Update to libnbd version 1.24.0: (jsc#PED-14625). Fix for bsc#1253059, bsc#1255432, CVE-2025-14946 - a malicious URI can cause arbitrary code execution via SSH argument injection.

OBS-URL: https://build.opensuse.org/request/show/1277278
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/libnbd?expand=0&rev=19

_service

@@ -1,7 +1,7 @@
 <services>
   <service name="tar_scm" mode="manual">
     <param name="filename">libnbd</param>
-    <param name="revision">v1.20.2</param>
+    <param name="revision">v1.24.0</param>
     <param name="scm">git</param>
     <param name="submodules">disable</param>
     <param name="url">https://gitlab.com/nbdkit/libnbd.git</param>

_servicedata

@@ -1,4 +1,4 @@
 <servicedata>
 <service name="tar_scm">
                 <param name="url">https://gitlab.com/nbdkit/libnbd.git</param>
-              <param name="changesrevision">30963227b281adab0017317e3eb17f4c3088f1fc</param></service></servicedata>
+              <param name="changesrevision">7df1ebd896ccccbb4ae7bdcdd4580fa16a708eb6</param></service></servicedata>

libnbd.changes

@@ -1,3 +1,323 @@
+-------------------------------------------------------------------
+Tue Dec 16 16:29:46 UTC 2025 - Charles Arnold <carnold@suse.com>
+
+- Update to version 1.24.0: (jsc#PED-14625)
+  * Version 1.24.0.
+  * docs: Finalize release notes for libnbd 1.24
+  * ci/lcitool/projects/libnbd.yml: Add 'tar' as an explicit dependency
+  * misc: Require libxml2 / URI support for these tests
+  * tests: Add an explicit 'requires_uri' for URI support
+  * ci: Update various OS versions
+  * generator: Rework description of nbd_set_tls_priority
+  * Version 1.23.13.
+  * tests: Add a test of tls-priority
+  * lib: In nbd_get_uri return tls-priority if non-default
+  * lib: Add tls-priority to URIs, but disable it by default
+  * generator/API.ml: Arrange tls-* URI parameters in order
+  * lib: Use the TLS priority from the handle
+  * lib: Add nbd_get_tls_priority and nbd_set_tls_priority
+  * rust: Allow piped links in POD documentation
+  * lib/crypto.c: Support extra client keys for hybrid PQC
+  * configure: Print TLS priority in summary output
+  * vector: Fine-tune vector_reserve behavior
+  * misc: Fix tab-completion of -h/--help options
+  * Version 1.23.12.
+  * docs: Add outline release notes for libnbd 1.24
+  * misc: Rename -f/--fast as --fast-zero
+  * misc/nbddiscard.pod: Document --check & --fast in alphabetical order
+  * misc/nbddiscard.pod: Document short and long options in synopsis
+  * sh: Add an example of writing to the disk using nbdsh
+  * sh: Link to nbdkit(1)
+  * sh: Link to nbddump from the hexdump example
+  * misc: Add nbdzero --fast
+  * misc: Add nbddiscard --check
+  * misc: Avoid traceback on NBD errors in nbddiscard
+  * misc: Enhance nbddiscard/nbdzero range tests
+  * tests: Add define() to functions.sh
+  * Version 1.23.11.
+  * misc: Fix creation of nbdzero symlink
+  * misc/nbddiscard.in: Fix tests on macOS
+  * misc/nbddiscard: Generate shebang with correct path to python
+  * copy: Link --destination-is-zero option to new tools nbddiscard/nbdzero
+  * misc/nbdzero.1: Fix link to nbddiscard(1)
+  * Version 1.23.10.
+  * Add new 'nbddiscard' and 'nbdzero' tools
+  * tests: Fix missing exit in some tests
+  * Update TODO
+  * configure: Add new macro to print package version
+  * copy: Skip some tests when running on ZFS
+  * copy/copy-allocated-destination-zero-*.sh: Remove test for /dev/zero
+  * docs/libnbd-security.pod: Add section for recent nbd+ssh security issue
+  * Version 1.23.9.
+  * uri: Sanitize user-provided hostnames
+  * lib/uri.c: Replace boolean parsing code with common nbdkit code
+  * common/include: Extra bool parsing into a mini-library
+  * common/include: Add locale-safe ascii_strcasecmp and ascii_strncasecmp.
+  * Version 1.23.8.
+  * lib/uri: Allow ssh compression to be controlled from URIs
+  * generator: Additional checking for longdesc
+  * generator/API.ml: Make longdesc fields consistent
+  * generator: Use quoted string literals in many places
+  * generator: Use quoted string literals for regular expressions
+  * ocaml: Deal with fallback case
+  * examples/connect-benchmark.c: Include <stdatomic.h> or fall back
+  * docs: Minor copyediting to export name documentation
+  * docs: Document which NBD URI features are non-standard
+  * tests: Add a test of tls-username in NBD URIs
+  * lib/uri.c: Replace nbd-user with tls-username
+  * Version 1.23.7.
+  * docs: nbd_connect_uri: Combine export name sections together
+  * docs: nbd_connect_uri: Minor copyedits
+  * docs: nbd_connect_uri: Split up URI parsing section
+  * lib/uri.c: Add nbd-port and nbd-user parameters
+  * lib/uri.c: Return EINVAL errno for invalid SSH username
+  * lib/uri: Refactor long connect_uri function
+  * lib/uri.c: Use uri_query_list functions to free
+  * lib/uri.c: Add static annotation to parse_bool
+  * lib/uri.c: Factor out common char port_str[32]
+  * lib: Convert nbd+ssh://user@.. to SSH username
+  * docs: Clarify documentation for export names in nbd_connect_uri
+  * docs: Add S<...> around qemu versions to avoid distracting linebreak
+  * generator: rust: Parse S<...> (non-breaking spaces) in POD
+  * generator: rust: Allow nested X<..X<..>..> expressions in POD
+  * generator: Don't list nbd_is_uri as a "flag call"
+  * generator: Clarify documentation for nbd_set_private_data
+  * Version 1.23.6.
+  * ocaml: Get a better estimate of the size of the libnbd handle
+  * lib: When debugging is enabled print the size of the handle
+  * lib: New API nbd_get_handle_size to estimate the handle size
+  * ocaml: Small tweaks to the generated documentation
+  * ci: Remove fedora-40, alpine-320, add fedora-42, alpine-322
+  * python: Implement indexing and slicing for nbd.Buffer
+  * python: Add libnbd-python(3) documentation
+  * common: utils: Add const to <vector>_duplicate variable decls
+  * copy, info: Use new vector_array_append functions in a couple of places
+  * common: utils: vector: Fix vector_uniq prototype and add a test
+  * common: utils: vector: Add range functions for insert, append and remove
+  * common: utils: vector: Prefer vector_reset over free()
+  * common: utils: vector: Add new vector_uniq function
+  * common/utils: Add convenient string_append_format function
+  * Version 1.23.5.
+  * tools: Add extra version information in the output of --version
+  * ublk: Remove unused EXPECTED_VERSION
+  * lib: New API: nbd_get_version_extra
+  * build: Add ./configure --with-extra="..."
+  * todo: Remove a couple of minor features that have been implemented
+  * Version 1.23.4.
+  * api: Relax LIBNBD_STRICT_ALIGN for unaligned image size
+  * info: Tolerate nbdkit slop on large extents
+  * generator: Avoid const-correctness warnings in golang
+  * generator: Optimize buffer size on macOS and Linux
+  * ocaml: Implement NBD.Buffer.is_zero
+  * maint: Spelling fixes
+  * ci: Disable cross-builds of Rust
+  * rust: Allow cargo build --target $RUST_TARGET to be set
+  * Version 1.23.3.
+  * copy: Test --allocated + --destination-is-zero options together
+  * copy: Test --destination-is-zero option
+  * copy: Test --allocated option more thoroughly
+  * copy: Add a test of the --flush option
+  * copy: Remove output file in a few tests
+  * build: Print rustc version in ./configure output
+  * generator: Improve the comment for set_buffers
+  * Set socket buffer only for unix socket
+  * rust: Use nbd.is_uri in examples
+  * Set socket receive and send buffers on macOS
+  * ci: Skip go on FreeBSD 14
+  * ci: Update to latest
+  * copy: Fix file allocation when using --allocated
+  * copy: Fix file_sync_zero when allocate == true
+  * copy: Consider options when zeroing in synch mode
+  * copy: Fix corrupted hash on incomplete read
+  * copy: Enable zero optimization for allocated extents
+  * copy: Shrink struct block
+  * copy: Define block_type outside of block struct
+  * copy: Fix crash when blkhash size is not a power of 2
+  * Version 1.23.2.
+  * copy: Hard error if sync_file_range fails
+  * Version 1.23.1.
+  * copy: Add --blkhash option
+  * info/info-uri-nbds.sh: Fix test if compiled without GnuTLS
+  * copy: Set the total size in bytes copied
+  * copy: progress: Add a comment about size and pipes
+  * build: Create sections in the configure file
+  * build: Add heading about basic build environment
+  * build: Only use ANSI colour sequences if stdout is a terminal
+  * build: Embolden headings in configure output
+  * build: Colourize features
+
+-------------------------------------------------------------------
+Tue Oct 28 16:11:08 UTC 2025 - Charles Arnold <carnold@suse.com>
+
+- Update to version 1.22.5:
+  * Version 1.22.5.
+  * lib/uri.c: Fix indices in SSH command array.
+    Fixes bsc#1253059, bsc#1255432 - CVE-2025-14946
+  * uri: Sanitize user-provided hostnames
+  * examples/connect-benchmark.c: Include <stdatomic.h> or fall back
+  * docs: Minor copyediting to export name documentation
+
+-------------------------------------------------------------------
+Fri Sep 05 21:02:25 UTC 2025 - Charles Arnold <carnold@suse.com>
+
+- Update to version 1.22.4:
+  * Version 1.22.4.
+  * docs: nbd_connect_uri: Combine export name sections together
+  * docs: nbd_connect_uri: Minor copyedits
+  * docs: nbd_connect_uri: Split up URI parsing section
+  * lib/uri.c: Use uri_query_list functions to free
+  * lib/uri.c: Add static annotation to parse_bool
+  * docs: Clarify documentation for export names in nbd_connect_uri
+  * docs: Add S<...> around qemu versions to avoid distracting linebreak
+  * generator: rust: Parse S<...> (non-breaking spaces) in POD
+  * generator: rust: Allow nested X<..X<..>..> expressions in POD
+  * generator: Don't list nbd_is_uri as a "flag call"
+  * generator: Clarify documentation for nbd_set_private_data
+  * ocaml: Small tweaks to the generated documentation
+  * ci: Remove fedora-40, alpine-320, add fedora-42, alpine-322
+  * common: utils: Add const to <vector>_duplicate variable decls
+  * copy, info: Use new vector_array_append functions in a couple of places
+  * common: utils: vector: Fix vector_uniq prototype and add a test
+  * common: utils: vector: Add range functions for insert, append and remove
+  * common: utils: vector: Prefer vector_reset over free()
+  * common: utils: vector: Add new vector_uniq function
+  * common/utils: Add convenient string_append_format function
+
+-------------------------------------------------------------------
+Thu Jul 31 17:01:32 UTC 2025 - Charles Arnold <carnold@suse.com>
+
+- Update to version 1.22.3:
+  * Version 1.22.3.
+  * ublk: Remove unused EXPECTED_VERSION
+  * todo: Remove a couple of minor features that have been implemented
+  * info: Tolerate nbdkit slop on large extents
+  * generator: Avoid const-correctness warnings in golang
+  * maint: Spelling fixes
+  * ci: Disable cross-builds of Rust
+  * rust: Allow cargo build --target $RUST_TARGET to be set
+
+-------------------------------------------------------------------
+Tue May 06 22:48:02 UTC 2025 - jfehlig@suse.com
+
+- Update to version 1.22.2:
+  * Version 1.22.2.
+  * copy: Test --allocated + --destination-is-zero options together
+  * copy: Test --destination-is-zero option
+  * copy: Test --allocated option more thoroughly
+  * copy: Add a test of the --flush option
+  * copy: Remove output file in a few tests
+  * build: Print rustc version in ./configure output
+  * rust: Use nbd.is_uri in examples
+  * ci: Skip go on FreeBSD 14
+  * ci: Update to latest
+  * copy: Fix file allocation when using --allocated
+  * copy: Fix file_sync_zero when allocate == true
+  * copy: Consider options when zeroing in synch mode
+  * copy: Hard error if sync_file_range fails
+  * info/info-uri-nbds.sh: Fix test if compiled without GnuTLS
+  * copy: Set the total size in bytes copied
+  * copy: progress: Add a comment about size and pipes
+  * info: Use magenta for export headings, instead of black
+  * Version 1.22.1.
+  * ocaml/{examples,tests}: Don't try to run OCAMLFIND if --disable-ocaml
+  * docs/libnbd-release-notes-1.22.pod: Set release date
+  * Version 1.22.0.
+  * ci: Update FreeBSD builds
+  * copy: Include pthread.h
+  * docs: Small revisions to the release notes
+  * golang: Replace () with correct argument decl, for GCC 15
+  * docs: Add outline release notes for libnbd 1.22
+  * ci: Update to latest
+  * dump: Add a test of --length and --offset
+  * dump: Add --offset for further limiting the dump
+  * dump: Document --length
+  * examples: Add simple program to benchmark connections
+  * Version 1.21.6.
+  * build: Use 'tar ztf' instead of 'zcat | tar'
+  * Revert "ci: Skip maintainer-check-extra-dist test on macOS"
+  * ci: Skip maintainer-check-extra-dist test on macOS
+  * ci: Install bash (from homebrew) in the CI environment
+  * configure: Check that bash is sufficiently new
+  * ci: Dump out failed log files when the tests fail
+  * golang, rust: Use env bash for FreeBSD
+  * python: Skip Python tests on macOS
+  * tests/newstyle-limited.c: Check truncate is GNU truncate before using
+  * ocaml/tests/test_220_opt_list.ml: Use correct nbdkit binary
+  * ocaml/tests/test_580_aio_connect.ml: Skip this test on macOS
+  * build: Test for GnuTLS certtool on macOS
+  * build: Use GNU alternatives on macOS and FreeBSD
+  * copy/copy-file-to-nbd.sh: Remove test for 'truncate'
+  * lib/test-fork-safe-execvpe.sh: Skip this test on macOS
+  * ci/build.sh: Set os_id on macOS which lacks /etc/os-release
+  * ci: Don't skip tests on non-Linux
+  * Version 1.21.5.
+  * interop: Skip nbd-server test on Alpine
+  * ci: Update CI files
+  * vsock: Document limitations and reserved vsock port numbers
+  * rust: Parse perlpod L<https://...> (external links) to rust markup
+  * generator: connect_uri: Document differences with qemu parsing
+  * podwrapper: Add some simple checks for cross-references within manual pages.
+  * docs/libnbd-release-notes-1.10.pod: Remove broken link to "nbd_connect(3)"
+  * docs/nbd_create.pod: Cross-reference nbd_shutdown(3)
+  * Version 1.21.4.
+  * docs: Use "oldstyle servers" in preference to "older servers"
+  * docs: Mention newstyle and oldstyle servers in main docs
+  * docs: Mention nbd_is_uri under "Connecting to an NBD URI" in main docs
+  * README: Fix bold markdown
+  * README: Mention 'make install DESTDIR=...'
+  * README: Mention the ./run script
+  * lib: Add nbd_get_subprocess_pid to return h->pid
+  * docs/libnbd-security.pod: Assign CVE-2024-7383
+  * Version 1.21.3.
+  * build: Prefer "for developers" in ./configure --help output
+  * build: Fix ./configure --help output for --enable-python-code-style
+  * copy: Fix URI detection
+  * lib: Add new nbd_is_uri API
+  * tests/requires.c: Don't fail to compile if NBDKIT is not defined
+  * Version 1.21.2.
+  * lib: Implement nbd+ssh:// and nbds+ssh:// URIs
+  * tests/connect-uri.c: Replace -DREQUIRES_NBDKIT_TLS_VERIFY_PEER=1
+  * lib/uri.c: Change socket required boolean into an enum
+  * generator/states-newstyle.c: Don't sign extend escaped chars
+  * rust: Add os-ext feature to get mio::unix
+  * generator/states-newstyle.c: Quote untrusted string from the server
+  * generator: Restore assignment to local 'err'
+  * .gitignore: Remove unused line
+  * lib: Don't overwrite error in nbd_opt_{go,info}
+  * generator: Print full error in handle_reply_error
+  * ci: Drop Alma Linux 8
+  * lib/crypto.c: Check <gnutls/socket.h> works before including it
+  * lib/uri.c: Append tls-hostname and tls-verify-peer when getting URI
+  * Version 1.21.1.
+  * docs: security: Add link to TLS server certificate checking announcement
+  * lib/uri.c: Allow tls-hostname to be overridden in URIs
+  * lib/uri.c: Allow tls-verify-peer to be overridden in URIs
+  * lib/crypto.c: Add API functions to get/set TLS hostname
+
+-------------------------------------------------------------------
+Fri Oct 18 16:42:38 UTC 2024 - jfehlig@suse.com
+
+- Update to version 1.20.3:
+  * Version 1.20.3.
+  * interop: Skip nbd-server test on Alpine
+  * ci: Update CI files
+  * rust: Parse perlpod L<https://...> (external links) to rust markup
+  * podwrapper: Add some simple checks for cross-references within manual pages.
+  * docs/libnbd-release-notes-1.10.pod: Remove broken link to "nbd_connect(3)"
+  * docs/nbd_create.pod: Cross-reference nbd_shutdown(3)
+  * docs: Use "oldstyle servers" in preference to "older servers"
+  * docs: Mention newstyle and oldstyle servers in main docs
+  * README: Fix bold markdown
+  * README: Mention 'make install DESTDIR=...'
+  * README: Mention the ./run script
+  * build: Prefer "for developers" in ./configure --help output
+  * build: Fix ./configure --help output for --enable-python-code-style
+  * .gitignore: Remove unused line
+  * ci: Drop Alma Linux 8
+  * lib/crypto.c: Check <gnutls/socket.h> works before including it
+  * docs/libnbd-security.pod: Assign CVE-2024-7383
+  * jsc#PED-8910
+
 -------------------------------------------------------------------
 Mon Aug 05 16:08:37 UTC 2024 - jfehlig@suse.com
 
@@ -387,6 +707,7 @@ Fri Jul  8 17:59:24 UTC 2022 - James Fehlig <jfehlig@suse.com>
   * python: Plug uninit leak in nbd.Buffer.to_bytearray
   * python: Avoid memleak on (unlikely) module failure
   * python: Accept buffers in nbd.Buffer.from_bytearray()
+  * jsc#ECO-3633
 - Enable building python module and utilities
 
 -------------------------------------------------------------------

libnbd.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package libnbd
 #
-# Copyright (c) 2024 SUSE LLC
+# Copyright (c) 2026 SUSE LLC and contributors
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -19,7 +19,7 @@
 %define sover 0
 
 Name:           libnbd
-Version:        1.20.2
+Version:        1.24.0
 Release:        0
 Summary:        NBD client library in userspace
 License:        LGPL-2.1-or-later
@@ -161,9 +161,13 @@ done
 %{_bindir}/nbdcopy
 %{_bindir}/nbddump
 %{_bindir}/nbdinfo
+%{_bindir}/nbddiscard
+%{_bindir}/nbdzero
 %{_mandir}/man1/nbdcopy.1*
 %{_mandir}/man1/nbddump.1*
+%{_mandir}/man1/nbddiscard.1*
 %{_mandir}/man1/nbdinfo.1*
+%{_mandir}/man1/nbdzero.1*
 
 %files -n libnbd%{sover} -f %name.files
 %license COPYING.LIB
@@ -176,6 +180,7 @@ done
 %{_libdir}/pkgconfig/libnbd.pc
 %{_mandir}/man3/libnbd.3*
 %{_mandir}/man3/libnbd-ocaml.3.gz
+%{_mandir}/man3/libnbd-python.3*
 %{_mandir}/man1/libnbd-release-notes-1.*.1*
 %{_mandir}/man3/libnbd-security.3*
 %{_mandir}/man3/nbd_*.3*