From 337cbdaa5541a54f64a606122cb827808588b1efe4be3c4fa27bdc81db63f2a9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B8rn=20Lie?= Date: Wed, 12 Jan 2022 21:28:39 +0000 Subject: [PATCH] Accepting request 945932 from home:AndreasStieger:branches:GNOME:Factory flatpak 1.12.3 CVE-2021-43860 boo#1194610 boo#1194611 OBS-URL: https://build.opensuse.org/request/show/945932 OBS-URL: https://build.opensuse.org/package/show/GNOME:Factory/flatpak?expand=0&rev=150 --- flatpak-1.12.2.tar.xz | 3 --- flatpak-1.12.3.tar.xz | 3 +++ flatpak.changes | 35 +++++++++++++++++++++++++++++++++++ flatpak.spec | 7 ++----- support-new-pyparsing.patch | 21 --------------------- 5 files changed, 40 insertions(+), 29 deletions(-) delete mode 100644 flatpak-1.12.2.tar.xz create mode 100644 flatpak-1.12.3.tar.xz delete mode 100644 support-new-pyparsing.patch diff --git a/flatpak-1.12.2.tar.xz b/flatpak-1.12.2.tar.xz deleted file mode 100644 index 4c60ee2..0000000 --- a/flatpak-1.12.2.tar.xz +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:df1eb464f9142c11627f99f04f6a5c02c868bbb145489b8902cb6c105e774b75 -size 1541068 diff --git a/flatpak-1.12.3.tar.xz b/flatpak-1.12.3.tar.xz new file mode 100644 index 0000000..bacfe9c --- /dev/null +++ b/flatpak-1.12.3.tar.xz @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:d715f23347d7eb859301c8f0c778a899bb7c9e26dac6ae2a2a4b9fc21cf77b69 +size 1555340 diff --git a/flatpak.changes b/flatpak.changes index fadcee7..8d8d33e 100644 --- a/flatpak.changes +++ b/flatpak.changes @@ -1,3 +1,38 @@ +------------------------------------------------------------------- +Wed Jan 12 20:40:35 UTC 2022 - Andreas Stieger + +- update to 1.12.3: + + CVE-2021-43860: a malicious repository could have sent invalid + application metadata in a way that hides some of the app + permissions displayed during installation (boo#1194610) + + flatpak-builder could allow --mirror-screenshots-url commands + to create directories outside of the build directory + (boo#1194611) + + Extra-data downloading now properly handles compressed + content-encodings which fixes checksum verification + + Note: In some corner case server setups this may require the + extra-data checksum to be changed + + Avoid unnecessary policy-kit dialog due to auto-pinning when + installing runtimes + + Better handling of updates of extensions that exist in multiple + repositories + + Fixed (initial) installation apps with renamed ids + + Fixed regression in updates from no-enumerate remotes + + We now verify checksums of summary caches, to better handle + local file corruption + + Improved cli output for non-terminal targets + + Flatpak run --session-bus now works + + Fix build with PyParsing >= 3.0.4 + dropping support-new-pyparsing.patch + + Fixed "Since" annotations on FlatpakTransaction signals + + bash auto completion now doesn't complete on command name + aliases + + Minor improvements to the search command + + Minor improvements to the list command + + Minor improvements to the repair command + + Add more tests + + Updated translations and docs + ------------------------------------------------------------------- Thu Dec 9 04:29:19 UTC 2021 - Steve Kowalik diff --git a/flatpak.spec b/flatpak.spec index daf49f8..0dbd0c5 100644 --- a/flatpak.spec +++ b/flatpak.spec @@ -1,7 +1,7 @@ # # spec file for package flatpak # -# Copyright (c) 2021 SUSE LLC +# Copyright (c) 2022 SUSE LLC # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -30,7 +30,7 @@ %define support_environment_generators 1 %endif Name: flatpak -Version: 1.12.2 +Version: 1.12.3 Release: 0 Summary: OSTree based application bundles management License: LGPL-2.1-or-later @@ -38,9 +38,6 @@ Group: System/Packages URL: https://flatpak.github.io/ Source0: https://github.com/flatpak/flatpak/releases/download/%{version}/%{name}-%{version}.tar.xz Patch0: polkit_rules_usability.patch -# https://github.com/flatpak/flatpak/issues/4534 -# https://gitlab.gnome.org/alexl/variant-schema-compiler/-/issues/4 -Patch1: support-new-pyparsing.patch BuildRequires: bison BuildRequires: bubblewrap >= 0.4.1 BuildRequires: docbook-xsl-stylesheets diff --git a/support-new-pyparsing.patch b/support-new-pyparsing.patch deleted file mode 100644 index 0c1d204..0000000 --- a/support-new-pyparsing.patch +++ /dev/null @@ -1,21 +0,0 @@ -Index: flatpak-1.12.2/subprojects/variant-schema-compiler/variant-schema-compiler -=================================================================== ---- flatpak-1.12.2.orig/subprojects/variant-schema-compiler/variant-schema-compiler -+++ flatpak-1.12.2/subprojects/variant-schema-compiler/variant-schema-compiler -@@ -4,6 +4,7 @@ import argparse - import sys - import os - from pyparsing import * -+pyparsing_version = tuple(int(x) for x in __version__.split('.')) - - typename_prefix = "" - funcname_prefix = "" -@@ -1741,6 +1742,8 @@ def handleNameableType(toks): - return type - - nameableType = (Optional((Suppress("'") + ident).leaveWhitespace()) + (arrayType ^ maybeType ^ dictType ^ structType)).setParseAction(handleNameableType) -+if pyparsing_version >= (3, 0, 4): -+ nameableType = (Optional((Suppress("'") + ident)) + (arrayType ^ maybeType ^ dictType ^ structType)).setParseAction(handleNameableType) - - typeSpec <<= basicType ^ variantType ^ namedType ^ nameableType -