1.19 bump

.gitignore

@@ -1 +1,2 @@
 /Digest-1.17.tar.gz
+/Digest-1.19.tar.gz

Digest-0.17-CVE-2016-1238-prevent-loading-optional-modules-from-.patch

@@ -1,41 +0,0 @@
-From 8cfc4916736280dd76655fdef5b78331bfac414d Mon Sep 17 00:00:00 2001
-From: Tony Cook <tony@develop-help.com>
-Date: Wed, 27 Jul 2016 14:04:59 +1000
-Subject: [PATCH] CVE-2016-1238: prevent loading optional modules from default
- .
-
-Digest attempts to load Digest::SHA, only failing if Digest::SHA2
-is also unavailable.
-
-If a system has Digest installed, but not Digest::SHA, and a user
-attempts to run a program using Digest with SHA-256 from a world
-writable directory such as /tmp and since perl adds "." to the end
-of @INC an attacker can run code as the original user by creating
-/tmp/Digest/SHA.pm.
-
-The change temporarily removes the default "." entry from the end of
-@INC preventing that attack.
----
- Digest.pm | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/Digest.pm b/Digest.pm
-index 2ae6eec..c75649f 100644
---- a/Digest.pm
-+++ b/Digest.pm
-@@ -42,7 +42,11 @@ sub new
-         unless (exists ${"$class\::"}{"VERSION"}) {
-             my $pm_file = $class . ".pm";
-             $pm_file =~ s{::}{/}g;
--            eval { require $pm_file };
-+            eval {
-+                local @INC = @INC;
-+                pop @INC if $INC[-1] eq '.';
-+                require $pm_file;
-+            };
-             if ($@) {
-                 $err ||= $@;
-                 next;
--- 
-2.1.4
-

perl-Digest.spec

@@ -1,23 +1,25 @@
 Name:           perl-Digest
-Version:        1.17
-Release:        457%{?dist}
+Version:        1.19
+Release:        1%{?dist}
 Summary:        Modules that calculate message digests
 License:        GPL+ or Artistic
 URL:            https://metacpan.org/release/Digest
-Source0:        https://cpan.metacpan.org/authors/id/G/GA/GAAS/Digest-%{version}.tar.gz
-# Avoid loading optional modules from default . (CVE-2016-1238)
-Patch0:         Digest-0.17-CVE-2016-1238-prevent-loading-optional-modules-from-.patch
+Source0:        https://cpan.metacpan.org/authors/id/T/TO/TODDR/Digest-%{version}.tar.gz
 BuildArch:      noarch
 BuildRequires:  coreutils
-BuildRequires:  findutils
 BuildRequires:  make
 BuildRequires:  perl-interpreter
 BuildRequires:  perl-generators
+BuildRequires:  perl(:VERSION) >= 5.6
+BuildRequires:  perl(ExtUtils::MakeMaker) >= 6.76
+BuildRequires:  perl(strict)
+BuildRequires:  perl(warnings)
+# Run-time:
 BuildRequires:  perl(Carp)
 BuildRequires:  perl(Exporter)
-BuildRequires:  perl(ExtUtils::MakeMaker)
 BuildRequires:  perl(MIME::Base64)
 # Tests only:
+BuildRequires:  perl(File::Temp)
 BuildRequires:  perl(lib)
 BuildRequires:  perl(Test::More) >= 0.47
 Requires:       perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version))
@@ -25,24 +27,20 @@ Requires:       perl(MIME::Base64)
 
 %description
 The Digest:: modules calculate digests, also called "fingerprints" or
-"hashes", of some data, called a message. The digest is (usually)
-some small/fixed size string. The actual size of the digest depend of
-the algorithm used. The message is simply a sequence of arbitrary
-bytes or bits.
+"hashes", of some data, called a message. The digest is (usually) some
+small/fixed size string. The actual size of the digest depends of the
+algorithm used. The message is simply a sequence of arbitrary bytes or bits.
 
 %prep
 %setup -q -n Digest-%{version}
-%patch0 -p1
 chmod -x digest-bench
 
 %build
-%{__perl} Makefile.PL INSTALLDIRS=vendor
-make %{?_smp_mflags}
+perl Makefile.PL INSTALLDIRS=vendor NO_PACKLIST=1 NO_PERLLOCAL=1
+%{make_build}
 
 %install
-make pure_install PERL_INSTALL_ROOT=$RPM_BUILD_ROOT
-find $RPM_BUILD_ROOT -type f -name .packlist -exec rm -f {} \;
-find $RPM_BUILD_ROOT -depth -type d -exec rmdir {} 2>/dev/null \;
+%{make_install}
 %{_fixperms} $RPM_BUILD_ROOT/*
 
 %check
@@ -54,6 +52,9 @@ make test
 %{_mandir}/man3/*
 
 %changelog
+* Wed Oct 14 2020 Petr Pisar <ppisar@redhat.com> - 1.19-1
+- 1.19 bump
+
 * Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.17-457
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
 

sources

@@ -1 +1 @@
-SHA512 (Digest-1.17.tar.gz) = 2465f29a5d2fee9b8a9adbe7cf02541966a52d502fbb77392ec9839c8132c2f4499d2c47140316f2a1315dccc4d32f251056e02ce46b358632abb406c9197366
+SHA512 (Digest-1.19.tar.gz) = 97eb738d64571abdcf3cec74479e5bdebbdb4f9658ff483de863fdf47aac1a3d32c10f9ecc52bc58f6041da26e92254cec9fd5a76a3b1c2d96b406ccf48add93