From a4c861bd25289c16445ce05e38567439ada3c14d Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Tue, 30 Mar 2021 08:43:54 -0400 Subject: [PATCH] import librepo-1.12.0-3.el8 --- ...h-read-from-repomd.xml-RhBug-1866498.patch | 47 +++++++++++++++++++ ...pkcs11-certificate-and-key-for-repos.patch | 40 ++++++++++++++++ SPECS/librepo.spec | 11 ++++- 3 files changed, 97 insertions(+), 1 deletion(-) create mode 100644 SOURCES/0001-Validate-path-read-from-repomd.xml-RhBug-1866498.patch create mode 100644 SOURCES/0002-Add-support-for-pkcs11-certificate-and-key-for-repos.patch diff --git a/SOURCES/0001-Validate-path-read-from-repomd.xml-RhBug-1866498.patch b/SOURCES/0001-Validate-path-read-from-repomd.xml-RhBug-1866498.patch new file mode 100644 index 0000000..aeb2858 --- /dev/null +++ b/SOURCES/0001-Validate-path-read-from-repomd.xml-RhBug-1866498.patch @@ -0,0 +1,47 @@ +From 699d3ee7b8968b5586ceb53e07d678e702735609 Mon Sep 17 00:00:00 2001 +From: Jaroslav Rohel +Date: Wed, 12 Aug 2020 08:35:28 +0200 +Subject: [PATCH] Validate path read from repomd.xml + +--- + librepo/yum.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/librepo/yum.c b/librepo/yum.c +index 3059188..529257b 100644 +--- a/librepo/yum.c ++++ b/librepo/yum.c +@@ -23,6 +23,7 @@ + #define BITS_IN_BYTE 8 + + #include ++#include + #include + #include + #include +@@ -770,6 +771,22 @@ prepare_repo_download_targets(LrHandle *handle, + continue; + + char *location_href = record->location_href; ++ ++ char *dest_dir = realpath(handle->destdir, NULL); ++ path = lr_pathconcat(handle->destdir, record->location_href, NULL); ++ char *requested_dir = realpath(dirname(path), NULL); ++ lr_free(path); ++ if (!g_str_has_prefix(requested_dir, dest_dir)) { ++ g_debug("%s: Invalid path: %s", __func__, location_href); ++ g_set_error(err, LR_YUM_ERROR, LRE_IO, "Invalid path: %s", location_href); ++ g_slist_free_full(*targets, (GDestroyNotify) lr_downloadtarget_free); ++ free(requested_dir); ++ free(dest_dir); ++ return FALSE; ++ } ++ free(requested_dir); ++ free(dest_dir); ++ + gboolean is_zchunk = FALSE; + #ifdef WITH_ZCHUNK + if (handle->cachedir && record->header_checksum) +-- +2.28.0 + diff --git a/SOURCES/0002-Add-support-for-pkcs11-certificate-and-key-for-repos.patch b/SOURCES/0002-Add-support-for-pkcs11-certificate-and-key-for-repos.patch new file mode 100644 index 0000000..d4ab6f5 --- /dev/null +++ b/SOURCES/0002-Add-support-for-pkcs11-certificate-and-key-for-repos.patch @@ -0,0 +1,40 @@ +From 1e7673d07308081f13e7bb1829cfed2ccd865ea0 Mon Sep 17 00:00:00 2001 +From: Masahiro Matsuya +Date: Fri, 13 Nov 2020 17:37:59 +0100 +Subject: [PATCH] Add support for pkcs11 certificate and key for repository + authorization + +msg: Add support for pkcs11 certificate and key for repository authorization +type: enhancement +resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1859495 +--- + librepo/handle.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/librepo/handle.c b/librepo/handle.c +index d8728c4..33edf5d 100644 +--- a/librepo/handle.c ++++ b/librepo/handle.c +@@ -649,6 +649,9 @@ lr_handle_setopt(LrHandle *handle, + lr_free(handle->sslclientcert); + handle->sslclientcert = g_strdup(va_arg(arg, char *)); + c_rc = curl_easy_setopt(c_h, CURLOPT_SSLCERT, handle->sslclientcert); ++ if (c_rc == CURLE_OK && handle->sslclientcert && !strncasecmp(handle->sslclientcert, "pkcs11:", 7)) { ++ c_rc = curl_easy_setopt(c_h, CURLOPT_SSLCERTTYPE, "ENG"); ++ } + break; + + case LRO_SSLCLIENTKEY: +@@ -656,6 +659,9 @@ lr_handle_setopt(LrHandle *handle, + lr_free(handle->sslclientkey); + handle->sslclientkey = g_strdup(va_arg(arg, char *)); + c_rc = curl_easy_setopt(c_h, CURLOPT_SSLKEY, handle->sslclientkey); ++ if (c_rc == CURLE_OK && handle->sslclientkey && !strncasecmp(handle->sslclientkey, "pkcs11:", 7)) { ++ c_rc = curl_easy_setopt(c_h, CURLOPT_SSLKEYTYPE, "ENG"); ++ } + break; + + case LRO_SSLCACERT: +-- +2.26.2 + diff --git a/SPECS/librepo.spec b/SPECS/librepo.spec index b6d3f76..4ed5503 100644 --- a/SPECS/librepo.spec +++ b/SPECS/librepo.spec @@ -27,13 +27,16 @@ Name: librepo Version: 1.12.0 -Release: 1%{?dist} +Release: 3%{?dist} Summary: Repodata downloading library License: LGPLv2+ URL: https://github.com/rpm-software-management/librepo Source0: %{url}/archive/%{version}/%{name}-%{version}.tar.gz +Patch1: 0001-Validate-path-read-from-repomd.xml-RhBug-1866498.patch +Patch2: 0002-Add-support-for-pkcs11-certificate-and-key-for-repos.patch + BuildRequires: cmake BuildRequires: gcc BuildRequires: check-devel @@ -190,6 +193,12 @@ popd %endif %changelog +* Tue Dec 15 2020 Marek Blaha - 1.12.0-3 +- Add support for pkcs11 certificate and key for repository authorization (RhBug:1859495) + +* Mon Aug 17 2020 Ales Matej - 1.12.0-2 +- Validate paths read from repomd.xml (RhBug:1866505) + * Wed Jun 03 2020 Nicola Sella - 1.12.0-1 - Update to 1.12.0 - Decode package URL when using for local filename (RhBug:1817130)