Version in base suite: 287-1 Base version: cockpit_287-1 Target version: cockpit_287.1-0+deb12u2 Base file: /srv/ftp-master.debian.org/ftp/pool/main/c/cockpit/cockpit_287-1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/c/cockpit/cockpit_287.1-0+deb12u2.dsc /srv/release.debian.org/tmp/ex_Q5_htkA/cockpit-287.1/dist/sosreport/sosreport.js.gz |binary cockpit-287.1/aclocal.m4 | 19 ---- cockpit-287.1/configure | 40 +++------- cockpit-287.1/debian/changelog | 16 ++++ cockpit-287.1/debian/patches/0001-ssh-Use-valid-host-name-in-test-sshbridge.patch | 36 +++++++++ cockpit-287.1/debian/patches/series | 1 cockpit-287.1/pkg/sosreport/index.jsx | 11 ++ cockpit-287.1/src/client/org.cockpit_project.CockpitClient.metainfo.xml | 2 cockpit-287.1/test/verify/check-sosreport | 6 + cockpit-287.1/tools/arch/PKGBUILD | 2 cockpit-287.1/tools/cockpit.spec | 2 cockpit-287.1/tools/debian/changelog | 2 cockpit-287.1/tools/debian/copyright | 30 +++---- cockpit-287.1/version.m4 | 2 14 files changed, 102 insertions(+), 67 deletions(-) diff -Nru cockpit-287/aclocal.m4 cockpit-287.1/aclocal.m4 --- cockpit-287/aclocal.m4 2023-03-08 08:51:04.000000000 +0000 +++ cockpit-287.1/aclocal.m4 2024-04-02 08:24:57.000000000 +0000 @@ -1189,7 +1189,6 @@ dnl supported. (2.0 was released on October 16, 2000). m4_define_default([_AM_PYTHON_INTERPRETER_LIST], [python python2 python3 dnl - python3.11 python3.10 dnl python3.9 python3.8 python3.7 python3.6 python3.5 python3.4 python3.3 dnl python3.2 python3.1 python3.0 dnl python2.7 python2.6 python2.5 python2.4 python2.3 python2.2 python2.1 dnl @@ -1406,14 +1405,7 @@ am_cv_python_pythondir=`$PYTHON -c " $am_python_setup_sysconfig if can_use_sysconfig: - if hasattr(sysconfig, 'get_default_scheme'): - scheme = sysconfig.get_default_scheme() - else: - scheme = sysconfig._get_default_scheme() - if scheme == 'posix_local': - # Debian's default scheme installs to /usr/local/ but we want to find headers in /usr/ - scheme = 'posix_prefix' - sitedir = sysconfig.get_path('purelib', scheme, vars={'base':'$am_py_prefix'}) + sitedir = sysconfig.get_path('purelib', vars={'base':'$am_py_prefix'}) else: from distutils import sysconfig sitedir = sysconfig.get_python_lib(0, 0, prefix='$am_py_prefix') @@ -1455,14 +1447,7 @@ am_cv_python_pyexecdir=`$PYTHON -c " $am_python_setup_sysconfig if can_use_sysconfig: - if hasattr(sysconfig, 'get_default_scheme'): - scheme = sysconfig.get_default_scheme() - else: - scheme = sysconfig._get_default_scheme() - if scheme == 'posix_local': - # Debian's default scheme installs to /usr/local/ but we want to find headers in /usr/ - scheme = 'posix_prefix' - sitedir = sysconfig.get_path('platlib', scheme, vars={'platbase':'$am_py_exec_prefix'}) + sitedir = sysconfig.get_path('platlib', vars={'platbase':'$am_py_exec_prefix'}) else: from distutils import sysconfig sitedir = sysconfig.get_python_lib(1, 0, prefix='$am_py_exec_prefix') diff -Nru cockpit-287/configure cockpit-287.1/configure --- cockpit-287/configure 2023-03-08 08:51:05.000000000 +0000 +++ cockpit-287.1/configure 2024-04-02 08:24:58.000000000 +0000 @@ -1,6 +1,6 @@ #! /bin/sh # Guess values for system-dependent variables and create Makefiles. -# Generated by GNU Autoconf 2.71 for Cockpit 287. +# Generated by GNU Autoconf 2.71 for Cockpit 287.1. # # Report bugs to . # @@ -610,8 +610,8 @@ # Identity of this package. PACKAGE_NAME='Cockpit' PACKAGE_TARNAME='cockpit' -PACKAGE_VERSION='287' -PACKAGE_STRING='Cockpit 287' +PACKAGE_VERSION='287.1' +PACKAGE_STRING='Cockpit 287.1' PACKAGE_BUGREPORT='devel@lists.cockpit-project.org' PACKAGE_URL='https://cockpit-project.org/' @@ -1407,7 +1407,7 @@ # Omit some internal or obsolete options to make the list less imposing. # This message is too long to be a string in the A/UX 3.1 sh. cat <<_ACEOF -\`configure' configures Cockpit 287 to adapt to many kinds of systems. +\`configure' configures Cockpit 287.1 to adapt to many kinds of systems. Usage: $0 [OPTION]... [VAR=VALUE]... @@ -1474,7 +1474,7 @@ if test -n "$ac_init_help"; then case $ac_init_help in - short | recursive ) echo "Configuration of Cockpit 287:";; + short | recursive ) echo "Configuration of Cockpit 287.1:";; esac cat <<\_ACEOF @@ -1647,7 +1647,7 @@ test -n "$ac_init_help" && exit $ac_status if $ac_init_version; then cat <<\_ACEOF -Cockpit configure 287 +Cockpit configure 287.1 generated by GNU Autoconf 2.71 Copyright (C) 2021 Free Software Foundation, Inc. @@ -1865,7 +1865,7 @@ This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. -It was created by Cockpit $as_me 287, which was +It was created by Cockpit $as_me 287.1, which was generated by GNU Autoconf 2.71. Invocation command line was $ $0$ac_configure_args_raw @@ -3142,7 +3142,7 @@ # Define the identity of the package. PACKAGE='cockpit' - VERSION='287' + VERSION='287.1' printf "%s\n" "#define PACKAGE \"$PACKAGE\"" >>confdefs.h @@ -6994,7 +6994,7 @@ printf %s "(cached) " >&6 else $as_nop - for am_cv_pathless_PYTHON in python python2 python3 python3.11 python3.10 python3.9 python3.8 python3.7 python3.6 python3.5 python3.4 python3.3 python3.2 python3.1 python3.0 python2.7 python2.6 python2.5 python2.4 python2.3 python2.2 python2.1 python2.0 none; do + for am_cv_pathless_PYTHON in python python2 python3 python3.9 python3.8 python3.7 python3.6 python3.5 python3.4 python3.3 python3.2 python3.1 python3.0 python2.7 python2.6 python2.5 python2.4 python2.3 python2.2 python2.1 python2.0 none; do test "$am_cv_pathless_PYTHON" = none && break prog="import sys # split strings by '.' and convert to numeric. Append some zeros @@ -7272,14 +7272,7 @@ am_cv_python_pythondir=`$PYTHON -c " $am_python_setup_sysconfig if can_use_sysconfig: - if hasattr(sysconfig, 'get_default_scheme'): - scheme = sysconfig.get_default_scheme() - else: - scheme = sysconfig._get_default_scheme() - if scheme == 'posix_local': - # Debian's default scheme installs to /usr/local/ but we want to find headers in /usr/ - scheme = 'posix_prefix' - sitedir = sysconfig.get_path('purelib', scheme, vars={'base':'$am_py_prefix'}) + sitedir = sysconfig.get_path('purelib', vars={'base':'$am_py_prefix'}) else: from distutils import sysconfig sitedir = sysconfig.get_python_lib(0, 0, prefix='$am_py_prefix') @@ -7322,14 +7315,7 @@ am_cv_python_pyexecdir=`$PYTHON -c " $am_python_setup_sysconfig if can_use_sysconfig: - if hasattr(sysconfig, 'get_default_scheme'): - scheme = sysconfig.get_default_scheme() - else: - scheme = sysconfig._get_default_scheme() - if scheme == 'posix_local': - # Debian's default scheme installs to /usr/local/ but we want to find headers in /usr/ - scheme = 'posix_prefix' - sitedir = sysconfig.get_path('platlib', scheme, vars={'platbase':'$am_py_exec_prefix'}) + sitedir = sysconfig.get_path('platlib', vars={'platbase':'$am_py_exec_prefix'}) else: from distutils import sysconfig sitedir = sysconfig.get_python_lib(1, 0, prefix='$am_py_exec_prefix') @@ -7928,7 +7914,7 @@ # report actual input values of CONFIG_FILES etc. instead of their # values after options handling. ac_log=" -This file was extended by Cockpit $as_me 287, which was +This file was extended by Cockpit $as_me 287.1, which was generated by GNU Autoconf 2.71. Invocation command line was CONFIG_FILES = $CONFIG_FILES @@ -7997,7 +7983,7 @@ cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_cs_config='$ac_cs_config_escaped' ac_cs_version="\\ -Cockpit config.status 287 +Cockpit config.status 287.1 configured by $0, generated by GNU Autoconf 2.71, with options \\"\$ac_cs_config\\" diff -Nru cockpit-287/debian/changelog cockpit-287.1/debian/changelog --- cockpit-287/debian/changelog 2023-03-10 10:41:16.000000000 +0000 +++ cockpit-287.1/debian/changelog 2024-04-16 07:20:17.000000000 +0000 @@ -1,3 +1,19 @@ +cockpit (287.1-0+deb12u2) bookworm-security; urgency=medium + + * Add 0001-ssh-Use-valid-host-name-in-test-sshbridge.patch: + Use valid host name in test-sshbridge. Fixes FTBFS due to unit test + failure when building against libssh 0.10.6. (Closes: #1069059) + + -- Martin Pitt Tue, 16 Apr 2024 09:20:17 +0200 + +cockpit (287.1-0+deb12u1) bookworm-security; urgency=medium + + * New upstream security update: + - sosreport: Fix command injection with crafted report names + [CVE-2024-2947] + + -- Martin Pitt Tue, 02 Apr 2024 11:11:19 +0200 + cockpit (287-1) unstable; urgency=medium * New upstream release: diff -Nru cockpit-287/debian/patches/0001-ssh-Use-valid-host-name-in-test-sshbridge.patch cockpit-287.1/debian/patches/0001-ssh-Use-valid-host-name-in-test-sshbridge.patch --- cockpit-287/debian/patches/0001-ssh-Use-valid-host-name-in-test-sshbridge.patch 1970-01-01 00:00:00.000000000 +0000 +++ cockpit-287.1/debian/patches/0001-ssh-Use-valid-host-name-in-test-sshbridge.patch 2024-04-16 07:19:18.000000000 +0000 @@ -0,0 +1,36 @@ +From 518d36c349202052578a459872c3657760226648 Mon Sep 17 00:00:00 2001 +From: Martin Pitt +Date: Fri, 29 Dec 2023 07:12:11 +0100 +Subject: [PATCH] ssh: Use valid host name in test-sshbridge + +libssh 0.10.6 made host name parsing stricter. `some_host` is not a +valid general host name, and is rejected with the latest version. +--- + src/ssh/test-sshbridge.