- Arch-dev-public - lists.archlinux.org

[arch-dev-public] postgres move
by Pierre Schmitz 08 May '08

08 May '08

Hi all, how is the status of postgres in testing? It is blocking php from being move to extra. postgres is in testing for 3 month now; so could it be moved to extra as well? Pierre -- archlinux.de

5 7

[arch-dev-public] SVN repo view
by Aaron Griffin 08 May '08

08 May '08

This is being sent out to the public list, as the last discussion was internal. We now have a web front end to our PKGBUILDs at the URL: http://repos.archlinux.org Yes, it's themed, and yes, it's paged. You can also use it to view the old CVS repos too. Oh, also, it uses enscript to color PKGBUILDs, and I forced it to detect PKGBUILD files as bash. If someone wants to go crazy and make an enscript file (/usr/share/enscript/hl/*) for a PKGBUILD, then this viewer could be all the more better. Cheers, Aaron

2 5

[arch-dev-public] New DB scripts
by Aaron Griffin 07 May '08

07 May '08

Hey all, I'm comfortable enough with the new db scripts to throw them out in the wild. So, I've placed them at /arch-new for you to play with. Here are some caveats, however: * This will not update the website DB. Use at your discresion. Once these are "approved", then Eliott can move the new-model web changes out and the front end WILL be updated on a cron job. * There will be a warning about ~/staging/${REPO}64/ existing. This is expected. Because we have the arch in the filename, we don't need extra dirs anymore. Don't worry, the scripts handle it gracefully and a new devtools release will do away with pushing to the '64' dirs. Then we can clean up our staging dirs a bit. * I didn't fully test removal, because I didn't have anything to remove. If someone has a package to remove, let me know so I can test it properly. If you try, let me know if it fails. Neat things: * This can now _kinda_ create on-the-fly repos, but I locked it down a tad to prevent abuse. The following pattern should make a brand new repo with no problem: archrelease foobar-i686 ssh archlinux.org /arch-new/db-update foobar i686 Now, this actually requires someone with the right privileges to create /home/ftp/foobar, because I didn't want 400 repos being sent out to all our mirrors. * Should be much faster on the svn checkout and all that stuff * Uses repo-add which means we get the 5 or 6 DB values that we've been missing since pacman 3.0 was released. Now, when I "move these live", the following need to be done at the same time. * I need to rebuild ALL dbs with repo-add once, just to get some data for old packages in there. * We need to move the newmodel code so the front end is updated * We _should_ release a new devtools, for the staging dir changes Extra notes: * All cleanup scripts should be able to function off of a repo DB file, and be runnable as a cron job. I am going to be setting up Thomas' ftpdir-cleanup script as a cron job which will clean up all package files that are NOT in the db. No more dupe cleaning, yay! * packages.txt has been broken since we moved to svn. No one has noticed, I think. Should this be done away with, or should it be adapted as a cron-able task?

4 6

[arch-dev-public] [signoff] m4-1.4.11-1
by Andreas Radke 07 May '08

07 May '08

new version in testing for both arches. please signoff. -Andy * Noteworthy changes in Version 1.4.11 (2008-04-02) [stable] Released by Eric Blake, based on git version 1.4.10a ** Security fixes for the -F option, for bugs present since -F was introduced in 1.3: Avoid core dump with 'm4 -F file -t undefined', and avoid arbitrary code execution with certain file names. ** Fix regression introduced in 1.4.9b in the `divert' builtin when more than 512 kibibytes are saved in diversions on platforms like NetBSD or darwin where fopen(name,"a+") seeks to the end of the file. ** The output of the `maketemp' and `mkstemp' builtins is now quoted if a file was created. This is a minor security fix, because it was possible (although rather unlikely) that an unquoted string could match an existing macro name, such that use of the `mkstemp' output would trigger inadvertent macro expansion and operate on the wrong file name. ** Enhance the `defn' builtin to support concatenation of multiple text arguments, as required by POSIX. However, at this time, it is not possible to concatenate a builtin macro with anything else; a warning is now issued if this is attempted, although a future version of M4 may lift this restriction to match other implementations. ** Enhance the `format' builtin to parse all C99 floating point numbers, even on platforms where strtod(3) is buggy, although the replacement function does have the known issue of rounding errors when parsing some decimal floating point values. This fixes testsuite failures introduced in 1.4.9b. ** Enhance the `index' builtin to guarantee linear behavior, in spite of the surprisingly large number of systems with a brain-dead quadratic strstr(3). ** A number of portability improvements inherited from gnulib.

3 2

[arch-dev-public] [signoff] pkgconfig 0.23-1
by Andreas Radke 07 May '08

07 May '08

minor update in testing for both arches. -Andy pkg-config 0.23 === - Add support for setting sysroot through PKG_CONFIG_SYSROOT_DIR in the environment. - Update included glib to 1.2.10. - Other minor fixes, including a segfault.

2 1

[arch-dev-public] APNG patch in libpng
by Travis Willard 06 May '08

06 May '08

Hey guys, Recent exploit found in libpng < 1.2.27 (http://bugs.archlinux.org/task/10192#comment27550) is getting a lot of attention in our forums and bugtrackers, however since the APNG patch (included for firefox3's sake - http://bugs.archlinux.org/task/9570) isn't updated for the new libpng version yet, I'm blocked on updating this. If I drop APNG from libpng to ensure we get updates as quick as possible, this means firefox3 will need to be rebuilt without system PNG. If this happens, that means firefox3 will be using a vulnerable version of the library, but I can react quicker to vulnerabilities like this in the future. I'm not sure what is the best course of action. Wait until a new APNG patch is released? Update and force firefox3 to rebuild? >From the libpng website: "The pngtest sample application distributed with libpng, pngcrush, and certain versions of ImageMagick are known to be affected, but the bug is otherwise believed to be quite rare." - if the bug is quite rare, can we put it off? Any input?

2 8

[arch-dev-public] [signoff] dialog 20080318-1
by Andreas Radke 05 May '08

05 May '08

new upstream release with minor changes. in testing for both arches. also added some minor requested features #10060 and utf8 support #8984. binary file size didn't increased too much. should be also ok with our installer. our iso builders should test it! -Andy -- $Id: CHANGES,v 1.248 2008/03/16 20:13:15 tom Exp $ -- Thomas E. Dickey <dickey(a)invisible-island.net> This version of dialog was originally from a Debian snapshot. I've done this to it: 2008/03/16 + modify dlg_mouse_wgetch() to loop only on errors that it detects, rather than on errors forwarded from dlg_getc(), in case those are due to a disconnected terminal (report by Anatoli Sakhnik). + allow "default" color in dialogrc file (request by Dashing). + fix an indexing error in formbox (Debian #469190, report by Dmitry Gomerman, patch by Vladimir Mezentsev). + add bindings for CTL/N, CTL/P to checklist, fselect and menubox widgets (prompted by discussion with John Gatewood Ham). + add be(a)latin.po, th.po and update zh_TW.po from http://translationproject.org/latest/dialog/ > patches by Peter Astrand: + modify dlg_auto_sizefile() to ensure the computed height and width do not extend beyond the screen size. + use unctrl() to make inputstr.c work with Solaris curses. > patches by Yura Kalinichenko: + extend pause widget to use ok/cancel buttons (the former giving the same result as a timeout), rather than an exit-button. + fix initialization parameter of inputbox for multibyte characters.

3 4

[arch-dev-public] [signoff] wget 1.11.2-1
by Andreas Radke 05 May '08

05 May '08

another minor upstream bugfix release in testing for both arches. please signoff. -Andy * Changes in Wget 1.11.2 ** Fixed a problem in authenticating over HTTPS through a proxy. (Regression in 1.11 over 1.10.2.) ** The combination of -r or -p with -O, which was disallowed in 1.11, has been downgraded to a warning in 1.11.2. (-O and -N, which was never meaningful, is still an error.) ** Further improvements to progress bar displays in non-English locales (too many spaces could be inserted, causing the display to scroll). ** Successive invocations of Wget on FTP URLS, with --no-remove-listing and --continue, was causing Wget to append, rather than replace, information in the .listing file, and thereby download the same files multiple times. This has been fixed in 1.11.2. ** Wget 1.11 no longer allowed ".." to persist at the beginning of URLs, for improved conformance with RFC 3986. However, this behavior presents problems for some FTP setups, and so they are now preserved again, for FTP URLs only.

