Accepting request 1291196 from Base:System

OBS-URL: https://build.opensuse.org/request/show/1291196
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/coreutils?expand=0&rev=164

coreutils-9.5.tar.xz

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:cd328edeac92f6a665de9f323c93b712af1858bc2e0d88f3f7100469470a1b8a
-size 6007136

coreutils-9.5.tar.xz.sig

@@ -1,16 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQIzBAABCAAdFiEEbDfcEhIaUAa8HbgE32/ZcTBgN9kFAmYFirgACgkQ32/ZcTBg
-N9nZMg//WF6fyy6kxNZJIeUnAzAyMhY5hjlD33hFSaj2ihfmt7IQzRuOu7bhYk94
-5lpDJvfljubJpuAU15MD0g/7xdRVPEf/igkRqdvm79eWips1c8d7HfcorxqJcYKf
-40JV0rQyDaMqQbqFl6rPipAaagE3GBSdHz3eNVhiEQ9MII/XKNX7dZ/5MBIUW/wl
-VM7G7sA4WBh0k+K0fGNALrlFHSmQDqwVIVhuDlFNcVmY37NIsIcvIT910HlKTFWV
-A5okdepRs9a2dOIhGvMVK/U+4D9vbVbS+QlnXH74UlmnczKPQsCQKsusG02bv9L0
-ih+jFj9BVCoUjB1fQlo6/VE4Kvdhpg/NZKZCaKIEH0d4mn1XHqvyTTRN0SVOlJr8
-ZmY7e94A5TDbpkt5MFPxZ6M1Z5dZTtVX2/rkQtb59jIr/p5eYmjId3NsjWtoXICo
-XMr+hLtjMt/XIfN/eXnaSOZSoyNxOPurfe59hfjVhaexCeIrEIglZmYWw8HhkfWz
-vAxGWOFVwYfWlWlfxggdYkysRvU0vUb1JhO8HIRwmCX05YEhvTwKZMnvo/z/Y++G
-CrXyduj9e8jzRkunlU6mqFmHqaYrgt5t7e1PLFYxEgWBX77fvpSbBsLhX5nH2c6I
-4uRaQpaZQ+hnYu7U5OHfhy1OwG2qcYjbou4zK4BuI1ktnBHFgbc=
-=IhBg
------END PGP SIGNATURE-----

