.ghc-cmark-gfm.metadata

@@ -1 +0,0 @@
-da89257e776c474b5e4d06cfd89473cd7e9c2fd1 SOURCES/cmark-gfm-0.1.3.tar.gz

.gitignore

@@ -1 +1,3 @@
-SOURCES/cmark-gfm-0.1.3.tar.gz
+/cmark-gfm-0.1.3.tar.gz
+/cmark-gfm-0.2.2.tar.gz
+/cmark-gfm-0.2.3.tar.gz

gating.yaml

@@ -0,0 +1,6 @@
+--- !Policy
+product_versions:
+  - rhel-8
+decision_context: osci_compose_gate
+rules:
+  - !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}

ghc-cmark-gfm.spec

@@ -4,17 +4,11 @@
 %global pkg_name cmark-gfm
 %global pkgver %{pkg_name}-%{version}
 
-# https://github.com/kivikakk/cmark-gfm-hs/issues/6
-%ifarch ppc64 s390x
-%bcond_with tests
-%else
-# enabling the testsuite changed the hashes
-%bcond_with tests
-%endif
+%bcond_without tests
 
 Name:           ghc-%{pkg_name}
-Version:        0.1.3
-Release:        4%{?dist}
+Version:        0.2.3
+Release:        1%{?dist}
 Summary:        Fast, accurate GitHub Flavored Markdown parser and renderer
 
 License:        BSD
@@ -30,11 +24,13 @@ BuildRequires:  ghc-text-devel
 BuildRequires:  ghc-HUnit-devel
 %endif
 # End cabal-rpm deps
+Provides:       bundled(cmark-gfm) = 0.29.0.gfm.3
 
 %description
-This package provides Haskell bindings for <https://github.com/github/cmark
+This package provides Haskell bindings for <https://github.com/github/cmark-gfm
 libcmark-gfm>, the reference parser for <https://github.github.com/gfm/ GitHub
-Flavored Markdown>, a fully specified variant of Markdown.
+Flavored Markdown>, a fully specified variant of Markdown. It includes sources
+for libcmark-gfm (0.29.0.gfm.3).
 
 
 %package devel
@@ -85,6 +81,20 @@ This package provides the Haskell %{pkg_name} library development files.
 
 
 %changelog
+* Thu Apr 14 2022 Jens Petersen <petersen@redhat.com> - 0.2.3-1
+- 0.2.3 bundles the C cmark-gfm-0.29.0.gfm.3 library which fixes CVE-2022-24724
+  https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x
+- Resolves: #2060668
+
+* Mon Jan 11 2021 Jens Petersen <petersen@redhat.com> - 0.2.2-2
+- rebuild
+
+* Mon Dec 14 2020 Jens Petersen <petersen@redhat.com> - 0.2.2-1
+- https://github.com/kivikakk/cmark-gfm-hs/releases/tag/0.2.2
+- updates cbits to cmark-gfm-0.29.0.gfm.1 for CVE-2020-5238 (#1854329)
+  https://github.com/github/cmark-gfm/security/advisories/GHSA-7gc6-9qr5-hc85
+- fixes rhbz#1855805
+
 * Fri Jun  1 2018 Jens Petersen <petersen@redhat.com> - 0.1.3-4
 - disable testsuite to restore the package hash
 

sources

@@ -0,0 +1 @@
+SHA512 (cmark-gfm-0.2.3.tar.gz) = 0f4e25b755437d9b3b017e6cb88d45b78363e5dce1fbfb13f93ee03559635e325cfdc567082c1bff555be3f5c84accc822d029806a2e7d37fbef57d23f3b59e9

tests/tests.yml

@@ -0,0 +1,18 @@
+---
+- hosts: localhost
+  tags:
+  - classic
+  roles:
+  - role: standard-test-basic
+    vars:
+    - pkg: "ghc-cmark-gfm"
+    - develpkg: "{{pkg}}-devel"
+    - pkgname: "{{pkg|regex_replace('^ghc-(.*)$', '\\1')}}"
+    required_packages:
+    - "{{develpkg}}"
+    tests:
+    - ghc:
+        run: echo 'main = return ()' > test.hs; ghc -package {{pkgname}} test.hs; ./test
+    - revdeps:
+        run: revdeps=$(dnf -q repoquery --qf "%{name}" --whatrequires={{develpkg}}); if [ -z "${revdeps}" ]; then echo "No valid dependents"; exit 1; else dnf -y install ${revdeps}; fi
+...