diff --git a/.gitignore b/.gitignore index 97bb489..88d4009 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1 @@ xar-1.5.2.tar.gz -/xar-417.1.tar.gz diff --git a/sources b/sources index 712a6eb..dddc32a 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (xar-417.1.tar.gz) = 4c3c61f5289d0b2e380cbde772b383da369ca8ad046f5d779e02f59300288c90c5e31d105a2c01ac17dc719b8b46b55d8d36a8b3b20360f315766fce92dec762 +8eabb055d3387b8edc30ecfb08d2e80d xar-1.5.2.tar.gz diff --git a/xar-1.5-norpath.patch b/xar-1.5-norpath.patch new file mode 100644 index 0000000..855440d --- /dev/null +++ b/xar-1.5-norpath.patch @@ -0,0 +1,24 @@ +diff -Naupr xar-1.5.orig/configure xar-1.5/configure +--- xar-1.5.orig/configure 2007-05-13 18:09:50.000000000 +0200 ++++ xar-1.5/configure 2007-05-30 14:40:04.000000000 +0200 +@@ -2800,7 +2800,7 @@ case "${host}" in + CFLAGS="$CFLAGS" + abi="elf" + CPPFLAGS="$CPPFLAGS -D_GNU_SOURCE" +- RPATH="-Wl,-rpath," ++ RPATH="" + ;; + *-*-netbsd*) + echo "$as_me:$LINENO: checking ABI" >&5 +diff -Naupr xar-1.5.orig/configure.ac xar-1.5/configure.ac +--- xar-1.5.orig/configure.ac 2007-05-11 04:51:25.000000000 +0200 ++++ xar-1.5/configure.ac 2007-05-30 14:40:13.000000000 +0200 +@@ -109,7 +109,7 @@ case "${host}" in + abi="elf" + dnl Linux needs this for things like asprintf() and poll() flags. + CPPFLAGS="$CPPFLAGS -D_GNU_SOURCE" +- RPATH="-Wl,-rpath," ++ RPATH="" + ;; + *-*-netbsd*) + AC_MSG_CHECKING([ABI]) diff --git a/xar-1.5.2-CVE-2010-0055.patch b/xar-1.5.2-CVE-2010-0055.patch new file mode 100644 index 0000000..8be4389 --- /dev/null +++ b/xar-1.5.2-CVE-2010-0055.patch @@ -0,0 +1,49 @@ +Index: xar/lib/archive.c +=================================================================== +--- xar/lib/archive.c (revision 224) ++++ xar/lib/archive.c (revision 225) +@@ -330,6 +330,44 @@ + + EVP_DigestFinal(&XAR(ret)->toc_ctx, toccksum, &tlen); + ++ const char *value; ++ uint64_t offset = 0; ++ uint64_t length = tlen; ++ if( xar_prop_get( XAR_FILE(ret) , "checksum/offset", &value) == 0 ) { ++ errno = 0; ++ offset = strtoull( value, (char **)NULL, 10); ++ if( errno != 0 ) { ++ xar_close(ret); ++ return NULL; ++ } ++ } else if( xar_signature_first(ret) != NULL ) { ++ // All archives that have a signature also specify the location ++ // of the checksum. If the location isn't specified, error out. ++ xar_close(ret); ++ return NULL; ++ } ++ ++ XAR(ret)->heap_offset = xar_get_heap_offset(ret) + offset; ++ if( lseek(XAR(ret)->fd, XAR(ret)->heap_offset, SEEK_SET) == -1 ) { ++ xar_close(ret); ++ return NULL; ++ } ++ if( xar_prop_get( XAR_FILE(ret) , "checksum/size", &value) == 0 ) { ++ errno = 0; ++ length = strtoull( value, (char **)NULL, 10); ++ if( errno != 0 ) { ++ xar_close(ret); ++ return NULL; ++ } ++ } else if( xar_signature_first(ret) != NULL ) { ++ xar_close(ret); ++ return NULL; ++ } ++ if( length != tlen ) { ++ xar_close(ret); ++ return NULL; ++ } ++ + xar_read_fd(XAR(ret)->fd, cval, tlen); + XAR(ret)->heap_offset += tlen; + if( memcmp(cval, toccksum, tlen) != 0 ) { diff --git