diff --git a/.cvsignore b/.cvsignore deleted file mode 100644 index e69de29..0000000 diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..88d4009 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +xar-1.5.2.tar.gz diff --git a/Makefile b/Makefile deleted file mode 100644 index 795b5c9..0000000 --- a/Makefile +++ /dev/null @@ -1,21 +0,0 @@ -# Makefile for source rpm: xar -# $Id$ -NAME := xar -SPECFILE = $(firstword $(wildcard *.spec)) - -define find-makefile-common -for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done -endef - -MAKEFILE_COMMON := $(shell $(find-makefile-common)) - -ifeq ($(MAKEFILE_COMMON),) -# attept a checkout -define checkout-makefile-common -test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2 -endef - -MAKEFILE_COMMON := $(shell $(checkout-makefile-common)) -endif - -include $(MAKEFILE_COMMON) diff --git a/sources b/sources index e69de29..dddc32a 100644 --- a/sources +++ b/sources @@ -0,0 +1 @@ +8eabb055d3387b8edc30ecfb08d2e80d xar-1.5.2.tar.gz diff --git a/xar-1.5-install.patch b/xar-1.5-install.patch new file mode 100644 index 0000000..6fbc1ce --- /dev/null +++ b/xar-1.5-install.patch @@ -0,0 +1,24 @@ +diff -Naupr xar-1.5.orig/lib/Makefile.inc.in xar-1.5/lib/Makefile.inc.in +--- xar-1.5.orig/lib/Makefile.inc.in 2007-05-11 04:51:24.000000000 +0200 ++++ xar-1.5/lib/Makefile.inc.in 2007-05-30 14:35:42.000000000 +0200 +@@ -68,7 +68,7 @@ lib_install : $(LIBXAR_S) + @INSTALL@ -d $(DESTDIR)$(INCLUDEDIR)/xar + @INSTALL@ -m 0644 $(LIBXAR_INCS) $(DESTDIR)$(INCLUDEDIR)/xar + @INSTALL@ -d $(DESTDIR)$(LIBDIR) +- @INSTALL@ -m 0444 $(LIBXAR_S) $(DESTDIR)$(LIBDIR) ++ @INSTALL@ -m 0755 $(LIBXAR_S) $(DESTDIR)$(LIBDIR) + ifneq ($(words "" $(LIBXAR_LNAME)), 1) + rm -f $(DESTDIR)$(LIBDIR)/$(LIBXAR_LNAME) + ln -s $(LIBXAR_SNAME) $(DESTDIR)$(LIBDIR)/$(LIBXAR_LNAME) +diff -Naupr xar-1.5.orig/src/Makefile.inc.in xar-1.5/src/Makefile.inc.in +--- xar-1.5.orig/src/Makefile.inc.in 2007-05-11 04:50:41.000000000 +0200 ++++ xar-1.5/src/Makefile.inc.in 2007-05-30 14:35:57.000000000 +0200 +@@ -11,7 +11,7 @@ src_install : @objroot@src/ixar + @INSTALL@ -d $(DESTDIR)$(BINDIR) + @INSTALL@ -m 0755 $< $(DESTDIR)$(BINDIR)/xar + @INSTALL@ -d $(DESTDIR)$(MANDIR)/man1 +- @INSTALL@ -m 0444 @srcroot@src/xar.1 $(DESTDIR)$(MANDIR)/man1 ++ @INSTALL@ -m 0644 @srcroot@src/xar.1 $(DESTDIR)$(MANDIR)/man1 + + src_uninstall : + rm -f $(DESTDIR)/$(BINDIR)/xar diff --git a/xar-1.5-norpath.patch b/xar-1.5-norpath.patch new file mode 100644 index 0000000..855440d --- /dev/null +++ b/xar-1.5-norpath.patch @@ -0,0 +1,24 @@ +diff -Naupr xar-1.5.orig/configure xar-1.5/configure +--- xar-1.5.orig/configure 2007-05-13 18:09:50.000000000 +0200 ++++ xar-1.5/configure 2007-05-30 14:40:04.000000000 +0200 +@@ -2800,7 +2800,7 @@ case "${host}" in + CFLAGS="$CFLAGS" + abi="elf" + CPPFLAGS="$CPPFLAGS -D_GNU_SOURCE" +- RPATH="-Wl,-rpath," ++ RPATH="" + ;; + *-*-netbsd*) + echo "$as_me:$LINENO: checking ABI" >&5 +diff -Naupr xar-1.5.orig/configure.ac xar-1.5/configure.ac +--- xar-1.5.orig/configure.ac 2007-05-11 04:51:25.000000000 +0200 ++++ xar-1.5/configure.ac 2007-05-30 14:40:13.000000000 +0200 +@@ -109,7 +109,7 @@ case "${host}" in + abi="elf" + dnl Linux needs this for things like asprintf() and poll() flags. + CPPFLAGS="$CPPFLAGS -D_GNU_SOURCE" +- RPATH="-Wl,-rpath," ++ RPATH="" + ;; + *-*-netbsd*) + AC_MSG_CHECKING([ABI]) diff --git a/xar-1.5.2-CVE-2010-0055.patch b/xar-1.5.2-CVE-2010-0055.patch new file mode 100644 index 0000000..8be4389 --- /dev/null +++ b/xar-1.5.2-CVE-2010-0055.patch @@ -0,0 +1,49 @@ +Index: xar/lib/archive.c +=================================================================== +--- xar/lib/archive.c (revision 224) ++++ xar/lib/archive.c (revision 225) +@@ -330,6 +330,44 @@ + + EVP_DigestFinal(&XAR(ret)->toc_ctx, toccksum, &tlen); + ++ const char *value; ++ uint64_t offset = 0; ++ uint64_t length = tlen; ++ if( xar_prop_get( XAR_FILE(ret) , "checksum/offset", &value) == 0 ) { ++ errno = 0; ++ offset = strtoull( value, (char **)NULL, 10); ++ if( errno != 0 ) { ++ xar_close(ret); ++ return NULL; ++ } ++ } else if( xar_signature_first(ret) != NULL ) { ++ // All archives that have a