Compare commits
No commits in common. "c8s" and "c9-beta" have entirely different histories.
@ -1 +0,0 @@
|
|||||||
1
|
|
||||||
3
.gitignore
vendored
3
.gitignore
vendored
@ -1,2 +1 @@
|
|||||||
SOURCES/Date-Manip-6.60.tar.gz
|
SOURCES/Date-Manip-6.85.tar.gz
|
||||||
/Date-Manip-6.60.tar.gz
|
|
||||||
|
|||||||
1
.perl-Date-Manip.metadata
Normal file
1
.perl-Date-Manip.metadata
Normal file
@ -0,0 +1 @@
|
|||||||
|
c3711e7ac006cb1d026042ec81b604c0979180a7 SOURCES/Date-Manip-6.85.tar.gz
|
||||||
@ -1,38 +1,42 @@
|
|||||||
Name: perl-Date-Manip
|
Name: perl-Date-Manip
|
||||||
Version: 6.60
|
Version: 6.85
|
||||||
Release: 3%{?dist}.1
|
Release: 3%{?dist}
|
||||||
Summary: Date manipulation routines
|
Summary: Date manipulation routines
|
||||||
Group: Development/Libraries
|
|
||||||
License: GPL+ or Artistic
|
License: GPL+ or Artistic
|
||||||
URL: http://search.cpan.org/dist/Date-Manip/
|
URL: https://metacpan.org/release/Date-Manip
|
||||||
Source0: http://www.cpan.org/authors/id/S/SB/SBECK/Date-Manip-%{version}.tar.gz
|
Source0: https://cpan.metacpan.org/authors/id/S/SB/SBECK/Date-Manip-%{version}.tar.gz
|
||||||
# https://security.metacpan.org/patches/D/Date-Manip/6.99/CVE-2026-60075-r1.patch
|
|
||||||
Patch0: perl-Date-Manip-6.60-CVE-2026-60075.patch
|
|
||||||
BuildArch: noarch
|
BuildArch: noarch
|
||||||
# Build
|
# Build
|
||||||
|
BuildRequires: coreutils
|
||||||
BuildRequires: make
|
BuildRequires: make
|
||||||
BuildRequires: perl-interpreter
|
|
||||||
BuildRequires: perl-generators
|
BuildRequires: perl-generators
|
||||||
BuildRequires: perl(Config)
|
BuildRequires: perl-interpreter
|
||||||
BuildRequires: perl(ExtUtils::MakeMaker) >= 6.76
|
BuildRequires: perl(ExtUtils::MakeMaker) >= 6.76
|
||||||
BuildRequires: perl(strict)
|
BuildRequires: perl(strict)
|
||||||
BuildRequires: perl(warnings)
|
BuildRequires: perl(warnings)
|
||||||
# Runtime
|
# Runtime
|
||||||
|
BuildRequires: perl(:VERSION) >= 5.10.0
|
||||||
BuildRequires: perl(Carp)
|
BuildRequires: perl(Carp)
|
||||||
# XXX: BuildRequires: perl(Cwd)
|
# Cwd not used at tests
|
||||||
# XXX: BuildRequires: perl(Data::Dumper)
|
BuildRequires: perl(Data::Dumper)
|
||||||
BuildRequires: perl(Encode)
|
BuildRequires: perl(Encode)
|
||||||
BuildRequires: perl(Exporter)
|
BuildRequires: perl(Exporter)
|
||||||
# XXX: BuildRequires: perl(File::Find)
|
# File::Find not used at tests
|
||||||
# XXX: BuildRequires: perl(File::Spec)
|
# File::Spec not used at tests
|
||||||
BuildRequires: perl(integer)
|
BuildRequires: perl(integer)
|
||||||
BuildRequires: perl(IO::File)
|
BuildRequires: perl(IO::File)
|
||||||
BuildRequires: perl(Storable)
|
BuildRequires: perl(Storable)
|
||||||
BuildRequires: perl(utf8)
|
BuildRequires: perl(utf8)
|
||||||
|
# Win32::TieRegistry not used
|
||||||
# Tests only
|
# Tests only
|
||||||
BuildRequires: perl(Test::Inter)
|
# File::Basename not used
|
||||||
|
# File::Find::Rule not used
|
||||||
|
# lib not used
|
||||||
|
BuildRequires: perl(Test::Inter) >= 1.09
|
||||||
BuildRequires: perl(Test::More)
|
BuildRequires: perl(Test::More)
|
||||||
Requires: perl-libs
|
# Test::Pod 1.00 not used
|
||||||
|
# Test::Pod::Coverage 1.00 not used
|
||||||
|
