public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
* [rpms/icecream] epel8: Update to current upstream git
@ 2026-07-31 6:34 Michal Schmidt
0 siblings, 0 replies; only message in thread
From: Michal Schmidt @ 2026-07-31 6:34 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : rpms/icecream
Branch : epel8
Commit : c61b150ab2843335559d5394d629080aa626a52a
Author : Michal Schmidt <mschmidt@redhat.com>
Date : 2014-09-05T18:51:49+02:00
Stats : +170/-328 in 14 file(s)
URL : https://src.fedoraproject.org/rpms/icecream/c/c61b150ab2843335559d5394d629080aa626a52a?branch=epel8
Log:
Update to current upstream git
Drops bundled minilzo, use system lzo library. (#1131794, CVE-2014-4607)
Fix build of manpages (use docbook2X).
Enable clang wrappers.
Remove no longer necessary restorecon /var/log/icecc.
Drop merged patches.
---
diff --git a/.gitignore b/.gitignore
index 6346ca2..2ba509f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
icecream-manpages.tar.bz2
/icecc-0.9.7.tar.bz2
/icecc-1.0.1.tar.bz2
+/icecream-20140822.tar.xz
diff --git a/0001-Revert-chmod-chown-envs-dir-when-preparing-this.patch b/0001-Revert-chmod-chown-envs-dir-when-preparing-this.patch
new file mode 100644
index 0000000..14286d1
--- /dev/null
+++ b/0001-Revert-chmod-chown-envs-dir-when-preparing-this.patch
@@ -0,0 +1,66 @@
+From ed4bc5a48c33142891e2ebe5a0bfdc676a1ba8d2 Mon Sep 17 00:00:00 2001
+From: Michal Schmidt <mschmidt@redhat.com>
+Date: Mon, 26 Aug 2013 17:08:52 +0200
+Subject: [PATCH 1/3] Revert "chmod/chown envs dir when preparing this"
+
+This reverts commit 137e683760707c690df496516432d72d8f7a81d3.
+---
+ daemon/environment.cpp | 7 +------
+ daemon/environment.h | 2 +-
+ daemon/main.cpp | 2 +-
+ 3 files changed, 3 insertions(+), 8 deletions(-)
+
+diff --git a/daemon/environment.cpp b/daemon/environment.cpp
+index a134b8e..3dbf27a 100644
+--- a/daemon/environment.cpp
++++ b/daemon/environment.cpp
+@@ -200,7 +200,7 @@ static bool cleanup_directory(const string &directory)
+ return true;
+ }
+
+-bool cleanup_cache(const string &basedir, uid_t user_uid, gid_t user_gid)
++bool cleanup_cache(const string &basedir)
+ {
+ flush_debug();
+
+@@ -219,11 +219,6 @@ bool cleanup_cache(const string &basedir, uid_t user_uid, gid_t user_gid)
+ return false;
+ }
+
+- if (chown(basedir.c_str(), user_uid, user_gid) || chmod(basedir.c_str(), 0775)) {
+- log_perror("chown/chmod in cleanup_cache() failed");
+- return false;
+- }
+-
+ return true;
+ }
+
+diff --git a/daemon/environment.h b/daemon/environment.h
+index c50a339..3e30f10 100644
+--- a/daemon/environment.h
++++ b/daemon/environment.h
+@@ -29,7 +29,7 @@
+ #include <unistd.h>
+
+ class MsgChannel;
+-extern bool cleanup_cache(const std::string &basedir, uid_t user_uid, gid_t user_gid);
++extern bool cleanup_cache(const std::string &basedir);
+ extern int start_create_env(const std::string &basedir,
+ uid_t user_uid, gid_t user_gid,
+ const std::string &compiler, const std::list<std::string> &extrafiles);
+diff --git a/daemon/main.cpp b/daemon/main.cpp
+index 8f7be1c..4db17f2 100644
+--- a/daemon/main.cpp
++++ b/daemon/main.cpp
+@@ -2268,7 +2268,7 @@ int main(int argc, char **argv)
+ pidFile << dcc_master_pid << endl;
+ pidFile.close();
+
+- if (!cleanup_cache(d.envbasedir, d.user_uid, d.user_gid)) {
++ if (!cleanup_cache(d.envbasedir)) {
+ return 1;
+ }
+
+--
+2.1.0
+
diff --git a/0001-make-dist-hook-work-also-with-srcdir-builddir.patch b/0001-make-dist-hook-work-also-with-srcdir-builddir.patch
deleted file mode 100644
index e1e3599..0000000
--- a/0001-make-dist-hook-work-also-with-srcdir-builddir.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-From 5abe21688caea8dcfbe1d747102e52830fa352d8 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Lubo=C5=A1=20Lu=C5=88=C3=A1k?= <l.lunak@suse.cz>
-Date: Thu, 11 Jul 2013 15:40:13 +0200
-Subject: [PATCH 1/8] make dist-hook work also with srcdir != builddir
-
----
- Makefile.am | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/Makefile.am b/Makefile.am
-index 8109f65..2e2ae6b 100644
---- a/Makefile.am
-+++ b/Makefile.am
-@@ -12,4 +12,4 @@ SUBDIRS = \
- compilerwrapper
-
- dist-hook:
-- git log --date=short --pretty="format:@%cd %an <%ae> [%H]%n%n%s%n%n%e%b" | sed -e "s|^\([^@]\)|\t\1|" -e "s|^@||" >$(distdir)/ChangeLog
-+ ( cd $(top_srcdir) && git log --date=short --pretty="format:@%cd %an <%ae> [%H]%n%n%s%n%n%e%b" | sed -e "s|^\([^@]\)|\t\1|" -e "s|^@||" ) >$(distdir)/ChangeLog
---
-1.8.3.1
-
diff --git a/0002-daemon-main-do-not-create-run-icecc-by-ourselves.patch b/0002-daemon-main-do-not-create-run-icecc-by-ourselves.patch
new file mode 100644
index 0000000..fb4de95
--- /dev/null
+++ b/0002-daemon-main-do-not-create-run-icecc-by-ourselves.patch
@@ -0,0 +1,30 @@
+From f99d4abcd23ba589b07acbdab05213e360e66312 Mon Sep 17 00:00:00 2001
+From: Michal Schmidt <mschmidt@redhat.com>
+Date: Thu, 29 Aug 2013 18:12:02 +0200
+Subject: [PATCH 2/3] daemon/main: do not create /run/icecc by ourselves
+
+In order to be able to restrict the daemon's SELinux policy even more,
+let's rely on tmpfiles.d to create the /run/icecc directory for us
+instead of creating it from the daemon.
+---
+ daemon/main.cpp | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/daemon/main.cpp b/daemon/main.cpp
+index 4db17f2..fc12caf 100644
+--- a/daemon/main.cpp
++++ b/daemon/main.cpp
+@@ -2177,10 +2177,6 @@ int main(int argc, char **argv)
+ logfile = "/var/log/icecc/iceccd.log";
+ }
+
+- mkdir("/var/run/icecc", S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH);
+- chmod("/var/run/icecc", S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH);
+- chown("/var/run/icecc", d.user_uid, d.user_gid);
+-
+ #ifdef HAVE_LIBCAP_NG
+ capng_clear(CAPNG_SELECT_BOTH);
+ capng_update(CAPNG_ADD, (capng_type_t)(CAPNG_EFFECTIVE | CAPNG_PERMITTED), CAP_SYS_CHROOT);
+--
+2.1.0
+
diff --git a/0002-handle-HOME-not-being-set.patch b/0002-handle-HOME-not-being-set.patch
deleted file mode 100644
index fbe1717..0000000
--- a/0002-handle-HOME-not-being-set.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From 6f79da339b3fd946b46932d61f30a117918de7b7 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Lubo=C5=A1=20Lu=C5=88=C3=A1k?= <l.lunak@suse.cz>
-Date: Tue, 16 Jul 2013 15:46:06 +0200
-Subject: [PATCH 2/8] handle $HOME not being set
-
----
- client/main.cpp | 2 +-
- daemon/main.cpp | 11 ++++++++---
- 2 files changed, 9 insertions(+), 4 deletions(-)
-
-diff --git a/client/main.cpp b/client/main.cpp
-index d72ce9d..638dbda 100644
---- a/client/main.cpp
-+++ b/client/main.cpp
-@@ -335,7 +335,7 @@ int main(int argc, char **argv)
- if (!local_daemon)
- local_daemon = Service::createChannel( "/var/run/iceccd.socket" );
-
-- if (!local_daemon) {
-+ if (!local_daemon && getenv("HOME")) {
- string path = getenv("HOME");
- path += "/.iceccd.socket";
- local_daemon = Service::createChannel( path );
-diff --git a/daemon/main.cpp b/daemon/main.cpp
-index 28ec158..5d7e430 100644
---- a/daemon/main.cpp
-+++ b/daemon/main.cpp
-@@ -553,9 +553,14 @@ bool Daemon::setup_listen_fds()
- unlink(myaddr.sun_path);
- old_umask = umask(0);
- } else { // Started by user.
-- strncpy(myaddr.sun_path, getenv("HOME"), sizeof(myaddr.sun_path)-1);
-- strncat(myaddr.sun_path, "/.iceccd.socket", sizeof(myaddr.sun_path)-1-strlen(myaddr.sun_path));
-- unlink(myaddr.sun_path);
-+ if( getenv( "HOME" )) {
-+ strncpy(myaddr.sun_path, getenv("HOME"), sizeof(myaddr.sun_path)-1);
-+ strncat(myaddr.sun_path, "/.iceccd.socket", sizeof(myaddr.sun_path)-1-strlen(myaddr.sun_path));
-+ unlink(myaddr.sun_path);
-+ } else {
-+ log_error() << "launched by user, but $HOME not set" << endl;
-+ return false;
-+ }
- }
-
- if (bind(unix_listen_fd, (struct sockaddr*)&myaddr, sizeof(myaddr)) < 0) {
---
-1.8.3.1
-
diff --git a/0003-Debian-and-Ubuntu-uses-docbook2x-man-instead-of-docb.patch b/0003-Debian-and-Ubuntu-uses-docbook2x-man-instead-of-docb.patch
deleted file mode 100644
index 5bc17f2..0000000
--- a/0003-Debian-and-Ubuntu-uses-docbook2x-man-instead-of-docb.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From 059b0aaa9b54ab4a8866cdaf40eb4200a2797feb Mon Sep 17 00:00:00 2001
-From: Rodrigo Belem <rodrigo.belem@gmail.com>
-Date: Mon, 8 Apr 2013 15:55:49 -0400
-Subject: [PATCH 3/8] Debian and Ubuntu uses docbook2x-man instead of
- docbook-to-man
-
-Signed-off-by: Rodrigo Belem <rodrigo.belem@gmail.com>
-(cherry picked from commit df212c10336b6369ab244d9c888263774c9087dc)
----
- configure.ac | 11 +++++++----
- 1 file changed, 7 insertions(+), 4 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index 2a35390..3750c49 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -71,12 +71,15 @@ AC_ARG_WITH(man,
- )
- AS_IF([test "x$with_man" != "xno"], [
- build_man=yes
-- AC_PATH_PROG(DOCBOOK2X,[docbook-to-man])
-+ AC_PATH_PROG(DOCBOOK2X,[docbook2x-man])
- AS_IF([test -z "$DOCBOOK2X"], [
-- AC_PATH_PROG(DOCBOOK2X,[docbook2man.pl])
-+ AC_PATH_PROG(DOCBOOK2X,[docbook-to-man])
- AS_IF([test -z "$DOCBOOK2X"], [
-- AC_MSG_WARN([docbook-to-man is missing. Install docbook2X package.])
-- DOCBOOK2X='echo docbook-to-man is missing. Install docbook2X package.'
-+ AC_PATH_PROG(DOCBOOK2X,[docbook2man.pl])
-+ AS_IF([test -z "$DOCBOOK2X"], [
-+ AC_MSG_WARN([docbook2x is missing. Install docbook2x package.])
-+ DOCBOOK2X='echo docbook2x is missing. Install docbook2x package.'
-+ ])
- ])
- ])
- ], [build_man=no])
---
-1.8.3.1
-
diff --git a/0003-configure.ac-simplify-search-for-docbook2X-add-db2x_.patch b/0003-configure.ac-simplify-search-for-docbook2X-add-db2x_.patch
new file mode 100644
index 0000000..c2b4481
--- /dev/null
+++ b/0003-configure.ac-simplify-search-for-docbook2X-add-db2x_.patch
@@ -0,0 +1,47 @@
+From ab01e50fc9a6ba9af1168e3e8aabaf23415d1066 Mon Sep 17 00:00:00 2001
+From: Michal Schmidt <mschmidt@redhat.com>
+Date: Fri, 5 Sep 2014 17:51:06 +0200
+Subject: [PATCH 3/3] configure.ac: simplify search for docbook2X, add
+ db2x_docbook2man
+
+AC_PATH_PROGS can be used to search for the first usable program from a
+given list.
+
+In Fedora the correct docbook tool for creating manpages is
+'db2x_docbook2man' from the docbook2X package.
+---
+ configure.ac | 17 ++++-------------
+ 1 file changed, 4 insertions(+), 13 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index 9da2d01..8943c12 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -76,20 +76,11 @@ AC_ARG_WITH(man,
+ )
+ AS_IF([test "x$with_man" != "xno"], [
+ build_man=yes
+- AC_PATH_PROG(DOCBOOK2X,[docbook2x-man])
++ AC_PATH_PROGS(DOCBOOK2X,
++ [docbook2x-man db2x_docbook2man docbook-to-man docbook2man.pl docbook2man])
+ AS_IF([test -z "$DOCBOOK2X"], [
+- AC_PATH_PROG(DOCBOOK2X,[docbook-to-man])
+- AS_IF([test -z "$DOCBOOK2X"], [
+- AC_PATH_PROG(DOCBOOK2X,[docbook2man.pl])
+- AS_IF([test -z "$DOCBOOK2X"], [
+- AC_PATH_PROG(DOCBOOK2X,[docbook2man])
+- AS_IF([test -z "$DOCBOOK2X"], [
+- AC_MSG_WARN([docbook2x is missing. Install docbook2x package.])
+- DOCBOOK2X='echo docbook2x is missing. Install docbook2x package.'
+- ])
+- ])
+- ])
+- ])
++ AC_MSG_WARN([docbook2x is missing. Install docbook2x package.])
++ DOCBOOK2X='echo docbook2x is missing. Install docbook2x package.'])
+ ], [build_man=no])
+ AC_SUBST(DOCBOOK2X)
+ AM_CONDITIONAL([WITH_ICECREAM_MAN], [test "x$build_man" != "xno"])
+--
+2.1.0
+
diff --git a/0004-Mac-brew-has-docbook2man-instead-of-docbook-to-man.patch b/0004-Mac-brew-has-docbook2man-instead-of-docbook-to-man.patch
deleted file mode 100644
index 721f505..0000000
--- a/0004-Mac-brew-has-docbook2man-instead-of-docbook-to-man.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From 50e25516be288526f6251502900c7cc887b40294 Mon Sep 17 00:00:00 2001
-From: Eike Ziller <github@eikeziller.de>
-Date: Tue, 18 Jun 2013 22:55:36 +0200
-Subject: [PATCH 4/8] Mac/brew has docbook2man instead of docbook-to-man
-
-(cherry picked from commit a40bae096bd51f328d6ff299077c5530729b0580)
----
- configure.ac | 7 +++++--
- 1 file changed, 5 insertions(+), 2 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index 3750c49..e77e864 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -77,8 +77,11 @@ AS_IF([test "x$with_man" != "xno"], [
- AS_IF([test -z "$DOCBOOK2X"], [
- AC_PATH_PROG(DOCBOOK2X,[docbook2man.pl])
- AS_IF([test -z "$DOCBOOK2X"], [
-- AC_MSG_WARN([docbook2x is missing. Install docbook2x package.])
-- DOCBOOK2X='echo docbook2x is missing. Install docbook2x package.'
-+ AC_PATH_PROG(DOCBOOK2X,[docbook2man])
-+ AS_IF([test -z "$DOCBOOK2X"], [
-+ AC_MSG_WARN([docbook2x is missing. Install docbook2x package.])
-+ DOCBOOK2X='echo docbook2x is missing. Install docbook2x package.'
-+ ])
- ])
- ])
- ])
---
-1.8.3.1
-
diff --git a/0005-Revert-chmod-chown-envs-dir-when-preparing-this.patch b/0005-Revert-chmod-chown-envs-dir-when-preparing-this.patch
deleted file mode 100644
index 1e3d05d..0000000
--- a/0005-Revert-chmod-chown-envs-dir-when-preparing-this.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From bade4de1155e41809205ede25ffb99211c72547c Mon Sep 17 00:00:00 2001
-From: Michal Schmidt <mschmidt@redhat.com>
-Date: Mon, 26 Aug 2013 17:08:52 +0200
-Subject: [PATCH 5/8] Revert "chmod/chown envs dir when preparing this"
-
-This reverts commit 137e683760707c690df496516432d72d8f7a81d3.
----
- daemon/environment.cpp | 7 +------
- daemon/environment.h | 2 +-
- daemon/main.cpp | 2 +-
- 3 files changed, 3 insertions(+), 8 deletions(-)
-
-diff --git a/daemon/environment.cpp b/daemon/environment.cpp
-index 87a78a7..4a4ac94 100644
---- a/daemon/environment.cpp
-+++ b/daemon/environment.cpp
-@@ -165,7 +165,7 @@ static bool cleanup_directory( const string& directory )
- return true;
- }
-
--bool cleanup_cache( const string &basedir, uid_t user_uid, gid_t user_gid )
-+bool cleanup_cache( const string &basedir )
- {
- flush_debug();
-
-@@ -181,11 +181,6 @@ bool cleanup_cache( const string &basedir, uid_t user_uid, gid_t user_gid )
- log_perror( "mkdir in cleanup_cache() failed" );
- return false;
- }
-- if ( chown( basedir.c_str(), user_uid, user_gid ) ||
-- chmod( basedir.c_str(), 0775 ) ) {
-- log_perror( "chown/chmod in cleanup_cache() failed" );
-- return false;
-- }
-
- return true;
- }
-diff --git a/daemon/environment.h b/daemon/environment.h
-index 8e9361f..ecea781 100644
---- a/daemon/environment.h
-+++ b/daemon/environment.h
-@@ -27,7 +27,7 @@
- #include <unistd.h>
-
- class MsgChannel;
--extern bool cleanup_cache( const std::string &basedir, uid_t user_uid, gid_t user_gid );
-+extern bool cleanup_cache( const std::string &basedir );
- extern size_t setup_env_cache(const std::string &basedir, std::string &native_environment,
- uid_t user_uid, gid_t user_gid,
- const std::string &compiler, const std::list<std::string> &extrafiles);
-diff --git a/daemon/main.cpp b/daemon/main.cpp
-index 5d7e430..e08b1e1 100644
---- a/daemon/main.cpp
-+++ b/daemon/main.cpp
-@@ -1872,7 +1872,7 @@ int main( int argc, char ** argv )
- pidFile << dcc_master_pid << endl;
- pidFile.close();
-
-- if ( !cleanup_cache( d.envbasedir, d.user_uid, d.user_gid ) )
-+ if ( !cleanup_cache( d.envbasedir ) )
- return 1;
-
- list<string> nl = get_netnames (200);
---
-1.8.3.1
-
diff --git a/0006-daemon-main-do-not-create-run-icecc-by-ourselves.patch b/0006-daemon-main-do-not-create-run-icecc-by-ourselves.patch
deleted file mode 100644
index b156cb9..0000000
--- a/0006-daemon-main-do-not-create-run-icecc-by-ourselves.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From ab65771358f581d55889eba5e3feab283ab55717 Mon Sep 17 00:00:00 2001
-From: Michal Schmidt <mschmidt@redhat.com>
-Date: Thu, 29 Aug 2013 18:12:02 +0200
-Subject: [PATCH 6/8] daemon/main: do not create /run/icecc by ourselves
-
-In order to be able to restrict the daemon's SELinux policy even more,
-let's rely on tmpfiles.d to create the /run/icecc directory for us
-instead of creating it from the daemon.
----
- daemon/main.cpp | 4 ----
- 1 file changed, 4 deletions(-)
-
-diff --git a/daemon/main.cpp b/daemon/main.cpp
-index e08b1e1..387d4e2 100644
---- a/daemon/main.cpp
-+++ b/daemon/main.cpp
-@@ -1801,10 +1801,6 @@ int main( int argc, char ** argv )
- logfile = "/var/log/icecc/iceccd.log";
- }
-
-- mkdir("/var/run/icecc", S_IRWXU|S_IRGRP|S_IXGRP|S_IROTH|S_IXOTH);
-- chmod("/var/run/icecc", S_IRWXU|S_IRGRP|S_IXGRP|S_IROTH|S_IXOTH);
-- chown("/var/run/icecc", d.user_uid, d.user_gid);
--
- #ifdef HAVE_LIBCAP_NG
- capng_clear(CAPNG_SELECT_BOTH);
- capng_update(CAPNG_ADD, (capng_type_t)(CAPNG_EFFECTIVE|CAPNG_PERMITTED), CAP_SYS_CHROOT);
---
-1.8.3.1
-
diff --git a/0007-icecc-create-env-avoid-tar-looking-at-etc-passwd.patch b/0007-icecc-create-env-avoid-tar-looking-at-etc-passwd.patch
deleted file mode 100644
index 22b4ea8..0000000
--- a/0007-icecc-create-env-avoid-tar-looking-at-etc-passwd.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From 318786fede24b6dbeb2c8be4706d432dbf6585af Mon Sep 17 00:00:00 2001
-From: Michal Schmidt <mschmidt@redhat.com>
-Date: Thu, 29 Aug 2013 15:54:19 +0200
-Subject: [PATCH 7/8] icecc-create-env: avoid tar looking at /etc/passwd
-
-If we invoke tar with --numeric-owner, it won't try to read /etc/passwd.
-This has the minor benefit of not having to worry about this access in
-the SELinux policy (or other MAC policies).
----
- client/icecc-create-env | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/client/icecc-create-env b/client/icecc-create-env
-index 029e351..1379ce1 100755
---- a/client/icecc-create-env
-+++ b/client/icecc-create-env
-@@ -337,7 +337,7 @@ md5=`for i in $target_files; do $md5sum $tempdir/$i; done | sed -e 's/ .*$//' |
- echo "creating $md5.tar.gz"
- mydir=`pwd`
- cd $tempdir
--tar -czhf "$mydir/$md5".tar.gz $target_files || {
-+tar -czh --numeric-owner -f "$mydir/$md5".tar.gz $target_files || {
- echo "Couldn't create archive"
- exit 3
- }
---
-1.8.3.1
-
diff --git a/0008-daemon-improve-capabilities-dropping.patch b/0008-daemon-improve-capabilities-dropping.patch
deleted file mode 100644
index ac40964..0000000
--- a/0008-daemon-improve-capabilities-dropping.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From 4c2bce95802f47383f6f57245a447183da4de7c9 Mon Sep 17 00:00:00 2001
-From: Michal Schmidt <mschmidt@redhat.com>
-Date: Fri, 30 Aug 2013 21:25:47 +0200
-Subject: [PATCH 8/8] daemon: improve capabilities dropping
-
-This fixes issues in the usage of libcap-ng to drop capabilities:
-- capng_change_id() already applies the selected capabilities. Calling
- capng_apply() afterwards is pointless.
