[gentoo-commits] proj/hardened-dev:musl commit in: dev-vcs/cvs/, dev-vcs/cvs/files/

[Anthony G. Basile]

commit:     18906a4e3a58b3a9ebf081fbf5e1b575b04b735e
Author:     Felix Janda <felix.janda <AT> posteo <DOT> de>
AuthorDate: Sun Feb 16 21:23:41 2014 +0000
Commit:     Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Sat Feb 22 14:27:56 2014 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-dev.git;a=commit;h=18906a4e

dev-vcs/cvs: move to tree

---
 dev-vcs/cvs/cvs-1.12.12-r99.ebuild                 |  86 +++++++++++++
 dev-vcs/cvs/files/cvs-1.12.12-block-requests.patch | 140 +++++++++++++++++++++
 .../files/cvs-1.12.12-cvs-gnulib-vasnprintf.patch  |  34 +++++
 dev-vcs/cvs/files/cvs-1.12.12-cvsbug-tmpfix.patch  |  22 ++++
 dev-vcs/cvs/files/cvs-1.12.12-install-sh.patch     |  12 ++
 dev-vcs/cvs/files/cvs-1.12.12-mktime-x32.patch     |  29 +++++
 dev-vcs/cvs/files/cvs-1.12.12-openat.patch         |  21 ++++
 dev-vcs/cvs/files/cvs-1.12.12-regex.patch          |  11 ++
 dev-vcs/cvs/files/cvs.pam-include-1.12.12          |   4 +
 dev-vcs/cvs/files/cvspserver.xinetd.d              |  14 +++
 dev-vcs/cvs/metadata.xml                           |   8 ++
 11 files changed, 381 insertions(+)

diff --git a/dev-vcs/cvs/cvs-1.12.12-r99.ebuild b/dev-vcs/cvs/cvs-1.12.12-r99.ebuild
new file mode 100644
index 0000000..27ed6e5
--- /dev/null
+++ b/dev-vcs/cvs/cvs-1.12.12-r99.ebuild
@@ -0,0 +1,86 @@
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/dev-vcs/cvs/cvs-1.12.12-r6.ebuild,v 1.4 2014/01/19 10:30:16 vapier Exp $
+
+inherit eutils pam toolchain-funcs
+
+DESCRIPTION="Concurrent Versions System - source code revision control tools"
+HOMEPAGE="http://www.nongnu.org/cvs/"
+
+SRC_URI="mirror://gnu/non-gnu/cvs/source/feature/${PV}/${P}.tar.bz2
+	doc? ( mirror://gnu/non-gnu/cvs/source/feature/${PV}/cederqvist-${PV}.html.tar.bz2
+		mirror://gnu/non-gnu/cvs/source/feature/${PV}/cederqvist-${PV}.pdf
+		mirror://gnu/non-gnu/cvs/source/feature/${PV}/cederqvist-${PV}.ps )"
+
+LICENSE="GPL-2 LGPL-2"
+SLOT="0"
+KEYWORDS="amd64 arm x86"
+
+IUSE="crypt doc kerberos nls pam server"
+
+DEPEND=">=sys-libs/zlib-1.1.4
+	kerberos? ( virtual/krb5 )
+	pam? ( virtual/pam )"
+
+src_unpack() {
+	unpack ${P}.tar.bz2
+	use doc && unpack cederqvist-${PV}.html.tar.bz2
+	EPATCH_OPTS="-p1 -d ${S}" epatch "${FILESDIR}"/${P}-cvsbug-tmpfix.patch
+	epatch "${FILESDIR}"/${P}-openat.patch
+	EPATCH_OPTS="-p1 -d ${S}" epatch "${FILESDIR}"/${P}-block-requests.patch
+	cd "${S}"
+	epatch "${FILESDIR}"/${P}-cvs-gnulib-vasnprintf.patch
+	epatch "${FILESDIR}"/${P}-install-sh.patch
+	epatch "${FILESDIR}"/${P}-regex.patch
+	epatch "${FILESDIR}"/${P}-mktime-x32.patch # 395641
+	use server || elog "If you want any CVS server functionality, you MUST emerge with USE=server!"
+}
+
+src_compile() {
+	if tc-is-cross-compiler ; then
+		# Sane defaults when cross-compiling (as these tests want to
+		# try and execute code).
+		export cvs_cv_func_printf_ptr="yes"
+	fi
+	econf \
+		--with-external-zlib \
+		--with-tmpdir=/tmp \
+		$(use_enable crypt encryption) \
+		$(use_with kerberos gssapi) \
+		$(use_enable nls) \
+		$(use_enable pam) \
+		$(use_enable server) \
+		|| die
+	emake || die "emake failed"
+}
+
+src_install() {
+	emake install DESTDIR="${D}" || die
+
+	insinto /etc/xinetd.d
+	newins "${FILESDIR}"/cvspserver.xinetd.d cvspserver || die "newins failed"
+
+	dodoc BUGS ChangeLog* DEVEL* FAQ HACKING \
+		MINOR* NEWS PROJECTS README* TESTS TODO
+
+	# Not installed into emacs site-lisp because it clobbers the normal C
+	# indentations.
+	dodoc cvs-format.el || die "dodoc failed"
+
+	use server && newdoc "${FILESDIR}"/cvs-1.12.12-cvs-custom.c cvs-custom.c
+
+	if use doc; then
+		dodoc "${DISTDIR}"/cederqvist-${PV}.pdf
+		dodoc "${DISTDIR}"/cederqvist-${PV}.ps
+		tar xjf "${DISTDIR}"/cederqvist-${PV}.html.tar.bz2
+		dohtml -r cederqvist-${PV}.html/*
+		cd "${D}"/usr/share/doc/${PF}/html/
+		ln -s cvs.html index.html
+	fi
+
+	newpamd "${FILESDIR}"/cvs.pam-include-1.12.12 cvs
+}
+
+src_test() {
+	einfo "FEATURES=\"maketest\" has been disabled for dev-vcs/cvs"
+}

