A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or ov…
A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the w…
VuXML only (0) · listed, port not fixed yet
None. pkg audit reports nothing for this version.
Fixed (5)
VuXML entries whose affected range this version has left.
archivers/gtar: fix build on i386
Override a hidden safety check that stops the build on platforms
that are not Y2038 safe. FreeBSD/i386 still has a 32-bit time_t.
PR: 272622
Reported by: cy
archivers/gtar: switch the default archive to stdin/stdout
The gtar port tries to use the same default archive location as the
base system tar. Starting with libarchive 3.6.0, bsdtar defaults
to reading/writing the archive from stdin/to stdout in the common
case where the /dev/sa0 device does not exist on a system.
Using "-" as the default archive file is also the GNU upstream
default.
PR: 271260
Reported by: Michael Stone <mstone2001@msn.com>
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.
There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.
The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.
Approved by: portmgr (tcberner)
Remove support for FreeBSD 12.1 from various ports.
FreeBSD 12.1 reached end-of-life today. Adjust the message
for the wine ports while here, since stable/13 has branched.
Submitted by: rene
Reviewed by: jbeich, mandree, mat, osa
Approved by: portmgr (mat)
Differential Revision: https://reviews.freebsd.org/D28406
archivers/gtar: update to 1.33
Noteworthy changes:
* POSIX extended format headers do not include PID by default
* --delay-directory-restore works for archives with reversed member ordering
* Fix extraction of a symbolic link hardlinked to another symbolic link
* Wildcards in exclude-vcs-ignore mode don't match slash
* Fix the --no-overwrite-dir option
* Fix handling of chained renames in incremental backups
* Link counting works for file names supplied with -T
* Accept only position-sensitive (file-selection) options in file list files
Update to 1.31. Noteworthy changes: * Support for zstd compression (if zstd is installed). * The -K option interacts properly with member names given on the command line. * Fix handling of file shrinkage during read access when --sparse is used.
Install texinfo files (GNU info) into ${PREFIX}/share/info
After a discussion on the mailing list on moving manpages to
${PREFIX}/share/man for consistency with base where it is
installed in usr/share/man, it appeared the same should happen
to GNU info files which were installed under share in base and
not in ports.
Now texinfo is not in base on any of the supported version of FreeBSD
it is possible to proceed to this move and it is easier to do than
the manpage change.
Other benefit than consistency are less patching: all build tools but
cmake are expecting info files to be under share/info and cmake (patched here)
was having an exception for BSD so the patch makes FreeBSD case less
specific for them
Bump revision of all impacted ports
PR: 232907
exp-run by: antoine
Differential Revision: https://reviews.freebsd.org/D17816
Update to 1.30. Noteworthy changes: * Member names containing '..' components are now skipped when extracting. * Report erroneous use of position-sensitive options. * --numeric-owner now affects private headers too. * Fixed the --delay-directory-restore option * The --warnings=failed-read option * The --warnings=none option now suppresses all warnings * Fix reporting of hardlink mismatches during
Most commonly used build systems support silent builds, when they hide actual commands executed and only show short summary line (like "CC foo.c"). CMake and ninja enable this by default, some autotools using ports do as well. This is unacceptable because we need complete build logs at any time, so we now switch to verbose build logs unconditionally. Note that this change deliberately affects ALL
Change summary:
- Always do verbose builds for cmake, ninja and GNU configure (the
latter includes check if --disable-silent-rules is actually supported
by the configure script; there are isolated cases when it's not true)
- Remove CMAKE_VERBOSE, NINJA_VERBOSE and
CONFIGURE_ARGS=--disable-silent-rules from all ports which set them
for this is no longer needed
- Revert hacks for --disable-silent-rules support priorly committed
to biology/ncbi-blast+ and net-p2p/mldonkey - no longer needed as well
Submitted by: amdmi3
Reviewed by: mat
Exp-run by: antoine
Approved by: portmgr (mat, antoine)
Differential Revision: D7534
Do not attempt to rebuild tar.info after patching configure. I can't reproduce this on 10.3, but have a report from 9.3. Differences in make(1)?
Reported by: Rob Levandowski <robl@macwhiz.com>
Split devel/gettext in devel/gettext-runtime and devel/gettext-tools. The first contains runtime libraries such as libintl and the latter contains developer tools such as msgfmt. Ports that use gettext will usually need a LIB_DEPENDS on gettext-runtime and a BUILD_DEPENDS on gettext-tools.
USES=gettext-runtime can be used to set a LIB/BUILD/RUN_DEPENDS on
devel/gettext-runtime and USES=gettext-tools can be used to set a
BUILD/RUN_DEPENDS on devel/gettext-tools. USES=gettext is now the same
as "USES=gettext-runtime gettext-tools" meaning a LIB_DEPENDS on
devel/gettext-runtime and a BUILD_DEPENDS on devel/gettext-tools.
Update gettext to 0.19.3.
Remove :oldver from converters/libiconv and devel/gettext-runtime. Leave
symlinks with the old library versions to avoid the need to bump
PORTREVISION on a large number of dependent ports. When most of the
dependent ports have had normal version updates, PORTREVISION can be
bumped on the remaining ones (low number) and the links can be removed.
Fix some ports that installed files in lib/locale instead of share/locale.
PR: 194038
Reviewed by: bapt
Exp-run: antoine
Approved by: portmgr (antoine)
Update to 1.28. Noteworthy changes in this release: * New checkpoint action: totals * Extended checkpoint format specification. * New option --one-top-level * New option --sort * New exclusion options * Manpages
Update to 1.27.1. Bug fixes: * Fix unquoting of file names obtained via the -T option. * Fix GNU long link header timestamp (backward compatibility). * Fix extracting sparse members from star archives.
PR: 189675
Submitted by: Jason Harris <jharris@widomaker.com>
- Add LDFLAGS to CONFIGURE_ENV and MAKE_ENV (as it was done with LDFLAGS) - Fix all ports that add {CPP,LD}FLAGS to *_ENV to modify flags instead
PR: 157936
Submitted by: myself
Exp-runs by: pav
Approved by: pav
Fix bug with --one-file-system and --listed-incremental. This is important for at least misc/amanda-client.
Submitted by: John Hein <jhein@symmetricom.com>
Obtained from: upstream