import librepo-1.12.0-3.el8

SOURCES/0001-Validate-path-read-from-repomd.xml-RhBug-1866498.patch

@@ -0,0 +1,47 @@
+From 699d3ee7b8968b5586ceb53e07d678e702735609 Mon Sep 17 00:00:00 2001
+From: Jaroslav Rohel <jrohel@redhat.com>
+Date: Wed, 12 Aug 2020 08:35:28 +0200
+Subject: [PATCH] Validate path read from repomd.xml
+
+---
+ librepo/yum.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/librepo/yum.c b/librepo/yum.c
+index 3059188..529257b 100644
+--- a/librepo/yum.c
++++ b/librepo/yum.c
+@@ -23,6 +23,7 @@
+ #define  BITS_IN_BYTE 8
+ 
+ #include <stdio.h>
++#include <libgen.h>
+ #include <assert.h>
+ #include <stdlib.h>
+ #include <errno.h>
+@@ -770,6 +771,22 @@ prepare_repo_download_targets(LrHandle *handle,
+             continue;
+ 
+         char *location_href = record->location_href;
++
++        char *dest_dir = realpath(handle->destdir, NULL);
++        path = lr_pathconcat(handle->destdir, record->location_href, NULL);
++        char *requested_dir = realpath(dirname(path), NULL);
++        lr_free(path);
++        if (!g_str_has_prefix(requested_dir, dest_dir)) {
++            g_debug("%s: Invalid path: %s", __func__, location_href);
++            g_set_error(err, LR_YUM_ERROR, LRE_IO, "Invalid path: %s", location_href);
++            g_slist_free_full(*targets, (GDestroyNotify) lr_downloadtarget_free);
++            free(requested_dir);
++            free(dest_dir);
++            return FALSE;
++        }
++        free(requested_dir);
++        free(dest_dir);
++
+         gboolean is_zchunk = FALSE;
+         #ifdef WITH_ZCHUNK
+         if (handle->cachedir && record->header_checksum)
+-- 
+2.28.0
+

SOURCES/0002-Add-support-for-pkcs11-certificate-and-key-for-repos.patch

@@ -0,0 +1,40 @@
+From 1e7673d07308081f13e7bb1829cfed2ccd865ea0 Mon Sep 17 00:00:00 2001
+From: Masahiro Matsuya <mmatsuya@redhat.com>
+Date: Fri, 13 Nov 2020 17:37:59 +0100
+Subject: [PATCH] Add support for pkcs11 certificate and key for repository
+ authorization
+
+msg: Add support for pkcs11 certificate and key for repository authorization
+type: enhancement
+resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1859495
+---
+ librepo/handle.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/librepo/handle.c b/librepo/handle.c
+index d8728c4..33edf5d 100644
+--- a/librepo/handle.c
++++ b/librepo/handle.c
+@@ -649,6 +649,9 @@ lr_handle_setopt(LrHandle *handle,
+             lr_free(handle->sslclientcert);
+         handle->sslclientcert = g_strdup(va_arg(arg, char *));
+         c_rc = curl_easy_setopt(c_h, CURLOPT_SSLCERT, handle->sslclientcert);
++        if (c_rc == CURLE_OK && handle->sslclientcert && !strncasecmp(handle->sslclientcert, "pkcs11:", 7)) {
++            c_rc = curl_easy_setopt(c_h, CURLOPT_SSLCERTTYPE, "ENG");
++        }
+         break;
+ 
+     case LRO_SSLCLIENTKEY:
+@@ -656,6 +659,9 @@ lr_handle_setopt(LrHandle *handle,
+             lr_free(handle->sslclientkey);
+         handle->sslclientkey = g_strdup(va_arg(arg, char *));
+         c_rc = curl_easy_setopt(c_h, CURLOPT_SSLKEY, handle->sslclientkey);
++        if (c_rc == CURLE_OK && handle->sslclientkey && !strncasecmp(handle->sslclientkey, "pkcs11:", 7)) {
++            c_rc = curl_easy_setopt(c_h, CURLOPT_SSLKEYTYPE, "ENG");
++        }
+         break;
+ 
+     case LRO_SSLCACERT:
+-- 
+2.26.2
+

SPECS/librepo.spec

@@ -27,13 +27,16 @@
 
 Name:           librepo
 Version:        1.12.0
-Release:        1%{?dist}
+Release:        3%{?dist}
 Summary:        Repodata downloading library
 
 License:        LGPLv2+
 URL:            https://github.com/rpm-software-management/librepo
 Source0:        %{url}/archive/%{version}/%{name}-%{version}.tar.gz
 
+Patch1:         0001-Validate-path-read-from-repomd.xml-RhBug-1866498.patch
+Patch2:         0002-Add-support-for-pkcs11-certificate-and-key-for-repos.patch
+
 BuildRequires:  cmake
 BuildRequires:  gcc
 BuildRequires:  check-devel
@@ -190,6 +193,12 @@ popd
 %endif
 
 %changelog
+* Tue Dec 15 2020 Marek Blaha <mblaha@redhat.com> - 1.12.0-3
+- Add support for pkcs11 certificate and key for repository authorization (RhBug:1859495)
+
+* Mon Aug 17 2020 Ales Matej <amatej@redhat.com> - 1.12.0-2
+- Validate paths read from repomd.xml (RhBug:1866505)
+
 * Wed Jun 03 2020 Nicola Sella <nsella@redhat.com> - 1.12.0-1
 - Update to 1.12.0
 - Decode package URL when using for local filename (RhBug:1817130)