commit: 666f5a08663cbcea9577196b6ed8233f75753b16 Author: Tomáš Mózes <hydrapolic <AT> gmail <DOT> com> AuthorDate: Wed Nov 11 19:37:16 2020 +0000 Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org> CommitDate: Wed Nov 11 22:35:44 2020 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=666f5a08
app-emulation/xen-tools: add security patches, drop vulnerable Closes: https://bugs.gentoo.org/754033 Signed-off-by: Tomáš Mózes <hydrapolic <AT> gmail.com> Closes: https://github.com/gentoo/gentoo/pull/18226 Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org> app-emulation/xen-tools/Manifest | 6 +++++- app-emulation/xen-tools/files/gentoo-patches.conf | 10 +++++++++ ...4.14.0-r2.ebuild => xen-tools-4.13.2-r1.ebuild} | 25 +++++++++++----------- ...4.14.0-r2.ebuild => xen-tools-4.14.0-r3.ebuild} | 17 ++++++++------- 4 files changed, 37 insertions(+), 21 deletions(-) diff --git a/app-emulation/xen-tools/Manifest b/app-emulation/xen-tools/Manifest index 77c0db9f600..47ebae23498 100644 --- a/app-emulation/xen-tools/Manifest +++ b/app-emulation/xen-tools/Manifest @@ -1,13 +1,17 @@ DIST OpenSSL_1_1_1b.tar.gz 8384386 BLAKE2B f720ee2bb1ba9a104334cc39988942b5f18e9df54ec114969983e013d1d5e766e2605237281dfbd7218523b0f64ed465238d2da995791c4a789cb5e20b2d9be3 SHA512 f09f07226c1ea7d903d65572f6c63e1dd8afbbe4789438572ccae3c31445c30cf353dbf2e7637ab9d1042a2dc221cacdbed6167e881c1a1ad40163f751a33b28 +DIST OpenSSL_1_1_1g.tar.gz 9975550 BLAKE2B 22efa4ffe5d56a861bc4e2e1bc9a558e79265a3789acd9ca65d0a1162a1808a089a92a234e88c951f2a3cdabd3b1908ac7fe6d5f2b5fe554f229a22c11ab185b SHA512 bc8d24d7fc93542a8d77e13a57768de242ef679ef4db93c1b6b981a15a60646a5c5d869d066248448f3eb1ab2012e3ddc80bf301f486c0574d469a3f7db7b8d4 DIST berkeley-softfloat-b64af41c3276f97f0e181920400ee056b9c88037.tar.gz 148741 BLAKE2B 72014022926b636147e202d74c42df2ce9cfed00b91c275d5b2e0afbc5c68765445cbe7ac6389d7c2512bd1d45b0e16e999936552d09bbc733ab66c92968bd31 SHA512 8420c29faa7ff57e06d6758b03e81ca0630c59946bc031e8611f1449e23634cf901b502161f2c1423c0cff949b5481445e36a3aa53dc885b61ca2c673b3ba567 +DIST brotli-666c3280cc11dc433c303d79a83d4ffbdd12cc8d.tar.gz 23855739 BLAKE2B 7406ec5b29ac66afbcd7c1376bb3208f298d19b6592b2869c52173aa64947d58bd443f9a61c67deaf046be910a0e31c0b843e5508e97e0e1f5e7bce100d86904 SHA512 df8e90562c4fd7f0e787949df6bc4f5a165b39bd333f442d27874fe65640fbba268f9350d7113e6761a5acceb66d78e75f1a296e5a89b94574edf28109cdc812 +DIST edk2-06dc822d045c2bb42e497487935485302486e151.tar.gz 13192042 BLAKE2B 81afa7fd5f6f14fff35baa3c6c64583fa21c7b793ed847a3362fd05a926bb4402db911f9f78f4ffd76a6de9b815171dfa245ae41afac3b022cd108597e8c1ac3 SHA512 a032a1496db7ddc32a7d6d1a7d5fe4122ab43b13547ec019855166d785f162268ad82ceb3c41efafe1687e73fc72599ee6852741652451e1cb329fd655c69b6c DIST edk2-20d2e5a125e34fc8501026613a71549b2a1a3e54.tar.gz 14567879 BLAKE2B 381d47674afcc7b611edee91531694a70e6799c2b351d81632777fb382a8cce968e44a1f3e17c4852db28e81624e2ec1ebb98ed121c2a6cc3f2982939eb546a5 SHA512 1a4b4d8eacd495e705fea924b16640d6814fba7ec25a3153222eb981d43b0fd9b16b54baf8feecf99cd89b10f7735ff4b075660453d0fc2722fe4608353c8aeb DIST ipxe-git-1dd56dbd11082fb622c2ed21cfaced4f47d798a6.tar.gz 3810726 BLAKE2B b95266ec7fcee5c27065ba999b023ded9eb42a3690555e626911493f1dc995927fa67071bdc6432b3995df82134f8c49ea0d72eaf407f455dd1e2675d5b8d844 SHA512 8120696ba6d79fd9189664deed9b0489825d8d1edf7b931023b3979b7b9f82248e5b808c4517036cd40a85442ddf51a8dcad3b05d7f3c3cc6650654d53da4050 DIST seabios-1.12.1.tar.gz 613450 BLAKE2B cb926b650c41a9962db407945cb5b6558079b061bd61f32ea56aedf0d37a00d10ad4434acbe717ffbc0dd1d1c0767304af8e640a53b0fc3784969dfa1590f681 SHA512 58755ce842adcb99c0f2f3ebbf9ec6d4a5072753966ab46805a96db1570847b109a90e6e03d61f9088ef877ca8ba96a8006777dc38ec434fce6b487f6c1f91d0 DIST seabios-1.13.0.tar.gz 620952 BLAKE2B 460a7dd2b2775b981bbd890ed0a50fe905794c68b0b895799667dd1378bb84125712330c2f6945112709d42cfb7b01196c7fff99051e44b6211d47d19531cfae SHA512 7f158badf7deecc2998eab2a08f3615dfe5a7c0a51323f7b4568a4d1280935bc32bb466c8226d87d2ca7e13f9f117ff0092befcc0699bc31c5018e84754e8393 DIST xen-4.13.1-upstream-patches-3.tar.xz 87056 BLAKE2B 01d7133b8f7e3c9a42b9771dcb7739777f79f229941114cce70ba2897dd52bf53f08de35602a0b40a120fc155c274dbf91e107856f4afdae2c4f7b4bc0a67cdd SHA512 d67e9ddfbf27dc5a23a77679b1b2524a49c2aec3ff9eb3472f9e075893d87401f8e99707b0652744eb4af7a3ed9a815c3925de49995bcd7c82d97c13a69b5309 DIST xen-4.13.1.tar.gz 39024612 BLAKE2B efff138699fac2c14fad2e0dfd4535ebd744577df3dddccc2a589b81a76f24fc81c75e295f4cd33ca2e820929417b22d714504b576cb0737a563037bd56b6a95 SHA512 b56d20704155d98d803496cba83eb928e0f986a750831cd5600fc88d0ae772fe1456571654375054043d2da8daca255cc98385ebf08b1b1a75ecf7f4b7a0ee90 +DIST xen-4.13.2-upstream-patches-0.tar.xz 15404 BLAKE2B e4f679e4281e4edfe4f1e7722c19a973461b9a6423828f17719dfd766a73ef61a74b1cd87f375e2b0c2ec9cbed7b6a0f12c4a9982bbc325cdbba4c70a7145248 SHA512 122fe404f9c19567016e43208ddd08bdac56e7f264853d6cbe0929650fc4ada7175cc24c0e4fbf088acab77127eb76454948b98cbc731e35a12e1b068a5fd793 DIST xen-4.13.2.tar.gz 39037826 BLAKE2B ad2b7c3003ca29e5e60a85c581f706ef87d99eadf939ed36ebe8f6698582f7a29dbdaf502039b60a0afe7ad4ae6ce89713e69dc8b8a7d5abe65063da7f1baa5b SHA512 cd3092281c97e9421e303aa288aac04dcccd5536ba7c0ff4d51fbf3d07b5ffacfe3456ba06f5cf63577dafbf8cf3a5d9825ceb5e9ef8ca1427900cc3e57b50a3 -DIST xen-4.14.0-upstream-patches-1.tar.xz 45360 BLAKE2B 0f72a2cc3d18557b86a2a83f97e4141be46a20e3ba59ccc881a34a4408988eba9827e3b927bc07aba9678123d783303e7d47d789e57323a7f6691d718c019dc8 SHA512 3d5093e4367d27e7f6e8d4cc31841a5c80cc3fb870d6cb32131d064e16cbb559e9a783c70eec1ce13c960b3e2a8d5e23e18d26b936bc418b434df3bb801d3e4f +DIST xen-4.14.0-upstream-patches-4.tar.xz 79204 BLAKE2B 54d3ba5eac263d78c052cdf2b7958662dc29f689f03d03692c20c881a6b520bf08c86cf830a2727c2a2249c256aa0d06dea75496c8ee6699361c86c3f91bbd83 SHA512 c18b43a16e225cd1c50fe975fa1daf414e8e5fd47e4d3c9e2c655001ae59ab6fed5d332e5f34acc4f01b3c9d42bd425a86e084a4eb22c360257689aab3fe6825 DIST xen-4.14.0.tar.gz 39950576 BLAKE2B db4c3e79cfdfb10260d0d14d9d28e8c8bd9bf23f42aee743acf8f560bf4cdb96a425c0df887c70f9755f62680be24bfbe0149e52a4cb843ae83090cd9d6afc71 SHA512 ebce47a2f754955d8517123d69f62006634d97620fbbe3784869a0667466e586a249f57ffaf7846d5bcb45d69377cde43354c82c233fbb5407e55653b9a33ac0 DIST xen-gentoo-patches-21.tar.xz 18280 BLAKE2B 95446da72fc16cb82e4e51df8796c64db05a30894a351a98dbd6700ce354c34956ca09a1af98125a4e56c337936e8fae296d806519b8afa23a82b078aa0db8f1 SHA512 3cffac162606a09b10b47dca604f167897e6ac8d153411d3464ef29a7a4d46ac5b92340884cb21279cb2d053b131f1ea5cb2111e3e9a21b3298b5ab3320ee34d DIST xen-gentoo-patches-22.tar.xz 18764 BLAKE2B e0da49b39fbc6b689db47e40a4fbb4f6568644fe192b114cce01b0406cba4bf23339ad1bf39b972f895df004916827b6e774f97fc079aeb8ac436763efda5fc3 SHA512 5b7959af4ed30edd2526698ab60a86353e35d9dc48dc941b6df7659a7c4904260461e0decbd8d788542bd69384736f2175861d4943c3738618d20788b19ea9b1 diff --git a/app-emulation/xen-tools/files/gentoo-patches.conf b/app-emulation/xen-tools/files/gentoo-patches.conf index 6e28428602a..23d836ed8d1 100644 --- a/app-emulation/xen-tools/files/gentoo-patches.conf +++ b/app-emulation/xen-tools/files/gentoo-patches.conf @@ -73,6 +73,16 @@ ${_gx054} ${_gx056} ${_gx060} " +# xen-tools-4.13.2 patches set (v1) +_gpv_xen_tools_4132_1=" +${_gx038} +${_gx027} +${_gx028} ${_gx029} +${_gx037} +${_gx053} ${_gx050} ${_gx051} +${_gx054} ${_gx056} +" + # xen-tools-4.14.0 patches set _gpv_xen_tools_4140_0=" ${_gx039} diff --git a/app-emulation/xen-tools/xen-tools-4.14.0-r2.ebuild b/app-emulation/xen-tools/xen-tools-4.13.2-r1.ebuild similarity index 95% copy from app-emulation/xen-tools/xen-tools-4.14.0-r2.ebuild copy to app-emulation/xen-tools/xen-tools-4.13.2-r1.ebuild index 6e50b8d46e3..9fa2b645afc 100644 --- a/app-emulation/xen-tools/xen-tools-4.14.0-r2.ebuild +++ b/app-emulation/xen-tools/xen-tools-4.13.2-r1.ebuild @@ -17,19 +17,20 @@ if [[ $PV == *9999 ]]; then S="${WORKDIR}/${REPO}" else KEYWORDS="~amd64 ~arm ~arm64 ~x86" - UPSTREAM_VER=1 - SECURITY_VER=28 + UPSTREAM_VER=0 + SECURITY_VER=29 # xen-tools's gentoo patches tarball - GENTOO_VER=22 + GENTOO_VER=21 # xen-tools's gentoo patches version which apply to this specific ebuild - GENTOO_GPV=0 + GENTOO_GPV=1 # xen-tools ovmf's patches OVMF_VER= - SEABIOS_VER="1.13.0" - EDK2_COMMIT="20d2e5a125e34fc8501026613a71549b2a1a3e54" - EDK2_OPENSSL_VERSION="1_1_1b" + SEABIOS_VER="1.12.1" + EDK2_COMMIT="06dc822d045c2bb42e497487935485302486e151" + EDK2_OPENSSL_VERSION="1_1_1g" EDK2_SOFTFLOAT_COMMIT="b64af41c3276f97f0e181920400ee056b9c88037" + EDK2_BROTLI_COMMIT="666c3280cc11dc433c303d79a83d4ffbdd12cc8d" IPXE_COMMIT="1dd56dbd11082fb622c2ed21cfaced4f47d798a6" [[ -n ${UPSTREAM_VER} ]] && \ @@ -50,6 +51,7 @@ else ovmf? ( https://github.com/tianocore/edk2/archive/${EDK2_COMMIT}.tar.gz -> edk2-${EDK2_COMMIT}.tar.gz https://github.com/openssl/openssl/archive/OpenSSL_${EDK2_OPENSSL_VERSION}.tar.gz https://github.com/ucb-bar/berkeley-softfloat-3/archive/${EDK2_SOFTFLOAT_COMMIT}.tar.gz -> berkeley-softfloat-${EDK2_SOFTFLOAT_COMMIT}.tar.gz + https://github.com/google/brotli/archive/${EDK2_BROTLI_COMMIT}.tar.gz -> brotli-${EDK2_BROTLI_COMMIT}.tar.gz ${OVMF_PATCHSET_URI} ) ${UPSTREAM_PATCHSET_URI} ${SECURITY_PATCHSET_URI} @@ -263,8 +265,12 @@ src_prepare() { mv ../edk2-${EDK2_COMMIT} tools/firmware/ovmf-dir-remote || die rm -r tools/firmware/ovmf-dir-remote/CryptoPkg/Library/OpensslLib/openssl || die rm -r tools/firmware/ovmf-dir-remote/ArmPkg/Library/ArmSoftFloatLib/berkeley-softfloat-3 || die + rm -r tools/firmware/ovmf-dir-remote/BaseTools/Source/C/BrotliCompress/brotli || die + rm -r tools/firmware/ovmf-dir-remote/MdeModulePkg/Library/BrotliCustomDecompressLib/brotli || die mv ../openssl-OpenSSL_${EDK2_OPENSSL_VERSION} tools/firmware/ovmf-dir-remote/CryptoPkg/Library/OpensslLib/openssl || die mv ../berkeley-softfloat-3-${EDK2_SOFTFLOAT_COMMIT} tools/firmware/ovmf-dir-remote/ArmPkg/Library/ArmSoftFloatLib/berkeley-softfloat-3 || die + cp -r ../brotli-${EDK2_BROTLI_COMMIT} tools/firmware/ovmf-dir-remote/BaseTools/Source/C/BrotliCompress/brotli || die + cp -r ../brotli-${EDK2_BROTLI_COMMIT} tools/firmware/ovmf-dir-remote/MdeModulePkg/Library/BrotliCustomDecompressLib/brotli || die cp tools/firmware/ovmf-makefile tools/firmware/ovmf-dir-remote/Makefile || die fi @@ -277,11 +283,6 @@ src_prepare() { echo ipxe-gcc10.patch >> tools/firmware/etherboot/patches/series || die fi - # gcc 10 - # libxlu_pci.c:32:18: error: 'func' may be used uninitialized in this function - sed -e '/CFLAGS/s/Werror/Wno-error/g' \ - -i tools/libxl/Makefile || die - mv tools/qemu-xen/qemu-bridge-helper.c tools/qemu-xen/xen-bridge-helper.c || die # Fix texi2html build error with new texi2html, qemu.doc.html diff --git a/app-emulation/xen-tools/xen-tools-4.14.0-r2.ebuild b/app-emulation/xen-tools/xen-tools-4.14.0-r3.ebuild similarity index 95% rename from app-emulation/xen-tools/xen-tools-4.14.0-r2.ebuild rename to app-emulation/xen-tools/xen-tools-4.14.0-r3.ebuild index 6e50b8d46e3..dec7829740e 100644 --- a/app-emulation/xen-tools/xen-tools-4.14.0-r2.ebuild +++ b/app-emulation/xen-tools/xen-tools-4.14.0-r3.ebuild @@ -17,7 +17,7 @@ if [[ $PV == *9999 ]]; then S="${WORKDIR}/${REPO}" else KEYWORDS="~amd64 ~arm ~arm64 ~x86" - UPSTREAM_VER=1 + UPSTREAM_VER=4 SECURITY_VER=28 # xen-tools's gentoo patches tarball GENTOO_VER=22 @@ -27,9 +27,10 @@ else OVMF_VER= SEABIOS_VER="1.13.0" - EDK2_COMMIT="20d2e5a125e34fc8501026613a71549b2a1a3e54" - EDK2_OPENSSL_VERSION="1_1_1b" + EDK2_COMMIT="06dc822d045c2bb42e497487935485302486e151" + EDK2_OPENSSL_VERSION="1_1_1g" EDK2_SOFTFLOAT_COMMIT="b64af41c3276f97f0e181920400ee056b9c88037" + EDK2_BROTLI_COMMIT="666c3280cc11dc433c303d79a83d4ffbdd12cc8d" IPXE_COMMIT="1dd56dbd11082fb622c2ed21cfaced4f47d798a6" [[ -n ${UPSTREAM_VER} ]] && \ @@ -50,6 +51,7 @@ else ovmf? ( https://github.com/tianocore/edk2/archive/${EDK2_COMMIT}.tar.gz -> edk2-${EDK2_COMMIT}.tar.gz https://github.com/openssl/openssl/archive/OpenSSL_${EDK2_OPENSSL_VERSION}.tar.gz https://github.com/ucb-bar/berkeley-softfloat-3/archive/${EDK2_SOFTFLOAT_COMMIT}.tar.gz -> berkeley-softfloat-${EDK2_SOFTFLOAT_COMMIT}.tar.gz + https://github.com/google/brotli/archive/${EDK2_BROTLI_COMMIT}.tar.gz -> brotli-${EDK2_BROTLI_COMMIT}.tar.gz ${OVMF_PATCHSET_URI} ) ${UPSTREAM_PATCHSET_URI} ${SECURITY_PATCHSET_URI} @@ -263,8 +265,12 @@ src_prepare() { mv ../edk2-${EDK2_COMMIT} tools/firmware/ovmf-dir-remote || die rm -r tools/firmware/ovmf-dir-remote/CryptoPkg/Library/OpensslLib/openssl || die rm -r tools/firmware/ovmf-dir-remote/ArmPkg/Library/ArmSoftFloatLib/berkeley-softfloat-3 || die + rm -r tools/firmware/ovmf-dir-remote/BaseTools/Source/C/BrotliCompress/brotli || die + rm -r tools/firmware/ovmf-dir-remote/MdeModulePkg/Library/BrotliCustomDecompressLib/brotli || die mv ../openssl-OpenSSL_${EDK2_OPENSSL_VERSION} tools/firmware/ovmf-dir-remote/CryptoPkg/Library/OpensslLib/openssl || die mv ../berkeley-softfloat-3-${EDK2_SOFTFLOAT_COMMIT} tools/firmware/ovmf-dir-remote/ArmPkg/Library/ArmSoftFloatLib/berkeley-softfloat-3 || die + cp -r ../brotli-${EDK2_BROTLI_COMMIT} tools/firmware/ovmf-dir-remote/BaseTools/Source/C/BrotliCompress/brotli || die + cp -r ../brotli-${EDK2_BROTLI_COMMIT} tools/firmware/ovmf-dir-remote/MdeModulePkg/Library/BrotliCustomDecompressLib/brotli || die cp tools/firmware/ovmf-makefile tools/firmware/ovmf-dir-remote/Makefile || die fi @@ -277,11 +283,6 @@ src_prepare() { echo ipxe-gcc10.patch >> tools/firmware/etherboot/patches/series || die fi - # gcc 10 - # libxlu_pci.c:32:18: error: 'func' may be used uninitialized in this function - sed -e '/CFLAGS/s/Werror/Wno-error/g' \ - -i tools/libxl/Makefile || die - mv tools/qemu-xen/qemu-bridge-helper.c tools/qemu-xen/xen-bridge-helper.c || die # Fix texi2html build error with new texi2html, qemu.doc.html