-- In order to apply the bounding set, CAPNG_CLEAR_BOUNDING must therefore
- be passed to capng_change_id(). Might as well add CAPNG_DROP_SUPP_GRP
- to drop any supplementary groups.
-- The return value of capng_change_id() must be checked to prevent
- continuing to run with unwanted capabilities in case of an error.
-
-I have checked that with this patch applied iceccd runs with a bounding
-set defined (pscap does not show the '+' sign anymore).
----
- daemon/main.cpp | 10 +++++++---
- 1 file changed, 7 insertions(+), 3 deletions(-)
-
-diff --git a/daemon/main.cpp b/daemon/main.cpp
-index 387d4e2..34ad342 100644
---- a/daemon/main.cpp
-+++ b/daemon/main.cpp
-@@ -1803,9 +1803,13 @@ int main( int argc, char ** argv )
-
- #ifdef HAVE_LIBCAP_NG
- capng_clear(CAPNG_SELECT_BOTH);
-- capng_update(CAPNG_ADD, (capng_type_t)(CAPNG_EFFECTIVE|CAPNG_PERMITTED), CAP_SYS_CHROOT);
-- capng_change_id(d.user_uid, d.user_gid, CAPNG_NO_FLAG);
-- capng_apply(CAPNG_SELECT_BOTH);
-+ capng_update(CAPNG_ADD, (capng_type_t)(CAPNG_EFFECTIVE | CAPNG_PERMITTED), CAP_SYS_CHROOT);
-+ int r = capng_change_id(d.user_uid, d.user_gid,
-+ (capng_flags_t)(CAPNG_DROP_SUPP_GRP | CAPNG_CLEAR_BOUNDING));
-+ if (r) {
-+ log_error() << "Error: capng_change_id failed: " << r << endl;
-+ exit(EXIT_SETUID_FAILED);
-+ }
- #endif
- } else {
- d.noremote = true;
---
-1.8.3.1
-
diff --git a/icecream.spec b/icecream.spec
index 91ab38e..c96adf8 100644
--- a/icecream.spec
+++ b/icecream.spec
@@ -4,13 +4,17 @@
Name: icecream
Version: 1.0.1
-Release: 7%{?dist}
+Release: 8.20140822git%{?dist}
Summary: Distributed compiler
Group: Development/Tools
License: GPLv2+
URL: http://en.opensuse.org/Icecream
-Source0: http://ftp.suse.com/pub/projects/icecream/icecc-%{version}.tar.bz2
+#Source0: http://ftp.suse.com/pub/projects/icecream/icecc-%{version}.tar.bz2
+# This git snapshot was generated by:
+# git archive --prefix=icecream-20140822/ 98869a75147eacd716a631e6237d665842f8cd65 | \
+# xz -9 > icecream-20140822.tar.xz
+Source0: icecream-20140822.tar.xz
Source1: icecream.sh.in
Source2: icecream.csh.in
Source3: icecream.fc
@@ -22,20 +26,16 @@ Source9: iceccd-wrapper
Source10: icecc-scheduler-wrapper
Source11: icecream-tmpfiles.conf
-Patch0001: 0001-make-dist-hook-work-also-with-srcdir-builddir.patch
-Patch0002: 0002-handle-HOME-not-being-set.patch
-Patch0003: 0003-Debian-and-Ubuntu-uses-docbook2x-man-instead-of-docb.patch
-Patch0004: 0004-Mac-brew-has-docbook2man-instead-of-docbook-to-man.patch
-Patch0005: 0005-Revert-chmod-chown-envs-dir-when-preparing-this.patch
-Patch0006: 0006-daemon-main-do-not-create-run-icecc-by-ourselves.patch
-Patch0007: 0007-icecc-create-env-avoid-tar-looking-at-etc-passwd.patch
-Patch0008: 0008-daemon-improve-capabilities-dropping.patch
+Patch0001: 0001-Revert-chmod-chown-envs-dir-when-preparing-this.patch
+Patch0002: 0002-daemon-main-do-not-create-run-icecc-by-ourselves.patch
+Patch0003: 0003-configure.ac-simplify-search-for-docbook2X-add-db2x_.patch
Patch10000: %{name}-cleanup-conffile.patch
BuildRequires: systemd
BuildRequires: libcap-ng-devel
-BuildRequires: docbook-utils
+BuildRequires: lzo-devel
+BuildRequires: docbook2X
BuildRequires: autoconf automake libtool
Requires(pre): shadow-utils
@@ -77,15 +77,11 @@ Requires: %{name} = %{version}-%{release}
This package contains development files for %{name}.