diff --git a/dev-vcs/cvs/files/cvs-1.12.12-block-requests.patch b/dev-vcs/cvs/files/cvs-1.12.12-block-requests.patch
new file mode 100644
index 0000000..9c9b49d
--- /dev/null
+++ b/dev-vcs/cvs/files/cvs-1.12.12-block-requests.patch
@@ -0,0 +1,140 @@
+Author: Robin H. Johnson <robbat2@g.o>
+Date: 2006-08-09
+
+This patch allows a CVS server to deny usage of specific commands, based on
+input in the environment.
+
+Just set the CVS_BLOCK_REQUESTS env var with all of the commands you want,
+seperated by spaces. Eg:
+CVS_BLOCK_REQUESTS="Gzip-stream gzip-file-contents"
+would block ALL usage of compression.
+
+Please see the array 'struct request requests[]' in src/server.c for a full
+list of commands.
+
+Please note that if you block any commands marked as RQ_ESSENTIAL, CVS clients
+may fail! (This includes 'ci'!).
+
+See the companion cvs-custom.c for a wrapper that can enforce the environment variable for pserver setups.
+
+Signed-off-by: Robin H. Johnson <robbat2@g.o>
+
+diff -Nuar --exclude '*~' -U 10 cvs-1.12.12.orig/src/server.c cvs-1.12.12/src/server.c
+--- cvs-1.12.12.orig/src/server.c	2005-04-14 14:13:29.000000000 +0000
++++ cvs-1.12.12/src/server.c	2006-08-09 01:40:44.000000000 +0000
+@@ -5836,43 +5836,90 @@
+ #undef REQ_LINE
+ };
+ #endif /* SERVER_SUPPORT or CLIENT_SUPPORT */
+ 
+ 
+ 
+ #ifdef SERVER_SUPPORT
+ /*
+  * This server request is not ignored by the secondary.
+  */
++
++/* Hack by Robin H. Johnson <robbat2@g.o>.
++ * Allow the server ENV to specify what request types are to be ignored.
++ */
++
++static char blocked_requests[BUFSIZ] = " ";
++
++static void build_blocked_requests() {
++	char *tmp = getenv("CVS_BLOCK_REQUESTS");
++
++	if (tmp != NULL && strlen(tmp) > 0) {
++		// move to our custom buffer
++		strncat(blocked_requests, tmp, sizeof(blocked_requests)-strlen(blocked_requests));
++		//add a space on the end as well for searching
++		strncat(blocked_requests, " ", sizeof(blocked_requests)-strlen(blocked_requests));
++	}
++
++	// now blocked_requests contains the list of every request that we do not
++	// want to serve
++}
++
++// returns 0 if we should serve this request
++// use as if(checker(FOO)) continue;
++static int serve_valid_requests_checker(char *reqname) {
++	char needle[BUFSIZ] = " ";
++	char *tmp;
++
++	if(!blocked_requests || strlen(blocked_requests) < 2)
++		return 0;
++
++	// we want to look for ' 'reqname' '
++	snprintf(needle, sizeof(needle), " %s ", reqname);
++
++	// now do the search
++	tmp = strstr(blocked_requests, needle);
++
++	if (tmp != NULL)
++		return 1;
++
++	return 0;
++	
++}
++
+ static void
+ serve_valid_requests (char *arg)
+ {
+     struct request *rq;
+ 
+     /* Since this is processed in the first pass, don't reprocess it in the
+      * second.
+      *
+      * We still print errors since new errors could have been generated in the
+      * second pass.
+      */
+     if (print_pending_error ()
+ #ifdef PROXY_SUPPORT
+ 	|| reprocessing
+ #endif /* PROXY_SUPPORT */
+        )
+ 	return;
++	
++    build_blocked_requests();
+ 
+     buf_output0 (buf_to_net, "Valid-requests");
+     for (rq = requests; rq->name != NULL; rq++)
+     {
+ 	if (rq->func != NULL)
+ 	{
++		if(serve_valid_requests_checker(rq->name)) 
++			continue;
+ 	    buf_append_char (buf_to_net, ' ');
+ 	    buf_output0 (buf_to_net, rq->name);
+ 	}
+     }
+     buf_output0 (buf_to_net, "\nok\n");
+ 
+     /* The client is waiting for the list of valid requests, so we
+        must send the output now.  */
+     buf_flush (buf_to_net, 1);
+ }
+@@ -6353,20 +6400,24 @@
+ 		    cmd += len;
+ 		else if (cmd[len] == ' ')
+ 		    cmd += len + 1;
+ 		else
+ 		    /*
+ 		     * The first len characters match, but it's a different
+ 		     * command.  e.g. the command is "cooperate" but we matched
+ 		     * "co".
+ 		     */
+ 		    continue;
++		// Ignore commands that we are supposed to ignore.
++		if(serve_valid_requests_checker(rq->name))
++				continue;
++
+ 
+ 		if (!(rq->flags & RQ_ROOTLESS)
+ 		    && current_parsed_root == NULL)
+ 		{
+ 		    /* For commands which change the way in which data
+ 		       is sent and received, for example Gzip-stream,
+ 		       this does the wrong thing.  Since the client
+ 		       assumes that everything is being compressed,
+ 		       unconditionally, there is no way to give this
+ 		       error to the client without turning on

