Compare commits

...

No commits in common. "c8" and "imports/c9/libexif-0.6.22-6.el9" have entirely different histories.

2 changed files with 49 additions and 154 deletions

View File

@ -1,117 +0,0 @@
#!/usr/bin/perl
#
# This is a hacked version of gettext.pm from Debian's strip-nondeterminism project.
# It is a workaround for https://savannah.gnu.org/bugs/?49654
#
# Copyright 2016 Reiner Herrmann <reiner@reiner-h.de>
# Copyright 2016 Chris Lamb <lamby@debian.org>
#
# This file is part of strip-nondeterminism.
#
# strip-nondeterminism is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# strip-nondeterminism is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with strip-nondeterminism. If not, see <http://www.gnu.org/licenses/>.
#
use Time::Piece;
use POSIX qw(strftime);
use strict;
use warnings;
=head1 DEPRECATION PLAN
Situation unclear. Whilst #792687 is closed, many Gettext related files are
being normalised based on anecdotal viewings of build logs.
=cut
sub read_file($) {
my $filename = shift;
local $/ = undef;
open(my $fh, '<', $filename)
or die "Can't open file $filename for reading: $!";
binmode($fh);
my $buf = <$fh>;
close($fh);
return $buf;
}
sub normalize {
my ($mo_filename, %options) = @_;
my $fmt;
my $buf = read_file($mo_filename);
my $magic = unpack("V", substr($buf, 0*4, 4));
if ($magic == 0x950412DE) {
# little endian
$fmt = "V";
} elsif ($magic == 0xDE120495) {
# big endian
$fmt = "N";
} else {
# unknown format
return 0;
}
my ($revision, $nstrings, $orig_to, $trans_to)
= unpack($fmt x 4, substr($buf, 1*4, 4*4));
my $major = int($revision / 256);
my $minor = int($revision % 256);
return 0 if $major > 1;
my $modified = 0;
for (my $i=0; $i < $nstrings; $i++) {
my $len = unpack($fmt, substr($buf, $orig_to + $i*8, 4));
next if $len > 0;
my $offset = unpack($fmt, substr($buf, $orig_to + $i*8 + 4, 4));
my $trans_len = unpack($fmt, substr($buf, $trans_to + $i*8));
my $trans_offset = unpack($fmt, substr($buf, $trans_to + $i*8 + 4));
my $trans_msg = substr($buf, $trans_offset, $trans_len);
next unless $trans_msg =~ m/^POT-Creation-Date: (.*)/m;
my $pot_date = $1;
my $time;
eval {$time = Time::Piece->strptime($pot_date, "%Y-%m-%d %H:%M%z");};
next if $@;
my $new_time = strftime("%Y-%m-%d %H:%M+0000", gmtime(0));
$trans_msg
=~ s/\QPOT-Creation-Date: $pot_date\E/POT-Creation-Date: $new_time/;
print("Replaced POT-Creation-Date $pot_date with $new_time.\n");
next if length($trans_msg) != $trans_len;
$buf
= substr($buf, 0, $trans_offset)
. $trans_msg
. substr($buf, $trans_offset + $trans_len);
$modified = 1;
}
if ($modified) {
open(my $fh, '>', $mo_filename)
or die "Can't open file $mo_filename for writing: $!";
binmode($fh);
print $fh $buf;
close($fh);
}
return $modified;
}
print("Removing timestamp from " . $ARGV[0] . "...\n");
normalize($ARGV[0])

