Re: removal www/newsbeuter
On Sun 11/02/2018 21:04, Stuart Henderson wrote: > On 2018/02/11 19:46, Björn Ketelaars wrote: > > newsbeuter has been abandoned almost 6 months ago. There is however an > > active maintained fork available (https://newsboat.org), which is in > > ports: www/newsboat. > > > > Any objections to sending www/newsbeuter to the attic? > > No objections here, please send a diff before committing though just so > we can check everything's ok. > > What do you think is best for quirks? Are the two compatible enough that > it would be sane to auto update from newsbeuter to newsboat, or would > it be better to add to $obsolete_reason as "no longer maintained upstream", > maybe with an faq/current.html mention about it? > Steps: 1.) Addition for quirks https://marc.info/?l=openbsd-ports&m=151843908929681&w=2 2.) Unhook from www https://marc.info/?l=openbsd-ports&m=15184399742&w=2 3.) Diff below OK? Index: Makefile === RCS file: Makefile diff -N Makefile --- Makefile14 Dec 2017 06:11:09 - 1.16 +++ /dev/null 1 Jan 1970 00:00:00 - @@ -1,37 +0,0 @@ -# $OpenBSD: Makefile,v 1.16 2017/12/14 06:11:09 jca Exp $ - -COMMENT = open-source RSS/Atom feed reader for text terminals -DISTNAME = newsbeuter-2.9 -CATEGORIES = www -REVISION = 1 - -HOMEPAGE = https://newsbeuter.org/ - -# MIT -PERMIT_PACKAGE_CDROM = Yes - -WANTLIB += c crypto curl iconv intl json-c m ncursesw pthread -WANTLIB += sqlite3 stfl xml2 ${COMPILER_LIBCXX} - -MASTER_SITES = https://newsbeuter.org/downloads/ - -# C++11 -COMPILER = base-clang ports-gcc - -BUILD_DEPENDS =devel/gettext-tools - -LIB_DEPENDS = databases/sqlite3 \ - devel/gettext \ - devel/stfl \ - devel/json-c \ - textproc/libxml \ - net/curl - -MAKE_FLAGS = CXX="${CXX}" -FAKE_FLAGS = mandir=${PREFIX}/man - -USE_GMAKE =Yes -CONFIGURE_STYLE = simple -CONFIGURE_SCRIPT = config.sh - -.include Index: distinfo === RCS file: distinfo diff -N distinfo --- distinfo5 Feb 2017 21:58:16 - 1.2 +++ /dev/null 1 Jan 1970 00:00:00 - @@ -1,2 +0,0 @@ -SHA256 (newsbeuter-2.9.tar.gz) = dKi/AZsJw7JwupWtwp8rvkjqH1XMBjQnayH8zh8EPcg= -SIZE (newsbeuter-2.9.tar.gz) = 432763 Index: patches/patch-src_controller_cpp === RCS file: patches/patch-src_controller_cpp diff -N patches/patch-src_controller_cpp --- patches/patch-src_controller_cpp17 Sep 2017 17:04:52 - 1.3 +++ /dev/null 1 Jan 1970 00:00:00 - @@ -1,31 +0,0 @@ -From 96e9506ae9e252c548665152d1b8968297128307 Mon Sep 17 00:00:00 2001 -From: Alexander Batischev -Date: Sun, 13 Aug 2017 21:48:35 +0300 -Subject: [PATCH] Sanitize inputs to bookmark-cmd (#591) - -Newsbeuter didn't properly shell-escape the arguments passed to -bookmarking command, which allows a remote attacker to perform remote -code execution by crafting an RSS item whose title and/or URL contain -something interpretable by the shell (most notably subshell -invocations.) - -This has been reported by Jeriko One , complete with -PoC and a patch. - -This vulnerability was assigned CVE-2017-12904. - src/controller.cpp -+++ src/controller.cpp -@@ -1275,9 +1275,10 @@ std::string controller::bookmark(const std::string& url, const std::string& titl - std::string bookmark_cmd = cfg.get_configvalue("bookmark-cmd"); - bool is_interactive = cfg.get_configvalue_as_bool("bookmark-interactive"); - if (bookmark_cmd.length() > 0) { -- std::string cmdline = utils::strprintf("%s '%s' %s %s", -+ std::string cmdline = utils::strprintf("%s '%s' '%s' '%s'", - bookmark_cmd.c_str(), utils::replace_all(url,"'", "%27").c_str(), -- stfl::quote(title).c_str(), stfl::quote(description).c_str()); -+ utils::replace_all(title,"'", "%27").c_str(), -+ utils::replace_all(description,"'", "%27").c_str()); - - LOG(LOG_DEBUG, "controller::bookmark: cmd = %s", cmdline.c_str()); - Index: patches/patch-src_feedhq_api_cpp === RCS file: patches/patch-src_feedhq_api_cpp diff -N patches/patch-src_feedhq_api_cpp --- patches/patch-src_feedhq_api_cpp5 Feb 2017 21:58:16 - 1.1 +++ /dev/null 1 Jan 1970 00:00:00 - @@ -1,31 +0,0 @@ -$OpenBSD: patch-src_feedhq_api_cpp,v 1.1 2017/02/05 21:58:16 abieber Exp $ src/feedhq_api.cpp.origTue Oct 11 09:07:30 2016 -+++ src/feedhq_api.cpp Tue Oct 11 09:
