[rpms/libcap-ng] f45: New upstream feature release

[Steve Grubb <sgrubb@redhat.com>]

A new commit has been pushed.

Repo   : rpms/libcap-ng
Branch : f45
Commit : 64bb2a2dc4956219ab3215c9060136cc4ebe14e0
Author : Steve Grubb <sgrubb@redhat.com>
Date   : 2026-08-20T23:15:41-04:00
Stats  : +6/-216 in 5 file(s)
URL    : https://src.fedoraproject.org/rpms/libcap-ng/c/64bb2a2dc4956219ab3215c9060136cc4ebe14e0?branch=f45

Log:
New upstream feature release

---
diff --git a/.gitignore b/.gitignore
index 765397d..974b858 100644
--- a/.gitignore
+++ b/.gitignore
@@ -32,3 +32,4 @@ libcap-ng-0.6.4.tar.gz
 /libcap-ng-0.9.2.tar.gz
 /libcap-ng-0.9.3.tar.gz
 /libcap-ng-0.9.4.tar.gz
+/libcap-ng-0.9.5.tar.gz

diff --git a/0001-cap-audit-allow-supplying-vmlinux.h-for-reproducible.patch b/0001-cap-audit-allow-supplying-vmlinux.h-for-reproducible.patch
deleted file mode 100644
index 7da2241..0000000
--- a/0001-cap-audit-allow-supplying-vmlinux.h-for-reproducible.patch
+++ /dev/null
@@ -1,139 +0,0 @@
-From c87636e78cb101e3305b8b970f15e71b0fcfde4b Mon Sep 17 00:00:00 2001
-From: Daan De Meyer <daan@amutable.com>
-Date: Tue, 7 Jul 2026 09:57:57 +0200
-Subject: [PATCH] cap-audit: allow supplying vmlinux.h for reproducible builds
-
-By default cap-audit generates vmlinux.h from the running kernel's BTF
-data in /sys/kernel/btf/vmlinux, which makes the build depend on the host
-kernel and is therefore not reproducible.
-
-Add --with-vmlinux-h=auto|provided|generated and --with-vmlinux-h-path=PATH
-so a pre-generated vmlinux.h can be supplied at configure time instead. In
-provided mode the file is copied as-is and /sys is never read; generated
-mode keeps the existing behaviour.
----
- configure.ac                | 62 +++++++++++++++++++++++++++++++++++++
- utils/cap-audit/Makefile.am |  8 +++++
- 2 files changed, 70 insertions(+)
-
-diff --git a/configure.ac b/configure.ac
-index 44ef598d06..61cbb4e06b 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -70,6 +70,23 @@ AS_HELP_STRING([--enable-cap-audit],[build cap-audit [[default=no]]]),
- [enable_cap_audit=$enableval],
- [enable_cap_audit=no])
- 
-+dnl For reproducible builds cap-audit's vmlinux.h can be supplied at
-+dnl configure time instead of being generated from the running kernel's BTF
-+dnl data in /sys/kernel/btf/vmlinux.
-+AC_ARG_WITH([vmlinux-h],
-+AS_HELP_STRING([--with-vmlinux-h=MODE],
-+[how to obtain cap-audit's vmlinux.h: auto, provided, or generated [[default=auto]]]),
-+[with_vmlinux_h="$withval"],
-+[with_vmlinux_h=auto])
-+AC_ARG_WITH([vmlinux-h-path],
-+AS_HELP_STRING([--with-vmlinux-h-path=PATH],
-+[path to a pre-generated vmlinux.h to use for cap-audit]),
-+[with_vmlinux_h_path="$withval"],
-+[with_vmlinux_h_path=""])
-+
-+VMLINUX_H_PATH=""
-+vmlinux_h_status="n/a (cap-audit disabled)"
-+
- if test "x$enable_cap_audit" = "xyes"; then
- missing_cap_audit_deps=no
- AC_CHECK_PROG([CLANG],[clang],[clang],[no])
-@@ -85,6 +102,48 @@ if test "$CLANG" = "no" -o "$BPFTOOL" = "no" -o \
