CVS commit: pkgsrc/devel

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Sun Feb 21 12:47:16 UTC 2021

Modified Files:
        pkgsrc/devel/gdbus-codegen: distinfo
        pkgsrc/devel/glib2: Makefile.common PLIST distinfo

Log Message:
glib2 glib2-tools gdbus-codegen: updated to 2.66.7

Overview of changes in GLib 2.66.7
==================================

* Fix various regressions caused by rushed security fixes in 2.66.6
  (work by Simon McVittie and Jan Alexander Steffens) (!1933, !1943)

* Fix a silent integer truncation when calling `g_byte_array_new_take()` for
  byte arrays bigger than `G_MAXUINT` (work by Krzesimir Nowak) (!1944)

* Disallow using currently-undefined D-Bus connection or server flags to prevent
  forward-compatibility problems with new security-sensitive flags likely to be
  released in GLib 2.68 (work by Simon McVittie) (!1945)

* Bugs fixed:
 - !1933 [2.66] Fix regressions in 2.66.6 where negative gssize indicates strlen()
 - !1943 Backport !1941 “gkeyfilesettingsbackend: Fix basename handling when group is unset” to glib-2-66
 - !1944 Backport !1942 “gbytearray: Do not accept too large byte arrays” to glib-2-66
 - !1945 Backport !1934 “gdbus: Reject attempts to set future connection or server flags” to glib-2-66

Overview of changes in GLib 2.66.6
==================================

* Fix various instances within GLib where `g_memdup()` was vulnerable to a
  silent integer truncation and heap overflow problem (discovered by
  Kevin Backhouse, work by Philip Withnall)

* Bugs fixed:
 - !1927 Backport !1926 “Add g_memdup2()” to glib-2-66

Overview of changes in GLib 2.66.5
==================================

* Fix some issues with handling over-long (invalid) input when parsing for `GDate` (!1824)

* Don’t load GIO modules or parse other GIO environment variables when `AT_SECURE`
  is set (i.e. in a setuid/setgid/setcap process). GIO has always been
  documented as not being safe to use in privileged processes, but people persist
  in using it unsafely, so these changes should harden things against potential
  attacks at least a little. Unfortunately they break a couple of projects which
  were relying on reading `DBUS_SESSION_BUS_ADDRESS`, so GIO continues to read
  that for setgid/setcap (but not setuid) processes. This loophole will be closed
  in GLib 2.70 (see issue 2316), which should give modules 6 months to change
  their behaviour. (Work by Simon McVittie and Philip Withnall)

* Fix `g_spawn()` searching `PATH` when it wasn’t meant to (work by
  Simon McVittie and Thomas Haller) (!1913)

* Bugs fixed:
 - giomodule: Loads GIO modules even if setuid, etc.
 - g_private_replace ordering issue
 - GIO security hardening causing gnome-keyring to regress when session bus is provided by dbus-launch (dbus-x11)
 - gthread: Destroy value after replacing it in g_private_replace()
 - Backport !1821 “gdate: Limit length of dates which can be parsed as valid” to glib-2-66
 - gdatetime.c: Fix MSVC builds for lack of NAN items
 - Backport !1827 “Windows: fix FD_READ condition flag still set on recoverable UDP socket errors.” to glib-2-66
 - Backport !1862 “gio: Ignore various environment variables when running as setuid” to glib-2-66
 - Backport !1868 “gdesktopappinfo: Fix validation of XDG_CURRENT_DESKTOP” to glib-2-66
 - Backport !1902 “spawn: Don't set a search path if we don't want to search PATH” to glib-2-66
 - Backport !1920 “Resolve GDBus regressions in setcap/setgid programs” to glib-2-66


