- Arch-dev-public - lists.archlinux.org

[arch-dev-public] [signoff] openssl 0.9.8m-1
by Pierre Schmitz 03 Mar '10

03 Mar '10

Hi all, here is an update for openssl. It implements RFC5746 renegotiation. I also cleaned up the PKGBUILD and was able to remove some patches that are included upstream now. The remaining ones are just trivial and don't alter any program code. Please sign off. Here is the upstream changelog: Changes between 0.9.8l and 0.9.8m [25 Feb 2010] *) Always check bn_wexpend() return values for failure. (CVE-2009-3245) [Martin Olsson, Neel Mehta] *) Fix X509_STORE locking: Every 'objs' access requires a lock (to accommodate for stack sorting, always a write lock!). [Bodo Moeller] *) On some versions of WIN32 Heap32Next is very slow. This can cause excessive delays in the RAND_poll(): over a minute. As a workaround include a time check in the inner Heap32Next loop too. [Steve Henson] *) The code that handled flushing of data in SSL/TLS originally used the BIO_CTRL_INFO ctrl to see if any data was pending first. This caused the problem outlined in PR#1949. The fix suggested there however can trigger problems with buggy BIO_CTRL_WPENDING (e.g. some versions of Apache). So instead simplify the code to flush unconditionally. This should be fine since flushing with no data to flush is a no op. [Steve Henson] *) Handle TLS versions 2.0 and later properly and correctly use the highest version of TLS/SSL supported. Although TLS >= 2.0 is some way off ancient servers have a habit of sticking around for a while... [Steve Henson] *) Modify compression code so it frees up structures without using the ex_data callbacks. This works around a problem where some applications call CRYPTO_cleanup_all_ex_data() before application exit (e.g. when restarting) then use compression (e.g. SSL with compression) later. This results in significant per-connection memory leaks and has caused some security issues including CVE-2008-1678 and CVE-2009-4355. [Steve Henson] *) Constify crypto/cast (i.e., <openssl/cast.h>): a CAST_KEY doesn't change when encrypting or decrypting. [Bodo Moeller] *) Add option SSL_OP_LEGACY_SERVER_CONNECT which will allow clients to connect and renegotiate with servers which do not support RI. Until RI is more widely deployed this option is enabled by default. [Steve Henson] *) Add "missing" ssl ctrls to clear options and mode. [Steve Henson] *) If client attempts to renegotiate and doesn't support RI respond with a no_renegotiation alert as required by RFC5746. Some renegotiating TLS clients will continue a connection gracefully when they receive the alert. Unfortunately OpenSSL mishandled this alert and would hang waiting for a server hello which it will never receive. Now we treat a received no_renegotiation alert as a fatal error. This is because applications requesting a renegotiation might well expect it to succeed and would have no code in place to handle the server denying it so the only safe thing to do is to terminate the connection. [Steve Henson] *) Add ctrl macro SSL_get_secure_renegotiation_support() which returns 1 if peer supports secure renegotiation and 0 otherwise. Print out peer renegotiation support in s_client/s_server. [Steve Henson] *) Replace the highly broken and deprecated SPKAC certification method with the updated NID creation version. This should correctly handle UTF8. [Steve Henson] *) Implement RFC5746. Re-enable renegotiation but require the extension as needed. Unfortunately, SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION turns out to be a bad idea. It has been replaced by SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION which can be set with SSL_CTX_set_options(). This is really not recommended unless you know what you are doing. [Eric Rescorla <ekr(a)networkresonance.com>, Ben Laurie, Steve Henson] *) Fixes to stateless session resumption handling. Use initial_ctx when issuing and attempting to decrypt tickets in case it has changed during servername handling. Use a non-zero length session ID when attempting stateless session resumption: this makes it possible to determine if a resumption has occurred immediately after receiving server hello (several places in OpenSSL subtly assume this) instead of later in the handshake. [Steve Henson] *) The functions ENGINE_ctrl(), OPENSSL_isservice(), CMS_get1_RecipientRequest() and RAND_bytes() can return <=0 on error fixes for a few places where the return code is not checked correctly. [Julia Lawall <julia(a)diku.dk>] *) Add --strict-warnings option to Configure script to include devteam warnings in other configurations. [Steve Henson] *) Add support for --libdir option and LIBDIR variable in makefiles. This makes it possible to install openssl libraries in locations which have names other than "lib", for example "/usr/lib64" which some systems need. [Steve Henson, based on patch from Jeremy Utley] *) Don't allow the use of leading 0x80 in OIDs. This is a violation of X690 8.9.12 and can produce some misleading textual output of OIDs. [Steve Henson, reported by Dan Kaminsky] *) Delete MD2 from algorithm tables. This follows the recommendation in several standards that it is not used in new applications due to several cryptographic weaknesses. For binary compatibility reasons the MD2 API is still compiled in by default. [Steve Henson] *) Add compression id to {d2i,i2d}_SSL_SESSION so it is correctly saved and restored. [Steve Henson] *) Rename uni2asc and asc2uni functions to OPENSSL_uni2asc and OPENSSL_asc2uni conditionally on Netware platforms to avoid a name clash. [Guenter <lists(a)gknw.net>] *) Fix the server certificate chain building code to use X509_verify_cert(), it used to have an ad-hoc builder which was unable to cope with anything other than a simple chain. [David Woodhouse <dwmw2(a)infradead.org>, Steve Henson] *) Don't check self signed certificate signatures in X509_verify_cert() by default (a flag can override this): it just wastes time without adding any security. As a useful side effect self signed root CAs with non-FIPS digests are now usable in FIPS mode. [Steve Henson] *) In dtls1_process_out_of_seq_message() the check if the current message is already buffered was missing. For every new message was memory allocated, allowing an attacker to perform an denial of service attack with sending out of seq handshake messages until there is no memory left. Additionally every future messege was buffered, even if the sequence number made no sense and would be part of another handshake. So only messages with sequence numbers less than 10 in advance will be buffered. (CVE-2009-1378) [Robin Seggelmann, discovered by Daniel Mentz] *) Records are buffered if they arrive with a future epoch to be processed after finishing the corresponding handshake. There is currently no limitation to this buffer allowing an attacker to perform a DOS attack with sending records with future epochs until there is no memory left. This patch adds the pqueue_size() function to detemine the size of a buffer and limits the record buffer to 100 entries. (CVE-2009-1377) [Robin Seggelmann, discovered by Daniel Mentz] *) Keep a copy of frag->msg_header.frag_len so it can be used after the parent structure is freed. (CVE-2009-1379) [Daniel Mentz] *) Handle non-blocking I/O properly in SSL_shutdown() call. [Darryl Miles <darryl-mailinglists(a)netbauds.net>] *) Add 2.5.4.* OIDs [Ilya O. <vrghost(a)gmail.com>] -- Pierre Schmitz, https://users.archlinux.de/~pierre

