- a hack is needed. Maybe other users also have texmf-platform-new trees.
+ 
+-            TEXMF           = "{$TEXMFCONFIG,$TEXMFHOME,!!$TEXMFSYSCONFIG,!!$TEXMFSYSVAR,!!$TEXMFPROJECT,!!$TEXMFFONTS,!!$TEXMFLOCAL,!!$TEXMFDIST}",
++            TEXMF           = "{$TEXMFCONFIG,$TEXMFHOME,!!$TEXMFSYSCONFIG,!!$TEXMFSYSVAR,!!$TEXMFLOCAL,!!$TEXMFFEDORA,!!$TEXMFDIST}",
+ 
+             TEXFONTMAPS     = ".;$TEXMF/fonts/data//;$TEXMF/fonts/map/{pdftex,dvips}//",
+             ENCFONTS        = ".;$TEXMF/fonts/data//;$TEXMF/fonts/enc/{dvips,pdftex}//",

texlive-2022-fix-latex-ltx.patch

@@ -0,0 +1,12 @@
+diff -up ./tex/latex/base/latex.ltx.fix ./tex/latex/base/latex.ltx
+--- ./tex/latex/base/latex.ltx.fix	2023-04-14 09:48:57.815126401 -0400
++++ ./tex/latex/base/latex.ltx	2023-04-14 09:49:56.376902836 -0400
+@@ -15798,6 +15798,8 @@ Type  H <return>  for immediate help.}%
+ \@maxdepth = \maxdepth
+ \newdimen\paperheight
+ \newdimen\paperwidth
++\newdimen\stockheight
++\newdimen\stockwidth
+ \newif \if@insert
+ \newif \if@fcolmade
+ \newif \if@specialpage \@specialpagefalse

texlive-20220321-texinfo-path-fix.patch

@@ -1,12 +1,34 @@
 diff -up texlive-base-20220321/source/texk/kpathsea/texmf.cnf.texinfo-fix texlive-base-20220321/source/texk/kpathsea/texmf.cnf
---- texlive-base-20220321/source/texk/kpathsea/texmf.cnf.texinfo-fix	2022-04-24 14:56:58.552736645 -0400
-+++ texlive-base-20220321/source/texk/kpathsea/texmf.cnf	2022-04-24 14:59:20.022477425 -0400
+--- texlive-base-20220321/source/texk/kpathsea/texmf.cnf.texinfo-fix	2023-05-25 10:49:55.510891474 -0400
++++ texlive-base-20220321/source/texk/kpathsea/texmf.cnf	2023-05-25 11:44:59.261966579 -0400
+@@ -59,7 +59,7 @@
+ % SELFAUTOPARENT (its grandparent = /usr/local/texlive/YYYY), and
+ % SELFAUTOGRANDPARENT (its great-grandparent = /usr/local/texlive).
+ % Sorry for the off-by-one-generation names.
+-TEXMFROOT = $SELFAUTOPARENT
++TEXMFROOT = /usr/share/texlive
+ 
+ % The main tree of distributed packages and programs:
+ TEXMFDIST = $TEXMFROOT/texmf-dist
+@@ -69,10 +69,10 @@ TEXMFDIST = $TEXMFROOT/texmf-dist
+ TEXMFMAIN = $TEXMFDIST
+ 
+ % Local additions to the distribution trees.
+-TEXMFLOCAL = $SELFAUTOGRANDPARENT/texmf-local
++TEXMFLOCAL = /usr/share/texlive/texmf-local
+ 
+ % TEXMFSYSVAR, where *-sys store cached runtime data.
+-TEXMFSYSVAR = $TEXMFROOT/texmf-var
++TEXMFSYSVAR = /var/lib/texmf
+ 
+ % TEXMFSYSCONFIG, where *-sys store configuration data.
+ TEXMFSYSCONFIG = $TEXMFROOT/texmf-config
 @@ -83,6 +83,9 @@ TEXMFSYSCONFIG = $TEXMFROOT/texmf-config
  % to %USERPROFILE% on Windows, $HOME otherwise.
  TEXMFHOME = ~/texmf
  
