.cpio.metadata

@@ -1 +1 @@
-60358408c76db354f6716724c4bcbcb6e18ab642 SOURCES/cpio-2.12.tar.bz2
+4dcefc0e1bc36b11506a354768d82b15e3fe6bb8 SOURCES/cpio-2.13.tar.bz2

.gitignore

@@ -1 +1 @@
-SOURCES/cpio-2.12.tar.bz2
+SOURCES/cpio-2.13.tar.bz2

SOURCES/cpio-2.11-retain-symlink-times.patch

@@ -1,6 +1,6 @@
-From 7a4094d382e74aaed0a0b8356dc24d64952852f9 Mon Sep 17 00:00:00 2001
+From 8bce60df53f93c9cbfb18274c6700c143a0092c6 Mon Sep 17 00:00:00 2001
 From: Pavel Raiskup <praiskup@redhat.com>
-Date: Fri, 3 Jul 2020 12:32:58 +0200
+Date: Fri, 3 Jul 2020 13:00:18 +0200
 Subject: [PATCH] Extract: retain times for symlinks
 
 Original report by Pat Riehecky at
@@ -17,14 +17,14 @@ symlinks.
 ---
  src/copyin.c   | 5 ++---
  src/copypass.c | 2 ++
- src/util.c     | 6 ++++--
- 3 files changed, 8 insertions(+), 5 deletions(-)
+ src/util.c     | 8 +++++---
+ 3 files changed, 9 insertions(+), 6 deletions(-)
 
 diff --git a/src/copyin.c b/src/copyin.c
-index 183b5b5..267ed4b 100644
+index bf3b0a8..93b006a 100644
 --- a/src/copyin.c
 +++ b/src/copyin.c
-@@ -639,9 +639,7 @@ copyin_device (struct cpio_file_stat* file_hdr)
+@@ -615,9 +615,7 @@ copyin_device (struct cpio_file_stat* file_hdr)
    /* chown may have turned off some permissions we wanted. */
    if (chmod (file_hdr->c_name, file_hdr->c_mode) < 0)
      chmod_error_details (file_hdr->c_name, file_hdr->c_mode);
@@ -35,7 +35,7 @@ index 183b5b5..267ed4b 100644
  }
  
  static void
-@@ -692,6 +690,7 @@ copyin_link (struct cpio_file_stat *file_hdr, int in_file_des)
+@@ -668,6 +666,7 @@ copyin_link (struct cpio_file_stat *file_hdr, int in_file_des)
    	  && errno != EPERM)
  	chown_error_details (file_hdr->c_name, uid, gid);
      }
@@ -44,10 +44,10 @@ index 183b5b5..267ed4b 100644
  }
  
 diff --git a/src/copypass.c b/src/copypass.c
-index c5a9899..b4e7169 100644
+index dc13b5b..a5f9b7b 100644
 --- a/src/copypass.c
 +++ b/src/copypass.c
-@@ -317,6 +317,8 @@ process_copy_pass ()
+@@ -306,6 +306,8 @@ process_copy_pass ()
  		  && errno != EPERM)
  	        chown_error_details (output_name.ds_string, uid, gid);
              }
@@ -57,18 +57,20 @@ index c5a9899..b4e7169 100644
  	}
  #endif
 diff --git a/src/util.c b/src/util.c
-index 6ff6032..11f9c30 100644
+index 4421b20..0e8d88c 100644
 --- a/src/util.c
 +++ b/src/util.c
-@@ -1389,7 +1389,6 @@ set_perms (int fd, struct cpio_file_stat *header)
-        we have to refer to it using name+ instead of name.  */
-     file_hdr->c_name [cdf_char] = '+';
- #endif
+@@ -1230,8 +1230,7 @@ set_perms (int fd, struct cpio_file_stat *header)
+   /* chown may have turned off some permissions we wanted. */
+   if (fchmod_or_chmod (fd, header->c_name, header->c_mode) < 0)
+     chmod_error_details (header->c_name, header->c_mode);
 -  if (retain_time_flag)
-     set_file_times (fd, header->c_name, header->c_mtime, header->c_mtime);
+-    set_file_times (fd, header->c_name, header->c_mtime, header->c_mtime);
++  set_file_times (fd, header->c_name, header->c_mtime, header->c_mtime);
  }
  
