CVE-2022-47022.patch
removed since it's included in 2.9.3
Changelog:
===========
* Handle Linux glibc allocation errors in binding routines (CVE-2022-47022).
* Fix hwloc-calc when searching objects on heterogeneous memory platforms,
thanks to Antoine Morvan for the report.
* Fix hwloc_get_next_child() when there are some memory-side caches.
* Don't crash if the topology is empty because Linux cgroups are wrong.
* Improve some hwloc-bind warnings in case of command-line parsing errors.
* Many documentation improvements all over the place, including:
+ hwloc_topology_restrict() and hwloc_topology_insert_group() may reorder
children, causing the logical indexes of objects to change.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
===========
- Add 'age' field to MLS locate queries
- Location updates now always have an accuracy value
- Improvements to NMEA parsing:
- Parse NMEA timestamps with sub-second accuracy
- Add default accuracy to NMEA RMC locations
- Ignore locations from GGA and RMC sentences if the GNSS fix is not valid
- Prioritize GNSS sources with a recent fix over other sources, preventing location jumps
- Install D-Bus policy in /usr/share, not /etc
- Upgrade GLib / Gio dependency to version 2.68.0
- Correct gi annotations in GClueSimple
- Various small fixes
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
==========
* lib-oauth2: Allow JWT tokens to be validated with missing typ field.
+ auth: Auth passdb and userdb reply can contain "event_<name>=value"
which will be added to login event and mail user event respectively.
+ lib-master: Set process title during various initialization stages to
clearly describe what the process is waiting on.
+ lib-storage: The mail_temp_scan_interval is now fuzzed incrementing it
by 0..30% based on username's hash to reduce the chance of load spikes.
+ lib-storage: The temp file scan has been moved from the open of the
mailbox to the close, to reduce the latency perceived by users.
+ stats: If metric has fields specified, all these fields are
exported as counters to prometheus exposition.
- *-login: Processes might have crashed when a SSL connection disconnects
uncleanly.
- acl: When plugin was loaded \HasChildren and \HasNoChildren flags
were calculated incorrectly for mailboxes containing '*' and '%'
in their names.
- auth: Crash occured if a connection to PostgreSQL database server
failed during startup.
- auth: Logins with invalid passwords (e.g. unknown scheme) in passdb
were failing with "password mismatch" instead of "internal error".
- auth: XOAUTH2 and OAUTHBEARER mechanisms were not giving out protocol
specific error message on all errors. This especially broke OIDC
discovery.
- dbox: When last_temp_file_scan header wasn't set (especially after
dsync migration), the next mailbox open always triggers the temp file
scan.
- dict-redis: A crash would occur on transaction rollback.
- dsync: Infinite loop causing out of memory would occur when handling
mailbox deletion from remote end and hierarchy separators would differ.
- dsync: Incremental dsync failed for folder names ending with '%',
unless BROKENCHAR was set. Also folder names with '%' elsewhere in
them caused each incremental dsync to unnecessarily rename the folder
to a temporary name and back. v2.3.19 regression.
- imap-hibernate: If an IMAP client unhibernation timed out with
"(version received)", the unhibernation could still have successfully
finished later on and continued working normally. This was rather
confusing, because imap-hibernate already logged that the client got
disconnected.
- imapc: Crashed when a folder mapped through the virtual plugin
disappears from the storage.
- imapc: EXPUNGE, EXISTS or FETCH replies from a server for a previously
selected mailbox could have been processed as if they belonged to the
new mailbox currently being selected.
- lib-http: Dovecot HTTP server (doveadm, stats/openmetrics) may have
disconnected HTTP clients before the response is fully sent. This
happened only on busy servers where kernel's socket buffers were
rather full.
- lib-http: Fixed a potential crash on http-server if a client
disconnected early. v2.3.18 regression.
- lib-index: Index file corruption could have caused a crash. Fixes:
Panic: file mail-transaction-log-view.c: line 165 (mail_transaction_log_view_set):
assertion failed: (min_file_seq <= max_file_seq).
- lib-index: Purging an existing >1GB cache file can crash. Now cache
files still above 1GB after purging are removed. Fixes:
Panic: file mail-index-util.c: line 10 (mail_index_uint32_to_offset):
assertion failed: (offset < 0x40000000)
- lib-lua: A HTTP client could not resolve DNS names in mail processes,
because it expected "the dns-client" socket to exist in the current
directory.
- lib-oauth2: Dovecot would send client_id and client_secret as POST
parameters to the introspection server. These need to be optionally in
Basic auth instead.
- lib-oauth2: JWT aud validation was not performed if aud was missing
from a token, but was configured on Dovecot.
- lib-oauth2: JWT key type check was too strict.
- lib-oauth2: JWT token audience was not validated against client_id as
required by the specification.
- lib-ssl-iostream: Using the ssl_require_crl=yes setting may have caused
CRL check failures for outgoing SSL/TLS connections, although it was
supposed to affect checking CRLs only for client-side SSL
certificates. v2.3.17 regression.
- lib-sql: MySQL driver leaked memory when connection failed.
- lib-storage: Various fixes when running into out of disk space.
- master: Service idle_kill setting didn't work properly on busy
servers.
- mdbox: Temp file scan was done for always empty directories.
- mdbox: The fdatasync() call was done in wrong parent directory when
writing mails. Also on a failure it crashed instead of logging an error.
- notify_status: The plugin crashes if any user initialization fails.
- pop3: Sending command with the ':' character caused an assert-crash.
v2.3.18 regression. Fixes: Panic: event_reason_code_prefix(): name has ':'
- stats: Fix panic when a nonexistent event exporter was referenced while
adding a new metric dynamically via doveadm stats add.
- stats: If process exported a lot of events and then exited, some of
the last events may have become lost.
- stats: Invalid Prometheus label names were created with specific
histogram group_by configurations. Prometheus rejected these labels.
- welcome: The plugin didn't execute in some situations that created
INBOX but didn't open it.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
License Update: link update
from http://support.hdfgroup.org/ftp/HDF5/releases/COPYING_LBNL_HDF5 to
https://raw.githubusercontent.com/hdfgroup/hdf5/develop/COPYING_LBNL_HDF5.
Rework the patch 0001-cmake-remove-build-flags.patch to fix the build path
issue.
Add zlib depends to fix the below failure:
/build/tmp/work/core2-64-poky-linux/hdf5/1.14.2/recipe-sysroot-native/usr/bin/x86_64-poky-linux/../../libexec/x86_64-poky-linux/gcc/x86_64-poky-linux/13.2.0/ld: bin/libhdf5.so.310.2.0: undefined reference to `inflateEnd'
/build/tmp/work/core2-64-poky-linux/hdf5/1.14.2/recipe-sysroot-native/usr/bin/x86_64-poky-linux/../../libexec/x86_64-poky-linux/gcc/x86_64-poky-linux/13.2.0/ld: bin/libhdf5.so.310.2.0: undefined reference to `inflate'
/build/tmp/work/core2-64-poky-linux/hdf5/1.14.2/recipe-sysroot-native/usr/bin/x86_64-poky-linux/../../libexec/x86_64-poky-linux/gcc/x86_64-poky-linux/13.2.0/ld: bin/libhdf5.so.310.2.0: undefined reference to `compress2'
/build/tmp/work/core2-64-poky-linux/hdf5/1.14.2/recipe-sysroot-native/usr/bin/x86_64-poky-linux/../../libexec/x86_64-poky-linux/gcc/x86_64-poky-linux/13.2.0/ld: bin/libhdf5.so.310.2.0: undefined reference to `inflateInit_'
collect2: error: ld returned 1 exit status
Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
- Add a packageconfig for jpegxl. This is done because it is requested by default and
do_configure fails because we dont have a recipe for it in meta-oe
- Refresh patches with devtool
- Remove check-GST_GL_HAVE_PLATFORM_GLX.patch. The file has been reworked and it should
hopefully not be needed anymore
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
- refresh patches
- remove soup2 option as soup2 support was removed
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Apps (Applications tab) is an optional Cockpit Project package.
Make it also an optional package in recipe.
Signed-off-by: Daniel Semkowicz <dse@thaumatec.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Packagekit (Software Updates tab) is an optional Cockpit Project
package. Make it also an optional package in recipe.
Signed-off-by: Daniel Semkowicz <dse@thaumatec.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Don't override CFLAGS and just append the "-fPIC" to CFLAGS to make
sure -fdebug-prefix-map option passed to compiler to fix the below
issue:
WARNING: minifi-cpp-0.7.0-r0 do_package_qa: QA Issue: File /usr/bin/.debug/minificontroller in package minifi-cpp-dbg contains reference to TMPDIR
File /usr/bin/.debug/minifi in package minifi-cpp-dbg contains reference to TMPDIR [buildpaths]
Pass the OPENSSLDIR to avoid introducing the build path to fix the
below issue:
WARNING: minifi-cpp-0.7.0-r0 do_package_qa: QA Issue: File /usr/bin/minificontroller in package minifi-cpp contains reference to TMPDIR
File /usr/bin/minifi in package minifi-cpp contains reference to TMPDIR [buildpaths]
Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
- Add a patch to disable an offensive hardening option
that causes polkit to segfault
- better safety with deeper resctiction of the configuration files
- better safety with restricting the daemon's owner under systemd
- better safety with the systemd unit sandboxing
- less thread races during upload of the configuration
- glib, gobject, gio >= 2.32
- mozjs-102 OR duktape
- gobject-introspection >= 0.6.2 (optional)
- pam (optional)
- ConsoleKit OR systemd
- gettext
- meson
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Tecla is a keyboard layout viewer that uses GTK/Libadwaita for UI,
and libxkbcommon to deal with keyboard maps.
It is a required dependency for gnome-control-center-45
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
- fix various reproducibility issues
- build with sccomp by default and remove the according patch
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apply the work around from:
https://gitlab.freedesktop.org/pulseaudio/webrtc-audio-processing/-/merge_requests/28
which is still needed for 1.3 version:
webrtc-audio-processing-1.3/webrtc/modules/audio_processing/agc2/adaptive_mode_level_estimator.cc: In function 'float webrtc::{anonymous}::GetLevel(const webrtc::VadLevelAnalyzer::Result&, LevelEstimatorType)':
webrtc-audio-processing-1.3/webrtc/modules/audio_processing/agc2/adaptive_mode_level_estimator.cc:45:1: error: control reaches end of non-void function [-Werror=return-type]
45 | }
| ^
webrtc-audio-processing-1.3/webrtc/modules/audio_processing/audio_processing_impl.cc: In function 'webrtc::GainControl::Mode webrtc::{anonymous}::Agc1ConfigModeToInterfaceMode(webrtc::AudioProcessing::Config::GainController1::Mode)':
webrtc-audio-processing-1.3/webrtc/modules/audio_processing/audio_processing_impl.cc:117:1: error: control reaches end of non-void function [-Werror=return-type]
117 | }
| ^
webrtc-audio-processing-1.3/webrtc/modules/audio_processing/audio_processing_impl.cc: In lambda function:
webrtc-audio-processing-1.3/webrtc/modules/audio_processing/audio_processing_impl.cc:1853:13: error: control reaches end of non-void function -Werror=return-type]
1853 | default:
| ^~~~~~~
* this can now be dropped from meta-webosose, where it was since:
https://github.com/webosose/meta-webosose/commit/c2a24372e9f792bc900939a6642e64c459073b36#diff-c367f86896c48beb338dac912d3bf03e07d92c8345fa08dc3dcd93093a949c16
Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Wang Mingyu
Mingli Yu
Markus Volk
Khem Raj
Daniel Semkowicz
Martin Jansa
Chi Xu
Trevor Gamblin
Sam Van Den Berge