coreutils-9.7-sort-CVE-2025-5278.patch

@@ -0,0 +1,117 @@
+# based on commit 8c9602e3a145e9596dc1a63c6ed67865814b6633
+# removed offsets and fuzziness
+Author: Pádraig Brady <P@draigBrady.com>
+Date:   Tue May 20 16:03:44 2025 +0100
+
+    sort: fix buffer under-read (CWE-127)
+    
+    * src/sort.c (begfield): Check pointer adjustment
+    to avoid Out-of-range pointer offset (CWE-823).
+    (limfield): Likewise.
+    * tests/sort/sort-field-limit.sh: Add a new test,
+    which triggers with ASAN or Valgrind.
+    * tests/local.mk: Reference the new test.
+    * NEWS: Mention bug fix introduced in v7.2 (2009).
+    Fixes https://bugs.gnu.org/78507
+
+---
+ NEWS                           |   10 ++++++++++
+ src/sort.c                     |   12 ++++++++++--
+ tests/local.mk                 |    1 +
+ tests/sort/sort-field-limit.sh |   35 +++++++++++++++++++++++++++++++++++
+ 4 files changed, 56 insertions(+), 2 deletions(-)
+
+--- a/NEWS
++++ b/NEWS
+@@ -1,5 +1,15 @@
+ GNU coreutils NEWS                                    -*- outline -*-
+ 
++* Noteworthy changes in release ?.? (????-??-??) [?]
++
++** Bug fixes
++
++  sort with key character offsets of SIZE_MAX, could induce
++  a read of 1 byte before an allocated heap buffer. For example:
++  'sort +0.18446744073709551615R input' on 64 bit systems.
++  [bug introduced in coreutils-7.2]
++
++
+ * Noteworthy changes in release 9.7 (2025-04-09) [stable]
+ 
+ ** Bug fixes
+--- a/src/sort.c
++++ b/src/sort.c
+@@ -1793,7 +1793,11 @@ begfield_uni (const struct line *line, c
+       ++ptr;
+ 
+   /* Advance PTR by SCHAR (if possible), but no further than LIM.  */
+-  ptr = MIN (lim, ptr + schar);
++  size_t remaining_bytes = lim - ptr;
++  if (schar < remaining_bytes)
++    ptr += schar;
++  else
++    ptr = lim;
+ 
+   return ptr;
+ }
+@@ -1954,7 +1958,11 @@ limfield_uni (struct line const *line, s
+           ++ptr;
+ 
+       /* Advance PTR by ECHAR (if possible), but no further than LIM.  */
+-      ptr = MIN (lim, ptr + echar);
++      size_t remaining_bytes = lim - ptr;
++      if (echar < remaining_bytes)
++        ptr += echar;
++      else
++        ptr = lim;
+     }
+ 
+   return ptr;
+--- a/tests/local.mk
++++ b/tests/local.mk
+@@ -388,6 +388,7 @@ all_tests =					\
+   tests/sort/sort-debug-keys.sh			\
+   tests/sort/sort-debug-warn.sh			\
+   tests/sort/sort-discrim.sh			\
++  tests/sort/sort-field-limit.sh		\
+   tests/sort/sort-files0-from.pl		\
+   tests/sort/sort-float.sh			\
+   tests/misc/sort-mb-tests.sh			\
+--- /dev/null
++++ b/tests/sort/sort-field-limit.sh
+@@ -0,0 +1,35 @@
++#!/bin/sh
++# From 7.2-9.7, this would trigger an out of bounds mem read
++
++# Copyright (C) 2025 Free Software Foundation, Inc.
++
++# This program is free software: you can redistribute it and/or modify
++# it under the terms of the GNU General Public License as published by
++# the Free Software Foundation, either version 3 of the License, or
++# (at your option) any later version.
++
++# This program is distributed in the hope that it will be useful,
++# but WITHOUT ANY WARRANTY; without even the implied warranty of
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++# GNU General Public License for more details.
++
++# You should have received a copy of the GNU General Public License
++# along with this program.  If not, see <https://www.gnu.org/licenses/>.
++
++. "${srcdir=.}/tests/init.sh"; path_prepend_ ./src
++print_ver_ sort
++getlimits_
++
++# This issue triggers with valgrind or ASAN
++valgrind --error-exitcode=1 sort --version 2>/dev/null &&
++  VALGRIND='valgrind --error-exitcode=1'
++
++{ printf '%s\n' aa bb; } > in || framework_failure_
++
++_POSIX2_VERSION=200809 $VALGRIND sort +0.${SIZE_MAX}R in > out || fail=1
++compare in out || fail=1
++
++_POSIX2_VERSION=200809 $VALGRIND sort +1 -1.${SIZE_MAX}R in > out || fail=1
++compare in out || fail=1
++
++Exit $fail

coreutils-9.7.tar.xz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:e8bb26ad0293f9b5a1fc43fb42ba970e312c66ce92c1b0b16713d7500db251bf
+size 6158960

coreutils-9.7.tar.xz.sig

@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABCAAdFiEEbDfcEhIaUAa8HbgE32/ZcTBgN9kFAmf2WecACgkQ32/ZcTBg
+N9nppA/+MUNHBWrhVCFNzdMRQaSmwTyUkOpA+z4pL0a/i+9o3AD1RYF/Zrpen0+E
+6K9VTcYsmW/R7ZPL1xg4dl4WVBJ/1LrKu3D5ZP3kydpKH7PYriekeYR7dgJQMd9Q
+RIrE7RoXOWSa6aSEhQQ9U/9BQiGrwo46Ja9A3LSn/c8Ty1/49e5HA3pQG0U2GIGb
+cxLKz6nWcI2MYnTWm3nuSk0AlL9LetVEyoNR7SUufjzqCpgCZTAd7vN6y476A+kv
+ajsBVTj1OGj3FKNff/a5Qhc0i+Xmtn/81S5sG8DnTJtb7q1J7B/5odchq5jQsGyH
+8QfxYnu++pOgsLThGR98Io5hA/rqcofZFU2rIIXm65Qb7YB4yLgcS9m6STlUEFLU
+mOOF8I5pVvbxewUz0WVxit1ist1P+AIFwBvv3H/2zgl2AOua+WpKxt2gISRY9j1c
+E4KOvwlpu4ebFo2CcK0NxLF82YXY8sQQVtR1HCmg10inAZp0XsfRocbYj+dOnvY5
+7jthL4GxWAIeDrAiS/oJmtL0Savhq9hB6u6zR5G5Puh6SigDX0NmMPqMsGtQ3t8n
+GlnLldNVujaNe6NYYHSATGu6yHByBOSGNk7IDEeRFyF74p9w6gV+qJNYuS7EtXVt
+sdNiA/UIxhk0KyL4rhDwUw9AbbTP/HhlB+FD+LJX61bxQfFnWuQ=
+=YizV
+-----END PGP SIGNATURE-----

