Hello community, here is the log from the commit of package subversion for openSUSE:Factory checked in at 2015-08-07 00:25:00 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/subversion (Old) and /work/SRC/openSUSE:Factory/.subversion.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "subversion" Changes: -------- --- /work/SRC/openSUSE:Factory/subversion/subversion.changes 2015-05-18 22:23:55.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.subversion.new/subversion.changes 2015-08-07 00:25:03.000000000 +0200 @@ -1,0 +2,39 @@ +Thu Aug 6 11:28:23 UTC 2015 - [email protected] + +- Pass --enable-broken-httpd-auth to configure. Assumes all apache2 + packages contain security patches regardless of their version number. + Should fix the build on SLES12 and perhaps elsewhere. + +------------------------------------------------------------------- +Thu Aug 6 11:10:50 UTC 2015 - [email protected] + +- fix mod_authz_svn build with -Wunused-variable + * subversion-1.8.14-unused-var-authnrequired.patch + +------------------------------------------------------------------- +Thu Aug 6 10:48:33 UTC 2015 - [email protected] + +- Apache Subversion 1.8.14 + This release fixes two vulnerabilities: + * mod_authz_svn: do not leak information in mixed anonymous/authenticated + httpd (dav) configurations (CVE-2015-3184) bnc#939514 + * do not leak paths that were hidden by path-based authz (CVE-2015-3187) + bnc#939517 + Non-security fixes: + * document svn:autoprops + * fix 'svn cp ^/A/D/H@1 ^/A' to properly create A + * improve conflict prompts for binary files + * improve performance of 'ls -v' + * improved Sqlite 3.8.9 query performance + * fixed issue #4580: 'svn -v st' on file externals reports "?" for user/rev + * mod_dav_svn: do not ignore skel parsing errors + * detect invalid svndiff data earlier + * prevent possible repository corruption on power/disk failures + * fixed issue #4577: Read error with some repository nodes + * fixed issue #4531: server-side copy (over dav) is slow + * swig-pl: fix some stack memory problems +- Refreshed patch subversion-no-build-date.patch +- Remove obsoleted patch subversion-1.8.13-fix-sqlite-3.8.9-tests.patch +- Add patch subversion-1.8.14-httpd-version-number-detection.patch + +------------------------------------------------------------------- Old: ---- subversion-1.8.13-fix-sqlite-3.8.9-tests.patch subversion-1.8.13.tar.bz2 subversion-1.8.13.tar.bz2.asc New: ---- subversion-1.8.14-httpd-version-number-detection.patch subversion-1.8.14-unused-var-authnrequired.patch subversion-1.8.14.tar.bz2 subversion-1.8.14.tar.bz2.asc ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ subversion.spec ++++++ --- /var/tmp/diff_new_pack.b1HkKi/_old 2015-08-07 00:25:06.000000000 +0200 +++ /var/tmp/diff_new_pack.b1HkKi/_new 2015-08-07 00:25:06.000000000 +0200 @@ -36,7 +36,7 @@ %bcond_without python_ctypes %bcond_with all_regression_tests Name: subversion -Version: 1.8.13 +Version: 1.8.14 Release: 0 Summary: Subversion version control system License: Apache-2.0 @@ -71,7 +71,8 @@ Patch43: subversion-1.8.11-swig-py-comment-2.patch Patch44: subversion-1.8.11-swig-py-comment-3.patch Patch45: subversion-1.8.11-autocheck-time.patch -Patch46: subversion-1.8.13-fix-sqlite-3.8.9-tests.patch +Patch46: subversion-1.8.14-httpd-version-number-detection.patch +Patch47: subversion-1.8.14-unused-var-authnrequired.patch BuildRequires: apache2-devel BuildRequires: apache2-prefork BuildRequires: cyrus-sasl-devel @@ -252,6 +253,7 @@ %patch44 -p1 %patch45 -p1 %patch46 -p1 +%patch47 %build # Re-boot strap, needed for patch37 @@ -312,7 +314,8 @@ %endif --disable-mod-activation \ --with-libmagic \ - --disable-static + --disable-static \ + --enable-broken-httpd-auth make %{?_smp_mflags} make doc-api %{?_smp_mflags} ++++++ subversion-1.8.14-httpd-version-number-detection.patch ++++++ diff -ur subversion-1.8.14.orig/build/ac-macros/apache.m4 subversion-1.8.14/build/ac-macros/apache.m4 --- subversion-1.8.14.orig/build/ac-macros/apache.m4 Mon Jul 27 02:23:40 2015 +++ subversion-1.8.14/build/ac-macros/apache.m4 Tue Jul 28 11:08:30 2015 @@ -164,7 +164,7 @@ if ! test -e $HTTPD ; then HTTPD="`$APXS -q bindir`/`$APXS -q PROGNAME`" fi - HTTPD_VERSION=["`$HTTPD -v | $SED -e 's@^.*/\([0-9.]*\)\(.*$\)@\1@ ; 1q'`"] + HTTPD_VERSION=["`$HTTPD -v | $SED -e 's/^.*Apache\/\([0-9.]*\).*$/\1/' -e 1q`"] AC_ARG_ENABLE(broken-httpd-auth, AS_HELP_STRING([--enable-broken-httpd-auth], [Allow building against httpd 2.4 with broken auth]), ++++++ subversion-1.8.14-unused-var-authnrequired.patch ++++++ --- subversion/mod_authz_svn/mod_authz_svn.c.orig 2015-08-06 13:03:43.000000000 +0200 +++ subversion/mod_authz_svn/mod_authz_svn.c 2015-08-06 13:04:35.000000000 +0200 @@ -860,13 +860,14 @@ &authz_svn_module); const char *repos_path = NULL; const char *dest_repos_path = NULL; - int status, authn_required; + int status; #if USE_FORCE_AUTHN /* Use the force_authn() hook available in 2.4.x to work securely * given that ap_some_auth_required() is no longer functional for our * purposes in 2.4.x. */ + int authn_required; int authn_configured; /* We are not configured to run */ ++++++ subversion-1.8.13.tar.bz2 -> subversion-1.8.14.tar.bz2 ++++++ /work/SRC/openSUSE:Factory/subversion/subversion-1.8.13.tar.bz2 /work/SRC/openSUSE:Factory/.subversion.new/subversion-1.8.14.tar.bz2 differ: char 11, line 1 ++++++ subversion-no-build-date.patch ++++++ --- /var/tmp/diff_new_pack.b1HkKi/_old 2015-08-07 00:25:06.000000000 +0200 +++ /var/tmp/diff_new_pack.b1HkKi/_new 2015-08-07 00:25:06.000000000 +0200 @@ -63,7 +63,7 @@ + info->build_time = ""; info->build_host = SVN_BUILD_HOST; info->copyright = apr_pstrdup - (pool, _("Copyright (C) 2014 The Apache Software Foundation.\n" + (pool, _("Copyright (C) 2015 The Apache Software Foundation.\n" Index: subversion-1.8.9/subversion/tests/cmdline/getopt_tests_data/svn--version--verbose_stdout =================================================================== --- subversion-1.8.9.orig/subversion/tests/cmdline/getopt_tests_data/svn--version--verbose_stdout 2014-05-07 20:10:17.000000000 +0100