Requires: perl(:MODULE_COMPAT_%(eval "$(perl -V:version)"; echo $version))
|
||||||
Requires: perl(Cwd)
|
Requires: perl(Cwd)
|
||||||
Requires: perl(File::Find)
|
Requires: perl(File::Find)
|
||||||
Requires: perl(File::Spec)
|
Requires: perl(File::Spec)
|
||||||
@ -45,51 +49,28 @@ Obsoletes: perl-DateManip < 5.48-1
|
|||||||
|
|
||||||
%description
|
%description
|
||||||
Date::Manip is a series of modules designed to make any common date/time
|
Date::Manip is a series of modules designed to make any common date/time
|
||||||
operation easy to do. Operations such as comparing two times, determining a
|
operation easy to do. Operations such as comparing two times, determining
|
||||||
data a given amount of time from another, or parsing international times
|
a data a given amount of time from another, or parsing international times
|
||||||
are all easily done. It deals with time as it is used in the Gregorian
|
are all easily done. It deals with time as it is used in the Gregorian
|
||||||
calendar (the one currently in use) with full support for time changes due
|
calendar (the one currently in use) with full support for time changes due
|
||||||
to daylight saving time.
|
to daylight saving time.
|
||||||
|
|
||||||
%package tests
|
|
||||||
Summary: Tests for %{name}
|
|
||||||
Requires: %{name} = %{?epoch:%{epoch}:}%{version}-%{release}
|
|
||||||
Requires: perl-Test-Harness
|
|
||||||
|
|
||||||
%description tests
|
|
||||||
Tests from %{name}. Execute them
|
|
||||||
with "%{_libexecdir}/%{name}/test".
|
|
||||||
|
|
||||||
%prep
|
%prep
|
||||||
%setup -q -n Date-Manip-%{version}
|
%setup -q -n Date-Manip-%{version}
|
||||||
%patch0 -p1
|
|
||||||
|
|
||||||
# Help generators to recognize Perl scripts
|
|
||||||
for F in t/*.t; do
|
|
||||||
perl -i -MConfig -ple 'print $Config{startperl} if $. == 1 && !s{\A#!.*perl\b}{$Config{startperl}}' "$F"
|
|
||||||
chmod +x "$F"
|
|
||||||
done
|
|
||||||
|
|
||||||
%build
|
%build
|
||||||
perl Makefile.PL INSTALLDIRS=vendor NO_PACKLIST=1
|
perl Makefile.PL INSTALLDIRS=vendor NO_PACKLIST=1 NO_PERLLOCAL=1
|
||||||
make %{?_smp_mflags}
|
%{make_build}
|
||||||
|
|
||||||
%install
|
%install
|
||||||
make pure_install DESTDIR=%{buildroot}
|
%{make_install}
|
||||||
%{_fixperms} %{buildroot}/*
|
%{_fixperms} %{buildroot}/*
|
||||||
|
|
||||||
# Install tests
|
|
||||||
mkdir -p %{buildroot}%{_libexecdir}/%{name}
|
|
||||||
cp -a t %{buildroot}%{_libexecdir}/%{name}
|
|
||||||
# Remove release tests
|
|
||||||
rm -f %{buildroot}%{_libexecdir}/%{name}/t/pod*
|
|
||||||
cat > %{buildroot}%{_libexecdir}/%{name}/test << 'EOF'
|
|
||||||
#!/bin/sh
|
|
||||||
cd %{_libexecdir}/%{name} && exec prove -I . -j "$(getconf _NPROCESSORS_ONLN)"
|
|
||||||
EOF
|
|
||||||
chmod +x %{buildroot}%{_libexecdir}/%{name}/test
|
|
||||||
|
|
||||||
%check
|
%check
|
||||||
|
unset DATE_MANIP DATE_MANIP_DEBUG DATE_MANIP_DEBUG_ABBREVS \
|
||||||
|
DATE_MANIP_DEBUG_ZONES DATE_MANIP_TEST_DM5 OS MULTINET_TIMEZONE \
|
||||||
|
RELEASE_TESTING 'SYS$TIMEZONE_DIFFERENTIAL' 'SYS$TIMEZONE_NAME' \
|
||||||
|
'SYS$TIMEZONE_RULE' 'TCPIP$TZ' 'UCX$TZ'
|
||||||
make test
|
make test
|
||||||
|
|
||||||
%files
|
%files
|
||||||
@ -99,19 +80,82 @@ make test
|
|||||||
%{_mandir}/man[13]/*.[13]*
|
%{_mandir}/man[13]/*.[13]*
|
||||||
%{_bindir}/dm_*
|
%{_bindir}/dm_*
|
||||||
|
|
||||||
%files tests
|
|
||||||
%{_libexecdir}/%{name}
|
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
* Thu Aug 13 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 6.60-3.1
|
* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 6.85-3
|
||||||
- Fix CVE-2026-60075: prevent ReDoS via crafted strings with long
|
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
|
||||||
interior whitespace runs in date/time parsing
|
Related: rhbz#1991688
|
||||||
- Resolves: RHEL-239807
|
|
||||||
|
|
||||||
* Thu Jul 20 2023 Jitka Plesnikova <jplesnik@redhat.com> - 6.60-3
|
* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 6.85-2
|
||||||
- Replace versioned MODULE_COMPAT by non-versioned perl-libs
|
- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
|
||||||
- Package tests
|
|
||||||
- Resolves: rhbz#2219504
|
* Tue Mar 03 2021 Jan Pazdziora <jpazdziora@redhat.com> - 6.85-1
|
||||||
|
- 1933868 - Rebase to upstream version 6.85.
|
||||||
|
|
||||||
|
* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 6.83-3
|
||||||
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
|
||||||
|
|
||||||
|
* Fri Jan 15 2021 Petr Pisar <ppisar@redhat.com> - 6.83-2
|
||||||
|
- Specify all dependendencies
|
||||||
|
|
||||||
|
* Tue Dec 15 2020 Jan Pazdziora <jpazdziora@redhat.com> - 6.83-1
|
||||||
|
- 1902872 - Rebase to upstream version 6.83.
|
||||||
|
|
||||||
|
* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 6.82-3
|
||||||
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
|
||||||
|
|
||||||
|
* Tue Jun 23 2020 Jitka Plesnikova <jplesnik@redhat.com> - 6.82-2
|
||||||
|
- Perl 5.32 rebuild
|
||||||
|
|
||||||
|
* Mon Jun 08 2020 Jan Pazdziora <jpazdziora@redhat.com> - 6.82-1
|
||||||
|
- 1842524 - Rebase to upstream version 6.82.
|
||||||
|
|
||||||
|
* Mon Apr 27 2020 Jan Pazdziora <jpazdziora@redhat.com> - 6.81-1
|
||||||
|
- 1827253 - Rebase to upstream version 6.81.
|
||||||
|
|
||||||
|
* Tue Mar 03 2020 Jan Pazdziora <jpazdziora@redhat.com> - 6.80-1
|
||||||
|
- 1809202 - Rebase to upstream version 6.80.
|
||||||
|
|
||||||
|
* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 6.79-2
|
||||||
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
|
||||||
|
|
||||||
|
* Mon Dec 09 2019 Jan Pazdziora <jpazdziora@redhat.com> - 6.79-1
|
||||||
|
- 1778849 - Rebase to upstream version 6.79.
|
||||||
|
|
||||||
|
* Mon Sep 02 2019 Jan Pazdziora <jpazdziora@redhat.com> - 6.78-1
|
||||||
|
- 1747170 - Rebase to upstream version 6.78.
|
||||||
|
|
||||||
|
* Fri Jul 26 2019 Fedora Release Engineering <releng@fedoraproject.org> - 6.77-2
|
||||||
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
|
||||||
|
|
||||||
|
* Thu Jun 06 2019 Jan Pazdziora <jpazdziora@redhat.com> - 6.77-1
|
||||||
|
- 1716417 - Rebase to upstream version 6.77.
|
||||||
|
|
||||||
|
* Fri May 31 2019 Jitka Plesnikova <jplesnik@redhat.com> - 6.76-2
|
||||||
|
- Perl 5.30 rebuild
|
||||||
|
|
||||||
|
* Mon Mar 04 2019 Jan Pazdziora <jpazdziora@redhat.com> - 6.76-1
|
||||||
|
- 1684273 - Rebase to upstream version 6.76.