-@@ -1398,6 +1397,8 @@ set_file_times (int fd,
+ void
+@@ -1239,6 +1238,8 @@ set_file_times (int fd,
  		const char *name, unsigned long atime, unsigned long mtime)
  {
    struct timespec ts[2];
@@ -77,7 +79,7 @@ index 6ff6032..11f9c30 100644
    
    memset (&ts, 0, sizeof ts);
  
-@@ -1406,7 +1407,8 @@ set_file_times (int fd,
+@@ -1247,7 +1248,8 @@ set_file_times (int fd,
  
    /* Silently ignore EROFS because reading the file won't have upset its 
       timestamp if it's on a read-only filesystem. */

SOURCES/cpio-2.12-improper-input-validation.patch

@@ -1,154 +0,0 @@
-From: Thomas Habets <habets@google.com>
-Subject: [PATCH] Check for size overflow in tar header fields.
-
-This prevents surprising outputs being created, e.g. this cpio tar
-output with more than one file:
-
-tar cf suffix.tar AUTHORS
-dd if=/dev/zero seek=16G bs=1 count=0 of=suffix.tar
-echo suffix.tar | cpio -H tar -o | tar tvf -
-
--rw-r--r-- 1000/1000       0 2019-08-30 16:40 suffix.tar
--rw-r--r-- thomas/thomas 161 2019-08-30 16:40 AUTHORS
----
- src/copyout.c |  3 +--
- src/extern.h  |  2 +-
- src/tar.c     | 45 ++++++++++++++++++++++++++++++++-------------
- 3 files changed, 34 insertions(+), 16 deletions(-)
-
-diff --git a/src/copyout.c b/src/copyout.c
-index dcae449..56416ba 100644
---- a/src/copyout.c
-+++ b/src/copyout.c
-@@ -552,8 +552,7 @@ write_out_header (struct cpio_file_stat *file_hdr, int out_des)
- 	  error (0, 0, _("%s: file name too long"), file_hdr->c_name);
- 	  return 1;
- 	}
--      write_out_tar_header (file_hdr, out_des); /* FIXME: No error checking */
--      return 0;
-+      return write_out_tar_header (file_hdr, out_des);
- 
-     case arf_binary:
-       return write_out_binary_header (makedev (file_hdr->c_rdev_maj,
-diff --git a/src/extern.h b/src/extern.h
-index e27d662..47b477a 100644
---- a/src/extern.h
-+++ b/src/extern.h
-@@ -145,7 +145,7 @@ int make_path (char *argpath, uid_t owner, gid_t group,
- 	       const char *verbose_fmt_string);
- 
- /* tar.c */
--void write_out_tar_header (struct cpio_file_stat *file_hdr, int out_des);
-+int write_out_tar_header (struct cpio_file_stat *file_hdr, int out_des);
- int null_block (long *block, int size);
- void read_in_tar_header (struct cpio_file_stat *file_hdr, int in_des);
- int otoa (char *s, unsigned long *n);
-diff --git a/src/tar.c b/src/tar.c
-index e2b5f45..53dc99a 100644
---- a/src/tar.c
-+++ b/src/tar.c
-@@ -93,8 +93,9 @@ stash_tar_filename (char *prefix, char *filename)
-    sprintf (where, "%*lo ", digits - 2, value);
-    except that sprintf fills in the trailing NUL and we don't.  */
- 
--static void
--to_oct (register long value, register int digits, register char *where)
-+static int
-+to_oct_or_error (register long value, register int digits, register char *where,
-+                 const char *filename, const char *fieldname)
- {
-   --digits;			/* Leave the trailing NUL slot alone.  */
- 
-@@ -105,10 +106,17 @@ to_oct (register long value, register int digits, register char *where)
-       value >>= 3;
-     }
-   while (digits > 0 && value != 0);
-+  if (value > 0)
-+    {
-+      error (1, 0, _("%s: field width not sufficient for storing %s"),