 +% Texinfo on Fedora lives out of $TEXMFROOT
-+TEXINFOHOME = $SELFAUTODIR/share/texmf
++TEXINFOHOME = /usr/share/texmf
 +
  % TEXMFVAR, where texconfig/updmap/fmtutil store cached runtime data.
  TEXMFVAR = ~/.texlive2022/texmf-var
@@ -16,7 +38,7 @@ diff -up texlive-base-20220321/source/texk/kpathsea/texmf.cnf.texinfo-fix texliv
  % ever defined (the 99% common case), no extra elements will be added to
  % the search paths. tlmgr takes care to end any value with a trailing comma.
 -TEXMF = {$TEXMFAUXTREES$TEXMFCONFIG,$TEXMFVAR,$TEXMFHOME,!!$TEXMFLOCAL,!!$TEXMFSYSCONFIG,!!$TEXMFSYSVAR,!!$TEXMFDIST}
-+TEXMF = {$TEXMFAUXTREES$TEXMFCONFIG,$TEXMFVAR,$TEXMFHOME,$TEXINFOHOME,!!$TEXMFLOCAL,!!$TEXMFSYSCONFIG,!!$TEXMFSYSVAR,!!$TEXMFDIST}
++TEXMF = {$TEXMFAUXTREES$TEXMFCONFIG,$TEXMFVAR,$TEXMFHOME,!!$TEXINFOHOME,!!$TEXMFLOCAL,!!$TEXMFSYSCONFIG,!!$TEXMFSYSVAR,!!$TEXMFDIST}
  
  % Where to look for, and where mktexlsr creates, ls-R files. By default,
  % this is all and only the !! elements of TEXMF, so that mktexlsr does not

texlive-base-20220321-fix-scripts.patch

@@ -0,0 +1,20 @@
+diff -up ./scripts/context/perl/mptopdf.pl.fix-scripts ./scripts/context/perl/mptopdf.pl
+--- ./scripts/context/perl/mptopdf.pl.fix-scripts	2023-05-25 11:52:19.149713294 -0400
++++ ./scripts/context/perl/mptopdf.pl	2023-05-25 11:53:05.379317240 -0400
+@@ -1,5 +1,4 @@
+-eval '(exit $?0)' && eval 'exec perl -S $0 ${1+"$@"}' && eval 'exec perl -S $0 $argv:q'
+-        if 0;
++#! /usr/bin/perl -w
+ 
+ # MikTeX users can set environment variable TEXSYSTEM to "miktex".
+ 
+diff -up ./scripts/thumbpdf/thumbpdf.pl.fix-scripts ./scripts/thumbpdf/thumbpdf.pl
+--- ./scripts/thumbpdf/thumbpdf.pl.fix-scripts	2023-05-25 11:53:23.018547680 -0400
++++ ./scripts/thumbpdf/thumbpdf.pl	2023-05-25 11:53:44.086822918 -0400
+@@ -1,5 +1,4 @@
+-eval '(exit $?0)' && eval 'exec perl -S $0 ${1+"$@"}' && eval 'exec perl -S $0 $argv:q'
+-  if 0;
++#! /usr/bin/perl -w
+ use strict;
+ $^W=1; # turn warning on
+ #

texlive-base.spec

@@ -23,7 +23,7 @@
 
 Name: %{shortname}-base
 Version: %{source_date}
-Release: 69%{?dist}
+Release: 72%{?dist}
 Epoch: 10
 Summary: TeX formatting system
 # The only files in the base package are directories, cache, and license texts
@@ -514,6 +514,18 @@ Patch43: texlive-base-c99-4.patch
 # Fix issue where off_t could be set incorrectly on i686 due to order of header load
 Patch44: texlive-base-20220321-pdf-header-order-fix.patch
 