- "x$missing_cap_audit_deps" = "xyes"; then
- AC_MSG_ERROR([cap-audit requires clang, bpftool, libbpf, and libaudit])
- fi
-+
-+AC_MSG_CHECKING([how to obtain vmlinux.h])
-+case "$with_vmlinux_h" in
-+auto)
-+if test "x$with_vmlinux_h_path" != "x"; then
-+vmlinux_h_source=provided
-+else
-+vmlinux_h_source=generated
-+fi
-+;;
-+provided)
-+vmlinux_h_source=provided
-+;;
-+generated)
-+vmlinux_h_source=generated
-+;;
-+*)
-+AC_MSG_RESULT([error])
-+AC_MSG_ERROR([invalid --with-vmlinux-h value '$with_vmlinux_h' (expected auto, provided, or generated)])
-+;;
-+esac
-+
-+if test "x$vmlinux_h_source" = "xprovided"; then
-+if test "x$with_vmlinux_h_path" = "x"; then
-+AC_MSG_RESULT([error])
-+AC_MSG_ERROR([--with-vmlinux-h=provided requires --with-vmlinux-h-path=PATH])
-+fi
-+if test ! -f "$with_vmlinux_h_path"; then
-+AC_MSG_RESULT([error])
-+AC_MSG_ERROR([provided vmlinux.h not found: $with_vmlinux_h_path])
-+fi
-+dnl Resolve to an absolute path so the build works from any directory.
-+case "$with_vmlinux_h_path" in
-+/*) VMLINUX_H_PATH="$with_vmlinux_h_path" ;;
-+*)  VMLINUX_H_PATH="`pwd`/$with_vmlinux_h_path" ;;
-+esac
-+vmlinux_h_status="provided ($VMLINUX_H_PATH)"
-+AC_MSG_RESULT([provided ($VMLINUX_H_PATH)])
-+else
-+vmlinux_h_status="generated from /sys/kernel/btf/vmlinux"
-+AC_MSG_RESULT([generated from /sys/kernel/btf/vmlinux])
-+fi
- fi
- 
- if test "x$BPF_ARCH" = "x"; then
-@@ -142,8 +201,10 @@ AC_SUBST(LIBBPF_CFLAGS)
- AC_SUBST(LIBBPF_LIBS)
- AC_SUBST(LIBAUDIT_CFLAGS)
- AC_SUBST(LIBAUDIT_LIBS)
-+AC_SUBST(VMLINUX_H_PATH)
- 
- AM_CONDITIONAL([BUILD_CAP_AUDIT], [test "x$enable_cap_audit" = "xyes"])
-+AM_CONDITIONAL([PROVIDED_VMLINUX_H], [test "x$VMLINUX_H_PATH" != "x"])
- AM_CONDITIONAL([BUILD_DEPRECATED], [test "x$enable_deprecated" = "xyes"])
- 
- echo .
-@@ -324,4 +385,5 @@ echo "
- `echo $CFLAGS | fmt -w 50 | sed 's,^,                          ,'`
-   __attr_dealloc_free support:  $DEALLOC
-   netcap advanced mode:  $netcap_advanced_status
-+  cap-audit vmlinux.h:   $vmlinux_h_status
-   "
-diff --git a/utils/cap-audit/Makefile.am b/utils/cap-audit/Makefile.am
-index 9fed078fcd..aea8c39547 100644
---- a/utils/cap-audit/Makefile.am
-+++ b/utils/cap-audit/Makefile.am
-@@ -45,6 +45,7 @@ cap_audit_util.$(OBJEXT) cap_audit_yaml.$(OBJEXT): cap_audit.skel.h
- BPF_ARCH = @BPF_ARCH@
- BPFTOOL = @BPFTOOL@
- CLANG = @CLANG@
-+VMLINUX_H_PATH = @VMLINUX_H_PATH@
- 
- BPF_CFLAGS = -g -O2 -target bpf -D__TARGET_ARCH_${BPF_ARCH} ${AM_CPPFLAGS}
- 
-@@ -54,7 +55,14 @@ cap_audit.skel.h: cap_audit.bpf.o
- cap_audit.bpf.o: cap_audit.bpf.c vmlinux.h
- 	$(AM_V_CC)$(CLANG) $(BPF_CFLAGS) -c $< -o $@
- 
-+if PROVIDED_VMLINUX_H
-+# Reproducible builds: use the vmlinux.h supplied at configure time via
-+# --with-vmlinux-h-path instead of reading the running kernel's BTF data.
-+vmlinux.h: $(VMLINUX_H_PATH)
-+	$(AM_V_GEN)cp $< $@
-+else
- vmlinux.h:
- 	$(AM_V_GEN)$(BPFTOOL) btf dump file /sys/kernel/btf/vmlinux format c > $@
-+endif
- 
- man_MANS = cap-audit.8

