[gentoo-commits] proj/musl:master commit in: dev-libs/glib/, dev-libs/glib/files/

[Anthony G. Basile]

commit:     1cff7d041fe6e0054c7d0cd5dadede5fd62271f8
Author:     stefson <herrtimson <AT> yahoo <DOT> de>
AuthorDate: Thu Jul 25 15:26:42 2019 +0000
Commit:     Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Wed Aug 21 12:55:11 2019 +0000
URL:        https://gitweb.gentoo.org/proj/musl.git/commit/?id=1cff7d04

dev-libs/glib: add 2.58.3-r1 from tree

Bug: https://bugs.gentoo.org/690498
Signed-off-by: Steffen Kuhn <nielson2 <AT> yandex.com>
Signed-off-by: Anthony G. Basile <blueness <AT> gentoo.org>

 dev-libs/glib/files/2.58.3-CVE-2019-12450.patch    |  53 ++++
 .../glib/files/2.58.3-gdbusmessage-limit-fix.patch | 120 ++++++++
 dev-libs/glib/glib-2.58.3-r1.ebuild                | 320 +++++++++++++++++++++
 3 files changed, 493 insertions(+)

diff --git a/dev-libs/glib/files/2.58.3-CVE-2019-12450.patch b/dev-libs/glib/files/2.58.3-CVE-2019-12450.patch
new file mode 100644
index 0000000..949ac56
--- /dev/null
+++ b/dev-libs/glib/files/2.58.3-CVE-2019-12450.patch
@@ -0,0 +1,53 @@
+From e6b769819d63d2b24b251dbc9f902fe6fd614da3 Mon Sep 17 00:00:00 2001
+From: Ondrej Holy <oholy@××××××.com>
+Date: Thu, 23 May 2019 10:41:53 +0200
+Subject: [PATCH] gfile: Limit access to files when copying
+
+file_copy_fallback creates new files with default permissions and
+set the correct permissions after the operation is finished. This
+might cause that the files can be accessible by more users during
+the operation than expected. Use G_FILE_CREATE_PRIVATE for the new
+files to limit access to those files.
+---
+ gio/gfile.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/gio/gfile.c b/gio/gfile.c
+index 1cc69166a..13b435480 100644
+--- a/gio/gfile.c
++++ b/gio/gfile.c
+@@ -3284,12 +3284,12 @@ file_copy_fallback (GFile                  *source,
+         out = (GOutputStream*)_g_local_file_output_stream_replace (_g_local_file_get_filename (G_LOCAL_FILE (destination)),
+                                                                    FALSE, NULL,
+                                                                    flags & G_FILE_COPY_BACKUP,
+-                                                                   G_FILE_CREATE_REPLACE_DESTINATION,
+-                                                                   info,
++                                                                   G_FILE_CREATE_REPLACE_DESTINATION |
++                                                                   G_FILE_CREATE_PRIVATE, info,
+                                                                    cancellable, error);
+       else
+         out = (GOutputStream*)_g_local_file_output_stream_create (_g_local_file_get_filename (G_LOCAL_FILE (destination)),
+-                                                                  FALSE, 0, info,
++                                                                  FALSE, G_FILE_CREATE_PRIVATE, info,
+                                                                   cancellable, error);
+     }
+   else if (flags & G_FILE_COPY_OVERWRITE)
+@@ -3297,12 +3297,13 @@ file_copy_fallback (GFile                  *source,
+       out = (GOutputStream *)g_file_replace (destination,
+                                              NULL,
+                                              flags & G_FILE_COPY_BACKUP,
+-                                             G_FILE_CREATE_REPLACE_DESTINATION,
++                                             G_FILE_CREATE_REPLACE_DESTINATION |
++                                             G_FILE_CREATE_PRIVATE,
+                                              cancellable, error);
+     }
+   else
+     {
+-      out = (GOutputStream *)g_file_create (destination, 0, cancellable, error);
++      out = (GOutputStream *)g_file_create (destination, G_FILE_CREATE_PRIVATE, cancellable, error);
+     }
+ 
+   if (!out)
+-- 
+2.20.1
+

diff --git a/dev-libs/glib/files/2.58.3-gdbusmessage-limit-fix.patch b/dev-libs/glib/files/2.58.3-gdbusmessage-limit-fix.patch
new file mode 100644
index 0000000..0828132
--- /dev/null
+++ b/dev-libs/glib/files/2.58.3-gdbusmessage-limit-fix.patch
@@ -0,0 +1,120 @@
+From 2d655ef8954695cabf9e99cc61411de2bb4cb847 Mon Sep 17 00:00:00 2001
+From: Philip Withnall <withnall@××××××××.com>
+Date: Mon, 28 Jan 2019 14:36:42 +0000
+Subject: [PATCH] gdbusmessage: Fix check on upper limit of message size
+
+There was a typo in the figure checked against. Add a unit test.