|
||||||
|
|
||||||
|
* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 6.75-2
|
||||||
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
|
||||||
|
|
||||||
|
* Mon Dec 10 2018 Jan Pazdziora <jpazdziora@redhat.com> - 6.75-1
|
||||||
|
- 1656324 - Rebase to upstream version 6.75.
|
||||||
|
|
||||||
|
* Mon Sep 10 2018 Jan Pazdziora <jpazdziora@redhat.com> - 6.73-1
|
||||||
|
- 1624940 - Rebase to upstream version 6.73.
|
||||||
|
|
||||||
|
* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 6.72-3
|
||||||
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
|
||||||
|
|
||||||
|
* Thu Jun 28 2018 Jitka Plesnikova <jplesnik@redhat.com> - 6.72-2
|
||||||
|
- Perl 5.28 rebuild
|
||||||
|
|
||||||
|
* Thu Jun 07 2018 Jan Pazdziora <jpazdziora@redhat.com> - 6.72-1
|
||||||
|
- 1585345 - Rebase to upstream version 6.72.
|
||||||
|
|
||||||
|
* Fri Mar 02 2018 Jan Pazdziora <jpazdziora@redhat.com> - 6.70-1
|
||||||
|
- 1550748 - Rebase to upstream version 6.70.
|
||||||
|
|
||||||
* Thu Feb 08 2018 Fedora Release Engineering <releng@fedoraproject.org> - 6.60-2
|
* Thu Feb 08 2018 Fedora Release Engineering <releng@fedoraproject.org> - 6.60-2
|
||||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
|
||||||
@ -1,6 +0,0 @@
|
|||||||
--- !Policy
|
|
||||||
product_versions:
|
|
||||||
- rhel-8
|
|
||||||
decision_context: osci_compose_gate
|
|
||||||
rules:
|
|
||||||
- !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}
|
|
||||||
@ -1,69 +0,0 @@
|
|||||||
From 86c3aa6b43e0b311c3aa5e80e58ab51ab525feb3 Mon Sep 17 00:00:00 2001
|
|
||||||
From: CPANSec Security Scanner Bot <cpan-security@security.metacpan.org>
|
|
||||||
Date: Thu, 13 Aug 2026 13:52:54 +0000
|
|
||||||
Subject: [PATCH] Date::Manip: cap the length of a string handed to the parsers
|
|
||||||
|
|
||||||
CVE-2026-60075. _parse_time removes a time from anywhere in the string
|
|
||||||
with the unanchored substitution s/$timerx/ /, where $timerx is an
|
|
||||||
auto-generated alternation of time patterns reached through a leading
|
|
||||||
(?:$atrx|^|\s+). The engine retries the match at every position of an
|
|
||||||
interior whitespace run: at each start position the leading \s+ consumes
|
|
||||||
the rest of the run greedily, the time alternation fails because the run
|
|
||||||
holds no digits, and the engine backtracks a space at a time across the
|
|
||||||
run before advancing the start position. The cost is quadratic in the
|
|
||||||
length of the run, and no time need be present in the string. On the
|
|
||||||
machine this patch was tested on, parsing "x" . (" " x 2000) . "x" took
|
|
||||||
1.7 seconds of CPU and "x" . (" " x 16000) . "x" took 107 seconds,
|
|
||||||
rising about fourfold for each doubling of the run.
|
|
||||||
|
|
||||||
Fix: reject a string longer than $MAXLENGTH (256) at the parse and
|
|
||||||
parse_time entries, before any regex runs, which is the shape of the fix
|
|
||||||
libwww-perl shipped in HTTP::Date 6.08 for the same weakness class.
|
|
||||||
Legitimate date strings are well under 100 characters, and a 42 entry
|
|
||||||
corpus of legitimate formats parses to the same value before and after.
|
|
||||||
---
|
|
||||||
lib/Date/Manip/Date.pm | 17 +++++++++++++++++
|
|
||||||
1 file changed, 17 insertions(+)
|
|
||||||
|
|
||||||
diff --git a/lib/Date/Manip/Date.pm b/lib/Date/Manip/Date.pm
|
|
||||||
index b954917..f755cab 100644
|
|
||||||
--- a/lib/Date/Manip/Date.pm
|
|
||||||
+++ b/lib/Date/Manip/Date.pm
|
|
||||||
@@ -93,6 +93,13 @@ sub input {
|
|
||||||
# DATE PARSING
|
|
||||||
########################################################################
|
|
||||||
|
|
||||||
+# The longest string the parsers will look at. The time matching
|
|
||||||
+# regexp is applied unanchored, so the cost of failing to match grows
|
|
||||||
+# with the square of the length of an interior whitespace run. Real
|
|
||||||
+# date strings are well under 100 characters.
