CVS commit: pkgsrc/print/atril

["Maya Rashish" <maya%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   maya
Date:           Mon Oct 28 21:49:22 UTC 2019

Modified Files:
        pkgsrc/print/atril: Makefile options.mk

Log Message:
atril: don't enable dvi support by default. bump pkgrevision.

This option is pulling in t1lib. t1lib is an enormous security risk.
It hasn't seen maintenance since 2011 and we have local patches for
security issues from 2011.

Given the lack of attention, it's likely there are more security
issues lurking.

Documents are usually obtained from untrusted sources, and thus are
considered a remote attack vector
Documents may embed their own fonts. If one embeds a T1 font, it might
be parsed by this unmaintained library.

To avoid this risk, rip out the t1lib dependency.


To generate a diff of this commit:
cvs rdiff -u -r1.49 -r1.50 pkgsrc/print/atril/Makefile
cvs rdiff -u -r1.3 -r1.4 pkgsrc/print/atril/options.mk

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/print/atril/Makefile
diff -u pkgsrc/print/atril/Makefile:1.49 pkgsrc/print/atril/Makefile:1.50
--- pkgsrc/print/atril/Makefile:1.49    Sat Oct 19 12:46:06 2019
+++ pkgsrc/print/atril/Makefile Mon Oct 28 21:49:22 2019
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.49 2019/10/19 12:46:06 nia Exp $
+# $NetBSD: Makefile,v 1.50 2019/10/28 21:49:22 maya Exp $
 
-PKGREVISION= 5
+PKGREVISION= 6
 .include "../../meta-pkgs/mate/Makefile.common"
 
 DISTNAME=      atril-${VERSION:R}.1

Index: pkgsrc/print/atril/options.mk
diff -u pkgsrc/print/atril/options.mk:1.3 pkgsrc/print/atril/options.mk:1.4
--- pkgsrc/print/atril/options.mk:1.3   Wed Mar  6 05:48:55 2019
+++ pkgsrc/print/atril/options.mk       Mon Oct 28 21:49:22 2019
@@ -1,8 +1,8 @@
-# $NetBSD: options.mk,v 1.3 2019/03/06 05:48:55 gutteridge Exp $
+# $NetBSD: options.mk,v 1.4 2019/10/28 21:49:22 maya Exp $
 
 PKG_OPTIONS_VAR=       PKG_OPTIONS.atril
 PKG_SUPPORTED_OPTIONS= dbus pdf ps xps dvi djvu tiff gdk-pixbuf keyring introspection
-PKG_SUGGESTED_OPTIONS= dbus pdf ps xps dvi djvu tiff gdk-pixbuf keyring
+PKG_SUGGESTED_OPTIONS= dbus pdf ps xps djvu tiff gdk-pixbuf keyring
 
 .include "../../mk/bsd.options.mk"