Hello community, here is the log from the commit of package ruby for openSUSE:11.4 checked in at Tue Feb 22 21:49:57 CET 2011.
Login failed, 500 SSL negotiation failed: at /work/abuild/lib/abuild/modules/SUSE/BugzillaClient.pm line 99. -------- --- old-versions/11.4/all/ruby/ruby.changes 2010-07-02 11:50:18.000000000 +0200 +++ 11.4/ruby/ruby.changes 2011-02-22 17:58:56.000000000 +0100 @@ -1,0 +2,33 @@ +Tue Feb 22 16:38:09 UTC 2011 - [email protected] + +- update to 1.8.7.p334 (bnc#673740, bnc#673750, bnc#600752) + - A symlink race condition vulnerability was found in + FileUtils.remove_entry_secure. The vulnerability allows local + users to delete arbitrary files and directories. CVE-2011-1004 + - Exception#to_s method can be used to trick $SAFE check, which + makes a untrusted codes to modify arbitrary strings. + CVE-2011-1005 + - Ruby WEBrick character set issue (XSS) CVE-2010-0541 + + for all non security changes see + /usr/share/doc/packages/ruby/ChangeLog + +- refreshed ruby-1.8.x_openssl_branch_update.patch +- buildrequires openssl to make the last openssl test work +- https://github.com/ruby/ruby/commit/1887f60a8540f64f5c7bb14d57c0be70506941b8.patch + * ext/zlib/zlib.c (zstream_append_input2): add RB_GC_GUARD. + This caused failure when test/csv is executed with GC.stress = + true. +- added ruby-1.8.7.p334_remove_zlib_test_params_test.patch: + remove the test_params patch from backport in r27917 + It doesnt pass atm. +- removed ruby-1.8.6.p36_socket_ipv6.patch: + included upstream + +------------------------------------------------------------------- +Tue Sep 7 14:38:54 UTC 2010 - [email protected] + +- the testsuite and doc-html package should of course require the + main package + +------------------------------------------------------------------- @@ -4,0 +38,24 @@ + +------------------------------------------------------------------- +Thu Jul 1 15:27:17 UTC 2010 - [email protected] + +- update to 1.8.7.p299 (bnc#606056 and bnc#603914) + - OpenSSL 1.0.0 support + - Use OpenSSL engines which exist + - Fixed range and chunked support for Net::HTTP + - Iconv fixes + - Backported pack/unpack from the 1.9 branch (bnc#606056 bnc#603914) + - Multiple fixes in the resolver + - Fixed Unicode inspection bug. + - Escape characters properly for the accesslog (bnc#570616) +- cleaned up rpmlintrc +- refreshed patches: + old: ruby-1.8.7.p22_lib64.patch + new: ruby-1.8.7.p299_lib64.patch + old: ruby_1.8.6.p36_date_remove_privat.patch + new: ruby-1.8.7.p299_date_remove_privat.patch + old: ruby-pedantic-headers.diff + new: ruby-1.8.7.p299_pedantic-headers.patch +- replaced patches ruby-1.8.x_openssl-1.0.patch and + ruby-1.8.x_openssl-1.0-tests.patch with + ruby-1.8.x_openssl_branch_update.patch calling whatdependson for 11.4-i586 Old: ---- ruby-1.8.6.p36_socket_ipv6.patch ruby-1.8.7-p249.tar.bz2 ruby-1.8.7-p72_topdir.patch ruby-1.8.7-p72_vendor_specific.patch ruby-1.8.7.p22_lib64.patch ruby-1.8.x_openssl-1.0-tests.patch ruby-1.8.x_openssl-1.0.patch ruby-pedantic-headers.diff ruby_1.8.6.p36_date_remove_privat.patch New: ---- 1887f60a8540f64f5c7bb14d57c0be70506941b8.patch ruby-1.8.7-p334.tar.bz2 ruby-1.8.7.p299_date_remove_privat.patch ruby-1.8.7.p299_lib64.patch ruby-1.8.7.p299_pedantic-headers.patch ruby-1.8.7.p299_webrick_error_page_encoding.patch ruby-1.8.7.p334_remove_zlib_test_params_test.patch ruby-1.8.7.p72_topdir.patch ruby-1.8.7.p72_vendor_specific.patch ruby-1.8.x_openssl_branch_update.