coreutils-disable_tests.patch

@@ -6,7 +6,7 @@ Index: gnulib-tests/gnulib.mk
 ===================================================================
 --- gnulib-tests/gnulib.mk.orig
 +++ gnulib-tests/gnulib.mk
-@@ -1473,10 +1473,10 @@ EXTRA_DIST += test-getloadavg.c signatur
+@@ -1548,10 +1548,10 @@ EXTRA_DIST += getlocalename_l-unsafe.h l
  
  ## begin gnulib module getlogin-tests
  

coreutils-fix-gnulib-time_r-tests.patch

@@ -1,95 +0,0 @@
-2 upstream gnulib commits for coreutils-9.5 to skip localtime_r tests
-when the timezone 'Europe/Paris' does not work.
-
-Commit 1:
-  http://git.sv.gnu.org/cgit/gnulib.git/commit/?id=f130f5426ecd4edd559
-
-From f130f5426ecd4edd5596797e0a5721b927f80126 Mon Sep 17 00:00:00 2001
-From: Paul Eggert <eggert@cs.ucla.edu>
-Date: Sat, 30 Mar 2024 13:28:01 -0600
-Subject: [PATCH 1/2] time_r-tests: skip French tests if no Europe/Paris
-
-* tests/test-localtime_r.c (main):
-* tests/test-localtime_r-mt.c (main):
-If TZ='Europe/Paris' does not work, skip these tests.
-
-Commit 2:
-  http://git.sv.gnu.org/cgit/gnulib.git/commit/?id=2c04db80e2c52b8f05b
-
-From 2c04db80e2c52b8f05b4136af955510e7d370470 Mon Sep 17 00:00:00 2001
-From: Bruno Haible <bruno@clisp.org>
-Date: Sat, 30 Mar 2024 22:50:39 +0100
-Subject: [PATCH 2/2] time_r tests: Avoid misleading skip message on native
- Windows.
-
-* tests/test-localtime_r.c (main): Use the macro FRENCH_TZ.
-* tests/test-localtime_r-mt.c (main): Likewise.
----
- gnulib-tests/test-localtime_r-mt.c |   21 +++++++++++++++++++++
- gnulib-tests/test-localtime_r.c    |   21 +++++++++++++++++++++
- 2 files changed, 42 insertions(+)
-
-Index: gnulib-tests/test-localtime_r-mt.c
-===================================================================
---- gnulib-tests/test-localtime_r-mt.c.orig
-+++ gnulib-tests/test-localtime_r-mt.c
-@@ -107,6 +107,27 @@ main (int argc, char *argv[])
- {
-   setenv ("TZ", FRENCH_TZ, 1);
- 
-+  /* Check that this TZ works.  */
-+  {
-+    time_t t = 0; /* 1970-01-01 01:00:00 */
-+    struct tm *result = localtime (&t);
-+    if (! (result
-+           && result->tm_sec == 0
-+           && result->tm_min == 0
-+           && result->tm_hour == 1
-+           && result->tm_mday == 1
-+           && result->tm_mon == 1 - 1
-+           && result->tm_year == 1970 - 1900
-+           && result->tm_wday == 4
-+           && result->tm_yday == 0
-+           && result->tm_isdst == 0))
-+      {
-+        fputs ("Skipping test: TZ='" FRENCH_TZ "' is not Paris time\n",
-+               stderr);
-+        return 77;
-+      }
-+  }
-+
-   /* Create the threads.  */
-   gl_thread_create (thread1_func, NULL);
-   gl_thread_create (thread2_func, NULL);
-Index: gnulib-tests/test-localtime_r.c
-===================================================================
---- gnulib-tests/test-localtime_r.c.orig
-+++ gnulib-tests/test-localtime_r.c
-@@ -43,6 +43,27 @@ main (void)
- {
-   setenv ("TZ", FRENCH_TZ, 1);
- 
-+  /* Check that this TZ works.  */
-+  {
-+    time_t t = 0; /* 1970-01-01 01:00:00 */
-+    struct tm *result = localtime (&t);
-+    if (! (result
-+           && result->tm_sec == 0
-+           && result->tm_min == 0
-+           && result->tm_hour == 1
-+           && result->tm_mday == 1
-+           && result->tm_mon == 1 - 1
-+           && result->tm_year == 1970 - 1900
-+           && result->tm_wday == 4
-+           && result->tm_yday == 0
-+           && result->tm_isdst == 0))
-+      {
-+        fputs ("Skipping test: TZ='" FRENCH_TZ "' is not Paris time\n",
-+               stderr);
-+        return 77;
-+      }
-+  }
-+
-   /* Note: The result->tm_gmtoff values and the result->tm_zone values are the
-      same (3600, "CET" or 7200, "CEST") across all tested platforms:
-      glibc, musl, macOS, FreeBSD, NetBSD, OpenBSD, Minix, Cygwin, Android.  */