+# Fix issue with latex.ltx (fixed in 2023)
+Patch45: texlive-2022-fix-latex-ltx.patch
+
+# Fix interpreters in some perl scripts (thanks Debian)
+Patch46: texlive-base-20220321-fix-scripts.patch
+
+# Fix texmfcnf.lua
+Patch47: texlive-2022-fedora-texmfcnf.lua.patch
+
+# Apply upstream fix for CVE-2023-32700
+Patch48: texlive-2022-CVE-2023-32700.patch
+
 # Can't do this because it causes everything else to be noarch
 # BuildArch: noarch
 BuildRequires: make
@@ -2763,6 +2775,10 @@ License: GPL-2.0-or-later
 Summary: Tools to simplify using fonts (especially TT/OTF ones)
 Requires: texlive-base
 Requires: texlive-kpathsea
+# for otfinfo
+Requires: texlive-lcdftypetools
+# For vptovf
+Requires: texlive-fontware
 Provides: tex(fontools_ly1.enc) = %{epoch}:%{source_date}-%{release}
 Provides: tex(fontools_ot1.enc) = %{epoch}:%{source_date}-%{release}
 Provides: tex(fontools_t1.enc) = %{epoch}:%{source_date}-%{release}
@@ -7446,6 +7462,8 @@ xz -dc %{SOURCE0} | tar x
 %patch37 -p1 -b .libpaper2
 %endif
 
+%patch48 -p1 -b .CVE-2023-32700
+
 # Setup copies of the licenses
 for l in `unxz -c %{SOURCE3} | tar t`; do
 ln -s %{_texdir}/licenses/$l $l
@@ -7540,6 +7558,7 @@ export XPDF_LIBS="-lxpdfcore -lfofi -lgoo -lsplash $GLIB_LIBS $PAPER_LIBS $FONTC
 --with-system-libpaper --with-system-potrace --with-pic --with-xdvi-x-toolkit=xaw --with-system-mpfr --with-system-gmp \
 --enable-shared --enable-compiler-warnings=max --without-cxx-runtime-hack \
 --disable-native-texlive-build --disable-t1utils --enable-psutils --disable-biber --disable-ptexenc --disable-largefile \
+--with-banner-add='/CVE-2023-32700 patched' \
 %if %{with poppler}
 --with-system-poppler --with-system-xpdf \
 %else
@@ -7667,6 +7686,16 @@ pushd %{buildroot}%{_texdir}/texmf-dist
 
 # neuter tlmgr a bit
 patch -p1 < %{_sourcedir}/texlive-20190410-tlmgr-ignore-warning.patch
+
+# fix an issue in latex.ltx
+patch -p1 < %{_sourcedir}/texlive-2022-fix-latex-ltx.patch
+
+# fix interpreters in some perl scripts
+patch -p1 < %{_sourcedir}/texlive-base-20220321-fix-scripts.patch
+
+# fix texmfnf.lua
+patch -p1 < %{_sourcedir}/texlive-2022-fedora-texmfcnf.lua.patch
+
 popd
 
 # config files in /etc symlinked
@@ -10195,6 +10224,17 @@ yes | %{_bindir}/updmap-sys --quiet --syncwithtrees >/dev/null 2>&1 || :
 %doc %{_texdir}/texmf-dist/doc/latex/yplan/
 
 %changelog
+* Thu May 25 2023 Tom Callaway <spot@fedoraproject.org> - 10:20220321-72
+- apply upstream fix for CVE-2023-32700
+- patch texmfcnf.lua
+- fix mptopdf.pl and thumbpdf.pl to have proper interpreter lines
+
+* Fri Apr 14 2023 Tom Callaway <spot@fedoraproject.org> - 10:20220321-71
+- fix Requires for texlive-fontools (bz 2185284)
+
+* Fri Apr 14 2023 Tom Callaway <spot@fedoraproject.org> - 10:20220321-70
+- fix issue with latex.ltx (bz2178523)
+
 * Mon Mar  6 2023 Tom Callaway <spot@fedoraproject.org> - 10:20220321-69
 - fix texlive-pdfcrop to have an explicit Requires: texlive-pdftex (bz2175666)