To generate a diff of this commit:
cvs rdiff -u -r1.17 -r1.18 pkgsrc/devel/gdbus-codegen/distinfo
cvs rdiff -u -r1.86 -r1.87 pkgsrc/devel/glib2/Makefile.common
cvs rdiff -u -r1.122 -r1.123 pkgsrc/devel/glib2/PLIST
cvs rdiff -u -r1.278 -r1.279 pkgsrc/devel/glib2/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/devel/gdbus-codegen/distinfo
diff -u pkgsrc/devel/gdbus-codegen/distinfo:1.17 pkgsrc/devel/gdbus-codegen/distinfo:1.18
--- pkgsrc/devel/gdbus-codegen/distinfo:1.17    Sun Dec 20 11:06:40 2020
+++ pkgsrc/devel/gdbus-codegen/distinfo Sun Feb 21 12:47:16 2021
@@ -1,7 +1,7 @@
-$NetBSD: distinfo,v 1.17 2020/12/20 11:06:40 prlw1 Exp $
+$NetBSD: distinfo,v 1.18 2021/02/21 12:47:16 adam Exp $
 
-SHA1 (glib-2.66.4.tar.xz) = a45268bb9adeb49563c16978c52b3bd5ac93ae0d
-RMD160 (glib-2.66.4.tar.xz) = f52c65cc249d8ae057a96cc9530bc434fdb6754c
-SHA512 (glib-2.66.4.tar.xz) = b3bc3e6e5cca793139848940e5c0894f1c7e3bd3a770b213a1ea548ac54a2432aebb140ed54518712fb8af36382b3b13d5f7ffd3d87ff63cba9e2f55434f7260
-Size (glib-2.66.4.tar.xz) = 4838124 bytes
+SHA1 (glib-2.66.7.tar.xz) = 734a6f1e1edb2292d08e658bfe7f49b41c7eb0c9
+RMD160 (glib-2.66.7.tar.xz) = 02df1bc4cd5f42968833c1e09e7179c57b6f47a1
+SHA512 (glib-2.66.7.tar.xz) = f6e6cc0fe2ab4a31a623bf9a1e63f833783e044e7ed55b66a84fc0cbf1410eec233fe0e226abb20aac0e40167a9624bf5e65197f9eed879da1293af44408d530
+Size (glib-2.66.7.tar.xz) = 4844892 bytes
 SHA1 (patch-meson.build) = 4f9d178950414e1537b48a552d63c9e551801999

Index: pkgsrc/devel/glib2/Makefile.common
diff -u pkgsrc/devel/glib2/Makefile.common:1.86 pkgsrc/devel/glib2/Makefile.common:1.87
--- pkgsrc/devel/glib2/Makefile.common:1.86     Sun Dec 20 11:06:40 2020
+++ pkgsrc/devel/glib2/Makefile.common  Sun Feb 21 12:47:16 2021
@@ -1,9 +1,9 @@
-# $NetBSD: Makefile.common,v 1.86 2020/12/20 11:06:40 prlw1 Exp $
+# $NetBSD: Makefile.common,v 1.87 2021/02/21 12:47:16 adam Exp $
 # used by devel/gdbus-codegen/Makefile
 # used by devel/glib2/Makefile
 # used by devel/glib2-tools/Makefile
 
-DISTNAME=      glib-2.66.4
+DISTNAME=      glib-2.66.7
 PKGNAME=       ${DISTNAME:S/glib/glib2/}
 MASTER_SITES=  ${MASTER_SITE_GNOME:=sources/glib/${PKGVERSION_NOREV:R}/}
 EXTRACT_SUFX=  .tar.xz