-+             filename, fieldname);
-+      return 1;
-+    }
- 
-   /* Add leading zeroes, if necessary.  */
-   while (digits > 0)
-     where[--digits] = '0';
-+  return 0;
- }
- 
- 
-@@ -139,7 +147,7 @@ tar_checksum (struct tar_header *tar_hdr)
- /* Write out header FILE_HDR, including the file name, to file
-    descriptor OUT_DES.  */
- 
--void
-+int
- write_out_tar_header (struct cpio_file_stat *file_hdr, int out_des)
- {
-   int name_len;
-@@ -168,11 +176,16 @@ write_out_tar_header (struct cpio_file_stat *file_hdr, int out_des)
- 
-   /* Ustar standard (POSIX.1-1988) requires the mode to contain only 3 octal
-      digits */
--  to_oct (file_hdr->c_mode & MODE_ALL, 8, tar_hdr->mode);
--  to_oct (file_hdr->c_uid, 8, tar_hdr->uid);
--  to_oct (file_hdr->c_gid, 8, tar_hdr->gid);
--  to_oct (file_hdr->c_filesize, 12, tar_hdr->size);
--  to_oct (file_hdr->c_mtime, 12, tar_hdr->mtime);
-+  if (to_oct_or_error (file_hdr->c_mode & MODE_ALL, 8, tar_hdr->mode, file_hdr->c_name, _("mode")))
-+    return 1;
-+  if (to_oct_or_error (file_hdr->c_uid, 8, tar_hdr->uid, file_hdr->c_name, _("uid")))
-+    return 1;
-+  if (to_oct_or_error (file_hdr->c_gid, 8, tar_hdr->gid, file_hdr->c_name, _("gid")))
-+    return 1;
-+  if (to_oct_or_error (file_hdr->c_filesize, 12, tar_hdr->size, file_hdr->c_name, _("file size")))
-+    return 1;
-+  if (to_oct_or_error (file_hdr->c_mtime, 12, tar_hdr->mtime, file_hdr->c_name, _("modification time")))
-+    return 1;
- 
-   switch (file_hdr->c_mode & CP_IFMT)
-     {
-@@ -184,7 +197,8 @@ write_out_tar_header (struct cpio_file_stat *file_hdr, int out_des)
- 	  strncpy (tar_hdr->linkname, file_hdr->c_tar_linkname,
- 		   TARLINKNAMESIZE);
- 	  tar_hdr->typeflag = LNKTYPE;
--	  to_oct (0, 12, tar_hdr->size);
-+	  if (to_oct_or_error (0, 12, tar_hdr->size, file_hdr->c_name, _("file size")))
-+            return 1;
- 	}
-       else
- 	tar_hdr->typeflag = REGTYPE;
-@@ -210,7 +224,8 @@ write_out_tar_header (struct cpio_file_stat *file_hdr, int out_des)
- 	 than TARLINKNAMESIZE.  */
-       strncpy (tar_hdr->linkname, file_hdr->c_tar_linkname,
- 	       TARLINKNAMESIZE);
--      to_oct (0, 12, tar_hdr->size);
-+      if (to_oct_or_error (0, 12, tar_hdr->size, file_hdr->c_name, _("file size")))
-+        return 1;
-       break;
- #endif /* CP_IFLNK */
-     }
-@@ -229,13 +244,17 @@ write_out_tar_header (struct cpio_file_stat *file_hdr, int out_des)
-       if (name)
- 	strcpy (tar_hdr->gname, name);
- 
--      to_oct (file_hdr->c_rdev_maj, 8, tar_hdr->devmajor);
--      to_oct (file_hdr->c_rdev_min, 8, tar_hdr->devminor);
-+      if (to_oct_or_error (file_hdr->c_rdev_maj, 8, tar_hdr->devmajor, file_hdr->c_name, _("rdev major")))
-+        return 1;
-+      if (to_oct_or_error (file_hdr->c_rdev_min, 8, tar_hdr->devminor, file_hdr->c_name, _("rdev minor")))
-+        return 1;
-     }
- 
--  to_oct (tar_checksum (tar_hdr), 8, tar_hdr->chksum);
-+  if (to_oct_or_error (tar_checksum (tar_hdr), 8, tar_hdr->chksum, file_hdr->c_name, _("checksum")))
-+    return 1;
- 
-   tape_buffered_write ((char *) &tar_rec, out_des, TARRECORDSIZE);
-+  return 0;
- }
- 
- /* Return nonzero iff all the bytes in BLOCK are NUL.
--- 
-2.26.0
-

