%generate_buildrequires
by Andrew C Aitchison
On Thu, 3 Dec 2020, Michel Alexandre Salim wrote:
>> Apart from the usual package-not-available story (which I want to fix
>> as part of my work bringing up the EPEL Packagers SIG), my current
>> snag is that python-tox-current-env uses %generate_buildrequires which
>> does not work on CentOS 8:
>>
>> CentOS 8 is still on RPM 4.14:
>> <mock-chroot> sh-4.4# rpm -q rpm
>> rpm-4.14.2-37.el8.x86_64
>>
>> I'll put up a patch to hardcode dependencies for non-Fedora releases,
>> though that sorts of defeat the purpose of dynamic build
>> requirements.
>> Then again, this is only needed for EPEL8, since EPEL9 will have a
>> new enough RPM.
>>
> Given that %generate_buildrequires is the selling point of pyproject-
> rpm-macros, I'm guessing a better way forward for EPEL8 would be to not
> require it on EPEL8 since there's no way it would work, since RH won't
> update RPM?
>
> https://src.fedoraproject.org/rpms/pyproject-rpm-macros
Is %generate_buildrequires suppose to work for packages
which do not used python ?
From the name I would expect it to, but reading that doc makes me
think %generate_buildrequires *is* python specific.
If so, the name is misleading.
(I am also confused/suspicious of the point of a macro to automate
build requires, except as a step on a path to somewhere else.
If build requirements need to be stated explicitly,
then automating their statement is a good way of hiding an issue
that needs to be reviewed whenever changes are made.
)
--
Andrew C. Aitchison Kendal, UK
andrew(a)aitchison.me.uk
1 year
How to support python 3.8 from RHEL 8.2 in EPEL?
by Orion Poplawski
Folks -
Looks like RHEL 8.2 will have python 3.8 in addition to python 3.6. From
the 8.2 beta:
Red Hat Enterprise Linux 8 for x86_64 - AppStream Beta (RPMs)
Name Stream Profiles Summary
python27 2.7 [d][e] common [d] Python programming
language, version 2.7
python36 3.6 [d][e] build, common [d] Python programming
language, version 3.6
python38 3.8 [d][e] build, common [d] Python programming
language, version 3.8
Currently, %python_pkgversion is set to 3 in
/usr/lib/rpm/macros.d/macros.python-srpm from python-srpm-macros.
python3-devel is still provided only by python36-devel, so presumably all
EPEL8 python packages will continue to be built against python 3.6. But I
imagine that people will soon be asking for python 3.8 versions of EPEL
packages. How can we provide those? Does this have to be done in some
modular fashion - which seems to come back to the discussion of whether or not
every package has to become its own module or whether to group them together
somehow. Or since both python modules are "default" modules and we can
install both python36-devel and python38-devel at the same time, perhaps we
can define the python3_other* macros again for python38 and just go that way?
Thoughts?
--
Orion Poplawski
Manager of NWRA Technical Systems 720-772-5637
NWRA, Boulder/CoRA Office FAX: 303-415-9702
3380 Mitchell Lane orion(a)nwra.com
Boulder, CO 80301 https://www.nwra.com/
1 year, 3 months
Xfce 4.16 on EPEL-8
by Mukundan Ragavan
Hi all,
I have a COPR containing xfce 4.16 packages for EPEL-8 packages [0]. I
would like to get some testing done using this COPR before getting into
EPEL-8.
Please email if and when you notice problems and I will try to fix it as
soon as possible.
As a reminder - xfce 4.16 will be available in F34.
Thanks,
Mukundan.
[0] https://copr.fedorainfracloud.org/coprs/nonamedotc/xfce416-epel8/
--
GPG Key: E5C8BC67
1 year, 9 months
gcc-gnat
by Erick Wittman
Hi EPEL developers.
I am using CentOS 8 and am using various packages in the EPEL
repository. I am interested in seeing gcc-gnat added to EPEL.
I cannot find a current Fedora maintainer listed for this package, but
it is available in Fedora (at least in version 32). Are there any
EPEL
maintainers who are interested in creating an EPEL version of this package?