|
|
||||||
+
|
|
||||||
+our $MAXLENGTH = 256;
|
|
||||||
+
|
|
||||||
sub parse {
|
|
||||||
my($self,$instring,@opts) = @_;
|
|
||||||
$self->_init();
|
|
||||||
@@ -103,6 +110,11 @@ sub parse {
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
+ if (length($instring) > $MAXLENGTH) {
|
|
||||||
+ $$self{'err'} = '[parse] Date string too long';
|
|
||||||
+ return 1;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
my %opts = map { $_,1 } @opts;
|
|
||||||
|
|
||||||
my $dmt = $$self{'tz'};
|
|
||||||
@@ -345,6 +357,11 @@ sub parse_time {
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
+ if (length($string) > $MAXLENGTH) {
|
|
||||||
+ $$self{'err'} = '[parse_time] Time string too long';
|
|
||||||
+ return 1;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
my($y,$m,$d,$h,$mn,$s);
|
|
||||||
|
|
||||||
if ($$self{'err'}) {
|
|
||||||
@ -1,12 +0,0 @@
|
|||||||
summary: Private (RHEL) beakerlib tests
|
|
||||||
enabled: false
|
|
||||||
adjust:
|
|
||||||
- when: distro == rhel
|
|
||||||
enabled: true
|
|
||||||
because: private tests are accesible only within rhel pipline
|
|
||||||
discover:
|
|
||||||
- name: rhel
|
|
||||||
how: fmf
|
|
||||||
url: https://pkgs.devel.redhat.com/git/tests/perl-Date-Manip
|
|
||||||
execute:
|
|
||||||
how: tmt
|
|
||||||
@ -1,5 +0,0 @@
|
|||||||
summary: Sanity tests
|
|
||||||
discover:
|
|
||||||
how: fmf
|
|
||||||
execute:
|
|
||||||
how: tmt
|
|
||||||
1
sources
1
sources
@ -1 +0,0 @@
|
|||||||
SHA512 (Date-Manip-6.60.tar.gz) = 46ac9696aea04167427957a43de1b44041ea05d3eaf01ffbdbfda9f458b3073f36ec46c9661ac437f96731d0f40aebc206ef385c6c4aff1b147917fc2c89a1cf
|
|
||||||
@ -1,9 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
OUTPUT=`rpm -qR perl-Date-Manip`
|
|
||||||
|
|
||||||
if ! echo "$OUTPUT" | grep -q "MODULE_COMPAT_"; then
|
|
||||||
exit 0
|
|
||||||
else
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
@ -1,17 +0,0 @@
|
|||||||
summary: Test for BZ 2219504
|
|
||||||
component:
|
|
||||||
- perl-Date-Manip
|
|
||||||
require:
|
|
||||||
- bash
|
|
||||||
- perl-Date-Manip
|
|
||||||
test: ./bz_2219504-check.sh
|
|
||||||
enabled: false
|
|
||||||
adjust:
|
|
||||||
- when: distro == centos-stream-8 or distro == rhel-8
|
|
||||||
enabled: true
|
|
||||||
tag:
|
|
||||||
- TestCaseCopy
|
|
||||||
- Tier1
|
|
||||||
tier: '1'
|
|
||||||
extra-nitrate: TC#0615610
|
|
||||||
id: 8cbc566f-9bbb-47ab-a526-0945257a30c6
|
|
||||||
@ -1,10 +0,0 @@
|
|||||||
summary: Upstream tests
|
|
||||||
component: perl-Date-Manip
|
|
||||||
require: perl-Date-Manip-tests
|
|
||||||
test: /usr/libexec/perl-Date-Manip/test
|
|
||||||
tag:
|
|
||||||
- Tier1
|
|
||||||
- rhel-buildroot
|
|
||||||
tier: '1'
|
|
||||||
extra-nitrate: TC#0615611
|
|
||||||
id: 083fd883-2fc4-426e-aae8-c0274c8e33a7
|
|
||||||
Loading…
Reference in New Issue
Block a user