Compare commits

..

No commits in common. "c8s" and "c9-beta" have entirely different histories.
c8s ... c9-beta

12 changed files with 104 additions and 190 deletions

View File

@ -1 +0,0 @@
1

3
.gitignore vendored
View File

@ -1,2 +1 @@
SOURCES/Date-Manip-6.60.tar.gz
/Date-Manip-6.60.tar.gz
SOURCES/Date-Manip-6.85.tar.gz

View File

@ -0,0 +1 @@
c3711e7ac006cb1d026042ec81b604c0979180a7 SOURCES/Date-Manip-6.85.tar.gz

View File

@ -1,38 +1,42 @@
Name: perl-Date-Manip
Version: 6.60
Release: 3%{?dist}.1
Version: 6.85
Release: 3%{?dist}
Summary: Date manipulation routines
Group: Development/Libraries
License: GPL+ or Artistic
URL: http://search.cpan.org/dist/Date-Manip/
Source0: http://www.cpan.org/authors/id/S/SB/SBECK/Date-Manip-%{version}.tar.gz
# https://security.metacpan.org/patches/D/Date-Manip/6.99/CVE-2026-60075-r1.patch
Patch0: perl-Date-Manip-6.60-CVE-2026-60075.patch
URL: https://metacpan.org/release/Date-Manip
Source0: https://cpan.metacpan.org/authors/id/S/SB/SBECK/Date-Manip-%{version}.tar.gz
BuildArch: noarch
# Build
BuildRequires: coreutils
BuildRequires: make
BuildRequires: perl-interpreter
BuildRequires: perl-generators
BuildRequires: perl(Config)
BuildRequires: perl-interpreter
BuildRequires: perl(ExtUtils::MakeMaker) >= 6.76
BuildRequires: perl(strict)
BuildRequires: perl(warnings)
# Runtime
BuildRequires: perl(:VERSION) >= 5.10.0
BuildRequires: perl(Carp)
# XXX: BuildRequires: perl(Cwd)
# XXX: BuildRequires: perl(Data::Dumper)
# Cwd not used at tests
BuildRequires: perl(Data::Dumper)
BuildRequires: perl(Encode)
BuildRequires: perl(Exporter)
# XXX: BuildRequires: perl(File::Find)
# XXX: BuildRequires: perl(File::Spec)
# File::Find not used at tests
# File::Spec not used at tests
BuildRequires: perl(integer)
BuildRequires: perl(IO::File)
BuildRequires: perl(Storable)
BuildRequires: perl(utf8)
# Win32::TieRegistry not used
# Tests only
BuildRequires: perl(Test::Inter)
# File::Basename not used
# File::Find::Rule not used
# lib not used
BuildRequires: perl(Test::Inter) >= 1.09
BuildRequires: perl(Test::More)
Requires: perl-libs
# Test::Pod 1.00 not used
# Test::Pod::Coverage 1.00 not used
Requires: perl(:MODULE_COMPAT_%(eval "$(perl -V:version)"; echo $version))
Requires: perl(Cwd)
Requires: perl(File::Find)
Requires: perl(File::Spec)
@ -45,51 +49,28 @@ Obsoletes: perl-DateManip < 5.48-1
%description
Date::Manip is a series of modules designed to make any common date/time
operation easy to do. Operations such as comparing two times, determining a
data a given amount of time from another, or parsing international times
operation easy to do. Operations such as comparing two times, determining
a data a given amount of time from another, or parsing international times
are all easily done. It deals with time as it is used in the Gregorian
calendar (the one currently in use) with full support for time changes due
to daylight saving time.
%package tests
Summary: Tests for %{name}
Requires: %{name} = %{?epoch:%{epoch}:}%{version}-%{release}
Requires: perl-Test-Harness
%description tests
Tests from %{name}. Execute them
with "%{_libexecdir}/%{name}/test".
%prep
%setup -q -n Date-Manip-%{version}
%patch0 -p1
# Help generators to recognize Perl scripts
for F in t/*.t; do
perl -i -MConfig -ple 'print $Config{startperl} if $. == 1 && !s{\A#!.*perl\b}{$Config{startperl}}' "$F"
chmod +x "$F"
done
%build
perl Makefile.PL INSTALLDIRS=vendor NO_PACKLIST=1
make %{?_smp_mflags}
perl Makefile.PL INSTALLDIRS=vendor NO_PACKLIST=1 NO_PERLLOCAL=1
%{make_build}
%install
make pure_install DESTDIR=%{buildroot}
%{make_install}
%{_fixperms} %{buildroot}/*
# Install tests
mkdir -p %{buildroot}%{_libexecdir}/%{name}
cp -a t %{buildroot}%{_libexecdir}/%{name}
# Remove release tests
rm -f %{buildroot}%{_libexecdir}/%{name}/t/pod*
cat > %{buildroot}%{_libexecdir}/%{name}/test << 'EOF'
#!/bin/sh
cd %{_libexecdir}/%{name} && exec prove -I . -j "$(getconf _NPROCESSORS_ONLN)"
EOF
chmod +x %{buildroot}%{_libexecdir}/%{name}/test
%check
unset DATE_MANIP DATE_MANIP_DEBUG DATE_MANIP_DEBUG_ABBREVS \
DATE_MANIP_DEBUG_ZONES DATE_MANIP_TEST_DM5 OS MULTINET_TIMEZONE \
RELEASE_TESTING 'SYS$TIMEZONE_DIFFERENTIAL' 'SYS$TIMEZONE_NAME' \
'SYS$TIMEZONE_RULE' 'TCPIP$TZ' 'UCX$TZ'
make test
%files
@ -99,19 +80,82 @@ make test
%{_mandir}/man[13]/*.[13]*
%{_bindir}/dm_*
%files tests
%{_libexecdir}/%{name}
%changelog
* Thu Aug 13 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 6.60-3.1
- Fix CVE-2026-60075: prevent ReDoS via crafted strings with long
interior whitespace runs in date/time parsing
- Resolves: RHEL-239807
* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 6.85-3
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
Related: rhbz#1991688
* Thu Jul 20 2023 Jitka Plesnikova <jplesnik@redhat.com> - 6.60-3
- Replace versioned MODULE_COMPAT by non-versioned perl-libs
- Package tests
- Resolves: rhbz#2219504
* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 6.85-2
- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
* Tue Mar 03 2021 Jan Pazdziora <jpazdziora@redhat.com> - 6.85-1
- 1933868 - Rebase to upstream version 6.85.
* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 6.83-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
* Fri Jan 15 2021 Petr Pisar <ppisar@redhat.com> - 6.83-2
- Specify all dependendencies
* Tue Dec 15 2020 Jan Pazdziora <jpazdziora@redhat.com> - 6.83-1
- 1902872 - Rebase to upstream version 6.83.
* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 6.82-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
* Tue Jun 23 2020 Jitka Plesnikova <jplesnik@redhat.com> - 6.82-2
- Perl 5.32 rebuild
* Mon Jun 08 2020 Jan Pazdziora <jpazdziora@redhat.com> - 6.82-1
- 1842524 - Rebase to upstream version 6.82.
* Mon Apr 27 2020 Jan Pazdziora <jpazdziora@redhat.com> - 6.81-1
- 1827253 - Rebase to upstream version 6.81.
* Tue Mar 03 2020 Jan Pazdziora <jpazdziora@redhat.com> - 6.80-1
- 1809202 - Rebase to upstream version 6.80.
* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 6.79-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
* Mon Dec 09 2019 Jan Pazdziora <jpazdziora@redhat.com> - 6.79-1
- 1778849 - Rebase to upstream version 6.79.
* Mon Sep 02 2019 Jan Pazdziora <jpazdziora@redhat.com> - 6.78-1
- 1747170 - Rebase to upstream version 6.78.
* Fri Jul 26 2019 Fedora Release Engineering <releng@fedoraproject.org> - 6.77-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
* Thu Jun 06 2019 Jan Pazdziora <jpazdziora@redhat.com> - 6.77-1
- 1716417 - Rebase to upstream version 6.77.
* Fri May 31 2019 Jitka Plesnikova <jplesnik@redhat.com> - 6.76-2
- Perl 5.30 rebuild
* Mon Mar 04 2019 Jan Pazdziora <jpazdziora@redhat.com> - 6.76-1
- 1684273 - Rebase to upstream version 6.76.
* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 6.75-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
* Mon Dec 10 2018 Jan Pazdziora <jpazdziora@redhat.com> - 6.75-1
- 1656324 - Rebase to upstream version 6.75.
* Mon Sep 10 2018 Jan Pazdziora <jpazdziora@redhat.com> - 6.73-1
- 1624940 - Rebase to upstream version 6.73.
* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 6.72-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
* Thu Jun 28 2018 Jitka Plesnikova <jplesnik@redhat.com> - 6.72-2
- Perl 5.28 rebuild
* Thu Jun 07 2018 Jan Pazdziora <jpazdziora@redhat.com> - 6.72-1
- 1585345 - Rebase to upstream version 6.72.
* Fri Mar 02 2018 Jan Pazdziora <jpazdziora@redhat.com> - 6.70-1
- 1550748 - Rebase to upstream version 6.70.
* Thu Feb 08 2018 Fedora Release Engineering <releng@fedoraproject.org> - 6.60-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

View File

@ -1,6 +0,0 @@
--- !Policy
product_versions:
- rhel-8
decision_context: osci_compose_gate
rules:
- !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}

View File

@ -1,69 +0,0 @@
From 86c3aa6b43e0b311c3aa5e80e58ab51ab525feb3 Mon Sep 17 00:00:00 2001
From: CPANSec Security Scanner Bot <cpan-security@security.metacpan.org>
Date: Thu, 13 Aug 2026 13:52:54 +0000
Subject: [PATCH] Date::Manip: cap the length of a string handed to the parsers
CVE-2026-60075. _parse_time removes a time from anywhere in the string
with the unanchored substitution s/$timerx/ /, where $timerx is an
auto-generated alternation of time patterns reached through a leading
(?:$atrx|^|\s+). The engine retries the match at every position of an
interior whitespace run: at each start position the leading \s+ consumes
the rest of the run greedily, the time alternation fails because the run
holds no digits, and the engine backtracks a space at a time across the
run before advancing the start position. The cost is quadratic in the
length of the run, and no time need be present in the string. On the
machine this patch was tested on, parsing "x" . (" " x 2000) . "x" took
1.7 seconds of CPU and "x" . (" " x 16000) . "x" took 107 seconds,
rising about fourfold for each doubling of the run.
Fix: reject a string longer than $MAXLENGTH (256) at the parse and
parse_time entries, before any regex runs, which is the shape of the fix
libwww-perl shipped in HTTP::Date 6.08 for the same weakness class.
Legitimate date strings are well under 100 characters, and a 42 entry
corpus of legitimate formats parses to the same value before and after.
---
lib/Date/Manip/Date.pm | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/lib/Date/Manip/Date.pm b/lib/Date/Manip/Date.pm
index b954917..f755cab 100644
--- a/lib/Date/Manip/Date.pm
+++ b/lib/Date/Manip/Date.pm
@@ -93,6 +93,13 @@ sub input {
# DATE PARSING
########################################################################
+# The longest string the parsers will look at. The time matching
+# regexp is applied unanchored, so the cost of failing to match grows
+# with the square of the length of an interior whitespace run. Real
+# date strings are well under 100 characters.
+
+our $MAXLENGTH = 256;
+
sub parse {
my($self,$instring,@opts) = @_;
$self->_init();
@@ -103,6 +110,11 @@ sub parse {
return 1;
}
+ if (length($instring) > $MAXLENGTH) {
+ $$self{'err'} = '[parse] Date string too long';
+ return 1;
+ }
+
my %opts = map { $_,1 } @opts;
my $dmt = $$self{'tz'};
@@ -345,6 +357,11 @@ sub parse_time {
return 1;
}
+ if (length($string) > $MAXLENGTH) {
+ $$self{'err'} = '[parse_time] Time string too long';
+ return 1;
+ }
+
my($y,$m,$d,$h,$mn,$s);
if ($$self{'err'}) {

View File

@ -1,12 +0,0 @@
summary: Private (RHEL) beakerlib tests
enabled: false
adjust:
- when: distro == rhel
enabled: true
because: private tests are accesible only within rhel pipline
discover:
- name: rhel
how: fmf
url: https://pkgs.devel.redhat.com/git/tests/perl-Date-Manip
execute:
how: tmt

View File

@ -1,5 +0,0 @@
summary: Sanity tests
discover:
how: fmf
execute:
how: tmt

View File

@ -1 +0,0 @@
SHA512 (Date-Manip-6.60.tar.gz) = 46ac9696aea04167427957a43de1b44041ea05d3eaf01ffbdbfda9f458b3073f36ec46c9661ac437f96731d0f40aebc206ef385c6c4aff1b147917fc2c89a1cf

View File

@ -1,9 +0,0 @@
#!/bin/bash
OUTPUT=`rpm -qR perl-Date-Manip`
if ! echo "$OUTPUT" | grep -q "MODULE_COMPAT_"; then
exit 0
else
exit 1
fi

View File

@ -1,17 +0,0 @@
summary: Test for BZ 2219504
component:
- perl-Date-Manip
require:
- bash
- perl-Date-Manip
test: ./bz_2219504-check.sh
enabled: false
adjust:
- when: distro == centos-stream-8 or distro == rhel-8
enabled: true
tag:
- TestCaseCopy
- Tier1
tier: '1'
extra-nitrate: TC#0615610
id: 8cbc566f-9bbb-47ab-a526-0945257a30c6

View File

@ -1,10 +0,0 @@
summary: Upstream tests
component: perl-Date-Manip
require: perl-Date-Manip-tests
test: /usr/libexec/perl-Date-Manip/test
tag:
- Tier1
- rhel-buildroot
tier: '1'
extra-nitrate: TC#0615611
id: 083fd883-2fc4-426e-aae8-c0274c8e33a7