Thank you
1 year, 10 months
proposal: EPEL 8 Next
by Carl George
Howdy folks,
A large part of my day job is working on CentOS Stream. Naturally I would
like it to be successful and have wide adoption. I know that EPEL will play
a big role in this success. EPEL is extremely popular. Many users consider
RHEL and CentOS unusable without it.
The problem we are facing is that EPEL 8 cannot be 100% compatible with
RHEL/CentOS 8 and CentOS 8 Stream at the same time. It is not uncommon for
RHEL to ship library soname changes in minor releases. In the RHEL 8 cycle,
those changes are showing up in CentOS 8 Stream first. EPEL 8 builds
against the latest RHEL 8 release. This can result in EPEL 8 packages that
are uninstallable on CentOS 8 Stream due to the library differences. One
prominent example we have already seen is llvm-libs, which has increased its
library soname in every RHEL 8 minor release so far. Another increase is
planned for RHEL 8.3, which has already been released in CentOS 8 Stream.
There are likely other incompatibilities that haven't been noticed yet. I
expect this problem to grow worse as RHEL development continues and more
packages are added to EPEL 8. This situation is hurting the adoption of
CentOS Stream.
To solve this problem, I am proposing that we create a new repository called
EPEL 8 Next.
- built against CentOS 8 Stream
- opt-in for packagers (must request epel8-next dist-git branch)
- opt-in for users (part of epel-release but disabled by default)
- used *with* epel8, not *instead of*
This will provide EPEL packagers a place where they can update their
packages when necessary to be compatible with CentOS 8 Stream. These
packages would also be useful for RHEL 8 users during the gap between a RHEL
minor release and the equivalent CentOS 8 Linux rebuild. In theory this
repository should also be directly consumable by RHEL 8 Beta releases.
Similar to RHEL itself, breaking changes could be permitted in epel8-next in
preparation for delivering them to epel8 around the time of the next RHEL
minor release.
This proposal may sound similar to epel8-playground. However, that was
still built against RHEL 8, so it didn't solve the compatibility issue with
CentOS 8 Stream. This proposal does draw on lessons learned from the
playground experiment.
- no automatic builds via packages.cfg
- opt-in rather than opt-out
- layering on top of epel8, rather than duplicating content
I first suggested this idea at the last EPEL Steering Committee meeting, and
we plan to discuss it again during the next one. Please share your thoughts
on this proposal.
--
Carl George
2 years
Fedora EPEL 8 updates-testing report
by updates@fedoraproject.org
The following Fedora EPEL 8 Security updates need testing:
Age URL
12 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-610589457a prosody-0.11.8-1.el8
10 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-bfa4482ae0 libmysofa-1.2-4.el8
6 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-3428ca1a34 ansible-2.9.18-1.el8
3 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-71d1af6aca isync-1.4.1-1.el8
3 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-525253c896 chromium-88.0.4324.182-1.el8
0 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-fedb6fa69d python-aiohttp-3.7.4-1.el8
0 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-6fed4b5ffb nagios-4.4.6-3.el8
The following builds have been pushed to Fedora EPEL 8 updates-testing
netdata-1.29.3-1.el8
strongswan-5.9.1-1.el8
Details about builds:
================================================================================
netdata-1.29.3-1.el8 (FEDORA-EPEL-2021-33b2e87760)
Real-time performance monitoring
--------------------------------------------------------------------------------
Update Information:
Update from upstream ---- Update from upstream
--------------------------------------------------------------------------------
ChangeLog:
* Sat Feb 27 2021 Didier Fabert <didier.fabert(a)gmail.com> 1.29.3-1
- Update from upstream
* Fri Feb 19 2021 Didier Fabert <didier.fabert(a)gmail.com> 1.29.2-1
- Update from upstream
* Thu Feb 11 2021 Didier Fabert <didier.fabert(a)gmail.com> 1.29.1-1
- Update from upstream
* Fri Feb 5 2021 Didier Fabert <didier.fabert(a)gmail.com> 1.29.0-1
- Update from upstream
- Add profile file
- Move edit-config from netdata package to netdata-conf
* Wed Dec 23 2020 Didier Fabert <didier.fabert(a)gmail.com> 1.28.0-2
- Re-enable cloud client
- Un-blundle libwebsockets (using lib from system) on fedora only
* Mon Dec 21 2020 Didier Fabert <didier.fabert(a)gmail.com> 1.28.0-1
- Update from upstream: bugfix from upstream
* Fri Dec 18 2020 Didier Fabert <didier.fabert(a)gmail.com> 1.27.0-1
- Update from upstream
* Fri Dec 11 2020 Ling Wang <LingWangNeuralEng(a)gmail.com> 1.26.0-3
- fix Bug 1906930: change /usr/share/netdata/web group to netdata
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1927059 - netdata-1.29.2 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1927059
[ 2 ] Bug #1932062 - netdata-1.29.3 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1932062
--------------------------------------------------------------------------------
================================================================================
strongswan-5.9.1-1.el8 (FEDORA-EPEL-2021-ab11199fb0)
An OpenSource IPsec-based VPN and TNC solution
--------------------------------------------------------------------------------
Update Information:
The latest strongswan update was not built for F34 (but built for rawhide and
F33), and not for EPEL8 either.
--------------------------------------------------------------------------------
ChangeLog:
* Fri Feb 12 2021 Paul Wouters <pwouters(a)redhat.com> - 5.9.1-1
- Resolves: rhbz# 1896545 strongswan-5.9.1 is available
* Thu Feb 11 2021 Davide Cavalca <dcavalca(a)fedoraproject.org> - 5.9.0-4
- Build with with capabilities support
- Resolves: rhbz#1911572 StrongSwan not configured with libcap support
* Wed Jan 27 2021 Fedora Release Engineering <releng(a)fedoraproject.org> - 5.9.0-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
* Thu Oct 22 2020 Paul Wouters <pwouters(a)redhat.com> - 5.9.0-2
- Resolves: rhbz#1886759 charon looking for certificates in the wrong place
* Mon Sep 28 2020 Paul Wouters <pwouters(a)redhat.com> - 5.9.0-1
- Resolves: rhbz#1861747 strongswan-5.9.0 is available
- Remove --enable-fips-mode=2, which defaults strongswan to FIPS only.
(use fips_mode = 2 in plugins {} openssl {} in strongswan.conf to enable FIPS)
* Sat Aug 1 2020 Fedora Release Engineering <releng(a)fedoraproject.org> - 5.8.4-5
- Second attempt - Rebuilt for
https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
* Wed Jul 29 2020 Fedora Release Engineering <releng(a)fedoraproject.org> - 5.8.4-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
* Tue Apr 21 2020 Bj��rn Esser <besser82(a)fedoraproject.org> - 5.8.4-3
- Rebuild (json-c)
* Sun Apr 12 2020 Mikhail Zabaluev <mikhail.zabaluev(a)gmail.com> - 5.8.4-2
- Patch0: Add RuntimeDirectory options to service files (#1789263)
* Sun Apr 12 2020 Mikhail Zabaluev <mikhail.zabaluev(a)gmail.com> - 5.8.4-1
- Updated to 5.8.4
- Patch4 has been applied upstream
--------------------------------------------------------------------------------
2 years, 3 months
Fedora EPEL 8 updates-testing report
by updates@fedoraproject.org
The following Fedora EPEL 8 Security updates need testing:
Age URL
11 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-610589457a prosody-0.11.8-1.el8
9 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-bfa4482ae0 libmysofa-1.2-4.el8
5 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-3428ca1a34 ansible-2.9.18-1.el8
3 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-71d1af6aca isync-1.4.1-1.el8
3 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-525253c896 chromium-88.0.4324.182-1.el8
The following builds have been pushed to Fedora EPEL 8 updates-testing
ceres-solver-1.14.0-3.el8
clamav-0.103.1-1.el8
nagios-4.4.6-3.el8
python-aiohttp-3.7.4-1.el8
python-tkrzw-0.1.4-2.el8
stacer-1.1.0-12.el8
urdfdom-headers-1.0.5-1.el8
Details about builds:
================================================================================
ceres-solver-1.14.0-3.el8 (FEDORA-EPEL-2021-da889f4309)
A non-linear least squares minimizer
--------------------------------------------------------------------------------
Update Information:
Introduce ceres-solver to EPEL8
--------------------------------------------------------------------------------
ChangeLog:
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1927572 - Please build ceres-solver for EPEL 8
https://bugzilla.redhat.com/show_bug.cgi?id=1927572
--------------------------------------------------------------------------------
================================================================================
clamav-0.103.1-1.el8 (FEDORA-EPEL-2021-10c83ba6bf)
End-user tools for the Clam Antivirus scanner
--------------------------------------------------------------------------------
Update Information:
ClamAV 0.103.1 patch release https://blog.clamav.net/2021/02/clamav-01031-patch-
release.html Notable changes Added a new scan option to alert on broken
media (graphics) file formats. This feature mitigates the risk of malformed
media files intended to exploit vulnerabilities in other software. At present,
media validation exists for JPEG, TIFF, PNG and GIF files. To enable this
feature, set AlertBrokenMedia yes in clamd.conf for use with ClamD, or use the
--alert-broken-media option when using ClamScan. These options are disabled by
default in this patch release but may be enabled in a subsequent release.
Application developers may enable this scan option by enabling
CL_SCAN_HEURISTIC_BROKEN_MEDIA for the heuristic scan option bit field.
Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF and PNG typing behavior. BMP
and JPEG 2000 files will continue to detect as CL_TYPE_GRAPHICS because ClamAV
does not yet have BMP or JPEG 2000 format-checking capabilities. Bug fixes
Fixed PNG parser logic bugs that caused an excess of parsing errors and fixed a
stack exhaustion issue affecting some systems when scanning PNG files. PNG file
type detection was disabled via signature database update for ClamAV version
0.103.0 to mitigate the effects from these bugs. Fixed an issue where PNG
and GIF files no longer work with Target:5 graphics signatures if detected as
CL_TYPE_PNG or CL_TYPE_GIF rather than as CL_TYPE_GRAPHICS. Target types now
support up to 10 possible file types to make way for additional graphics types
in future releases. Fixed ClamOnAcc's --fdpass option. File descriptor
passing (or "FD-passing") is a mechanism by which ClamOnAcc and ClamDScan may
transfer an open file to ClamD to scan, even if ClamD is running as a non-
privileged user and wouldn't otherwise have read-access to the file. This
enables ClamD to scan all files without having to run ClamD as root. If
possible, ClamD should never be run as root to mitigate the risk in case ClamD
is somehow compromised while scanning malware. Interprocess file descriptor
passing for ClamOnAcc was broken since version 0.102.0 due to a bug introduced
by the switch to cURL for communicating with ClamD. On Linux, passing file
descriptors from one process to another is handled by the kernel, so we reverted
ClamOnAcc to use standard system calls for socket communication when FD-passing
is enabled. Fixed a ClamOnAcc stack corruption issue on some systems when
using an older version of libcurl. Patch courtesy of Emilio Pozuelo Monfort.
Allow ClamScan and ClamDScan scans to proceed even if the realpath lookup
failed. This alleviates an issue on Windows scanning files hosted on file-
systems that do not support the GetMappedFileNameW() API, such as on ImDisk RAM-
disks. Fixed FreshClam's --on-update-execute=EXIT_1 temporary directory
cleanup issue. ClamD's log output and VirusEvent feature now provide the
scan target's file path instead of a file descriptor. The ClamD socket API for
submitting a scan by FD-passing doesn't include a file path. This feature works
by looking up the file path by the file descriptor. This feature works on Mac
and Linux but is not yet implemented for other UNIX operating systems. FD-
passing is not available for Windows. Fixed an issue where FreshClam
database validation didn't work correctly when run in daemon mode on Linux/Unix.
Fixed scan speed performance issues accidentally introduced in ClamAV 0.103.0
caused by hashing file maps more than once when parsing a file as a new type,
and caused by frequent scanning of non-HTML text data with the HTML parser.
Other improvements Scanning JPEG, TIFF, PNG and GIF files will no longer
return "parse" errors when file format validation fails. Instead, the scan will
alert with the "Heuristics.Broken.Media" signature prefix and a descriptive
suffix to indicate the issue, provided that the "alert broken media" feature is
enabled. GIF format validation will no longer fail if the GIF image is
missing the trailer byte, as this appears to be a relatively common issue in
otherwise functional GIFs. Added a TIFF dynamic configuration (DCONF)
option that was missing. This will allow us to disable TIFF format validation
via signature database update in the event that it proves to be problematic.
This feature already exists for many other file types.
--------------------------------------------------------------------------------
ChangeLog:
* Wed Feb 17 2021 S��rgio Basto <sergio(a)serjux.com> - 0.103.1-1
- Update to 0.103.1
* Wed Jan 27 2021 S��rgio Basto <sergio(a)serjux.com> - 0.103.0-3
- Add upstream patch clamonacc: Fix stack buffer overflow with old curl
* Tue Jan 26 2021 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.103.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1909184 - clamdscan in 0.103.0 version seems to consume too much memory
https://bugzilla.redhat.com/show_bug.cgi?id=1909184
--------------------------------------------------------------------------------
================================================================================
nagios-4.4.6-3.el8 (FEDORA-EPEL-2021-6fed4b5ffb)
Host/service/network monitoring program
--------------------------------------------------------------------------------
Update Information:
Fix for CVE-2020-13977 BZ1849087 Require plugins needed for localhost monitoring
(#1932297) Update to 4.4.6
--------------------------------------------------------------------------------
ChangeLog:
* Sat Feb 27 2021 Guido Aulisi <guido.aulisi(a)gmail.com> - 4.4.6-3
- Require plugins needed for localhost monitoring (#1932297)
* Tue Feb 23 2021 Guido Aulisi <guido.aulisi(a)gmail.com> - 4.4.6-2
- Fix systemd unit file permissions #1676334
* Sat Feb 20 2021 Guido Aulisi <guido.aulisi(a)gmail.com> - 4.4.6-1
- Update to 4.4.6
- Fix for CVE-2020-13977 #BZ1849087
- Some spec cleanup
* Tue Feb 18 2020 Stephen Smoogen <smooge(a)fedoraproject.org> - 4.4.5-3
- Add change to allow for problems found in mass rebuild and gcc10.
- Fix BZ#1793909
* Wed Jan 29 2020 Fedora Release Engineering <releng(a)fedoraproject.org> - 4.4.5-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1829114 - nagios-4.4.6 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1829114
[ 2 ] Bug #1849087 - CVE-2020-13977 nagios: URL injection (post-authentication) vulnerability [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1849087
[ 3 ] Bug #1932297 - Nagios server rpm missing some nagios-plugins-* dependency
https://bugzilla.redhat.com/show_bug.cgi?id=1932297
--------------------------------------------------------------------------------
================================================================================
python-aiohttp-3.7.4-1.el8 (FEDORA-EPEL-2021-fedb6fa69d)
Python HTTP client/server for asyncio
--------------------------------------------------------------------------------
Update Information:
Update to latest upstream release 3.7.4
--------------------------------------------------------------------------------
ChangeLog:
* Sat Feb 27 2021 Fabian Affolter <mail(a)fabian-affolter.ch> - 3.7.4-1
- Update to latest upstream release 3.7.4
* Thu Feb 4 2021 Miro Hron��ok <mhroncok(a)redhat.com> - 3.7.3-3
- Allow installation with chardet 4
* Wed Jan 27 2021 Fedora Release Engineering <releng(a)fedoraproject.org> - 3.7.3-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
* Fri Dec 11 2020 Fabian Affolter <mail(a)fabian-affolter.ch> - 3.7.3-1
- Update to latest upstream release 3.7.3
* Wed Dec 9 2020 Fabian Affolter <mail(a)fabian-affolter.ch> - 3.7.2-1
- Update to latest upstream release 3.7.2
* Mon Oct 26 2020 Fabian Affolter <mail(a)fabian-affolter.ch> - 3.7.1-1
- Update to new upstream version 3.7.1
* Wed Oct 14 2020 Fabian Affolter <mail(a)fabian-affolter.ch> - 3.6.3-1
- Update to new upstream version 3.6.3
* Tue Jul 28 2020 Fedora Release Engineering <releng(a)fedoraproject.org> - 3.6.2-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
* Sun May 24 2020 Miro Hron��ok <mhroncok(a)redhat.com> - 3.6.2-4
- Rebuilt for Python 3.9
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1933364 - python-aiohttp: Open redirect in aiohttp.web_middlewares.normalize_path_middleware
https://bugzilla.redhat.com/show_bug.cgi?id=1933364
--------------------------------------------------------------------------------
================================================================================
python-tkrzw-0.1.4-2.el8 (FEDORA-EPEL-2021-ee18e697bf)
TKRZW Python bindings
--------------------------------------------------------------------------------
Update Information:
python_provide fix
--------------------------------------------------------------------------------
ChangeLog:
--------------------------------------------------------------------------------
================================================================================
stacer-1.1.0-12.el8 (FEDORA-EPEL-2021-9f9f9c3668)
Linux system optimizer and monitoring
--------------------------------------------------------------------------------
Update Information:
build: Add `qt5-qtcharts` dep | RH#1933328
--------------------------------------------------------------------------------
ChangeLog:
* Sat Feb 27 2021 Artem Polishchuk <ego.cordatus(a)gmail.com> - 1.1.0-12
- build: Add qt5-qtcharts dep | RH#1933328
* Wed Jan 27 2021 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.1.0-11
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
* Wed Jul 29 2020 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.1.0-10
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1933328 - Stacer does not work after being installed by dnf package manager
https://bugzilla.redhat.com/show_bug.cgi?id=1933328
--------------------------------------------------------------------------------
================================================================================
urdfdom-headers-1.0.5-1.el8 (FEDORA-EPEL-2021-56f9b1b656)
The URDF (U-Robot Description Format) headers
--------------------------------------------------------------------------------
Update Information:
Introduce urdfdom-headers to epel8
--------------------------------------------------------------------------------
ChangeLog:
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1918537 - Please build urdfdom-headers for EPEL 8
https://bugzilla.redhat.com/show_bug.cgi?id=1918537
--------------------------------------------------------------------------------
2 years, 3 months
Fedora EPEL 7 updates-testing report
by updates@fedoraproject.org
The following Fedora EPEL 7 Security updates need testing:
Age URL
11 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-3cc28d5469 php-horde-Horde-Text-Filter-2.3.7-1.el7
11 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-bb1731457c prosody-0.11.8-1.el7
10 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-f93d3d26db privoxy-3.0.31-1.el7
9 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-389d1fe8e6 libmysofa-1.2-4.el7
9 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-4dda69dcf1 rubygem-rack-cors-1.0.6-1.el7
5 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-9ec8ceb857 ansible-2.9.18-1.el7
3 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-5261c4f487 chromium-88.0.4324.182-1.el7
The following builds have been pushed to Fedora EPEL 7 updates-testing
clamav-0.103.1-1.el7
nagios-4.4.6-3.el7
Details about builds:
================================================================================
clamav-0.103.1-1.el7 (FEDORA-EPEL-2021-03e142a515)
End-user tools for the Clam Antivirus scanner
--------------------------------------------------------------------------------
Update Information:
ClamAV 0.103.1 patch release (
https://blog.clamav.net/2021/02/clamav-01031-patch-release.html ) Notable
changes Added a new scan option to alert on broken media (graphics) file
formats. This feature mitigates the risk of malformed media files intended
to exploit vulnerabilities in other software. At present, media validation
exists for JPEG, TIFF, PNG and GIF files. To enable this feature, set
AlertBrokenMedia yes in clamd.conf for use with ClamD, or use the --alert-
broken-media option when using ClamScan. These options are disabled by default
in this patch release but may be enabled in a subsequent release.
Application developers may enable this scan option by enabling
CL_SCAN_HEURISTIC_BROKEN_MEDIA for the heuristic scan option bit field.
Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF and PNG typing behavior. BMP
and JPEG 2000 files will continue to detect as CL_TYPE_GRAPHICS because ClamAV
does not yet have BMP or JPEG 2000 format-checking capabilities. Bug fixes
Fixed PNG parser logic bugs that caused an excess of parsing errors and fixed a
stack exhaustion issue affecting some systems when scanning PNG files. PNG file
type detection was disabled via signature database update for ClamAV version
0.103.0 to mitigate the effects from these bugs. Fixed an issue where PNG
and GIF files no longer work with Target:5 graphics signatures if detected as
CL_TYPE_PNG or CL_TYPE_GIF rather than as CL_TYPE_GRAPHICS. Target types now
support up to 10 possible file types to make way for additional graphics types
in future releases. Fixed ClamOnAcc's --fdpass option. File descriptor
passing (or "FD-passing") is a mechanism by which ClamOnAcc and ClamDScan may
transfer an open file to ClamD to scan, even if ClamD is running as a non-
privileged user and wouldn't otherwise have read-access to the file. This
enables ClamD to scan all files without having to run ClamD as root. If
possible, ClamD should never be run as root to mitigate the risk in case ClamD
is somehow compromised while scanning malware. Interprocess file descriptor
passing for ClamOnAcc was broken since version 0.102.0 due to a bug introduced
by the switch to cURL for communicating with ClamD. On Linux, passing file
descriptors from one process to another is handled by the kernel, so we reverted
ClamOnAcc to use standard system calls for socket communication when FD-passing
is enabled. Fixed a ClamOnAcc stack corruption issue on some systems when
using an older version of libcurl. Patch courtesy of Emilio Pozuelo Monfort.
Allow ClamScan and ClamDScan scans to proceed even if the realpath lookup
failed. This alleviates an issue on Windows scanning files hosted on file-
systems that do not support the GetMappedFileNameW() API, such as on ImDisk RAM-
disks. Fixed FreshClam's --on-update-execute=EXIT_1 temporary directory
cleanup issue. ClamD's log output and VirusEvent feature now provide the
scan target's file path instead of a file descriptor. The ClamD socket API for
submitting a scan by FD-passing doesn't include a file path. This feature works
by looking up the file path by the file descriptor. This feature works on Mac
and Linux but is not yet implemented for other UNIX operating systems. FD-
passing is not available for Windows. Fixed an issue where FreshClam
database validation didn't work correctly when run in daemon mode on Linux/Unix.
Fixed scan speed performance issues accidentally introduced in ClamAV 0.103.0
caused by hashing file maps more than once when parsing a file as a new type,
and caused by frequent scanning of non-HTML text data with the HTML parser.
Other improvements Scanning JPEG, TIFF, PNG and GIF files will no longer
return "parse" errors when file format validation fails. Instead, the scan will
alert with the "Heuristics.Broken.Media" signature prefix and a descriptive
suffix to indicate the issue, provided that the "alert broken media" feature is
enabled. GIF format validation will no longer fail if the GIF image is
missing the trailer byte, as this appears to be a relatively common issue in
otherwise functional GIFs. Added a TIFF dynamic configuration (DCONF)
option that was missing. This will allow us to disable TIFF format validation
via signature database update in the event that it proves to be problematic.
This feature already exists for many other file types.
--------------------------------------------------------------------------------
ChangeLog:
* Wed Feb 17 2021 S��rgio Basto <sergio(a)serjux.com> - 0.103.1-1
- Update to 0.103.1
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1909184 - clamdscan in 0.103.0 version seems to consume too much memory
https://bugzilla.redhat.com/show_bug.cgi?id=1909184
--------------------------------------------------------------------------------
================================================================================
nagios-4.4.6-3.el7 (FEDORA-EPEL-2021-548bb74e95)
Host/service/network monitoring program
--------------------------------------------------------------------------------
Update Information:
Fix for CVE-2020-13977 BZ1849087 Require plugins needed for localhost monitoring
(#1932297) Update to 4.4.6
--------------------------------------------------------------------------------
ChangeLog:
* Sat Feb 27 2021 Guido Aulisi <guido.aulisi(a)gmail.com> - 4.4.6-3
- Require plugins needed for localhost monitoring (#1932297)
* Tue Feb 23 2021 Guido Aulisi <guido.aulisi(a)gmail.com> - 4.4.6-2
- Fix systemd unit file permissions #1676334
* Sat Feb 20 2021 Guido Aulisi <guido.aulisi(a)gmail.com> - 4.4.6-1
- Update to 4.4.6
- Fix for CVE-2020-13977 #BZ1849087
- Some spec cleanup
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1829114 - nagios-4.4.6 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1829114
[ 2 ] Bug #1849087 - CVE-2020-13977 nagios: URL injection (post-authentication) vulnerability [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1849087
[ 3 ] Bug #1932297 - Nagios server rpm missing some nagios-plugins-* dependency
https://bugzilla.redhat.com/show_bug.cgi?id=1932297
--------------------------------------------------------------------------------
2 years, 3 months
Fedora EPEL 8 updates-testing report
by updates@fedoraproject.org
The following Fedora EPEL 8 Security updates need testing:
Age URL
10 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-610589457a prosody-0.11.8-1.el8
8 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-bfa4482ae0 libmysofa-1.2-4.el8
4 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-3428ca1a34 ansible-2.9.18-1.el8
2 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-71d1af6aca isync-1.4.1-1.el8
2 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-4186de3a1a nagios-4.4.6-1.el8
2 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-525253c896 chromium-88.0.4324.182-1.el8
The following builds have been pushed to Fedora EPEL 8 updates-testing
libss7-2.0.0-7.el8
python-certbot-nginx-1.12.0-2.el8
xrootd-5.1.0-2.el8
Details about builds:
================================================================================
libss7-2.0.0-7.el8 (FEDORA-EPEL-2021-3c0e44a4fe)
SS7 protocol services to applications
--------------------------------------------------------------------------------
Update Information:
Initial package for EPEL8
--------------------------------------------------------------------------------
ChangeLog:
--------------------------------------------------------------------------------
================================================================================
python-certbot-nginx-1.12.0-2.el8 (FEDORA-EPEL-2021-4c2bba15fa)
The nginx plugin for certbot
--------------------------------------------------------------------------------
Update Information:
fix dependency on pyparsing
--------------------------------------------------------------------------------
ChangeLog:
* Fri Feb 26 2021 Felix Schwarz <fschwarz(a)fedoraproject.org> - 1.12.0-2
- lower pyparsing requirement to fix EPEL 8 (#1931256)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1931256 - python3-certbot-nginx requires python3.6dist(pyparsing) which is not provided in RHEL 8
https://bugzilla.redhat.com/show_bug.cgi?id=1931256
--------------------------------------------------------------------------------
================================================================================
xrootd-5.1.0-2.el8 (FEDORA-EPEL-2021-9fbd9db005)
Extended ROOT file server
--------------------------------------------------------------------------------
Update Information:
XRootD 5.1.0-
--------------------------------------------------------------------------------
ChangeLog:
* Fri Feb 26 2021 Mattias Ellert <mattias.ellert(a)physics.uu.se> - 1:5.1.0-2
- Remove debug output
* Tue Feb 23 2021 Mattias Ellert <mattias.ellert(a)physics.uu.se> - 1:5.1.0-1
- Update to version 5.1.0
- Add scitokens plugin package
- Packages xrootd-ceph and xrdcl-http are now built as part of xrootd
replacing the packages built from separate source rpms
- Drop patches (accepted upstream or previously backported)
- Fix broken library dependency in XrdCeph cmake file
- Fix format error on 32 bit architectures
* Sat Feb 13 2021 Mattias Ellert <mattias.ellert(a)physics.uu.se> - 1:5.0.3-5
- Drop workaround for false positive warning from gcc 11
* Tue Jan 26 2021 Mattias Ellert <mattias.ellert(a)physics.uu.se> - 1:5.0.3-4
- Workaround false positive warning from gcc 11 (Fedora 34+)
* Tue Dec 8 2020 Mattias Ellert <mattias.ellert(a)physics.uu.se> - 1:5.0.3-3
- Fix array length calculation (gcc 11 error)
- Fix uninitialized variable error
--------------------------------------------------------------------------------
2 years, 3 months