SOURCES/cpio-2.13-dev_number.patch

@@ -3,10 +3,10 @@ Date: Mon, 14 Sep 2015 09:37:15 +0200
 Subject: [PATCH 3/7] Support major/minor device numbers over 127 (bz#450109)
 
 diff --git a/src/copyin.c b/src/copyin.c
-index cde911e..12bd27c 100644
+index b29f348..1142d6a 100644
 --- a/src/copyin.c
 +++ b/src/copyin.c
-@@ -1196,15 +1196,15 @@ read_in_binary (struct cpio_file_stat *file_hdr,
+@@ -1123,15 +1123,15 @@ read_in_binary (struct cpio_file_stat *file_hdr,
        swab_array ((char *) short_hdr, 13);
      }
  
@@ -25,4 +25,4 @@ index cde911e..12bd27c 100644
 +  file_hdr->c_rdev_min = minor ((unsigned short)short_hdr->c_rdev);
    file_hdr->c_mtime = (unsigned long) short_hdr->c_mtimes[0] << 16
                        | short_hdr->c_mtimes[1];
- 
+   file_hdr->c_filesize = (unsigned long) short_hdr->c_filesizes[0] << 16

SOURCES/cpio-2.13-exitCode.patch

@@ -0,0 +1,39 @@
+Subject: [PATCH 2/7] set exit code to 1 when cpio fails to store file > 4GB
+ (#183224)
+
+diff --git a/src/copyout.c b/src/copyout.c
+index 8b0beb6..4b7336b 100644
+--- a/src/copyout.c
++++ b/src/copyout.c
+@@ -290,7 +290,7 @@ field_width_error (const char *filename, const char *fieldname,
+ {
+   char valbuf[UINTMAX_STRSIZE_BOUND + 1];
+   char maxbuf[UINTMAX_STRSIZE_BOUND + 1];
+-  error (0, 0, _("%s: value %s %s out of allowed range 0..%s"),
++  error (1, 0, _("%s: value %s %s out of allowed range 0..%s"),
+ 	 filename, fieldname,
+ 	 STRINGIFY_BIGINT (value, valbuf),
+ 	 STRINGIFY_BIGINT (MAX_VAL_WITH_DIGITS (width - nul, LG_8),
+diff --git a/tests/CVE-2019-14866.at b/tests/CVE-2019-14866.at
+index e877b39..50ad60b 100644
+--- a/tests/CVE-2019-14866.at
++++ b/tests/CVE-2019-14866.at
+@@ -30,6 +30,5 @@ fi
+ [0],
+ [],
+ [cpio: file: value size 17179869184 out of allowed range 0..8589934591
+-2 blocks
+ ])
+ AT_CLEANUP
+diff --git a/tests/testsuite b/tests/testsuite
+index b45c731..fd8454d 100755
+--- a/tests/testsuite
++++ b/tests/testsuite
+@@ -2885,7 +2885,6 @@ fi
+ at_status=$? at_failed=false
+ $at_check_filter
+ echo >>"$at_stderr"; $as_echo "cpio: file: value size 17179869184 out of allowed range 0..8589934591
+-2 blocks
+ " | \
+   $at_diff - "$at_stderr" || at_failed=:
+ at_fn_diff_devnull "$at_stdout" || at_failed=:

SOURCES/cpio-2.13-mutiple-definition.patch

@@ -0,0 +1,13 @@
+diff -up cpio-2.13/src/global.c.me cpio-2.13/src/global.c
+--- cpio-2.13/src/global.c.me	2020-01-30 17:17:42.015259283 +0100
++++ cpio-2.13/src/global.c	2020-01-30 17:24:12.680794025 +0100
+@@ -184,9 +184,6 @@ unsigned int warn_option = 0;
+ /* Extract to standard output? */
+ bool to_stdout_option = false;
+ 
+-/* The name this program was run with.  */
+-char *program_name;
+-
+ /* A pointer to either lstat or stat, depending on whether
+    dereferencing of symlinks is done for input files.  */
+ int (*xstat) ();

SOURCES/cpio-2.13-reset-gid-uid.patch

@@ -0,0 +1,63 @@
+From 5913893d6f3de65b16e1ad294b88893305efb20f Mon Sep 17 00:00:00 2001
+From: Ondrej Dubaj <odubaj@redhat.com>
+Date: Thu, 18 Feb 2021 09:59:31 +0100
+Subject: [PATCH] * lib/system.h (ERRNO_IS_EACCES): Remove.  Not used anymore.
+ (sys_reset_uid_gid): Re-initialize supplementary groups when switching
+ privileges. Fix ordering of setgid and setuid calls.
+
+---
+ lib/system.h | 32 +++++++++++++++++++++++++-------
+ 1 file changed, 25 insertions(+), 7 deletions(-)
+
+diff --git a/lib/system.h b/lib/system.h
+index 1c1a5d0..4fd3ce9 100644
+--- a/lib/system.h
++++ b/lib/system.h
+@@ -470,19 +470,37 @@ char *getenv ();
+ #if MSDOS
+ # include <process.h>
+ # define SET_BINARY_MODE(arc) setmode(arc, O_BINARY)
+-# define ERRNO_IS_EACCES errno == EACCES
+ # define mkdir(file, mode) (mkdir) (file)
+ # define TTY_NAME "con"
+ # define sys_reset_uid_gid()
+ #else
+ # define SET_BINARY_MODE(arc)
+-# define ERRNO_IS_EACCES 0
+ # define TTY_NAME "/dev/tty"
+-# define sys_reset_uid_gid()					\
+-  do {								\
+-    if (! (setuid (getuid ()) == 0 && setgid (getgid ()) == 0)) \
+-      abort ();							\
+-  } while (0)
++# include <paxlib.h>
++static inline void
++sys_reset_uid_gid (void)
++{
++  struct passwd *pw;
++  uid_t uid = getuid ();
++  gid_t gid = getgid ();
++  
++  if ((pw = getpwuid (uid)) == NULL)
++    {
++      FATAL_ERROR ((0, errno, "%s(%lu)", "getpwuid", (unsigned long)uid));
++    }
++  if (initgroups (pw->pw_name, getgid ()))
++    {
++      FATAL_ERROR ((0, errno, "%s", "initgroups"));
++    }
++  if (gid != getegid () && setgid (gid) && errno != EPERM)
++    {
++      FATAL_ERROR ((0, errno, "%s", "setgid"));
++    }
++  if (uid != geteuid () && setuid (uid) && errno != EPERM)
++    {
++      FATAL_ERROR ((0, errno, "%s", "setuid"));
++    }
++}
+ #endif
+ 
+ #if XENIX
+-- 
+2.26.0
+

SOURCES/cpio-2.13-revert-CVE-2015-1197-fix.patch

@@ -0,0 +1,91 @@
+revert fix for CVE-2015-1197 as it causes shutdown issues
+
+revert suggested as a workaround by upstream:
+https://lists.gnu.org/archive/html/bug-cpio/2019-11/msg00016.html
+
+--- b/src/copyin.c
++++ a/src/copyin.c
+@@ -645,14 +645,13 @@
+       link_name = xstrdup (file_hdr->c_tar_linkname);
+     }
+ 
+-  cpio_safer_name_suffix (link_name, true, !no_abs_paths_flag, false);
+-  
+   res = UMASKED_SYMLINK (link_name, file_hdr->c_name,
+ 			 file_hdr->c_mode);
+   if (res < 0 && create_dir_flag)
+     {
+       create_all_directories (file_hdr->c_name);
++      res = UMASKED_SYMLINK (link_name, file_hdr->c_name,
++			     file_hdr->c_mode);
+-      res = UMASKED_SYMLINK (link_name, file_hdr->c_name, file_hdr->c_mode);
+     }
+   if (res < 0)
+     {
+--- b/tests/CVE-2015-1197.at
++++ /dev/null
+@@ -1,43 +0,0 @@
+-# Process this file with autom4te to create testsuite.  -*- Autotest -*-
+-# Copyright (C) 2009-2019 Free Software Foundation, Inc.
+-#
+-# This program is free software; you can redistribute it and/or modify
+-# it under the terms of the GNU General Public License as published by
+-# the Free Software Foundation; either version 3, or (at your option)
+-# any later version.
+-#
+-# This program is distributed in the hope that it will be useful,
+-# but WITHOUT ANY WARRANTY; without even the implied warranty of
+-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+-# GNU General Public License for more details.
+-#
+-# You should have received a copy of the GNU General Public License
+-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-
+-AT_SETUP([CVE-2015-1197 (--no-absolute-filenames for symlinks)])
+-AT_CHECK([
+-tempdir=$(pwd)/tmp
+-mkdir $tempdir
+-touch $tempdir/file
+-ln -s $tempdir dir
+-AT_DATA([filelist],
+-[dir
+-dir/file
+-])
+-ln -s /tmp dir
+-touch /tmp/file
+-cpio -o < filelist > test.cpio
+-rm dir /tmp/file
+-cpio --no-absolute-filenames -iv < test.cpio
+-],
+-[2],
+-[],
+-[1 block
+-cpio: Removing leading `/' from hard link targets
+-dir
+-cpio: dir/file: Cannot open: No such file or directory
+-dir/file
+-1 block
+-])
+-AT_CLEANUP
+-
+--- b/tests/Makefile.am
++++ a/tests/Makefile.am
+@@ -56,9 +56,8 @@
+  symlink-long.at\
+  symlink-to-stdout.at\
+  version.at\
+  big-block-size.at\
+- CVE-2015-1197.at\
+  CVE-2019-14866.at
+ 
+ TESTSUITE = $(srcdir)/testsuite
+
+--- b/tests/testsuite.at
++++ a/tests/testsuite.at
+@@ -43,6 +43,5 @@
+ m4_include([setstat04.at])
+ m4_include([setstat05.at])
+ m4_include([big-block-size.at])
+
+-m4_include([CVE-2015-1197.at])
+ m4_include([CVE-2019-14866.at])

SOURCES/cpio-2.9-exitCode.patch

@@ -1,18 +0,0 @@
-From: Peter Vrabec <pvrabec@redhat.com>
-Date: Mon, 14 Sep 2015 09:31:08 +0200
-Subject: [PATCH 2/7] set exit code to 1 when cpio fails to store file > 4GB
- (#183224)
-
-diff --git a/src/copyout.c b/src/copyout.c
-index 1f0987a..dcae449 100644
---- a/src/copyout.c
-+++ b/src/copyout.c
-@@ -287,7 +287,7 @@ to_ascii (char *where, uintmax_t v, size_t digits, unsigned logbase)
- static void
- field_width_error (const char *filename, const char *fieldname)
- {
--  error (0, 0, _("%s: field width not sufficient for storing %s"),
-+  error (1, 0, _("%s: field width not sufficient for storing %s"),
- 	 filename, fieldname);
- }
- 

SPECS/cpio.spec

@@ -1,10 +1,10 @@
 Summary: A GNU archiving program
 Name: cpio
-Version: 2.12
-Release: 11%{?dist}
+Version: 2.13
+Release: 16%{?dist}
 License: GPLv3+
-URL: http://www.gnu.org/software/cpio/
-Source: ftp://ftp.gnu.org/gnu/cpio/cpio-%{version}.tar.bz2
+URL: https://www.gnu.org/software/cpio/
+Source: https://ftp.gnu.org/gnu/cpio/cpio-%{version}.tar.bz2
 