a/xar-1.6.1-ext2.patch b/xar-1.6.1-ext2.patch deleted file mode 100644 index da413b0..0000000 --- a/xar-1.6.1-ext2.patch +++ /dev/null @@ -1,24 +0,0 @@ ---- a/lib/ext2.c.orig -+++ b/lib/ext2.c -@@ -139,8 +139,10 @@ - if(! (flags & ~EXT2_NOCOMPR_FL) ) - x_addprop(f, "NoCompBlock"); - #endif -+#ifdef EXT2_ECOMPR_FL - if(! (flags & ~EXT2_ECOMPR_FL) ) - x_addprop(f, "CompError"); -+#endif - if(! (flags & ~EXT2_BTREE_FL) ) - x_addprop(f, "BTree"); - if(! (flags & ~EXT2_INDEX_FL) ) -@@ -225,8 +227,10 @@ - if( e2prop_get(f, "NoCompBlock", (char **)&tmp) == 0 ) - flags |= EXT2_NOCOMPR_FL ; - #endif -+#ifdef EXT2_ECOMPR_FL - if( e2prop_get(f, "CompError", (char **)&tmp) == 0 ) - flags |= EXT2_ECOMPR_FL ; -+#endif - if( e2prop_get(f, "BTree", (char **)&tmp) == 0 ) - flags |= EXT2_BTREE_FL ; - if( e2prop_get(f, "HashIndexed", (char **)&tmp) == 0 ) diff --git a/xar-1.8-Add-OpenSSL-To-Configuration.patch b/xar-1.8-Add-OpenSSL-To-Configuration.patch deleted file mode 100644 index 81cf068..0000000 --- a/xar-1.8-Add-OpenSSL-To-Configuration.patch +++ /dev/null @@ -1,20 +0,0 @@ -diff -rupN a/configure.ac b/configure.ac ---- a/configure.ac 2020-01-25 04:24:35.603846773 +0300 -+++ b/configure.ac 2020-01-25 04:41:05.743109638 +0300 -@@ -320,6 +320,16 @@ if test "x${have_libxml2}" = "x0" ; then - fi - - dnl -+dnl Configure libcrypto (part of OpenSSL). -+dnl -+have_libcrypto="1" -+AC_CHECK_HEADERS([openssl/evp.h], , [have_libcrypto="0"]) -+AC_CHECK_LIB([crypto], [OPENSSL_init_crypto], , [have_libcrypto="0"]) -+if test "x${have_libcrypto}" = "x0" ; then -+ AC_MSG_ERROR([Cannot build without libcrypto (OpenSSL)]) -+fi -+ -+dnl - dnl Configure libz. - dnl - have_libz="1" diff --git a/xar-1.8-arm-ppc.patch b/xar-1.8-arm-ppc.patch deleted file mode 100644 index b2eec5a..0000000 --- a/xar-1.8-arm-ppc.patch +++ /dev/null @@ -1,23 +0,0 @@ ---- a/lib/archive.c -+++ b/lib/archive.c -@@ -387,7 +387,8 @@ - return NULL; - } - -- XAR(ret)->heap_offset = xar_get_heap_offset(ret) + offset; -+ XAR(ret)->heap_offset = -+ XAR(ret)->toc_count + sizeof(xar_header_t) + offset; - if( lseek(XAR(ret)->fd, XAR(ret)->heap_offset, SEEK_SET) == -1 ) { - xar_close(ret); - return NULL; ---- a/src/xar.c -+++ a/src/xar.c -@@ -783,7 +783,7 @@ - int main(int argc, char *argv[]) { - int ret; - char *filename = NULL; -- char command = 0, c; -+ signed char command = 0, c; - char **args; - const char *tocfile = NULL; - int arglen, i, err; diff --git a/xar-1.8-openssl-1.1.patch b/xar-1.8-openssl-1.1.patch deleted file mode 100644 index f811d99..0000000 --- a/xar-1.8-openssl-1.1.patch +++ /dev/null @@ -1,45 +0,0 @@ -lib/hash.c: fix compilation with OpenSSL-1.1+ - -EVP_MD_CTX has become an anonymous struct now, so can't allocate size -for it anymore. - ---- a/lib/hash.c 2015-06-09 03:22:07.000000000 +0000 -+++ b/lib/hash.c 2019-01-01 14:37:01.487775958 +0000 -@@ -102,7 +102,7 @@ - #ifdef __APPLE__ - CCDigestRef digest; - #else -- EVP_MD_CTX digest; -+ EVP_MD_CTX *digest; - const EVP_MD *type; - #endif - unsigned int length; -@@ -123,7 +123,8 @@ - #else - OpenSSL_add_all_digests(); - HASH_CTX(hash)->type = EVP_get_digestbyname(digest_name); -- EVP_DigestInit(&HASH_CTX(hash)->digest, HASH_CTX(hash)->type); -+ HASH_CTX(hash)->digest = EVP_MD_CTX_create(); -+ EVP_DigestInit(HASH_CTX(hash)->digest, HASH_CTX(hash)->type); - #endif - - HASH_CTX(hash)->digest_name = strdup(digest_name); -@@ -143,7 +143,7 @@ - #ifdef __APPLE__ - CCDigestUpdate(HASH_CTX(hash)->digest, buffer, nbyte); - #else -- EVP_DigestUpdate(&HASH_CTX(hash)->digest, buffer, nbyte); -+ EVP_DigestUpdate(HASH_CTX(hash)->digest, buffer, nbyte); - #endif - } - -@@ -160,7 +160,8 @@ - CCDigestFinal(HASH_CTX(hash)->digest, buffer); - CCDigestDestroy(HASH_CTX(hash)->digest); - #else -- EVP_DigestFinal(&HASH_CTX(hash)->digest, buffer, &HASH_CTX(hash)->length); -+ EVP_DigestFinal(HASH_CTX(hash)->digest, buffer, &HASH_CTX(hash)->length); -+ EVP_MD_CTX_destroy(HASH_CTX(hash)->digest); - #endif - - *nbyte = HASH_CTX(hash)->length; diff --git a/xar-1.8-safe_dirname.patch b/xar-1.8-safe_dirname.patch deleted file mode 100644 index eb2f5f0..0000000 --- a/xar-1.8-safe_dirname.patch +++ /dev/null @@ -1,16 +0,0 @@ -linuxattr: fix missing symbol safe_dirname - -This one was probably missed when they did a global rename to xar_ -prefixed variants. - ---- a/lib/linuxattr.c -+++ b/lib/linuxattr.c -@@ -223,7 +223,7 @@ - if( statfs(file, &sfs) != 0 ) { - char *tmp, *bname; - tmp = strdup(file); -- bname = safe_dirname(tmp); -+ bname = xar_safe_dirname(tmp); - statfs(bname, &sfs); - free(tmp); - free(bname); diff --git a/xar.spec b/xar.spec index d206546..b90c884 100644 --- a/xar.spec +++ b/xar.spec @@ -1,32 +1,19 @@ -%global subversion 417.1 - -Name: xar -Version: 1.8.0.%{subversion} -Release: 20%{?dist} -Summary: The eXtensible ARchiver -# Automatically converted from old format: BSD - review is highly recommended. -License: LicenseRef-Callaway-BSD -URL: https://opensource.apple.com/source/xar -Source: https://opensource.apple.com/tarballs/xar/xar-%{subversion}.tar.gz -BuildRequires: make -BuildRequires: gcc -BuildRequires: libxml2-devel -BuildRequires: openssl-devel -BuildRequires: zlib-devel -BuildRequires: bzip2-devel -BuildRequires: gawk -BuildRequires: autoconf - - -#First 4 patches taken from Gentoo Xar package. To make Xar more suitable for Linux systems -#Copyright Gentoo authors 2019 GPLv2 -Patch0: xar-1.6.1-ext2.patch -Patch1: xar-1.8-safe_dirname.patch -Patch2: xar-1.8-arm-ppc.patch -Patch3: xar-1.8-openssl-1.1.patch - -Patch4: xar-1.8-Add-OpenSSL-To-Configuration.patch - +Summary: The eXtensible ARchiver +Name: xar +Version: 1.5.2 +Release: 7%{?dist} +License: BSD +Group: Applications/Archiving +URL: http://code.google.com/p/xar/ +Source: http://xar.googlecode.com/files/xar-%{version}.tar.gz +Patch0: xar-1.5-norpath.patch +Patch1: xar-1.5.2-CVE-2010-0055.patch +BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root +BuildRequires: libxml2-devel +BuildRequires: openssl-devel +BuildRequires: zlib-devel +BuildRequires: bzip2-devel +BuildRequires: /usr/bin/awk %description The XAR project aims to provide an easily extensible archive format. Important @@ -41,6 +28,7 @@ table of content's rich meta-data. %package devel Summary: Development files for the eXtensible ARchiver +Group: Development/Libraries Requires: %{name} = %{version}-%{release} %description devel @@ -48,168 +36,45 @@ Development files for the eXtensible ARchiver. %prep -%setup -n xar-%{subversion} -pushd xar -%patch -P0 -p1 -%patch -P1 -p1 -%patch -P2 -p1 -%patch -P3 -p1 -%patch -P4 -p1 -sed 's:-Wl,-rpath,::g' -i configure.ac #No rpath -sed 's:filetree.h:../lib/filetree.h:g' -i src/xar.c #Fix path -sed 's:util.h:../lib/util.h:g' -i src/xar.c #Fix path -popd +%setup -q +%patch0 -p1 -b .norpath +%patch1 -p1 -b .CVE-2010-0055 + %build -pushd xar -cp /usr/lib/rpm/redhat/config.{guess,sub} . -env NOCONFIGURE=1 ./autogen.sh %configure --disable-static -make %{?_smp_mflags} -popd +%{__make} %{?_smp_mflags} %install -pushd xar -make install DESTDIR=%{buildroot} -rm -f %{buildroot}%{_libdir}/libxar.la #Not needed -popd +%{__rm} -rf %{buildroot} +%{__make} install DESTDIR=%{buildroot} +%{__rm} -f %{buildroot}%{_libdir}/libxar.la -%ldconfig_scriptlets + +%clean +%{__rm} -rf %{buildroot} + + +%post -p /sbin/ldconfig + +%postun -p /sbin/ldconfig %files -%doc README xar/ChangeLog xar/TODO -%license xar/LICENSE +%defattr(-,root,root,-) +%doc LICENSE TODO %{_bindir}/xar %{_libdir}/libxar.so.* %{_mandir}/man1/xar.1* %files devel +%defattr(-,root,root,-) %{_includedir}/xar/ %{_libdir}/libxar.so %changelog -* Fri Jul 17 2026 Fedora Release Engineering - 1.8.0.417.1-20 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild - -* Sat Jun 13 2026 Yaakov Selkowitz - 1.8.0.417.1-19 -- Rebuilt for openssl 4.0 - -* Wed Feb 04 2026 Marcin Juszkiewicz - 1.8.0.417.1-18 -- update gnu-config files to make it build on riscv64 - -* Sat Jan 17 2026 Fedora Release Engineering - 1.8.0.417.1-17 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - -* Fri Jul 25 2025 Fedora Release Engineering - 1.8.0.417.1-16 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild - -* Sun Jan 19 2025 Fedora Release Engineering - 1.8.0.417.1-15 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild - -* Wed Sep 04 2024 Miroslav Suchý - 1.8.0.417.1-14 -- convert license to SPDX - -* Sat Jul 20 2024 Fedora Release Engineering - 1.8.0.417.1-13 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - -* Sat Jan 27 2024 Fedora Release Engineering - 1.8.0.417.1-12 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Sat Jul 22 2023 Fedora Release Engineering - 1.8.0.417.1-11 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - -* Sat Jan 21 2023 Fedora Release Engineering - 1.8.0.417.1-10 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - -* Mon Jan 16 2023 Yaakov Selkowitz - 1.8.0.417.1-9 -- Enable build on aarch64, ppc64le - -* Sat Jul 23 2022 Fedora Release Engineering - 1.8.0.417.1-8 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - -* Sat Jan 22 2022 Fedora Release Engineering - 1.8.0.417.1-7 