Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package libcdio for openSUSE:Factory checked in at 2026-10-20 12:36:18 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/libcdio (Old) and /work/SRC/openSUSE:Factory/.libcdio.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libcdio" Tue Oct 20 12:36:18 2026 rev:54 rq:1386163 version:2.4.0 Changes: -------- --- /work/SRC/openSUSE:Factory/libcdio/cdio-utils.changes 2024-08-07 06:10:28.618502831 +0200 +++ /work/SRC/openSUSE:Factory/.libcdio.new.3698736/cdio-utils.changes 2026-10-20 12:36:40.214374707 +0200 @@ -1,0 +2,9 @@ +Sat Oct 17 17:03:17 UTC 2026 - Martin Pluskal <[email protected]> + +- Update to 2.4.0: sync with libcdio (soname bumps in the + libraries, CVE-2024-36600 fixed, parsers hardened, new + cdio_get_device_fd() and udf_setpos() API) +- c99.patch: rebased onto 2.4.0 +- Spec cleanup via spec-cleaner (pkgconfig-style BuildRequires) + +------------------------------------------------------------------- --- /work/SRC/openSUSE:Factory/libcdio/libcdio.changes 2025-01-17 18:37:09.648430347 +0100 +++ /work/SRC/openSUSE:Factory/.libcdio.new.3698736/libcdio.changes 2026-10-20 12:36:40.270377041 +0200 @@ -1,0 +2,33 @@ +Sat Oct 17 17:03:17 UTC 2026 - Martin Pluskal <[email protected]> + +- Update to 2.4.0 (skips 2.3.0): + * Fix buffer overrun for Joliet filenames (CVE-2024-36600) + * Harden image parsers: validate Rock Ridge records and + continuation ranges, NRG track mappings and footer bounds, + UDF File Identifier Descriptor bounds and file entry + descriptors, reject cdrdao pre-track directives and cap + track counts + * Correct MMC CDB allocation length handling, deprecate obscure + MMC set-length macros, apply MMC command timeout on GNU/Linux + and move references from MMC-5 to MMC-6 Draft 2g + * New API: cdio_get_device_fd() and udf_setpos(); ISRC support + in image drivers; joliet-level driver option + * Fix ISO 9660 timezone offset signs, USB-drive detection on + macOS, MCN retrieval and last-track length calculation + * LFS fixes on 32-bit systems; thread-safe recursion checks and + strtok for multi-threaded use; tolerate missing help2man + outside maintainer mode +- Soname bumps, shlib subpackages renamed accordingly: + libcdio.so.19 -> libcdio21 (.so.21), libcdio++.so.1 -> + libcdio++2 (.so.2), libiso9660.so.12 -> libiso9660-13 + (.so.13); libudf and libiso9660++ sonames unchanged (.so.0 and + .so.1, libudf is linked without -version-info) +- c99.patch: rebased onto 2.4.0 (upstream kept the LFS shims) +- Drop --without-iso-info/--without-iso-read from the library + build: the 2.4.0 test suite requires both tools (check_udf.sh, + check_iso.sh); the binaries are still not shipped (bindir is + removed at install) +- Add pkgconfig(libcddb) >= 1.0.1 floor from configure.ac +- Spec cleanup via spec-cleaner (pkgconfig-style BuildRequires) + +------------------------------------------------------------------- Old: ---- libcdio-2.2.0.tar.bz2 New: ---- libcdio-2.4.0.tar.bz2 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ cdio-utils.spec ++++++ --- /var/tmp/diff_new_pack.kX3KPT/_old 2026-10-20 12:36:41.140413313 +0200 +++ /var/tmp/diff_new_pack.kX3KPT/_new 2026-10-20 12:36:41.142413396 +0200 @@ -1,7 +1,7 @@ # # spec file for package cdio-utils # -# Copyright (c) 2025 SUSE LLC +# Copyright (c) 2026 SUSE LLC and contributors # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -18,11 +18,10 @@ %define cdioutils 1 Name: cdio-utils -Version: 2.2.0 +Version: 2.4.0 Release: 0 Summary: Utility programs making use of libcdio, a CD-ROM access library License: GPL-3.0-or-later -Group: Productivity/Multimedia/Other URL: https://savannah.gnu.org/projects/libcdio Source0: https://github.com/libcdio/libcdio/releases/download/%{version}/libcdio-%{version}.tar.bz2 Source4: baselibs.conf @@ -30,14 +29,30 @@ BuildRequires: fdupes BuildRequires: gcc-c++ BuildRequires: help2man -BuildRequires: libcdio-devel BuildRequires: libtool BuildRequires: makeinfo -BuildRequires: ncurses-devel BuildRequires: pkgconfig -BuildRequires: popt-devel -BuildRequires: pkgconfig(libcddb) +BuildRequires: pkgconfig(form) +BuildRequires: pkgconfig(formw) +BuildRequires: pkgconfig(libcddb) >= 1.0.1 +BuildRequires: pkgconfig(libcdio) +BuildRequires: pkgconfig(libcdio++) +BuildRequires: pkgconfig(libiso9660) +BuildRequires: pkgconfig(libiso9660++) +BuildRequires: pkgconfig(libudf) BuildRequires: pkgconfig(libvcdinfo) >= 2.0 +BuildRequires: pkgconfig(menu) +BuildRequires: pkgconfig(menuw) +BuildRequires: pkgconfig(ncurses) +BuildRequires: pkgconfig(ncurses++) +BuildRequires: pkgconfig(ncurses++w) +BuildRequires: pkgconfig(ncursesw) +BuildRequires: pkgconfig(panel) +BuildRequires: pkgconfig(panelw) +BuildRequires: pkgconfig(popt) +BuildRequires: pkgconfig(tic) +BuildRequires: pkgconfig(ticw) +BuildRequires: pkgconfig(tinfo) Provides: libcdio-utils = %{version} Obsoletes: libcdio-utils < %{version} @@ -65,7 +80,7 @@ VCDINFO_CFLAGS=-I%{_includedir}/libvcd VCDINFO_LIBS="-L%{_libdir} -lvcdinfo \ -L%{buildir}/lib/iso9660/.libs/ -liso9660 -L%{buildir}/lib/driver/.libs/ -lcdio" \ -make %{?_smp_mflags} +%make_build %install %make_install ++++++ libcdio.spec ++++++ --- /var/tmp/diff_new_pack.kX3KPT/_old 2026-10-20 12:36:41.175414772 +0200 +++ /var/tmp/diff_new_pack.kX3KPT/_new 2026-10-20 12:36:41.177414855 +0200 @@ -1,7 +1,7 @@ # # spec file for package libcdio # -# Copyright (c) 2025 SUSE LLC +# Copyright (c) 2026 SUSE LLC and contributors # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -16,17 +16,16 @@ # -%define cdio_name libcdio19 -%define cdiopp_name libcdio++1 -%define iso9660_name libiso9660-12 +%define cdio_name libcdio21 +%define cdiopp_name libcdio++2 +%define iso9660_name libiso9660-13 %define iso9660pp_name libiso9660++1 %define udf_name libudf0 Name: libcdio -Version: 2.2.0 +Version: 2.4.0 Release: 0 Summary: CD-ROM Access Library License: GPL-3.0-or-later -Group: Productivity/Multimedia/Other URL: https://savannah.gnu.org/projects/libcdio Source0: https://github.com/libcdio/libcdio/releases/download/%{version}/libcdio-%{version}.tar.bz2 Source3: baselibs.conf @@ -36,10 +35,22 @@ BuildRequires: help2man BuildRequires: libtool BuildRequires: makeinfo -BuildRequires: ncurses-devel BuildRequires: pkgconfig -BuildRequires: popt-devel -BuildRequires: pkgconfig(libcddb) +BuildRequires: pkgconfig(form) +BuildRequires: pkgconfig(formw) +BuildRequires: pkgconfig(libcddb) >= 1.0.1 +BuildRequires: pkgconfig(menu) +BuildRequires: pkgconfig(menuw) +BuildRequires: pkgconfig(ncurses) +BuildRequires: pkgconfig(ncurses++) +BuildRequires: pkgconfig(ncurses++w) +BuildRequires: pkgconfig(ncursesw) +BuildRequires: pkgconfig(panel) +BuildRequires: pkgconfig(panelw) +BuildRequires: pkgconfig(popt) +BuildRequires: pkgconfig(tic) +BuildRequires: pkgconfig(ticw) +BuildRequires: pkgconfig(tinfo) Requires(post): %{install_info_prereq} Requires(preun): %{install_info_prereq} @@ -51,7 +62,6 @@ %package -n %{cdio_name} Summary: CD-ROM Access Library -Group: System/Libraries %description -n %{cdio_name} The libcdio package contains libraries for CD-ROM and CD image @@ -63,7 +73,6 @@ %package -n %{cdiopp_name} Summary: C++ API for the libcdio CD-ROM access library -Group: System/Libraries %description -n %{cdiopp_name} The libcdio package contains libraries for CD-ROM and CD image @@ -73,14 +82,12 @@ %package -n %{iso9660_name} Summary: Library for working with ISO 9660 filesystems -Group: System/Libraries %description -n %{iso9660_name} A library for working with ISO 9660 filesystems, which are mainly used on CDs. %package -n %{iso9660pp_name} Summary: Library for working with ISO 9660 filesystems -Group: System/Libraries %description -n %{iso9660pp_name} A library for working with ISO 9660 filesystems, which are mainly used on CDs. @@ -88,7 +95,6 @@ %package -n %{udf_name} Summary: Library for working with Universal Disk Format filesystems -Group: System/Libraries %description -n %{udf_name} This library is made to read and write UDF filesystems, which are mainly @@ -96,7 +102,6 @@ %package devel Summary: CD-ROM access library -Group: Development/Languages/C and C++ Requires: %{cdio_name} = %{version} Requires: %{cdiopp_name} = %{version} Requires: %{iso9660_name} = %{version} @@ -126,10 +131,8 @@ --without-cd-drive \ --without-cd-info \ --without-cdda-player \ - --without-cd-read \ - --without-iso-info \ - --without-iso-read -make %{?_smp_mflags} + --without-cd-read +%make_build %install %make_install @@ -138,7 +141,7 @@ find %{buildroot} -type f -name "*.la" -delete -print %check -make %{?_smp_mflags} check +%make_build check %post -n %{cdio_name} -p /sbin/ldconfig %post -n %{cdiopp_name} -p /sbin/ldconfig ++++++ baselibs.conf ++++++ --- /var/tmp/diff_new_pack.kX3KPT/_old 2026-10-20 12:36:41.226416898 +0200 +++ /var/tmp/diff_new_pack.kX3KPT/_new 2026-10-20 12:36:41.229417023 +0200 @@ -1,9 +1,9 @@ -libcdio19 +libcdio21 obsoletes "libcdio-<targettype> <= <version>" provides "libcdio-<targettype> = <version>" -libiso9660-12 +libiso9660-13 libiso9660++1 -libcdio++1 +libcdio++2 libudf0 #libcdio_cdda1 #libcdio_paranoia1 ++++++ c99.patch ++++++ --- /var/tmp/diff_new_pack.kX3KPT/_old 2026-10-20 12:36:41.245417690 +0200 +++ /var/tmp/diff_new_pack.kX3KPT/_new 2026-10-20 12:36:41.250417899 +0200 @@ -11,31 +11,27 @@ Signed-off-by: Alfred Wingate <[email protected]> --- - configure.ac | 8 ++++---- - lib/driver/_cdio_generic.c | 12 +----------- - lib/driver/_cdio_stdio.c | 6 +----- - 3 files changed, 6 insertions(+), 20 deletions(-) + configure.ac | 4 ++-- + lib/driver/_cdio_generic.c | 11 +---------- + lib/driver/_cdio_stdio.c | 6 +----- + 3 files changed, 6 insertions(+), 15 deletions(-) --- a/configure.ac +++ b/configure.ac -@@ -539,10 +539,10 @@ AC_SUBST(HAVE_SOLARIS_CDROM) +@@ -565,8 +565,8 @@ AC_SUBST(HAVE_WIN32_CDROM) AC_SUBST(HAVE_OS2_CDROM) -AC_CHECK_FUNCS( [chdir drand48 fseeko fseeko64 ftruncate geteuid getgid \ - getuid getpwuid gettimeofday lseek64 lstat memcpy memset mkstemp rand \ -- seteuid setegid snprintf setenv strndup unsetenv tzset sleep \ -- _stati64 usleep vsnprintf readlink realpath gmtime_r localtime_r] ) -+AC_CHECK_FUNCS( [chdir drand48 fseeko ftruncate geteuid getgid getuid \ -+ getpwuid gettimeofday lstat memcpy memset mkstemp rand seteuid \ -+ setegid snprintf setenv strndup unsetenv tzset sleep _stati64 \ -+ usleep vsnprintf readlink realpath gmtime_r localtime_r] ) - - # check for timegm() support - AC_CHECK_FUNC(timegm, AC_DEFINE(HAVE_TIMEGM,1, ++AC_CHECK_FUNCS( [chdir drand48 fseeko ftruncate geteuid getgid \ ++ getuid getpwuid gettimeofday lstat memcpy memset mkstemp rand \ + seteuid setegid snprintf setenv strndup unsetenv tzset sleep \ + _stati64 usleep vsnprintf readlink realpath gmtime_r \ + localtime_r strtok_r] ) --- a/lib/driver/_cdio_generic.c +++ b/lib/driver/_cdio_generic.c -@@ -55,16 +55,6 @@ +@@ -56,15 +56,6 @@ #define PATH_MAX 4096 #endif @@ -48,11 +44,10 @@ -#else -#define CDIO_LSEEK lseek -#endif -- - /*! + + /** Eject media -- there's nothing to do here. We always return -2. - Should we also free resources? -@@ -170,7 +160,7 @@ off_t +@@ -171,7 +162,7 @@ cdio_generic_lseek (void *user_data, off_t offset, int whence) { generic_img_private_t *p_env = user_data; @@ -60,10 +55,10 @@ + return lseek(p_env->fd, offset, whence); } - /*! + /** --- a/lib/driver/_cdio_stdio.c +++ b/lib/driver/_cdio_stdio.c -@@ -47,11 +47,7 @@ +@@ -48,11 +48,7 @@ #include "_cdio_stdio.h" #include "cdio_assert.h" ++++++ libcdio-2.2.0.tar.bz2 -> libcdio-2.4.0.tar.bz2 ++++++ ++++ 41441 lines of diff (skipped)