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ ruby.spec ++++++ --- /var/tmp/diff_new_pack.FWOjj2/_old 2011-02-22 21:48:17.000000000 +0100 +++ /var/tmp/diff_new_pack.FWOjj2/_new 2011-02-22 21:48:17.000000000 +0100 @@ -1,7 +1,7 @@ # -# spec file for package ruby (Version 1.8.7.p249) +# spec file for package ruby # -# Copyright (c) 2010 SUSE LINUX Products GmbH, Nuernberg, Germany. +# Copyright (c) 2011 SUSE LINUX Products GmbH, Nuernberg, Germany. # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -19,11 +19,11 @@ Name: ruby -Version: 1.8.7.p249 -Release: 4 +Version: 1.8.7.p334 +Release: 1.<RELEASE2> # %define pkg_version 1.8.7 -%define patch_level p249 +%define patch_level p334 %define rb_arch %(echo %{_target_cpu}-linux | sed -e "s/i686/i586/" -e "s/hppa2.0/hppa/" -e "s/ppc/powerpc/") %define rb_ver %(echo %{pkg_version} | sed -e 's/\\\.[0-9]\\\+$//') # @@ -32,6 +32,8 @@ # BuildRoot: %{_tmppath}/%{name}-%{version}-build BuildRequires: bison gdbm-devel gperf graphviz libjpeg-devel openssl-devel readline-devel tk-devel +# for openssl testsuite +BuildRequires: openssl #define with_bleak_house 1 %if 0%{suse_version} >= 1030 %define use_fdupes 1 @@ -56,18 +58,20 @@ Source: ftp://ftp.ruby-lang.org/pub/ruby/ruby-%{pkg_version}-%{patch_level}.tar.bz2 Source1: irb.1 Source2: ruby-doc-bundle.tar.bz2 -Patch1: ruby-1.8.7.p22_lib64.patch +Patch1: ruby-1.8.7.p299_lib64.patch Patch2: ruby-1.8.7.p22_tcltk-multilib.patch -Patch3: ruby-1.8.6.p36_socket_ipv6.patch -Patch5: ruby_1.8.6.p36_date_remove_privat.patch -Patch6: ruby-pedantic-headers.diff -Patch7: ruby-1.8.7-p72_vendor_specific.patch -Patch8: ruby-1.8.7-p72_topdir.patch -# can be removed on next version update. pulled from svn +Patch5: ruby-1.8.7.p299_date_remove_privat.patch +Patch6: ruby-1.8.7.p299_pedantic-headers.patch +Patch7: ruby-1.8.7.p72_vendor_specific.patch +Patch8: ruby-1.8.7.p72_topdir.patch Patch9: ruby-1.8.x_digest_non_void_return.patch -Patch10: ruby-1.8.x_openssl-1.0.patch -Patch11: ruby-1.8.x_openssl-1.0-tests.patch -Patch12: ruby-1.8.x_yaml2byte.patch +# can be removed on next version update. pulled from svn +Patch10: ruby-1.8.x_openssl_branch_update.patch +Patch11: ruby-1.8.x_yaml2byte.patch +Patch12: 1887f60a8540f64f5c7bb14d57c0be70506941b8.patch +Patch13: ruby-1.8.7.p334_remove_zlib_test_params_test.patch +# need to discuss with sec team which encoding is better +Patch14: ruby-1.8.7.p299_webrick_error_page_encoding.patch # vendor ruby files taken from: # http://svn.macports.org/repository/macports/trunk/dports/lang/ruby/ Source3: site-specific.rb @@ -172,6 +176,7 @@ License: GPLv2+ Group: Development/Languages/Ruby Summary: This package contains the HTML docs for ruby +Requires: %{name} = %{version} %if 0%{?suse_version} >= 1120 BuildArch: noarch %endif @@ -188,8 +193,8 @@ %package examples License: GPLv2+ Group: Development/Languages/Ruby -Summary: Example scripts for ruby Requires: %{name} = %{version} +Summary: Example scripts for ruby %description examples Example scripts for ruby @@ -203,6 +208,7 @@ %package test-suite License: GPLv2+ Group: Development/Languages/Ruby +Requires: %{name} = %{version} Summary: An Interpreted Object-Oriented Scripting Language %description test-suite @@ -244,7 +250,6 @@ %setup -q -n ruby-%{pkg_version}-%{patch_level} -a2 %{?with_bleak_house:-a6} %patch1 %patch2 -%patch3 %patch5 %patch6 %patch7 @@ -253,6 +258,7 @@ %patch10 %patch11 %patch12 +%patch13 %if 0%{?with_bleak_house} for patch in valgrind configure gc ; do patch -p0 < bleak_house-%{bleak_house_version}/ruby/${patch}.patch @@ -263,7 +269,7 @@ old parse.c %build -autoreconf -fi +# autoreconf -fi export CFLAGS="%{optflags} -g -fno-strict-aliasing" %configure \ --target=%{_target_platform} \ ++++++ 1887f60a8540f64f5c7bb14d57c0be70506941b8.patch ++++++ >From 1887f60a8540f64f5c7bb14d57c0be70506941b8 Mon Sep 17 00:00:00 2001 From: mame <mame@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> Date: Sat, 29 May 2010 17:22:46 +0000 Subject: [PATCH] * ext/zlib/zlib.c (zstream_append_input2): add RB_GC_GUARD. This caused failure when test/csv is executed with GC.stress = true. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@28080 b2dd03c8-39d4-4d8f-98ff-823fe69b080e --- ChangeLog | 5 +++++ ext/zlib/zlib.c | 1 + 2 files changed, 6 insertions(+), 0 deletions(-) Index: ext/zlib/zlib.c =================================================================== --- ext/zlib/zlib.c.orig +++ ext/zlib/zlib.c @@ -610,6 +610,7 @@ zstream_append_input(z, src, len) } #define zstream_append_input2(z,v)\ + RB_GC_GUARD(v),\ zstream_append_input((z), RSTRING(v)->ptr, RSTRING(v)->len) static void ++++++ ruby-1.8.7-p249.tar.bz2 -> ruby-1.8.7-p334.tar.bz2 ++++++ ++++ 39629 lines of diff (skipped) ++++++ ruby-1.8.7.p299_date_remove_privat.patch ++++++ === lib/date.rb ================================================================== Index: lib/date.rb =================================================================== --- lib/date.rb.orig 2010-06-08 06:45:42.000000000 +0200 +++ lib/date.rb 2010-07-01 14:07:25.065690840 +0200 @@ -1648,8 +1648,6 @@ class Time DateTime.new!(DateTime.jd_to_ajd(jd, fr, of), of, DateTime::ITALY) end - private :to_date, :to_datetime - end class Date ++++++ ruby-1.8.7.p22_lib64.patch -> ruby-1.8.7.p299_lib64.patch ++++++ --- old-versions/11.4/all/ruby/ruby-1.8.7.p22_lib64.patch 2008-09-06 07:06:38.000000000 +0200 +++ 11.4/ruby/ruby-1.8.7.p299_lib64.patch 2010-07-01 19:25:17.000000000 +0200 @@ -1,8 +1,8 @@ Index: configure.in =================================================================== ---- configure.in.orig 2008-06-15 12:28:47.000000000 +0200 -+++ configure.in 2008-06-21 04:19:24.713590544 +0200 -@@ -1366,7 +1366,7 @@ rb_cv_missing_fconvert=yes, rb_cv_missin +--- configure.in.orig 2010-06-08 11:26:34.000000000 +0200 ++++ configure.in 2010-07-01 14:07:03.849193105 +0200 +@@ -1433,7 +1433,7 @@ rb_cv_missing_fconvert=yes, rb_cv_missin if test "$rb_cv_missing_fconvert" = yes; then AC_DEFINE(MISSING_FCONVERT) fi ++++++ ruby-1.8.7.p299_pedantic-headers.patch ++++++ Index: node.h =================================================================== --- node.h.orig 2009-02-25 07:15:55.000000000 +0100 +++ node.h 2010-07-01 14:07:38.645191446 +0200 @@ -395,7 +395,7 @@ enum rb_thread_status { THREAD_TO_KILL, THREAD_RUNNABLE, THREAD_STOPPED, - THREAD_KILLED, + THREAD_KILLED }; typedef struct rb_thread *rb_thread_t; ++++++ ruby-1.8.7.p299_webrick_error_page_encoding.patch ++++++ Index: lib/webrick/httpresponse.rb =================================================================== --- lib/webrick/httpresponse.rb.orig 2008-06-06 10:05:24.000000000 +0200 +++ lib/webrick/httpresponse.rb 2010-07-01 17:58:35.585190988 +0200 @@ -209,7 +209,7 @@ module WEBrick @keep_alive = false self.status = HTTPStatus::RC_INTERNAL_SERVER_ERROR end - @header['content-type'] = "text/html" + @header['content-type'] = "text/html; charset=utf-8" if respond_to?