Accepting request 969536 from home:AndreasStieger:branches:devel:tools:scm:svn

- Apache Subversion 1.14.2:
  * CVE-2021-28544: SVN authz protected copyfrom paths regression
    (boo#1197939)
  * CVE-2022-24070: mod_dav_svn memory corruption (boo#1197940)
  * Fix -r option documentation for some svnadmin subcommands
  * Fix error message encoding when system() call fails
  * Fix assertion failure in conflict resolver
  * Support multiple working copy formats (1.8-onward, 1.15)

OBS-URL: https://build.opensuse.org/request/show/969536
OBS-URL: https://build.opensuse.org/package/show/devel:tools:scm:svn/subversion?expand=0&rev=351

fix-javahl-test.patch

@@ -1,9 +1,9 @@
 Index: subversion/bindings/javahl/tests/org/apache/subversion/javahl/BasicTests.java
 ===================================================================
---- subversion/bindings/javahl/tests/org/apache/subversion/javahl/BasicTests.java	(revision 1895276)
+--- subversion/bindings/javahl/tests/org/apache/subversion/javahl/BasicTests.java.orig
-+++ subversion/bindings/javahl/tests/org/apache/subversion/javahl/BasicTests.java	(working copy)
++++ subversion/bindings/javahl/tests/org/apache/subversion/javahl/BasicTests.java
-@@ -4676,7 +4676,19 @@
+@@ -4743,7 +4743,19 @@ public class BasicTests extends SVNTests
-             // RuntimeException("Test exception") is expected here
+                 ex.printStackTrace();
          }
  
 -        tunnelAgent.joinAndTest();

subversion-1.14.1.tar.bz2

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:2c5da93c255d2e5569fa91d92457fdb65396b0666fad4fd59b22e154d986e1a9
-size 8504612

subversion-1.14.1.tar.bz2.asc

@@ -1,26 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQEcBAABAgAGBQJgG+hvAAoJEE99uqmaWblz4yUIAMCqnFGchPMrWNhrRLOb3oi+
-vzk64LJ1h2X3MzstqIzRGb3ja3VmPcx2kQ4MmmHLc7XzXL7rMVRgPJB9NzKhs+dp
-nvnTq0wS4KLjOzIiG3ump41T1qofi5ui5fbgeVEyU4py/fBDVeR0XokZ0k8HAZCj
-oM166uprcSr0RfeQqnlSNEFUgIMq1hxTOa879N4aoMsFoLaMx18gjFL1RUyaz/0R
-eH+EMkBk2wgGkzCWdOZlJeyp0YI6Lx4k/bHO8WXLci97tpw9t9UUtQAXTrKudShP
-fP9BQqUv0uHdUAF3ZiYga6VKQicynuXev4du2vVqLoQ+BgMQXPwnbgA/FtSpeOA=
-=z3Ba
------END PGP SIGNATURE-----
------BEGIN PGP SIGNATURE-----
-
-iQIzBAABCgAdFiEEujwVsTN88PsiK9QaG8plhqNHlD8FAmAi0f0ACgkQG8plhqNH
-lD+H+g/9EJ2PEQyMZYCLof6DR9Lqh5dq5Uksp/w3/00TkKQEjNQzz4P7fvUoHO5x
-9eqdIWTehFpOhXHjGUEyAFj6Z2OoPRZLe9fsBLBd2vQQhW+du/k0vN2aSav/b1WZ
-yaqeJNNbUg+tZUV02SoScNOOUNhrFoaa3NQseV6gm7PdFgZIFLjtr6F/oX9eCWgY
-7kjVsJzI8ltlPA/IcvdDdwIKxUS0jSFRnk6IY9nniPRfukICr1Vm+4+xKa7RcxaO
-NFs7bGbx3RRfc9AWLiwSGjUVwd7grpVeIPxZSnii7yH+vngk59ozQGRQOZbM9Aym
-BRyIO84h0hqOpuZdDeMF2uQoXYZXtzU5GLi0Da38/4vJIAsX3bu1OzesuTFd3DCz
-npOwabjhoGLX7tqTXmMUAOCnSuBVmgQRNkGtVZDbQtJiulfA9LJGrpbcL0bS1C39
-FwiAU1xd3bj35KBLV4/YiDHn22n7BWoLcyCRnKOj6uPuFNkv3upps3S/gUrzIacS
-oxTOsT1caVLMNWTNrtaYJ9VOyGOrbevQi2zdvo/D2qQ6QtzpzvcFpdUYC01Q8fBL
-7+ztPS9OR5R8iKTtGxvPEPI7Ed0OkVuj5y+iWGxeMUtfzYcGzN62/x1BSJ3vpla7
-23nunL+LrfWm0z1L8mqCf95HCC79qaC15SxL7MZXfDiepCNs2NE=
-=QCtX
------END PGP SIGNATURE-----

subversion-1.14.2.tar.bz2

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:c9130e8d0b75728a66f0e7038fc77052e671830d785b5616aad53b4810d3cc28
+size 8606570

subversion-1.14.2.tar.bz2.asc

@@ -0,0 +1,66 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABCAAdFiEEYBFjz51Jn9cYz1gtH7BkuE7sxJMFAmJKA9oACgkQH7BkuE7s
+xJMspg//fT0ONQ4AIKpTAthnZQ3ECNta/S2c7nQppQdR7JZ8Q7iWVnVWn8rMJqPE
+kFtlymmfdQGrmBZGdMvZzOqXSClyEkoZRF1pgbEWbUvCbzxvuqxPNrnBb/9C+nmq
+mg8QeWYpVYRylzeq5fiKl2MnM7RmvwM2QCE1e4LVoM56kgcqxmtAjXJauLR3ubm7
+p1uDasdNekThMJvf/GHU3HQuxWxX7XzQ1tvO3FS6jDA+47HBKojKREFgQFx2NOxp
+sGYn/DwHmHYgicg/6kF+SCk6cvz/ck6+DkE4z6ctjBNPc701zOdpnTb6T0I1Ovxt
+IEy1QWkKQrO63yD2tbUBszB+d2rYY+c8X+t73dxq0RzOxkJGMpf/ZTZ6LC4AKNgY
+sZC1wg7fkXJNjGgiKSt0SzfQUzNjk/Onf4LKd7gOuv/TeOHucEa1l2KvNwa0OI0l
+AC3k3ppBEdh+aXN9y+8QsQdKPv57jCS29NOgieVT6WUV8mugdKsxWHlDHewa8wGR
+Iyd4BIyWzOwyCLzyuESYCXyn9FDXMQOORvbDXvf5IvdBgkWEUUBaqv4rhYE2RrCU
+i0G4wXsLQa2VCioL/Azt+S9+sFQhmlweZPtoLj2+xfTIoFXmealaXmm4hSA2ayks
+SYc+A+Hn4zoebqY9XhUJU9Vs5JKXe1/xVtJdzBsczgiakrrEo44=
+=dfDx
+-----END PGP SIGNATURE-----
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABCAAdFiEEP45GfLM2bjAT4RINWD8ArfmBw58FAmJKZ/cACgkQWD8ArfmB
+w59gBA/+OUhN6mVRKMa5lxHArNxLcXyowykBPFB4NR9+MoBe4LAIDpm86BG5e/kz
+q3ui3/3POOVcs97OlE1gU8ribJCfne5cjlxl4sHqxZwultv6+yt3AhyxhNSu33WB
+m+MbGrTPZkGxPxm/uGEEionp3FloKclnP+hgnjHeYEi8gx1eCG26EXfVzTZlNr5m
++TUJy4QMDtdiHskw5AJEe/5QawF6hPfzOOhX8NumU/umBubAH465EqTW5M/XuFbS
+8amnofWv0dwHu90OZb+em1HjXKrz+f1uZ/+Bt0P1fkznRWijTMrRU+/K42sr6OcJ
+Gh4q5mlzW16Cvi8yp+IneHJD08N2tjvDILVnlGwU8XJ9o3JPIKGow0Y2FMWL4ZjC
+OOW+Ucc67NkVNw7YwRUgfSkTdXy1x4upz78PjGMOSjuqlAYDh+nX6WY3ysrG5w68
+niOLPy8f6M9aMjb+ifAbvbiXHVpIKs2XDBeUzmcjGCMi2q9BGjNXqhrIOnxrVx+A
+wYVThqiMyTj93wd91eew/JBWmSqsn2KVTpsq5NUbu8+zgbb/0HK/IseE6JF972DT