3 3

[arch-dev-public] Versioned dependency fun...
by Allan McRae 02 Mar '10

02 Mar '10

Hmmm... > pacman -U libjpeg-8a-1-i686.pkg.tar.xz loading package data... checking dependencies... error: failed to prepare transaction (could not satisfy dependencies) :: ghostscript: requires libjpeg>=8 :: imlib2: requires libjpeg>=8 :: jasper: requires libjpeg>=8 :: libdjvu: requires libjpeg>=8 .... To avoid this, I will be renumbering it to libjpeg-8.0.1 (which is the soname version). Allan

3 5

[arch-dev-public] [signoff] fakeroot 1.14.4-2
by Allan McRae 02 Mar '10

02 Mar '10

Rebuild to do the ld.so.conf.d thing. Signoff both, Allan

3 3

[arch-dev-public] initscripts hack-a-thon?
by Allan McRae 02 Mar '10

02 Mar '10

Hi all, Looking in the bug tracker, there are 35 bug reports for initscripts. That represents about 10% of bugs... I'm not really sure who is in charge of initscripts these days, but how about a group of use gets together on IRC some time in the future and try getting through a bunch of these bug reports? Allan

5 4

[arch-dev-public] [signoff] namcap 2.5
by Dan McGee 02 Mar '10

02 Mar '10

I wrapped up the namcap changes tonight and got a version released. I converted it to an any package as well in the process. Let Pierre notice if you see any problems here with his new wrapper script. :) If things seem OK then we'll move this off to [extra] in a few days, I just didn't want to break namcap for everyone if it turns out there was something we missed. -Dan Here is the shortlog since 2.4: Abhishek Dasgupta (1): Fix rpath: /usr/lib/* and /lib are valid Dan McGee (12): Add a warning for packages that are over 50% docs Touch up hicolor icon message Add a way to use an alternate tags file Allow static libraries to have 644 or 444 permission Don't ignore the presence of unknown library references Cleanup some messages rpath: show both invalid rpath and file it was in rpath: allow $ORIGIN type rpaths Cleanup setup.py a bit Do checking for tarfiles correctly Bump version to 2.5 setup.py: Make sdist command work Pierre Schmitz (1): Use a wrapper script to support different compression types

3 2

[arch-dev-public] [PATCH 4/4] ftpdir-cleanup: lock repo before doing the cleanup
by Eric Bélanger 02 Mar '10

02 Mar '10

This should fix the problem of the ftpdir-cleanup script removing the new package instead of the old one (FS#17058). The script makes $LOCK_TRIAL attempts, each separated by $LOCK_DELAY seconds, in getting the repo lock. If the lock is unsuccessful, the cleanup is skipped for that particular repo. Signed-off-by: Eric Bélanger <snowmaniscool(a)gmail.com> BTW, I didn't really tested this except the while loop logic. --- misc-scripts/ftpdir-cleanup | 28 +++++++++++++++++++++++++--- 1 files changed, 25 insertions(+), 3 deletions(-) diff --git a/misc-scripts/ftpdir-cleanup b/misc-scripts/ftpdir-cleanup index a185090..77f79e6 100755 --- a/misc-scripts/ftpdir-cleanup +++ b/misc-scripts/ftpdir-cleanup @@ -10,15 +10,35 @@ dest=$2 ############################################################ -. "$(dirname $0)/../db-functions" +. "$(dirname $0)/../db-functions" . "$(dirname $0)/../config" ${CLEANUP_DRYRUN} && echo 'dry run mode is active' ftppath_base="$FTP_BASE/$reponame/$FTP_OS_SUFFIX" +LOCK_DELAY=10 +LOCK_TRIAL=6 + for arch in ${ARCHES[@]}; do + IS_LOCKED=0 + count=0 + while [ $count -le $LOCK_TRIAL ]; do + if repo_lock $reponame $arch ; then + IS_LOCKED=1 + let count=$LOCK_TRIAL+1 + continue + fi + sleep $LOCK_DELAY + let count=$count+1 + done + + if [ $IS_LOCKED -eq 0 ]; then + echo "Failed to lock $reponame $arch repo" + exit 1 + fi + TMPDIR=$(mktemp -d /tmp/cleanup-XXXXXX) || exit 1 ftppath="$ftppath_base/$arch" MISSINGFILES="" @@ -80,10 +100,10 @@ for arch in ${ARCHES[@]}; do dbpkgname=$(grep -A1 '^%FILENAME%$' "${p}/desc" 2>/dev/null| tail -n1) if [ "${dbpkgname}" = "${pkgname}" ]; then continue 2 - fi + fi done EXTRAFILES="$EXTRAFILES $pkg" - done + done rm -rf ${TMPDIR} @@ -100,6 +120,8 @@ for arch in ${ARCHES[@]}; do fi done + repo_unlock $reponame $arch + #Make sure we've done *something* before outputting anything if [ -z "$DELETEFILES$DELETESYMLINKS$MISSINGFILES$EXTRAFILES" ]; then continue -- 1.7.0

4 6

[arch-dev-public] [PATCH 4/4] Make repo locking an atomic process and added timeout argument
by Eric Bélanger 02 Mar '10

02 Mar '10

The repo locking function now use a lock directory instead of a lock file. This makes the lock checking and creation an atomic process. The repo_lock function will now try to obtain a lock every $LOCK_DELAY seconds until it is successful. An optional third argument can be use to give a timeout in seconds; this is intended for scripts that runs unattended. Repo locking is now used in the ftpdir-cleanup script. This should fix the problem of the ftpdir-cleanup script removing the new package instead of the old one (FS#17058). Signed-off-by: Eric Bélanger <snowmaniscool(a)gmail.com> --- config | 3 ++ db-functions | 48 ++++++++++++++++++++++++++++-------------- misc-scripts/ftpdir-cleanup | 10 ++++++-- 3 files changed, 42 insertions(+), 19 deletions(-) diff --git a/config b/config index 8d04c60..85a225a 100644 --- a/config +++ b/config @@ -9,6 +9,9 @@ CLEANUP_DESTDIR="/srv/package-cleanup" CLEANUP_DRYRUN=false SOURCE_CLEANUP_DESTDIR="/srv/source-cleanup" +LOCK_DELAY=10 +LOCK_TIMEOUT=300 + STAGING="$HOME/staging" TMPDIR="/srv/tmp" ARCHES=(i686 x86_64) diff --git a/db-functions b/db-functions index e756368..d688df6 100644 --- a/db-functions +++ b/db-functions @@ -15,27 +15,43 @@ restore_umask () { umask $UMASK } -repo_lock () { #repo_lock repo-name arch - LOCKFILE="$TMPDIR/.repolock.$1.$2" - if [ -f "$LOCKFILE" ]; then - owner="$(/usr/bin/stat -c %U $LOCKFILE)" - echo "error: db generation is already in progress (started by $owner)" >&2 - exit 1 - else - /bin/touch "$LOCKFILE" - if [ ! -f "$LOCKFILE" ]; then - echo "error: could not create repo lock... something went wrong!" >&2 - fi - set_umask +repo_lock () { #repo_lock <repo-name> <arch> [timeout] + LOCKDIR="$TMPDIR/.repolock.$1.$2" + local _count + local _trial + local _timeout + local _lockblock + local _owner + + if [ $# -eq 2 ]; then + _lockblock=true + _trial=0 + elif [ $# -eq 3 ]; then + _lockblock=false + _timeout=$3 + let _trial=$_timeout/$LOCK_DELAY fi + + _count=0 + while [ $_count -le $_trial ] || $_lockblock ; do + if ! mkdir "$LOCKDIR" >/dev/null 2>&1 ; then + _owner="$(/usr/bin/stat -c %U $LOCKDIR)" + echo "error: Repo $1-$2 is already locked by $_owner. Retrying in $LOCK_DELAY seconds..." >&2 + else + set_umask + break + fi + sleep $LOCK_DELAY + let _count=$_count+1 + done } -repo_unlock () { #repo_unlock repo-name arch - LOCKFILE="$TMPDIR/.repolock.$1.$2" - if [ ! -f "$LOCKFILE" ]; then +repo_unlock () { #repo_unlock <repo-name> <arch> + LOCKDIR="$TMPDIR/.repolock.$1.$2" + if [ ! -d "$LOCKDIR" ]; then echo "error: repo lock doesn't exist... something went terribly wrong!" >&2 else - rm -f "$LOCKFILE" + rmdir "$LOCKDIR" fi restore_umask } diff --git a/misc-scripts/ftpdir-cleanup b/misc-scripts/ftpdir-cleanup index a185090..4c559b9 100755 --- a/misc-scripts/ftpdir-cleanup +++ b/misc-scripts/ftpdir-cleanup @@ -10,7 +10,7 @@ dest=$2 ############################################################ -. "$(dirname $0)/../db-functions" +. "$(dirname $0)/../db-functions" . "$(dirname $0)/../config" ${CLEANUP_DRYRUN} && echo 'dry run mode is active' @@ -19,6 +19,8 @@ ftppath_base="$FTP_BASE/$reponame/$FTP_OS_SUFFIX" for arch in ${ARCHES[@]}; do + repo_lock $reponame $arch $LOCK_TIMEOUT + TMPDIR=$(mktemp -d /tmp/cleanup-XXXXXX) || exit 1 ftppath="$ftppath_base/$arch" MISSINGFILES="" @@ -80,10 +82,10 @@ for arch in ${ARCHES[@]}; do dbpkgname=$(grep -A1 '^%FILENAME%$' "${p}/desc" 2>/dev/null| tail -n1) if [ "${dbpkgname}" = "${pkgname}" ]; then continue 2 - fi + fi done EXTRAFILES="$EXTRAFILES $pkg" - done + done rm -rf ${TMPDIR} @@ -100,6 +102,8 @@ for arch in ${ARCHES[@]}; do fi done + repo_unlock $reponame $arch + #Make sure we've done *something* before outputting anything if [ -z "$DELETEFILES$DELETESYMLINKS$MISSINGFILES$EXTRAFILES" ]; then continue -- 1.7.0.1

1 0

[arch-dev-public] archboot release homepage created
by Tobias Powalowski 01 Mar '10

01 Mar '10

Hi guys, just created a archboot release homepage, would it be possible to link it somewhere on DOWNLOAD on our main page? ftp://ftp.archlinux.org/iso/archboot/index.html is the adress. thanks in advance greetings tpowa -- Tobias Powalowski Archlinux Developer & Package Maintainer (tpowa) http://www.archlinux.org tpowa(a)archlinux.org

4 5

[arch-dev-public] [signoff] m4-1.4.14
by Allan McRae 01 Mar '10

01 Mar '10

Upstream update. * Noteworthy changes in Version 1.4.14 (2010-02-24) [stable] Released by Eric Blake, based on git version 1.4.13.* ** Fix regression introduced in 1.4.12 where executing with stdout closed could crash m4 on exit on some platforms. ** Fix regressions introduced in 1.4.13 in the `esyscmd' builtin, where closed file descriptors could interfere with child execution, and where a child status of 127 made m4 print a spurious message to stderr. ** Fix a security hole in 'make dist', present since at least M4 1.4, that could affect anybody attempting to redistribute modified sources (see Automake CVE-2009-4029). ** A number of portability improvements inherited from gnulib. Signoff both, Allan

2 2

[arch-dev-public] boost-1.42.0 rebuild
by Giovanni Scafora 28 Feb '10

28 Feb '10

Hi all, boost-1.42.0 requires another rebuild due to a soname bumps. What do you think about that? -- Arch Linux Developer http://www.archlinux.org http://www.archlinux.it

4 19