View File

@ -1,18 +1,14 @@
Summary: Library for extracting extra information from image files
Name: libexif
Version: 0.6.22
Release: 5%{?dist}
Group: System Environment/Libraries
Release: 6%{?dist}
License: LGPLv2+
URL: https://libexif.github.io/
%global tarball_version %(echo %{version} | sed -e 's|\\.|_|g')
Source0: https://github.com/libexif/libexif/archive/libexif-%{tarball_version}-release.tar.gz
Source1: strip-gettext-nondeterminism
# https://bugzilla.redhat.com/show_bug.cgi?id=1847753
# https://bugzilla.redhat.com/show_bug.cgi?id=1847761
# https://github.com/libexif/libexif/commit/ce03ad7ef4e8aeefce79192bf5b6f69fae396f0c
Patch0: CVE-2020-0181-CVE-2020-0198.patch
# https://github.com/libexif/libexif/commit/9266d14b5ca4e29b970fa03272318e5f99386e06
Patch1: CVE-2020-0452.patch
@ -22,9 +18,7 @@ BuildRequires: doxygen
BuildRequires: gettext-devel
BuildRequires: libtool
BuildRequires: pkgconfig
# For strip-gettext-nondeterminism
BuildRequires: perl(Time::Piece)
BuildRequires: make
%description
Most digital cameras produce EXIF files, which are JPEG files with
@ -33,38 +27,40 @@ allows you to parse an EXIF file and read the data from those tags.
%package devel
Summary: Files needed for libexif application development
Group: Development/Libraries
Requires: %{name}%{?_isa} = %{version}-%{release}
Requires: pkgconfig
%description devel
The libexif-devel package contains the libraries and header files
for writing programs that use libexif.
%package doc
Summary: The EXIF Library API documentation
Group: Development/Libraries
Requires: %{name}%{?_isa} = %{version}-%{release}
%description doc
API Documentation for programmers wishing to use libexif in their programs.
%prep
%autosetup -n libexif-libexif-%{tarball_version}-release -p1
%build
autoreconf -fiv
%configure --disable-static
make %{?_smp_mflags}
%configure \
--disable-static
%make_build
%install
make DESTDIR=%{buildroot} install
find %{buildroot} -name "*.la" -exec rm -v {} \;
%make_install
rm -fv %{buildroot}%{_libdir}/lib*.la
rm -rf %{buildroot}%{_datadir}/doc/libexif
cp -R doc/doxygen-output/libexif-api.html .
iconv -f latin1 -t utf-8 < COPYING > COPYING.utf8; cp COPYING.utf8 COPYING
iconv -f latin1 -t utf-8 < README > README.utf8; cp README.utf8 README
find %{buildroot} -type f -name '*.mo' -exec %{SOURCE1} {} \;
%find_lang libexif-12
%check
@ -73,38 +69,54 @@ make check
%ldconfig_scriptlets
%files -f libexif-12.lang
%doc COPYING README NEWS
%doc README NEWS
%license COPYING
%{_libdir}/libexif.so.12*
%files devel
%{_includedir}/libexif
%{_libdir}/*.so
%{_libdir}/libexif.so
%{_libdir}/pkgconfig/libexif.pc
%files doc
%doc libexif-api.html
%changelog
* Mon Dec 07 2020 Richard Hughes <rhughes@redhat.com> - 0.6.22-5
- Fix CVE-2020-0452
- Resolves: #1902593
* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 0.6.22-6
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
Related: rhbz#1991688
* Thu Jun 25 2020 Michael Catanzaro <mcatanzaro@redhat.com> - 0.6.22-4
- Add patch for CVE-2020-0181/CVE-2020-0198
- Resolves: #1847753
- Resolves: #1847761
* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 0.6.22-5
- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
* Thu Jun 04 2020 Michael Catanzaro <mcatanzaro@redhat.com> - 0.6.22-3
- Also remove timezone from the .mo files
- Related: #1841320
* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 0.6.22-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
* Wed Jun 03 2020 Michael Catanzaro <mcatanzaro@redhat.com> - 0.6.22-2
- Remove timestamps from the .mo files to avoid multilib conflicts
- Related: #1841320
* Mon Nov 09 2020 Michael Catanzaro <mcatanzaro@redhat.com> - 0.6.22-3
- Fix CVE-2020-0181, CVE-2020-0198, and CVE-2020-0452
* Mon Jun 01 2020 Michael Catanzaro <mcatanzaro@redhat.com> - 0.6.22-1
- Upgrade to 0.6.22
- Resolves: #1841320
* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.6.22-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
* Mon May 18 2020 Rex Dieter <rdieter@fedoraproject.org> - 0.6.22-1
- 0.6.22
- .spec cleanup
* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.6.21-21
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 0.6.21-20
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
* Tue Feb 12 2019 Yaakov Selkowitz <yselkowi@redhat.com> - 0.6.21-19
- Fix for CVE-2018-20030 (#1663879)
* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 0.6.21-18
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 0.6.21-17
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 0.6.21-16
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild