pool/qt6-base
SHA256
4
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add fix for CVE-2024-39936

Browse Source 
OBS-URL: https://build.opensuse.org/package/show/KDE:Qt6/qt6-base?expand=0&rev=112
This commit is contained in:
Christophe Marin 2024-07-06 11:24:02 +00:00 committed by Git OBS Bridge
commit 8f0aa72f44
12 changed files with 2352 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
.gitattributes vendored Normal file
View File

@ -0,0 +1,23 @@
## Default LFS
*.7z filter=lfs diff=lfs merge=lfs -text
*.bsp filter=lfs diff=lfs merge=lfs -text
*.bz2 filter=lfs diff=lfs merge=lfs -text
*.gem filter=lfs diff=lfs merge=lfs -text
*.gz filter=lfs diff=lfs merge=lfs -text
*.jar filter=lfs diff=lfs merge=lfs -text
*.lz filter=lfs diff=lfs merge=lfs -text
*.lzma filter=lfs diff=lfs merge=lfs -text
*.obscpio filter=lfs diff=lfs merge=lfs -text
*.oxt filter=lfs diff=lfs merge=lfs -text
*.pdf filter=lfs diff=lfs merge=lfs -text
*.png filter=lfs diff=lfs merge=lfs -text
*.rpm filter=lfs diff=lfs merge=lfs -text
*.tbz filter=lfs diff=lfs merge=lfs -text
*.tbz2 filter=lfs diff=lfs merge=lfs -text
*.tgz filter=lfs diff=lfs merge=lfs -text
*.ttf filter=lfs diff=lfs merge=lfs -text
*.txz filter=lfs diff=lfs merge=lfs -text
*.whl filter=lfs diff=lfs merge=lfs -text
*.xz filter=lfs diff=lfs merge=lfs -text
*.zip filter=lfs diff=lfs merge=lfs -text
*.zst filter=lfs diff=lfs merge=lfs -text

1
.gitignore vendored Normal file
View File

@ -0,0 +1 @@
.osc

52
0001-CMake-Install-objects-files-into-ARCHDATADIR.patch Normal file
View File

@ -0,0 +1,52 @@
From 4e517492a03b6c0b710a2d9a3df05922ac233992 Mon Sep 17 00:00:00 2001
From: Christophe Marin <christophe@krop.fr>
Date: Wed, 24 May 2023 11:23:39 +0200
Subject: [PATCH] CMake: Install objects files into 'ARCHDATADIR'
Change-Id: I917a9ef4d83f93eb5c3e47964bf1814d1b53fdab
---
cmake/QtResourceHelpers.cmake | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/cmake/QtResourceHelpers.cmake b/cmake/QtResourceHelpers.cmake
index 2df1fed50f..e4f34b5ff1 100644
--- a/cmake/QtResourceHelpers.cmake
+++ b/cmake/QtResourceHelpers.cmake
@@ -38,7 +38,7 @@ function(qt_internal_add_resource target resourceName)
if (out_targets)
qt_install(TARGETS ${out_targets}
EXPORT "${INSTALL_CMAKE_NAMESPACE}${target}Targets"
- DESTINATION "${INSTALL_LIBDIR}"
+ DESTINATION "${INSTALL_ARCHDATADIR}"
)
qt_internal_add_targets_to_additional_targets_export_file(
TARGETS ${out_targets}
@@ -47,7 +47,7 @@ function(qt_internal_add_resource target resourceName)
qt_internal_install_resource_pdb_files("${out_targets}")
qt_internal_record_rcc_object_files("${target}" "${out_targets}"
- INSTALL_DIRECTORY "${INSTALL_LIBDIR}")
+ INSTALL_DIRECTORY "${INSTALL_ARCHDATADIR}")
endif()
if (arg_OUTPUT_TARGETS)
@@ -77,7 +77,7 @@ function(qt_internal_record_rcc_object_files target resource_targets)
# It's comprised of thee following path parts:
#
# part (1) INSTALL_DIRECTORY.
- # A usual value is '${INSTALL_LIBDIR}/' for libraries
+ # A usual value is '${INSTALL_ARCHDATADIR}/' for libraries
# and '${INSTALL_QMLDIR}/foo/bar/' for qml plugin resources.
#
# part (2) the value computed by CMake's computeInstallObjectDir comprised of an
@@ -128,6 +128,6 @@ function(qt_internal_install_resource_pdb_files objlib_targets)
_qt_resource_generated_cpp_relative_path)
get_filename_component(rel_obj_file_dir "${generated_cpp_file_relative_path}" DIRECTORY)
qt_internal_install_pdb_files(${target}
- "${INSTALL_LIBDIR}/objects-$<CONFIG>/${target}/${rel_obj_file_dir}")
+ "${INSTALL_ARCHDATADIR}/objects-$<CONFIG>/${target}/${rel_obj_file_dir}")
endforeach()
endfunction()
--
2.40.1

39
0001-Don-t-strip-binaries-when-building-with-qmake.patch Normal file
View File

@ -0,0 +1,39 @@
From e43300d226ca98dbda1b1b69c3a1aaf8543f0a16 Mon Sep 17 00:00:00 2001
From: Christophe Marin <christophe@krop.fr>
Date: Wed, 4 Oct 2023 09:24:42 +0200
Subject: [PATCH] Don't strip binaries when building with qmake
Change-Id: I134f83b0a4fb1636d15f527585f8e9c9892f9057
---
mkspecs/common/gcc-base.conf | 2 ++
mkspecs/common/linux.conf | 4 ++--
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/mkspecs/common/gcc-base.conf b/mkspecs/common/gcc-base.conf
index ae58326289..3a686cf18c 100644
--- a/mkspecs/common/gcc-base.conf
+++ b/mkspecs/common/gcc-base.conf
@@ -31,6 +31,8 @@
# you can use the manual test in tests/manual/mkspecs.
#
+CONFIG += nostrip
+
QMAKE_CFLAGS_OPTIMIZE = -O2
QMAKE_CFLAGS_OPTIMIZE_FULL = -O3
QMAKE_CFLAGS_OPTIMIZE_DEBUG = -Og
diff --git a/mkspecs/common/linux.conf b/mkspecs/common/linux.conf
index 544cc22715..b809cffeeb 100644
--- a/mkspecs/common/linux.conf
+++ b/mkspecs/common/linux.conf
@@ -48,5 +48,5 @@ QMAKE_OBJCOPY = objcopy
QMAKE_NM = nm -P
QMAKE_RANLIB =
-QMAKE_STRIP = strip
-QMAKE_STRIPFLAGS_LIB += --strip-unneeded
+QMAKE_STRIP =
+QMAKE_STRIPFLAGS_LIB +=
--
2.42.0

244
0001-HTTP2-Delay-any-communication-until-encrypted-can-be.patch Normal file
View File

@ -0,0 +1,244 @@
From 2b1e36e183ce75c224305c7a94457b92f7a5cf58 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=C3=A5rten=20Nordheim?= <marten.nordheim@qt.io>
Date: Tue, 25 Jun 2024 17:09:35 +0200
Subject: [PATCH] HTTP2: Delay any communication until encrypted() can be
responded to
We have the encrypted() signal that lets users do extra checks on the
established connection. It is emitted as BlockingQueued, so the HTTP
thread stalls until it is done emitting. Users can potentially call
abort() on the QNetworkReply at that point, which is passed as a Queued
call back to the HTTP thread. That means that any currently queued
signal emission will be processed before the abort() call is processed.
In the case of HTTP2 it is a little special since it is multiplexed and
the code is built to start requests as they are available. This means
that, while the code worked fine for HTTP1, since one connection only
has one request, it is not working for HTTP2, since we try to send more
requests in-between the encrypted() signal and the abort() call.
This patch changes the code to delay any communication until the
encrypted() signal has been emitted and processed, for HTTP2 only.
It's done by adding a few booleans, both to know that we have to return
early and so we can keep track of what events arose and what we need to
resume once enough time has passed that any abort() call must have been
processed.
Fixes: QTBUG-126610
Pick-to: 6.5 6.2 5.15 5.12
Change-Id: Ic25a600c278203256e35f541026f34a8783235ae
Reviewed-by: Marc Mutz <marc.mutz@qt.io>
Reviewed-by: Volker Hilsheimer <volker.hilsheimer@qt.io>
(cherry picked from commit b1e75376cc3adfc7da5502a277dfe9711f3e0536)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
(cherry picked from commit 0fb43e4395da34d561814242a0186999e4956e28)
---
src/network/access/qhttp2protocolhandler.cpp | 6 +--
.../access/qhttpnetworkconnectionchannel.cpp | 48 ++++++++++++++++++-
.../access/qhttpnetworkconnectionchannel_p.h | 6 +++
tests/auto/network/access/http2/tst_http2.cpp | 44 +++++++++++++++++
4 files changed, 99 insertions(+), 5 deletions(-)
diff --git a/src/network/access/qhttp2protocolhandler.cpp b/src/network/access/qhttp2protocolhandler.cpp
index 0abd99b9bc..3631b13dc8 100644
--- a/src/network/access/qhttp2protocolhandler.cpp
+++ b/src/network/access/qhttp2protocolhandler.cpp
@@ -303,12 +303,12 @@ bool QHttp2ProtocolHandler::sendRequest()
}
}
- if (!prefaceSent && !sendClientPreface())
- return false;
-
if (!requests.size())
return true;
+ if (!prefaceSent && !sendClientPreface())
+ return false;
+
m_channel->state = QHttpNetworkConnectionChannel::WritingState;
// Check what was promised/pushed, maybe we do not have to send a request
// and have a response already?
diff --git a/src/network/access/qhttpnetworkconnectionchannel.cpp b/src/network/access/qhttpnetworkconnectionchannel.cpp
index 6766989690..1e4161d1fd 100644
--- a/src/network/access/qhttpnetworkconnectionchannel.cpp
+++ b/src/network/access/qhttpnetworkconnectionchannel.cpp
@@ -209,6 +209,10 @@ void QHttpNetworkConnectionChannel::abort()
bool QHttpNetworkConnectionChannel::sendRequest()
{
Q_ASSERT(protocolHandler);
+ if (waitingForPotentialAbort) {
+ needInvokeSendRequest = true;
+ return false; // this return value is unused
+ }
return protocolHandler->sendRequest();
}
@@ -221,21 +225,28 @@ bool QHttpNetworkConnectionChannel::sendRequest()
void QHttpNetworkConnectionChannel::sendRequestDelayed()
{
QMetaObject::invokeMethod(this, [this] {
- Q_ASSERT(protocolHandler);
if (reply)
- protocolHandler->sendRequest();
+ sendRequest();
}, Qt::ConnectionType::QueuedConnection);
}
void QHttpNetworkConnectionChannel::_q_receiveReply()
{
Q_ASSERT(protocolHandler);
+ if (waitingForPotentialAbort) {
+ needInvokeReceiveReply = true;
+ return;
+ }
protocolHandler->_q_receiveReply();
}
void QHttpNetworkConnectionChannel::_q_readyRead()
{
Q_ASSERT(protocolHandler);
+ if (waitingForPotentialAbort) {
+ needInvokeReadyRead = true;
+ return;
+ }
protocolHandler->_q_readyRead();
}
@@ -1239,7 +1250,18 @@ void QHttpNetworkConnectionChannel::_q_encrypted()
if (!h2RequestsToSend.isEmpty()) {
// Similar to HTTP/1.1 counterpart below:
const auto &pair = std::as_const(h2RequestsToSend).first();
+ waitingForPotentialAbort = true;
emit pair.second->encrypted();
+
+ // We don't send or handle any received data until any effects from
+ // emitting encrypted() have been processed. This is necessary
+ // because the user may have called abort(). We may also abort the
+ // whole connection if the request has been aborted and there is
+ // no more requests to send.
+ QMetaObject::invokeMethod(this,
+ &QHttpNetworkConnectionChannel::checkAndResumeCommunication,
+ Qt::QueuedConnection);
+
// In case our peer has sent us its settings (window size, max concurrent streams etc.)
// let's give _q_receiveReply a chance to read them first ('invokeMethod', QueuedConnection).
}
@@ -1257,6 +1279,28 @@ void QHttpNetworkConnectionChannel::_q_encrypted()
QMetaObject::invokeMethod(connection, "_q_startNextRequest", Qt::QueuedConnection);
}
+
+void QHttpNetworkConnectionChannel::checkAndResumeCommunication()
+{
+ Q_ASSERT(connection->connectionType() == QHttpNetworkConnection::ConnectionTypeHTTP2
+ || connection->connectionType() == QHttpNetworkConnection::ConnectionTypeHTTP2Direct);
+
+ // Because HTTP/2 requires that we send a SETTINGS frame as the first thing we do, and respond
+ // to a SETTINGS frame with an ACK, we need to delay any handling until we can ensure that any
+ // effects from emitting encrypted() have been processed.
+ // This function is called after encrypted() was emitted, so check for changes.
+
+ if (!reply && h2RequestsToSend.isEmpty())
+ abort();
+ waitingForPotentialAbort = false;
+ if (needInvokeReadyRead)
+ _q_readyRead();
+ if (needInvokeReceiveReply)
+ _q_receiveReply();
+ if (needInvokeSendRequest)
+ sendRequest();
+}
+
void QHttpNetworkConnectionChannel::requeueHttp2Requests()
{
const auto h2RequestsToSendCopy = std::exchange(h2RequestsToSend, {});
diff --git a/src/network/access/qhttpnetworkconnectionchannel_p.h b/src/network/access/qhttpnetworkconnectionchannel_p.h
index c42290feca..061f20fd42 100644
--- a/src/network/access/qhttpnetworkconnectionchannel_p.h
+++ b/src/network/access/qhttpnetworkconnectionchannel_p.h
@@ -74,6 +74,10 @@ public:
QAbstractSocket *socket;
bool ssl;
bool isInitialized;
+ bool waitingForPotentialAbort = false;
+ bool needInvokeReceiveReply = false;
+ bool needInvokeReadyRead = false;
+ bool needInvokeSendRequest = false;
ChannelState state;
QHttpNetworkRequest request; // current request, only used for HTTP
QHttpNetworkReply *reply; // current reply for this request, only used for HTTP
@@ -146,6 +150,8 @@ public:
void closeAndResendCurrentRequest();
void resendCurrentRequest();
+ void checkAndResumeCommunication();
+
bool isSocketBusy() const;
bool isSocketWriting() const;
bool isSocketWaiting() const;
diff --git a/tests/auto/network/access/http2/tst_http2.cpp b/tests/auto/network/access/http2/tst_http2.cpp
index 00efbc9832..c02e7b7b5b 100644
--- a/tests/auto/network/access/http2/tst_http2.cpp
+++ b/tests/auto/network/access/http2/tst_http2.cpp
@@ -106,6 +106,8 @@ private slots:
void duplicateRequestsWithAborts();
+ void abortOnEncrypted();
+
protected slots:
// Slots to listen to our in-process server:
void serverStarted(quint16 port);
@@ -1479,6 +1481,48 @@ void tst_Http2::duplicateRequestsWithAborts()
QCOMPARE(finishedCount, ExpectedSuccessfulRequests);
}
+void tst_Http2::abortOnEncrypted()
+{
+#if !QT_CONFIG(ssl)
+ QSKIP("TLS support is needed for this test");
+#else
+ clearHTTP2State();
+ serverPort = 0;
+
+ ServerPtr targetServer(newServer(defaultServerSettings, H2Type::h2Direct));
+
+ QMetaObject::invokeMethod(targetServer.data(), "startServer", Qt::QueuedConnection);
+ runEventLoop();
+
+ nRequests = 1;
+ nSentRequests = 0;
+
+ const auto url = requestUrl(H2Type::h2Direct);
+ QNetworkRequest request(url);
+ request.setAttribute(QNetworkRequest::Http2DirectAttribute, true);
+
+ std::unique_ptr<QNetworkReply> reply{manager->get(request)};
+ reply->ignoreSslErrors();
+ connect(reply.get(), &QNetworkReply::encrypted, reply.get(), [reply = reply.get()](){
+ reply->abort();
+ });
+ connect(reply.get(), &QNetworkReply::errorOccurred, this, &tst_Http2::replyFinishedWithError);
+
+ runEventLoop();
+ STOP_ON_FAILURE
+
+ QCOMPARE(nRequests, 0);
+ QCOMPARE(reply->error(), QNetworkReply::OperationCanceledError);
+
+ const bool res = QTest::qWaitFor(
+ [this, server = targetServer.get()]() {
+ return serverGotSettingsACK || prefaceOK || nSentRequests > 0;
+ },
+ 500);
+ QVERIFY(!res);
+#endif // QT_CONFIG(ssl)
+}
+
void tst_Http2::serverStarted(quint16 port)
{
serverPort = port;
--
2.45.2

54
0001-Use-newer-GCC-on-Leap.patch Normal file
View File

@ -0,0 +1,54 @@
From 793c4c0d728024139083660a7f382f6d95853efe Mon Sep 17 00:00:00 2001
From: Christophe Marin <christophe@krop.fr>
Date: Sun, 6 Jun 2021 10:44:09 +0200
Subject: [PATCH] Use newer GCC on Leap.patch
The default compiler in Leap doesn't match the Qt requirements.
Use the latest compiler version available on Leap.
Change-Id: I0c4ad87af4dd60d12fa09366eb9910edafcc9c4c
---
mkspecs/common/g++-base.conf | 6 +++---
mkspecs/common/gcc-base.conf | 4 ++--
2 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/mkspecs/common/g++-base.conf b/mkspecs/common/g++-base.conf
index d392879..ddca128 100644
--- a/mkspecs/common/g++-base.conf
+++ b/mkspecs/common/g++-base.conf
@@ -8,14 +8,14 @@
# you can use the manual test in tests/manual/mkspecs.
#
-QMAKE_COMPILER = gcc
+QMAKE_COMPILER = gcc-13
-QMAKE_CC = $${CROSS_COMPILE}gcc
+QMAKE_CC = $${CROSS_COMPILE}gcc-13
QMAKE_LINK_C = $$QMAKE_CC
QMAKE_LINK_C_SHLIB = $$QMAKE_CC
-QMAKE_CXX = $${CROSS_COMPILE}g++
+QMAKE_CXX = $${CROSS_COMPILE}g++-13
QMAKE_LINK = $$QMAKE_CXX
QMAKE_LINK_SHLIB = $$QMAKE_CXX
diff --git a/mkspecs/common/gcc-base.conf b/mkspecs/common/gcc-base.conf
index ae58326..33cc860 100644
--- a/mkspecs/common/gcc-base.conf
+++ b/mkspecs/common/gcc-base.conf
@@ -124,8 +124,8 @@ QMAKE_CFLAGS_MIPS_DSPR2 += -mdspr2
QMAKE_CFLAGS_ARCH_HASWELL = -march=core-avx2
# Wrapper tools that understand .o/.a files with GIMPLE instead of machine code
-QMAKE_AR_LTCG = gcc-ar cqs
-QMAKE_NM_LTCG = gcc-nm -P
+QMAKE_AR_LTCG = gcc-ar-13 cqs
+QMAKE_NM_LTCG = gcc-nm-13 -P
QMAKE_RANLIB_LTCG = true # No need to run since gcc-ar has "s"
QMAKE_LINK_OBJECT_SCRIPT = object_script
--
2.43.0

37
_constraints Normal file
View File

@ -0,0 +1,37 @@
<?xml version="1.0" encoding="UTF-8"?>
<constraints>
<hardware>
<disk>
<size unit="G">12</size>
</disk>
<memory>
<size unit="G">4</size>
</memory>
<processors>4</processors>
</hardware>
<overwrite>
<conditions>
<arch>ppc64</arch>
<arch>ppc64le</arch>
</conditions>
<hardware>
<memory>
<size unit="G">5</size>
</memory>
</hardware>
</overwrite>
<!-- relax constraints for qt6-base:docs -->
<overwrite>
<conditions>
<package>qt6-base:docs</package>
</conditions>
<hardware>
<disk>
<size unit="G">3</size>
</disk>
<memory>
<size unit="G">2</size>
</memory>
</hardware>
</overwrite>
</constraints>

4
_multibuild Normal file
View File

@ -0,0 +1,4 @@
<multibuild>
<flavor>docs</flavor>
</multibuild>

12
qt6-base-rpmlintrc Normal file
View File

@ -0,0 +1,12 @@
# using fdupes on include directories means looking for troubles
addFilter("files-duplicated-waste .*")
addFilter("files-duplicate .*")
# library and development package names don't match
addFilter("no-dependency-on .*")
# Only libraries used at link time are guaranteed to work
addFilter("shlib-fixed-dependency .*")
# libQt6ExampleIcons.a only contains embedded icons, there's nothing to extract
addFilter("lto-no-text-in-archive .*libQt6ExampleIcons.a")

596
qt6-base.changes Normal file
View File

@ -0,0 +1,596 @@
-------------------------------------------------------------------
Sat Jul 6 11:22:52 UTC 2024 - Christophe Marin <christophe@krop.fr>
- Add upstream change (boo#1227426, CVE-2024-39936)
* 0001-HTTP2-Delay-any-communication-until-encrypted-can-be.patch
-------------------------------------------------------------------
Wed Jun 19 07:25:37 UTC 2024 - Christophe Marin <christophe@krop.fr>
- Update to 6.7.2:
* https://www.qt.io/blog/qt-6.7.2-released
-------------------------------------------------------------------
Tue May 21 08:31:24 UTC 2024 - Christophe Marin <christophe@krop.fr>
- Update to 6.7.1:
* https://www.qt.io/blog/qt-6.7.1-released
- Build with system md4c when possible
- Drop patches, merged upstream:
* fix_builds_with_Werror.patch
* 0001-QStringConverterICU-Pass-correct-pointer-to-callback.patch
* 0001-CMake-ELF-allow-using-Qt-s-full-version-number-in-th.patch
-------------------------------------------------------------------
Fri May 3 07:15:23 UTC 2024 - Christophe Marin <christophe@krop.fr>
- Add upstream security fix (CVE-2024-33861, boo#1223917):
* 0001-QStringConverterICU-Pass-correct-pointer-to-callback.patch
-------------------------------------------------------------------
Tue Apr 2 13:39:34 UTC 2024 - Christophe Marin <christophe@krop.fr>
- Update to 6.7.0:
* https://www.qt.io/blog/qt-6.7-released
- Replace 0001-Tell-the-truth-about-private-API.patch with
upstream change:
* 0001-CMake-ELF-allow-using-Qt-s-full-version-number-in-th.patch
- Add upstream fix (QTBUG-123937):
* fix_builds_with_Werror.patch
-------------------------------------------------------------------
Tue Mar 26 14:25:22 UTC 2024 - Christophe Marin <christophe@krop.fr>
- Update to 6.6.3:
* https://www.qt.io/blog/qt-6.6.3-released
* Includes fix for issue where the wasm component may access
QNetworkReply header data via a dangling pointer
(CVE-2024-30161, bsc#1221926, QTBUG-122893)
- Make libQt6PrintSupport6 require qt6-printsupport-cups
(boo#1221576)
-------------------------------------------------------------------
Thu Mar 21 14:56:42 UTC 2024 - Christophe Marin <christophe@krop.fr>
- Replace the postgresql-server build dependency with the client library
-------------------------------------------------------------------
Wed Feb 14 16:53:08 UTC 2024 - Christophe Marin <christophe@krop.fr>
- Update to 6.6.2
* https://www.qt.io/blog/qt-6.6.2-released
* Fix for potential buffer overflow when reading KTX
images (boo#1219996, CVE-2024-25580)
- Drop patches, merged upstream:
* 0001-QMimeDatabase-handle-buggy-type-definitions.patch
* 0001-QMimeDatabase-collect-glob-patterns-from.patch
* 0001-HPack-fix-a-Yoda-Condition.patch
* 0002-HPack-fix-incorrect-integer-overflow-check.patch
* 0001-Http2-fix-potential-overflow-in-assemble_hpack_block.patch
-------------------------------------------------------------------
Wed Jan 31 14:51:31 UTC 2024 - Christophe Marin <christophe@krop.fr>
- Switch to the latest GCC version available in Leap
- Replace 0001-Require-GCC-12.patch with 0001-Use-newer-GCC-on-Leap.patch
-------------------------------------------------------------------
Wed Jan 3 08:52:06 UTC 2024 - Antonio Larrosa <alarrosa@suse.com>
- Add upstream patches to fix an incorrect integer overflow check
(boo#1218413, CVE-2023-51714):
* 0001-HPack-fix-a-Yoda-Condition.patch
* 0002-HPack-fix-incorrect-integer-overflow-check.patch
- Add upstream patch to fix a potential overflow in
assemble_hpack_block():
* 0001-Http2-fix-potential-overflow-in-assemble_hpack_block.patch
-------------------------------------------------------------------
Sat Dec 30 14:51:31 UTC 2023 - Luca Beltrame <lbeltrame@kde.org>
- Add upstream patch for a bug in QMimeDatabase which makes
impossible to save JPEG files in Qt6 applications:
* 0001-QMimeDatabase-collect-glob-patterns-from.patch
* https://code.qt.io/cgit/qt/qtbase.git/commit/?id=4e9944e6c8a456353d243ab268cb0f01ff006faa
-------------------------------------------------------------------
Mon Dec 4 19:11:49 UTC 2023 - Kacper Koniuszy <kacper.koniuszy@tuta.io>
- Add upstream patch for a bug in QMimeDatabase that causes some
applications to hang:
* 0001-QMimeDatabase-handle-buggy-type-definitions.patch
* https://code.qt.io/cgit/qt/qtbase.git/commit/?id=54656da9ace06caf4a0eeb1832989c0ab211a4a0
-------------------------------------------------------------------
Mon Nov 27 14:00:05 UTC 2023 - Christophe Marin <christophe@krop.fr>
- Update to 6.6.1:
* https://www.qt.io/blog/qt-6.6.1-released
- Drop patches, merged upstream:
* 0001-xcb-replace-a-warning-with-debug-info-in-qxcbconnect.patch
* 0001-a11y-fix-race-condition-on-atspi-startup-on-Wayland.patch
* 0001-xkb-fix-build-with-libxkbcommon-1.6.0-and-later.patch
-------------------------------------------------------------------
Thu Nov 16 09:14:40 UTC 2023 - Christophe Marin <christophe@krop.fr>
- Make libQt6Network6 require the network plugins
-------------------------------------------------------------------
Fri Nov 3 11:34:03 UTC 2023 - Christophe Marin <christophe@krop.fr>
- Add upstream changes:
* 0001-xcb-replace-a-warning-with-debug-info-in-qxcbconnect.patch (QTBUG-117820)
* 0001-a11y-fix-race-condition-on-atspi-startup-on-Wayland.patch
- Turn FEATURE_forkfd_pidfd off until QTBUG-117954 gets fixed
-------------------------------------------------------------------
Wed Oct 25 14:16:30 UTC 2023 - Christophe Marin <christophe@krop.fr>
- Add upstream change:
* 0001-xkb-fix-build-with-libxkbcommon-1.6.0-and-later.patch
-------------------------------------------------------------------
Tue Oct 10 09:39:48 UTC 2023 - Christophe Marin <christophe@krop.fr>
- Update to 6.6.0
* https://www.qt.io/blog/qt-6.6-released
-------------------------------------------------------------------
Wed Oct 4 07:25:51 UTC 2023 - Christophe Marin <christophe@krop.fr>
- Add patch to fix creation of -debuginfo packages for qmake builds:
* 0001-Don-t-strip-binaries-when-building-with-qmake.patch
-------------------------------------------------------------------
Thu Sep 28 07:34:06 UTC 2023 - Christophe Marin <christophe@krop.fr>
- Update to 6.5.3
* https://www.qt.io/blog/qt-6.5.3-released
- Drop patch, merged upstream:
* CVE-2023-38197-qtbase-6.5.diff
- Enable the experimental native painting feature to improve
remote desktop performances (boo#1214915)
exporting QT_XCB_NATIVE_PAINTING is required to use the feature.
-------------------------------------------------------------------
Thu Jul 20 08:34:44 UTC 2023 - Christophe Marin <christophe@krop.fr>
- Use a mirror to download sources for all Qt packages. Upstream
servers are very slow since a couple weeks.
- Update to 6.5.2
* https://www.qt.io/blog/qt-6.5.2-released-1
* Includes fix for a buffer overflow in QXmlStreamReader
(boo#1214327, CVE-2023-37369).
- Drop patches, merged upstream:
* 0001-Schannel-Reject-certificate-not-signed-by-a-configur.patch
* 0001-Ssl-Copy-the-on-demand-cert-loading-bool-from-defaul.patch
* 0001-tabbar-fix.patch
- Add patch:
* CVE-2023-38197-qtbase-6.5.diff (boo#1213326, CVE-2023-38197)
-------------------------------------------------------------------
Fri Jun 30 15:13:07 UTC 2023 - Christophe Marin <christophe@krop.fr>
- Update subpackages requirements
-------------------------------------------------------------------
Thu Jun 29 11:13:42 UTC 2023 - Christophe Marin <christophe@krop.fr>
- Replace 0001-Require-GCC-10.patch with 0001-Require-GCC-12.patch
-------------------------------------------------------------------
Wed Jun 7 17:58:46 UTC 2023 - Jonas Kvinge <jonaski@opensuse.org>
- Add patch for QTabBar regression in Qt 6.5.1 (QTBUG-114204)
* 0001-tabbar-fix.patch
-------------------------------------------------------------------
Mon Jun 5 08:59:52 UTC 2023 - Christophe Marin <christophe@krop.fr>
- Add upstream changes (CVE-2023-34410, boo#1211994):
* 0001-Schannel-Reject-certificate-not-signed-by-a-configur.patch
* 0001-Ssl-Copy-the-on-demand-cert-loading-bool-from-defaul.patch
-------------------------------------------------------------------
Wed May 24 07:45:34 UTC 2023 - Christophe Marin <christophe@krop.fr>
- Update to 6.5.1
* https://www.qt.io/blog/qt-6.5.1-released
* Includes fix for a buffer overflow in QTextLayout (boo#1211798,
CVE-2023-32763).
* Includes fix for incorrect parsing of strict-transport-security
(HSTS) header (boo#1211797, CVE-2023-32762)
* Includes fix for a buffer overflow in QDnsLookup
(CVE-2023-33285, bsc#1211642)
- Drop patches, merged upstream:
* 0001-QApplication-Fix-DEPRECATED_VERSION-for-setActiveWin.patch
* 0001-QVariant-Fix-support-for-metatypes-created-by-Qt-6.5.patch
- Add patch
* 0001-CMake-Install-objects-files-into-ARCHDATADIR.patch
-------------------------------------------------------------------
Fri Apr 28 13:56:55 UTC 2023 - Christophe Marin <christophe@krop.fr>
- Add upstream change to fix boo#1210849:
* 0001-QVariant-Fix-support-for-metatypes-created-by-Qt-6.5.patch
-------------------------------------------------------------------
Sat Apr 8 10:42:33 UTC 2023 - Christophe Marin <christophe@krop.fr>
- Add upstream change:
* 0001-QApplication-Fix-DEPRECATED_VERSION-for-setActiveWin.patch
-------------------------------------------------------------------
Mon Apr 3 10:01:48 UTC 2023 - Christophe Marin <christophe@krop.fr>
- Update to 6.5.0
* https://www.qt.io/blog/qt-6.5-lts-released
* Includes fix for boo#1215178, QTBUG-109474, QTCREATORBUG-28593
- Drop patch, merged upstream:
* 0001-Avoid-resetting-CMAKE_AUTOMOC_MACRO_NAMES.patch
-------------------------------------------------------------------
Thu Mar 16 09:59:57 UTC 2023 - Christophe Marin <christophe@krop.fr>
- Update to 6.4.3:
* https://www.qt.io/blog/qt-6.4.3-released
- Drop patch, merged upstream:
* CVE-2023-24607-qtbase-6.4.diff
- Add patch to silence moc warnings:
* 0001-Avoid-resetting-CMAKE_AUTOMOC_MACRO_NAMES.patch
-------------------------------------------------------------------
Wed Feb 8 17:48:36 UTC 2023 - Christophe Marin <christophe@krop.fr>
- Fix a possible DOS in the Qt ODBC driver plugin (CVE-2023-24607,
bsc#1209616):
* CVE-2023-24607-qtbase-6.4.diff
-------------------------------------------------------------------
Fri Jan 6 16:46:36 UTC 2023 - Christophe Marin <christophe@krop.fr>
- Update to 6.4.2:
* https://www.qt.io/blog/qt-6.4.2-released
-------------------------------------------------------------------
Tue Nov 15 11:53:07 UTC 2022 - Christophe Giboudeaux <christophe@krop.fr>
- Update to 6.4.1:
* https://www.qt.io/blog/qt-6.4.1-released
-------------------------------------------------------------------
Sun Oct 16 07:39:21 UTC 2022 - Christophe Giboudeaux <christophe@krop.fr>
- Make sure the QPA and wayland-related plugins are installed if
needed
-------------------------------------------------------------------
Thu Sep 29 10:35:48 UTC 2022 - Christophe Giboudeaux <christophe@krop.fr>
- Update to 6.4.0:
* https://www.qt.io/blog/qt-6.4-released
-------------------------------------------------------------------
Fri Sep 16 08:29:02 UTC 2022 - Christophe Giboudeaux <christophe@krop.fr>
- Update to 6.4.0 RC
-------------------------------------------------------------------
Fri Sep 9 12:41:32 UTC 2022 - Christophe Giboudeaux <christophe@krop.fr>
- Update to 6.3.2:
* https://www.qt.io/blog/qt-6.3.2-released
-------------------------------------------------------------------
Fri Jun 17 15:15:01 UTC 2022 - Christophe Giboudeaux <christophe@krop.fr>
- Update to 6.3.1:
* https://www.qt.io/blog/qt-6.3.1-released
- Drop patches, now upstream:
* 0001-CMake-Don-t-hardcode-the-library-directory-name.patch
* 0001-XCB-fix-GCC-12-warning-about-uninitialized-variable-.patch
* 0001-Fix-build-with-GCC12-avoid-QCborStreamReader-prepars.patch
* 0001-QtOpenGL-Fix-build-with-GCC-12-qt_imageForBrush-is-i.patch
-------------------------------------------------------------------
Tue May 10 07:30:33 UTC 2022 - Christophe Giboudeaux <christophe@krop.fr>
- Add GCC 12 compatibility changes:
* 0001-XCB-fix-GCC-12-warning-about-uninitialized-variable-.patch
* 0001-Fix-build-with-GCC12-avoid-QCborStreamReader-prepars.patch
* 0001-QtOpenGL-Fix-build-with-GCC-12-qt_imageForBrush-is-i.patch
-------------------------------------------------------------------
Tue May 3 11:25:01 UTC 2022 - Fabian Vogt <fabian@ritter-vogt.de>
- Require the SSL devel package it was built with, not just any
pkgconfig(openssl). Otherwise it is satisfied with libressl-devel
even if it was built with openssl-devel.
-------------------------------------------------------------------
Fri Apr 8 11:56:51 UTC 2022 - Christophe Giboudeaux <christophe@krop.fr>
- Update to 6.3.0:
* https://www.qt.io/blog/qt-6.3-released
-------------------------------------------------------------------
Tue Mar 29 12:28:29 UTC 2022 - Christophe Giboudeaux <christophe@krop.fr>
- Update to 6.3.0-rc
- Add patch:
* 0001-CMake-Don-t-hardcode-the-library-directory-name.patch
- Update build constraints
-------------------------------------------------------------------
Mon Mar 21 08:46:52 UTC 2022 - Christophe Giboudeaux <christophe@krop.fr>
- Update to 6.2.4
* https://www.qt.io/blog/qt-6.2.4-released
- Drop 0001-QProcess-Unix-ensure-we-don-t-accidentally-execute-s.patch
Merged upstream.
-------------------------------------------------------------------
Wed Mar 2 09:16:10 UTC 2022 - Christophe Giboudeaux <christophe@krop.fr>
- Add upstream change (boo#1196501, CVE-2022-25255):
* 0001-QProcess-Unix-ensure-we-don-t-accidentally-execute-s.patch
- Install qt6-core-private-devel when installing qt6-core-devel
(boo#1195368)
-------------------------------------------------------------------
Mon Jan 31 08:54:21 UTC 2022 - Christophe Giboudeaux <christophe@krop.fr>
- Update to 6.2.3:
* https://www.qt.io/blog/qt-6.2.3-released
-------------------------------------------------------------------
Wed Dec 22 13:47:40 UTC 2021 - Antonio Larrosa <alarrosa@suse.com>
- Increase the memory constraint to fix a oom failure
-------------------------------------------------------------------
Wed Dec 1 10:05:54 UTC 2021 - Christophe Giboudeaux <christophe@krop.fr>
- Update to 6.2.2
* https://www.qt.io/blog/qt-6.2.2-released
- Make sure all dependencies are present when installing devel
packages. Qt >= 6.2.2 is much less permissive.
- Drop 0001-qscrollarea-performance-fix.patch. Merged upstream.
-------------------------------------------------------------------
Thu Nov 4 20:59:52 UTC 2021 - Jonas Kvinge <jonaski@opensuse.org>
- Add patch for critical performance regression in qscrollarea
* 0001-qscrollarea-performance-fix.patch
-------------------------------------------------------------------
Tue Oct 26 11:22:28 UTC 2021 - Christophe Giboudeaux <christophe@krop.fr>
- Update to 6.2.1
* https://www.qt.io/blog/qt-6.2.1-released
-------------------------------------------------------------------
Thu Sep 30 12:25:46 UTC 2021 - Christophe Giboudeaux <christophe@krop.fr>
- Update to 6.2.0:
* https://www.qt.io/blog/qt-6.2-lts-released
-------------------------------------------------------------------
Sat Sep 25 07:18:33 UTC 2021 - Christophe Giboudeaux <christophe@krop.fr>
- Update to 6.2.0-rc2
-------------------------------------------------------------------
Thu Sep 16 14:07:31 UTC 2021 - Christophe Giboudeaux <christophe@krop.fr>
- Update to 6.2.0-rc
-------------------------------------------------------------------
Thu Sep 9 14:04:56 UTC 2021 - Christophe Giboudeaux <christophe@krop.fr>
- Update to 6.2.0-beta4
-------------------------------------------------------------------
Wed Sep 1 13:03:23 UTC 2021 - Christophe Giboudeaux <christophe@krop.fr>
- Update to 6.1.3:
* https://www.qt.io/blog/qt-6.1.3-released
-------------------------------------------------------------------
Fri Jul 2 14:07:30 UTC 2021 - Christophe Giboudeaux <christophe@krop.fr>
- Update to 6.1.2. New bugfix release:
* https://www.qt.io/blog/qt-6.1.2-released
-------------------------------------------------------------------
Tue Jun 8 05:54:07 UTC 2021 - Christophe Giboudeaux <christophe@krop.fr>
- Update to 6.1.1:
* https://www.qt.io/blog/qt-6.1.1-released
-------------------------------------------------------------------
Sat Jun 5 15:50:54 UTC 2021 - Christophe Giboudeaux <christophe@krop.fr>
- Update the minimum disk size. Leap 15.3 needs more than 13G.
- Also require at least 4 cores.
-------------------------------------------------------------------
Thu May 6 17:10:11 UTC 2021 - Christophe Giboudeaux <christophe@krop.fr>
- Update to 6.1.0:
* https://www.qt.io/blog/qt-6.1-released
-------------------------------------------------------------------
Fri Apr 23 14:11:33 UTC 2021 - Christophe Giboudeaux <christophe@krop.fr>
- Update to 6.1.0-rc.
-------------------------------------------------------------------
Sat Apr 17 08:04:45 UTC 2021 - Christophe Giboudeaux <christophe@krop.fr>
- Stop owning directories provided by the filesystem package (boo#1184786)
-------------------------------------------------------------------
Tue Apr 13 06:29:24 UTC 2021 - Christophe Giboudeaux <christophe@krop.fr>
- Update to 6.1.0-beta3.
-------------------------------------------------------------------
Wed Mar 31 13:29:44 UTC 2021 - Christophe Giboudeaux <christophe@krop.fr>
- Update to 6.0.3
* https://www.qt.io/blog/qt-6.0.3-released
-------------------------------------------------------------------
Sat Mar 20 17:12:40 UTC 2021 - Christophe Giboudeaux <christophe@krop.fr>
- Update to 6.1.0-beta2
- Drop fix-fixqt4headers.patch. No longer needed.
-------------------------------------------------------------------
Fri Mar 5 17:23:59 UTC 2021 - Christophe Giboudeaux <christophe@krop.fr>
- Update to 6.1.0-beta1
https://www.qt.io/blog/qt-6.1-beta-released
-------------------------------------------------------------------
Fri Mar 5 09:31:18 UTC 2021 - Christophe Giboudeaux <christophe@krop.fr>
- Update to 6.0.2:
https://www.qt.io/blog/qt-6.0.2-released
-------------------------------------------------------------------
Wed Feb 3 16:54:58 UTC 2021 - Christophe Giboudeaux <christophe@krop.fr>
- Update to 6.0.1
https://www.qt.io/blog/qt-6.0.1-released
- Drop patches:
* 0001-Fix-QCache-Crash.patch
* 0001-CMake-Fix-conditions-for-some-subarch-features.patch
* 0001-CMake-strip-the-executable-bit-from-qt-cmake-private.patch
- Enable ltcg where possible.
-------------------------------------------------------------------
Sat Jan 23 20:24:22 UTC 2021 - Mykola Krachkovsky <w01dnick@gmail.com>
- Remove uikit qmake spec to avoid automatic dep on python2
-------------------------------------------------------------------
Wed Dec 16 11:26:03 UTC 2020 - Christophe Giboudeaux <christophe@krop.fr>
- Use a different 'Name' when building the docs flavor.
-------------------------------------------------------------------
Fri Dec 11 15:56:51 UTC 2020 - Jonas Kvinge <jonas@jkvinge.net>
- Add patch for critical bug: QCache related crashes.
* 0001-Fix-QCache-Crash.patch
-------------------------------------------------------------------
Tue Dec 8 14:09:01 UTC 2020 - Christophe Giboudeaux <christophe@krop.fr>
- Update to 6.0.0:
* https://www.qt.io/blog/qt-6.0-released
-------------------------------------------------------------------
Mon Dec 7 18:42:26 UTC 2020 - Christophe Giboudeaux <christophe@krop.fr>
- libQt6Core6 now owns most of runtime folders and
qt6-base-common-devel owns development ones.
-------------------------------------------------------------------
Thu Dec 3 17:59:47 UTC 2020 - Christophe Giboudeaux <christophe@krop.fr>
- Disable the reduce_relocations option. (boo#1175278, QTBUG-86173)
-------------------------------------------------------------------
Wed Dec 2 12:08:58 UTC 2020 - Christophe Giboudeaux <christophe@krop.fr>
- Qt 6.0.0 RC2
-------------------------------------------------------------------
Wed Dec 2 11:06:59 UTC 2020 - Christophe Giboudeaux <christophe@krop.fr>
- Add the missing openssl dependency for qt6-network-private-devel
-------------------------------------------------------------------
Mon Nov 30 16:55:57 UTC 2020 - Christophe Giboudeaux <christophe@krop.fr>
- Add upstream patches:
* 0001-CMake-strip-the-executable-bit-from-qt-cmake-private.patch
* 0001-CMake-Fix-conditions-for-some-subarch-features.patch
-------------------------------------------------------------------
Wed Nov 25 14:19:54 UTC 2020 - Christophe Giboudeaux <christophe@krop.fr>
- Update to 6.0.0~rc1
-------------------------------------------------------------------
Tue Nov 17 07:26:23 UTC 2020 - Christophe Giboudeaux <christophe@krop.fr>
- Update to 6.0.0~beta5
- Drop upstream patches:
* 0001-CMake-Potentially-use-INSTALL_LIBDIR-in-qt6_extract_.patch
* 0001-CMake-Allow-using-DESTDIR-when-installing-documentat.patch
* 0001-CMake-Make-zstd-config-based-lookup-quiet.patch
-------------------------------------------------------------------
Tue Nov 10 18:40:31 UTC 2020 - Christophe Giboudeaux <christophe@krop.fr>
- Update to 6.0.0~beta4
- Replace patches:
* 0001-CMake-Allow-using-DESTDIR-when-installing-documentat.patch
(replaces 0001-cmake-Fix-doc-installation.patch)
* 0001-CMake-Potentially-use-INSTALL_LIBDIR-in-qt6_extract_.patch
(replaces 0001-cmake-Don-t-hardcode-the-library-directory-name.patch)
- Add upstream patch:
* 0001-CMake-Locate-zstd-using-CONFIG.patch
-------------------------------------------------------------------
Tue Oct 20 07:47:07 UTC 2020 - Christophe Giboudeaux <christophe@krop.fr>
- Update to 6.0.0beta1
https://www.qt.io/blog/qt-6.0-beta-released
-------------------------------------------------------------------
Wed Oct 7 12:24:40 UTC 2020 - Christophe Giboudeaux <christophe@krop.fr>
- Turn more options on:
* link to openSSL
* libproxy usage
-------------------------------------------------------------------
Tue Oct 6 19:41:23 UTC 2020 - Christophe Giboudeaux <christophe@krop.fr>
- Update to 6.0.0-alpha
https://www.qt.io/blog/qt-6.0-alpha-released
- Import fix-fixqt4headers.patch from libqt5-qtbase
- Add patches:
* 0001-cmake-Fix-doc-installation.patch
* 0001-cmake-Don-t-hardcode-the-library-directory-name.patch
-------------------------------------------------------------------
Sun Sep 20 08:25:20 UTC 2020 - Christophe Giboudeaux <christophe@krop.fr>
- Resurrect 0001-Tell-the-truth-about-private-API.patch from
libqt5-qtbase
-------------------------------------------------------------------
Tue Jan 21 22:38:13 UTC 2020 - Christophe Giboudeaux <christophe@krop.fr>
- Add a qt6-printsupport-cups package for the cups plugin
- Add the journald option back
-------------------------------------------------------------------
Tue Jan 21 22:19:11 UTC 2020 - Christophe Giboudeaux <christophe@krop.fr>
- Split the changes into smaller commits
- Fixed the wrong paths in CMake config files
- Fixed the mkspecs install dir. Everything is in qt6_mkspecsdir now.
-------------------------------------------------------------------
Tue Dec 31 09:06:08 UTC 2019 - Christophe Giboudeaux <christophe@krop.fr>
- Experimental qt6-qtbase package

1287
qt6-base.spec Normal file
View File

File diff suppressed because it is too large Load Diff

BIN
qtbase-everywhere-src-6.7.2.tar.xz (Stored with Git LFS) Normal file
View File

Binary file not shown.