 # help2man generated manual page distributed only in RHEL/Fedora
 Source1: cpio.1
@@ -15,11 +15,11 @@ Patch1: cpio-2.9-rh.patch
 # fix warn_if_file_changed() and set exit code to 1 when cpio fails to store
 # file > 4GB (#183224)
 # http://lists.gnu.org/archive/html/bug-cpio/2006-11/msg00000.html
-Patch2: cpio-2.9-exitCode.patch
+Patch2: cpio-2.13-exitCode.patch
 
 # Support major/minor device numbers over 127 (bz#450109)
 # http://lists.gnu.org/archive/html/bug-cpio/2008-07/msg00000.html
-Patch3: cpio-2.9-dev_number.patch
+Patch3: cpio-2.13-dev_number.patch
 
 # Define default remote shell as /usr/bin/ssh (#452904)
 Patch4: cpio-2.9.90-defaultremoteshell.patch
@@ -36,18 +36,24 @@ Patch7: cpio-2.10-longnames-split.patch
 # Cpio does Sum32 checksum, not CRC (downstream)
 Patch8: cpio-2.11-crc-fips-nit.patch
 
-# Extract: retain times for symlinks
-# downstream patch (#1487673)
-# https://www.mail-archive.com/bug-cpio@gnu.org/msg00605.html
-Patch9: cpio-2.11-retain-symlink-times.patch
+# Fix multiple definition of `program_name'
+Patch9: cpio-2.13-mutiple-definition.patch
 
-# Fixed improper input validation when writing tar header fields
-# upstream patch (#1766223)
-# https://cement.retrofitta.se/tmp/cpio-tar.patch
-Patch10: cpio-2.12-improper-input-validation.patch
+# Revert fix for CVE-2015-1197 (#1797163)
+# reverts upstream commit 45b0ee2b4
+Patch10: cpio-2.13-revert-CVE-2015-1197-fix.patch
+
+# Extract: retain times for symlinks
+# downstream patch (#1486364)
+# https://www.mail-archive.com/bug-cpio@gnu.org/msg00605.html
+Patch11: cpio-2.11-retain-symlink-times.patch
+
+# Properly drop priviledges for remote command
+# http://git.savannah.gnu.org/cgit/paxutils.git/commit/?id=d247e3c2809a37b6d0c3067251d96bb7f12555e7
+Patch12: cpio-2.13-reset-gid-uid.patch
 
 # Fixed integer overflow in ds_fgetstr()
-# upstream patch (#1992511)
+# upstream patch (#1992512)
 # https://git.savannah.gnu.org/cgit/cpio.git/commit/?id=dd96882877721703e19272fe25034560b794061b
 # https://git.savannah.gnu.org/cgit/cpio.git/commit/?id=dfc801c44a93bed7b3951905b188823d6a0432c8
 # https://git.savannah.gnu.org/cgit/cpio.git/commit/?id=236684f6deb3178043fe72a8e2faca538fa2aae1
@@ -56,13 +62,14 @@ Patch10: cpio-2.12-improper-input-validation.patch
 # https://git.savannah.gnu.org/cgit/cpio.git/commit/?id=7dd8ba91d8b6a2640e6c01c3e3a4234828646f23
 # https://git.savannah.gnu.org/cgit/cpio.git/commit/?id=684b7ac5767e676cda78c161aeb7fe7b45a07529
 # https://git.savannah.gnu.org/cgit/cpio.git/commit/?id=b1c85839bf1381f749dd45bf6a5a38924e3315a0
-Patch11: cpio-2.13-CVE-2021-38185.patch
-
+Patch13: cpio-2.13-CVE-2021-38185.patch
 
 Provides: bundled(gnulib)
+Provides: bundled(paxutils)
 Provides: /bin/cpio
 BuildRequires: gcc
 BuildRequires: texinfo, autoconf, automake, gettext, gettext-devel, rmt
+BuildRequires: make
 
 %description
 GNU cpio copies files into or out of a cpio or tar archive.  Archives
@@ -87,12 +94,12 @@ Install cpio if you need a program to manage file archives.
 autoreconf -fi
 export CFLAGS="$RPM_OPT_FLAGS -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE64_SOURCE -pedantic -fno-strict-aliasing -Wall $CFLAGS"
 %configure --with-rmt="%{_sysconfdir}/rmt"
-make %{?_smp_mflags}
+%make_build
 (cd po && make update-gmo)
 
 
 %install
-make DESTDIR=$RPM_BUILD_ROOT INSTALL="install -p" install
+%make_install
 
 rm -f $RPM_BUILD_ROOT%{_libexecdir}/rmt
 rm -f $RPM_BUILD_ROOT%{_infodir}/dir
@@ -112,24 +119,77 @@ make check || {
 
 %files -f %{name}.lang
 %doc AUTHORS ChangeLog NEWS README THANKS TODO
-%{!?_licensedir:%global license %%doc}
 %license COPYING
 %{_bindir}/*
 %{_mandir}/man*/*
 %{_infodir}/*.info*
 
 %changelog
-* Mon Sep 20 2021 Ondrej Dubaj <odubaj@redhat.com> - 2.12-11
-- Fixed CVE-2021-38185 (#1992511)
+* Thu Aug 26 2021 Ondrej Dubaj <odubaj@redhat.com> - 2.13-16
+- Fixed CVE-2021-38185 (#1992512)
 
-* Thu Jan 21 2021 Ondrej Dubaj <odubaj@redhat.com> - 2.12-10
-- Fixed improper input validation when writing tar header fields (#1766223)
+* Thu Aug 19 2021 Ondrej Dubaj <odubaj@redhat.com> - 2.13-15
+- Revert patch for CVE-2021-38185 (#1992512)
 
-* Mon Jun 15 2020 Ondrej Dubaj <odubaj@redhat.com> - 2.12-9
-- Extract: retain times for symlinks (#1487673)
+* Mon Aug 16 2021 Ondrej Dubaj <odubaj@redhat.com> - 2.13-14
+- Minor fix for CVE-2021-38185 (#1992512)
 
-* Tue Jul 17 2018 Pavel Raiskup <praiskup@redhat.com> - 2.12-8
-- cleanup, sync with rawhide
+* Mon Aug 16 2021 Ondrej Dubaj <odubaj@redhat.com> - 2.13-13
+- Fixed CVE-2021-38185 (#1992512)
+
+* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 2.13-12
+- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
+  Related: rhbz#1991688
+
+* Thu Apr 15 2021 Mohan Boddu <mboddu@redhat.com> - 2.13-11
+- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
+
+* Thu Feb 18 2021 Ondrej Dubaj <odubaj@redhat.com> - 2.13-10
+- Properly drop priviledges for remote command
+
+* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.13-9
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Mon Jul 27 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.13-8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Mon Jul 13 2020 Tom Stellard <tstellar@redhat.com> - 2.13-7
+- Use make macros
+- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
+
+* Mon Jun 15 2020 Ondrej Dubaj <odubaj@redhat.com> - 2.13-6
+- Extract: retain times for symlinks (#1486364)
+
+* Tue Apr 07 2020 Ondrej Dubaj <odubaj@redhat.com> - 2.13-5.1
+- Release bump due to testing of gating
+
+* Wed Feb 05 2020 Petr Kubat <pkubat@redhat.com> - 2.13-4
+- Revert fix for CVE-2015-1197 as it causes shutdown issues (#1797163)
+
+* Thu Jan 30 2020 Than Ngo <than@redhat.com> - 2.13-3
+- Fix multiple definition of program_name
+
+* Tue Jan 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.13-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
+* Wed Nov 06 2019 Pavel Raiskup <praiskup@redhat.com> - 2.13-1
+- new upstream release, per release notes
+  https://lists.gnu.org/archive/html/bug-cpio/2019-11/msg00000.html
+
+* Wed Jul 24 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.12-12
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
+* Tue Feb 19 2019 Pavel Raiskup <praiskup@redhat.com> - 2.12-11
+- admit that we bundle paxutils project
+
+* Thu Jan 31 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.12-10
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Thu Jul 12 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.12-9
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+
+* Wed Apr 11 2018 Pavel Raiskup <praiskup@redhat.com> - 2.12-8
+- spring spec cleanup
 
 * Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.12-7
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild