Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package hare for openSUSE:Factory checked in at 2026-08-22 21:35:01 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/hare (Old) and /work/SRC/openSUSE:Factory/.hare.new.1258 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "hare" Sat Aug 22 21:35:01 2026 rev:11 rq:1372933 version:0.26.0.1 Changes: -------- --- /work/SRC/openSUSE:Factory/hare/hare.changes 2026-02-18 17:06:57.413537218 +0100 +++ /work/SRC/openSUSE:Factory/.hare.new.1258/hare.changes 2026-08-22 21:37:06.573291833 +0200 @@ -1,0 +2,13 @@ +Thu Aug 13 13:04:25 UTC 2026 - [email protected] + +- Relax strict qbe dependency requirement from = 1.2 to >= 1.2 + to fix Factory build failures. + +------------------------------------------------------------------- +Sat May 09 11:29:50 UTC 2026 - [email protected] + +- Update to version 0.26.0.1: + * This is a security release for Hare 0.26.0 which includes patches to + address CVE-2026-43923. + +------------------------------------------------------------------- Old: ---- hare-0.26.0.tar.zst New: ---- hare-0.26.0.1.tar.zst ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ hare.spec ++++++ --- /var/tmp/diff_new_pack.VGt4Fc/_old 2026-08-22 21:37:07.680331405 +0200 +++ /var/tmp/diff_new_pack.VGt4Fc/_new 2026-08-22 21:37:07.682331476 +0200 @@ -17,10 +17,10 @@ %bcond_without test -%define relver 0.25.2 +%define relver 0.26.0 Name: hare Release: 0 -Version: 0.26.0 +Version: 0.26.0.1 Summary: Hare system programming language Group: Development/Tools/Building License: MPL-2.0 @@ -40,7 +40,7 @@ BuildRequires: zstd Requires: harec >= %{relver} # Hare requires QBE 1.2 like HareC does -Requires: qbe = 1.2 +Requires: qbe >= 1.2 Requires: timezone %description ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.VGt4Fc/_old 2026-08-22 21:37:07.800335695 +0200 +++ /var/tmp/diff_new_pack.VGt4Fc/_new 2026-08-22 21:37:07.810336052 +0200 @@ -1,6 +1,6 @@ -mtime: 1771029222 -commit: fa686504a366b885214f40eddf72a01b8eff3704c011dd9d42faba3fdf98e7e9 -url: https://src.opensuse.org/hare/hare.git -revision: fa686504a366b885214f40eddf72a01b8eff3704c011dd9d42faba3fdf98e7e9 +mtime: 1786626456 +commit: bebc44b34a285840cde4fe3705098d38e544d1d57d19912c570f13717f2ae3d9 +url: https://src.opensuse.org/hare/hare +revision: bebc44b34a285840cde4fe3705098d38e544d1d57d19912c570f13717f2ae3d9 projectscmsync: https://src.opensuse.org/hare/_ObsPrj.git ++++++ _service ++++++ --- /var/tmp/diff_new_pack.VGt4Fc/_old 2026-08-22 21:37:07.873338304 +0200 +++ /var/tmp/diff_new_pack.VGt4Fc/_new 2026-08-22 21:37:07.880338554 +0200 @@ -1,7 +1,7 @@ <services> <service mode="manual" name="roast_scm"> <param name="url">https://git.sr.ht/~sircmpwn/hare</param> - <param name="revision">0.26.0</param> + <param name="revision">0.26.0.1</param> <param name="changesgenerate">true</param> <param name="changesauthor">[email protected]</param> </service> ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-08-13 15:07:36.000000000 +0200 @@ -0,0 +1,2 @@ +.osc +hare/ ++++++ hare-0.26.0.tar.zst -> hare-0.26.0.1.tar.zst ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/hare-0.26.0/makefiles/linux.aarch64.mk new/hare-0.26.0.1/makefiles/linux.aarch64.mk --- old/hare-0.26.0/makefiles/linux.aarch64.mk 2026-02-13 15:22:19.000000000 +0100 +++ new/hare-0.26.0.1/makefiles/linux.aarch64.mk 2026-05-09 13:29:49.000000000 +0200 @@ -5,7 +5,7 @@ OBJS = $(HARECACHE)/rt.o $(HARECACHE)/types.o $(HARECACHE)/bytes.o $(HARECACHE)/encoding_utf8.o $(HARECACHE)/sort_cmp.o $(HARECACHE)/strings.o $(HARECACHE)/ascii.o $(HARECACHE)/errors.o $(HARECACHE)/io.o $(HARECACHE)/bufio.o $(HARECACHE)/crypto_math.o $(HARECACHE)/endian.o $(HARECACHE)/hash.o $(HARECACHE)/crypto_sha256.o $(HARECACHE)/math.o $(HARECACHE)/memio.o $(HARECACHE)/path.o $(HARECACHE)/format_elf.o $(HARECACHE)/linux.o $(HARECACHE)/types_c.o $(HARECACHE)/linux_vdso.o $(HARECACHE)/time.o $(HARECACHE)/fs.o $(HARECACHE)/os.o $(HARECACHE)/strconv.o $(HARECACHE)/fmt.o $(HARECACHE)/encoding_hex.o $(HARECACHE)/math_random.o $(HARECACHE)/sort.o $(HARECACHE)/hare_lex.o $(HARECACHE)/hare_ast.o $(HARECACHE)/hare_parse.o $(HARECACHE)/hare_unparse.o $(HARECACHE)/hare_module.o $(HARECACHE)/unix.o $(HARECACHE)/unix_signal.o $(HARECACHE)/os_exec.o $(HARECACHE)/shlex.o $(HARECACHE)/unix_tty.o $(HARECACHE)/cmd_hare_build.o $(HARECACHE)/dirs.o $(HARECACHE)/getopt.o $(HARECACHE)/cmd_hare.o rt_ha = rt/+aarch64/arch_jmp.ha rt/+aarch64/cpuid.ha rt/+linux/+aarch64.ha rt/+linux/env.ha rt/+linux/errno.ha rt/+linux/initfini.ha rt/+linux/platform_abort.ha rt/+linux/platformstart-libc.ha rt/+linux/prctl.ha rt/+linux/segmalloc.ha rt/+linux/signal.ha rt/+linux/socket.ha rt/+linux/start.ha rt/+linux/stat.ha rt/+linux/syscallno+aarch64.ha rt/+linux/syscalls.ha rt/+linux/types.ha rt/abort.ha rt/ensure.ha rt/fenv_defs.ha rt/heap-libc.ha rt/jmp.ha rt/malloc.ha rt/memcpy.ha rt/memfunc_ptr.ha rt/memmove.ha rt/memset.ha rt/strcmp.ha rt/u64tos.ha rt/unknown_errno.ha -$(HARECACHE)/rt.ssa: $(rt_ha) +$(HARECACHE)/rt.ssa: $(rt_ha) $(HARECACHE)/format_elf.td @mkdir -p -- "$(HARECACHE)" @printf 'HAREC\t%s\n' "$@" @$(TDENV) $(HAREC) $(HARECFLAGS) -o $@ -t $(HARECACHE)/rt.td.tmp -N rt $(rt_ha) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/hare-0.26.0/makefiles/linux.riscv64.mk new/hare-0.26.0.1/makefiles/linux.riscv64.mk --- old/hare-0.26.0/makefiles/linux.riscv64.mk 2026-02-13 15:22:19.000000000 +0100 +++ new/hare-0.26.0.1/makefiles/linux.riscv64.mk 2026-05-09 13:29:49.000000000 +0200 @@ -5,7 +5,7 @@ OBJS = $(HARECACHE)/rt.o $(HARECACHE)/types.o $(HARECACHE)/bytes.o $(HARECACHE)/encoding_utf8.o $(HARECACHE)/sort_cmp.o $(HARECACHE)/strings.o $(HARECACHE)/ascii.o $(HARECACHE)/errors.o $(HARECACHE)/io.o $(HARECACHE)/bufio.o $(HARECACHE)/crypto_math.o $(HARECACHE)/endian.o $(HARECACHE)/hash.o $(HARECACHE)/crypto_sha256.o $(HARECACHE)/math.o $(HARECACHE)/memio.o $(HARECACHE)/path.o $(HARECACHE)/format_elf.o $(HARECACHE)/linux.o $(HARECACHE)/types_c.o $(HARECACHE)/linux_vdso.o $(HARECACHE)/time.o $(HARECACHE)/fs.o $(HARECACHE)/os.o $(HARECACHE)/strconv.o $(HARECACHE)/fmt.o $(HARECACHE)/encoding_hex.o $(HARECACHE)/math_random.o $(HARECACHE)/sort.o $(HARECACHE)/hare_lex.o $(HARECACHE)/hare_ast.o $(HARECACHE)/hare_parse.o $(HARECACHE)/hare_unparse.o $(HARECACHE)/hare_module.o $(HARECACHE)/unix.o $(HARECACHE)/unix_signal.o $(HARECACHE)/os_exec.o $(HARECACHE)/shlex.o $(HARECACHE)/unix_tty.o $(HARECACHE)/cmd_hare_build.o $(HARECACHE)/dirs.o $(HARECACHE)/getopt.o $(HARECACHE)/cmd_hare.o rt_ha = rt/+linux/+riscv64.ha rt/+linux/env.ha rt/+linux/errno.ha rt/+linux/initfini.ha rt/+linux/platform_abort.ha rt/+linux/platformstart-libc.ha rt/+linux/prctl.ha rt/+linux/segmalloc.ha rt/+linux/signal.ha rt/+linux/socket.ha rt/+linux/start.ha rt/+linux/stat.ha rt/+linux/syscallno+riscv64.ha rt/+linux/syscalls.ha rt/+linux/types.ha rt/+riscv64/arch_jmp.ha rt/+riscv64/cpuid.ha rt/abort.ha rt/ensure.ha rt/fenv_defs.ha rt/heap-libc.ha rt/jmp.ha rt/malloc.ha rt/memcpy.ha rt/memfunc_ptr.ha rt/memmove.ha rt/memset.ha rt/strcmp.ha rt/u64tos.ha rt/unknown_errno.ha -$(HARECACHE)/rt.ssa: $(rt_ha) +$(HARECACHE)/rt.ssa: $(rt_ha) $(HARECACHE)/format_elf.td @mkdir -p -- "$(HARECACHE)" @printf 'HAREC\t%s\n' "$@" @$(TDENV) $(HAREC) $(HARECFLAGS) -o $@ -t $(HARECACHE)/rt.td.tmp -N rt $(rt_ha) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/hare-0.26.0/makefiles/linux.x86_64.mk new/hare-0.26.0.1/makefiles/linux.x86_64.mk --- old/hare-0.26.0/makefiles/linux.x86_64.mk 2026-02-13 15:22:19.000000000 +0100 +++ new/hare-0.26.0.1/makefiles/linux.x86_64.mk 2026-05-09 13:29:49.000000000 +0200 @@ -5,7 +5,7 @@ OBJS = $(HARECACHE)/rt.o $(HARECACHE)/types.o $(HARECACHE)/bytes.o $(HARECACHE)/encoding_utf8.o $(HARECACHE)/sort_cmp.o $(HARECACHE)/strings.o $(HARECACHE)/ascii.o $(HARECACHE)/errors.o $(HARECACHE)/io.o $(HARECACHE)/bufio.o $(HARECACHE)/crypto_math.o $(HARECACHE)/endian.o $(HARECACHE)/hash.o $(HARECACHE)/crypto_sha256.o $(HARECACHE)/math.o $(HARECACHE)/memio.o $(HARECACHE)/path.o $(HARECACHE)/format_elf.o $(HARECACHE)/linux.o $(HARECACHE)/types_c.o $(HARECACHE)/linux_vdso.o $(HARECACHE)/time.o $(HARECACHE)/fs.o $(HARECACHE)/os.o $(HARECACHE)/strconv.o $(HARECACHE)/fmt.o $(HARECACHE)/encoding_hex.o $(HARECACHE)/math_random.o $(HARECACHE)/sort.o $(HARECACHE)/hare_lex.o $(HARECACHE)/hare_ast.o $(HARECACHE)/hare_parse.o $(HARECACHE)/hare_unparse.o $(HARECACHE)/hare_module.o $(HARECACHE)/unix.o $(HARECACHE)/unix_signal.o $(HARECACHE)/os_exec.o $(HARECACHE)/shlex.o $(HARECACHE)/unix_tty.o $(HARECACHE)/cmd_hare_build.o $(HARECACHE)/dirs.o $(HARECACHE)/getopt.o $(HARECACHE)/cmd_hare.o rt_ha = rt/+linux/+x86_64.ha rt/+linux/env.ha rt/+linux/errno.ha rt/+linux/initfini.ha rt/+linux/platform_abort.ha rt/+linux/platformstart-libc.ha rt/+linux/prctl.ha rt/+linux/segmalloc.ha rt/+linux/signal.ha rt/+linux/socket.ha rt/+linux/start.ha rt/+linux/stat.ha rt/+linux/syscallno+x86_64.ha rt/+linux/syscalls.ha rt/+linux/types.ha rt/+x86_64/arch_jmp.ha rt/+x86_64/cpuid.ha rt/abort.ha rt/ensure.ha rt/fenv_defs.ha rt/heap-libc.ha rt/jmp.ha rt/malloc.ha rt/memcpy.ha rt/memfunc_ptr.ha rt/memmove.ha rt/memset.ha rt/strcmp.ha rt/u64tos.ha rt/unknown_errno.ha -$(HARECACHE)/rt.ssa: $(rt_ha) +$(HARECACHE)/rt.ssa: $(rt_ha) $(HARECACHE)/format_elf.td @mkdir -p -- "$(HARECACHE)" @printf 'HAREC\t%s\n' "$@" @$(TDENV) $(HAREC) $(HARECFLAGS) -o $@ -t $(HARECACHE)/rt.td.tmp -N rt $(rt_ha) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/hare-0.26.0/rt/+linux/platformstart-libc.ha new/hare-0.26.0.1/rt/+linux/platformstart-libc.ha --- old/hare-0.26.0/rt/+linux/platformstart-libc.ha 2026-02-13 15:22:19.000000000 +0100 +++ new/hare-0.26.0.1/rt/+linux/platformstart-libc.ha 2026-05-09 13:29:49.000000000 +0200 @@ -1,9 +1,59 @@ // SPDX-License-Identifier: MPL-2.0 // (c) Hare authors <https://harelang.org> +use format::elf; + export fn start_linux(iv: *[*]uintptr) never = { argc = iv[0]: size; argv = &iv[1]: *[*]*u8; envp = &argv[argc + 1]: *[*]nullable *u8; + + // Read auxv to determine if we need to sanitize file descriptors + let i = 0z; + for (envp[i] != null) i += 1; + const auxv = &envp[i + 1]: *[*][2]uintptr; + + let secure = false; + let uid: uintptr = 0, euid: uintptr = 0; + let gid: uintptr = 0, egid: uintptr = 0; + for (let j = 0z; auxv[j][0]: u64 != elf::at::NULL; j += 1) { + switch (auxv[j][0]: u64) { + case elf::at::SECURE => secure = auxv[j][1] != 0; + case elf::at::UID => uid = auxv[j][1]; + case elf::at::EUID => euid = auxv[j][1]; + case elf::at::GID => gid = auxv[j][1]; + case elf::at::EGID => egid = auxv[j][1]; + case => void; + }; + }; + + if (secure || uid != euid || gid != egid) { + sanitize_stdio(); + }; + start_ha(); }; + +// The standard library's stdin/stdout/stderr always refer to file descriptors +// 0, 1, and 2. If these have not been opened, subsequent file descriptors may +// take these FD numbers, causing I/O intended for stdin/stdout/stderr to use +// these files instead. +// +// If the process is setuid, this can cause the program to write garbage, leak +// information, or otherwise misbehave within the context of its elevated +// privileges. In case we have elevated permissions, ensure file descriptors 0-2 +// are valid and replace them with /dev/null if not. +fn sanitize_stdio() void = { + let pfds: [3]pollfd = [ + pollfd { fd = 0, ... }, + pollfd { fd = 1, ... }, + pollfd { fd = 2, ... }, + ]; + + const r = poll(&pfds: *[*]pollfd, 3, 0)!; + for (let i = 0z; i < 3; i += 1) { + if (pfds[i].revents & POLLNVAL != 0) { + _ = open("/dev/null", O_RDWR, 0); + }; + }; +}; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/hare-0.26.0/rt/+linux/types.ha new/hare-0.26.0.1/rt/+linux/types.ha --- old/hare-0.26.0/rt/+linux/types.ha 2026-02-13 15:22:19.000000000 +0100 +++ new/hare-0.26.0.1/rt/+linux/types.ha 2026-05-09 13:29:49.000000000 +0200 @@ -352,7 +352,7 @@ export def POLLOUT: i16 = 0x004; export def POLLERR: i16 = 0x008; export def POLLHUP: i16 = 0x010; -export def POLLVAL: i16 = 0x020; +export def POLLNVAL: i16 = 0x020; export type pollfd = struct { fd: int, diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/hare-0.26.0/scripts/version new/hare-0.26.0.1/scripts/version --- old/hare-0.26.0/scripts/version 2026-02-13 15:22:19.000000000 +0100 +++ new/hare-0.26.0.1/scripts/version 2026-05-09 13:29:49.000000000 +0200 @@ -1,7 +1,7 @@ #!/bin/sh # Distro packagers may set the LOCALVER variable to add their distribution to # the version, e.g. 1.0-alpine. -VERSION="${VERSION:-0.26.0}" +VERSION="${VERSION:-0.26.0.1}" ver=$(git describe 2>/dev/null) # shellcheck disable=SC2181