Re: removal www/newsbeuter
On 18.02.11Sun 21:04, Stuart Henderson wrote: > What do you think is best for quirks? Are the two compatible enough that > it would be sane to auto update from newsbeuter to newsboat, Yes, it is just a fork, after newsbeuter abandoned. FreeBSD Ports in the last year stepped this, the change from newsbeuter to newsboat was smoothly on FreeBSD.
Re: removal www/newsbeuter
On Mon, Feb 12, 2018 at 01:37:50PM +0100, Björn Ketelaars wrote: > On Sun 11/02/2018 21:04, Stuart Henderson wrote: > > On 2018/02/11 19:46, Björn Ketelaars wrote: > > > newsbeuter has been abandoned almost 6 months ago. There is however an > > > active maintained fork available (https://newsboat.org), which is in > > > ports: www/newsboat. > > > > > > Any objections to sending www/newsbeuter to the attic? > > > > No objections here, please send a diff before committing though just so > > we can check everything's ok. > > > > What do you think is best for quirks? Are the two compatible enough that > > it would be sane to auto update from newsbeuter to newsboat, or would > > it be better to add to $obsolete_reason as "no longer maintained upstream", > > maybe with an faq/current.html mention about it? > > I will wait for about a week before doing anything, except collecting > feedback. I did however prepare a diff for quirks. Newsboat has > a mechanism in place that prompts you whether it should port your > newsbeuter configuration upon the first run. This should ensure a smooth > update. > > The binaries however have different names. I'm not sure if this warrants > a mentioning on current.html. I do not thinks so, other opinions? Don't think so either, as quirks will update to newsboat, users will find it via news ? Landry
Re: removal www/newsbeuter
On Mon 12/02/2018 13:37, Björn Ketelaars wrote: > On Sun 11/02/2018 21:04, Stuart Henderson wrote: > > On 2018/02/11 19:46, Björn Ketelaars wrote: > > > newsbeuter has been abandoned almost 6 months ago. There is however an > > > active maintained fork available (https://newsboat.org), which is in > > > ports: www/newsboat. > > > > > > Any objections to sending www/newsbeuter to the attic? > > > > No objections here, please send a diff before committing though just so > > we can check everything's ok. > > > > What do you think is best for quirks? Are the two compatible enough that > > it would be sane to auto update from newsbeuter to newsboat, or would > > it be better to add to $obsolete_reason as "no longer maintained upstream", > > maybe with an faq/current.html mention about it? > > I will wait for about a week before doing anything, except collecting > feedback. I did however prepare a diff for quirks. Newsboat has > a mechanism in place that prompts you whether it should port your > newsbeuter configuration upon the first run. This should ensure a smooth > update. > > The binaries however have different names. I'm not sure if this warrants > a mentioning on current.html. I do not thinks so, other opinions? And a diff for unhooking newsbeuter from www. Same as above...I will wait for about a week. OK? Index: Makefile === RCS file: /cvs/ports/www/Makefile,v retrieving revision 1.849 diff -u -p -r1.849 Makefile --- Makefile19 Jan 2018 14:40:46 - 1.849 +++ Makefile12 Feb 2018 12:04:48 - @@ -99,7 +99,6 @@ SUBDIR += mozilla-firefox SUBDIR += mozplugger SUBDIR += netsurf - SUBDIR += newsbeuter SUBDIR += newsboat SUBDIR += nextcloud SUBDIR += nghttp2
Re: removal www/newsbeuter