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/ssh/test-sshbridge.c b/src/ssh/test-sshbridge.c +index e0ff9a7a9..9c561e29a 100644 +--- a/src/ssh/test-sshbridge.c ++++ b/src/ssh/test-sshbridge.c +@@ -323,7 +323,7 @@ setup (TestCase *tc, + if (!fixture->knownhosts_home) + g_assert_cmpint (mkdir (tc->home_ssh_dir, 0700), ==, 0); + +- g_string_append (content, "Host some_host\n"); ++ g_string_append (content, "Host somehost\n"); + g_string_append_printf (content, "\tHostname %s\n", hostname); + + if (fixture->ssh_config_port == PORT_VALID) +@@ -346,7 +346,7 @@ setup (TestCase *tc, + if (fixture->ssh_config_user == USER_INVALID_HOST_PRIORITY) + g_string_append_printf (new_host, "%s@", g_get_user_name ()); + /* Host in the ssh config file */ +- g_string_append (new_host, "some_host"); ++ g_string_append (new_host, "somehost"); + /* The port in host should take priority over the port in ssh config */ + if (fixture->ssh_config_port == PORT_INVALID_HOST_PRIORITY) + g_string_append_printf (new_host, ":%hu", tc->ssh_port); +-- +2.44.0 + diff -Nru cockpit-287/debian/patches/series cockpit-287.1/debian/patches/series --- cockpit-287/debian/patches/series 1970-01-01 00:00:00.000000000 +0000 +++ cockpit-287.1/debian/patches/series 2024-04-16 07:20:00.000000000 +0000 @@ -0,0 +1 @@ +0001-ssh-Use-valid-host-name-in-test-sshbridge.patch Binary files /srv/release.debian.org/tmp/p0XtUWDOmX/cockpit-287/dist/sosreport/sosreport.js.gz and /srv/release.debian.org/tmp/ex_Q5_htkA/cockpit-287.1/dist/sosreport/sosreport.js.gz differ diff -Nru cockpit-287/pkg/sosreport/index.jsx cockpit-287.1/pkg/sosreport/index.jsx --- cockpit-287/pkg/sosreport/index.jsx 2023-03-08 08:51:03.000000000 +0000 +++ cockpit-287.1/pkg/sosreport/index.jsx 2024-04-02 08:24:56.000000000 +0000 @@ -218,7 +218,16 @@ } function sosRemove(path) { - return cockpit.script(cockpit.format("rm -f '$0' '$0'.*", path), { superuser: true, err: "message" }); + // there are various potential extra files; not all of them are expected to exist, + // the file API tolerates removing nonexisting files + const paths = [ + path, + path + ".asc", + path + ".gpg", + path + ".md5", + path + ".sha256", + ]; + return Promise.all(paths.map(p => cockpit.file(p, { superuser: true }).replace(null))); } const SOSDialog = () => { diff -Nru cockpit-287/src/client/org.cockpit_project.CockpitClient.metainfo.xml cockpit-287.1/src/client/org.cockpit_project.CockpitClient.metainfo.xml --- cockpit-287/src/client/org.cockpit_project.CockpitClient.metainfo.xml 2023-03-08 08:51:03.000000000 +0000 +++ cockpit-287.1/src/client/org.cockpit_project.CockpitClient.metainfo.xml 2024-04-02 08:24:56.000000000 +0000 @@ -33,7 +33,7 @@ - + org.cockpit_project.CockpitClient.desktop diff -Nru cockpit-287/test/verify/check-sosreport cockpit-287.1/test/verify/check-sosreport --- cockpit-287/test/verify/check-sosreport 2023-03-08 08:51:03.000000000 +0000 +++ cockpit-287.1/test/verify/check-sosreport 2024-04-02 08:24:56.000000000 +0000 @@ -89,8 +89,9 @@ # while the download is ongoing, it will have an *.xz.tmpsuffix name, gets renamed to *.xz when done wait(lambda: len(downloaded_sosreports()) > 0) report_gpg = downloaded_sosreports()[0] + report = report_gpg.removesuffix(".gpg") base_report_gpg = os.path.basename(report_gpg) - report = report_gpg.replace(".gpg", "") + base_report = base_report_gpg.removesuffix(".gpg") m.execute(f"test -f /var/tmp/{base_report_gpg}") @@ -113,7 +114,8 @@ b.click("tr:contains(mylabel) button.pf-c-dropdown__toggle") b.click("tr:contains(mylabel) li:contains(Delete)") b.click("#sos-remove-dialog button:contains(Delete)") - wait(lambda: m.execute(f"! test -f /var/tmp/{base_report_gpg} && echo yes")) + # ensure it removes the report itself, and auxiliary files like .gpg + m.execute(f"while ls /var/tmp/{base_report}*; do sleep 1; done", stdout=None, timeout=10) self.allow_journal_messages('.*comm="sosreport".*') diff -Nru cockpit-287/tools/arch/PKGBUILD cockpit-287.1/tools/arch/PKGBUILD --- cockpit-287/tools/arch/PKGBUILD 2023-03-08 08:51:03.000000000 +0000 +++ cockpit-287.1/tools/arch/PKGBUILD 2024-04-02 08:24:56.000000000 +0000 @@ -5,7 +5,7 @@ pkgbase=cockpit pkgname=(cockpit cockpit-pcp cockpit-test) -pkgver=287 +pkgver=287.1 pkgrel=1 pkgdesc='A systemd web based user interface for Linux servers' arch=('x86_64') diff -Nru cockpit-287/tools/cockpit.spec cockpit-287.1/tools/cockpit.spec --- cockpit-287/tools/cockpit.spec 2023-03-08 08:51:03.000000000 +0000 +++ cockpit-287.1/tools/cockpit.spec 2024-04-02 08:24:56.000000000 +0000 @@ -49,7 +49,7 @@ License: LGPL-2.1-or-later URL: https://cockpit-project.org/ -Version: 287 +Version: 287.1 Release: 1%{?dist} Source0: https://github.com/cockpit-project/cockpit/releases/download/%{version}/cockpit-%{version}.tar.xz diff -Nru cockpit-287/tools/debian/changelog cockpit-287.1/tools/debian/changelog --- cockpit-287/tools/debian/changelog 2023-03-08 08:51:03.000000000 +0000 +++ cockpit-287.1/tools/debian/changelog 2024-04-02 08:24:56.000000000 +0000 @@ -1,4 +1,4 @@ -cockpit (287-1) UNRELEASED; urgency=medium +cockpit (287.1-1) UNRELEASED; urgency=medium * Work in progress diff -Nru cockpit-287/tools/debian/copyright cockpit-287.1/tools/debian/copyright --- cockpit-287/tools/debian/copyright 2023-03-08 08:51:03.000000000 +0000 +++ cockpit-287.1/tools/debian/copyright 2024-04-02 08:24:56.000000000 +0000 @@ -59,19 +59,19 @@ Files: dist/apps/* Copyright: (c) Facebook, Inc. and its affiliates. 2015-2016 David Clark - Copyright (C) 2013 - 2023 Red Hat, Inc. + Copyright (C) 2013 - 2024 Red Hat, Inc. Facebook, Inc. and its affiliates. License: LGPL-2.1-or-later and MIT Files: dist/base1/* -Copyright: Copyright (C) 2013 - 2023 Red Hat, Inc. +Copyright: Copyright (C) 2013 - 2024 Red Hat, Inc. OpenJS Foundation and other contributors License: LGPL-2.1-or-later and MIT Files: dist/kdump/* Copyright: (c) Facebook, Inc. and its affiliates. 2015-2016 David Clark - Copyright (C) 2013 - 2023 Red Hat, Inc. + Copyright (C) 2013 - 2024 Red Hat, Inc. Facebook, Inc. and its affiliates. OpenJS Foundation and other contributors License: LGPL-2.1-or-later and MIT @@ -79,14 +79,14 @@ Files: dist/metrics/* Copyright: (c) Facebook, Inc. and its affiliates. 2015-2016 David Clark - Copyright (C) 2013 - 2023 Red Hat, Inc. + Copyright (C) 2013 - 2024 Red Hat, Inc. Facebook, Inc. and its affiliates. License: LGPL-2.1-or-later and MIT Files: dist/networkmanager/* Copyright: (c) Facebook, Inc. and its affiliates. 