+
+Signed-off-by: Philip Withnall <withnall@××××××××.com>
+
+https://gitlab.gnome.org/GNOME/glib/issues/1642
+---
+ gio/gdbusmessage.c        |  2 +-
+ gio/tests/gdbus-message.c | 72 ++++++++++++++++++++++++++++++++++++++-
+ 2 files changed, 72 insertions(+), 2 deletions(-)
+
+diff --git a/gio/gdbusmessage.c b/gio/gdbusmessage.c
+index 169e6fd15..2ad51f888 100644
+--- a/gio/gdbusmessage.c
++++ b/gio/gdbusmessage.c
+@@ -1984,7 +1984,7 @@ g_dbus_message_bytes_needed (guchar  *blob,
+                    "Unable to determine message blob length - given blob is malformed");
+     }
+ 
+-  if (ret > (2<<27))
++  if (ret > (1<<27))
+     {
+       g_set_error (error,
+                    G_IO_ERROR,
+diff --git a/gio/tests/gdbus-message.c b/gio/tests/gdbus-message.c
+index 88a9c5d86..74e0f712e 100644
+--- a/gio/tests/gdbus-message.c
++++ b/gio/tests/gdbus-message.c
+@@ -141,6 +141,74 @@ message_copy (void)
+ 
+ /* ---------------------------------------------------------------------------------------------------- */
+ 
++/* Test g_dbus_message_bytes_needed() returns correct results for a variety of
++ * arbitrary binary inputs.*/
++static void
++message_bytes_needed (void)
++{
++  const struct
++    {
++      const guint8 blob[16];
++      gssize expected_bytes_needed;
++    }
++  vectors[] =
++    {
++      /* Little endian with header rounding */
++      { { 'l', 0, 0, 1,  /* endianness, message type, flags, protocol version */
++          50, 0, 0, 0,  /* body length */
++          1, 0, 0, 0,  /* message serial */
++          7, 0, 0, 0  /* header length */}, 74 },
++      /* Little endian without header rounding */
++      { { 'l', 0, 0, 1,  /* endianness, message type, flags, protocol version */
++          50, 0, 0, 0,  /* body length */
++          1, 0, 0, 0,  /* message serial */
++          8, 0, 0, 0  /* header length */}, 74 },
++      /* Big endian with header rounding */
++      { { 'B', 0, 0, 1,  /* endianness, message type, flags, protocol version */
++          0, 0, 0, 50,  /* body length */
++          0, 0, 0, 1,  /* message serial */
++          0, 0, 0, 7  /* header length */}, 74 },
++      /* Big endian without header rounding */
++      { { 'B', 0, 0, 1,  /* endianness, message type, flags, protocol version */
++          0, 0, 0, 50,  /* body length */
++          0, 0, 0, 1,  /* message serial */
++          0, 0, 0, 8  /* header length */}, 74 },
++      /* Invalid endianness */
++      { { '!', 0, 0, 1,  /* endianness, message type, flags, protocol version */
++          0, 0, 0, 50,  /* body length */
++          0, 0, 0, 1,  /* message serial */
++          0, 0, 0, 8  /* header length */}, -1 },
++      /* Oversized */
++      { { 'l', 0, 0, 1,  /* endianness, message type, flags, protocol version */
++          0, 0, 0, 0x08,  /* body length (128MiB) */
++          1, 0, 0, 0,  /* message serial */
++          7, 0, 0, 0  /* header length */}, -1 },
++    };
++  gsize i;
++
++  for (i = 0; i < G_N_ELEMENTS (vectors); i++)
++    {
++      gssize bytes_needed;
++      GError *local_error = NULL;
++
++      g_test_message ("Vector: %" G_GSIZE_FORMAT, i);
++
++      bytes_needed = g_dbus_message_bytes_needed ((guchar *) vectors[i].blob,
++                                                  G_N_ELEMENTS (vectors[i].blob),
++                                                  &local_error);
++
++      if (vectors[i].expected_bytes_needed < 0)
++        g_assert_error (local_error, G_IO_ERROR, G_IO_ERROR_INVALID_ARGUMENT);
++      else
++        g_assert_no_error (local_error);
++      g_assert_cmpint (bytes_needed, ==, vectors[i].expected_bytes_needed);
++
++      g_clear_error (&local_error);
++    }
++}
++
++/* ---------------------------------------------------------------------------------------------------- */
++
+ int
+ main (int   argc,
+       char *argv[])
+@@ -151,6 +219,8 @@ main (int   argc,
+ 
+   g_test_add_func ("/gdbus/message/lock", message_lock);
+   g_test_add_func ("/gdbus/message/copy", message_copy);
+-  return g_test_run();
++  g_test_add_func ("/gdbus/message/bytes-needed", message_bytes_needed);
++
++  return g_test_run ();
+ }
+ 
+-- 
+2.20.1
+

diff --git a/dev-libs/glib/glib-2.58.3-r1.ebuild b/dev-libs/glib/glib-2.58.3-r1.ebuild
new file mode 100644
index 0000000..cb0cf13
--- /dev/null
+++ b/dev-libs/glib/glib-2.58.3-r1.ebuild
@@ -0,0 +1,320 @@
+# Copyright 1999-2018 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+PYTHON_COMPAT=( python{2_7,3_5,3_6,3_7} )
+GNOME2_EAUTORECONF=yes
+
+inherit autotools bash-completion-r1 epunt-cxx flag-o-matic gnome2 libtool linux-info \
+	multilib multilib-minimal pax-utils python-any-r1 toolchain-funcs virtualx
+
+# Until bug #537330 glib is a reverse dependency of pkgconfig and, then
+# adding new dependencies end up making stage3 to grow. Every addition needs
+# then to be think very closely.
+
+DESCRIPTION="The GLib library of C routines"
+HOMEPAGE="https://www.gtk.org/"
+SRC_URI="${SRC_URI}
+	https://pkgconfig.freedesktop.org/releases/pkg-config-0.28.tar.gz" # pkg.m4 for eautoreconf
+
+LICENSE="LGPL-2.1+"
+SLOT="2"
+IUSE="dbus debug fam gtk-doc kernel_linux +mime selinux static-libs systemtap test utils xattr"
+
+KEYWORDS="amd64 ~arm arm64 ~mips ~ppc x86"
+
+# Added util-linux multilib dependency to have libmount support (which
+# is always turned on on linux systems, unless explicitly disabled, but
+# this ebuild does not do that anyway) (bug #599586)
+
+RDEPEND="
+	!<dev-util/gdbus-codegen-${PV}
+	>=dev-libs/libpcre-8.31:3[${MULTILIB_USEDEP},static-libs?]
+	>=virtual/libiconv-0-r1[${MULTILIB_USEDEP}]
+	>=virtual/libffi-3.0.13-r1:=[${MULTILIB_USEDEP}]
+	>=virtual/libintl-0-r2[${MULTILIB_USEDEP}]
+	>=sys-libs/zlib-1.2.8-r1[${MULTILIB_USEDEP}]
+	kernel_linux? ( >=sys-apps/util-linux-2.23[${MULTILIB_USEDEP}] )
+	selinux? ( >=sys-libs/libselinux-2.2.2-r5[${MULTILIB_USEDEP}] )
+	xattr? ( >=sys-apps/attr-2.4.47-r1[${MULTILIB_USEDEP}] )
+	fam? ( >=virtual/fam-0-r1[${MULTILIB_USEDEP}] )
+	utils? (
+		>=dev-util/gdbus-codegen-${PV}
+		virtual/libelf:0=
+	)
+"
+DEPEND="${RDEPEND}
+	app-text/docbook-xml-dtd:4.1.2
+	app-text/docbook-xsl-stylesheets
+	>=dev-libs/libxslt-1.0
+	>=sys-devel/gettext-0.11
+	gtk-doc? ( >=dev-util/gtk-doc-1.20 )
+	systemtap? ( >=dev-util/systemtap-1.3 )
+	${PYTHON_DEPS}
+	test? (
+		sys-devel/gdb
+		>=dev-util/gdbus-codegen-${PV}
+		>=sys-apps/dbus-1.2.14 )
+"
+# configure.ac has gtk-doc-am stuff behind m4_ifdef, so we don't need a gtk-doc-am build dep
+
+# Migration of glib-genmarshal, glib-mkenums and gtester-report to a separate
+# python depending package, which can be buildtime depended in packages that
+# need these tools, without pulling in python at runtime.
+RDEPEND="${RDEPEND}
+	>=dev-util/glib-utils-${PV}"
+PDEPEND="
+	dbus? ( gnome-base/dconf )
+	mime? ( x11-misc/shared-mime-info )
+"
+# shared-mime-info needed for gio/xdgmime, bug #409481
+# dconf is needed to be able to save settings, bug #498436
+
+MULTILIB_CHOST_TOOLS=(
+	/usr/bin/gio-querymodules$(get_exeext)
+)
+
+pkg_setup() {
+	if use kernel_linux ; then
+		CONFIG_CHECK="~INOTIFY_USER"
+		if use test ; then
+			CONFIG_CHECK="~IPV6"
+			WARNING_IPV6="Your kernel needs IPV6 support for running some tests, skipping them."
+		fi
+		linux-info_pkg_setup
+	fi
+	python-any-r1_pkg_setup
+}
+
+src_prepare() {
+
+	# Musl fix
+	eapply "${FILESDIR}/2.56.2-quark_init_on_demand.patch"
+	eapply "${FILESDIR}/2.56.2-gobject_init_on_demand.patch"
+
+	# Prevent build failure in stage3 where pkgconfig is not available, bug #481056
+	mv -f "${WORKDIR}"/pkg-config-*/pkg.m4 "${S}"/m4macros/ || die
+
+	if use test; then
+		# Disable tests requiring dev-util/desktop-file-utils when not installed, bug #286629, upstream bug #629163
+		if ! has_version dev-util/desktop-file-utils ; then
+			ewarn "Some tests will be skipped due dev-util/desktop-file-utils not being present on your system,"
+			ewarn "think on installing it to get these tests run."
+			sed -i -e "/appinfo\/associations/d" gio/tests/appinfo.c || die
+			sed -i -e "/g_test_add_func/d" gio/tests/desktop-app-info.c || die
+		fi
+
+		# gdesktopappinfo requires existing terminal (gnome-terminal or any
+		# other), falling back to xterm if one doesn't exist
+		#if ! has_version x11-terms/xterm && ! has_version x11-terms/gnome-terminal ; then
+		#	ewarn "Some tests will be skipped due to missing terminal program"
+		# These tests seem to sometimes fail even with a terminal; skip for now and reevulate with meson
+		# Also try https://gitlab.gnome.org/GNOME/glib/issues/1601 once ready for backport (or in a bump) and file new issue if still fails
+		sed -i -e "/appinfo\/launch/d" gio/tests/appinfo.c || die
+		# desktop-app-info/launch* might fail similarly
+		sed -i -e "/desktop-app-info\/launch-as-manager/d" gio/tests/desktop-app-info.c || die
+		#fi
+
+		# https://bugzilla.gnome.org/show_bug.cgi?id=722604
+		sed -i -e "/timer\/stop/d" glib/tests/timer.c || die
+		sed -i -e "/timer\/basic/d" glib/tests/timer.c || die
+
+		ewarn "Tests for search-utils have been skipped"
+		sed -i -e "/search-utils/d" glib/tests/Makefile.am || die
+	else
+		# Don't build tests, also prevents extra deps, bug #512022
+		sed -i -e 's/ tests//' {.,gio,glib}/Makefile.am || die
+	fi
+
+	# gdbus-codegen is a separate package
+	eapply "${FILESDIR}"/${PN}-2.58.2-external-gdbus-codegen.patch
+
+	# gdbus message upper limit check fix from glib-2-58
+	eapply "${FILESDIR}"/${PV}-gdbusmessage-limit-fix.patch
+	# gfile copy fallback security fix (wrong permissions at start)
+	eapply "${FILESDIR}"/${PV}-CVE-2019-12450.patch
+
+	# Tarball doesn't come with gtk-doc.make and we can't unconditionally depend on dev-util/gtk-doc due
+	# to circular deps during bootstramp. If actually not building gtk-doc, an almost empty file will do
+	# fine as well - this is also what upstream autogen.sh does if gtkdocize is not found. If gtk-doc is
+	# installed, eautoreconf will call gtkdocize, which overwrites the empty gtk-doc.make with a full copy.
+	cat > gtk-doc.make << EOF
+EXTRA_DIST =
+CLEANFILES =
+EOF
+
+	gnome2_src_prepare
+	epunt_cxx
+}
+
+multilib_src_configure() {
+	# Avoid circular depend with dev-util/pkgconfig and
+	# native builds (cross-compiles won't need pkg-config
+	# in the target ROOT to work here)
+	if ! tc-is-cross-compiler && ! $(tc-getPKG_CONFIG) --version >& /dev/null; then
+		if has_version sys-apps/dbus; then
+			export DBUS1_CFLAGS="-I/usr/include/dbus-1.0 -I/usr/$(get_libdir)/dbus-1.0/include"
+			export DBUS1_LIBS="-ldbus-1"
+		fi
+		export LIBFFI_CFLAGS="-I$(echo /usr/$(get_libdir)/libffi-*/include)"
+		export LIBFFI_LIBS="-lffi"
+		export PCRE_CFLAGS=" " # test -n "$PCRE_CFLAGS" needs to pass
+		export PCRE_LIBS="-lpcre"
+	fi
+
+	# These configure tests don't work when cross-compiling.
+	if tc-is-cross-compiler ; then
+		# https://bugzilla.gnome.org/show_bug.cgi?id=756473
+		case ${CHOST} in
+		hppa*|metag*) export glib_cv_stack_grows=yes ;;
+		*)            export glib_cv_stack_grows=no ;;
+		esac
+		# https://bugzilla.gnome.org/show_bug.cgi?id=756474
+		export glib_cv_uscore=no
+		# https://bugzilla.gnome.org/show_bug.cgi?id=756475
+		export ac_cv_func_posix_get{pwuid,grgid}_r=yes
+	fi
+
+	local myconf
+
+	case "${CHOST}" in
+		*-mingw*) myconf="${myconf} --with-threads=win32" ;;
+		*)        myconf="${myconf} --with-threads=posix" ;;
+	esac
+
+	# libelf used only by the gresource bin
+	ECONF_SOURCE="${S}" gnome2_src_configure ${myconf} \
+		$(usex debug --enable-debug=yes ' ') \
+		$(use_enable xattr) \
+		$(use_enable fam) \
+		$(multilib_native_use_enable gtk-doc) \
+		$(use_enable kernel_linux libmount) \
+		$(use_enable selinux) \
+		$(use_enable static-libs static) \
+		$(use_enable systemtap dtrace) \
+		$(use_enable systemtap systemtap) \
+		$(multilib_native_use_enable utils libelf) \
+		--with-python=${EPYTHON} \
+		--disable-compile-warnings \
+		--enable-man \
+		--with-pcre=system \
+		--with-xml-catalog="${EPREFIX}/etc/xml/catalog"
+
+	if multilib_is_native_abi; then
+		local d
+		for d in glib gio gobject; do
+			ln -s "${S}"/docs/reference/${d}/html docs/reference/${d}/html || die
+		done
+	fi
+}
+
+multilib_src_test() {
+	export XDG_CONFIG_DIRS=/etc/xdg
+	export XDG_DATA_DIRS=/usr/local/share:/usr/share
+	export G_DBUS_COOKIE_SHA1_KEYRING_DIR="${T}/temp"
+	export LC_TIME=C # bug #411967
+	unset GSETTINGS_BACKEND # bug #596380
+	python_setup
+
+	# Related test is a bit nitpicking
+	mkdir "$G_DBUS_COOKIE_SHA1_KEYRING_DIR"
+	chmod 0700 "$G_DBUS_COOKIE_SHA1_KEYRING_DIR"
+
+	# Hardened: gdb needs this, bug #338891
+	if host-is-pax ; then
+		pax-mark -mr "${BUILD_DIR}"/tests/.libs/assert-msg-test \
+			|| die "Hardened adjustment failed"
+	fi
+
+	# Need X for dbus-launch session X11 initialization
+	virtx emake check
+}
+
+multilib_src_install() {