+Ed+Hk0Pj24KGsKMHONAXB0rd7kW2f9+tPKO2tK7xYS/v9pSEmxJLuS0kgArNgaGM
+yCj77G9sJmyxGmE1Mb/UW6b7CCUo+Owb3+IsrntKxb4GFTwaVAE=
+=9MZA
+-----END PGP SIGNATURE-----
+-----BEGIN PGP SIGNATURE-----
+
+iQEzBAABCAAdFiEEi8Ta4MWk1l9ARAEHT326qZpZuXMFAmJK9doACgkQT326qZpZ
+uXNxqAf+PtDGZD4Qd1fJCns6eK18lIU8xBMy1Q+TxRp/RqtnSg075osJGevvCsmZ
+syn8JcoPFzc+EzX94bOLAFbcnxC+FZTyAiMMCcnmLO+uGUfMMGxUTiXV8Vkc9VHJ
+WDKqKfzjDbmSGBmb4nKMyChbpfWFyw5INnPxxCA4GDjYqavlA+RsDx2efwtD3zWz
+SNa0Ww8aQyWD9hSY8MU/iVNkajEE1fVIxHjAuHlvyTYPZr7jEavpQoMLMiKKiJJG
+mLpEpPvfud92D4TaxKK/nFbdn2XKfEVZ61/0hstj7B/BZnufBFsWVNmU6fXbfnGg
+RgLNgPYXMeozlwq2d6eh340NKcSrCQ==
+=hC7u
+-----END PGP SIGNATURE-----
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABCgAdFiEEujwVsTN88PsiK9QaG8plhqNHlD8FAmJMzM4ACgkQG8plhqNH
+lD8JyRAAoqgWuN7/KiroKZkZFpZ607XEbo0iHka3yKc/uJycfs6ZOMYF7gGNZZRI
+nNHi1MuvCBwMKlGkdWjJbSURWeUJ7fWudwQKTV/40HVsOx3yDB3IzoSr0156Ti1m
+fYXdq31nOG7WCemMMqvmwVb4cmotmtdUTGm9N0hy38hjv/oglpSh+RpAqibWOqD2
+vR4L1bdbw51kV2xsvSInpBQgPjp1EcNSdhKZBsl9IOwPmHalbQU6W9RCay+r0s6p
+P1sziXx0KBgwMhIrmR9nDBTY1KE/MGqSwCDi0Zuv54LQ0a42UCDLchm2sbW61nVj
+5tCrnEZi6G+eLAjSqj0lGQ4d5vywGb3oi6QcAu36703z6qra6zwAp+DD4qUuPFq7
+f5gOnZKNJNy7bDrSAgm8HP/yAxXdKWsMdtn0IclOPyd5pwO7mMALkawjLOXIpgfJ
+uU+7I0+XhVxj8QEr+W9bHXUF07HLzWwvBY3InU1NfkGsrwMYxKX8CeFnoIckEyi+
+6HaLrLseB6699R3rNx9FBKo+ryhdCFHedEzGdUw0QFrJRTSiu7o0kSth+we4iUP/
+k3UYLC6+5py7h2yoImAZ2ixq1EnAoRdW6dT8xntSue1CiLJky6ej/JkJjUTXugnv
+UjTyQ5p3PNi/YFTAXnIvoQe/xrSUswtEq5MPHTd01t0OKiKmLek=
+=ToH4
+-----END PGP SIGNATURE-----
+-----BEGIN PGP SIGNATURE-----
+
+iHUEABYKAB0WIQTsJfzBBWGNBK20NCnEQWFnNJo7ywUCYkhNQAAKCRDEQWFnNJo7
+y6mRAQDV+0XPH+LQzZ4/34rtkoXz3EIza8Vjs3eDhTELwlT7IgEAjik593eDczG3
+ZwluxOn1MjRlju05kSEbXWDxCYCiaQU=
+=pQq5
+-----END PGP SIGNATURE-----

subversion-no-build-date.patch

@@ -13,10 +13,10 @@ Prevent unneccessary rebuilds of binary packages differing only by date, time an
  subversion/tests/cmdline/getopt_tests_data/svn--version_stdout                |    1 -
  5 files changed, 6 insertions(+), 12 deletions(-)
 
-Index: subversion-1.14.1/subversion/bindings/javahl/tests/org/apache/subversion/javahl/BasicTests.java
+Index: subversion-1.14.2/subversion/bindings/javahl/tests/org/apache/subversion/javahl/BasicTests.java
 ===================================================================
---- subversion-1.14.1.orig/subversion/bindings/javahl/tests/org/apache/subversion/javahl/BasicTests.java
+--- subversion-1.14.2.orig/subversion/bindings/javahl/tests/org/apache/subversion/javahl/BasicTests.java
-+++ subversion-1.14.1/subversion/bindings/javahl/tests/org/apache/subversion/javahl/BasicTests.java
++++ subversion-1.14.2/subversion/bindings/javahl/tests/org/apache/subversion/javahl/BasicTests.java
 @@ -148,10 +148,10 @@ public class BasicTests extends SVNTests
          {
              vx = client.getVersionExtended(false);
@@ -30,10 +30,10 @@ Index: subversion-1.14.1/subversion/bindings/javahl/tests/org/apache/subversion/
                  throw new Exception("Build time empty");
              result = vx.getBuildHost();
              if (result == null || result.trim().length() == 0)
-Index: subversion-1.14.1/subversion/libsvn_subr/opt.c
+Index: subversion-1.14.2/subversion/libsvn_subr/opt.c
 ===================================================================
---- subversion-1.14.1.orig/subversion/libsvn_subr/opt.c
+--- subversion-1.14.2.orig/subversion/libsvn_subr/opt.c
-+++ subversion-1.14.1/subversion/libsvn_subr/opt.c
++++ subversion-1.14.2/subversion/libsvn_subr/opt.c
 @@ -1147,12 +1147,8 @@ svn_opt__print_version_info(const char *
    if (quiet)
      return svn_cmdline_printf(pool, "%s\n", SVN_VER_NUMBER);
@@ -49,10 +49,10 @@ Index: subversion-1.14.1/subversion/libsvn_subr/opt.c
    SVN_ERR(svn_cmdline_printf(pool, "%s\n", svn_version_ext_copyright(info)));
  
