Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package xmpp-dns for openSUSE:Factory checked in at 2026-08-09 21:37:31 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/xmpp-dns (Old) and /work/SRC/openSUSE:Factory/.xmpp-dns.new.16738 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "xmpp-dns" Sun Aug 9 21:37:31 2026 rev:23 rq:1370176 version:0.6.4 Changes: -------- --- /work/SRC/openSUSE:Factory/xmpp-dns/xmpp-dns.changes 2026-06-23 17:45:58.892997710 +0200 +++ /work/SRC/openSUSE:Factory/.xmpp-dns.new.16738/xmpp-dns.changes 2026-08-09 21:39:49.695435802 +0200 @@ -1,0 +2,6 @@ +Fri Aug 7 07:19:14 UTC 2026 - Michael Vetter <[email protected]> + +- Update to 0.6.4: + * Drop privileges when running as root. + +------------------------------------------------------------------- Old: ---- xmpp-dns-0.6.3.tar.gz New: ---- xmpp-dns-0.6.4.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ xmpp-dns.spec ++++++ --- /var/tmp/diff_new_pack.VV4Toa/_old 2026-08-09 21:39:50.243454516 +0200 +++ /var/tmp/diff_new_pack.VV4Toa/_new 2026-08-09 21:39:50.243454516 +0200 @@ -17,7 +17,7 @@ Name: xmpp-dns -Version: 0.6.3 +Version: 0.6.4 Release: 0 Summary: A CLI tool to check XMPP SRV records License: BSD-2-Clause ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.VV4Toa/_old 2026-08-09 21:39:50.275455608 +0200 +++ /var/tmp/diff_new_pack.VV4Toa/_new 2026-08-09 21:39:50.279455745 +0200 @@ -1,6 +1,6 @@ -mtime: 1781503475 -commit: da2cfeb492da4342c75fec0bab850364aaf483276bc412b2aaad00df51c71f1d +mtime: 1786087226 +commit: 3260f5ca5e4e45c792acd994b2fc9f43eb94039301096a972f389f169910f4ef url: https://src.opensuse.org/xmpp/xmpp-dns -revision: da2cfeb492da4342c75fec0bab850364aaf483276bc412b2aaad00df51c71f1d +revision: 3260f5ca5e4e45c792acd994b2fc9f43eb94039301096a972f389f169910f4ef projectscmsync: https://src.opensuse.org/xmpp/_ObsPrj.git ++++++ _service ++++++ --- /var/tmp/diff_new_pack.VV4Toa/_old 2026-08-09 21:39:50.299456428 +0200 +++ /var/tmp/diff_new_pack.VV4Toa/_new 2026-08-09 21:39:50.303456565 +0200 @@ -3,7 +3,7 @@ <param name="url">https://salsa.debian.org/mdosch/xmpp-dns.git</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="revision">v0.6.3</param> + <param name="revision">v0.6.4</param> <param name="versionformat">@PARENT_TAG@</param> <param name="changesgenerate">disable</param> <param name="versionrewrite-pattern">v(.*)</param> ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-08-07 09:20:26.000000000 +0200 @@ -0,0 +1 @@ +.osc ++++++ vendor.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/vendor/golang.org/x/net/idna/idna.go new/vendor/golang.org/x/net/idna/idna.go --- old/vendor/golang.org/x/net/idna/idna.go 2026-06-14 21:53:39.000000000 +0200 +++ new/vendor/golang.org/x/net/idna/idna.go 2026-08-06 20:53:53.000000000 +0200 @@ -400,7 +400,11 @@ // Spec says keep the old label. continue } - if unicode16 && err == nil && len(u) > 0 && isASCII(u) { + if err == nil && len(u) > 0 && isASCII(u) { + // UTS 43 pre-revision 33 doesn't classify a xn-- label + // which contains only ASCII characters as an error, + // but that's a specification bug and a security issue. + // Always return an error in this case. err = punyError(enc) } isBidi = isBidi || bidirule.DirectionString(u) != bidi.LeftToRight diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/vendor/golang.org/x/text/unicode/norm/forminfo.go new/vendor/golang.org/x/text/unicode/norm/forminfo.go --- old/vendor/golang.org/x/text/unicode/norm/forminfo.go 2026-06-14 21:53:39.000000000 +0200 +++ new/vendor/golang.org/x/text/unicode/norm/forminfo.go 2026-08-06 20:53:53.000000000 +0200 @@ -121,8 +121,12 @@ // // When all 6 bits are zero, the character is inert, meaning it is never // influenced by normalization. +// +// We set flags to 0x80 (high bit 7 unused in quick check data) to indicate an invalid rune. type qcInfo uint8 +func (p Properties) isInvalid() bool { return p.flags == 0x80 } + func (p Properties) isYesC() bool { return p.flags&0x10 == 0 } func (p Properties) isYesD() bool { return p.flags&0x4 == 0 } @@ -247,6 +251,9 @@ // to a Properties. See the comment at the top of the file // for more information on the format. func compInfo(v uint16, sz int) Properties { + if sz == 0 { + return Properties{flags: 0x80, size: 1} + } if v == 0 { return Properties{size: uint8(sz)} } else if v >= 0x8000 { @@ -254,7 +261,7 @@ size: uint8(sz), ccc: uint8(v), tccc: uint8(v), - flags: qcInfo(v >> 8), + flags: qcInfo(v>>8) & 0x3f, } if p.ccc > 0 || p.combinesBackward() { p.nLead = uint8(p.flags & 0x3) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/vendor/golang.org/x/text/unicode/norm/iter.go new/vendor/golang.org/x/text/unicode/norm/iter.go --- old/vendor/golang.org/x/text/unicode/norm/iter.go 2026-06-14 21:53:39.000000000 +0200 +++ new/vendor/golang.org/x/text/unicode/norm/iter.go 2026-08-06 20:53:53.000000000 +0200 @@ -376,16 +376,12 @@ goto doNorm } prevCC = i.info.tccc - sz := int(i.info.size) - if sz == 0 { - sz = 1 // illegal rune: copy byte-by-byte - } - p := outp + sz + p := outp + int(i.info.size) if p > len(i.buf) { break } outp = p - i.p += sz + i.p += int(i.info.size) if i.p >= i.rb.nsrc { i.setDone() break diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/vendor/golang.org/x/text/unicode/norm/normalize.go new/vendor/golang.org/x/text/unicode/norm/normalize.go --- old/vendor/golang.org/x/text/unicode/norm/normalize.go 2026-06-14 21:53:39.000000000 +0200 +++ new/vendor/golang.org/x/text/unicode/norm/normalize.go 2026-08-06 20:53:53.000000000 +0200 @@ -148,7 +148,7 @@ // patched buffer and whether the decomposition is still in progress. func patchTail(rb *reorderBuffer) bool { info, p := lastRuneStart(&rb.f, rb.out) - if p == -1 || info.size == 0 { + if p == -1 || info.isInvalid() { return true } end := p + int(info.size) @@ -225,7 +225,7 @@ } fd := &rb.f if doMerge { - var info Properties + info := Properties{flags: 0x80, size: 1} // invalid rune if p < n { info = fd.info(src, p) if !info.BoundaryBefore() || info.nLeadingNonStarters() > 0 { @@ -235,7 +235,7 @@ p = decomposeSegment(rb, p, true) } } - if info.size == 0 { + if info.isInvalid() { rb.doFlush() // Append incomplete UTF-8 encoding. return src.appendSlice(rb.out, p, n) @@ -314,7 +314,7 @@ continue } info := f.info(src, i) - if info.size == 0 { + if info.isInvalid() { if atEOF { // include incomplete runes return n, true @@ -379,7 +379,7 @@ // CGJ insertion points correctly. Luckily it doesn't have to. for { info := fd.info(src, i) - if info.size == 0 { + if info.isInvalid() { return -1 } if s := ss.next(info); s != ssSuccess { @@ -424,7 +424,7 @@ } fd := formTable[f] info := fd.info(src, 0) - if info.size == 0 { + if info.isInvalid() { if atEOF { return 1 } @@ -435,7 +435,7 @@ for i := int(info.size); i < nsrc; i += int(info.size) { info = fd.info(src, i) - if info.size == 0 { + if info.isInvalid() { if atEOF { return i } @@ -465,7 +465,7 @@ if p == -1 { return -1 } - if info.size == 0 { // ends with incomplete rune + if info.isInvalid() { // ends with incomplete rune if p == 0 { // starts with incomplete rune return -1 } @@ -504,7 +504,7 @@ func decomposeSegment(rb *reorderBuffer, sp int, atEOF bool) int { // Force one character to be consumed. info := rb.f.info(rb.src, sp) - if info.size == 0 { + if info.isInvalid() { return 0 } if s := rb.ss.next(info); s == ssStarter { @@ -528,7 +528,7 @@ break } info = rb.f.info(rb.src, sp) - if info.size == 0 { + if info.isInvalid() { if !atEOF { return int(iShortSrc) } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/vendor/modules.txt new/vendor/modules.txt --- old/vendor/modules.txt 2026-06-14 21:53:39.000000000 +0200 +++ new/vendor/modules.txt 2026-08-06 20:53:53.000000000 +0200 @@ -4,10 +4,10 @@ # github.com/pborman/getopt/v2 v2.1.0 ## explicit; go 1.13 github.com/pborman/getopt/v2 -# golang.org/x/net v0.56.0 +# golang.org/x/net v0.57.0 ## explicit; go 1.25.0 golang.org/x/net/idna -# golang.org/x/text v0.38.0 +# golang.org/x/text v0.40.0 ## explicit; go 1.25.0 golang.org/x/text/secure/bidirule golang.org/x/text/transform ++++++ xmpp-dns-0.6.3.tar.gz -> xmpp-dns-0.6.4.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xmpp-dns-0.6.3/CHANGELOG.md new/xmpp-dns-0.6.4/CHANGELOG.md --- old/xmpp-dns-0.6.3/CHANGELOG.md 2026-06-14 21:53:39.000000000 +0200 +++ new/xmpp-dns-0.6.4/CHANGELOG.md 2026-08-06 20:53:53.000000000 +0200 @@ -1,5 +1,9 @@ # Changelog +## [0.6.4] 2026-08-06 +### Changed +- Drop privileges when running as root. + ## [0.6.3] 2026-06-14 ### Added - Add support for `NO_COLOR` environment variable (see <https://no-color.org/>). diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xmpp-dns-0.6.3/dropprivs_unix.go new/xmpp-dns-0.6.4/dropprivs_unix.go --- old/xmpp-dns-0.6.3/dropprivs_unix.go 1970-01-01 01:00:00.000000000 +0100 +++ new/xmpp-dns-0.6.4/dropprivs_unix.go 2026-08-06 20:53:53.000000000 +0200 @@ -0,0 +1,38 @@ +// Copyright Martin Dosch. +// Use of this source code is governed by the BSD-2-clause +// license that can be found in the LICENSE file. +//go:build !windows + +package main + +import ( + "fmt" + osUser "os/user" + "strconv" + "syscall" +) + +func dropPrivs() error { + nobody, err := osUser.Lookup("nobody") + if err != nil { + return fmt.Errorf("failed to drop root privilege: %w", err) + } else { + gid, err := strconv.Atoi(nobody.Gid) + if err != nil { + return fmt.Errorf("failed to drop root privilege: %w", err) + } + uid, err := strconv.Atoi(nobody.Uid) + if err != nil { + return fmt.Errorf("failed to drop root privilege: %w", err) + } + err = syscall.Setgid(gid) + if err != nil { + return fmt.Errorf("failed to drop root privilege: %w", err) + } + err = syscall.Setuid(uid) + if err != nil { + return fmt.Errorf("failed to drop root privilege: %w", err) + } + } + return nil +} diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xmpp-dns-0.6.3/dropprivs_windows.go new/xmpp-dns-0.6.4/dropprivs_windows.go --- old/xmpp-dns-0.6.3/dropprivs_windows.go 1970-01-01 01:00:00.000000000 +0100 +++ new/xmpp-dns-0.6.4/dropprivs_windows.go 2026-08-06 20:53:53.000000000 +0200 @@ -0,0 +1,11 @@ +// Copyright Martin Dosch. +// Use of this source code is governed by the BSD-2-clause +// license that can be found in the LICENSE file. +//go:build windows + +package main + +func dropPrivs() error { + // Windows doesn't support syscall.Setuid and syscall.Setgid + return nil +} diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xmpp-dns-0.6.3/go.mod new/xmpp-dns-0.6.4/go.mod --- old/xmpp-dns-0.6.3/go.mod 2026-06-14 21:53:39.000000000 +0200 +++ new/xmpp-dns-0.6.4/go.mod 2026-08-06 20:53:53.000000000 +0200 @@ -5,8 +5,8 @@ require ( github.com/gorilla/websocket v1.5.3 github.com/pborman/getopt/v2 v2.1.0 - golang.org/x/net v0.56.0 + golang.org/x/net v0.57.0 salsa.debian.org/mdosch/xmppsrv v0.3.3 ) -require golang.org/x/text v0.38.0 // indirect +require golang.org/x/text v0.40.0 // indirect diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xmpp-dns-0.6.3/go.sum new/xmpp-dns-0.6.4/go.sum --- old/xmpp-dns-0.6.3/go.sum 2026-06-14 21:53:39.000000000 +0200 +++ new/xmpp-dns-0.6.4/go.sum 2026-08-06 20:53:53.000000000 +0200 @@ -2,9 +2,9 @@ github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE= github.com/pborman/getopt/v2 v2.1.0 h1:eNfR+r+dWLdWmV8g5OlpyrTYHkhVNxHBdN2cCrJmOEA= github.com/pborman/getopt/v2 v2.1.0/go.mod h1:4NtW75ny4eBw9fO1bhtNdYTlZKYX5/tBLtsOpwKIKd0= -golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o= -golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec= -golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE= -golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4= +golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE= +golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU= +golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs= +golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY= salsa.debian.org/mdosch/xmppsrv v0.3.3 h1:F8FGyw1Q1LkAs/UbIXd6Obd33q2CKWrIxxrzvuLSVuM= salsa.debian.org/mdosch/xmppsrv v0.3.3/go.mod h1:udWXnWFa9zkcyN9YSB/u44BCnnRDpeQ0eDy3MVLjHZQ= diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xmpp-dns-0.6.3/main.go new/xmpp-dns-0.6.4/main.go --- old/xmpp-dns-0.6.3/main.go 2026-06-14 21:53:39.000000000 +0200 +++ new/xmpp-dns-0.6.4/main.go 2026-08-06 20:53:53.000000000 +0200 @@ -19,7 +19,9 @@ "net/http" "net/url" "os" + "os/user" "runtime" + "slices" "strconv" "strings" "time" @@ -31,7 +33,7 @@ ) const ( - version = "0.6.3" + version = "0.6.4" nsBOSH = "urn:xmpp:alt-connections:xbosh" nsC2SdTLS = "urn:xmpp:alt-connections:tls" nsC2SQuic = "urn:xmpp:alt-connections:quic" @@ -104,6 +106,16 @@ flagServerDTLS := getopt.ListLong("server-dtls", 0, "Add an arbitrary target for S2S with direct TLS in the form domain:port. Can be invoked several times.") flagServerSTLS := getopt.ListLong("server-stls", 0, "Add an arbitrary target for S2S with StartTLS in the form domain:port. Can be invoked several times.") + if runtime.GOOS != "windows" { + curUser, err := user.Current() + if err != nil { + log.Fatal("Failed to get current OS user: ", err) + } + if curUser.Username == "root" { + _ = dropPrivs() + } + } + // Parse command line flags. getopt.Parse() @@ -1107,9 +1119,10 @@ fmt.Println(err) return } - err = wsConn.WriteMessage(websocket.TextMessage, []byte(fmt.Sprintf( + err = wsConn.WriteMessage(websocket.TextMessage, fmt.Appendf( + nil, `<open xmlns='%s' to='%s'%s version='1.0' />`, framing, server, from, - ))) + )) if err != nil { fmt.Println(statusNOK) fmt.Println(err) @@ -1254,12 +1267,7 @@ } func containsIP(addressList []net.IP, ip net.IP) bool { - for _, r := range addressList { - if ip.Equal(r) { - return true - } - } - return false + return slices.ContainsFunc(addressList, ip.Equal) } func getID() string {