signature also specify the location ++ // of the checksum. If the location isn't specified, error out. ++ xar_close(ret); ++ return NULL; ++ } ++ ++ XAR(ret)->heap_offset = xar_get_heap_offset(ret) + offset; ++ if( lseek(XAR(ret)->fd, XAR(ret)->heap_offset, SEEK_SET) == -1 ) { ++ xar_close(ret); ++ return NULL; ++ } ++ if( xar_prop_get( XAR_FILE(ret) , "checksum/size", &value) == 0 ) { ++ errno = 0; ++ length = strtoull( value, (char **)NULL, 10); ++ if( errno != 0 ) { ++ xar_close(ret); ++ return NULL; ++ } ++ } else if( xar_signature_first(ret) != NULL ) { ++ xar_close(ret); ++ return NULL; ++ } ++ if( length != tlen ) { ++ xar_close(ret); ++ return NULL; ++ } ++ + xar_read_fd(XAR(ret)->fd, cval, tlen); + XAR(ret)->heap_offset += tlen; + if( memcmp(cval, toccksum, tlen) != 0 ) { diff --git a/xar.spec b/xar.spec new file mode 100644 index 0000000..b732621 --- /dev/null +++ b/xar.spec @@ -0,0 +1,121 @@ +Summary: The eXtensible ARchiver +Name: xar +Version: 1.5.2 +Release: 6%{?dist} +License: BSD +Group: Applications/Archiving +URL: http://code.google.com/p/xar/ +Source: http://xar.googlecode.com/files/xar-%{version}.tar.gz +Patch0: xar-1.5-norpath.patch +Patch1: xar-1.5.2-CVE-2010-0055.patch +BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root +BuildRequires: libxml2-devel +BuildRequires: openssl-devel +BuildRequires: zlib-devel +BuildRequires: bzip2-devel +BuildRequires: /usr/bin/awk + +%description +The XAR project aims to provide an easily extensible archive format. Important +design decisions include an easily extensible XML table of contents for random +access to archived files, storing the toc at the beginning of the archive to +allow for efficient handling of streamed archives, the ability to handle files +of arbitrarily large sizes, the ability to choose independent encodings for +individual files in the archive, the ability to store checksums for individual +files in both compressed and uncompressed form, and the ability to query the +table of content's rich meta-data. + + +%package devel +Summary: Development files for the eXtensible ARchiver +Group: Development/Libraries +Requires: %{name} = %{version}-%{release} + +%description devel +Development files for the eXtensible ARchiver. + + +%prep +%setup -q +%patch0 -p1 -b .norpath +%patch1 -p1 -b .CVE-2010-0055 + + +%build +%configure --disable-static +%{__make} %{?_smp_mflags} + + +%install +%{__rm} -rf %{buildroot} +%{__make} install DESTDIR=%{buildroot} +%{__rm} -f %{buildroot}%{_libdir}/libxar.la + + +%clean +%{__rm} -rf %{buildroot} + + +%post -p /sbin/ldconfig + +%postun -p /sbin/ldconfig + + +%files +%defattr(-,root,root,-) +%doc LICENSE TODO +%{_bindir}/xar +%{_libdir}/libxar.so.* +%{_mandir}/man1/xar.1* + +%files devel +%defattr(-,root,root,-) +%{_includedir}/xar/ +%{_libdir}/libxar.so + + +%changelog +* Wed Apr 28 2010 Matthias Saou 1.5.2-6 +- Include patch to fix CVE-2010-0055 (#570678). + +* Fri Aug 21 2009 Tomas Mraz - 1.5.2-5 +- rebuilt with new openssl + +* Mon Jul 27 2009 Fedora Release Engineering - 1.5.2-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild + +* Wed Feb 25 2009 Fedora Release Engineering - 1.5.2-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild + +* Sun Jan 18 2009 Tomas Mraz 1.5.2-2 +- rebuild with new openssl + +* Tue Dec 23 2008 Matthias Saou 1.5.2-1 +- Update to 1.5.2. +- Remove no longer needed install and memset patches. +- Disable newly built-by-default static lib and remove useless .la file. + +* Tue Feb 19 2008 Fedora Release Engineering +- Autorebuild for GCC 4.3 + +* Fri Dec 07 2007 Release Engineering +- Rebuild for deps + +* Thu Aug 23 2007 Matthias Saou 1.5.1-4 +- Rebuild for new BuildID feature. +- Add /usr/bin/awk build requirement, needed for the libxml configure check. + +* Wed Aug 8 2007 Matthias Saou 1.5.1-2 +- Patch memset call with swapped arguments (Dave Jones). + +* Wed Jul 11 2007 Matthias Saou 1.5.1-1 +- Update to 1.5.1. + +* Wed May 30 2007 Matthias Saou 1.5-1 +- Update to 1.5. +- Include patch to remove rpath. +- Include patch to fix file modes, and get the lib properly stripped. + +* Sun Feb 25 2007 Matthias Saou 1.4-1 +- Initial RPM release. +