    if (footer)
-Index: subversion-1.14.1/subversion/libsvn_subr/version.c
+Index: subversion-1.14.2/subversion/libsvn_subr/version.c
 ===================================================================
---- subversion-1.14.1.orig/subversion/libsvn_subr/version.c
+--- subversion-1.14.2.orig/subversion/libsvn_subr/version.c
-+++ subversion-1.14.1/subversion/libsvn_subr/version.c
++++ subversion-1.14.2/subversion/libsvn_subr/version.c
 @@ -139,8 +139,8 @@ svn_version_extended(svn_boolean_t verbo
  {
    svn_version_extended_t *info = apr_pcalloc(pool, sizeof(*info));
@@ -63,21 +63,21 @@ Index: subversion-1.14.1/subversion/libsvn_subr/version.c
 +  info->build_time = "";
    info->build_host = SVN_BUILD_HOST;
    info->copyright = apr_pstrdup
-     (pool, _("Copyright (C) 2021 The Apache Software Foundation.\n"
+     (pool, _("Copyright (C) 2022 The Apache Software Foundation.\n"
-Index: subversion-1.14.1/subversion/tests/cmdline/getopt_tests_data/svn--version--verbose_stdout
+Index: subversion-1.14.2/subversion/tests/cmdline/getopt_tests_data/svn--version--verbose_stdout
 ===================================================================
---- subversion-1.14.1.orig/subversion/tests/cmdline/getopt_tests_data/svn--version--verbose_stdout
+--- subversion-1.14.2.orig/subversion/tests/cmdline/getopt_tests_data/svn--version--verbose_stdout
-+++ subversion-1.14.1/subversion/tests/cmdline/getopt_tests_data/svn--version--verbose_stdout
++++ subversion-1.14.2/subversion/tests/cmdline/getopt_tests_data/svn--version--verbose_stdout
 @@ -1,5 +1,4 @@
  svn, version 1.9.0-dev (under development)
 -   compiled Feb 26 2014, 15:15:42 on x86_64-unknown-openbsd5.5
  
  Copyright (C) 2012 The Apache Software Foundation.
  This software consists of contributions made by many people;
-Index: subversion-1.14.1/subversion/tests/cmdline/getopt_tests_data/svn--version_stdout
+Index: subversion-1.14.2/subversion/tests/cmdline/getopt_tests_data/svn--version_stdout
 ===================================================================
---- subversion-1.14.1.orig/subversion/tests/cmdline/getopt_tests_data/svn--version_stdout
+--- subversion-1.14.2.orig/subversion/tests/cmdline/getopt_tests_data/svn--version_stdout
-+++ subversion-1.14.1/subversion/tests/cmdline/getopt_tests_data/svn--version_stdout
++++ subversion-1.14.2/subversion/tests/cmdline/getopt_tests_data/svn--version_stdout
 @@ -1,5 +1,4 @@
  svn, version 1.9.0-dev (under development)
 -   compiled Feb 26 2014, 15:15:42 on x86_64-unknown-openbsd5.5

subversion.changes

@@ -1,3 +1,15 @@
+-------------------------------------------------------------------
+Tue Apr 12 18:26:25 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>
+
+- Apache Subversion 1.14.2:
+  * CVE-2021-28544: SVN authz protected copyfrom paths regression
+    (boo#1197939)
+  * CVE-2022-24070: mod_dav_svn memory corruption (boo#1197940)
+  * Fix -r option documentation for some svnadmin subcommands
+  * Fix error message encoding when system() call fails
+  * Fix assertion failure in conflict resolver
+  * Support multiple working copy formats (1.8-onward, 1.15)
+
 -------------------------------------------------------------------
 Mon Mar  7 09:43:08 UTC 2022 - Danilo Spinella <danilo.spinella@suse.com>
 

subversion.spec

@@ -34,7 +34,7 @@
 %bcond_with	python_ctypes
 %bcond_with	all_regression_tests
 Name:           subversion
-Version:        1.14.1
+Version:        1.14.2
 Release:        0
 Summary:        Subversion version control system
 License:        Apache-2.0
@@ -49,7 +49,7 @@ Source15:       svnserve.tmpfiles
 Source16:       svn.sysusers
 Source42:       subversion.svngrep.sh
 Source43:       subversion.svndiff.sh
-Source50:       https://people.apache.org/keys/group/subversion.asc#/subversion.keyring
+Source50:       https://www.apache.org/dist/subversion/subversion-%{version}.KEYS#/%{name}.keyring
 Source51:       https://www.apache.org/dist/subversion/%{name}-%{version}.tar.bz2.asc
 Source92:       %{name}-rpmlintrc
 Patch0:         subversion-pkgconfig.patch