diff --git a/dev-vcs/cvs/files/cvs-1.12.12-cvs-gnulib-vasnprintf.patch b/dev-vcs/cvs/files/cvs-1.12.12-cvs-gnulib-vasnprintf.patch
new file mode 100644
index 0000000..d7d6e6b
--- /dev/null
+++ b/dev-vcs/cvs/files/cvs-1.12.12-cvs-gnulib-vasnprintf.patch
@@ -0,0 +1,34 @@
+http://bugs.gentoo.org/213833
+
+commit 913c09becd9df89dbd9b9f386e7f35c240d5efe8
+Author: Bruno Haible <bruno@×××××.org>
+Date:   Fri Oct 19 01:50:42 2007 +0200
+
+    Don't use %n on glibc >= 2.3 systems.
+
+diff --git a/lib/vasnprintf.c b/lib/vasnprintf.c
+index f563823..5d818aa 100644
+--- a/lib/vasnprintf.c
++++ b/lib/vasnprintf.c
+@@ -3385,9 +3385,21 @@ VASNPRINTF (DCHAR_T *resultbuf, size_t *lengthp,
+ #endif
+ 		  *p = dp->conversion;
+ #if USE_SNPRINTF
++# if !(__GLIBC__ > 2 || (__GLIBC__ == 2 && __GLIBC_MINOR__ >= 3))
+ 		p[1] = '%';
+ 		p[2] = 'n';
+ 		p[3] = '\0';
++# else
++		/* On glibc2 systems from glibc >= 2.3 - probably also older
++		   ones - we know that snprintf's returns value conforms to
++		   ISO C 99: the gl_SNPRINTF_DIRECTIVE_N test passes.
++		   Therefore we can avoid using %n in this situation.
++		   On glibc2 systems from 2004-10-18 or newer, the use of %n
++		   in format strings in writable memory may crash the program
++		   (if compiled with _FORTIFY_SOURCE=2), so we should avoid it
++		   in this situation.  */
++		p[1] = '\0';
++# endif
+ #else
+ 		p[1] = '\0';
+ #endif

diff --git a/dev-vcs/cvs/files/cvs-1.12.12-cvsbug-tmpfix.patch b/dev-vcs/cvs/files/cvs-1.12.12-cvsbug-tmpfix.patch
new file mode 100644
index 0000000..fcd4431
--- /dev/null
+++ b/dev-vcs/cvs/files/cvs-1.12.12-cvsbug-tmpfix.patch
@@ -0,0 +1,22 @@
+Index: cvs-1.12.12/src/cvsbug.in
+===================================================================
+--- cvs-1.12.12.orig/src/cvsbug.in
++++ cvs-1.12.12/src/cvsbug.in
+@@ -109,14 +109,14 @@ elif [ -f /bin/domainname ]; then
+     /usr/bin/ypcat passwd 2>/dev/null | cat - /etc/passwd | grep "^$LOGNAME:" |
+       cut -f5 -d':' | sed -e 's/,.*//' > $TEMP
+     ORIGINATOR="`cat $TEMP`"
+-    rm -f $TEMP
++    > $TEMP
+   fi
+ fi
+
+ if [ "$ORIGINATOR" = "" ]; then
+   grep "^$LOGNAME:" /etc/passwd | cut -f5 -d':' | sed -e 's/,.*//' > $TEMP
+   ORIGINATOR="`cat $TEMP`"
+-  rm -f $TEMP
++  > $TEMP
+ fi
+
+ if [ -n "$ORGANIZATION" ]; then
+

diff --git a/dev-vcs/cvs/files/cvs-1.12.12-install-sh.patch b/dev-vcs/cvs/files/cvs-1.12.12-install-sh.patch
new file mode 100644
index 0000000..825c0ee
--- /dev/null
+++ b/dev-vcs/cvs/files/cvs-1.12.12-install-sh.patch
@@ -0,0 +1,12 @@
+diff -ur a/build-aux/install-sh b/build-aux/install-sh
+--- a/build-aux/install-sh	2006-03-25 20:04:46 +0000
++++ b/build-aux/install-sh	2007-09-14 10:53:29 +0100
+@@ -246,7 +246,7 @@
+   fi
+ 
+   if test -n "$dir_arg"; then
+-    $doit $mkdircmd "$dst" \
++    { test -d "$dst" || $doit $mkdircmd -p "$dst"; } \
+       && { test -z "$chowncmd" || $doit $chowncmd "$dst"; } \
+       && { test -z "$chgrpcmd" || $doit $chgrpcmd "$dst"; } \
+       && { test -z "$stripcmd" || $doit $stripcmd "$dst"; } \

diff --git a/dev-vcs/cvs/files/cvs-1.12.12-mktime-x32.patch b/dev-vcs/cvs/files/cvs-1.12.12-mktime-x32.patch
new file mode 100644
index 0000000..948fa4d
--- /dev/null
+++ b/dev-vcs/cvs/files/cvs-1.12.12-mktime-x32.patch
@@ -0,0 +1,29 @@
+back port changes from upstream gnulib to make this work on x32
+
+https://bugs.gentoo.org/395641
+
+--- cvs-1.12.12/lib/mktime.c
++++ cvs-1.12.12/lib/mktime.c
+@@ -115,6 +115,13 @@
+ #define TM_YEAR_BASE 1900
+ verify (base_year_is_a_multiple_of_100, TM_YEAR_BASE % 100 == 0);
+ 
++#if INT_MAX <= LONG_MAX / 2
++typedef long int long_int;
++#else
++typedef long long int long_int;
++#endif
++verify (long_int_is_wide_enough, INT_MAX == INT_MAX * (long_int) 2 / 2);
++
+ /* Return 1 if YEAR + TM_YEAR_BASE is a leap year.  */
+ static inline int
+ leapyear (long int year)
+@@ -167,8 +174,6 @@
+ 	    int year0, int yday0, int hour0, int min0, int sec0)
+ {
+   verify (C99_integer_division, -1 / 2 == 0);
+-  verify (long_int_year_and_yday_are_wide_enough,
+-	  INT_MAX <= LONG_MAX / 2 || TIME_T_MAX <= UINT_MAX);
+ 
+   /* Compute intervening leap days correctly even if year is negative.
+      Take care to avoid integer overflow here.  */

diff --git a/dev-vcs/cvs/files/cvs-1.12.12-openat.patch b/dev-vcs/cvs/files/cvs-1.12.12-openat.patch
new file mode 100644
index 0000000..fdb406a
--- /dev/null
+++ b/dev-vcs/cvs/files/cvs-1.12.12-openat.patch
@@ -0,0 +1,21 @@
+Index: cvs-1.12.12/lib/openat.c
+===================================================================
+--- cvs-1.12.12.orig/lib/openat.c
++++ cvs-1.12.12/lib/openat.c
+@@ -55,9 +55,13 @@ rpl_openat (int fd, char const *filename
+       va_list arg;
+       va_start (arg, flags);
+ 
+-      /* Assume that mode_t is passed compatibly with mode_t's type
+-	 after argument promotion.  */
+-      mode = va_arg (arg, mode_t);
++      /* If mode_t is narrower than int, use the promoted type (int),
++         not mode_t.  Use sizeof to guess whether mode_t is nerrower;
++         we don't know of any practical counterexamples.  */
++      if (sizeof (mode_t) < sizeof (int))
++	mode = va_arg (arg, int);
++      else
++	mode = va_arg (arg, mode_t);
+ 
+       va_end (arg);
+     }

diff --git a/dev-vcs/cvs/files/cvs-1.12.12-regex.patch b/dev-vcs/cvs/files/cvs-1.12.12-regex.patch
new file mode 100644
index 0000000..4e69953
--- /dev/null
+++ b/dev-vcs/cvs/files/cvs-1.12.12-regex.patch
@@ -0,0 +1,11 @@
+--- a/cvs-1.12.12/lib/regex.c
++++ b/cvs-1.12.12/lib/regex.c
+@@ -8184,7 +8184,7 @@
+       if (msg_size > errbuf_size)
+         {
+ #if defined HAVE_MEMPCPY || defined _LIBC
+-	  *((char *) __mempcpy (errbuf, msg, errbuf_size - 1)) = '\0';
++	  *((char *) mempcpy (errbuf, msg, errbuf_size - 1)) = '\0';
+ #else
+           memcpy (errbuf, msg, errbuf_size - 1);
+           errbuf[errbuf_size - 1] = 0;

diff --git a/dev-vcs/cvs/files/cvs.pam-include-1.12.12 b/dev-vcs/cvs/files/cvs.pam-include-1.12.12
new file mode 100644
index 0000000..f401ec0
--- /dev/null
+++ b/dev-vcs/cvs/files/cvs.pam-include-1.12.12
@@ -0,0 +1,4 @@
+#%PAM-1.0
+auth        include	system-auth
+account     include	system-auth
+session     include	system-auth

diff --git a/dev-vcs/cvs/files/cvspserver.xinetd.d b/dev-vcs/cvs/files/cvspserver.xinetd.d
new file mode 100644
index 0000000..0f2edb0
--- /dev/null
+++ b/dev-vcs/cvs/files/cvspserver.xinetd.d
@@ -0,0 +1,14 @@
+service cvspserver
+{
+	disable		= yes
+	socket_type	= stream
+	wait		= no
+	user		= root
+	log_type	= FILE /var/log/cvspserver
+	protocol	= tcp
+	env		= HOME=/var/cvsroot
+	log_on_failure	+= USERID
+	port		= 2401
+	server		= /usr/bin/cvs
+	server_args	= -f --allow-root=/var/cvsroot pserver
+}

diff --git a/dev-vcs/cvs/metadata.xml b/dev-vcs/cvs/metadata.xml
new file mode 100644
index 0000000..4432750
--- /dev/null
+++ b/dev-vcs/cvs/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+  <herd>cvs-utils</herd>
+  <use>
+    <flag name="server">Enable server support</flag>
+  </use>
+</pkgmetadata>