2015-2016 David Clark - Copyright (C) 2013 - 2023 Red Hat, Inc. + Copyright (C) 2013 - 2024 Red Hat, Inc. Facebook, Inc. and its affiliates. OpenJS Foundation and other contributors License: LGPL-2.1-or-later and MIT @@ -94,40 +94,40 @@ Files: dist/packagekit/* Copyright: (c) Facebook, Inc. and its affiliates. 2015-2016 David Clark - Copyright (C) 2013 - 2023 Red Hat, Inc. + Copyright (C) 2013 - 2024 Red Hat, Inc. Facebook, Inc. and its affiliates. License: LGPL-2.1-or-later and MIT Files: dist/playground/* Copyright: (c) Facebook, Inc. and its affiliates. 2015-2016 David Clark - Copyright (C) 2013 - 2023 Red Hat, Inc. + Copyright (C) 2013 - 2024 Red Hat, Inc. Facebook, Inc. and its affiliates. License: LGPL-2.1-or-later and MIT Files: dist/selinux/* Copyright: (c) Facebook, Inc. and its affiliates. 2015-2016 David Clark - Copyright (C) 2013 - 2023 Red Hat, Inc. + Copyright (C) 2013 - 2024 Red Hat, Inc. Facebook, Inc. and its affiliates. License: LGPL-2.1-or-later and MIT Files: dist/shell/* Copyright: (c) Facebook, Inc. and its affiliates. 2015-2016 David Clark - Copyright (C) 2013 - 2023 Red Hat, Inc. + Copyright (C) 2013 - 2024 Red Hat, Inc. Facebook, Inc. and its affiliates. License: LGPL-2.1-or-later and MIT Files: dist/shell/machines/* -Copyright: Copyright (C) 2013 - 2023 Red Hat, Inc. +Copyright: Copyright (C) 2013 - 2024 Red Hat, Inc. OpenJS Foundation and other contributors License: LGPL-2.1-or-later and MIT Files: dist/sosreport/* Copyright: (c) Facebook, Inc. and its affiliates. 2015-2016 David Clark - Copyright (C) 2013 - 2023 Red Hat, Inc. + Copyright (C) 2013 - 2024 Red Hat, Inc. Facebook, Inc. and its affiliates. License: LGPL-2.1-or-later and MIT @@ -135,7 +135,7 @@ Copyright: (c) Facebook, Inc. and its affiliates. 2015-2016 David Clark Chen, Yi-Cyuan 2014-2017 - Copyright (C) 2013 - 2023 Red Hat, Inc. + Copyright (C) 2013 - 2024 Red Hat, Inc. Facebook, Inc. and its affiliates. OpenJS Foundation and other contributors License: LGPL-2.1-or-later and MIT @@ -143,20 +143,20 @@ Files: dist/systemd/* Copyright: (c) Facebook, Inc. and its affiliates. 2015-2016 David Clark - Copyright (C) 2013 - 2023 Red Hat, Inc. + Copyright (C) 2013 - 2024 Red Hat, Inc. Facebook, Inc. and its affiliates. License: LGPL-2.1-or-later and MIT Files: dist/tuned/* Copyright: (c) Facebook, Inc. and its affiliates. - Copyright (C) 2013 - 2023 Red Hat, Inc. + Copyright (C) 2013 - 2024 Red Hat, Inc. Facebook, Inc. and its affiliates. License: LGPL-2.1-or-later and MIT Files: dist/users/* Copyright: (c) Facebook, Inc. and its affiliates. 2015-2016 David Clark - Copyright (C) 2013 - 2023 Red Hat, Inc. + Copyright (C) 2013 - 2024 Red Hat, Inc. Facebook, Inc. and its affiliates. License: LGPL-2.1-or-later and MIT diff -Nru cockpit-287/version.m4 cockpit-287.1/version.m4 --- cockpit-287/version.m4 2023-03-08 08:51:03.000000000 +0000 +++ cockpit-287.1/version.m4 2024-04-02 08:24:56.000000000 +0000 @@ -1 +1 @@ -m4_define(VERSION_NUMBER, [287]) +m4_define(VERSION_NUMBER, [287.1])