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - -* Tue Sep 14 2021 Sahana Prasad - 1.8.0.417.1-6 -- Rebuilt with OpenSSL 3.0.0 - -* Fri Jul 23 2021 Fedora Release Engineering - 1.8.0.417.1-5 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - -* Wed Jan 27 2021 Fedora Release Engineering - 1.8.0.417.1-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - -* Wed Jul 29 2020 Fedora Release Engineering - 1.8.0.417.1-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - -* Fri Jan 31 2020 Fedora Release Engineering - 1.8.0.417.1-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - -* Sat Jan 25 2020 Mosaab Alzoubi - 1.8.0.417.1-1 -- Use Apple upstream instead of non-fresh Github one -- New upstream in 1.8 dev branch with 417.1 subversion -- Close CVE-2018-17093 -- Close CVE-2018-17094 -- Close CVE-2017-11124 -- Close CVE-2017-11125 -- Close CVE-2010-3798 -- Use license macro -- Add OpenSSL To Configuration - -* Wed Jan 1 2020 Mosaab Alzoubi - 1.6.1-1 -- Update to 1.6.1 -- Change upstream -- Exclude CVE-2010-0055 patch, includes in upstream -- Exclude norpath patch, using sed -- Pass FTBFS state #1676224 -- General clean of the spec -- Use Fedora guide lines in Source URL - -* Sun Feb 03 2019 Fedora Release Engineering - 1.5.2-21 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild - -* Sat Jul 14 2018 Fedora Release Engineering - 1.5.2-20 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild - -* Fri Feb 09 2018 Fedora Release Engineering - 1.5.2-19 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild - -* Thu Aug 03 2017 Fedora Release Engineering - 1.5.2-18 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild - -* Thu Jul 27 2017 Fedora Release Engineering - 1.5.2-17 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild - -* Sat Feb 11 2017 Fedora Release Engineering - 1.5.2-16 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild - -* Fri Feb 05 2016 Fedora Release Engineering - 1.5.2-15 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild - -* Fri Jun 19 2015 Fedora Release Engineering - 1.5.2-14 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild - -* Mon Aug 18 2014 Fedora Release Engineering - 1.5.2-13 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild - -* Sun Jun 08 2014 Fedora Release Engineering - 1.5.2-12 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild - -* Sun Aug 04 2013 Fedora Release Engineering - 1.5.2-11 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild - -* Fri Feb 15 2013 Fedora Release Engineering - 1.5.2-10 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild - -* Sun Jul 22 2012 Fedora Release Engineering - 1.5.2-9 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild - -* Sat Jan 14 2012 Fedora Release Engineering - 1.5.2-8 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild - * Mon Feb 07 2011 Fedora Release Engineering - 1.5.2-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild @@ -256,3 +121,4 @@ popd * Sun Feb 25 2007 Matthias Saou 1.4-1 - Initial RPM release. +