Merge branch 'el5' into el4

branches.

.gitignore

@@ -0,0 +1 @@
+xar-1.5.2.tar.gz

Makefile

@@ -1,21 +0,0 @@
-# Makefile for source rpm: xar
-# $Id$
-NAME := xar
-SPECFILE = $(firstword $(wildcard *.spec))
-
-define find-makefile-common
-for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done
-endef
-
-MAKEFILE_COMMON := $(shell $(find-makefile-common))
-
-ifeq ($(MAKEFILE_COMMON),)
-# attept a checkout
-define checkout-makefile-common
-test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2
-endef
-
-MAKEFILE_COMMON := $(shell $(checkout-makefile-common))
-endif
-
-include $(MAKEFILE_COMMON)

sources

@@ -0,0 +1 @@
+8eabb055d3387b8edc30ecfb08d2e80d  xar-1.5.2.tar.gz

xar-1.5-install.patch

@@ -0,0 +1,24 @@
+diff -Naupr xar-1.5.orig/lib/Makefile.inc.in xar-1.5/lib/Makefile.inc.in
+--- xar-1.5.orig/lib/Makefile.inc.in	2007-05-11 04:51:24.000000000 +0200
++++ xar-1.5/lib/Makefile.inc.in	2007-05-30 14:35:42.000000000 +0200
+@@ -68,7 +68,7 @@ lib_install : $(LIBXAR_S)
+ 	@INSTALL@ -d $(DESTDIR)$(INCLUDEDIR)/xar
+ 	@INSTALL@ -m 0644 $(LIBXAR_INCS) $(DESTDIR)$(INCLUDEDIR)/xar
+ 	@INSTALL@ -d $(DESTDIR)$(LIBDIR)
+-	@INSTALL@ -m 0444 $(LIBXAR_S) $(DESTDIR)$(LIBDIR)
++	@INSTALL@ -m 0755 $(LIBXAR_S) $(DESTDIR)$(LIBDIR)
+ ifneq ($(words "" $(LIBXAR_LNAME)), 1)
+ 	rm -f $(DESTDIR)$(LIBDIR)/$(LIBXAR_LNAME)
+ 	ln -s $(LIBXAR_SNAME) $(DESTDIR)$(LIBDIR)/$(LIBXAR_LNAME)
+diff -Naupr xar-1.5.orig/src/Makefile.inc.in xar-1.5/src/Makefile.inc.in
+--- xar-1.5.orig/src/Makefile.inc.in	2007-05-11 04:50:41.000000000 +0200
++++ xar-1.5/src/Makefile.inc.in	2007-05-30 14:35:57.000000000 +0200
+@@ -11,7 +11,7 @@ src_install : @objroot@src/ixar
+ 	@INSTALL@ -d $(DESTDIR)$(BINDIR)
+ 	@INSTALL@ -m 0755 $< $(DESTDIR)$(BINDIR)/xar
+ 	@INSTALL@ -d $(DESTDIR)$(MANDIR)/man1
+-	@INSTALL@ -m 0444 @srcroot@src/xar.1 $(DESTDIR)$(MANDIR)/man1
++	@INSTALL@ -m 0644 @srcroot@src/xar.1 $(DESTDIR)$(MANDIR)/man1
+ 
+ src_uninstall :
+ 	rm -f $(DESTDIR)/$(BINDIR)/xar

xar-1.5-norpath.patch

@@ -0,0 +1,24 @@
+diff -Naupr xar-1.5.orig/configure xar-1.5/configure
+--- xar-1.5.orig/configure	2007-05-13 18:09:50.000000000 +0200
++++ xar-1.5/configure	2007-05-30 14:40:04.000000000 +0200
+@@ -2800,7 +2800,7 @@ case "${host}" in
+ 	CFLAGS="$CFLAGS"
+ 	abi="elf"
+ 		CPPFLAGS="$CPPFLAGS -D_GNU_SOURCE"
+-	RPATH="-Wl,-rpath,"
++	RPATH=""
+ 	;;
+   *-*-netbsd*)
+ 	echo "$as_me:$LINENO: checking ABI" >&5
+diff -Naupr xar-1.5.orig/configure.ac xar-1.5/configure.ac
+--- xar-1.5.orig/configure.ac	2007-05-11 04:51:25.000000000 +0200
++++ xar-1.5/configure.ac	2007-05-30 14:40:13.000000000 +0200
+@@ -109,7 +109,7 @@ case "${host}" in
+ 	abi="elf"
+ 	dnl Linux needs this for things like asprintf() and poll() flags.
+ 	CPPFLAGS="$CPPFLAGS -D_GNU_SOURCE"
+-	RPATH="-Wl,-rpath,"
++	RPATH=""
+ 	;;
+   *-*-netbsd*)
+ 	AC_MSG_CHECKING([ABI])