4 3

[arch-dev-public] [signoff] pam 1.0.1-1
by Andreas Radke 05 May '08

05 May '08

new pam in testing for both arches. only minor changes. please signoff. -Andy Linux-PAM NEWS -- history of user-visible changes. Release 1.0.1 * Regression fixed in pam_set_item(). Release 1.0.0 * Small bug fixes * Translation updates Release 0.99.10.0 * New substack directive in config file syntax. * New module pam_tty_audit.so for enabling and disabling tty auditing. * New PAM items PAM_XDISPLAY and PAM_XAUTHDATA. * Auditing login denials based by origin (pam_access), time (pam_time), and number of sessions (pam_limits) to the Linux audit subsystem. * Support sha256 and sha512 algorithms in pam_unix when they are supported by crypt(). * New pam_sepermit.so module for allowing/rejecting access based on SELinux mode. * Improved functionality of pam_namespace.so module (method flags, namespace.d configuration directory, new options). * Finaly removed deprecated pam_rhosts_auth module.

4 3

[arch-dev-public] [signoff] coreutils 6.11-1
by Andreas Radke 05 May '08

05 May '08

each coreutils release is known to have regressions. so please test it carefully. it's in testing for both arches. -Andy GNU coreutils NEWS -*- outline -*- * Noteworthy changes in release 6.11 (2008-04-19) [stable] ** Bug fixes configure --enable-no-install-program=groups now works. "cp -fR fifo E" now succeeds with an existing E. Before this fix, using -fR to copy a fifo or "special" file onto an existing file would fail with EEXIST. Now, it once again unlinks the destination before trying to create the destination file. [bug introduced in coreutils-5.90] dd once again works with unnecessary options like if=/dev/stdin and of=/dev/stdout. [bug introduced in fileutils-4.0h] id now uses getgrouplist, when possible. This results in much better performance when there are many users and/or groups. ls no longer segfaults on files in /proc when linked with an older version of libselinux. E.g., ls -l /proc/sys would dereference a NULL pointer. md5sum would segfault for invalid BSD-style input, e.g., echo 'MD5 (' | md5sum -c - Now, md5sum ignores that line. sha1sum, sha224sum, sha384sum, and sha512sum are affected, too. [bug introduced in coreutils-5.1.0] md5sum -c would accept a NUL-containing checksum string like "abcd\0..." and would unnecessarily read and compute the checksum of the named file, and then compare that checksum to the invalid one: guaranteed to fail. Now, it recognizes that the line is not valid and skips it. sha1sum, sha224sum, sha384sum, and sha512sum are affected, too. [bug present in the original version, in coreutils-4.5.1, 1995] "mkdir -Z x dir" no longer segfaults when diagnosing invalid context "x" mkfifo and mknod would fail similarly. Now they're fixed. mv would mistakenly unlink a destination file before calling rename, when the destination had two or more hard links. It no longer does that. [bug introduced in coreutils-5.3.0] "paste -d'\' file" no longer overruns memory (heap since coreutils-5.1.2, stack before then) [bug present in the original version, in 1992] "pr -e" with a mix of backspaces and TABs no longer corrupts the heap [bug present in the original version, in 1992] "ptx -F'\' long-file-name" would overrun a malloc'd buffer and corrupt the heap. That was triggered by a lone backslash (or odd number of them) at the end of the option argument to --flag-truncation=STRING (-F), --word-regexp=REGEXP (-W), or --sentence-regexp=REGEXP (-S). "rm -r DIR" would mistakenly declare to be "write protected" -- and prompt about -- full DIR-relative names longer than MIN (PATH_MAX, 8192). "rmdir --ignore-fail-on-non-empty" detects and ignores the failure in more cases when a directory is empty. "seq -f % 1" would issue the erroneous diagnostic "seq: memory exhausted" rather than reporting the invalid string format. [bug introduced in coreutils-6.0] ** New features join now verifies that the inputs are in sorted order. This check can be turned off with the --nocheck-order option. sort accepts the new option --sort=WORD, where WORD can be one of general-numeric, month, numeric or random. These are equivalent to the options --general-numeric-sort/-g, --month-sort/-M, --numeric-sort/-n and --random-sort/-R, resp. ** Improvements id and groups work around an AFS-related bug whereby those programs would print an invalid group number, when given no user-name argument. ls --color no longer outputs unnecessary escape sequences seq gives better diagnostics for invalid formats. ** Portability rm now works properly even on systems like BeOS and Haiku, which have negative errno values. ** Consistency install, mkdir, rmdir and split now write --verbose output to stdout, not to stderr.

4 3