Accepting request 1248339 from GNOME:Factory

OBS-URL: https://build.opensuse.org/request/show/1248339
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/gvfs?expand=0&rev=199

README.SUSE

@@ -0,0 +1,14 @@
+Security of gvfs
+================
+
+gvfs allows to operate on files with root privileges from within
+unprivileged graphical applications. This is for example used in the Nautilus
+file manager via the `admin://` protocol.
+
+There exist some inherent dangers to the design of gvfs that can weaken
+your system's security. Please refer to this blog post [1] from the SUSE
+security team for technical details. The post also contains recommendations
+for users of gvfs [2].
+
+[1]: https://security.opensuse.org/2025/02/21/kio-admin-admittance.html
+[2]: https://security.opensuse.org/2025/02/21/kio-admin-admittance.html#7-recommendations-for-users-of-kio-admin-or-gvfs

_service

@@ -3,7 +3,7 @@
   <service name="obs_scm" mode="manual">
     <param name="scm">git</param>
     <param name="url">https://gitlab.gnome.org/GNOME/gvfs.git</param>
-    <param name="revision">1.54.2</param>
+    <param name="revision">1.56.1</param>
     <param name="versionformat">@PARENT_TAG@+@TAG_OFFSET@</param>
     <param name="versionrewrite-pattern">(.*)\+0</param>
     <param name="versionrewrite-replacement">\1</param>

gvfs-1.54.2.obscpio

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:4ca6feebcaef33c02cae2c2a6a3e66fab1763b79aa3d18f1bbbf20aa35b19990
-size 12908557

gvfs-1.56.1.obscpio

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:264b176b1896b33ea0d49642423804caf371451f324e1ebdc30d4b9e5a5ba9cd
+size 12935693

gvfs.changes

@@ -1,3 +1,82 @@
+-------------------------------------------------------------------
+Mon Feb 24 14:23:44 UTC 2025 - Matthias Gerstner <matthias.gerstner@suse.com>
+
+- add README.SUSE about security concerns in gvfs (bsc#1205607)
+
+-------------------------------------------------------------------
+Wed Dec 11 20:48:16 UTC 2024 - Bjørn Lie <bjorn.lie@gmail.com>
+
+- Drop unused and obsolete pkgconfig(gcr-base-3) BuildRequires and
+  replace it with pkgconfig(gcr-4) BuildRequires already pulled in
+  via libgdata dependency.
+
+-------------------------------------------------------------------
+Fri Oct 18 10:45:12 UTC 2024 - Bjørn Lie <bjorn.lie@gmail.com>
+
+- Update to version 1.56.1:
+  + udisks2: Increasing reference count when updating volume to fix
+    crashes
+  + onedrive:
+    - Use names instead of id for events to fix monitoring
+    - Add missing replace stream to fix crashes
+    - onedrive: Fix double free during cache rebuild to fix crashes
+  + dav: Recognize the 409 status to fix creation of parent
+    directories
+  + Updated translations.
+
+-------------------------------------------------------------------
+Sun Sep 15 12:26:56 UTC 2024 - Dominique Leuenberger <dimstar@opensuse.org>
+
+- Update to version 1.56.0:
+  + udisks2: Run update synchronously for internal changes.
+  + onedrive: Set name of drive root.
+  + onedrive: Handle multiple drives with same IDs.
+- Changes from version 1.55.90:
+  + fuse: Fill stat info during readdir to improve performance.
+  + smb: Fix access over FUSE when root dir is not accessible.
+  + onedrive: Guess mime type locally if not set by the server.
+  + trash: Add support for x-gvfs-trash mount option.
+  + onedrive: Add seek on write functionality.
+  + Updated translations.
+
+-------------------------------------------------------------------
+Sat Sep 14 16:12:12 UTC 2024 - Bjørn Lie <bjorn.lie@gmail.com>
+
+- Update to version 1.55.1:
+  + ftp:
+    - Change cwd to root before renaming to prevent failures
+    - Obtain correct modification time for old files using MDTM cmd
+    - Use timegm instead of mktime to not shift dates by timezone
+    - Add support for setting mtime attribute using MFMT cmd
+    - Preserve mtime when copying to local
+  + udisks2:
+    - Ignore autofs mounts to prevent duplicated entries
+    - Show only direct descendats of /media unless $USER
+    - Do not schedule update if pending already to improve
+      performance
+  + build:
+    - Add deprecated_apis option and disable installation of
+      headers
+    - Disable burn backend by default
+  + dav: Disable query_info_on_read method to fix mtime
+    preservation
+  + network: Disable usage of smbbrowse backend by default
+  + smbbrowse: Don't enforce NT1 to fix mounting in certain cases
+  + onedrive: Fix various memory leaks
+  + Updated translations.
+- Drop devel subpackage, and obsolete it from main package. The
+  header files are no longer built.
+
+-------------------------------------------------------------------
+Fri Sep 13 15:22:06 UTC 2024 - Bjørn Lie <bjorn.lie@gmail.com>
+
+- Update to version 1.54.3:
+  + onedrive:
+    - Set name of drive root
+    - Handle multiple drives with same IDs
+    - Guess mime type locally if not set by the server
+  + Updated translations.
+
 -------------------------------------------------------------------
 Fri Jun 28 21:30:03 UTC 2024 - Bjørn Lie <bjorn.lie@gmail.com>
 

gvfs.obsinfo

@@ -1,4 +1,4 @@
 name: gvfs
-version: 1.54.2
-mtime: 1719572947
-commit: 7ffc15fd6210568c009a64b6b4172e9ec8bba137
+version: 1.56.1
+mtime: 1729247301
+commit: e92b9c78e164b02921864d558056f7b96209aa13

gvfs.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package gvfs
 #
-# Copyright (c) 2024 SUSE LLC
+# Copyright (c) 2025 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -19,13 +19,14 @@
 %bcond_without  cdda
 %bcond_without  onedrive
 Name:           gvfs
-Version:        1.54.2
+Version:        1.56.1
 Release:        0
 Summary:        Virtual File System functionality for GLib
 License:        GPL-3.0-only AND LGPL-2.0-or-later
 Group:          Development/Libraries/C and C++
 URL:            https://wiki.gnome.org/Projects/gvfs
 Source0:        %{name}-%{version}.tar.zst
+Source1:        README.SUSE
 Source99:       baselibs.conf
 
 ### NOTE: Please, keep SLE-only patches at bottom (starting on 1000).
@@ -44,7 +45,7 @@ BuildRequires:  pkgconfig(avahi-client) >= 0.6
 BuildRequires:  pkgconfig(avahi-glib) >= 0.6
 BuildRequires:  pkgconfig(dbus-1)
 BuildRequires:  pkgconfig(fuse3) >= 3.0.0
-BuildRequires:  pkgconfig(gcr-base-3)
+BuildRequires:  pkgconfig(gcr-4)
 BuildRequires:  pkgconfig(gio-2.0)
 BuildRequires:  pkgconfig(gio-unix-2.0)
 BuildRequires:  pkgconfig(glib-2.0) >= 2.70.0
@@ -84,6 +85,7 @@ BuildRequires:  pkgconfig(libcdio_paranoia) >= 0.78.2
 # The library gvfscommon was converted to a private library and is not used outside of gvfs
 Obsoletes:      libgvfscommon0 <= %{version}
 %endif
+Obsoletes:      %{name}-devel <= %{version}
 
 %description
 gvfs GNOME's userspace virtual filesystem designed to work with the
@@ -182,6 +184,7 @@ gvfs plugins.
 %patch -P 1000 -p1
 %patch -P 1001 -p1
 %endif
+cp %{SOURCE1} .
 
 %build
 %meson \
@@ -222,7 +225,8 @@ mv daemon/trashlib/COPYING daemon/trashlib/COPYING.trashlib
 
 %files
 %license COPYING daemon/trashlib/COPYING.trashlib
-%doc NEWS README.md
+%doc NEWS README.md README.SUSE
+%doc CONTRIBUTING.md NEWS.pre-1-2
 %doc daemon/org.gtk.vfs.file-operations.rules.in
 %dir %{_datadir}/%{name}
 %dir %{_datadir}/%{name}/mounts
@@ -335,7 +339,6 @@ mv daemon/trashlib/COPYING daemon/trashlib/COPYING.trashlib
 %{_datadir}/%{name}/mounts/network.mount
 # allow priv ports for mounting nfs. Otherwise the nfs-service requires insecure (boo#1065864)
 %verify(not mode caps) %caps(cap_net_bind_service=+ep) %{_libexecdir}/%{name}/gvfsd-nfs
-%{_libexecdir}/%{name}/gvfsd-nfs
 %{_datadir}/%{name}/mounts/nfs.mount
 %{_libexecdir}/%{name}/gvfsd-recent
 %{_datadir}/%{name}/mounts/recent.mount
@@ -355,10 +358,6 @@ mv daemon/trashlib/COPYING daemon/trashlib/COPYING.trashlib
 %{_datadir}/glib-2.0/schemas/org.gnome.system.wsdd.gschema.xml
 %{_datadir}/gvfs/mounts/wsdd.mount
 
-%files devel
-%doc CONTRIBUTING.md NEWS.pre-1-2
-%{_includedir}/gvfs-client
-
 %files lang -f %{name}.lang
 
 %changelog