%prep
-%setup -q -n icecc-%{version}
+#setup -q -n icecc-%{version}
+%setup -q -n icecream-20140822
%patch0001 -p1
%patch0002 -p1
%patch0003 -p1
-%patch0004 -p1
-%patch0005 -p1
-%patch0006 -p1
-%patch0007 -p1
-%patch0008 -p1
%patch10000 -p0
sed -e 's|@LIBDIR@|%{_libdir}|g;s|@LIBEXECDIR@|%{_libexecdir}|g' %{SOURCE1} > icecream.sh
sed -e 's|@LIBDIR@|%{_libdir}|g;s|@LIBEXECDIR@|%{_libexecdir}|g' %{SOURCE2} > icecream.csh
@@ -96,7 +92,8 @@ cp -p %{SOURCE6} %{SOURCE7} %{SOURCE9} %{SOURCE10} %{SOURCE11} fedora
%build
autoreconf -fi
-%configure --disable-static --enable-shared
+%configure --disable-static --enable-shared \
+ --enable-clang-rewrite-includes --enable-clang-wrappers
# Remove rpath from local libtool copy
sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool
sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool
@@ -196,7 +193,7 @@ for selinuxvariant in %{selinux_variants}; do
%relabel ${selinuxvariant}
done
-restorecon -R %{_localstatedir}/cache/icecream %{_localstatedir}/log/icecc /run/icecc 2>/dev/null
+restorecon -R %{_localstatedir}/cache/icecream /run/icecc 2>/dev/null
%endif
%systemd_post iceccd.service icecc-scheduler.service
@@ -236,6 +233,7 @@ exit 0
%files
%doc COPYING README NEWS TODO
%{_bindir}/icecc
+%{_bindir}/icecc-create-env
%{_bindir}/icerun
%{_libexecdir}/icecc/
%{_libdir}/libicecc.so.*
@@ -257,6 +255,14 @@ exit 0
%{_libdir}/pkgconfig/icecc.pc
%changelog
+* Fri Sep 05 2014 Michal Schmidt <mschmidt@redhat.com> - 1.0.1-8.20140822git
+- Update to current upstream git.
+- Drops bundled minilzo, use system lzo library. (#1131794, CVE-2014-4607)
+- Fix build of manpages (use docbook2X).
+- Enable clang wrappers.
+- Remove no longer necessary restorecon /var/log/icecc.
+- Drop merged patches.
+
* Sat Aug 16 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.0.1-7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
diff --git a/sources b/sources
index b3ddfb6..421c7e7 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-638d8d3b102a964cadd5fd338fa73a95 icecc-1.0.1.tar.bz2
+e326bd5e43e0844ebfe1b0556e45b78e icecream-20140822.tar.xz
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-07-31 6:34 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-07-31 6:34 [rpms/icecream] epel8: Update to current upstream git Michal Schmidt
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox