openembedded-core.git/meta/recipes-devtools/dpkg, branch 2015-4

dpkg-native: Avoid 'file changed' errors from tar

2015-03-31T21:21:45+00:00

Hardlink count duing do_package_write_deb can change causing dpkg-deb
failures. We don't care about this error case so avoid it by checking
the tar exit code.

[YOCTO #7529]

Signed-off-by: Richard Purdie

dpkg: Don't move update-alternatives to sbindir

2015-03-24T10:07:59+00:00

Debian, Ubuntu and opkg all have it in bindir.

Signed-off-by: Andreas Oberritter 
Signed-off-by: Richard Purdie

recipes: Delete superfluous assignments, S = ${WORKDIR}/${BP}

2015-02-23T18:00:12+00:00

Given that bitbake.conf sets the default values:

BP = "${BPN}-${PV}"
S = "${WORKDIR}/${BP}"

there are a number of recipes that set the variable S completely
superfluously, so get rid of them.

Signed-off-by: Robert P. J. Day 
Signed-off-by: Richard Purdie

meta: enable parallel build for several recipes

2015-02-14T22:26:10+00:00

I used a for loop to build these packages more than 520 times, these
recipes never failed.

Signed-off-by: Robert Yang

dpkg: add perl to RDEPENDS

2015-02-03T14:53:40+00:00

perl scripts:
packages-split/dpkg/usr/bin/dpkg-parsechangelog:#!/usr/bin/perl
packages-split/dpkg/usr/bin/dpkg-mergechangelogs:#!/usr/bin/perl
packages-split/dpkg/usr/bin/dpkg-architecture:#!/usr/bin/perl
packages-split/dpkg/usr/bin/dpkg-vendor:#!/usr/bin/perl
packages-split/dpkg/usr/bin/dpkg-shlibdeps:#!/usr/bin/perl
packages-split/dpkg/usr/bin/dpkg-scanpackages:#!/usr/bin/perl
packages-split/dpkg/usr/bin/dpkg-buildpackage:#!/usr/bin/perl
packages-split/dpkg/usr/bin/dpkg-genchanges:#!/usr/bin/perl
packages-split/dpkg/usr/bin/dpkg-gensymbols:#!/usr/bin/perl
packages-split/dpkg/usr/bin/dpkg-distaddfile:#!/usr/bin/perl
packages-split/dpkg/usr/bin/dpkg-buildflags:#!/usr/bin/perl
packages-split/dpkg/usr/bin/dpkg-checkbuilddeps:#!/usr/bin/perl
packages-split/dpkg/usr/bin/dpkg-gencontrol:#!/usr/bin/perl
packages-split/dpkg/usr/bin/dpkg-scansources:#!/usr/bin/perl
packages-split/dpkg/usr/bin/dpkg-source:#!/usr/bin/perl
packages-split/dpkg/usr/bin/dpkg-name:#!/usr/bin/perl
packages-split/dpkg/usr/lib/dpkg/parsechangelog/debian:#!/usr/bin/perl

Signed-off-by: Robert Yang

dpkg: fix host contamination

2015-01-29T10:37:53+00:00

Force dpkg to use "tar" on the target.

The dpkg configure script looks for gnutar, gtar, and
tar in order. If it finds gnutar or gtar on the host
it expects to use that as its tar program on the target.
Without this, if gtar exists (as it does on my system) then
dpkg will consistently fail on the target with an error about
gtar not being found.

Signed-off-by: Dan McGregor 
Signed-off-by: Ross Burton

dpkg: Upgrade to 1.17.21

2014-12-25T08:17:19+00:00

Remove dpkg-1.17.4-CVE-2014-0471, dpkg-1.17.4-CVE-2014-0471-CVE-2014-3127 and
ignore_extra_fields patches that are already in upstream.

Rebase no-vla-warning patch.

Signed-off-by: Aníbal Limón 
Signed-off-by: Richard Purdie

dpkg: Security Advisory - CVE-2014-3127

2014-06-17T09:23:45+00:00

v2 changes:
* update format for commit log
* add Upstream-Status for patch

commit a12eb58959d0a10584a428f4a3103a49204c410f upstream

Dpkg::Source::Patch: Outright reject C-style filenames in patches

Because patch only started recognizing C-style filenames in diffs
in version 2.7, it's not safe to assume one behaviour or the other,
as the system might or might not have a recent enough version, or
a GNU patch program at all. There's also no reason we should be
supporting this kind of strange encoded filenames in patches, when
we have not done so up to now.

Let's just ban these types of diffs and be done with it.

Fixes: CVE-2014-0471, CVE-2014-3127
Closes: #746306

[drop the text for debian/changelog,because it's not suitable
for the veriosn]
Signed-off-by: Wenlin Kang 
Signed-off-by: Wenzong Fan 
Signed-off-by: Richard Purdie

dpkg: Security Advisory - CVE-2014-0471

2014-06-17T09:23:45+00:00

v2 changes:
* update format for commit log
* add Upstream-Status for patch

commit a82651188476841d190c58693f95827d61959b51 upstream

Dkpkg::Source::Patch: Correctly parse C-style diff filenames

We need to strip the surrounding quotes, and unescape any escape
sequence, so that we check the same files that the patch program will
be using, otherwise a malicious package could overpass those checks,
and perform directory traversal attacks on source package unpacking.

Fixes: CVE-2014-0471

Reported-by: Jakub Wilk 
[drop the text for debian/changelog,because it's not suitable
 for the veriosn]

Signed-off-by: Wenlin Kang 
Signed-off-by: Wenzong Fan 
Signed-off-by: Richard Purdie

Globally replace 'base_contains' calls with 'bb.utils.contains'

2014-04-25T16:10:58+00:00

The base_contains is kept as a compatibility method and we ought to
not use it in OE-Core so we can remove it from base metadata in
future.

Signed-off-by: Otavio Salvador 
Signed-off-by: Richard Purdie