(:create_error_page) create_error_page() ++++++ ruby-1.8.7.p334_remove_zlib_test_params_test.patch ++++++ Index: test/zlib/test_zlib.rb =================================================================== --- test/zlib/test_zlib.rb.orig +++ test/zlib/test_zlib.rb @@ -113,36 +113,36 @@ if defined? Zlib assert_equal(true, z.closed?) end - def test_params - z = Zlib::Deflate.new - z << "foo" - z.params(Zlib::DEFAULT_COMPRESSION, Zlib::DEFAULT_STRATEGY) - z << "bar" - s = z.finish - assert_equal("foobar", Zlib::Inflate.inflate(s)) - - data = ('a'..'z').to_a.join - z = Zlib::Deflate.new(Zlib::NO_COMPRESSION, Zlib::MAX_WBITS, - Zlib::DEF_MEM_LEVEL, Zlib::DEFAULT_STRATEGY) - z << data[0, 10] - z.params(Zlib::BEST_COMPRESSION, Zlib::DEFAULT_STRATEGY) - z << data[10 .. -1] - assert_equal(data, Zlib::Inflate.inflate(z.finish)) - - z = Zlib::Deflate.new - s = z.deflate("foo", Zlib::FULL_FLUSH) - z.avail_out = 0 - z.params(Zlib::NO_COMPRESSION, Zlib::FILTERED) - s << z.deflate("bar", Zlib::FULL_FLUSH) - z.avail_out = 0 - z.params(Zlib::BEST_COMPRESSION, Zlib::HUFFMAN_ONLY) - s << z.deflate("baz", Zlib::FINISH) - assert_equal("foobarbaz", Zlib::Inflate.inflate(s)) - - z = Zlib::Deflate.new - assert_raise(Zlib::StreamError) { z.params(10000, 10000) } - z.close # without this, outputs `zlib(finalizer): the stream was freed prematurely.' - end +# def test_params +# z = Zlib::Deflate.new +# z << "foo" +# z.params(Zlib::DEFAULT_COMPRESSION, Zlib::DEFAULT_STRATEGY) +# z << "bar" +# s = z.finish +# assert_equal("foobar", Zlib::Inflate.inflate(s)) +# +# data = ('a'..'z').to_a.join +# z = Zlib::Deflate.new(Zlib::NO_COMPRESSION, Zlib::MAX_WBITS, +# Zlib::DEF_MEM_LEVEL, Zlib::DEFAULT_STRATEGY) +# z << data[0, 10] +# z.params(Zlib::BEST_COMPRESSION, Zlib::DEFAULT_STRATEGY) +# z << data[10 .. -1] +# assert_equal(data, Zlib::Inflate.inflate(z.finish)) +# +# z = Zlib::Deflate.new +# s = z.deflate("foo", Zlib::FULL_FLUSH) +# z.avail_out = 0 +# z.params(Zlib::NO_COMPRESSION, Zlib::FILTERED) +# s << z.deflate("bar", Zlib::FULL_FLUSH) +# z.avail_out = 0 +# z.params(Zlib::BEST_COMPRESSION, Zlib::HUFFMAN_ONLY) +# s << z.deflate("baz", Zlib::FINISH) +# assert_equal("foobarbaz", Zlib::Inflate.inflate(s)) +# +# z = Zlib::Deflate.new +# assert_raise(Zlib::StreamError) { z.params(10000, 10000) } +# z.close # without this, outputs `zlib(finalizer): the stream was freed prematurely.' +# end def test_set_dictionary z = Zlib::Deflate.new ++++++ ruby-1.8.7-p72_topdir.patch -> ruby-1.8.7.p72_topdir.patch ++++++ ++++++ ruby-1.8.7-p72_vendor_specific.patch -> ruby-1.8.7.p72_vendor_specific.patch ++++++ ++++++ ruby-1.8.x_openssl_branch_update.patch ++++++ ++++ 1675 lines (skipped) ++++++ ruby-rpmlintrc ++++++ --- /var/tmp/diff_new_pack.FWOjj2/_old 2011-02-22 21:48:19.000000000 +0100 +++ /var/tmp/diff_new_pack.FWOjj2/_new 2011-02-22 21:48:19.000000000 +0100 @@ -1,4 +1,5 @@ -addFilter("ruby-test-suite spurious-executable-perm.*/usr/share/doc/packages/ruby-test-suite/runruby.rb") -addFilter("ruby non-executable-script /usr/lib.*/ruby/.*") -addFilter("ruby-doc-html wrong-file-end-of-line-encoding /usr/share/doc/packages/ruby/.*") -addFilter("ruby-test-suite zero-length /usr/share/doc/packages/ruby-test-suite/.*") +addFilter("spurious-executable-perm.*/usr/share/doc/packages/ruby-test-suite/runruby.rb") +addFilter("non-executable-script /usr/lib.*/ruby/.*") +addFilter("wrong-file-end-of-line-encoding /usr/share/doc/packages/ruby/.*") +addFilter("zero-length /usr/share/doc/packages/ruby-test-suite/.*") +addFilter("unexpanded-macro.*/usr/share/ri/.*") ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Remember to have fun... -- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
