From: Alex Vong <alexvong1995@gmail.com>
To: 30319@debbugs.gnu.org
Subject: [bug#30319] [PATCH] gnu: tar: Update to 1.30.
Date: Thu, 01 Feb 2018 23:55:11 +0800 [thread overview]
Message-ID: <87a7wsaen4.fsf@gmail.com> (raw)
[-- Attachment #1: Type: text/plain, Size: 143 bytes --]
Hello,
This patch updates tar to its latest version for core-updates. I add a
2016 copyright header because I forgot to add it in 20be64dcf.
[-- Attachment #2: 0001-gnu-tar-Update-to-1.30.patch --]
[-- Type: text/x-diff, Size: 4647 bytes --]
From bc2c8230c7089cbd3e9de8776dd97bd758dcde2d Mon Sep 17 00:00:00 2001
From: Alex Vong <alexvong1995@gmail.com>
Date: Thu, 1 Feb 2018 23:03:55 +0800
Subject: [PATCH] gnu: tar: Update to 1.30.
* gnu/packages/base.scm (tar): Update to 1.30.
[source]: Remove 'tar-CVE-2016-6321.patch'.
* gnu/packages/patches/tar-CVE-2016-6321.patch: Remove.
* gnu/local.mk (dist_patch_DATA): Adjust accordingly.
---
gnu/local.mk | 1 -
gnu/packages/base.scm | 8 ++---
gnu/packages/patches/tar-CVE-2016-6321.patch | 51 ----------------------------
3 files changed, 4 insertions(+), 56 deletions(-)
delete mode 100644 gnu/packages/patches/tar-CVE-2016-6321.patch
diff --git a/gnu/local.mk b/gnu/local.mk
index 9df027a8d..7bddb4060 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -1076,7 +1076,6 @@ dist_patch_DATA = \
%D%/packages/patches/t1lib-CVE-2010-2642.patch \
%D%/packages/patches/t1lib-CVE-2011-0764.patch \
%D%/packages/patches/t1lib-CVE-2011-1552+.patch \
- %D%/packages/patches/tar-CVE-2016-6321.patch \
%D%/packages/patches/tar-skip-unreliable-tests.patch \
%D%/packages/patches/tclxml-3.2-install.patch \
%D%/packages/patches/tcsh-fix-autotest.patch \
diff --git a/gnu/packages/base.scm b/gnu/packages/base.scm
index 92acbd364..faa5066cc 100644
--- a/gnu/packages/base.scm
+++ b/gnu/packages/base.scm
@@ -7,6 +7,7 @@
;;; Copyright © 2014, 2015 Manolis Fragkiskos Ragkousis <manolis837@gmail.com>
;;; Copyright © 2016, 2017 Efraim Flashner <efraim@flashner.co.il>
;;; Copyright © 2016 Jan Nieuwenhuizen <janneke@gnu.org>
+;;; Copyright © 2016, 2018 Alex Vong <alexvong1995@gmail.com>
;;; Copyright © 2017 Rene Saavedra <rennes@openmailbox.org>
;;; Copyright © 2017 Mathieu Othacehe <m.othacehe@gmail.com>
;;; Copyright © 2017 Marius Bakke <mbakke@fastmail.com>
@@ -166,16 +167,15 @@ implementation offers several extensions over the standard utility.")
(define-public tar
(package
(name "tar")
- (version "1.29")
+ (version "1.30")
(source (origin
(method url-fetch)
(uri (string-append "mirror://gnu/tar/tar-"
version ".tar.xz"))
(sha256
(base32
- "097hx7sbzp8qirl4m930lw84kn0wmxhmq7v1qpra3mrg0b8cyba0"))
- (patches (search-patches "tar-CVE-2016-6321.patch"
- "tar-skip-unreliable-tests.patch"))))
+ "1lyjyk8z8hdddsxw0ikchrsfg3i0x3fsh7l63a8jgaz1n7dr5gzi"))
+ (patches (search-patches "tar-skip-unreliable-tests.patch"))))
(build-system gnu-build-system)
;; Note: test suite requires ~1GiB of disk space.
(arguments
diff --git a/gnu/packages/patches/tar-CVE-2016-6321.patch b/gnu/packages/patches/tar-CVE-2016-6321.patch
deleted file mode 100644
index b79be9bc9..000000000
--- a/gnu/packages/patches/tar-CVE-2016-6321.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-Fix CVE-2016-6321:
-
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6321
-https://security-tracker.debian.org/tracker/CVE-2016-6321
-
-Patch adapted from upstream source repository (the changes to 'NEWS'
-don't apply to the Tar 1.29 release tarball).
-
-http://git.savannah.gnu.org/cgit/tar.git/commit/?id=7340f67b9860ea0531c1450e5aa261c50f67165d
-
-From 7340f67b9860ea0531c1450e5aa261c50f67165d Mon Sep 17 00:00:00 2001
-From: Paul Eggert <eggert@Penguin.CS.UCLA.EDU>
-Date: Sat, 29 Oct 2016 21:04:40 -0700
-Subject: [PATCH] When extracting, skip ".." members
-
-* NEWS: Document this.
-* src/extract.c (extract_archive): Skip members whose names
-contain "..".
----
- NEWS | 8 +++++++-
- src/extract.c | 8 ++++++++
- 2 files changed, 15 insertions(+), 1 deletion(-)
-
-diff --git a/src/extract.c b/src/extract.c
-index f982433..7904148 100644
---- a/src/extract.c
-+++ b/src/extract.c
-@@ -1629,12 +1629,20 @@ extract_archive (void)
- {
- char typeflag;
- tar_extractor_t fun;
-+ bool skip_dotdot_name;
-
- fatal_exit_hook = extract_finish;
-
- set_next_block_after (current_header);
-
-+ skip_dotdot_name = (!absolute_names_option
-+ && contains_dot_dot (current_stat_info.orig_file_name));
-+ if (skip_dotdot_name)
-+ ERROR ((0, 0, _("%s: Member name contains '..'"),
-+ quotearg_colon (current_stat_info.orig_file_name)));
-+
- if (!current_stat_info.file_name[0]
-+ || skip_dotdot_name
- || (interactive_option
- && !confirm ("extract", current_stat_info.file_name)))
- {
---
-2.11.0
-
--
2.16.1
[-- Attachment #3: Type: text/plain, Size: 14 bytes --]
Cheers,
Alex
next reply other threads:[~2018-02-01 15:56 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-02-01 15:55 Alex Vong [this message]
2018-02-01 21:15 ` [bug#30319] [PATCH] gnu: tar: Update to 1.30 Leo Famulari
2018-02-01 23:24 ` Alex Vong
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://guix.gnu.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87a7wsaen4.fsf@gmail.com \
--to=alexvong1995@gmail.com \
--cc=30319@debbugs.gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).