Levente Polyak pushed to branch main at Arch Linux / Packaging / Packages / zlib
Commits: a79dba90 by T.J. Townsend at 2023-10-25T02:54:44+02:00 backport fix for CVE-2023-45853 upstream committed the fix two months ago but made no release yet https://github.com/madler/zlib/pull/843 https://github.com/madler/zlib/commit/73331a6a0481067628f065ffe87bb1d8f787d10c https://www.openwall.com/lists/oss-security/2023/10/20/9 - - - - - 890045af by Levente Polyak at 2023-10-25T02:57:43+02:00 upgpkg: 1:1.3-2: backport fix for CVE-2023-45853 - - - - - 2 changed files: - + .SRCINFO - PKGBUILD Changes: ===================================== .SRCINFO ===================================== @@ -0,0 +1,29 @@ +pkgbase = zlib + pkgdesc = Compression library implementing the deflate compression method found in gzip and PKZIP + pkgver = 1.3 + pkgrel = 2 + epoch = 1 + url = https://www.zlib.net/ + arch = x86_64 + license = Zlib + options = staticlibs + options = debug + source = https://github.com/madler/zlib/releases/download/v1.3/zlib-1.3.tar.xz + source = https://github.com/madler/zlib/releases/download/v1.3/zlib-1.3.tar.xz.asc + source = zlib-1.3-CVE-2023-45853.patch::https://github.com/madler/zlib/commit/73331a6a0481067628f065ffe87bb1d8f787d10c.patch + validpgpkeys = 5ED46A6721D365587791E2AA783FCD8E58BCAFBA + sha512sums = 3868ac4da5842dd36c9dad794930675b9082ce15cbd099ddb79c0f6bd20a24aa8f33a123f378f26fe0ae02d91f31f2994dccaac565cedeaffed7b315e6ded2a2 + sha512sums = SKIP + sha512sums = 77de58fec1875b72ba47e2c21ff5cafd3251924baf047b4eb520fdecc63e9414c34d9224dae86982161d7e4f867120c6a7f4c5165adf6b090205513865e82e09 + b2sums = 5fe0f32339267348a313f23a21e9588bdb180b7415be303c85f5f169444d019e5f176ef7322f6e64297c360acc2a6041c50e2f66d1860e5c392d8970990f176a + b2sums = SKIP + b2sums = bba55b9074c6ac863b5dc65c3a087a2f5b9190e69106d9b2009ec3bd89e20a940091cb10464b3014c46c3c2e5248d578169164dfb9096b8ebcea08de4feee442 + +pkgname = zlib + depends = glibc + provides = libz.so + +pkgname = minizip + pkgdesc = Mini zip and unzip based on zlib + depends = glibc + depends = zlib ===================================== PKGBUILD ===================================== @@ -6,7 +6,7 @@ pkgbase=zlib pkgname=(zlib minizip) epoch=1 pkgver=1.3 -pkgrel=1 +pkgrel=2 pkgdesc='Compression library implementing the deflate compression method found in gzip and PKZIP' arch=(x86_64) license=(Zlib) @@ -15,15 +15,19 @@ options=( staticlibs # needed by binutils testsuite debug ) -source=(https://github.com/madler/zlib/releases/download/v$pkgver/$pkgname-$pkgver.tar.xz{,.asc}) +source=(https://github.com/madler/zlib/releases/download/v$pkgver/$pkgname-$pkgver.tar.xz{,.asc} + zlib-1.3-CVE-2023-45853.patch::https://github.com/madler/zlib/commit/73331a6a0481067628f065ffe87bb1d8f787d10c.patch) sha512sums=('3868ac4da5842dd36c9dad794930675b9082ce15cbd099ddb79c0f6bd20a24aa8f33a123f378f26fe0ae02d91f31f2994dccaac565cedeaffed7b315e6ded2a2' - 'SKIP') + 'SKIP' + '77de58fec1875b72ba47e2c21ff5cafd3251924baf047b4eb520fdecc63e9414c34d9224dae86982161d7e4f867120c6a7f4c5165adf6b090205513865e82e09') b2sums=('5fe0f32339267348a313f23a21e9588bdb180b7415be303c85f5f169444d019e5f176ef7322f6e64297c360acc2a6041c50e2f66d1860e5c392d8970990f176a' - 'SKIP') + 'SKIP' + 'bba55b9074c6ac863b5dc65c3a087a2f5b9190e69106d9b2009ec3bd89e20a940091cb10464b3014c46c3c2e5248d578169164dfb9096b8ebcea08de4feee442') validpgpkeys=('5ED46A6721D365587791E2AA783FCD8E58BCAFBA') # Mark Adler <[email protected]> prepare() { cd $pkgbase-$pkgver/contrib/minizip + patch -Np3 < "${srcdir}/zlib-1.3-CVE-2023-45853.patch" cp Makefile Makefile.orig cp ../README.contrib readme.txt autoreconf -fiv @@ -68,3 +72,5 @@ package_minizip() { # https://github.com/madler/zlib/pull/229 rm "$pkgdir/usr/include/minizip/crypt.h" } + +# vim: ts=2 sw=2 et: View it on GitLab: https://gitlab.archlinux.org/archlinux/packaging/packages/zlib/-/compare/a15e0ee1f540cdb2f2c4fd57476c0116358e20df...890045afa68f4d0feaf65502b75eb8791a636746 -- View it on GitLab: https://gitlab.archlinux.org/archlinux/packaging/packages/zlib/-/compare/a15e0ee1f540cdb2f2c4fd57476c0116358e20df...890045afa68f4d0feaf65502b75eb8791a636746 You're receiving this email because of your account on gitlab.archlinux.org.
