- Arch-dev-public - lists.archlinux.org

[arch-dev-public] APNG patch in libpng
by Travis Willard 06 May '08

06 May '08

Hey guys, Recent exploit found in libpng < 1.2.27 (http://bugs.archlinux.org/task/10192#comment27550) is getting a lot of attention in our forums and bugtrackers, however since the APNG patch (included for firefox3's sake - http://bugs.archlinux.org/task/9570) isn't updated for the new libpng version yet, I'm blocked on updating this. If I drop APNG from libpng to ensure we get updates as quick as possible, this means firefox3 will need to be rebuilt without system PNG. If this happens, that means firefox3 will be using a vulnerable version of the library, but I can react quicker to vulnerabilities like this in the future. I'm not sure what is the best course of action. Wait until a new APNG patch is released? Update and force firefox3 to rebuild? >From the libpng website: "The pngtest sample application distributed with libpng, pngcrush, and certain versions of ImageMagick are known to be affected, but the bug is otherwise believed to be quite rare." - if the bug is quite rare, can we put it off? Any input?

2 8

[arch-dev-public] [signoff] dialog 20080318-1
by Andreas Radke 05 May '08

05 May '08

new upstream release with minor changes. in testing for both arches. also added some minor requested features #10060 and utf8 support #8984. binary file size didn't increased too much. should be also ok with our installer. our iso builders should test it! -Andy -- $Id: CHANGES,v 1.248 2008/03/16 20:13:15 tom Exp $ -- Thomas E. Dickey <dickey(a)invisible-island.net> This version of dialog was originally from a Debian snapshot. I've done this to it: 2008/03/16 + modify dlg_mouse_wgetch() to loop only on errors that it detects, rather than on errors forwarded from dlg_getc(), in case those are due to a disconnected terminal (report by Anatoli Sakhnik). + allow "default" color in dialogrc file (request by Dashing). + fix an indexing error in formbox (Debian #469190, report by Dmitry Gomerman, patch by Vladimir Mezentsev). + add bindings for CTL/N, CTL/P to checklist, fselect and menubox widgets (prompted by discussion with John Gatewood Ham). + add be(a)latin.po, th.po and update zh_TW.po from http://translationproject.org/latest/dialog/ > patches by Peter Astrand: + modify dlg_auto_sizefile() to ensure the computed height and width do not extend beyond the screen size. + use unctrl() to make inputstr.c work with Solaris curses. > patches by Yura Kalinichenko: + extend pause widget to use ok/cancel buttons (the former giving the same result as a timeout), rather than an exit-button. + fix initialization parameter of inputbox for multibyte characters.

3 4

[arch-dev-public] [signoff] wget 1.11.2-1
by Andreas Radke 05 May '08

05 May '08

another minor upstream bugfix release in testing for both arches. please signoff. -Andy * Changes in Wget 1.11.2 ** Fixed a problem in authenticating over HTTPS through a proxy. (Regression in 1.11 over 1.10.2.) ** The combination of -r or -p with -O, which was disallowed in 1.11, has been downgraded to a warning in 1.11.2. (-O and -N, which was never meaningful, is still an error.) ** Further improvements to progress bar displays in non-English locales (too many spaces could be inserted, causing the display to scroll). ** Successive invocations of Wget on FTP URLS, with --no-remove-listing and --continue, was causing Wget to append, rather than replace, information in the .listing file, and thereby download the same files multiple times. This has been fixed in 1.11.2. ** Wget 1.11 no longer allowed ".." to persist at the beginning of URLs, for improved conformance with RFC 3986. However, this behavior presents problems for some FTP setups, and so they are now preserved again, for FTP URLs only.

4 3

[arch-dev-public] [signoff] pam 1.0.1-1
by Andreas Radke 05 May '08

05 May '08

new pam in testing for both arches. only minor changes. please signoff. -Andy Linux-PAM NEWS -- history of user-visible changes. Release 1.0.1 * Regression fixed in pam_set_item(). Release 1.0.0 * Small bug fixes * Translation updates Release 0.99.10.0 * New substack directive in config file syntax. * New module pam_tty_audit.so for enabling and disabling tty auditing. * New PAM items PAM_XDISPLAY and PAM_XAUTHDATA. * Auditing login denials based by origin (pam_access), time (pam_time), and number of sessions (pam_limits) to the Linux audit subsystem. * Support sha256 and sha512 algorithms in pam_unix when they are supported by crypt(). * New pam_sepermit.so module for allowing/rejecting access based on SELinux mode. * Improved functionality of pam_namespace.so module (method flags, namespace.d configuration directory, new options). * Finaly removed deprecated pam_rhosts_auth module.

4 3

[arch-dev-public] [signoff] coreutils 6.11-1
by Andreas Radke 05 May '08

05 May '08

each coreutils release is known to have regressions. so please test it carefully. it's in testing for both arches. -Andy GNU coreutils NEWS -*- outline -*- * Noteworthy changes in release 6.11 (2008-04-19) [stable] ** Bug fixes configure --enable-no-install-program=groups now works. "cp -fR fifo E" now succeeds with an existing E. Before this fix, using -fR to copy a fifo or "special" file onto an existing file would fail with EEXIST. Now, it once again unlinks the destination before trying to create the destination file. [bug introduced in coreutils-5.90] dd once again works with unnecessary options like if=/dev/stdin and of=/dev/stdout. [bug introduced in fileutils-4.0h] id now uses getgrouplist, when possible. This results in much better performance when there are many users and/or groups. ls no longer segfaults on files in /proc when linked with an older version of libselinux. E.g., ls -l /proc/sys would dereference a NULL pointer. md5sum would segfault for invalid BSD-style input, e.g., echo 'MD5 (' | md5sum -c - Now, md5sum ignores that line. sha1sum, sha224sum, sha384sum, and sha512sum are affected, too. [bug introduced in coreutils-5.1.0] md5sum -c would accept a NUL-containing checksum string like "abcd\0..." and would unnecessarily read and compute the checksum of the named file, and then compare that checksum to the invalid one: guaranteed to fail. Now, it recognizes that the line is not valid and skips it. sha1sum, sha224sum, sha384sum, and sha512sum are affected, too. [bug present in the original version, in coreutils-4.5.1, 1995] "mkdir -Z x dir" no longer segfaults when diagnosing invalid context "x" mkfifo and mknod would fail similarly. Now they're fixed. mv would mistakenly unlink a destination file before calling rename, when the destination had two or more hard links. It no longer does that. [bug introduced in coreutils-5.3.0] "paste -d'\' file" no longer overruns memory (heap since coreutils-5.1.2, stack before then) [bug present in the original version, in 1992] "pr -e" with a mix of backspaces and TABs no longer corrupts the heap [bug present in the original version, in 1992] "ptx -F'\' long-file-name" would overrun a malloc'd buffer and corrupt the heap. That was triggered by a lone backslash (or odd number of them) at the end of the option argument to --flag-truncation=STRING (-F), --word-regexp=REGEXP (-W), or --sentence-regexp=REGEXP (-S). "rm -r DIR" would mistakenly declare to be "write protected" -- and prompt about -- full DIR-relative names longer than MIN (PATH_MAX, 8192). "rmdir --ignore-fail-on-non-empty" detects and ignores the failure in more cases when a directory is empty. "seq -f % 1" would issue the erroneous diagnostic "seq: memory exhausted" rather than reporting the invalid string format. [bug introduced in coreutils-6.0] ** New features join now verifies that the inputs are in sorted order. This check can be turned off with the --nocheck-order option. sort accepts the new option --sort=WORD, where WORD can be one of general-numeric, month, numeric or random. These are equivalent to the options --general-numeric-sort/-g, --month-sort/-M, --numeric-sort/-n and --random-sort/-R, resp. ** Improvements id and groups work around an AFS-related bug whereby those programs would print an invalid group number, when given no user-name argument. ls --color no longer outputs unnecessary escape sequences seq gives better diagnostics for invalid formats. ** Portability rm now works properly even on systems like BeOS and Haiku, which have negative errno values. ** Consistency install, mkdir, rmdir and split now write --verbose output to stdout, not to stderr.

4 3

Re: [arch-dev-public] [arch-general] ATTN: Kernel maintainers (tpowa, brain0): libcap
by Travis Willard 05 May '08

05 May '08

On Mon, May 5, 2008 at 1:34 PM, Michal Soltys <soltys(a)ziu.info> wrote: > Travis Willard wrote: > > > Hey guys, > > > > I just realized that, for some squirrely reason, I am currently > > "maintaining" libcap. I have no freakin' clue what libcap even is. I > > just got a flag-out-of-date version asking if we should update it to > > libcap2, which seems reasonable, as it's nice and shiny-new. Looking > > around, however, libcap seems tied to kernel releases, so maybe it'd > > make more sense for someone more in-the-know with kernel.org stuff to > > take it on? > > > > > > Version 2.x works pretty fine - I've been using it for a while, but you > will need some simple and straightforward patches for e.g. samba (it assumes > ancient lack of header declarations, should be fixed in .29) and vsftpd > (doesn't look for 2.x at all, but otherwise compiles and works perfectly > fine). From other notable things - ntpd requires linking to libcap, if you > want to run it with privilege separation. > > > > > Basically, if someone out there knows WTF libcap is for, and how to > > test, etc., then let me know and you can grab it. > > > > > > In short - it's overbloated suid ;) > > http://www.friedhoff.org/posixfilecaps.html > > Sorry for crossposting, but I though I'd be good to mention samba / vsftpd > stuff. No problemo - thanks for the insight. Now I know WTF it is for. :D

1 0

[arch-dev-public] Licenses: Is Creative Commons in our list?
by Thayer Williams 05 May '08

05 May '08

Excuse the naive question, but while putting together some PKGBUILDs for the Arch artwork stuff, I couldn't find any reference to the Creative Commons licenses in /usr/share/licenses. Am I missing something or do we need to add this to our collection? The Arch Linux logo (and other related artwork) is released under CC license so I want to make sure I flag these properly. Cheers, Thayer

3 4

[arch-dev-public] ATTN: Kernel maintainers (tpowa, brain0): libcap
by Travis Willard 05 May '08

05 May '08

Hey guys, I just realized that, for some squirrely reason, I am currently "maintaining" libcap. I have no freakin' clue what libcap even is. I just got a flag-out-of-date version asking if we should update it to libcap2, which seems reasonable, as it's nice and shiny-new. Looking around, however, libcap seems tied to kernel releases, so maybe it'd make more sense for someone more in-the-know with kernel.org stuff to take it on? Basically, if someone out there knows WTF libcap is for, and how to test, etc., then let me know and you can grab it.

1 0

[arch-dev-public] [signoff] texinfo 4.12-2
by Eric Belanger 02 May '08

02 May '08

in testing for both arches. Changes: Added to base-devel group Please signoff. -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

2 1

[arch-dev-public] OMG info pages
by Aaron Griffin 02 May '08

02 May '08

I'm really really sick of people making mountains out of the docs molehill... it's such a petty issue... Would anyone honestly care if we removed the !docs option from makepkg.conf by default, and let each maintainer add options=(!docs) if the docs are too big for a given package? No need to do the rebuilds all in one go, just let the docs trickle in... Opinions anyone?

11 19