Accepting request 945932 from home:AndreasStieger:branches:GNOME:Factory

flatpak 1.12.3
CVE-2021-43860 boo#1194610
boo#1194611

OBS-URL: https://build.opensuse.org/request/show/945932
OBS-URL: https://build.opensuse.org/package/show/GNOME:Factory/flatpak?expand=0&rev=150

flatpak-1.12.2.tar.xz

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:df1eb464f9142c11627f99f04f6a5c02c868bbb145489b8902cb6c105e774b75
-size 1541068

flatpak-1.12.3.tar.xz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:d715f23347d7eb859301c8f0c778a899bb7c9e26dac6ae2a2a4b9fc21cf77b69
+size 1555340

flatpak.changes

@@ -1,3 +1,38 @@
+-------------------------------------------------------------------
+Wed Jan 12 20:40:35 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>
+
+- update to 1.12.3:
+  + CVE-2021-43860: a malicious repository could have sent invalid
+    application metadata in a way that hides some of the app
+    permissions displayed during installation (boo#1194610)
+  + flatpak-builder could allow --mirror-screenshots-url commands
+    to create directories outside of the build directory
+    (boo#1194611)
+  + Extra-data downloading now properly handles compressed
+    content-encodings which fixes checksum verification 
+  + Note: In some corner case server setups this may require the
+    extra-data checksum to be changed
+  + Avoid unnecessary policy-kit dialog due to auto-pinning when
+    installing runtimes
+  + Better handling of updates of extensions that exist in multiple
+    repositories
+  + Fixed (initial) installation apps with renamed ids
+  + Fixed regression in updates from no-enumerate remotes
+  + We now verify checksums of summary caches, to better handle
+    local file corruption
+  + Improved cli output for non-terminal targets
+  + Flatpak run --session-bus now works
+  + Fix build with PyParsing >= 3.0.4
+    dropping support-new-pyparsing.patch
+  + Fixed "Since" annotations on FlatpakTransaction signals
+  + bash auto completion now doesn't complete on command name
+    aliases
+  + Minor improvements to the search command
+  + Minor improvements to the list command
+  + Minor improvements to the repair command
+  + Add more tests
+  + Updated translations and docs
+
 -------------------------------------------------------------------
 Thu Dec  9 04:29:19 UTC 2021 - Steve Kowalik <steven.kowalik@suse.com>
 

flatpak.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package flatpak
 #
-# Copyright (c) 2021 SUSE LLC
+# Copyright (c) 2022 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -30,7 +30,7 @@
 %define support_environment_generators 1
 %endif
 Name:           flatpak
-Version:        1.12.2
+Version:        1.12.3
 Release:        0
 Summary:        OSTree based application bundles management
 License:        LGPL-2.1-or-later
@@ -38,9 +38,6 @@ Group:          System/Packages
 URL:            https://flatpak.github.io/
 Source0:        https://github.com/flatpak/flatpak/releases/download/%{version}/%{name}-%{version}.tar.xz
 Patch0:         polkit_rules_usability.patch
-# https://github.com/flatpak/flatpak/issues/4534
-# https://gitlab.gnome.org/alexl/variant-schema-compiler/-/issues/4
-Patch1:         support-new-pyparsing.patch
 BuildRequires:  bison
 BuildRequires:  bubblewrap >= 0.4.1
 BuildRequires:  docbook-xsl-stylesheets

support-new-pyparsing.patch

@@ -1,21 +0,0 @@
-Index: flatpak-1.12.2/subprojects/variant-schema-compiler/variant-schema-compiler
-===================================================================
---- flatpak-1.12.2.orig/subprojects/variant-schema-compiler/variant-schema-compiler
-+++ flatpak-1.12.2/subprojects/variant-schema-compiler/variant-schema-compiler
-@@ -4,6 +4,7 @@ import argparse
- import sys
- import os
- from pyparsing import *
-+pyparsing_version = tuple(int(x) for x in __version__.split('.'))
- 
- typename_prefix = ""
- funcname_prefix = ""
-@@ -1741,6 +1742,8 @@ def handleNameableType(toks):
-     return type
- 
- nameableType = (Optional((Suppress("'") + ident).leaveWhitespace()) + (arrayType ^ maybeType ^ dictType ^ structType)).setParseAction(handleNameableType)
-+if pyparsing_version >= (3, 0, 4):
-+    nameableType = (Optional((Suppress("'") + ident)) + (arrayType ^ maybeType ^ dictType ^ structType)).setParseAction(handleNameableType)
- 
- typeSpec <<= basicType  ^ variantType ^ namedType ^ nameableType
-