diff --git a/.gitignore b/.gitignore index 0a91fd3..55ad85c 100644 --- a/.gitignore +++ b/.gitignore @@ -1,5 +1,2 @@ -/zsh-5.*.*.tar.bz2 /zsh-5.*.tar.xz -/zsh-5.4.2.tar.gz -/*.src.rpm -results_*/ +/zsh-5.*.tar.xz.asc diff --git a/0001-zsh-5.7.1-zle-history-avoid-crash.patch b/0001-zsh-5.7.1-zle-history-avoid-crash.patch deleted file mode 100644 index 23932c3..0000000 --- a/0001-zsh-5.7.1-zle-history-avoid-crash.patch +++ /dev/null @@ -1,92 +0,0 @@ -From 15c190164c375cfe1772ebec92b544ca26a60e28 Mon Sep 17 00:00:00 2001 -From: Kamil Dudka -Date: Tue, 23 Jul 2019 14:45:48 +0200 -Subject: [PATCH 1/2] 44566: make sure Zle doesn't crash if history entry not - found - -Upstream-commit: f9cd2187875b6f2ebdb9b9a787fac20b2aaf745b -Signed-off-by: Kamil Dudka ---- - Src/Zle/zle_utils.c | 14 ++++++++++++-- - 1 file changed, 12 insertions(+), 2 deletions(-) - -diff --git a/Src/Zle/zle_utils.c b/Src/Zle/zle_utils.c -index c6df3d8..633f593 100644 ---- a/Src/Zle/zle_utils.c -+++ b/Src/Zle/zle_utils.c -@@ -1607,7 +1607,12 @@ static int - unapplychange(struct change *ch) - { - if(ch->hist != histline) { -- zle_setline(quietgethist(ch->hist)); -+ Histent he = quietgethist(ch->hist); -+ if(!he) { -+ dputs(ERRMSG("quietgethist(ch->hist) returned NULL")); -+ return 1; -+ } -+ zle_setline(he); - zlecs = ch->new_cs; - return 0; - } -@@ -1647,7 +1652,12 @@ static int - applychange(struct change *ch) - { - if(ch->hist != histline) { -- zle_setline(quietgethist(ch->hist)); -+ Histent he = quietgethist(ch->hist); -+ if(!he) { -+ dputs(ERRMSG("quietgethist(ch->hist) returned NULL")); -+ return 1; -+ } -+ zle_setline(he); - zlecs = ch->old_cs; - return 0; - } --- -2.20.1 - - -From 10dedc96ce0de43372add239f8256e259ca1e04a Mon Sep 17 00:00:00 2001 -From: Kamil Dudka -Date: Fri, 26 Jul 2019 17:24:59 +0200 -Subject: [PATCH 2/2] 44582: Fix foregoing commit to use DPUTS() better - -Upstream-commit: d6a9e222ec6b006c09d6f84beae6ef488a19b214 -Signed-off-by: Kamil Dudka ---- - Src/Zle/zle_utils.c | 10 ++++------ - 1 file changed, 4 insertions(+), 6 deletions(-) - -diff --git a/Src/Zle/zle_utils.c b/Src/Zle/zle_utils.c -index 633f593..29dba08 100644 ---- a/Src/Zle/zle_utils.c -+++ b/Src/Zle/zle_utils.c -@@ -1608,10 +1608,9 @@ unapplychange(struct change *ch) - { - if(ch->hist != histline) { - Histent he = quietgethist(ch->hist); -- if(!he) { -- dputs(ERRMSG("quietgethist(ch->hist) returned NULL")); -+ DPUTS(he == NULL, "quietgethist(ch->hist) returned NULL"); -+ if(he == NULL) - return 1; -- } - zle_setline(he); - zlecs = ch->new_cs; - return 0; -@@ -1653,10 +1652,9 @@ applychange(struct change *ch) - { - if(ch->hist != histline) { - Histent he = quietgethist(ch->hist); -- if(!he) { -- dputs(ERRMSG("quietgethist(ch->hist) returned NULL")); -+ DPUTS(he == NULL, "quietgethist(ch->hist) returned NULL"); -+ if(he == NULL) - return 1; -- } - zle_setline(he); - zlecs = ch->old_cs; - return 0; --- -2.20.1 - diff --git a/0002-zsh-5.7.1-CVE-2019-20044.patch b/0002-zsh-5.7.1-CVE-2019-20044.patch deleted file mode 100644 index 5533920..0000000 --- a/0002-zsh-5.7.1-CVE-2019-20044.patch +++ /dev/null @@ -1,1394 +0,0 @@ -From e6dea148252c9d8cb3de0965f2e558ac13e12f06 Mon Sep 17 00:00:00 2001 -From: Daniel Shahaf -Date: Thu, 26 Dec 2019 11:49:45 +0000 -Subject: [PATCH 1/7] internal: Allow %L in zerrmsg() in non-debug builds, too. - -This will let error messages include long integers. - -Upstream-commit: 81185f4c6106d7ea2f7beaabbec7360c08e400d2 -Signed-off-by: Kamil Dudka ---- - Src/utils.c | 2 -- - 1 file changed, 2 deletions(-) - -diff --git a/Src/utils.c b/Src/utils.c -index 32f6008..2ddc596 100644 ---- a/Src/utils.c -+++ b/Src/utils.c -@@ -325,12 +325,10 @@ zerrmsg(FILE *file, const char *fmt, va_list ap) - nicezputs(s, file); - break; - } --#ifdef DEBUG - case 'L': - lnum = va_arg(ap, long); - fprintf(file, "%ld", lnum); - break; --#endif - case 'd': - num = va_arg(ap, int); - fprintf(file, "%d", num); --- -2.21.1 - - -From 4907caaf15e5a054088e05534c5500679c15b105 Mon Sep 17 00:00:00 2001 -From: dana -Date: Thu, 26 Dec 2019 14:57:07 -0600 -Subject: [PATCH 2/7] unposted: zerrmsg(): Fix macro guard missed in previous - commit - -Upstream-commit: ed21a7b70068b4250a25dcdc5b7213a789b0d0ca -Signed-off-by: Kamil Dudka ---- - Src/utils.c | 2 -- - 1 file changed, 2 deletions(-) - -diff --git a/Src/utils.c b/Src/utils.c -index 2ddc596..4a1dcc4 100644 ---- a/Src/utils.c -+++ b/Src/utils.c -@@ -287,9 +287,7 @@ zerrmsg(FILE *file, const char *fmt, va_list ap) - { - const char *str; - int num; --#ifdef DEBUG - long lnum; --#endif - #ifdef HAVE_STRERROR_R - #define ERRBUFSIZE (80) - int olderrno; --- -2.21.1 - - -From 97e74e7038234359bd64b45a635720792824530e Mon Sep 17 00:00:00 2001 -From: Sam Foxman -Date: Sun, 22 Dec 2019 17:30:28 -0500 -Subject: [PATCH 3/7] Drop privileges securely - -Upstream-commit: 24e993db62cf146fb76ebcf677a4a7aa3766fc74 -Signed-off-by: Kamil Dudka ---- - Src/options.c | 161 +++++++++++++++++++++++++++++++++++++------------- - configure.ac | 4 +- - 2 files changed, 124 insertions(+), 41 deletions(-) - -diff --git a/Src/options.c b/Src/options.c -index 600b649..c9608af 100644 ---- a/Src/options.c -+++ b/Src/options.c -@@ -576,6 +576,7 @@ int - bin_setopt(char *nam, char **args, UNUSED(Options ops), int isun) - { - int action, optno, match = 0; -+ int retval = 0; - - /* With no arguments or options, display options. */ - if (!*args) { -@@ -603,18 +604,28 @@ bin_setopt(char *nam, char **args, UNUSED(Options ops), int isun) - inittyptab(); - return 1; - } -- if(!(optno = optlookup(*args))) -+ if(!(optno = optlookup(*args))) { - zwarnnam(nam, "no such option: %s", *args); -- else if(dosetopt(optno, action, 0, opts)) -- zwarnnam(nam, "can't change option: %s", *args); -+ retval = 1; -+ } else { -+ retval = !!dosetopt(optno, action, 0, opts); -+ if (retval) { -+ zwarnnam(nam, "can't change option: %s", *args); -+ } -+ } - break; - } else if(**args == 'm') { - match = 1; - } else { -- if (!(optno = optlookupc(**args))) -+ if (!(optno = optlookupc(**args))) { - zwarnnam(nam, "bad option: -%c", **args); -- else if(dosetopt(optno, action, 0, opts)) -- zwarnnam(nam, "can't change option: -%c", **args); -+ retval = 1; -+ } else { -+ retval = !!dosetopt(optno, action, 0, opts); -+ if (retval) { -+ zwarnnam(nam, "can't change option: -%c", **args); -+ } -+ } - } - } - args++; -@@ -624,10 +635,15 @@ bin_setopt(char *nam, char **args, UNUSED(Options ops), int isun) - if (!match) { - /* Not globbing the arguments -- arguments are simply option names. */ - while (*args) { -- if(!(optno = optlookup(*args++))) -+ if(!(optno = optlookup(*args++))) { - zwarnnam(nam, "no such option: %s", args[-1]); -- else if(dosetopt(optno, !isun, 0, opts)) -- zwarnnam(nam, "can't change option: %s", args[-1]); -+ retval = 1; -+ } else { -+ retval = !!dosetopt(optno, !isun, 0, opts); -+ if (retval) { -+ zwarnnam(nam, "can't change option: %s", args[-1]); -+ } -+ } - } - } else { - /* Globbing option (-m) set. */ -@@ -650,7 +666,8 @@ bin_setopt(char *nam, char **args, UNUSED(Options ops), int isun) - tokenize(s); - if (!(pprog = patcompile(s, PAT_HEAPDUP, NULL))) { - zwarnnam(nam, "bad pattern: %s", *args); -- continue; -+ retval = 1; -+ break; - } - /* Loop over expansions. */ - scanmatchtable(optiontab, pprog, 0, 0, OPT_ALIAS, -@@ -659,7 +676,7 @@ bin_setopt(char *nam, char **args, UNUSED(Options ops), int isun) - } - } - inittyptab(); -- return 0; -+ return retval; - } - - /* Identify an option name */ -@@ -768,37 +785,101 @@ dosetopt(int optno, int value, int force, char *new_opts) - return -1; - } else if(optno == PRIVILEGED && !value) { - /* unsetting PRIVILEGED causes the shell to make itself unprivileged */ --#ifdef HAVE_SETUID -- int ignore_err; -- errno = 0; -- /* -- * Set the GID first as if we set the UID to non-privileged it -- * might be impossible to restore the GID. -- * -- * Some OSes (possibly no longer around) have been known to -- * fail silently the first time, so we attempt the change twice. -- * If it fails we are guaranteed to pick this up the second -- * time, so ignore the first time. -- * -- * Some versions of gcc make it hard to ignore the results the -- * first time, hence the following. (These are probably not -- * systems that require the doubled calls.) -- */ -- ignore_err = setgid(getgid()); -- (void)ignore_err; -- ignore_err = setuid(getuid()); -- (void)ignore_err; -- if (setgid(getgid())) { -- zwarn("failed to change group ID: %e", errno); -- return -1; -- } else if (setuid(getuid())) { -- zwarn("failed to change user ID: %e", errno); -- return -1; -+ -+ int skip_setuid = 0; -+ int skip_setgid = 0; -+ -+#if defined(HAVE_GETEGID) && defined(HAVE_SETGID) && defined(HAVE_GETUID) -+ int orig_egid = getegid(); -+#endif -+ -+#if defined(HAVE_GETEUID) && defined(HAVE_GETUID) -+ if (geteuid() == getuid()) { -+ skip_setuid = 1; -+ } -+#endif -+ -+#if defined(HAVE_GETEGID) && defined(HAVE_GETGID) -+ if (getegid() == getgid()) { -+ skip_setgid = 1; - } -+#endif -+ -+ if (!skip_setgid) { -+ int setgid_err; -+#ifdef HAVE_SETRESGID -+ setgid_err = setresgid(getgid(), getgid(), getgid()); -+#elif defined(HAVE_SETREGID) -+#if defined(HAVE_GETEGID) && defined(HAVE_SETGID) && defined(HAVE_GETUID) -+ setgid_err = setregid(getgid(), getgid()); - #else -- zwarn("setuid not available"); -- return -1; --#endif /* not HAVE_SETUID */ -+ zwarnnam("unsetopt", -+ "PRIVILEGED: can't drop privileges; setregid available, but cannot check if saved gid changed"); -+ return -1; -+#endif -+#else -+ zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; setresgid and setregid not available"); -+ return -1; -+#endif -+ if (setgid_err) { -+ zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; failed to change group ID: %e", errno); -+ return -1; -+ } -+ } -+ -+ if (!skip_setuid) { -+#if defined(HAVE_GETEUID) && defined(HAVE_SETUID) -+ int orig_euid = geteuid(); -+#endif -+ int setuid_err; -+#if defined(HAVE_GETEUID) && defined(HAVE_INITGROUPS) && defined(HAVE_GETPWUID) -+ if (geteuid() == 0) { -+ struct passwd *pw = getpwuid(getuid()); -+ if (pw == NULL) { -+ zwarnnam("unsetopt", "can't drop privileges; failed to get user information for uid %d: %e", -+ getuid(), errno); -+ return -1; -+ } -+ if (initgroups(pw->pw_name, pw->pw_gid)) { -+ zwarnnam("unsetopt", "can't drop privileges; failed to set supplementary group list: %e", errno); -+ return -1; -+ } -+ } -+#endif -+ -+#ifdef HAVE_SETRESUID -+ setuid_err = setresuid(getuid(), getuid(), getuid()); -+#elif defined(HAVE_SETREUID) -+#if defined(HAVE_GETEUID) && defined(HAVE_SETUID) && defined(HAVE_GETUID) -+ setuid_err = setreuid(getuid(), getuid()); -+#else -+ zwarnnam("unsetopt", -+ "PRIVILEGED: can't drop privileges; setreuid available, but cannot check if saved uid changed"); -+ return -1; -+#endif -+#else -+ zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; setresuid and setreuid not available"); -+ return -1; -+#endif -+ if (setuid_err) { -+ zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; failed to change user ID: %e", errno); -+ return -1; -+ } -+#if defined(HAVE_GETEUID) && defined(HAVE_SETUID) && defined(HAVE_GETUID) -+ if (getuid() != 0 && !setuid(orig_euid)) { -+ zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; was able to restore the euid"); -+ return -1; -+ } -+#endif -+ } -+ -+#if defined(HAVE_GETEGID) && defined(HAVE_SETGID) && defined(HAVE_GETUID) -+ if (getuid() != 0 && !skip_setgid && !setgid(orig_egid)) { -+ zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; was able to restore the egid"); -+ return -1; -+ } -+#endif -+ - #ifdef JOB_CONTROL - } else if (!force && optno == MONITOR && value) { - if (new_opts[optno] == value) -diff --git a/configure.ac b/configure.ac -index 5513e25..1e654a7 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -1259,7 +1259,9 @@ AC_CHECK_FUNCS(strftime strptime mktime timelocal \ - inet_aton inet_pton inet_ntop \ - getlogin getpwent getpwnam getpwuid getgrgid getgrnam \ - initgroups nis_list \ -- setuid seteuid setreuid setresuid setsid \ -+ getuid setuid seteuid setreuid setresuid setsid \ -+ getgid setgid setegid setregid setresgid \ -+ geteuid getegid \ - memcpy memmove strstr strerror strtoul \ - getrlimit getrusage \ - setlocale \ --- -2.21.1 - - -From 540c79cb6a2c39b35c7bc28966936cd5a8e45713 Mon Sep 17 00:00:00 2001 -From: Daniel Shahaf -Date: Thu, 26 Dec 2019 09:16:19 +0000 -Subject: [PATCH 4/7] Improve PRIVILEGED fixes -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -- Fix retval handling in bin_setopt() - -- Don't skip_setuid / skip_setgid. It's not our place to optimize away noops - (that might not even _be_ noops; they might change the saved uid…). - -- Remove HAVE_* guard checks around functions that are used unguarded elsewhere. - -- Use bsd-setres_id.c from OpenSSH to provide setresuid() / setresgid() - everywhere, and thus simplify the ifdef soup. Fix some preëxisting - bugs in the macro definitions of setuid() (do we still need that one?). - -- Fix zwarning() format codes for variadic arguments type safety - -- Restored a comment from HEAD - -- Fix failure modes around initgroups() - -- Compared privilege restoration code with OpenSSH's permanently_drop_uid() and - updated as needed - -- Add E01 PRIVILEGED sanity checks - -Upstream-commit: 8250c5c168f07549ed646e6848e6dda118271e23 -Signed-off-by: Kamil Dudka ---- - Src/openssh_bsd_setres_id.c | 129 +++++++++++++++++++++++++++++++ - Src/options.c | 148 ++++++++++++++++-------------------- - Src/zsh.mdd | 3 +- - Src/zsh_system.h | 94 ++++++++++++++++++----- - Test/E01options.ztst | 15 ++++ - configure.ac | 5 +- - 6 files changed, 292 insertions(+), 102 deletions(-) - create mode 100644 Src/openssh_bsd_setres_id.c - -diff --git a/Src/openssh_bsd_setres_id.c b/Src/openssh_bsd_setres_id.c -new file mode 100644 -index 0000000..65e91a4 ---- /dev/null -+++ b/Src/openssh_bsd_setres_id.c -@@ -0,0 +1,129 @@ -+/* -+ * Copyright (c) 2012 Darren Tucker (dtucker at zip com au). -+ * -+ * Permission to use, copy, modify, and distribute this software for any -+ * purpose with or without fee is hereby granted, provided that the above -+ * copyright notice and this permission notice appear in all copies. -+ * -+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES -+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF -+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR -+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES -+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN -+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF -+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. -+ */ -+/* -+ * openssh_bsd_setres_id.c - setresuid() and setresgid() wrappers -+ * -+ * This file is part of zsh, the Z shell. -+ * -+ * It is based on the file openbsd-compat/bsd-setres_id.c in OpenSSH 7.9p1, -+ * which is subject to the copyright notice above. The zsh modifications are -+ * licensed as follows: -+ * -+ * Copyright (c) 2019 Daniel Shahaf -+ * All rights reserved. -+ * -+ * Permission is hereby granted, without written agreement and without -+ * license or royalty fees, to use, copy, modify, and distribute this -+ * software and to distribute modified versions of this software for any -+ * purpose, provided that the above copyright notice and the following -+ * two paragraphs appear in all copies of this software. -+ * -+ * In no event shall Daniel Shahaf or the Zsh Development Group be liable -+ * to any party for direct, indirect, special, incidental, or consequential -+ * damages arising out of the use of this software and its documentation, -+ * even if Daniel Shahaf and the Zsh Development Group have been advised of -+ * the possibility of such damage. -+ * -+ * Daniel Shahaf and the Zsh Development Group specifically disclaim any -+ * warranties, including, but not limited to, the implied warranties of -+ * merchantability and fitness for a particular purpose. The software -+ * provided hereunder is on an "as is" basis, and Daniel Shahaf and the -+ * Zsh Development Group have no obligation to provide maintenance, -+ * support, updates, enhancements, or modifications. -+ * -+ */ -+ -+ -+#include -+ -+#include -+#include -+#include -+ -+#include "zsh.mdh" -+ -+#if defined(ZSH_IMPLEMENT_SETRESGID) || defined(BROKEN_SETRESGID) -+int -+setresgid(gid_t rgid, gid_t egid, gid_t sgid) -+{ -+ int ret = 0, saved_errno; -+ -+ if (rgid != sgid) { -+ errno = ENOSYS; -+ return -1; -+ } -+#if defined(ZSH_HAVE_NATIVE_SETREGID) && !defined(BROKEN_SETREGID) -+ if (setregid(rgid, egid) < 0) { -+ saved_errno = errno; -+ zwarnnam("setregid", "to gid %L: %e", (long)rgid, errno); -+ errno = saved_errno; -+ ret = -1; -+ } -+#else -+ if (setegid(egid) < 0) { -+ saved_errno = errno; -+ zwarnnam("setegid", "to gid %L: %e", (long)(unsigned int)egid, errno); -+ errno = saved_errno; -+ ret = -1; -+ } -+ if (setgid(rgid) < 0) { -+ saved_errno = errno; -+ zwarnnam("setgid", "to gid %L: %e", (long)rgid, errno); -+ errno = saved_errno; -+ ret = -1; -+ } -+#endif -+ return ret; -+} -+#endif -+ -+#if defined(ZSH_IMPLEMENT_SETRESUID) || defined(BROKEN_SETRESUID) -+int -+setresuid(uid_t ruid, uid_t euid, uid_t suid) -+{ -+ int ret = 0, saved_errno; -+ -+ if (ruid != suid) { -+ errno = ENOSYS; -+ return -1; -+ } -+#if defined(ZSH_HAVE_NATIVE_SETREUID) && !defined(BROKEN_SETREUID) -+ if (setreuid(ruid, euid) < 0) { -+ saved_errno = errno; -+ zwarnnam("setreuid", "to uid %L: %e", (long)ruid, errno); -+ errno = saved_errno; -+ ret = -1; -+ } -+#else -+ -+# ifndef SETEUID_BREAKS_SETUID -+ if (seteuid(euid) < 0) { -+ saved_errno = errno; -+ zwarnnam("seteuid", "to uid %L: %e", (long)euid, errno); -+ errno = saved_errno; -+ ret = -1; -+ } -+# endif -+ if (setuid(ruid) < 0) { -+ saved_errno = errno; -+ zwarnnam("setuid", "to uid %L: %e", (long)ruid, errno); -+ errno = saved_errno; -+ ret = -1; -+ } -+#endif -+ return ret; -+} -+#endif -diff --git a/Src/options.c b/Src/options.c -index c9608af..deec560 100644 ---- a/Src/options.c -+++ b/Src/options.c -@@ -606,25 +606,21 @@ bin_setopt(char *nam, char **args, UNUSED(Options ops), int isun) - } - if(!(optno = optlookup(*args))) { - zwarnnam(nam, "no such option: %s", *args); -- retval = 1; -- } else { -- retval = !!dosetopt(optno, action, 0, opts); -- if (retval) { -- zwarnnam(nam, "can't change option: %s", *args); -- } -+ retval |= 1; -+ } else if (dosetopt(optno, action, 0, opts)) { -+ zwarnnam(nam, "can't change option: %s", *args); -+ retval |= 1; - } - break; - } else if(**args == 'm') { - match = 1; - } else { -- if (!(optno = optlookupc(**args))) { -+ if (!(optno = optlookupc(**args))) { - zwarnnam(nam, "bad option: -%c", **args); -- retval = 1; -- } else { -- retval = !!dosetopt(optno, action, 0, opts); -- if (retval) { -- zwarnnam(nam, "can't change option: -%c", **args); -- } -+ retval |= 1; -+ } else if (dosetopt(optno, action, 0, opts)) { -+ zwarnnam(nam, "can't change option: -%c", **args); -+ retval |= 1; - } - } - } -@@ -637,12 +633,10 @@ bin_setopt(char *nam, char **args, UNUSED(Options ops), int isun) - while (*args) { - if(!(optno = optlookup(*args++))) { - zwarnnam(nam, "no such option: %s", args[-1]); -- retval = 1; -- } else { -- retval = !!dosetopt(optno, !isun, 0, opts); -- if (retval) { -- zwarnnam(nam, "can't change option: %s", args[-1]); -- } -+ retval |= 1; -+ } else if (dosetopt(optno, !isun, 0, opts)) { -+ zwarnnam(nam, "can't change option: %s", args[-1]); -+ retval |= 1; - } - } - } else { -@@ -666,7 +660,7 @@ bin_setopt(char *nam, char **args, UNUSED(Options ops), int isun) - tokenize(s); - if (!(pprog = patcompile(s, PAT_HEAPDUP, NULL))) { - zwarnnam(nam, "bad pattern: %s", *args); -- retval = 1; -+ retval |= 1; - break; - } - /* Loop over expansions. */ -@@ -786,100 +780,92 @@ dosetopt(int optno, int value, int force, char *new_opts) - } else if(optno == PRIVILEGED && !value) { - /* unsetting PRIVILEGED causes the shell to make itself unprivileged */ - -- int skip_setuid = 0; -- int skip_setgid = 0; -- --#if defined(HAVE_GETEGID) && defined(HAVE_SETGID) && defined(HAVE_GETUID) -- int orig_egid = getegid(); --#endif -+ /* If set, return -1 so lastval will be non-zero. */ -+ int failed = 0; - --#if defined(HAVE_GETEUID) && defined(HAVE_GETUID) -- if (geteuid() == getuid()) { -- skip_setuid = 1; -- } -+#ifdef HAVE_SETUID -+ const int orig_euid = geteuid(); - #endif -+ const int orig_egid = getegid(); - --#if defined(HAVE_GETEGID) && defined(HAVE_GETGID) -- if (getegid() == getgid()) { -- skip_setgid = 1; -- } --#endif -- -- if (!skip_setgid) { -- int setgid_err; --#ifdef HAVE_SETRESGID -- setgid_err = setresgid(getgid(), getgid(), getgid()); --#elif defined(HAVE_SETREGID) --#if defined(HAVE_GETEGID) && defined(HAVE_SETGID) && defined(HAVE_GETUID) -- setgid_err = setregid(getgid(), getgid()); --#else -- zwarnnam("unsetopt", -- "PRIVILEGED: can't drop privileges; setregid available, but cannot check if saved gid changed"); -+ /* -+ * Set the GID first as if we set the UID to non-privileged it -+ * might be impossible to restore the GID. -+ */ -+ { -+#ifndef HAVE_SETRESGID -+ zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; setresgid() and friends not available"); - return -1; --#endif - #else -- zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; setresgid and setregid not available"); -- return -1; --#endif -+ int setgid_err; -+ setgid_err = setresgid(getgid(), getgid(), getgid()); - if (setgid_err) { - zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; failed to change group ID: %e", errno); - return -1; - } -+#endif - } - -- if (!skip_setuid) { --#if defined(HAVE_GETEUID) && defined(HAVE_SETUID) -- int orig_euid = geteuid(); --#endif -+ /* Set the UID second. */ -+ { -+#ifndef HAVE_SETRESUID -+ zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; setresuid() and friends not available"); -+ return -1; -+#else - int setuid_err; --#if defined(HAVE_GETEUID) && defined(HAVE_INITGROUPS) && defined(HAVE_GETPWUID) -+ -+# ifdef HAVE_INITGROUPS -+ /* Set the supplementary groups list. */ - if (geteuid() == 0) { - struct passwd *pw = getpwuid(getuid()); - if (pw == NULL) { -- zwarnnam("unsetopt", "can't drop privileges; failed to get user information for uid %d: %e", -- getuid(), errno); -- return -1; -- } -- if (initgroups(pw->pw_name, pw->pw_gid)) { -+ zwarnnam("unsetopt", "can't drop privileges; failed to get user information for uid %L: %e", -+ (long)getuid(), errno); -+ failed = 1; -+ } else if (initgroups(pw->pw_name, pw->pw_gid)) { - zwarnnam("unsetopt", "can't drop privileges; failed to set supplementary group list: %e", errno); - return -1; - } -+ } else if (getuid() != 0 && -+ (geteuid() != getuid() || orig_egid != getegid())) { -+ zwarnnam("unsetopt", "PRIVILEGED: supplementary group list not changed due to lack of permissions: EUID=%L", -+ (long)geteuid()); -+ failed = 1; - } --#endif -+# else -+ /* initgroups() isn't in POSIX. If it's not available on the system, -+ * we silently skip it. */ -+# endif - --#ifdef HAVE_SETRESUID - setuid_err = setresuid(getuid(), getuid(), getuid()); --#elif defined(HAVE_SETREUID) --#if defined(HAVE_GETEUID) && defined(HAVE_SETUID) && defined(HAVE_GETUID) -- setuid_err = setreuid(getuid(), getuid()); --#else -- zwarnnam("unsetopt", -- "PRIVILEGED: can't drop privileges; setreuid available, but cannot check if saved uid changed"); -- return -1; --#endif --#else -- zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; setresuid and setreuid not available"); -- return -1; --#endif - if (setuid_err) { - zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; failed to change user ID: %e", errno); - return -1; - } --#if defined(HAVE_GETEUID) && defined(HAVE_SETUID) && defined(HAVE_GETUID) -- if (getuid() != 0 && !setuid(orig_euid)) { -- zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; was able to restore the euid"); -- return -1; -- } - #endif - } - --#if defined(HAVE_GETEGID) && defined(HAVE_SETGID) && defined(HAVE_GETUID) -- if (getuid() != 0 && !skip_setgid && !setgid(orig_egid)) { -+#ifdef HAVE_SETGID -+ if (getuid() != 0 && orig_egid != getegid() && -+ (setgid(orig_egid) != -1 || setegid(orig_egid) != -1)) { - zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; was able to restore the egid"); - return -1; - } - #endif - -+#ifdef HAVE_SETUID -+ if (getuid() != 0 && orig_euid != geteuid() && -+ (setuid(orig_euid) != -1 || seteuid(orig_euid) != -1)) { -+ zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; was able to restore the euid"); -+ return -1; -+ } -+#endif -+ -+ if (failed) { -+ /* A warning message has been printed. */ -+ return -1; -+ } -+ - #ifdef JOB_CONTROL - } else if (!force && optno == MONITOR && value) { - if (new_opts[optno] == value) -diff --git a/Src/zsh.mdd b/Src/zsh.mdd -index 3e5788a..9bcacca 100644 ---- a/Src/zsh.mdd -+++ b/Src/zsh.mdd -@@ -13,7 +13,8 @@ objects="builtin.o compat.o cond.o context.o \ - exec.o glob.o hashtable.o hashnameddir.o \ - hist.o init.o input.o jobs.o lex.o linklist.o loop.o math.o \ - mem.o module.o options.o params.o parse.o pattern.o prompt.o signals.o \ --signames.o sort.o string.o subst.o text.o utils.o watch.o" -+signames.o sort.o string.o subst.o text.o utils.o watch.o \ -+openssh_bsd_setres_id.o" - - headers="../config.h zsh_system.h zsh.h sigcount.h signals.h \ - prototypes.h hashtable.h ztype.h" -diff --git a/Src/zsh_system.h b/Src/zsh_system.h -index e7d529b..6eb114b 100644 ---- a/Src/zsh_system.h -+++ b/Src/zsh_system.h -@@ -468,30 +468,90 @@ struct timespec { - # define setpgrp setpgid - #endif - --/* can we set the user/group id of a process */ -+/* compatibility wrappers */ - --#ifndef HAVE_SETUID -+/* Our strategy is as follows: -+ * -+ * - Ensure that either setre[ug]id() or set{e,}[ug]id() is available. -+ * - If setres[ug]id() are missing, provide them in terms of either -+ * setre[ug]id() or set{e,}[ug]id(), whichever is available. -+ * - Provide replacement setre[ug]id() or set{e,}[ug]id() if they are not -+ * available natively. -+ * -+ * There isn't a circular dependency because, right off the bat, we check that -+ * there's an end condition, and #error out otherwise. -+ */ -+#if !defined(HAVE_SETREUID) && !(defined(HAVE_SETEUID) && defined(HAVE_SETUID)) -+ /* -+ * If you run into this error, you have two options: -+ * - Teach zsh how to do the equivalent of setreuid() on your system -+ * - Remove support for PRIVILEGED option, and then remove the #error. -+ */ -+# error "Don't know how to change UID" -+#endif -+#if !defined(HAVE_SETREGID) && !(defined(HAVE_SETEGID) && defined(HAVE_SETGID)) -+ /* See above comment. */ -+# error "Don't know how to change GID" -+#endif -+ -+/* Provide setresuid(). */ -+#ifndef HAVE_SETRESUID -+int setresuid(uid_t, uid_t, uid_t); -+# define HAVE_SETRESUID -+# define ZSH_IMPLEMENT_SETRESUID - # ifdef HAVE_SETREUID --# define setuid(X) setreuid(X,X) --# define setgid(X) setregid(X,X) --# define HAVE_SETUID -+# define ZSH_HAVE_NATIVE_SETREUID - # endif - #endif - --/* can we set the effective user/group id of a process */ -+/* Provide setresgid(). */ -+#ifndef HAVE_SETRESGID -+int setresgid(gid_t, gid_t, gid_t); -+# define HAVE_SETRESGID -+# define ZSH_IMPLEMENT_SETRESGID -+# ifdef HAVE_SETREGID -+# define ZSH_HAVE_NATIVE_SETREGID -+# endif -+#endif - -+/* Provide setreuid(). */ -+#ifndef HAVE_SETREUID -+# define setreuid(X, Y) setresuid((X), (Y), -1) -+# define HAVE_SETREUID -+#endif -+ -+/* Provide setregid(). */ -+#ifndef HAVE_SETREGID -+# define setregid(X, Y) setresgid((X), (Y), -1) -+# define HAVE_SETREGID -+#endif -+ -+/* Provide setuid(). */ -+/* ### TODO: Either remove this (this function has been standard since 1985), -+ * ### or rewrite this without multiply-evaluating the argument */ -+#ifndef HAVE_SETUID -+# define setuid(X) setreuid((X), (X)) -+# define HAVE_SETUID -+#endif -+ -+/* Provide setgid(). */ -+#ifndef HAVE_SETGID -+/* ### TODO: Either remove this (this function has been standard since 1985), -+ * ### or rewrite this without multiply-evaluating the argument */ -+# define setgid(X) setregid((X), (X)) -+# define HAVE_SETGID -+#endif -+ -+/* Provide seteuid(). */ - #ifndef HAVE_SETEUID --# ifdef HAVE_SETREUID --# define seteuid(X) setreuid(-1,X) --# define setegid(X) setregid(-1,X) --# define HAVE_SETEUID --# else --# ifdef HAVE_SETRESUID --# define seteuid(X) setresuid(-1,X,-1) --# define setegid(X) setresgid(-1,X,-1) --# define HAVE_SETEUID --# endif --# endif -+# define seteuid(X) setreuid(-1, (X)) -+# define HAVE_SETEUID -+#endif -+ -+/* Provide setegid(). */ -+#ifndef HAVE_SETEGID -+# define setegid(X) setregid(-1, (X)) -+# define HAVE_SETEGID - #endif - - #ifdef HAVE_SYS_RESOURCE_H -diff --git a/Test/E01options.ztst b/Test/E01options.ztst -index 0f6bb34..c4c3d67 100644 ---- a/Test/E01options.ztst -+++ b/Test/E01options.ztst -@@ -1391,3 +1391,18 @@ F:Regression test for workers/41811 - ?(anon):4: `break' active at end of function scope - ?(anon):4: `break' active at end of function scope - ?(anon):4: `break' active at end of function scope -+ -+# There are further tests for PRIVILEGED in P01privileged.ztst. -+ if [[ -o privileged ]]; then -+ unsetopt privileged -+ fi -+ unsetopt privileged -+0:PRIVILEGED sanity check: unsetting is idempotent -+F:If this test fails at the first unsetopt, refer to P01privileged.ztst. -+ -+ if [[ -o privileged ]]; then -+ (( UID != EUID )) -+ else -+ (( UID == EUID )) -+ fi -+0:PRIVILEGED sanity check: default value is correct -diff --git a/configure.ac b/configure.ac -index 1e654a7..ffd65c0 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -1259,9 +1259,8 @@ AC_CHECK_FUNCS(strftime strptime mktime timelocal \ - inet_aton inet_pton inet_ntop \ - getlogin getpwent getpwnam getpwuid getgrgid getgrnam \ - initgroups nis_list \ -- getuid setuid seteuid setreuid setresuid setsid \ -- getgid setgid setegid setregid setresgid \ -- geteuid getegid \ -+ setuid seteuid setreuid setresuid setsid \ -+ setgid setegid setregid setresgid \ - memcpy memmove strstr strerror strtoul \ - getrlimit getrusage \ - setlocale \ --- -2.21.1 - - -From c1855ecb424f8f9547a43a2583bd22eed2748c89 Mon Sep 17 00:00:00 2001 -From: dana -Date: Sun, 29 Dec 2019 02:41:11 +0000 -Subject: [PATCH 5/7] Improve PRIVILEGED fixes (again) - -* Pass RGID instead of passwd GID to initgroups() - -* Clean up #ifdefs, avoid unnecessary checks - -* Flatten conditions - -Upstream-commit: 26d02efa7a9b0a6b32e1a8bbc6aca6c544b94211 -Signed-off-by: Kamil Dudka ---- - Src/options.c | 92 ++++++++++++++++++++++++--------------------------- - 1 file changed, 43 insertions(+), 49 deletions(-) - -diff --git a/Src/options.c b/Src/options.c -index deec560..8599ed3 100644 ---- a/Src/options.c -+++ b/Src/options.c -@@ -780,91 +780,85 @@ dosetopt(int optno, int value, int force, char *new_opts) - } else if(optno == PRIVILEGED && !value) { - /* unsetting PRIVILEGED causes the shell to make itself unprivileged */ - -+/* For simplicity's sake, require both setresgid() and setresuid() up-front. */ -+#if !defined(HAVE_SETRESGID) -+ zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; setresgid() and friends not available"); -+ return -1; -+#elif !defined(HAVE_SETRESUID) -+ zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; setresuid() and friends not available"); -+ return -1; -+#else - /* If set, return -1 so lastval will be non-zero. */ - int failed = 0; -- --#ifdef HAVE_SETUID - const int orig_euid = geteuid(); --#endif - const int orig_egid = getegid(); - - /* - * Set the GID first as if we set the UID to non-privileged it - * might be impossible to restore the GID. - */ -- { --#ifndef HAVE_SETRESGID -- zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; setresgid() and friends not available"); -+ if (setresgid(getgid(), getgid(), getgid())) { -+ zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; failed to change group ID: %e", errno); - return -1; --#else -- int setgid_err; -- setgid_err = setresgid(getgid(), getgid(), getgid()); -- if (setgid_err) { -- zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; failed to change group ID: %e", errno); -- return -1; -- } --#endif - } - -- /* Set the UID second. */ -- { --#ifndef HAVE_SETRESUID -- zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; setresuid() and friends not available"); -- return -1; --#else -- int setuid_err; -- - # ifdef HAVE_INITGROUPS -- /* Set the supplementary groups list. */ -- if (geteuid() == 0) { -- struct passwd *pw = getpwuid(getuid()); -- if (pw == NULL) { -- zwarnnam("unsetopt", "can't drop privileges; failed to get user information for uid %L: %e", -- (long)getuid(), errno); -- failed = 1; -- } else if (initgroups(pw->pw_name, pw->pw_gid)) { -- zwarnnam("unsetopt", "can't drop privileges; failed to set supplementary group list: %e", errno); -- return -1; -- } -- } else if (getuid() != 0 && -- (geteuid() != getuid() || orig_egid != getegid())) { -- zwarnnam("unsetopt", "PRIVILEGED: supplementary group list not changed due to lack of permissions: EUID=%L", -- (long)geteuid()); -+ /* Set the supplementary groups list. -+ * -+ * Note that on macOS, FreeBSD, and possibly some other platforms, -+ * initgroups() resets the EGID to its second argument (see setgroups(2) for -+ * details). This has the potential to leave the EGID in an unexpected -+ * state. However, it seems common in other projects that do this dance to -+ * simply re-use the same GID that's going to become the EGID anyway, in -+ * which case it doesn't matter. That's what we do here. It's therefore -+ * possible, in some probably uncommon cases, that the shell ends up not -+ * having the privileges of the RUID user's primary/passwd group. */ -+ if (geteuid() == 0) { -+ struct passwd *pw = getpwuid(getuid()); -+ if (pw == NULL) { -+ zwarnnam("unsetopt", "can't drop privileges; failed to get user information for uid %L: %e", -+ (long)getuid(), errno); - failed = 1; -+ /* This may behave strangely in the unlikely event that the same user -+ * name appears with multiple UIDs in the passwd database */ -+ } else if (initgroups(pw->pw_name, getgid())) { -+ zwarnnam("unsetopt", "can't drop privileges; failed to set supplementary group list: %e", errno); -+ return -1; - } -+ } else if (getuid() != 0 && -+ (geteuid() != getuid() || orig_egid != getegid())) { -+ zwarnnam("unsetopt", "PRIVILEGED: supplementary group list not changed due to lack of permissions: EUID=%L", -+ (long)geteuid()); -+ failed = 1; -+ } - # else -- /* initgroups() isn't in POSIX. If it's not available on the system, -- * we silently skip it. */ -+ /* initgroups() isn't in POSIX. If it's not available on the system, -+ * we silently skip it. */ - # endif - -- setuid_err = setresuid(getuid(), getuid(), getuid()); -- if (setuid_err) { -- zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; failed to change user ID: %e", errno); -- return -1; -- } --#endif -+ /* Set the UID second. */ -+ if (setresuid(getuid(), getuid(), getuid())) { -+ zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; failed to change user ID: %e", errno); -+ return -1; - } - --#ifdef HAVE_SETGID - if (getuid() != 0 && orig_egid != getegid() && - (setgid(orig_egid) != -1 || setegid(orig_egid) != -1)) { - zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; was able to restore the egid"); - return -1; - } --#endif - --#ifdef HAVE_SETUID - if (getuid() != 0 && orig_euid != geteuid() && - (setuid(orig_euid) != -1 || seteuid(orig_euid) != -1)) { - zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; was able to restore the euid"); - return -1; - } --#endif - - if (failed) { - /* A warning message has been printed. */ - return -1; - } -+#endif /* HAVE_SETRESGID && HAVE_SETRESUID */ - - #ifdef JOB_CONTROL - } else if (!force && optno == MONITOR && value) { --- -2.21.1 - - -From 419c71136403c294d8d4cc4b1d6292a96455aa88 Mon Sep 17 00:00:00 2001 -From: dana -Date: Sun, 29 Dec 2019 02:43:14 +0000 -Subject: [PATCH 6/7] Clean up error-message white space - -Upstream-commit: 4ce66857b71b40a0661df3780ff557f2b0f4cb13 -Signed-off-by: Kamil Dudka ---- - Src/options.c | 30 +++++++++++++++++++++--------- - 1 file changed, 21 insertions(+), 9 deletions(-) - -diff --git a/Src/options.c b/Src/options.c -index 8599ed3..5b972d4 100644 ---- a/Src/options.c -+++ b/Src/options.c -@@ -782,10 +782,12 @@ dosetopt(int optno, int value, int force, char *new_opts) - - /* For simplicity's sake, require both setresgid() and setresuid() up-front. */ - #if !defined(HAVE_SETRESGID) -- zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; setresgid() and friends not available"); -+ zwarnnam("unsetopt", -+ "PRIVILEGED: can't drop privileges; setresgid() and friends not available"); - return -1; - #elif !defined(HAVE_SETRESUID) -- zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; setresuid() and friends not available"); -+ zwarnnam("unsetopt", -+ "PRIVILEGED: can't drop privileges; setresuid() and friends not available"); - return -1; - #else - /* If set, return -1 so lastval will be non-zero. */ -@@ -798,7 +800,9 @@ dosetopt(int optno, int value, int force, char *new_opts) - * might be impossible to restore the GID. - */ - if (setresgid(getgid(), getgid(), getgid())) { -- zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; failed to change group ID: %e", errno); -+ zwarnnam("unsetopt", -+ "PRIVILEGED: can't drop privileges; failed to change group ID: %e", -+ errno); - return -1; - } - -@@ -816,18 +820,22 @@ dosetopt(int optno, int value, int force, char *new_opts) - if (geteuid() == 0) { - struct passwd *pw = getpwuid(getuid()); - if (pw == NULL) { -- zwarnnam("unsetopt", "can't drop privileges; failed to get user information for uid %L: %e", -+ zwarnnam("unsetopt", -+ "can't drop privileges; failed to get user information for uid %L: %e", - (long)getuid(), errno); - failed = 1; - /* This may behave strangely in the unlikely event that the same user - * name appears with multiple UIDs in the passwd database */ - } else if (initgroups(pw->pw_name, getgid())) { -- zwarnnam("unsetopt", "can't drop privileges; failed to set supplementary group list: %e", errno); -+ zwarnnam("unsetopt", -+ "can't drop privileges; failed to set supplementary group list: %e", -+ errno); - return -1; - } - } else if (getuid() != 0 && - (geteuid() != getuid() || orig_egid != getegid())) { -- zwarnnam("unsetopt", "PRIVILEGED: supplementary group list not changed due to lack of permissions: EUID=%L", -+ zwarnnam("unsetopt", -+ "PRIVILEGED: supplementary group list not changed due to lack of permissions: EUID=%L", - (long)geteuid()); - failed = 1; - } -@@ -838,19 +846,23 @@ dosetopt(int optno, int value, int force, char *new_opts) - - /* Set the UID second. */ - if (setresuid(getuid(), getuid(), getuid())) { -- zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; failed to change user ID: %e", errno); -+ zwarnnam("unsetopt", -+ "PRIVILEGED: can't drop privileges; failed to change user ID: %e", -+ errno); - return -1; - } - - if (getuid() != 0 && orig_egid != getegid() && - (setgid(orig_egid) != -1 || setegid(orig_egid) != -1)) { -- zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; was able to restore the egid"); -+ zwarnnam("unsetopt", -+ "PRIVILEGED: can't drop privileges; was able to restore the egid"); - return -1; - } - - if (getuid() != 0 && orig_euid != geteuid() && - (setuid(orig_euid) != -1 || seteuid(orig_euid) != -1)) { -- zwarnnam("unsetopt", "PRIVILEGED: can't drop privileges; was able to restore the euid"); -+ zwarnnam("unsetopt", -+ "PRIVILEGED: can't drop privileges; was able to restore the euid"); - return -1; - } - --- -2.21.1 - - -From 10177eaeee71efcfe13242d37a4e0ea0b0a8e430 Mon Sep 17 00:00:00 2001 -From: dana -Date: Sat, 28 Dec 2019 20:45:55 -0600 -Subject: [PATCH 7/7] Add unsetopt/PRIVILEGED tests - -Upstream-commit: b15bd4aa590db8087d1e8f2eb1af2874f5db814d -Signed-off-by: Kamil Dudka ---- - Test/E01options.ztst | 10 +- - Test/P01privileged.ztst | 197 ++++++++++++++++++++++++++++++++++++++++ - Test/README | 1 + - 3 files changed, 207 insertions(+), 1 deletion(-) - create mode 100644 Test/P01privileged.ztst - -diff --git a/Test/E01options.ztst b/Test/E01options.ztst -index c4c3d67..767879a 100644 ---- a/Test/E01options.ztst -+++ b/Test/E01options.ztst -@@ -74,7 +74,6 @@ - # HASH_LIST_ALL ) - # PRINT_EXIT_STATUS haven't worked out what this does yet, although - # Bart suggested a fix. --# PRIVILEGED (similar to GLOBAL_RCS) - # RCS ( " " " " ) - # SH_OPTION_LETTERS even I found this too dull to set up a test for - # SINGLE_COMMAND kills shell -@@ -95,6 +94,15 @@ - - %test - -+ # setopt should move on to the next operation in the face of an error, but -+ # preserve the >0 return code -+ unsetopt aliases -+ setopt not_a_real_option aliases && return 2 -+ print -r - $options[aliases] -+0:setopt error handling -+?(eval):setopt:4: no such option: not_a_real_option -+>on -+ - alias echo='print foo' - unsetopt aliases - # use eval else aliases are all parsed at start -diff --git a/Test/P01privileged.ztst b/Test/P01privileged.ztst -new file mode 100644 -index 0000000..c54112b ---- /dev/null -+++ b/Test/P01privileged.ztst -@@ -0,0 +1,197 @@ -+# This file contains tests related to the PRIVILEGED option. In order to run, -+# it requires that the test process itself have super-user privileges (or that -+# one of the environment variables described below be set). This can be achieved -+# via, e.g., `sudo make check TESTNUM=P`. -+# -+# Optionally, the environment variables ZSH_TEST_UNPRIVILEGED_UID and/or -+# ZSH_TEST_UNPRIVILEGED_GID may be set to UID:EUID or GID:EGID pairs, where the -+# two IDs in each pair are different, non-0 IDs valid on the system being used -+# to run the tests. (The UIDs must both be non-0 to effectively test downgrading -+# of privileges, and they must be non-matching to test auto-enabling of -+# PRIVILEGED and to ensure that disabling PRIVILEGED correctly resets the saved -+# UID. Technically GID 0 is not special, but for simplicity's sake we apply the -+# same requirements here.) -+# -+# If either of the aforementioned environment variables is not set, the test -+# script will try to pick the first two >0 IDs from the passwd/group databases -+# on the current system. -+# -+# If either variable is set, the tests will run, but they will likely fail -+# without super-user privileges. -+ -+%prep -+ -+ # Mind your empty lines here. The logic in this %prep section is somewhat -+ # complex compared to most others; to avoid lots of nested/duplicated -+ # conditions we need to make sure that this all gets executed as a single -+ # function from which we can return early -+ [[ $EUID == 0 || -n $ZSH_TEST_UNPRIVILEGED_UID$ZSH_TEST_UNPRIVILEGED_GID ]] || { -+ ZTST_unimplemented='PRIVILEGED tests require super-user privileges (or env var)' -+ return 1 -+ } -+ (( $+commands[perl] )) || { # @todo Eliminate this dependency with a C wrapper? -+ ZTST_unimplemented='PRIVILEGED tests require Perl' -+ return 1 -+ } -+ grep -qE '#define HAVE_SETRES?UID' $ZTST_testdir/../config.h || { -+ ZTST_unimplemented='PRIVILEGED tests require setreuid()/setresuid()' -+ return 1 -+ } -+ # -+ ruid= euid= rgid= egid= -+ # -+ if [[ -n $ZSH_TEST_UNPRIVILEGED_UID ]]; then -+ ruid=${ZSH_TEST_UNPRIVILEGED_UID%%:*} -+ euid=${ZSH_TEST_UNPRIVILEGED_UID##*:} -+ else -+ print -ru$ZTST_fd 'Selecting unprivileged UID:EUID pair automatically' -+ local tmp=$( getent passwd 2> /dev/null || < /etc/passwd ) -+ # Note: Some awks require -v and its argument to be separate -+ ruid=$( awk -F: '$3 > 0 { print $3; exit; }' <<< $tmp ) -+ euid=$( awk -F: -v u=$ruid '$3 > u { print $3; exit; }' <<< $tmp ) -+ fi -+ # -+ if [[ -n $ZSH_TEST_UNPRIVILEGED_GID ]]; then -+ rgid=${ZSH_TEST_UNPRIVILEGED_GID%%:*} -+ egid=${ZSH_TEST_UNPRIVILEGED_GID##*:} -+ else -+ print -ru$ZTST_fd 'Selecting unprivileged GID:EGID pair automatically' -+ local tmp=$( getent group 2> /dev/null || < /etc/group ) -+ # Note: Some awks require -v and its argument to be separate -+ rgid=$( awk -F: '$3 > 0 { print $3; exit; }' <<< $tmp ) -+ egid=$( awk -F: -v g=$rgid '$3 > g { print $3; exit; }' <<< $tmp ) -+ fi -+ # -+ [[ $ruid/$euid == <1->/<1-> && $ruid != $euid ]] || ruid= euid= -+ [[ $rgid/$egid == <1->/<1-> && $rgid != $egid ]] || rgid= egid= -+ # -+ [[ -n $ruid && -n $euid ]] || { -+ ZTST_unimplemented='PRIVILEGED tests require unprivileged UID:EUID' -+ return 1 -+ } -+ [[ -n $rgid || -n $egid ]] || { -+ ZTST_unimplemented='PRIVILEGED tests require unprivileged GID:EGID' -+ return 1 -+ } -+ # -+ print -ru$ZTST_fd \ -+ "Using unprivileged UID $ruid, EUID $euid, GID $rgid, EGID $egid" -+ # -+ # Execute process with specified UID and EUID -+ # $1 => Real UID -+ # $2 => Effective UID -+ # $3 => Real GID -+ # $4 => Effective GID -+ # $5 ... => Command + args to execute (must NOT be a shell command string) -+ re_exec() { -+ perl -e ' -+ die("re_exec: not enough arguments") unless (@ARGV >= 5); -+ my ($ruid, $euid, $rgid, $egid, @cmd) = @ARGV; -+ foreach my $id ($ruid, $euid, $rgid, $egid) { -+ die("re_exec: invalid ID: $id") unless ($id =~ /^(-1|\d+)$/a); -+ } -+ $< = 0 + $ruid if ($ruid >= 0); -+ $> = 0 + $euid if ($euid >= 0); -+ $( = 0 + $rgid if ($rgid >= 0); -+ $) = 0 + $egid if ($egid >= 0); -+ exec(@cmd); -+ die("re_exec: exec failed: $!"); -+ ' -- "$@" -+ } -+ # -+ # Convenience wrapper for re_exec to call `zsh -c` -+ # -* ... => (optional) Command-line options to zsh -+ # $1 => Real UID -+ # $2 => Effective UID -+ # $3 => Real GID -+ # $4 => Effective GID -+ # $5 ... => zsh command string; multiple strings are joined by \n -+ re_zsh() { -+ local -a opts -+ while [[ $1 == -[A-Za-z-]* ]]; do -+ opts+=( $1 ) -+ shift -+ done -+ re_exec "$1" "$2" "$3" "$4" $ZTST_exe $opts -fc \ -+ "MODULE_PATH=${(q)MODULE_PATH}; ${(F)@[5,-1]}" -+ } -+ # -+ # Return one or more random unused UIDs -+ # $1 ... => Names of parameters to store UIDs in -+ get_unused_uid() { -+ while (( $# )); do -+ local i_=0 uid_= -+ until [[ -n $uid_ ]]; do -+ (( ++i_ > 99 )) && return 1 -+ uid_=$RANDOM -+ id $uid_ &> /dev/null || break -+ uid_= -+ done -+ : ${(P)1::=$uid_} -+ shift -+ done -+ } -+ -+%test -+ -+ re_zsh $ruid $ruid -1 -1 'echo $UID/$EUID $options[privileged]' -+ re_zsh $euid $euid -1 -1 'echo $UID/$EUID $options[privileged]' -+ re_zsh $ruid $euid -1 -1 'echo $UID/$EUID $options[privileged]' -+0q:PRIVILEGED automatically enabled when RUID != EUID -+>$ruid/$ruid off -+>$euid/$euid off -+>$ruid/$euid on -+ -+ re_zsh -1 -1 $rgid $rgid 'echo $GID/$EGID $options[privileged]' -+ re_zsh -1 -1 $egid $egid 'echo $GID/$EGID $options[privileged]' -+ re_zsh -1 -1 $rgid $egid 'echo $GID/$EGID $options[privileged]' -+0q:PRIVILEGED automatically enabled when RGID != EGID -+>$rgid/$rgid off -+>$egid/$egid off -+>$rgid/$egid on -+ -+ re_zsh $ruid $euid -1 -1 'unsetopt privileged; echo $UID/$EUID' -+0q:EUID set to RUID after disabling PRIVILEGED -+*?zsh:unsetopt:1: PRIVILEGED: supplementary group list not changed * -+*?zsh:unsetopt:1: can't change option: privileged -+>$ruid/$ruid -+ -+ re_zsh 0 $euid -1 -1 'unsetopt privileged && echo $UID/$EUID' -+0:RUID/EUID set to 0/0 when privileged after disabling PRIVILEGED -+>0/0 -+ -+ re_zsh $ruid $euid -1 -1 "unsetopt privileged; UID=$euid" || -+ re_zsh $ruid $euid -1 -1 "unsetopt privileged; EUID=$euid" -+1:not possible to regain EUID when unprivileged after disabling PRIVILEGED -+*?zsh:unsetopt:1: PRIVILEGED: supplementary group list not changed * -+*?zsh:unsetopt:1: can't change option: privileged -+*?zsh:1: failed to change user ID: * -+*?zsh:unsetopt:1: PRIVILEGED: supplementary group list not changed * -+*?zsh:unsetopt:1: can't change option: privileged -+*?zsh:1: failed to change effective user ID: * -+ -+ re_zsh -1 -1 $rgid $egid 'unsetopt privileged && echo $GID/$EGID' -+0q:EGID set to RGID after disabling PRIVILEGED -+>$rgid/$rgid -+ -+# This test also confirms that we can't revert to the original EUID's primary -+# GID, which initgroups() may reset the EGID to on some systems -+ re_zsh $ruid 0 $rgid 0 'unsetopt privileged; GID=0' || -+ re_zsh $ruid 0 $rgid 0 'unsetopt privileged; EGID=0' -+1:not possible to regain EGID when unprivileged after disabling PRIVILEGED -+*?zsh:1: failed to change group ID: * -+*?zsh:1: failed to change effective group ID: * -+ -+ local rruid -+ grep -qF '#define HAVE_INITGROUPS' $ZTST_testdir/../config.h || { -+ ZTST_skip='initgroups() not available' -+ return 1 -+ } -+ get_unused_uid rruid || { -+ ZTST_skip="Can't get unused UID" -+ return 1 -+ } -+ re_zsh $rruid 0 -1 -1 'unsetopt privileged' -+1:getpwuid() fails with non-existent RUID and 0 EUID -+*?zsh:unsetopt:1: can't drop privileges; failed to get user information * -+*?zsh:unsetopt:1: can't change option: privileged -diff --git a/Test/README b/Test/README -index d012277..726d68e 100644 ---- a/Test/README -+++ b/Test/README -@@ -6,6 +6,7 @@ scripts names: - C: shell commands with special syntax - D: substititution - E: options -+ P: privileged (needs super-user privileges) - V: modules - W: builtin interactive commands and constructs - X: line editing --- -2.21.1 - diff --git a/dotzprofile b/dotzprofile new file mode 100644 index 0000000..9203f7e --- /dev/null +++ b/dotzprofile @@ -0,0 +1,12 @@ +# this file is installed as ~/.zprofile for newly created users + +# prepend ~/.local/bin and ~/bin to $PATH unless it is already there +if ! [[ "$PATH" =~ "$HOME/bin" ]] +then + PATH="$HOME/bin:$PATH" +fi +if ! [[ "$PATH" =~ "$HOME/.local/bin:" ]] +then + PATH="$HOME/.local/bin:$PATH" +fi +export PATH diff --git a/sources b/sources index 14a66e3..e248084 100644 --- a/sources +++ b/sources @@ -1 +1,2 @@ -SHA512 (zsh-5.7.1.tar.xz) = a6aa88e1955a80229a4784a128866e325f79a8b5f73c922ab480048411036f1835cbb31daa30ab38bd16ab2a50040eda8f4f1f64704b21b6acc3051b1dbf18d0 +SHA512 (zsh-5.9.2.tar.xz) = 40bb5eb2cf217e6bcff342fcc9314f082a5d8975abcb56897e86eba5839ddf0ec1ac3feed1e797d4c68cea22228197342916f14bb87309bbcc026a87622bc015 +SHA512 (zsh-5.9.2.tar.xz.asc) = 9657c8fef30124e4ea1b4ab41c80b471990c52c362e53f40c9bcca1be1b48af5d19437ecf6a645dbe9ea328d82cc43f9d88ad3835d23d76e482969017a956bf6 diff --git a/tests/tests.yml b/tests/tests.yml deleted file mode 100644 index 3d505a4..0000000 --- a/tests/tests.yml +++ /dev/null @@ -1,17 +0,0 @@ ---- - -- hosts: localhost - roles: - - role: standard-test-beakerlib - tags: - - classic - repositories: - - repo: "https://src.fedoraproject.org/tests/shell.git" - dest: "shell" - fmf_filter: "tier: 1, 2" - environment: - PACKAGES: zsh - SH_BIN: zsh - required_packages: - - expect # login requires expect - - which # smoke requires which diff --git a/zlogout.rhs b/zlogout.rhs index 3e78094..600702c 100644 --- a/zlogout.rhs +++ b/zlogout.rhs @@ -4,4 +4,4 @@ # # -clear +command -v clear &> /dev/null && clear diff --git a/zprofile.rhs b/zprofile.rhs index 03d316f..5e21475 100644 --- a/zprofile.rhs +++ b/zprofile.rhs @@ -2,9 +2,6 @@ # /etc/zprofile and ~/.zprofile are run for login shells # -PATH="$PATH:$HOME/bin" -export PATH - _src_etc_profile() { # Make /etc/profile happier, and have possible ~/.zshenv options like diff --git a/zsh-5.7.1.tar.xz.asc b/zsh-5.7.1.tar.xz.asc deleted file mode 100644 index bfb4510..0000000 --- a/zsh-5.7.1.tar.xz.asc +++ /dev/null @@ -1,11 +0,0 @@ ------BEGIN PGP SIGNATURE----- - -iQEzBAABCAAdFiEEfKfsqvBiFrkPiUFGrPgUbK6Mu8QFAlxXSocACgkQrPgUbK6M -u8SXPgf/Vw+pYfQXAlGy59MsmArJvU+72zP/Q8Cu9gSuLbNZetwR8Zkubibi1rpO -zCFn0Ps9lR565k9ue+wPUtBhZjEPJVjNALdJK5YaKvh6Dir3/nhoVoS4kobJCHad -k8X6ThID8zOwZ3E49n+2AiNxwKkSej6cUKzZ2CSGaZ077GgnY4M8y6ACSdwEp7w8 -f5W9gUMqxawx0PCfsxkoJNdNrWq0V2WAgVql3qqVqSvLzAijFXUqtDEauwHecDkw -5NqWZVHLqJHWHyYImjo/RQnVcGHLCYLSOiHH9duo1VnLsXUNPC9+8yjTRkEte8UA -38bf8N8gmpaI/sG1Z2v12VXqCV3eqA== -=g3Uh ------END PGP SIGNATURE----- diff --git a/zsh-keyring.asc b/zsh-keyring.asc new file mode 100644 index 0000000..da4b17f --- /dev/null +++ b/zsh-keyring.asc @@ -0,0 +1,269 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQENBFwswugBCADdkzua9HwC8Ip5zh7Z0/nJGKbMyq+cobXArhHos40taeidn0+v +HRES5y6PHR+h56c9TpmJEp/bLCHP5pLvcSz/ETz7+Kk82pld63pOHejSxAQCu7Wv +1NwrTu6TyKlZsNG1oZBxx2LkEN6k8Wy+88DlQqZoXOXafmhF+Sms6gv9DXa029sv +B07EehAx02T+b02QwVVG/Pq9austmsTd9EcNcVNRDneD2LcdxCllbS5IamjVa+NW +oeKZVqbsO71uUolwBvshFSBLPsSY8EZdGApjazQcY0lgkaRA/QlMOisyq2mjV6FY +JXHrlI3WWWK2vROjb35AHiHEE/EVgb5RVpxxABEBAAG0E2RhbmEgPGRhbmFAZGFu +YS5pcz6JAU4EEwEIADgWIQR8p+yq8GIWuQ+JQUas+BRsroy7xAUCXCzC6AIbAwUL +CQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRCs+BRsroy7xA5XB/93EQqzs0as07U+ +gmPDpvE7JwIY4TrcvAS7RHgJ4sE+arR5uTziHixiHBQQMedbfV51Jxgws6WL0Ko8 +7K8h9sN2UGnXIc1lWuQ2FDshrcpSHZvLxL4Z7WC3Rj/Dq3/nuZZyljWQNHxg4BlO +EJqe67F5kT2OI591oxB6L1E6F8sVsgxD7gBCPVl/8CsyZ7wkyW/gMRqrlYolJhpS +B5C1zKJzvULQJKXDCh9DUyi7cKFtPyYfYtRWfWhKGz5Dhtt9qvBlxJzZufZ9QNQt +oPhNGF34QaLWTCLRbtoVbNq2NlxalZ5Byhg/0pBcQc2w4C70jSxF3c+2oMEGQIbc +5GJFgLpZuQENBFwswugBCAD5rIYdlLWHOMw+stWTRNquu3SZr+v7RRzreV9fOKN+ +lUiqwicU2uCX39s/q+2wtF536r+IS/53DrMAW8sxf8eroK+MBnJYtP3U8BnB3mag +bTJXMjng2ZqZXvxzetXLyXR+38f+6WbJtV0ByDeFQQJYsFxOag3r6etxrzpwRFm0 +PL440fc0nxOxhxWWJcR0RKTMX87ymipi9mETYeZi7h9B3cDw8aIUz2O3s45TtNlA +NI1MNMU4sAsc5i+w0zJON9gT+rWDYFj6BiEqnRoSK2XDm+WaJa3FwgW1WnHPTe+E +RJFGT58DICU3ta6cCQPavZz/KALyj8GBJ+PydelIAv2rABEBAAGJATYEGAEIACAW +IQR8p+yq8GIWuQ+JQUas+BRsroy7xAUCXCzC6AIbDAAKCRCs+BRsroy7xOgxB/40 +sp9xFq8L/59yRTeXSskOsGk3aUlSnACofcRCGgDSXV5GwWJ/G0O8krhHOISJKuxc +vA0wLFq0WB/EafrKAPTSkrnxmq8noT3c8MpnFRSXHq3sOXkB4nqVEmUu/AAA0TbC +HcwhFQExvK7O+funxIGU5vqHFeQGJ0VcgC/KZUEMNtVV8aZGvn7JzSxEIwHVXGLu +5H7TnNWzLzkzIDVY9IJpTutsc6RMvv6BV8ooWBHSgzmh0MTqEjwNarHAMuffrAjE +zIO3qi0YCaxSDVf2jrWyYpB2QntplmUoubB9s/ngCqVb4A3B7JxPmJuL/0XMUThn +WZLWFpbLimyoUCfHoehZ +=dR/Y +-----END PGP PUBLIC KEY BLOCK----- +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQGNBFG3TRkBDADMoFASLIMP9faxKf/R/rOrZKbBT7ExMXQT9cVjlQLBcjOtb3uv +63NNTbj/fBDoHbgAal4jOrKYQVPa0LDyT7K9mgj+WBhNZObPeDbmbUwCsrwC6y46 +CJokUc0JwtL0Qm1d8dvMgZ6TzO2J/ZRBAB+Bv+W5pVkV+3BifS8mhHLrwWaJD6s3 +Axxl9PPACG1NB5mlItUci7BK+JTI2Bw7whe+gtyuCn/aat4ny6NYgc74PtLz0uS/ +hG+4hFMKvZrPsflEY/H14GK1AutW8DFSjW6A+etnV9OBUemGz+0WoFOjE+AGHbuY +FQZYUcj/WZSVcxyK0GJbTa3/KbcOwqLd+xdIWLBybSboP0TAUelyok+1PLORlZnd +dwvE9cp1hEcEJj/hlmugR7aseG0Fb0txU9x3OnwYaiWbsjk7oLVynlcQGzGe58ID +SfdsA2ywhkuQO6q397QzNDPRnP92g++HZRm+bGl3U0ffk8Asqef5TLMZvURRMy// +8OQFjeMWaYCXlf0AEQEAAbQjRGFuaWVsIFNoYWhhZiA8ZGFuaWVsc2hAYXBhY2hl +Lm9yZz6JAhwEEAEKAAYFAlfjTwAACgkQ3+aRrjMbo9tB/A/6A9EjezO5C8mS5WJa +lz+dZWEeJF/75npCpRsuCO5wuTMY4ac5VlDR0HqBD7JJnR+vfz4Z26ErtyyMZmuu +xxj72efT2y4XiVAWXMrQfSR3pIxyTlnrR65QoOIUXU81+1jDgn/UvKZFDa5uipw7 +fNiNqgQ6OXL1O4kLsbLP9Pr8hreD1Pw0N+FC93La537qDP1bFLPC8Ygie55+YyAE +kWoPg0+6eSm+PI97qqA4roPPHC/srGjDZ9DG4xTwmBu9l3jZWnh9vwzKl15Ai1T4 +rJ5ipH6giR7/uhglBWl0CoqlGuHdyb4eQ6s3lpjHkxTT21vlvji2p0m1C0FB9JLd +lghqqLSCBLm40adJWyBes6bXv45UQK3sYubETCCXnM/c2AtshK+yZRv01Bung53X +aKdqAaPTZyE/HyLemwRCZHOb6WKfXIQdX8bTyoKk9MGllbxKBxs2x5oJG8JHocTN +zBVyUv+BJbgmSn64s+NuCf7XwRRMORmS79oLoykuCHe4D4CD7ZiqBz1ymqyWRUPG +lc8C5T5L/0YNa+5UacFwzphWwt6v2nVkl/wb2UVAt0WIu1Xqzq1ahc2FAnj9qAiS +PEfyGi5oSHzLAP1kQv5tq5MDyi02ZpWgAJGepxSMlj6NREiTf1r50FLk2hJLov+6 +mIYPm8KYy8vLDLOuwEEWJi77PHSJAb0EEwEKACcCGwMCHgECF4AFCwkIBwMFFQoJ +CAsFFgIDAQAFAls530kFCQ1E+SsACgkQpf7uOseTdESZwgv/U5ErAMH2LPM9z8QQ +WaUk4ZNQ3Ll3m+pwQ5/llXraws/9lDlX4Q21MR0e6JEZOUPxBsCQ2/qaAEN3jbWd +pyQX7xuCY+PmTUOOx3c0XTNAB64monM1ZxKYa5sEP6JPqURPEW5tyhoAYUKASuBd +j+ocK6t0IXGCGuF+gNt74qUi6R6L3gyiexMZAtMCpNFd5Nq8zn5E+oEpLIdUnzoi +zCemknlrqZfbSafEjhwp0ye6ci4M5FO+IGQBwuyhfybCNlrUWga19DTaPOFIbs/D +/8pyg3Boc5AhRISqWY0X3xfN/XX45B9iaAzp9gVW3v/NV5pQ7elwEXixChCWbWlG +p7cw3BGisocdpykOpeKuSGurdMfRolfV4QaFJhj+JVsqlduFjJEBnhrqQ3rliGy3 +Jw0igAKYuZWth8acYMpJab18oHNLPQGLvZHziw+0+R5MZbq37GYQ8IpdzcbNMUXY +YrRPRsUmEtFpZ5QjhfTworVo9NHGEHhf3li0nUNMlGfuIzQXiQG9BBMBCgAnAhsD +Ah4BAheABQsJCAcDBRUKCQgLBRYCAwEABQJeNT7NBQkQF3o0AAoJEKX+7jrHk3RE +TZcL/RcoE737pkUWzU+Bv4qvGcwK+EQ3WPWEb9cmCsmBqZ4LRaLP1UZJ7kzuba54 +3QDMuwIm7xy4Gy5Jty3zOEXKzPjKyXIGUTbfADs65QtkOyJOOygbq2i9k0TydCES +v6mMP3HNyUPr9Kxna0dFbHZ69iZGmIBzw3/2NzyNOhh7DLnaVdmRf7QqzpZYsNGC +ADDjyhmPUm46VmsE2EqE/hF26U6A5V6VHIqe2XLGZPrr4FWbE9rc/i1n8pVRoe5e +KYlcAUxjlQ4BxRVsEZwuwznjLprxOUjyM68cJOE8BrpnIAcEU/88HZYsO8DALigy +NxOHkTWO7m5JI+fX9h4+6qAKVKWpa7qWZ85IEaGoWmiTgXdf2P9N8/9cTzEzB53V +ASSZl5z+xQsTx6kn3LKja7OtUDKLGBvfjsDSw1XTmAcFhj1ELQRRXfq38FgBB+Rq +e/qOGW46+c+bSMid02HNCkNipW/klo77LB5qnPKj/yElH49I/P1x4vUYxpUMPgGY ++crstLQmRGFuaWVsIFNoYWhhZiA8ZC5zQGRhbmllbC5zaGFoYWYubmFtZT6JAhwE +EAEKAAYFAlfjTvgACgkQ3+aRrjMbo9tpghAAuik/KT+YThdyNrVq2mz2c9rkzgNJ +bwkt6XQ42AumalTa1WdpvPqisEC88F6xpR/k9uA4nh/C/PLuwDtlSc9ZhBrrlJE5 +uPrkpBKcKiGWYdRFTGtyqxzLBt2MqWb1eWOtBBRjiQkDBoP1h+tHIJHvkr64uoJE +biSlM3CUjK/00bO7oiiZCKyd45tk1FEIZUnyGW2/JdwN9G0XWt7sdcfBxrccCTor +36hrYH0bNKSgwbSlraYdB00lnMRqQIFI6J+rGIHqWPgJn9ZdW8heD7BeYDP3TFPg +ADhvpP5BI7ATi2EBoAHDWyIiFjSXsllmIBq075O23jyfLaLiIY+sGzSs29d2HACA +NyobCqCx9iTufKgayXMO6bk//ic37ACs0cubEVLqHeGUy9PeFxjJPD4iXVbqEuNo +wAmyHtXplNLKGZuAfBcYfhlxcG+yTXQzxb711LI7iA8Ox41GBVToQCgpi8XNlgzZ +Y4e6sP/3uFRNLUm5zbH8KaQFy/HgNfYHWb7i8y8eSu3QGaPv4jiG9eLo2j/iDF26 +3JJeOw777CWNFvcMXwTP4novzVcF9gYnjOcxDojjn3Dxk3kRMEjG5u64t+SiGsTP +j/1fIbK+EX9PdwUH0FWFrq1K0F/4lPYIIUPuxAgN/nEdpURLDQzZ9XjICAZz50A5 +amSZ1f43AbciEVSJAb0EEwEKACcCGwMCHgECF4AFCwkIBwMFFQoJCAsFFgIDAQAF +Als530QFCQ1E+SsACgkQpf7uOseTdETg7wv+MnjKLG+J6mls4SV7dMFakHj4juqv +41tLZj/N6n5dO8Kev9rTU5WCP4vnAPIhL5254qL+tch8md/ztwc5ixj5jIVTVC7N +jZB8lYQx2y+g71Y2JqclzzfeA2rZ7G1CQJMU9DU4gtW9T5rRukk1FfQGXXAs4Ru8 +3aXRYOfEk6lNWtS5bnAbOSP++3tz8y35TxWgVnwqkpu8S9lmSciY/k2NgRtjATmR +9xHFJleHQK8tmJnbUIroN5Hd4wM541m4zl0lQG3fMw8m434IUVLA4v797/Sn1av5 +m23eyXArvTneNGHqkBG0WGuVffEk07KzujV986saCB01nJv+gHQ1OeLSGMRa5zwJ +Q7qkEw8BslfPDR6rkhC5i6B8i/vQENxnDSWeBMQ1gIdi/GpPyHqSssEJSZkT62Kg +94oljDMNEDPjrlSc0bBaHgiArdSdFh5fwLV3zlh/m2yWIqg52ZA2t7AezUpTJH5B +sywDpha2WtDs1BMcM6TdVEpRU/ZKn/MR+jgRiQG9BBMBCgAnAhsDAh4BAheABQsJ +CAcDBRUKCQgLBRYCAwEABQJeNT7TBQkQF3o0AAoJEKX+7jrHk3REBH0L/i+3ZwpV +5Ncju0iV36qCzhqgRyFu/PseNFDD19qc5/JfW3Ts+NriFNGfdR82ocTi3d8RM2XS +crT+lYQXOd72p5OGjmg1LlUb3gqGh3sIw16kJIli/5gs/HwhXrvums7rbJO0eg2q +7uDhGItMlE0DmWOyn+HHWX2WWArlDgQPbncgGXEg92ooLKmy5n/Xr7rK/pvQMlh0 +KEjCxrVtCxntfwdrWjNOIHc9O4NEc2+IZ1DApKlj4FUmHPdSIpAUpqWZt18pTemx +FzU3vO1aArqa7VKnuC6IsqX1fuI3Pn1ofyQclUSi3XjGd/5SEdE61ustCN7vw9gQ +48XFc5Odeefte0Ff0KtOt69w37OxpsUZliZfg1BD27RAGm7lJ1x1nFzXsFl/NHjT +F+t6lwMvtbiyCQNJYiIkHeTYe5npIG73qO5NNdNK8FdwRvJ3yyBqTYtY19xugOtG +iOqKA6fvm4Qdyei3qm/ecmcs319NpoYsLv/6BKlmUvmnMZ3tjXGG7n4EwbkBjQRR +t00ZAQwAt+YcRrbLSY4cZO+T1Z78kb+wtUptyYdsUTjMNa+RqFEginvGWXJi3t9x +HZD2IdwjFWUmnjeTdx8bdikpUedTlG3JrFurPX0xMgkgbC/BELF+4Suj3qHYTBr+ +iMMcZZEaGFMJ4IAHml11Ryka+p9rMVG8bHsCoTRPYyPctNS0b1YG13ZN6qdug+1x +WrgTBBJntQEsnuCw51HZOFAOQTPkLSTpVHTvcbkEbjotXFWx30ysvVHoZpo1gxt5 +XQtPJASDgkofUdHXgcrjCTDTx7AoOSnNArgJUpdKYzaX62PA+jwWKhfQ1+PY+wUC +7iGpmj40FMndzVbtaVKRdlEboTAOGOtDb7o4f02RBK53vJY5ZGtKq6chBE3CzBaW +JcuSd7z6yazx0W5oLptmgGHl1xI5mw1qYE58bK6NoXgLlzki0abyUpng17mMyWnR +kWUi2bAirAaHUkhEG4SeOcd5dvZB4KQWkmGjTGu4513NxAw/uNpXRCu/GUPeS/4d +3ugLUbvJABEBAAGJAaUEGAECAA8CGwwFAl41PtsFCRAXekIACgkQpf7uOseTdER8 +Xgv/SsCCMdABAfNzW9ig+IqaYDej/f1vWkDmJ7segJ+TNOKV7a6tva5/Ao+5M9Dn +U0DIVkOL4jp2h2F+sTS83zgoObb6NJ19NAH2pRiobIdlpbj0rIvQOgp6YpgDlP3d +RQKwqnPSKqpzwDKUXApCUyAQw3xAp2avnVayJHIbm5IiVg8FoS/0YWZwKup+p7qE +CwsAXftRUhYolejz65ZDMz/rxljFPvpBxBZsPZDqFaZzLr+PS7uvcdC8QFMAA9Cv +fLzzhHPmX4Ogu8iKkSmyV+pbxdLxcg13zGz7GTOx4+VXgaA3WNDlU8oj51GX5bXI +ny1jf8GFELDo/b/fog6HrcsGihE5MZzuJZ+ZBXjR2nbWTQoj85jnxqeUlJ0WuXu+ +mdIoCHvEB3Vu+r2Bn2np9w7askduYgk+6afOK06itGUNabLLtAa5M/gK/WOGop6x +O9nQmdz6VoZ5NdA89MlHTV/A+qahGqC23m6Jeto0jPePZkP9RLZLrevm8PtDey3c +eRf9uQIFBFlTfpsBD8C1vBhjCGSYTVxTiRWTENGUgmqDWbUqU2TXkvq3331w90Fr +/S4Jt+v0UQ5p9L0WA9PadKlWF3MjpedttbBYPfXl68B/0hiNnX8PkgP3/I4peX6/ +23AkSJ8mXBTsv+YnzCc0GFqm1Qaf6ZsxQWHpSoNYILTH+Q+7p4dJblpzf51w+UfQ +60iA1yO4Wov3FHZsWrkr2T1akn7dVMvVrrvSHCWG90VHXGB2WQkBkhCN3BhaSMUV +l9K8+XSx4I4rOC1FezItMHgBfW4QyD1HVsF+dZ0sVipqzwbAbJ0jFoX1a3AVEtAW +74dB2KSEd5UsAJ/ZUJV5K3vmfaudWobf8s6/YEdRIow4zphpif/UrxL+I9+RAGF2 +PpY3m3GpJP3sEnL9yXlqp0Kbr+xVuz/ewPWWJR6XJJhMCo8o3lXPFh+sVmc0fdb3 +lceiOJ0Au6lySP4/aZ5HkuRZAaJaLAlep2n5eLwPlNEWzWs+C9StdWNv0phuRumf +DNrqZwPeatydfrCwPCxxe62PzpbTfnvvQ9bVDA6rsW4VyTNVNGskuG5WAlw0GREm +eVtIW5bX864wQruAehyh9JFuM1JrS4FlBitHjN9Wx80eVIqRyqIzVqmYVclUhGHA +lKxGkbsh564FzSxKTaq8wzZNaWiLK3mdJnrXGl5LRbsBrSTCaZsAEQEAAYkDvAQY +AQIADwIbAgUCXjU+4QUJCHtIxgIhwVUgBBkBAgAGBQJZU36bAAoJENsn6ZdCmvIM +cdgPviW9GD4+Ta3+0nSOyYyFmFYET+MjKVShL3xOvpHsa1p9OpiuKKkoAx9o8CqW +dPPFMZJ95QRHeTLQrgt2ytQ3L0e54Qx4goiYKGmDlcq701qUwvPys8/jA3IwS9el +2GBBcpIExrIG+I9h6qDf7IXAkmRAjxI/KgGgEOUDcs5HFRblK+/bEaHjU6BnPvK+ +gB7y0vx1ZCCloW0zPGb9AmsHU9x3NfdrJgrVWchjFA4tGllQbXMzm3aOOgFDZ0qD +K9Hx0a8lrGPksBW7foJrifhTzMcLO14BSPTv/inAl8NpSW6LRpouX66nJhy5KXlK +C/n55LiiKU9+6lV3ba8KcDSzgt/my3tD7myJBh5HOv8fvXhSfmxcFLIZa22eQfGJ +eInu86E9Y0MHzYJ+te9qCaNC0Vay4VdmsC0MoOALacEz3GBvLIyD06cWQjb4ARXs +j6YPW/cp8pzakxerAA+gFDmu7J+RgH+BDVDRu0Uk53gCsnCxaAIWVU5lLAy8/aRp +G3zUPnEwZFT3gCkLkV/2nKlakPupaM2wb9ItIvA4nwYiqk6SAJPKwh5pdqNu3cRD +00RLfFS8OpEzMCi3qWdrTXXvtcutZnyBJeYaS5ORhyR/PNzNkLjNQrO4QxpQGRvK +TFLP8d23YMoXjogCZrW1yHq7ShjdQAZyALRmMQkQpf7uOseTdETSTAv+Jcyg59uI +4b+GjxYhokVfCZN0aBNBd/OrWAk0GOfJsNg20AUm7BTnb76p2pj6MwLvbeBZfQ0j +IMb1NbpJZ9B8faJzbRfBBhs45z9ff2UvyLxfjOjU7rRN3m63yBxMZJLRPgJw1k9n +0AspkkoWqQJwTOC/2VL9xxJZcfG747xBW04k4QeY7Va0HFB8T3nrYf2wWR/KhYSG +JLF8+2HxBGULa6L4rwyUZB3vROgzej3i6zYj5vpDsbDXv87AO6DeiQfn33EEQN3x +TIQxZX7J2ICwD4lZm5xK+IvmIjnQdoByNTO8JQ6Eykg4z5mEwsBjtu5n2QkCOf9S +Q9UodOHwQWZj/N5kEdY/KoygApWbctXrue2VOeFf5MsSWCpnWHsIXOELe8QvSwlD +WPTmUZs0gN/VQjzifiVOQZBYXAInpKak6xIwltBF1gfh/a8byPD84X7BDLxUnFKY +Ew4Gue8eao0HmXpIUm9vWdnFAU0NqLbvVfbqkrzyTRNzNopC44CUfwzR +=KiyE +-----END PGP PUBLIC KEY BLOCK----- +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQGNBGBzXzkBDACjRXUOZGdF/dFBPYxbdX17touhN3T1d00HH73LEpYNny5mY97h +NTE5lQWFQ+eNn7Tx79PZMDepv26mRHMQR6ezI2ahd2TxDCngNGlPcuhsTKgcNRiu +i0nbgB8ssqm/q8YoW+FWJLWfGwTfH38VMP3s3022wUXAMA/gz2FVx1uEFTavC92i +Mhrlg/+4Y9uzq4w4OMIA8QJ5cWIqBH0SzaGEZtthnZRnLRoKh9oXpgMZ4Bv+ofxT +a1qsZ6tNb4n8Wbscv/vYZqn1yOj5XI8ut27ocKuxnoATXOuK3ac54gZYSyI9YFyh +mjLHIMs4qpeDyhMZZRWAp6gfQP4gSAvDGZ/77o7qwV+r3kUbZFlxwz0C96Ul4CGU +SwRJT+PGFy44PAsvUudqLAhr6ndchMN4HM3vBAtngJIEz4YKngtq5OyAZEVEFMDr +H1WJ3/9NEq7jcqmlhEKd5t13FPIE4hfYX2cwLV4BAgcqB4uOKCP/0Ihg14Kd1FoX +I+jgqByM92IQeQ0AEQEAAbQYbGx1YSBsbHVhIDxsbHVhQGdteC5jb20+iQHUBBMB +CAA+FiEEKQALqIepMZD3K20A+1LjaLcLJVkFAmBzXzkCGwMFCQPCZwAFCwkIBwIG +FQoJCAsCBBYCAwECHgECF4AACgkQ+1LjaLcLJVkrZgv+OglxzCYf9dNu3gHlZ0AC +VzwJIrCZoS3IG36iiLsx+d2jYgdTfR3y4jH294mCVsGfoAoava6lun27Q94sMCaH +Ng0fcZfW5uwrn8jW+H+F7mCShpQNUDHDlZx/bkC4JX2jhEZCrqQRRZUYTlteVQpu +44ToiFq78iLs9fz9HFczDzmMmTvKp4r84+6AiFwQy2OGAVbON4EnxIZjEJdVKMqR +8XH3tWuGeqDnBBqXrrS6g7SAh9idlA8JfifkBNFSDM4SiNXJXk1/TumR3w008Dj3 +6gq3W1P0b91gY2VwYAUBeOciSJ02hcT0Sywa1NAkytQA0djECe+wl4Y8Z2nwO4u3 +ZCCNCKVWjtjoo1QUwCyUcQl2vEt7cJdEAfbzr0VH9oaL0trjXz7V7Y0oqkI/XOSI +wa/aTTrvybSKTEIvMIfC9IVjTwn6KMh9x66eiN1CmF6abfnwr7cTn3mbrJ2z0nMV +1OiuU6KahncXixo2XkrUOyZ6OxsVNVGmd/ttn1IVqpvMuQGNBGBzXzkBDAC7puuc +xUyEuxWhwYGuYCQXNeh7mHnYRhd5nFuM8hosaZx+w65RSzJ5UWKIPr6vt1vC8JK3 +r7emy1rPIeuwWCVVpzIcW6kTS+Jd/ZDDYKUdko9rm/rbmHScJF1LsiS1yvVP3l9P +0OE2db+IDqDItDvGcHSWgygR1G1hgPl5cKz14352R+cRYQDacCMlYhg8dFL08eoQ +96ZlLpiRLox0X3HFWih8ZyhQF/uO5cKjzEaeRnrL9vVne3BNVTaNTsUoHPvVQUJf +H/X8CR/L8B6E1sDa2KWcRhObhTaTeUUFsjqmWkiOIDRdd29JELDCD0O+tR28w+WK +8XwV+/2bV/49g9DVCWCHD6KxscTzOgspUKaNM2y5I5FZQVT3UYpu6GCJL46QVsJZ +j342tGuSzEKH8MHNikJC0vg2r7MnH8ogkcJ7MVEvF5aVy+WC4f0Ciz1Tjl+RShit +e71PeswQ6r5lFtWvanDQgB/UBfvKTwwA3qHQXe6sr0nvJO28QdD2Bo5NaIkAEQEA +AYkBvAQYAQgAJhYhBCkAC6iHqTGQ9yttAPtS42i3CyVZBQJgc185AhsMBQkDwmcA +AAoJEPtS42i3CyVZ6qQL/AqvaxPKKPfUQynDlWt313rqzCAls3MD1L8B9Ya/L/4Q +JgaEsJAwW9SkSkUneB4HT6H4zqZC7NF7iXGt3akm+tGMsgQ1t41X7Ac8p9nEtNfW +SX2SvtGgyFhi3qCJI1v2eEEI06e4m0K/O1l+w6UCwDFgMkxUsP6yRYJ5o6N0MalA +OElJQkND6rni4rBDUo4Q7RDfgNVRMAXEcKXV08I4veykfmk5sAD+Trb2bYSfp+uA +Dve7V9AzwlV7cSfaA4otJKk3uIt/M8xTc3cgh48Jg3ppywntiBWmzIL2JPS/0kBZ +id3Mu8a7Yz3cjv5sY7OksjsjuIxTCHycxFZbi0QxT/QtW6CItGDrKuCKr674Q9wO +cwnwDI6nW1zHsTjDFzaBYcFu7PHIqXd2aZkNWnc9iOQOHxLatTYKyDvzRyXuOAQa +APc+Fy/7VI7pJk64rkoRqzAhp0Bh/8DXmKXmA7CuWTY8wiFA0YlCLQnVebgZ/ALm +0mWkrhYxYrQKM6kywpFS6JkBjQRn++XUAQwAvRy/Pg/FrWnzF2Ch024gwdP9bcdt +FMc7KaTTgSHI+11axQ6IcgCaL7fNYQAk/f3zzhVcVWha72K+4/vDcl/jSDrBAiMD +V0ylwvz6iwowpXX6A427SSSl1FpeR/sV0RxSTsxVwROh3oiYWbmW5J5P0rtBhuxd +6oS6xP2OSYjOEbharxiSu9TyvhVuOadlF23VsaQyeZk4EB8+9Uf7uJsOuov5GUT3 +eDYnWgKoLofx/vzJupN7qhqoPVMDQO3n/L10SFuRiiXbvxRHvvD02hhnyjX+CUIN +L/lr1lIvoP0aKE1mJNilcBmnSpMkUS58Ip6XGBuwBiTv+CQQFHYefrDaBRgKXPyS +Zhi4RQAIUaGFFiGFdwtPgciPPt1fPHjERLhXwjwDa0fr5awtdlHm9k4wQOl/8uS1 +Lr07kns3NgHBfUGX8N5/D9PnKsgI1MuBl6ivLbOZOq3MvfdPkxBkWeYX4Rbp3bib +Iy2jR3os8h+X2+xCIEPgrLm1hO3zd++5UlYHABEBAAG0J0VyaWMgQ29vayA8aWxs +dWFAdXNlcnMuc291cmNlZm9yZ2UubmV0PokB0QQTAQgAOxYhBAqpRa0v2M873QkW +7iOJmTGQ3bLOBQJn++XUAhsDBQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheAAAoJ +ECOJmTGQ3bLOHY0L/02/2/N6+LAAAX2A2/JhFqMlPlempsZDhQg4sgaUpwZqlSnx +ZFUkOpNFG7UiGKZ3Za2lj+WbwSaVWgQhsuuhURel4m2SWy14yi6GFEnW6z2vW82c +lpEt2cDvG3q8wWFLJzZNIwoyuhhKNUx4HvEWZpzP02Nd0desv0/a+fjQk2Gq+kFn +U3g/YR2jr3FvTtregGBvafqEnDkLA52o6P9i6d+jarSX6fWtAM4/32aMNqe4KIxU +GYVlXdGe4C52SGwe7tvzBFjz+NX7FQnGbPsE/4IzX/wAK0JR2/OdlaK6YYdBT5VF +c8BIDmADu08DUjE9EdzumNKYArlrhl/AoXPkuagYZm9dmx9nf/3PdDEq6Y+gC+F3 +831+9hrAmeuANHFUCmYV+flm9Pgob5Dd3kc50dOJgeuuu9ki/iEOu3kgvC53Ng9R +aJQabsMAxG7FoKohQGFFcZn4UW/0iTq1ObG2KU6A4TJoirfyjRO+e9yRUIqvAH4j +e4JrCMvYHwSyO4SBGbQYRXJpYyBDb29rIDxsbHVhQGdteC5jb20+iQHRBBMBCAA7 +FiEECqlFrS/YzzvdCRbuI4mZMZDdss4FAmgRg9ECGwMFCwkIBwICIgIGFQoJCAsC +BBYCAwECHgcCF4AACgkQI4mZMZDdss6YXQv9H8cKyrdT+xuPwcTbosxElFkl7IP0 +fM5P7GwOBgm6EjoUDqIgAYPyHPhvpRX7m6+4chqqG/glJ03T4MhgyY47X8+gyW2C +GmYKK0UGhxOGUuxphrw09KwdPpZ33sknkr55gfs0ZNhk38aVYhigtbTW7Y5b1U6k +phNTAkAywbNLkSyainYKmFPncHWxd+FBvRzKjmtV90GlAFENVPyQm6AofBkPsxNI +GlbESZZUe887J+GTWW+2go28bJwaWkDoUUMw8cNIuucztfa4Iyn5K0G0bzNEeaoF +a6J+cwdHGQKiScyEzU+5wN+WFlclhg0FiKM0ca/r1KUJaGC5vuB5jH6pnVjF8TtN +OWyV7UazPSOU87AMv7I/N9Z9dSOPSp30u7R/LyzcbGjFJv0BSJFx9veuh57Yof6c +m7IM2AytEudhCwyuSIwM5DFKSFqxXwHA4c0PM735sGvFTzU6cRaq5/ghJFNb8q0O +K6+XyVGlYnVaSKT45gjDEzIZufcRxi5j6gOUuQGNBGf75dQBDADxDCI9E8MqlyJr +PSQenIjeI1hGnQHXxnKMbfX32QjTPu9+BkM0Szv9yZIQ5txTMTOwA62BQUiJWxn5 +4iYGDHOIuOy86kZ+frgFgrYi7ie6s+zv41I6yNTu/VmUVwOvVaCLPIQ7PA5UeXGE +qbPtG2BegyJLN9wlI1/inZYee/D2Sv9AsnMO3+Xfag6U+LWd+WDt0itiZsIahHHX +wyQBTPJKtDi+F0J+D07Yxv9bnI88h6FQlXTnS8N+vaJtcNUE91qWCoLzu4eC7QxO +nf1BaUrpXiQXUGyQwGem7i7ESjFAEFXVKHDmLOk0LzTymT6zWW09ywjaoPbzfpgC +XGHIT4wpb0+szSrZaoADB5hNMgtpZXi65a4C+N55qd/QgZdgTRVlfNot5y9+mKq7 +UreAgh/STkNzZMm4c6hE5SohYPAXvVe47Iu5vPoXYWjNWftxS3xYexiLwEWGsKDc +gGzE1z0a3vP/75Jwei+1VPS+yYub6xb2fhcJ/OMIWgJKqsQ2e3MAEQEAAYkBtgQY +AQgAIBYhBAqpRa0v2M873QkW7iOJmTGQ3bLOBQJn++XUAhsMAAoJECOJmTGQ3bLO +aWQL/R4uQ2rXyQK2xHbgH8UfT5AaGXwnPkGzRRxNd6crNl3QpCyvk+rpNuszRHeI +1D0HK4wtupROB0kYwjVbGZ0kaj7ZLCLwAdAI43eO/V6MEpo08TdPay/3S0yF4HsL +YEnGEMjvxhLFi5PsBwejtv9hMaWj84oBHAW8w9a5jPPupQhlNjazLAooUP4+neBY +/cuzNda+3ujOB4En6Md4FamDUDuYEbLxw1bJbvxCLErCMtYwktHZ/Fq7L/Ys02V1 +Jbhi0SAspNn6c09FVT2F1quItIuruoG6dNeFxuVV0p1/QBstU5EXS3paJm0rZnym +a4xv79sJ7ZCxcJ0yfpT0EP6LKyJ9nL9koiWDMWYRjTlNzIaWgsXV6Ka86ZJm139i +IB2RgqMrnQy45DIFgevvsXuFX5Ey8mCYu+YyqosZZGuPIU8hrcm0zoLjyuDsSOzu +Ay+pen1zbjyXGQZVN9tvRxizAa/3qL7AdilnlZNJKOiCXTGEiSGaKGibfseTWoWs +Qg719Q== +=+Fbc +-----END PGP PUBLIC KEY BLOCK----- +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQENBFZWC4cBCADgb7/oPoCs9SE+/jrzmDT7L+PbYLCygCExxp4mt3CsSzn5xefq +NGU+aBJnvyongcsYrW173GumDjXCG3GBtnmqs3dFeoqnEsSZFMYiQ4ctmWh48P+W +uQVQOWuh0CVS2OCFn37b5F9dy3oF6gJFdqbwOXJSgWMA/+StMGSkslTYFlG/JwZ1 +csk9jSwQw/yKDlTiFaqMwIwSXTK5fItSn3F0R+usgMhwRPu8gvK23tmEhnnwgmlR +xfEwJCLqGnvlW74dRkCjY349GAG1IN2felFfHn0ok/Lbx7coKRoEvHaCVbmtPSmX +Ps9axAV97wk37wS1dhEXcjxLb9GIZgptgo7DABEBAAG0LlBldGVyIFN0ZXBoZW5z +b24gPHAudy5zdGVwaGVuc29uQG50bHdvcmxkLmNvbT6JATcEEwEIACEFAlZWC4cC +GwMFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AACgkQpx2anUvbJ7NtaQf/RQ/RLvOG +iI4XJp/C9JIVHfHL7I801uT8V3y/d2+DehFasR9T+6B/Mf5y22NI31i5XBQuK0Wo +Zsi7F3bhNHyeVgO/p5JLBmxohByjL9f7B+k9Tt/DyWh66AVaCoam4ACR8TBOlNkD +p/8U0zzrxE9fQrjjK/PzhpVe97LKScEAu2Zc/qUFp4eTAnlqyosTqvU64+n1PrNC +CtZVYPnL17GCC4+S7yrh34Kllx+fkoHimTL/cUG+6+7sbmpUImpP+pgNEnL1IzBB +ajZRl1581McMGhIH1TBYrEVnIhononoOO7qr1eahUCEhVvanyVTnSeTTVR0VgK4s +joYLwDLM4XidgrkBDQRWVguHAQgA7JTI0botnBMfTAGff4Duoor5m0PuExQFCHcJ +/df5SyUUskycMlGR73+IbcT2D/zBIFDv5ZhCdOdmIW3CHICK+Ws7N5+KSzlzC+Vf +2LMmXuyJLhXeTqXI1ta6bIGjXeh5VA9Jd7B8dRQhCn1OrGbFhwtJSGejTmcWiLJW ++2GV9s44e9MlscMHvAk9QAvqrSUJoAkN3OCdgjcpDNVT8ek3NnjCD4xrBTxCcI1n +KsJeOgNHPkbou9+eHY80amkAkRn2ZSI9n25WjhKAp9QGDNL5wqHLjgHP6WiEwumN +DWPnPd+5FQHQXy1GHgH2BozfT1KZJ012T0Keuk/hnZJ/TVe4gwARAQABiQEfBBgB +CAAJBQJWVguHAhsMAAoJEKcdmp1L2yez1T0H/jitvgACci+5PQG1djYwioQIui4J +1nSg4HxW+4SCpSwlmH2LkKaF3WbjpPTRhYeMZ5zdOvGnjPUZCjGtWkWx0p+Jrpe/ +QIC3CNXerX9fpkr0K7+knqkb1RsjHU/YSsYTDDVJpL3BQOZzVocOjPa1YPTfTBU5 +tsQdA4RORi15LyAWcEAmR+X3qH2JM5pGP23hhOKnrFSSnfBP6ef1/jjRbfK5yItZ +5DOf6i3WS40zxB67dlBlHZwOQuYA3Sr01hEz4CeAkpV7lQ1gKelm1ZmcFQI6yqcR +PmVjIuxE1A/gTFe6LaAfCGA6/H1H6LLwWQ/rnUi/seMJ6aRkz/05dg7j5+E= +=wOVS +-----END PGP PUBLIC KEY BLOCK----- diff --git a/zsh-memcpy-sigsegv-bracketed-paste.patch b/zsh-memcpy-sigsegv-bracketed-paste.patch new file mode 100644 index 0000000..5310b19 --- /dev/null +++ b/zsh-memcpy-sigsegv-bracketed-paste.patch @@ -0,0 +1,83 @@ +From b258cb7816323050d7e485171c92ad3f1046799e Mon Sep 17 00:00:00 2001 +From: Mikael Magnusson +Date: Fri, 17 Jul 2026 22:53:21 +0200 +Subject: [PATCH] 54985: fix crash with bracketed-paste-magic and undo + +In particular, fc -P/-p didn't interact well with undo. Make sure we +store/restore histline across those calls. + +(cherry-picked from commit 7708d466dfab8dd29f9ae5de12c74af37bf99a4d) +--- + Src/Zle/zle_main.c | 8 ++++++++ + Src/hist.c | 7 ++++++- + Src/zsh.h | 3 ++- + 3 files changed, 16 insertions(+), 2 deletions(-) + +diff --git a/Src/Zle/zle_main.c b/Src/Zle/zle_main.c +index 44ee63d..817e605 100644 +--- a/Src/Zle/zle_main.c ++++ b/Src/Zle/zle_main.c +@@ -2168,6 +2168,14 @@ zle_main_entry(int cmd, va_list ap) + break; + } + ++ case ZLE_CMD_GET_HIST_LINE: ++ { ++ zlong *p = va_arg(ap, zlong *); ++ *p = histline; ++ ++ break; ++ } ++ + default: + #ifdef DEBUG + dputs("Bad command %d in zle_main_entry", cmd); +diff --git a/Src/hist.c b/Src/hist.c +index f58db23..85f329c 100644 +--- a/Src/hist.c ++++ b/Src/hist.c +@@ -226,6 +226,7 @@ static struct histsave { + HashTable histtab; + Histent hist_ring; + zlong curhist; ++ zlong histline; + zlong histlinect; + zlong histsiz; + zlong savehistsiz; +@@ -3846,6 +3847,10 @@ pushhiststack(char *hf, zlong hs, zlong shs, int level) + h->histsiz = histsiz; + h->savehistsiz = savehistsiz; + h->locallevel = level; ++ if (zleactive) ++ zleentry(ZLE_CMD_GET_HIST_LINE, &h->histline); ++ else ++ h->histline = 0; + + memset(&lasthist, 0, sizeof lasthist); + if (hf) { +@@ -3898,7 +3903,7 @@ pophiststack(void) + hist_ring = h->hist_ring; + curhist = h->curhist; + if (zleactive) +- zleentry(ZLE_CMD_SET_HIST_LINE, curhist); ++ zleentry(ZLE_CMD_SET_HIST_LINE, h->histline); + histlinect = h->histlinect; + histsiz = h->histsiz; + savehistsiz = h->savehistsiz; +diff --git a/Src/zsh.h b/Src/zsh.h +index 8fab0eb..32302ec 100644 +--- a/Src/zsh.h ++++ b/Src/zsh.h +@@ -3244,7 +3244,8 @@ enum { + ZLE_CMD_REFRESH, + ZLE_CMD_SET_KEYMAP, + ZLE_CMD_GET_KEY, +- ZLE_CMD_SET_HIST_LINE ++ ZLE_CMD_SET_HIST_LINE, ++ ZLE_CMD_GET_HIST_LINE, + }; + + /***************************************/ +-- +2.55.0 + diff --git a/zsh.spec b/zsh.spec index 22c7ade..8ceb62f 100644 --- a/zsh.spec +++ b/zsh.spec @@ -1,46 +1,43 @@ Summary: Powerful interactive shell Name: zsh -Version: 5.7.1 -Release: 6%{?dist} -License: MIT +Version: 5.9.2 +Release: 3%{?dist} +License: MIT-Modern-Variant AND ISC AND GPL-2.0-only URL: http://zsh.sourceforge.net/ + Source0: https://downloads.sourceforge.net/%{name}/%{name}-%{version}.tar.xz -Source1: zlogin.rhs -Source2: zlogout.rhs -Source3: zprofile.rhs -Source4: zshrc.rhs -Source5: zshenv.rhs -Source6: dotzshrc +Source1: https://downloads.sourceforge.net/%{name}/%{name}-%{version}.tar.xz.asc +Source2: zsh-keyring.asc -# make failed searches of history in Zle robust (#1722703) -Patch1: 0001-zsh-5.7.1-zle-history-avoid-crash.patch +Source3: zlogin.rhs +Source4: zlogout.rhs +Source5: zprofile.rhs +Source6: zshrc.rhs +Source7: zshenv.rhs +Source8: dotzshrc +Source9: dotzprofile -# drop privileges securely when unsetting PRIVILEGED option (CVE-2019-20044) -Patch2: 0002-zsh-5.7.1-CVE-2019-20044.patch +# https://sourceforge.net/p/zsh/code/ci/7708d466dfab8dd29f9ae5de12c74af37bf99a4d/ +# fix crash with bracketed-paste-magic and undo (rhbz#2484692) +Patch: zsh-memcpy-sigsegv-bracketed-paste.patch -BuildRequires: autoconf BuildRequires: coreutils BuildRequires: gawk BuildRequires: gcc -BuildRequires: gdbm-devel BuildRequires: glibc-langpack-ja +BuildRequires: gpgverify +BuildRequires: groff +BuildRequires: hostname BuildRequires: libcap-devel +BuildRequires: make BuildRequires: ncurses-devel -BuildRequires: pcre-devel +BuildRequires: pcre2-devel BuildRequires: sed BuildRequires: texi2html BuildRequires: texinfo Requires(post): grep Requires(postun): coreutils grep -# the hostname package is not available on RHEL-6 -%if 12 < 0%{?fedora} || 6 < 0%{?rhel} -BuildRequires: hostname -%else -# /bin and /usr/bin are separate directories on RHEL-6 -%define _bindir /bin -%endif - Provides: /bin/zsh %description @@ -53,7 +50,7 @@ mechanism, and more. %package html Summary: Zsh shell manual in html format -BuildArch: noarch +BuildArch: noarch %description html The zsh shell is a command interpreter usable as an interactive login @@ -66,8 +63,8 @@ mechanism, and more. This package contains the Zsh manual in html format. %prep +%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}' %autosetup -p1 -autoreconf -fiv # enable parallel build sed -e 's|^\.NOTPARALLEL|#.NOTPARALLEL|' -i 'Config/defs.mk.in' @@ -76,9 +73,6 @@ sed -e 's|^\.NOTPARALLEL|#.NOTPARALLEL|' -i 'Config/defs.mk.in' # make build of run-time loadable modules work again (#1535422) %undefine _strict_symbol_defs_build -# make loading of module's dependencies work again (#1277996) -export LIBLDFLAGS='-z lazy' - # avoid build failure in case we have working ypcat (#1687574) export zsh_cv_sys_nis='no' @@ -92,10 +86,13 @@ export zsh_cv_sys_nis='no' make -C Src headers make -C Src -f Makemod zsh{path,xmod}s.h version.h -make %{?_smp_mflags} all html +%make_build all html %check -# Run the testsuite +# avoid unnecessary failure of the test-suite in case ${RPS1} is set +unset RPS1 + +# run the test-suite make check %install @@ -110,17 +107,18 @@ rm -f $RPM_BUILD_ROOT%{_bindir}/zsh-%{version} rm -f $RPM_BUILD_ROOT%{_infodir}/dir mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir} -for i in %{SOURCE1} %{SOURCE2} %{SOURCE3} %{SOURCE4} %{SOURCE5}; do +for i in %{SOURCE3} %{SOURCE4} %{SOURCE5} %{SOURCE6} %{SOURCE7}; do install -m 644 $i $RPM_BUILD_ROOT%{_sysconfdir}/"$(basename $i .rhs)" done mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/skel -install -m 644 %{SOURCE6} $RPM_BUILD_ROOT%{_sysconfdir}/skel/.zshrc +install -m 644 %{SOURCE8} $RPM_BUILD_ROOT%{_sysconfdir}/skel/.zshrc +install -m 644 %{SOURCE9} $RPM_BUILD_ROOT%{_sysconfdir}/skel/.zprofile # This is just here to shut up rpmlint, and is very annoying. # Note that we can't chmod everything as then rpmlint will complain about # those without a she-bang line. -for i in checkmail harden run-help zcalc zkbd; do +for i in checkmail harden run-help test-repo-git-rebase-{apply,merge} zcalc zkbd; do sed -i -e 's!/usr/local/bin/zsh!%{_bindir}/zsh!' \ $RPM_BUILD_ROOT%{_datadir}/zsh/%{version}/functions/$i chmod +x $RPM_BUILD_ROOT%{_datadir}/zsh/%{version}/functions/$i @@ -160,11 +158,112 @@ fi %doc Doc/*.html %changelog -* Tue Mar 03 2020 Kamil Dudka - 5.7.1-6 -- improve printing of error messages introduced by the fix of CVE-2019-20044 +* Wed Jul 22 2026 Lukáš Zaoral - 5.9.2-3 +- fix crash with bracketed-paste-magic and undo (rhbz#2484692) -* Mon Feb 24 2020 Kamil Dudka - 5.7.1-5 -- drop privileges securely when unsetting PRIVILEGED option (CVE-2019-20044) +* Fri Jul 17 2026 Fedora Release Engineering - 5.9.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild + +* Mon Jul 13 2026 Lukáš Zaoral - 5.9.2-1 +- rebase to the latest upstream release (rhbz#2499540) + +* Thu Jun 04 2026 Lukáš Zaoral - 5.9.1-1 +- rebase to the latest upstream release (rhbz#2483668) + +* Tue Mar 24 2026 Lukáš Zaoral - 5.9-20 +- fix segfault in _IO_putc (rhbz#2449939) + +* Sat Jan 17 2026 Fedora Release Engineering - 5.9-19 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild + +* Mon Sep 29 2025 Christoph Erhardt - 5.9-18 +- Add completion support for dnf5 + +* Fri Jul 25 2025 Fedora Release Engineering - 5.9-17 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + +* Sun Jan 19 2025 Fedora Release Engineering - 5.9-16 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + +* Sat Jul 20 2024 Fedora Release Engineering - 5.9-15 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + +* Mon May 13 2024 Lukáš Zaoral - 5.9-14 +- fix zlogout when ncurses is not installed (rhbz#2279741) + +* Sat Jan 27 2024 Fedora Release Engineering - 5.9-13 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Wed Jan 17 2024 Lukáš Zaoral - 5.9-12 +- fix segfault in deletefilelist (rhbz#2245462) + +* Fri Dec 8 2023 Florian Weimer - 5.9-11 +- Fix C compatibility issue in the configure script + +* Tue Nov 21 2023 Lukáš Zaoral - 5.9-10 +- fix FTBFS caused by texinfo 7.1 +- fix build of the PCRE module + +* Mon Aug 21 2023 Lukáš Zaoral - 5.9-9 +- port to PCRE 2 (rhbz#1938979) + +* Sat Jul 22 2023 Fedora Release Engineering - 5.9-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Thu Jul 13 2023 Lukáš Zaoral - 5.9-7 +- Make zsh/{tcp,zftp} compatible with full RELRO (rhbz#2212160) + +* Wed May 17 2023 David Cantrell - 5.9-6 +- Update the License tag to use SPDX identifiers + +* Sat Jan 21 2023 Fedora Release Engineering - 5.9-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Fri Jan 13 2023 Timm Bäder - 5.9-4 +- use 'int main()' in test C-codes in configure + +* Mon Jan 09 2023 Kamil Dudka - 5.9-3 +- do not use egrep in tests to make them pass again + +* Sat Jul 23 2022 Fedora Release Engineering - 5.9-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Sun May 15 2022 Kamil Dudka - 5.9-1 +- update to latest upstream release + +* Sun Feb 13 2022 Kamil Dudka - 5.8.1-1 +- update to latest upstream release (fixes CVE-2021-45444) + +* Sat Jan 22 2022 Fedora Release Engineering - 5.8-9 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Tue Jan 04 2022 Kamil Dudka - 5.8-8 +- prepend ~/.local/bin and ~/bin to $PATH for newly created users (#1900809) + +* Thu Nov 25 2021 Debarshi Ray - 5.8-7 +- Overwrite PROMPT only if it's set to the built-in default (#2026749) + +* Fri Jul 23 2021 Fedora Release Engineering - 5.8-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Thu Mar 25 2021 Kamil Dudka - 5.8-5 +- complete file arguments after rpmbuild -r/-b/-t + +* Thu Jan 28 2021 Fedora Release Engineering - 5.8-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Wed Jul 29 2020 Fedora Release Engineering - 5.8-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Tue Jul 14 2020 Tom Stellard - 5.8-2 +- Use make macros +- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro + +* Mon Feb 24 2020 Kamil Dudka - 5.8-1 +- update to latest upstream release + +* Fri Jan 31 2020 Fedora Release Engineering - 5.7.1-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild * Fri Jul 26 2019 Kamil Dudka - 5.7.1-4 - make failed searches of history in Zle robust (#1722703) diff --git a/zshrc.rhs b/zshrc.rhs index 5b3b92a..82dc213 100644 --- a/zshrc.rhs +++ b/zshrc.rhs @@ -8,7 +8,7 @@ #setenv() { export $1=$2 } # csh compatibility # Set prompts -PROMPT='[%n@%m]%~%# ' # default prompt +[[ "$PROMPT" = "%m%# " ]] && PROMPT='[%n@%m]%~%# ' # default prompt #RPROMPT=' %~' # prompt for right side of screen # bindkey -v # vi key bindings