coreutils-getaddrinfo.patch

@@ -6,7 +6,7 @@ Index: gnulib-tests/test-getaddrinfo.c
 ===================================================================
 --- gnulib-tests/test-getaddrinfo.c.orig
 +++ gnulib-tests/test-getaddrinfo.c
-@@ -93,11 +93,7 @@ simple (char const *host, char const *se
+@@ -115,11 +115,7 @@ simple (int pass, char const *host, char
           the test merely because someone is down the country on their
           in-law's farm. */
        if (res == EAI_AGAIN)

coreutils-remove_hostname_documentation.patch

@@ -31,7 +31,7 @@ Index: doc/coreutils.texi
  * hostid invocation::            Print numeric host identifier
  * uptime invocation::            Print system uptime and load
  
-@@ -16421,7 +16419,6 @@ information.
+@@ -16482,7 +16480,6 @@ information.
  * arch invocation::             Print machine hardware name.
  * nproc invocation::            Print the number of processors.
  * uname invocation::            Print system information.
@@ -39,7 +39,7 @@ Index: doc/coreutils.texi
  * hostid invocation::           Print numeric host identifier.
  * uptime invocation::           Print system uptime and load.
  @end menu
-@@ -17329,15 +17326,6 @@ This is non-portable, even across GNU/Li
+@@ -17395,15 +17392,6 @@ This is non-portable, even across GNU/Li
  Print the machine hardware name (sometimes called the hardware class
  or hardware type).
  
@@ -55,7 +55,7 @@ Index: doc/coreutils.texi
  @item -p
  @itemx --processor
  @opindex -p
-@@ -17391,34 +17379,6 @@ Print the kernel version.
+@@ -17457,34 +17445,6 @@ Print the kernel version.
  
  @exitstatus
  

coreutils-remove_kill_documentation.patch

@@ -33,7 +33,7 @@ Index: doc/coreutils.texi
  Delaying
  
  * sleep invocation::             Delay for a specified time
-@@ -18848,90 +18842,6 @@ timeout -s INT 5s env --ignore-signal=IN
+@@ -18923,90 +18917,6 @@ timeout -s INT 5s env --ignore-signal=IN
  timeout -s INT -k 3s 5s env --ignore-signal=INT sleep 20
  @end example
  

coreutils-skip-gnulib-test-tls.patch

@@ -21,7 +21,7 @@ Index: gnulib-tests/gnulib.mk
 ===================================================================
 --- gnulib-tests/gnulib.mk.orig
 +++ gnulib-tests/gnulib.mk
-@@ -3299,9 +3299,10 @@ EXTRA_DIST += test-timespec.c macros.h
+@@ -3605,9 +3605,10 @@ EXTRA_DIST += test-timespec.c macros.h
  
  ## begin gnulib module tls-tests
  

coreutils-tests-shorten-extreme-factor-tests.patch

@@ -16,7 +16,7 @@ Index: tests/local.mk
 ===================================================================
 --- tests/local.mk.orig
 +++ tests/local.mk
-@@ -755,14 +755,9 @@ all_tests =					\
+@@ -759,14 +759,9 @@ all_tests =					\
  # See tests/factor/create-test.sh.
  tf = tests/factor
  factor_tests = \
@@ -27,10 +27,10 @@ Index: tests/local.mk
 -  $(tf)/t20.sh $(tf)/t21.sh $(tf)/t22.sh $(tf)/t23.sh $(tf)/t24.sh \
 -  $(tf)/t25.sh $(tf)/t26.sh $(tf)/t27.sh $(tf)/t28.sh $(tf)/t29.sh \
 -  $(tf)/t30.sh $(tf)/t31.sh $(tf)/t32.sh $(tf)/t33.sh $(tf)/t34.sh \
--  $(tf)/t35.sh $(tf)/t36.sh
+-  $(tf)/t35.sh $(tf)/t36.sh $(tf)/t37.sh
 +  $(tf)/t00.sh \
 +  $(tf)/t05.sh \
-+  $(tf)/t36.sh
++  $(tf)/t36.sh $(tf)/t37.sh
  
  $(factor_tests): $(tf)/run.sh $(tf)/create-test.sh
  	$(AM_V_GEN)$(MKDIR_P) $(tf)

coreutils-tests-workaround-make-fdleak.patch

@@ -6,7 +6,7 @@ Index: tests/init.sh
 ===================================================================
 --- tests/init.sh.orig
 +++ tests/init.sh
-@@ -691,6 +691,16 @@ compare ()
+@@ -731,6 +731,16 @@ compare ()
  }
  
  # -----------------------------------------------------------------------------

coreutils.changes

@@ -1,3 +1,164 @@
+-------------------------------------------------------------------
+Mon Jun  2 09:30:09 UTC 2025 - rw@suse.com
+
+- coreutils-9.7-sort-CVE-2025-5278.patch: Add upstream patch:
+  sort with key character offsets of SIZE_MAX, could induce
+  a read of 1 byte before an allocated heap buffer.
+  (CVE-2025-5278, bsc#1243767)
+
+-------------------------------------------------------------------
+Sun Apr 13 18:32:55 UTC 2025 - Bernhard Voelker <mail@bernhard-voelker.de>
+
+- coreutils-i18n.patch: update gnulib mbchar+mbfile to the commit
+  used by coreutils-9.7:
+    https://git.sv.gnu.org/cgit/gnulib.git/commit/?id=41e7b7e0d
+    mainly to pick up these commits:
+    - c67c553e758 mbfile: Support pushback characters also right before EOF.
+    - 87ee7ef66ee mbfile: Allow 2 pushback characters.
+
+-------------------------------------------------------------------
+Thu Apr 10 20:56:23 UTC 2025 - Bernhard Voelker <mail@bernhard-voelker.de>
+
+- Update to 9.7:
+  Bug fixes
+  * 'cat' would fail with "input file is output file" if input and
+    output are the same terminal device and the output is append-only.
+    [bug introduced in coreutils-9.6]
+  * 'cksum -a crc' misbehaved on aarch64 with 32-bit uint_fast32_t.
+    [bug introduced in coreutils-9.6]
+  * dd with the 'nocache' flag will now detect all failures to drop the
+    cache for the whole file.  Previously it may have erroneously succeeded.
+    [bug introduced with the "nocache" feature in coreutils-8.11]
+  * 'ls -Z dir' would crash on all systems, and 'ls -l' could crash
+    on systems like Android with SELinux but without xattr support.
+    [bug introduced in coreutils-9.6]
+  * `ls -l` could output spurious "Not supported" errors in certain cases,
+    like with dangling symlinks on cygwin.
+    [bug introduced in coreutils-9.6]
+  * timeout would fail to timeout commands with infinitesimal timeouts.
+    For example `timeout 1e-5000 sleep inf` would never timeout.
+    [bug introduced with timeout in coreutils-7.0]
+  * sleep, tail, and timeout would sometimes sleep for slightly less
+    time than requested.
+    [bug introduced in coreutils-5.0]
+  * 'who -m' now outputs entries for remote logins.  Previously login
+    entries prefixed with the service (like "sshd") were not matched.
+    [bug introduced in coreutils-9.4]
+  Improvements
+  * 'logname' correctly returns the user who logged in the session,
+    on more systems.  Previously on musl or uclibc it would have merely
+    output the LOGNAME environment variable.
+- coreutils-9.6-ls-Z-crash-fix.patch: Remove now-upstream patch.
+- Refresh all other patches.
+
+-------------------------------------------------------------------
+Fri Jan 17 22:22:08 UTC 2025 - Bernhard Voelker <mail@bernhard-voelker.de>
+
+- Update to 9.6:
+  Bug fixes
+  * cp fixes support for --update=none-fail, which would have been
+    rejected as an invalid option.
+    [bug introduced in coreutils-9.5]
+  * cp,mv --update no longer overrides --interactive or --force.
+    [bug introduced in coreutils-9.3]
+  * csplit no longer creates empty files given empty input.
+    [This bug was present in "the beginning".]
+  * ls and printf fix shell quoted output in the edge case of escaped
+    first and last characters, and single quotes in the string.
+    [bug introduced in coreutils-8.26]
+  * ls -l no longer outputs "Permission denied" errors on NFS
+    which may happen with files without read permission, and which resulted
+    in inaccurate indication of ACLs (missing '+' flag after mode).
+    [bug introduced in coreutils-9.4]
+  * ls -l no longer outputs "Not supported" errors on virtiofs.
+    [bug introduced in coreutils-9.4]
+  * mv works again with macFUSE file systems.  Previously it would
+    have exited with a "Function not implemented" error.
+    [bug introduced in coreutils-8.28]
+  * nproc gives more consistent results on systems with more than 1024 CPUs.
+    Previously it would have ignored the affinity mask on such systems.
+    [bug introduced with nproc in coreutils-8.1]
+  * numfmt --from=iec-i now works with numbers without a suffix.
+    Previously such numbers were rejected with an error.
+    [bug introduced with numfmt in coreutils-8.21]
+  * printf now diagnoses attempts to treat empty strings as numbers,
+    as per POSIX. For example, "printf '%d' ''" now issues a diagnostic
+    and fails instead of silently succeeding.
+    [This bug was present in "the beginning".]
+  * pwd no longer outputs an erroneous double slash on systems
+    where the system getcwd() was completely replaced.
+    [bug introduced in coreutils-9.2]
+  * 'shuf' generates more-random output when the output is small.
+    [bug introduced in coreutils-8.6]
+  * `tail --follow=name` no longer waits indefinitely for watched
+    file names that are moved elsewhere within the same file system.
+    [bug introduced in coreutils-8.24]
+  * `tail --follow` without --retry, will consistently exit with failure status
+    where inotify is not used, when all followed files become inaccessible.
+    [This bug was present in "the beginning".]
+  * `tail --follow --pid=PID` will now exit when the PID dies,
+    even in the presence of blocking inputs like unopened fifos.
+    [This bug was present in "the beginning".]
+  * 'tail -c 4096 /dev/zero' no longer loops forever.
+    [This bug was present in "the beginning".]
+  Changes in behavior
+  * 'factor' now buffers output more efficiently in some cases.
+  * install -C now dereferences symlink sources when comparing,
+    rather than always treating as different and performing the copy.
+  * kill -l and -t now list signal 0, as it's a valid signal to send.
+  * ls's -f option now simply acts like -aU, instead of also ignoring
+    some earlier options.  For example 'ls -fl' and 'ls -lf' are now
+    equivalent because -f no longer ignores an earlier -l.  The new
+    behavior is more orthogonal and is compatible with FreeBSD.
+  * stat -f -c%T now reports the "fuseblk" file system type as "fuse",
+    given that there is no longer a distinct "ctl" fuse variant file system.
+  New Features
+  * cksum -a now supports the "crc32b" option, which calculates the CRC
+    of the input as defined by ITU V.42, as used by gzip for example.
+    For performance pclmul instructions are used where supported.
+  * ls now supports the --sort=name option,
+    to explicitly select the default operation of sorting by file name.
+  * printf now supports indexed arguments, using the POSIX:2024 specified
+    %<i>$ format, where '<i>' is an integer referencing a particular argument,
+    thus allowing repetition or reordering of printf arguments.
+  * test supports the POSIX:2024 specified '<' and '>' operators with strings,
+    to compare the string locale collating order.
+  * timeout now supports the POSIX:2024 specified -f, and -p short options,
+    corresponding to --foreground, and --preserve-status respectively.
+  Improvements
+  * cksum -a crc, makes use of AVX2, AVX512, and ARMv8 SIMD extensions
+    for time reductions of up to 40%, 60%, and 80% respectively.
+  * 'head -c NUM', 'head -n NUM', 'nl -l NUM', 'nproc --ignore NUM',
+    'tail -c NUM', 'tail -n NUM', and 'tail --max-unchanged-stats NUM’
+    no longer fail merely because NUM stands for 2**64 or more.
+  * sort operates more efficiently when used on pseudo files with
+    an apparent size of 0, like those in /proc.
+  * stat and tail now know about the "bcachefs", and "pidfs" file system types.
+    stat -f -c%T now reports the file system type,
+    and tail -f uses inotify for these file systems.
+  * wc now reads a minimum of 256KiB at a time.
+    This was previously 16KiB and increasing to 256KiB was seen to increase
+    wc -l performance by about 10% when reading cached files on modern systems.
+- coreutils-fix-gnulib-time_r-tests.patch: Remove now-upstream patch.
+- coreutils-9.6-ls-Z-crash-fix.patch: Add upstream patch from after the release.
+- coreutils.spec (Patch920): Exchange names of above patch files accordingly.
+- coreutils-i18n.patch: Refresh patch, manually porting some upstream fixes
+  into the i18n chunks for expand.c, fold.c and unexpand.c.
+- Refresh all other patches:
+  * coreutils-disable_tests.patch
+  * coreutils-remove_hostname_documentation.patch
+  * coreutils-remove_kill_documentation.patch
+  * coreutils-skip-gnulib-test-tls.patch
+  * coreutils-tests-shorten-extreme-factor-tests.patch
+  * coreutils-tests-workaround-make-fdleak.patch
+
+-------------------------------------------------------------------
+Sun Sep 29 14:36:55 UTC 2024 - Bernhard Voelker <mail@bernhard-voelker.de>
+
+- coreutils-i18n.patch: fold(1): fix fold -b with UTF8 locale.
+  Sync fix in I18N patch from Fedora/Redhat and add a test. (RHEL-60295)
+  Original report: https://access.redhat.com/solutions/3459791
+
 -------------------------------------------------------------------
 Fri Jul 19 07:57:52 UTC 2024 - Andreas Schwab <schwab@suse.de>
 

coreutils.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package coreutils
 #
-# Copyright (c) 2024 SUSE LLC
+# Copyright (c) 2025 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -30,7 +30,7 @@
 %global psuffix %{nil}
 %endif
 Name:           coreutils%{?psuffix}
-Version:        9.5
+Version:        9.7
 Release:        0
 Summary:        GNU Core Utilities
 License:        GPL-3.0-or-later
@@ -44,6 +44,7 @@ Patch1:         coreutils-remove_hostname_documentation.patch
 Patch3:         coreutils-remove_kill_documentation.patch
 Patch4:         coreutils-i18n.patch
 Patch8:         coreutils-sysinfo.patch
+Patch10:        coreutils-9.7-sort-CVE-2025-5278.patch
 # OBS / RPMLINT require /usr/bin/timeout to be built with the -fpie option.
 Patch100:       coreutils-build-timeout-as-pie.patch
 # There is no network in the build root so make the test succeed
@@ -64,8 +65,7 @@ Patch501:       coreutils-test_without_valgrind.patch
 # tests: skip tests/rm/ext3-perf.sh temporarily as it hangs on OBS.
 Patch810:       coreutils-skip-tests-rm-ext3-perf.patch
 Patch900:       coreutils-tests-workaround-make-fdleak.patch
-# Upstream gnulib patch for coreutils-9.5.
-Patch920:       coreutils-fix-gnulib-time_r-tests.patch
+
 BuildRequires:  automake
 BuildRequires:  gmp-devel
 BuildRequires:  hostname
@@ -147,6 +147,7 @@ This package contains the documentation for the GNU Core Utilities.
 %patch -P 1
 %patch -P 3
 %patch -P 8
+%patch -P 10 -p1
 #
 %if 0%{?suse_version} <= 1320
 %patch -P 100
@@ -167,7 +168,6 @@ This package contains the documentation for the GNU Core Utilities.
 
 %patch -P 810
 %patch -P 900
-%patch -P 920
 
 # ================================================
 %build