diff --git a/fix-u32-parsing.patch b/fix-u32-parsing.patch
deleted file mode 100644
index ff5b709..0000000
--- a/fix-u32-parsing.patch
+++ /dev/null
@@ -1,70 +0,0 @@
-commit 1b7d3fd270a597d37486a01fbc7637b5e4cf9709
-Author: Steve Grubb <ausearch.1@gmail.com>
-Date:   Thu Aug 20 17:04:46 2026 -0400
-
-    Fix netcap u32 parsing on 32-bit systems
-    
-    parse_u32_hex_or_dec relied on comparing strtoul's result with UINT_MAX. On 32-bit systems, an out-of-range value saturates at ULONG_MAX, which is also UINT_MAX, so overflow and negative input could be accepted and the i686 utility_logic_test failed.
-    
-    Clear errno before conversion, reject ERANGE and signed input, and retain the explicit UINT_MAX comparison for platforms with wider unsigned long values.
-    
-    Extend utility_logic_test with the maximum valid u32, the next overflowing value, and signed input. The full native test suite passes.
-
-diff --git a/utils/netcap.c b/utils/netcap.c
-index c763281..09068c8 100644
---- a/utils/netcap.c
-+++ b/utils/netcap.c
-@@ -462,6 +462,9 @@ NETCAP_TESTABLE int parse_u32_hex_or_dec(const char *s, unsigned int *out)
- 	int base = 10;
- 	const char *p;
- 
-+	/* strtoul accepts signs, but these kernel fields are unsigned. */
-+	if (*s == '+' || *s == '-')
-+		return -1;
- 	for (p = s; *p; p++) {
- 		if ((*p >= 'a' && *p <= 'f') || (*p >= 'A' && *p <= 'F')) {
- 			base = 16;
-@@ -472,12 +475,13 @@ NETCAP_TESTABLE int parse_u32_hex_or_dec(const char *s, unsigned int *out)
- 		base = 16;
- 	if (base == 10 && strlen(s) > 3 && s[0] == '0')
- 		base = 16;
-+	errno = 0;
- 	v = strtoul(s, &end, base);
--	if (end == s || *end)
-+	if (errno == ERANGE || end == s || *end)
- 		return -1;
- 	/*
--	 * /proc and diag inputs are meant to fit in u32 fields. Reject values
--	 * above that range instead of silently truncating them into new ids.
-+	 * /proc and diag inputs are meant to fit in u32 fields. On platforms
-+	 * where unsigned long is wider, reject values that would be truncated.
- 	 */
- 	if (v > UINT_MAX)
- 		return -1;
-diff --git a/utils/test/utility_logic_test.c b/utils/test/utility_logic_test.c
-index 0769712..516d4fb 100644
---- a/utils/test/utility_logic_test.c
-+++ b/utils/test/utility_logic_test.c
-@@ -9,6 +9,7 @@
-  */
- 
- #include "config.h"
-+#include <limits.h>
- #include <stdio.h>
- #include <stdlib.h>
- #include <string.h>
-@@ -48,8 +49,14 @@ static void test_parse_u32_hex_or_dec(void)
- 		fail("hex parse with leading zero failed");
- 	if (parse_u32_hex_or_dec("G1", &out) == 0)
- 		fail("invalid parse should fail");
-+	if (parse_u32_hex_or_dec("4294967295", &out) != 0 || out != UINT_MAX)
-+		fail("maximum u32 parse failed");
- 	if (parse_u32_hex_or_dec("4294967296", &out) == 0)
- 		fail("overflow parse should fail");
-+	if (parse_u32_hex_or_dec("+1", &out) == 0)
-+		fail("positive sign parse should fail");
-+	if (parse_u32_hex_or_dec("-1", &out) == 0)
-+		fail("negative parse should fail");
- }
- 
- static void test_list_inode_iteration(void)

diff --git a/libcap-ng.spec b/libcap-ng.spec
index 944e50c..06791e5 100644
--- a/libcap-ng.spec
+++ b/libcap-ng.spec
@@ -1,12 +1,11 @@
 %global bpf_supported_arches aarch64 x86_64 ppc64le riscv64 s390x
 Summary: Alternate posix capabilities library
 Name: libcap-ng
-Version: 0.9.4
-Release: 2%{?dist}
+Version: 0.9.5
+Release: 1%{?dist}
 License: LGPL-2.0-or-later
 URL: https://github.com/stevegrubb/libcap-ng
 Source0: %{name}-%{version}.tar.gz
-Patch1: fix-u32-parsing.patch
 BuildRequires: gcc make
 BuildRequires: autoconf automake libtool
 BuildRequires: kernel-headers >= 2.6.11 
@@ -61,7 +60,6 @@ to determine the necessary capabilities for a program.
 %prep
 %setup -q
 touch -d @${SOURCE_DATE_EPOCH:?} NEWS
-%patch -P 1 -p1
 
 %build
 # Locate suitable vmlinux.h. In normal builds under mock,
@@ -132,8 +130,8 @@ make check
 %endif
 
 %changelog
-* Thu Aug 20 2026 Steve Grubb <sgrubb@redhat.com> 0.9.4-2
-- Add patch to fix 32 bit builds
+* Thu Aug 20 2026 Steve Grubb <sgrubb@redhat.com> 0.9.5-1
+- New upstream feature release
 
 * Thu Aug 20 2026 Steve Grubb <sgrubb@redhat.com> 0.9.4-1
 - New upstream feature release

diff --git a/sources b/sources
index 28e92b6..321ebc5 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (libcap-ng-0.9.4.tar.gz) = e361aa2d1213206560c50bd4953704c68e4c877da55c9bdb167c69a2431ce8c360839699c9cd6d873d1b1c3bbb044bc3625a5e01581789921ee4d3d737db5109
+SHA512 (libcap-ng-0.9.5.tar.gz) = eca44c680ea6104c59591ee19ae9136ed1f4d0437877a1c16f5fb5d546466ff99d52fe45daa081bc6dde15abbb3902528b7bf6fade4845d0c13756d426e21db7