staging/dedeckeh/tools/patch, branch master

tools/patch: apply patch for EACCES on xattr copy

2022-11-20T17:44:43Z

When compiling OpenWRT on a compressed btrfs volume the build fails in libtool. The file `libltdl/config/ltmain.m4sh` from `libtool-2.4.2.tar.xz` is missing write permissions, therefore patch falls back to copying the file and patching that. During this patch tries to preserve all file attribute on the new copy. However the attribute `btrfs.compression` is privileged and btrfs return EACCES. While patch ignores multiple other error codes during the copy of xattr copy it is not prepared for EACCES and aborts. EACCES should be ignored the same way as the other errors. Build log: ``` ... Applying ./patches/000-relocatable.patch using plaintext: patching file libltdl/config/general.m4sh patching file libtoolize.in patching file libtoolize.m4sh patching file libltdl/m4/libtool.m4 Applying ./patches/100-libdir-fixes.patch using plaintext: patching file libltdl/config/ltmain.m4sh File libltdl/config/ltmain.sh is read-only; trying to patch anyway patching file libltdl/config/ltmain.sh patch: setting attribute btrfs.compression for btrfs.compression: Permission denied Patch failed! Please fix ./patches/100-libdir-fixes.patch! ``` Link: https://lists.gnu.org/archive/html/bug-patch/2022-11/msg00000.html Signed-off-by: Thomas Weißschuh

tools: add Host/Uninstall where possible

2022-10-19T22:33:22Z

This cleans staging_dir when calling tool/x/clean. Signed-off-by: Rosen Penev

tools/patch: apply upstream patch for cve-2019-13638

2019-08-13T08:00:10Z

GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters. The ed editor does not need to be present on the vulnerable system. This is different from CVE-2018-1000156. https://nvd.nist.gov/vuln/detail/CVE-2019-13638 Signed-off-by: Russell Senior

tools/patch: apply upstream patch for CVE-2019-13636

2019-07-30T08:16:16Z

In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input files. This affects inp.c and util.c. https://nvd.nist.gov/vuln/detail/CVE-2019-13636 Signed-off-by: Russell Senior

tools/patch: Add fedora patch for crashing git style patches

2018-11-01T16:16:52Z

https://lists.gnu.org/archive/html/bug-patch/2018-10/msg00000.html I assume a CVE number will be assigned soon. Signed-off-by: Rosen Penev

tools: patch: Add missing CVE-2018-6951 fix

2018-10-16T10:51:10Z

uscan reports a new CVE now that PKG_CPE_ID was added. Reordered patches by date. Signed-off-by: Rosen Penev [re-title commit & refresh patches] Signed-off-by: Kevin Darbyshire-Bryant

tools: patch: Fix build by not modifing Makefile.am

2018-10-14T14:47:15Z

A new test case was adding in one of the patches fixing a problem, this also included a change in the test/Makefile.am to add this test case. The build system detected a change in the Makefile.am and wants to regenerate the Makefile.in, but this fails because automake-1.15 is not installed yet. As automake depends on patch being build first, make sure we do not modify the Makefile.am. This fixes build problem seen by the build bots. Fixes: 4797dddfde6 ("patch: apply upstream cve fixes") Signed-off-by: Hauke Mehrtens

patch: apply upstream cve fixes

2018-10-14T12:36:09Z

Apply two upstream patches to address two CVEs: * CVE-2018-1000156 * CVE-2018-6952 Add PKG_CPE_ID to Makefile. Build tested on apm821xx and ar71xx. Signed-off-by: Russell Senior

tools: update patch to v2.7.6

2018-02-12T08:27:56Z

Removes a redundant patch with a fix already upstream. Build tested on apm821xx (PPC). Signed-off-by: Russell Senior

tools: patch various gnu tools for macOS 10.13

2017-08-23T16:56:33Z

These host tools compile but may crash at runtime when building on macOS 10.13 (High Sierra). Backport upstream gnulib patch until new releases of affected tools. https://lists.gnu.org/archive/html/bug-gnulib/2017-07/msg00056.html https://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=c41f233c4c38e84023a16339782ee306f03e7f59 Signed-off-by: Ryan Mounce