On Sun 11/02/2018 21:04, Stuart Henderson wrote: > On 2018/02/11 19:46, Björn Ketelaars wrote: > > newsbeuter has been abandoned almost 6 months ago. There is however an > > active maintained fork available (https://newsboat.org), which is in > > ports: www/newsboat. > > > > Any objections to sending www/newsbeuter to the attic? > > No objections here, please send a diff before committing though just so > we can check everything's ok. > > What do you think is best for quirks? Are the two compatible enough that > it would be sane to auto update from newsbeuter to newsboat, or would > it be better to add to $obsolete_reason as "no longer maintained upstream", > maybe with an faq/current.html mention about it? I will wait for about a week before doing anything, except collecting feedback. I did however prepare a diff for quirks. Newsboat has a mechanism in place that prompts you whether it should port your newsbeuter configuration upon the first run. This should ensure a smooth update. The binaries however have different names. I'm not sure if this warrants a mentioning on current.html. I do not thinks so, other opinions? Index: Makefile === RCS file: /cvs/ports/devel/quirks/Makefile,v retrieving revision 1.563 diff -u -p -r1.563 Makefile --- Makefile6 Feb 2018 22:09:28 - 1.563 +++ Makefile12 Feb 2018 12:09:59 - @@ -5,7 +5,7 @@ CATEGORIES =devel databases DISTFILES = # API.rev -PKGNAME = quirks-2.408 +PKGNAME = quirks-2.409 PKG_ARCH = * MAINTAINER = Marc Espie Index: files/Quirks.pm === RCS file: /cvs/ports/devel/quirks/files/Quirks.pm,v retrieving revision 1.576 diff -u -p -r1.576 Quirks.pm --- files/Quirks.pm 6 Feb 2018 22:09:28 - 1.576 +++ files/Quirks.pm 12 Feb 2018 12:09:59 - @@ -498,6 +498,7 @@ my $stem_extensions = { 'arm' => 'nyx', 'luabitop' => 'lua-bitop', 'livestreamer' => 'streamlink', + 'newsbeuter' => 'newsboat', }; my $obsolete_reason = {
Re: removal www/newsbeuter
On Sun, Feb 11, 2018 at 09:16:47PM GMT, Remi Locherer wrote: > On Sun, Feb 11, 2018 at 07:46:19PM +0100, Björn Ketelaars wrote: > > newsbeuter has been abandoned almost 6 months ago. There is however an > > active maintained fork available (https://newsboat.org), which is in > > ports: www/newsboat. > > > > Any objections to sending www/newsbeuter to the attic? > > I switched to newsboat after it was imported and that was very smooth. FWIW, I've done the same - also, without any issues. > ok remi@ for the removal of www/newsbeuter. > > I think we also want a quirks entry so that people running newsbeuter > get newsboat with the next pkg_add -u. IMVHO, good idea. Raf > > > > -- > > Björn Ketelaars > > GPG key: 0x4F0E5F21 >
Re: removal www/newsbeuter
Sun, 11 Feb 2018 19:46:19 +0100 Björn Ketelaars > newsbeuter has been abandoned almost 6 months ago. There is however an > active maintained fork available (https://newsboat.org), which is in > ports: www/newsboat. > > Any objections to sending www/newsbeuter to the attic? > no, bin it
Re: removal www/newsbeuter
On Sun, Feb 11, 2018 at 07:46:19PM +0100, Björn Ketelaars wrote: > newsbeuter has been abandoned almost 6 months ago. There is however an > active maintained fork available (https://newsboat.org), which is in > ports: www/newsboat. > > Any objections to sending www/newsbeuter to the attic? I switched to newsboat after it was imported and that was very smooth. ok remi@ for the removal of www/newsbeuter. I think we also want a quirks entry so that people running newsbeuter get newsboat with the next pkg_add -u. > > -- > Björn Ketelaars > GPG key: 0x4F0E5F21
Re: removal www/newsbeuter
On 2018/02/11 19:46, Björn Ketelaars wrote: > newsbeuter has been abandoned almost 6 months ago. There is however an > active maintained fork available (https://newsboat.org), which is in > ports: www/newsboat. > > Any objections to sending www/newsbeuter to the attic? No objections here, please send a diff before committing though just so we can check everything's ok. What do you think is best for quirks? Are the two compatible enough that it would be sane to auto update from newsbeuter to newsboat, or would it be better to add to $obsolete_reason as "no longer maintained upstream", maybe with an faq/current.html mention about it?