staging/dangole/tools/patch, branch main

tools: refresh all patches

2024-05-23T09:49:03Z

Refresh all tools patches now that tools/refresh correctly works. CI now checks for them and actively complain if tools have unrefreshed patches. Signed-off-by: Rosen Penev [ reword commit message ] Link: https://github.com/openwrt/openwrt/pull/15524 Signed-off-by: Christian Marangi

tools: prefer gz or bz2 tarballs

2024-04-06T09:24:18Z

In the light of recent XZ events, and fundamental XZ issues lets work on moving away from using XZ. So, use gz compressed tarballs as sources whenever possible. dwarves only offers bz2 compressed tarballs, so use those as size difference is minor compared to XZ. Signed-off-by: Robert Marko dwarves

tools/patch: apply patch for EACCES on xattr copy

2022-11-20T17:44:43Z

When compiling OpenWRT on a compressed btrfs volume the build fails in libtool. The file `libltdl/config/ltmain.m4sh` from `libtool-2.4.2.tar.xz` is missing write permissions, therefore patch falls back to copying the file and patching that. During this patch tries to preserve all file attribute on the new copy. However the attribute `btrfs.compression` is privileged and btrfs return EACCES. While patch ignores multiple other error codes during the copy of xattr copy it is not prepared for EACCES and aborts. EACCES should be ignored the same way as the other errors. Build log: ``` ... Applying ./patches/000-relocatable.patch using plaintext: patching file libltdl/config/general.m4sh patching file libtoolize.in patching file libtoolize.m4sh patching file libltdl/m4/libtool.m4 Applying ./patches/100-libdir-fixes.patch using plaintext: patching file libltdl/config/ltmain.m4sh File libltdl/config/ltmain.sh is read-only; trying to patch anyway patching file libltdl/config/ltmain.sh patch: setting attribute btrfs.compression for btrfs.compression: Permission denied Patch failed! Please fix ./patches/100-libdir-fixes.patch! ``` Link: https://lists.gnu.org/archive/html/bug-patch/2022-11/msg00000.html Signed-off-by: Thomas Weißschuh

tools: add Host/Uninstall where possible

2022-10-19T22:33:22Z

This cleans staging_dir when calling tool/x/clean. Signed-off-by: Rosen Penev

tools/patch: apply upstream patch for cve-2019-13638

2019-08-13T08:00:10Z

GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters. The ed editor does not need to be present on the vulnerable system. This is different from CVE-2018-1000156. https://nvd.nist.gov/vuln/detail/CVE-2019-13638 Signed-off-by: Russell Senior

tools/patch: apply upstream patch for CVE-2019-13636

2019-07-30T08:16:16Z

In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input files. This affects inp.c and util.c. https://nvd.nist.gov/vuln/detail/CVE-2019-13636 Signed-off-by: Russell Senior

tools/patch: Add fedora patch for crashing git style patches

2018-11-01T16:16:52Z

https://lists.gnu.org/archive/html/bug-patch/2018-10/msg00000.html I assume a CVE number will be assigned soon. Signed-off-by: Rosen Penev

tools: patch: Add missing CVE-2018-6951 fix

2018-10-16T10:51:10Z

uscan reports a new CVE now that PKG_CPE_ID was added. Reordered patches by date. Signed-off-by: Rosen Penev [re-title commit & refresh patches] Signed-off-by: Kevin Darbyshire-Bryant

tools: patch: Fix build by not modifing Makefile.am

2018-10-14T14:47:15Z

A new test case was adding in one of the patches fixing a problem, this also included a change in the test/Makefile.am to add this test case. The build system detected a change in the Makefile.am and wants to regenerate the Makefile.in, but this fails because automake-1.15 is not installed yet. As automake depends on patch being build first, make sure we do not modify the Makefile.am. This fixes build problem seen by the build bots. Fixes: 4797dddfde6 ("patch: apply upstream cve fixes") Signed-off-by: Hauke Mehrtens

patch: apply upstream cve fixes

2018-10-14T12:36:09Z

Apply two upstream patches to address two CVEs: * CVE-2018-1000156 * CVE-2018-6952 Add PKG_CPE_ID to Makefile. Build tested on apm821xx and ar71xx. Signed-off-by: Russell Senior