+	emake DESTDIR="${D}" completiondir="$(get_bashcompdir)" install
+	keepdir /usr/$(get_libdir)/gio/modules
+}
+
+multilib_src_install_all() {
+	einstalldocs
+
+	# These are installed by dev-util/glib-utils
+	# TODO: With patching we might be able to get rid of the python-any deps and removals, and test depend on glib-utils instead; revisit with meson
+	rm "${ED}usr/bin/glib-genmarshal" || die
+	rm "${ED}usr/share/man/man1/glib-genmarshal.1" || die
+	rm "${ED}usr/bin/glib-mkenums" || die
+	rm "${ED}usr/share/man/man1/glib-mkenums.1" || die
+	rm "${ED}usr/bin/gtester-report" || die
+	rm "${ED}usr/share/man/man1/gtester-report.1" || die
+
+	# Do not install charset.alias even if generated, leave it to libiconv
+	rm -f "${ED}/usr/$(get_libdir)/charset.alias"
+
+	# Don't install gdb python macros, bug 291328
+	rm -rf "${ED}/usr/share/gdb/" "${ED}/usr/share/glib-2.0/gdb/"
+
+	# Completely useless with or without USE static-libs, people need to use pkg-config
+	find "${ED}" -name '*.la' -delete || die
+}
+
+pkg_preinst() {
+	gnome2_pkg_preinst
+
+	# Make gschemas.compiled belong to glib alone
+	local cache="usr/share/glib-2.0/schemas/gschemas.compiled"
+
+	if [[ -e ${EROOT}${cache} ]]; then
+		cp "${EROOT}"${cache} "${ED}"/${cache} || die
+	else
+		touch "${ED}"/${cache} || die
+	fi
+
+	multilib_pkg_preinst() {
+		# Make giomodule.cache belong to glib alone
+		local cache="usr/$(get_libdir)/gio/modules/giomodule.cache"
+
+		if [[ -e ${EROOT}${cache} ]]; then
+			cp "${EROOT}"${cache} "${ED}"/${cache} || die
+		else
+			touch "${ED}"/${cache} || die
+		fi
+	}
+
+	# Don't run the cache ownership when cross-compiling, as it would end up with an empty cache
+	# file due to inability to create it and GIO might not look at any of the modules there
+	if ! tc-is-cross-compiler ; then
+		multilib_foreach_abi multilib_pkg_preinst
+	fi
+}
+
+pkg_postinst() {
+	# force (re)generation of gschemas.compiled
+	GNOME2_ECLASS_GLIB_SCHEMAS="force"
+
+	gnome2_pkg_postinst
+
+	multilib_pkg_postinst() {
+		gnome2_giomodule_cache_update \
+			|| die "Update GIO modules cache failed (for ${ABI})"
+	}
+	if ! tc-is-cross-compiler ; then
+		multilib_foreach_abi multilib_pkg_postinst
+	else
+		ewarn "Updating of GIO modules cache skipped due to cross-compilation."
+		ewarn "You might want to run gio-querymodules manually on the target for"
+		ewarn "your final image for performance reasons and re-run it when packages"
+		ewarn "installing GIO modules get upgraded or added to the image."
+	fi
+}
+
+pkg_postrm() {
+	gnome2_pkg_postrm
+
+	if [[ -z ${REPLACED_BY_VERSION} ]]; then
+		multilib_pkg_postrm() {
+			rm -f "${EROOT}"usr/$(get_libdir)/gio/modules/giomodule.cache
+		}
+		multilib_foreach_abi multilib_pkg_postrm
+		rm -f "${EROOT}"usr/share/glib-2.0/schemas/gschemas.compiled
+	fi
+}