commit: e9a3e5777e80fb46ecf952f542b2e3c98d2c12d2 Author: Michał Górny <mgorny <AT> gentoo <DOT> org> AuthorDate: Wed Sep 18 03:56:50 2024 +0000 Commit: Michał Górny <mgorny <AT> gentoo <DOT> org> CommitDate: Wed Sep 18 04:37:00 2024 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e9a3e577
app-arch/libarchive: Bump to 3.7.5 Signed-off-by: Michał Górny <mgorny <AT> gentoo.org> app-arch/libarchive/Manifest | 2 + .../files/libarchive-3.7.5-iso9660-times.patch | 334 +++++++++++++++++++++ app-arch/libarchive/libarchive-3.7.5.ebuild | 177 +++++++++++ 3 files changed, 513 insertions(+) diff --git a/app-arch/libarchive/Manifest b/app-arch/libarchive/Manifest index 0c49596464d7..56e85afbaa09 100644 --- a/app-arch/libarchive/Manifest +++ b/app-arch/libarchive/Manifest @@ -1,2 +1,4 @@ DIST libarchive-3.7.4.tar.xz 5417660 BLAKE2B 128f72235da61e112201046c0cfe62a8c580cf73b426c4cfe270ae913356f6ad430ba33a663dcd617b082c7baf45ada8d1c9928c45fea16fd57e8020693a60bc SHA512 84bc346ba15861ab10aa54a3d687de955178e4efbe12bf3a49a467181e7f819673949f131f4c8338de8ed6e319a8565af376e5a540380bda08e60dffbc7c8686 DIST libarchive-3.7.4.tar.xz.asc 659 BLAKE2B 77e705194f6e9a9f97da0ac43c9b3157e1a8a490d26da34079e4ef3f2bcf98d6f6e95567e110287fab0ec26d3fc27e5bbeff7569c9ca138de2caf47af737c6d0 SHA512 82caa18a78661ea717ce93cdcb0806eed48450c20fb4d45cb4c33001f2d4d0fb5a791552acbb24ad8c41772e1d0b66c76c9cb86946bc862109721a0c986f5331 +DIST libarchive-3.7.5.tar.xz 5437940 BLAKE2B e1cf8490b2db64e912bd181391310653b4e3524e74f35557e1ddb8c5eb53dcde307da945d393921acf7549ef0d4a6bf228d8f42ab4d795d06dd2248196a11c85 SHA512 b9cfb0a147bf0f77cca9e2bdea173f47a78dcba5df1d97a8e0e7b14a15039ac6d5467e325423b2a05741848f73ca7ab4fece922153f24f934f9370cb521d20df +DIST libarchive-3.7.5.tar.xz.asc 659 BLAKE2B 7310b8d7e3f07b8c75910ff3355ffda653402ca2d6db9cdf7d669b9a4ac5f3fb4c4c4482e85184fd68a23c96bce587a95b56efb88ae971399e130e533bd0969a SHA512 7494518b61a58a9aa1e991a2cf6b16340e34d7aa2c25a3c531799785e165541781d1a915437260bc536fe8267140cc69abb2670e8c0576e975a5a2b7ecf8e20d diff --git a/app-arch/libarchive/files/libarchive-3.7.5-iso9660-times.patch b/app-arch/libarchive/files/libarchive-3.7.5-iso9660-times.patch new file mode 100644 index 000000000000..2c5bcc277364 --- /dev/null +++ b/app-arch/libarchive/files/libarchive-3.7.5-iso9660-times.patch @@ -0,0 +1,334 @@ +From b65d12b344a5d81c6060b1c1794afa8858fe234b Mon Sep 17 00:00:00 2001 +From: Tim Kientzle <[email protected]> +Date: Sat, 14 Sep 2024 21:09:34 -0700 +Subject: [PATCH] Be more cautious about parsing ISO-9660 timestamps + +Some ISO images don't have valid timestamps for the root directory +entry. Parsing such timestamps can generate nonsensical results, +which in one case showed up as an unexpected overflow on a 32-bit system. + +Add some validation logic that can check whether a 7-byte or 17-byte +timestamp is reasonable-looking, and use this to ignore invalid +timestamps in various locations. This also requires us to be a little +more careful about tracking which timestamps are actually known. + +Resolves issue #2329 +--- + .../archive_read_support_format_iso9660.c | 186 ++++++++++++++++-- + libarchive/test/test_read_format_iso_Z.c | 12 +- + 2 files changed, 177 insertions(+), 21 deletions(-) + +diff --git a/libarchive/archive_read_support_format_iso9660.c b/libarchive/archive_read_support_format_iso9660.c +index 056beb5ff..951afb603 100644 +--- a/libarchive/archive_read_support_format_iso9660.c ++++ b/libarchive/archive_read_support_format_iso9660.c +@@ -273,7 +273,7 @@ struct file_info { + char re; /* Having RRIP "RE" extension. */ + char re_descendant; + uint64_t cl_offset; /* Having RRIP "CL" extension. */ +- int birthtime_is_set; ++ int time_is_set; /* Bitmask indicating which times are known */ + time_t birthtime; /* File created time. */ + time_t mtime; /* File last modified time. */ + time_t atime; /* File last accessed time. */ +@@ -306,6 +306,11 @@ struct file_info { + } rede_files; + }; + ++#define BIRTHTIME_IS_SET 1 ++#define MTIME_IS_SET 2 ++#define ATIME_IS_SET 4 ++#define CTIME_IS_SET 8 ++ + struct heap_queue { + struct file_info **files; + int allocated; +@@ -394,7 +399,9 @@ static void dump_isodirrec(FILE *, const unsigned char *isodirrec); + #endif + static time_t time_from_tm(struct tm *); + static time_t isodate17(const unsigned char *); ++static int isodate17_valid(const unsigned char *); + static time_t isodate7(const unsigned char *); ++static int isodate7_valid(const unsigned char *); + static int isBootRecord(struct iso9660 *, const unsigned char *); + static int isVolumePartition(struct iso9660 *, const unsigned char *); + static int isVDSetTerminator(struct iso9660 *, const unsigned char *); +@@ -1351,13 +1358,22 @@ archive_read_format_iso9660_read_header(struct archive_read *a, + archive_entry_set_uid(entry, file->uid); + archive_entry_set_gid(entry, file->gid); + archive_entry_set_nlink(entry, file->nlinks); +- if (file->birthtime_is_set) ++ if ((file->time_is_set & BIRTHTIME_IS_SET)) + archive_entry_set_birthtime(entry, file->birthtime, 0); + else + archive_entry_unset_birthtime(entry); +- archive_entry_set_mtime(entry, file->mtime, 0); +- archive_entry_set_ctime(entry, file->ctime, 0); +- archive_entry_set_atime(entry, file->atime, 0); ++ if ((file->time_is_set & MTIME_IS_SET)) ++ archive_entry_set_mtime(entry, file->mtime, 0); ++ else ++ archive_entry_unset_mtime(entry); ++ if ((file->time_is_set & CTIME_IS_SET)) ++ archive_entry_set_ctime(entry, file->ctime, 0); ++ else ++ archive_entry_unset_ctime(entry); ++ if ((file->time_is_set & ATIME_IS_SET)) ++ archive_entry_set_atime(entry, file->atime, 0); ++ else ++ archive_entry_unset_atime(entry); + /* N.B.: Rock Ridge supports 64-bit device numbers. */ + archive_entry_set_rdev(entry, (dev_t)file->rdev); + archive_entry_set_size(entry, iso9660->entry_bytes_remaining); +@@ -1898,8 +1914,11 @@ parse_file_info(struct archive_read *a, struct file_info *parent, + file->parent = parent; + file->offset = offset; + file->size = fsize; +- file->mtime = isodate7(isodirrec + DR_date_offset); +- file->ctime = file->atime = file->mtime; ++ if (isodate7_valid(isodirrec + DR_date_offset)) { ++ file->time_is_set |= MTIME_IS_SET | ATIME_IS_SET | CTIME_IS_SET; ++ file->mtime = isodate7(isodirrec + DR_date_offset); ++ file->ctime = file->atime = file->mtime; ++ } + file->rede_files.first = NULL; + file->rede_files.last = &(file->rede_files.first); + +@@ -2573,51 +2592,73 @@ parse_rockridge_TF1(struct file_info *file, const unsigned char *data, + /* Use 17-byte time format. */ + if ((flag & 1) && data_length >= 17) { + /* Create time. */ +- file->birthtime_is_set = 1; +- file->birthtime = isodate17(data); ++ if (isodate17_valid(data)) { ++ file->time_is_set |= BIRTHTIME_IS_SET; ++ file->birthtime = isodate17(data); ++ } + data += 17; + data_length -= 17; + } + if ((flag & 2) && data_length >= 17) { + /* Modify time. */ +- file->mtime = isodate17(data); ++ if (isodate17_valid(data)) { ++ file->time_is_set |= MTIME_IS_SET; ++ file->mtime = isodate17(data); ++ } + data += 17; + data_length -= 17; + } + if ((flag & 4) && data_length >= 17) { + /* Access time. */ +- file->atime = isodate17(data); ++ if (isodate17_valid(data)) { ++ file->time_is_set |= ATIME_IS_SET; ++ file->atime = isodate17(data); ++ } + data += 17; + data_length -= 17; + } + if ((flag & 8) && data_length >= 17) { + /* Attribute change time. */ +- file->ctime = isodate17(data); ++ if (isodate17_valid(data)) { ++ file->time_is_set |= CTIME_IS_SET; ++ file->ctime = isodate17(data); ++ } + } + } else { + /* Use 7-byte time format. */ + if ((flag & 1) && data_length >= 7) { + /* Create time. */ +- file->birthtime_is_set = 1; +- file->birthtime = isodate7(data); ++ if (isodate7_valid(data)) { ++ file->time_is_set |= BIRTHTIME_IS_SET; ++ file->birthtime = isodate7(data); ++ } + data += 7; + data_length -= 7; + } + if ((flag & 2) && data_length >= 7) { + /* Modify time. */ +- file->mtime = isodate7(data); ++ if (isodate7_valid(data)) { ++ file->time_is_set |= MTIME_IS_SET; ++ file->mtime = isodate7(data); ++ } + data += 7; + data_length -= 7; + } + if ((flag & 4) && data_length >= 7) { + /* Access time. */ +- file->atime = isodate7(data); ++ if (isodate7_valid(data)) { ++ file->time_is_set |= ATIME_IS_SET; ++ file->atime = isodate7(data); ++ } + data += 7; + data_length -= 7; + } + if ((flag & 8) && data_length >= 7) { + /* Attribute change time. */ +- file->ctime = isodate7(data); ++ if (isodate7_valid(data)) { ++ file->time_is_set |= CTIME_IS_SET; ++ file->ctime = isodate7(data); ++ } + } + } + } +@@ -3226,6 +3267,56 @@ isValid733Integer(const unsigned char *p) + && p[3] == p[4]); + } + ++static int ++isodate7_valid(const unsigned char *v) ++{ ++ int year = v[0]; ++ int month = v[1]; ++ int day = v[2]; ++ int hour = v[3]; ++ int minute = v[4]; ++ int second = v[5]; ++ int gmt_off = (signed char)v[6]; ++ ++ /* ECMA-119 9.1.5 "If all seven values are zero, it shall mean ++ * that the date is unspecified" */ ++ if (year == 0 ++ && month == 0 ++ && day == 0 ++ && hour == 0 ++ && minute == 0 ++ && second == 0 ++ && gmt_off == 0) ++ return 0; ++ /* ++ * Sanity-test each individual field ++ */ ++ /* Year can have any value */ ++ /* Month must be 1-12 */ ++ if (month < 1 || month > 12) ++ return 0; ++ /* Day must be 1-31 */ ++ if (day < 1 || day > 31) ++ return 0; ++ /* Hour must be 0-23 */ ++ if (hour > 23) ++ return 0; ++ /* Minute must be 0-59 */ ++ if (minute > 59) ++ return 0; ++ /* second must be 0-59 according to ECMA-119 9.1.5 */ ++ /* BUT: we should probably allow for the time being in UTC, which ++ allows up to 61 seconds in a minute in certain cases */ ++ if (second > 61) ++ return 0; ++ /* Offset from GMT must be -48 to +52 */ ++ if (gmt_off < -48 || gmt_off > +52) ++ return 0; ++ ++ /* All tests pass, this is OK */ ++ return 1; ++} ++ + static time_t + isodate7(const unsigned char *v) + { +@@ -3252,6 +3343,67 @@ isodate7(const unsigned char *v) + return (t); + } + ++static int ++isodate17_valid(const unsigned char *v) ++{ ++ /* First 16 bytes are all ASCII digits */ ++ for (int i = 0; i < 16; i++) { ++ if (v[i] < '0' || v[i] > '9') ++ return 0; ++ } ++ ++ int year = (v[0] - '0') * 1000 + (v[1] - '0') * 100 ++ + (v[2] - '0') * 10 + (v[3] - '0'); ++ int month = (v[4] - '0') * 10 + (v[5] - '0'); ++ int day = (v[6] - '0') * 10 + (v[7] - '0'); ++ int hour = (v[8] - '0') * 10 + (v[9] - '0'); ++ int minute = (v[10] - '0') * 10 + (v[11] - '0'); ++ int second = (v[12] - '0') * 10 + (v[13] - '0'); ++ int hundredths = (v[14] - '0') * 10 + (v[15] - '0'); ++ int gmt_off = (signed char)v[16]; ++ ++ if (year == 0 && month == 0 && day == 0 ++ && hour == 0 && minute == 0 && second == 0 ++ && hundredths == 0 && gmt_off == 0) ++ return 0; ++ /* ++ * Sanity-test each individual field ++ */ ++ ++ /* Year must be 1900-2300 */ ++ /* (Not specified in ECMA-119, but these seem ++ like reasonable limits. */ ++ if (year < 1900 || year > 2300) ++ return 0; ++ /* Month must be 1-12 */ ++ if (month < 1 || month > 12) ++ return 0; ++ /* Day must be 1-31 */ ++ if (day < 1 || day > 31) ++ return 0; ++ /* Hour must be 0-23 */ ++ if (hour > 23) ++ return 0; ++ /* Minute must be 0-59 */ ++ if (minute > 59) ++ return 0; ++ /* second must be 0-59 according to ECMA-119 9.1.5 */ ++ /* BUT: we should probably allow for the time being in UTC, which ++ allows up to 61 seconds in a minute in certain cases */ ++ if (second > 61) ++ return 0; ++ /* Hundredths must be 0-99 */ ++ if (hundredths > 99) ++ return 0; ++ /* Offset from GMT must be -48 to +52 */ ++ if (gmt_off < -48 || gmt_off > +52) ++ return 0; ++ ++ /* All tests pass, this is OK */ ++ return 1; ++ ++} ++ + static time_t + isodate17(const unsigned char *v) + { +diff --git a/libarchive/test/test_read_format_iso_Z.c b/libarchive/test/test_read_format_iso_Z.c +index d07bc1bc8..716552fa3 100644 +--- a/libarchive/test/test_read_format_iso_Z.c ++++ b/libarchive/test/test_read_format_iso_Z.c +@@ -93,16 +93,20 @@ test_small(const char *name) + assertEqualIntA(a, ARCHIVE_OK, + archive_read_next_header(a, &ae)); + assertEqualString(".", archive_entry_pathname(ae)); +- assertEqualIntA(a, 3443989665, archive_entry_atime(ae)); +- assertEqualIntA(a, 0, archive_entry_birthtime(ae)); +- assertEqualIntA(a, 3443989665, archive_entry_ctime(ae)); ++ assertEqualInt(0, archive_entry_atime_is_set(ae)); ++ assertEqualInt(0, archive_entry_atime(ae)); ++ assertEqualInt(0, archive_entry_birthtime_is_set(ae)); ++ assertEqualInt(0, archive_entry_birthtime(ae)); ++ assertEqualInt(0, archive_entry_ctime_is_set(ae)); ++ assertEqualInt(0, archive_entry_ctime(ae)); + assertEqualIntA(a, 0, archive_entry_dev(ae)); + assertEqualIntA(a, AE_IFDIR, archive_entry_filetype(ae)); + assertEqualIntA(a, 0, archive_entry_gid(ae)); + assertEqualStringA(a, NULL, archive_entry_gname(ae)); + assertEqualIntA(a, 0, archive_entry_ino(ae)); + assertEqualIntA(a, AE_IFDIR | 0700, archive_entry_mode(ae)); +- assertEqualIntA(a, 3443989665, archive_entry_mtime(ae)); ++ assertEqualInt(0, archive_entry_mtime_is_set(ae)); ++ assertEqualInt(0, archive_entry_mtime(ae)); + assertEqualIntA(a, 4, archive_entry_nlink(ae)); + assertEqualIntA(a, 0700, archive_entry_perm(ae)); + assertEqualIntA(a, 2048, archive_entry_size(ae)); diff --git a/app-arch/libarchive/libarchive-3.7.5.ebuild b/app-arch/libarchive/libarchive-3.7.5.ebuild new file mode 100644 index 000000000000..c5d6394eed24 --- /dev/null +++ b/app-arch/libarchive/libarchive-3.7.5.ebuild @@ -0,0 +1,177 @@ +# Copyright 1999-2024 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=8 +inherit libtool multilib-minimal toolchain-funcs verify-sig + +DESCRIPTION="Multi-format archive and compression library" +HOMEPAGE=" + https://www.libarchive.org/ + https://github.com/libarchive/libarchive/ +" +SRC_URI=" + https://www.libarchive.de/downloads/${P}.tar.xz + verify-sig? ( https://www.libarchive.de/downloads/${P}.tar.xz.asc ) +" + +LICENSE="BSD BSD-2 BSD-4 public-domain" +SLOT="0/13" +KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris" +IUSE=" + acl blake2 +bzip2 +e2fsprogs expat +iconv lz4 +lzma lzo nettle + static-libs test xattr +zstd +" +RESTRICT="!test? ( test )" + +RDEPEND=" + sys-libs/zlib:=[${MULTILIB_USEDEP}] + acl? ( virtual/acl:=[${MULTILIB_USEDEP}] ) + blake2? ( app-crypt/libb2:=[${MULTILIB_USEDEP}] ) + bzip2? ( app-arch/bzip2:=[${MULTILIB_USEDEP}] ) + expat? ( dev-libs/expat:=[${MULTILIB_USEDEP}] ) + !expat? ( dev-libs/libxml2:=[${MULTILIB_USEDEP}] ) + iconv? ( virtual/libiconv:=[${MULTILIB_USEDEP}] ) + dev-libs/openssl:=[${MULTILIB_USEDEP}] + lz4? ( >=app-arch/lz4-0_p131:=[${MULTILIB_USEDEP}] ) + lzma? ( >=app-arch/xz-utils-5.2.5-r1:=[${MULTILIB_USEDEP}] ) + lzo? ( >=dev-libs/lzo-2:=[${MULTILIB_USEDEP}] ) + nettle? ( dev-libs/nettle:=[${MULTILIB_USEDEP}] ) + zstd? ( app-arch/zstd:=[${MULTILIB_USEDEP}] ) +" +# TODO: fix attr/xattr.h includes and remove sys-apps/attr dep +DEPEND="${RDEPEND} + kernel_linux? ( + virtual/os-headers + e2fsprogs? ( sys-fs/e2fsprogs[${MULTILIB_USEDEP}] ) + xattr? ( sys-apps/attr[${MULTILIB_USEDEP}] ) + ) + test? ( + app-arch/lrzip + app-arch/lz4 + app-arch/lzip + app-arch/lzop + app-arch/xz-utils + app-arch/zstd + lzma? ( app-arch/xz-utils[extra-filters(+)] ) + ) +" +BDEPEND=" + verify-sig? ( >=sec-keys/openpgp-keys-libarchive-20221209 ) + elibc_musl? ( sys-libs/queue-standalone ) +" + +VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/libarchive.org.asc + +# false positives (checks for libc-defined hash functions) +QA_CONFIG_IMPL_DECL_SKIP=( + SHA256_Init SHA256_Update SHA256_Final + SHA384_Init SHA384_Update SHA384_Final + SHA512_Init SHA512_Update SHA512_Final +) + +PATCHES=( + # https://github.com/libarchive/libarchive/issues/2069 + # (we can simply update the command since we don't support old lrzip) + "${FILESDIR}/${PN}-3.7.2-lrzip.patch" + # https://github.com/libarchive/libarchive/pull/2330 + "${FILESDIR}/${P}-iso9660-times.patch" +) + +src_prepare() { + default + + # Needed for flags to be respected w/ LTO + elibtoolize +} + +multilib_src_configure() { + export ac_cv_header_ext2fs_ext2_fs_h=$(usex e2fsprogs) #354923 + + local myconf=( + $(use_enable acl) + $(use_enable static-libs static) + $(use_enable xattr) + $(use_with blake2 libb2) + $(use_with bzip2 bz2lib) + $(use_with expat) + $(use_with !expat xml2) + $(use_with iconv) + $(use_with lz4) + $(use_with lzma) + $(use_with lzo lzo2) + $(use_with nettle) + --with-zlib + $(use_with zstd) + + # Windows-specific + --without-cng + ) + if multilib_is_native_abi ; then + myconf+=( + --enable-bsdcat="$(tc-is-static-only && echo static || echo shared)" + --enable-bsdcpio="$(tc-is-static-only && echo static || echo shared)" + --enable-bsdtar="$(tc-is-static-only && echo static || echo shared)" + --enable-bsdunzip="$(tc-is-static-only && echo static || echo shared)" + ) + else + myconf+=( + --disable-bsdcat + --disable-bsdcpio + --disable-bsdtar + --disable-bsdunzip + ) + fi + + ECONF_SOURCE="${S}" econf "${myconf[@]}" +} + +multilib_src_compile() { + if multilib_is_native_abi ; then + emake + else + emake libarchive.la + fi +} + +src_test() { + mkdir -p "${T}"/bin || die + # tests fail when lbzip2[symlink] is used in place of ref bunzip2 + ln -s "${BROOT}/bin/bunzip2" "${T}"/bin || die + # workaround lrzip broken on 32-bit arches with >= 10 threads + # https://bugs.gentoo.org/927766 + cat > "${T}"/bin/lrzip <<-EOF || die + #!/bin/sh + exec "$(type -P lrzip)" -p1 "\${@}" + EOF + chmod +x "${T}/bin/lrzip" || die + local -x PATH=${T}/bin:${PATH} + multilib-minimal_src_test +} + +multilib_src_test() { + # sandbox is breaking long symlink behavior + local -x SANDBOX_ON=0 + local -x LD_PRELOAD= + # some locales trigger different output that breaks tests + local -x LC_ALL=C.UTF-8 + emake check +} + +multilib_src_install() { + if multilib_is_native_abi ; then + emake DESTDIR="${D}" install + else + local install_targets=( + install-includeHEADERS + install-libLTLIBRARIES + install-pkgconfigDATA + ) + emake DESTDIR="${D}" "${install_targets[@]}" + fi + + # Libs.private: should be used from libarchive.pc instead + find "${ED}" -type f -name "*.la" -delete || die + # https://github.com/libarchive/libarchive/issues/1766 + sed -e '/Requires\.private/s:iconv::' \ + -i "${ED}/usr/$(get_libdir)/pkgconfig/libarchive.pc" || die +}