xar-1.5.2-CVE-2010-0055.patch

@@ -0,0 +1,49 @@
+Index: xar/lib/archive.c
+===================================================================
+--- xar/lib/archive.c	(revision 224)
++++ xar/lib/archive.c	(revision 225)
+@@ -330,6 +330,44 @@
+ 
+ 		EVP_DigestFinal(&XAR(ret)->toc_ctx, toccksum, &tlen);
+ 
++		const char *value;
++		uint64_t offset = 0;
++		uint64_t length = tlen;
++		if( xar_prop_get( XAR_FILE(ret) , "checksum/offset", &value) == 0 ) {
++			errno = 0;
++			offset = strtoull( value, (char **)NULL, 10);
++			if( errno != 0 ) {
++				xar_close(ret);
++				return NULL;
++			}
++		} else if( xar_signature_first(ret) != NULL ) {
++			// All archives that have a signature also specify the location
++			// of the checksum.  If the location isn't specified, error out.
++			xar_close(ret);
++			return NULL;
++		}
++
++		XAR(ret)->heap_offset = xar_get_heap_offset(ret) + offset;
++		if( lseek(XAR(ret)->fd, XAR(ret)->heap_offset, SEEK_SET) == -1 ) {
++			xar_close(ret);
++			return NULL;
++		}
++		if( xar_prop_get( XAR_FILE(ret) , "checksum/size", &value) == 0 ) {
++			errno = 0;
++			length = strtoull( value, (char **)NULL, 10);
++			if( errno != 0 ) {
++				xar_close(ret);
++				return NULL;
++			}
++		} else if( xar_signature_first(ret) != NULL ) {
++			xar_close(ret);
++			return NULL;
++		}
++		if( length != tlen ) {
++			xar_close(ret);
++			return NULL;
++		}
++
+ 		xar_read_fd(XAR(ret)->fd, cval, tlen);
+ 		XAR(ret)->heap_offset += tlen;
+ 		if( memcmp(cval, toccksum, tlen) != 0 ) {

xar.spec

@@ -0,0 +1,121 @@
+Summary: The eXtensible ARchiver
+Name: xar
+Version: 1.5.2
+Release: 6%{?dist}
+License: BSD
+Group: Applications/Archiving
+URL: http://code.google.com/p/xar/
+Source: http://xar.googlecode.com/files/xar-%{version}.tar.gz
+Patch0: xar-1.5-norpath.patch
+Patch1: xar-1.5.2-CVE-2010-0055.patch
+BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
+BuildRequires: libxml2-devel
+BuildRequires: openssl-devel
+BuildRequires: zlib-devel
+BuildRequires: bzip2-devel
+BuildRequires: /usr/bin/awk
+
+%description
+The XAR project aims to provide an easily extensible archive format. Important
+design decisions include an easily extensible XML table of contents for random
+access to archived files, storing the toc at the beginning of the archive to
+allow for efficient handling of streamed archives, the ability to handle files
+of arbitrarily large sizes, the ability to choose independent encodings for
+individual files in the archive, the ability to store checksums for individual
+files in both compressed and uncompressed form, and the ability to query the
+table of content's rich meta-data.
+
+
+%package devel
+Summary: Development files for the eXtensible ARchiver
+Group: Development/Libraries
+Requires: %{name} = %{version}-%{release}
+
+%description devel
+Development files for the eXtensible ARchiver.
+
+
+%prep
+%setup -q
+%patch0 -p1 -b .norpath
+%patch1 -p1 -b .CVE-2010-0055
+
+
+%build
+%configure --disable-static
+%{__make} %{?_smp_mflags}
+
+
+%install
+%{__rm} -rf %{buildroot}
+%{__make} install DESTDIR=%{buildroot}
+%{__rm} -f %{buildroot}%{_libdir}/libxar.la
+
+
+%clean
+%{__rm} -rf %{buildroot}
+
+
+%post -p /sbin/ldconfig
+
+%postun -p /sbin/ldconfig
+
+
+%files
+%defattr(-,root,root,-)
+%doc LICENSE TODO
+%{_bindir}/xar
+%{_libdir}/libxar.so.*
+%{_mandir}/man1/xar.1*
+
+%files devel
+%defattr(-,root,root,-)
+%{_includedir}/xar/
+%{_libdir}/libxar.so
+
+
+%changelog
+* Wed Apr 28 2010 Matthias Saou <http://freshrpms.net/> 1.5.2-6
+- Include patch to fix CVE-2010-0055 (#570678).
+
+* Fri Aug 21 2009 Tomas Mraz <tmraz@redhat.com> - 1.5.2-5
+- rebuilt with new openssl
+
+* Mon Jul 27 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.5.2-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
+
+* Wed Feb 25 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.5.2-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
+
+* Sun Jan 18 2009 Tomas Mraz <tmraz@redhat.com> 1.5.2-2
+- rebuild with new openssl
+
+* Tue Dec 23 2008 Matthias Saou <http://freshrpms.net/> 1.5.2-1
+- Update to 1.5.2.
+- Remove no longer needed install and memset patches.
+- Disable newly built-by-default static lib and remove useless .la file.
+
+* Tue Feb 19 2008 Fedora Release Engineering <rel-eng@fedoraproject.org> 
+- Autorebuild for GCC 4.3
+
+* Fri Dec 07 2007 Release Engineering <rel-eng at fedoraproject dot org> 
+- Rebuild for deps
+
+* Thu Aug 23 2007 Matthias Saou <http://freshrpms.net/> 1.5.1-4
+- Rebuild for new BuildID feature.
+- Add /usr/bin/awk build requirement, needed for the libxml configure check.
+
+* Wed Aug  8 2007 Matthias Saou <http://freshrpms.net/> 1.5.1-2
+- Patch memset call with swapped arguments (Dave Jones).
+
+* Wed Jul 11 2007 Matthias Saou <http://freshrpms.net/> 1.5.1-1
+- Update to 1.5.1.
+
+* Wed May 30 2007 Matthias Saou <http://freshrpms.net/> 1.5-1
+- Update to 1.5.
+- Include patch to remove rpath.
+- Include patch to fix file modes, and get the lib properly stripped.
+
+* Sun Feb 25 2007 Matthias Saou <http://freshrpms.net/> 1.4-1
+- Initial RPM release.
+