Index: pkgsrc/devel/glib2/PLIST
diff -u pkgsrc/devel/glib2/PLIST:1.122 pkgsrc/devel/glib2/PLIST:1.123
--- pkgsrc/devel/glib2/PLIST:1.122      Sun Dec 20 11:06:40 2020
+++ pkgsrc/devel/glib2/PLIST    Sun Feb 21 12:47:16 2021
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.122 2020/12/20 11:06:40 prlw1 Exp $
+@comment $NetBSD: PLIST,v 1.123 2021/02/21 12:47:16 adam Exp $
 ${PLIST.nococoa}bin/gapplication
 bin/gdbus
 bin/gio
@@ -282,19 +282,19 @@ ${PLIST.fam}lib/gio/modules/libgiofam.so
 lib/glib-2.0/include/glibconfig.h
 lib/libgio-2.0.so
 lib/libgio-2.0.so.0
-lib/libgio-2.0.so.0.6600.4
+lib/libgio-2.0.so.0.6600.7
 lib/libglib-2.0.so
 lib/libglib-2.0.so.0
-lib/libglib-2.0.so.0.6600.4
+lib/libglib-2.0.so.0.6600.7
 lib/libgmodule-2.0.so
 lib/libgmodule-2.0.so.0
-lib/libgmodule-2.0.so.0.6600.4
+lib/libgmodule-2.0.so.0.6600.7
 lib/libgobject-2.0.so
 lib/libgobject-2.0.so.0
-lib/libgobject-2.0.so.0.6600.4
+lib/libgobject-2.0.so.0.6600.7
 lib/libgthread-2.0.so
 lib/libgthread-2.0.so.0
-lib/libgthread-2.0.so.0.6600.4
+lib/libgthread-2.0.so.0.6600.7
 lib/pkgconfig/gio-2.0.pc
 lib/pkgconfig/gio-unix-2.0.pc
 lib/pkgconfig/glib-2.0.pc
@@ -306,8 +306,8 @@ lib/pkgconfig/gthread-2.0.pc
 share/aclocal/glib-2.0.m4
 share/aclocal/glib-gettext.m4
 share/aclocal/gsettings.m4
-share/gdb/auto-load${LOCALBASE}/lib/libglib-2.0.so.0.6600.4-gdb.py
-share/gdb/auto-load${LOCALBASE}/lib/libgobject-2.0.so.0.6600.4-gdb.py
+share/gdb/auto-load${LOCALBASE}/lib/libglib-2.0.so.0.6600.7-gdb.py
+share/gdb/auto-load${LOCALBASE}/lib/libgobject-2.0.so.0.6600.7-gdb.py
 share/gettext/its/gschema.its
 share/gettext/its/gschema.loc
 share/glib-2.0/gdb/glib_gdb.py

Index: pkgsrc/devel/glib2/distinfo
diff -u pkgsrc/devel/glib2/distinfo:1.278 pkgsrc/devel/glib2/distinfo:1.279
--- pkgsrc/devel/glib2/distinfo:1.278   Sun Dec 20 11:06:40 2020
+++ pkgsrc/devel/glib2/distinfo Sun Feb 21 12:47:16 2021
@@ -1,9 +1,9 @@
-$NetBSD: distinfo,v 1.278 2020/12/20 11:06:40 prlw1 Exp $
+$NetBSD: distinfo,v 1.279 2021/02/21 12:47:16 adam Exp $
 
-SHA1 (glib-2.66.4.tar.xz) = a45268bb9adeb49563c16978c52b3bd5ac93ae0d
-RMD160 (glib-2.66.4.tar.xz) = f52c65cc249d8ae057a96cc9530bc434fdb6754c
-SHA512 (glib-2.66.4.tar.xz) = b3bc3e6e5cca793139848940e5c0894f1c7e3bd3a770b213a1ea548ac54a2432aebb140ed54518712fb8af36382b3b13d5f7ffd3d87ff63cba9e2f55434f7260
-Size (glib-2.66.4.tar.xz) = 4838124 bytes
+SHA1 (glib-2.66.7.tar.xz) = 734a6f1e1edb2292d08e658bfe7f49b41c7eb0c9
+RMD160 (glib-2.66.7.tar.xz) = 02df1bc4cd5f42968833c1e09e7179c57b6f47a1
+SHA512 (glib-2.66.7.tar.xz) = f6e6cc0fe2ab4a31a623bf9a1e63f833783e044e7ed55b66a84fc0cbf1410eec233fe0e226abb20aac0e40167a9624bf5e65197f9eed879da1293af44408d530
+Size (glib-2.66.7.tar.xz) = 4844892 bytes
 SHA1 (patch-gio_gcredentialsprivate.h) = 6547edb518a98c3aca53acc1f98bde83e71b14cb
 SHA1 (patch-gio_gdbus-2.0_codegen_meson.build) = ec8ce89da08059ebf953d84a1dca5a2b380349f4
 SHA1 (patch-gio_giomodule.c) = d704699b2f457a08fff9219fe697e5fd2cc582ed