-
dpkg (1.18.2ubuntu5.1) wily-security; urgency=medium
* SECURITY UPDATE: multiple security issues
- dpkg-deb/extract.c: Fix off-by-one write access on ctrllenbuf
variable. (CVE-2015-0860)
- lib/dpkg/ar.c: Fix an off-by-one read access in ar member name
variable.
- Thanks to Guillem Jover and Hanno Böck for the patches!
-- Marc Deslauriers <email address hidden> Thu, 26 Nov 2015 08:00:10 -0500
-
dpkg (1.18.2ubuntu5) wily; urgency=medium
* Pull packaging changes from 1.18.3 to fix libdir issues (LP: #1504761)
* Fix an off-by-one write access in dpkg-deb when parsing the deb magic.
* Fix a segfault when using «dpkg --no-act» with a synthetic --admindir.
-- Adam Conrad <email address hidden> Sat, 17 Oct 2015 12:47:12 -0600
-
dpkg (1.18.2ubuntu4) wily; urgency=medium
* Add a Breaks on software-center (<< 13.10-0ubuntu9~) for trigger loops.
-- Adam Conrad <email address hidden> Fri, 11 Sep 2015 11:11:01 -0600
-
dpkg (1.18.2ubuntu3) wily; urgency=medium
* Cherrypick fix from git to be less strict about week day parsing.
* Extend the above to also be less strict about month name parsing.
-- Adam Conrad <email address hidden> Wed, 26 Aug 2015 16:39:42 -0600
-
dpkg (1.18.2ubuntu2) wily; urgency=medium
* Add a Breaks on dbus (<< 1.8.12-1ubuntu6~) to avoid the noawait trigger.
-- Adam Conrad <email address hidden> Tue, 18 Aug 2015 13:51:02 -0600
-
dpkg (1.18.2ubuntu1) wily; urgency=medium
* Merge with Debian unstable, bringing in a whole host of new bugfixes.
dpkg (1.18.2) unstable; urgency=low
[ Guillem Jover ]
* Fix plural form translations for single plural languages. Closes: #790025
* Add new dpkg-buildpackage -J option, which is a safe version of -j.
* Fix dpkg-gencontrol to add correct binary filename to debian/files,
even when overriding the Package field value with the -D option.
Reported by Niels Thykier <email address hidden>.
* Move the implicit build-essential:native Build-Depends from
dpkg-checkbuilddeps to a new vendor hook, as it is Debian-specific.
* Add support for ignoring built-in build dependencies and conflicts
with the new «dpkg-buildpackage --ignore-builtin-builddeps» and
«dpkg-checkbuilddeps -I» options. Closes: #480638, #571671
* When sys_siglist is defined in the system, try to use NSIG as we cannot
compute the array size with sizeof(). If NSIG is missing fallback to 32
items. Prompted by Igor Pashev <email address hidden>.
* Use string_to_security_class() instead of a literal SECCLASS value in
the setexecfilecon() libcompat function, as <selinux/flask.h> is now
deprecated.
* Switch libdpkg xz compressor to use CRC64 for integrity checks, to match
the default on the command-line tool, which should provide slightly better
detection against damaged data, at a negligible speed difference.
* Only use the SHELL environment variable for interactive shells.
Closes: #788819
* Move tar option --no-recursion before -T in dpkg-deb. With tar > 1.28 the
--no-recursion option is now positional, and needs to be passed before
the -T option, otherwise the tarball will end up with duplicated entries.
Thanks to Richard Purdie <email address hidden>.
* Add an extra level of escaping for double $(evals) in architecture.mk
and buildflags.mk, so that the variables are computed lazily again.
Regression introduced in dpkg 1.16.2. Closes: #793330
* Add binary packages Essential information to Package-List field in the
.dsc file, as optional essential=yes entries. This allows precomputing
the pseudo-essential set before starting an architecture bootstrap.
* Perl modules:
- Remove non-functional timezone name support from
Dpkg::Changelog::Entry::Debian.
- Use Time::Piece (part of the perl core distribution) instead of
Date::Parse in Dpkg::Changelog::Entry::Debian. This reduces the build
and run-time dependencies, and helps architecture bootstrapping.
- Simplify distribution splitting in Dpkg::Changelog::Entry::Debian.
- Add new function changelog_parse_plugin() in Dpkg::Changelog::Parse.
- Add new function changelog_parse_debian() in Dpkg::Changelog::Parse, and
use it in changelog_parse() instead of the external plugin parser when
the input format is “debian”. This significantly speeds up the parsing.
- Remove trailing space before handling blank line dot-separator in
Dpkg::Control::HashCore. Regression introduced in dpkg 1.18.0.
Reported by Jakub Wilk <email address hidden>. Closes: #789580
- Allow the Maintainer field in CTRL_FILE_STATUS.
- Import make_path from File::Path in Dpkg::Source::Package::V2.
Regression introduced in dpkg 1.18.0. Closes: #789957
- Make the BinaryFiles subpackage self-contained by explicitly importing
File::Spec in Dpkg::Source::Package::V2.
- Do not exclude pre-existing symlinks when unpacking the debian/ tarball
in Dpkg::Source::Package::V2. Closes: #790073, #791535
- Disable the thread sanitizer when the address sanitizer is enabled
in Dpkg::Vendor::Debian as these are mutually incompatible, and make
sanitize=+all not work at all.
- Allow colons (:) in added filenames in Dpkg::Dist::Files, which can be
present when the upstream version contains colons. Regression introduced
in dpkg 1.18.0. Reported by Jakub Wilk <email address hidden>.
- Future-proof tar invocations in Dpkg::Source::Archive for options that
might become positional in the future, and by always placing function
options first.
- Make the dependency comparison deep by comparing not only the first
dependency alternative, to get them sorted in a reproducible way.
Based on a patch by Chris Lamb <email address hidden>. Closes: #792491
- Support spaces in symbol names in Dpkg::Shlibs::Objdump. This is
required by Go shared libraries. Closes: #785344
Based on a patch by Michael Hudson-Doyle <email address hidden>.
* Test suite:
- Set SIGINT, SIGTERM and SIGPIPE to their default actions to get
deterministic behavior.
- Add test cases for the makefile snippets.
- Delete DEB_VENDOR from the environment to get reliable results.
* Packaging:
- Make the libdpkg-dev package Multi-Arch:same.
- Mark libio-string-perl as <!nocheck>.
* Documentation:
- Fix grammar in dpkg-architecture(1).
Thanks to Chris Lamb <email address hidden>. Closes: #787616
- Use the feature area name in the dpkg-buildflags(1) subsection title.
- Document DPKG_HOOK_ACTION also in dpkg(1) ENVIRONMENT section.
- Clarify when some features where added in man pages.
- Document --yet-to-unpack, --predep-packages and all --assert-<feature>
commands as supported in both «dpkg --help» and dpkg(1).
- Document abitable in dpkg-architecture(1).
- Clarify that an architecture wildcard is a Debian thing in
dpkg-architecture(1).
- Document multiarch triplet in dpkg-architecture(1) TERMS section.
- Remove “my” keyword from Dpkg perl modules function prototypes.
- Say FUNCTIONS instead of METHODS for Dpkg modules when appropriate.
- Fix POD syntax inside verbatim paragraph in Dpkg::Changelog.
- Document and mark Dpkg::Arch as a public module.
- Fix Dpkg::Changelog::Parse::changelog_parse documentation.
[ Updated programs translations ]
* Dutch (Frans Spiesschaert). Closes: #789097
* Simplified Chinese (Zhou Mo). Closes: #787986
* Turkish (Mert Dirik). Closes: #788211
* Vietnamese (Trần Ngọc Quân).
[ Updated manpages translations ]
* German (Helge Kreutzmann).
[ Updated dselect translations ]
* Dutch (Frans Spiesschaert). Closes: #789096
[ Updated scripts translations ]
* German (Helge Kreutzmann).
-- Adam Conrad <email address hidden> Thu, 13 Aug 2015 02:05:42 -0600
-
dpkg (1.18.1ubuntu1) wily; urgency=medium
* Merge from Debian testing; remaining changes in the Ubuntu delta:
- Change native source version/format mismatch errors into warnings
until the dust settles on Debian bug 737634 about override options.
- Add DPKG_UNTRANSLATED_MESSAGES environment check so that higher-level
tools can get untranslated dpkg terminal log messages while at the
same time having translated debconf prompts.
- Special-case arm{el,hf} ELF objects in Shlibs/Objdump.pm for multilib.
- Map unqualified package names of multiarch-same packages to the native
arch instead of throwing an error, so that we don't break on upgrade
when there are unqualified names stored in the dpkg trigger database.
- Apply a workaround from mvo to consider ^rc packages as multiarch,
during the dpkg consistency checks. (see LP: 1015567 and 1057367).
* Carry over Breaks/Conflicts for triggers/upgrades until post-16.04.
dpkg (1.18.1) unstable; urgency=low
[ Guillem Jover ]
* Cast c_isbits() c argument to an unsigned char when indexing the array.
This fixes build failures on armel, armhf, ppc64el and s390x.
* Do not allow pathnames with embedded newlines in dpkg-deb and dpkg.
Closes: #720761
* Fix setting the SE Linux context when a file has a statoverride.
Closes: #786435
* Set the SE Linux file context even when the file mode has no file type.
* Make dpkg-buildpackage -j override any parallel option specified in
DEB_BUILD_OPTIONS. Regression introduced in dpkg 1.14.15.
* Honor Pre-Depends, Conflicts and Breaks for packages in unpacked and
half states. Thanks to Ian Jackson <email address hidden>. Closes: #377860
* Fix build failure on FreeBSD by actually using libmd if available.
* Sort dpkg-scanpackages output by package name and version.
Thanks to Maximilian Schwerin <email address hidden>.
* Sort dpkg-scansources output by package name and version.
Thanks to Maximilian Schwerin <email address hidden>.
* Set the correct default compression value in dpkg-deb for control.tar.gz
member. This meant using compression level 1 when using the zlib shared
library to compress the control.tar member, and always failing when using
the gzip command. Regression introduced in dpkg 1.17.6. Closes: #786654
* Use the generated template file instead of the original one when looking
for changes in dpkg-gensymbols. There's too much information not being
preserved in the symbols files to be able to regenerate templates for
them. Closes: #785937, #786840
* Perl modules:
- Add missing strict and warnings pragmas for submodules.
- Use non-destructive substitutions inside map.
- Use the state keyword to simplify the code.
- Do not replace #PACKAGE# in template mode in Dpkg::Shlibs::SymbolFile.
* Documentation:
- Update current default source compressor from gzip to xz.
- Remove spurious ‘=’ from parallel DEB_BUILD_OPTIONS without arguments
in dpkg-buildpackage(1).
[ Updated programs translations ]
* German (Sven Joachim).
* Simplified Chinese (Zhou Mo). Closes: #786377
[ Updated manpages translations ]
* German (Helge Kreutzmann).
[ Updated dselect translations ]
* German (Sven Joachim).
dpkg (1.18.0) unstable; urgency=low
[ Guillem Jover ]
* Only trim trailing “/” and “/.” from «dpkg-query --search» arguments if
they are a pathname, and not a pattern or a substring match.
* Switch C/C++ code to use a new set of C locale character type functions
independent of the current locale.
* Add support for arch-bits and arch-endian dpkg-gensymbols tags.
Closes: #630342
* Switch perl code from legacy File::Path functions to new ones.
* Fix perl uninitialized value usage in dpkg-scansources when the Binary
field is missing.
* Use dpkg-query instead of dpkg for --search in dpkg-shlibdeps so that
the subprocesses get the correct admindir. Closes: #775258
* Rework the Installed-Size field default value computation to make it
reproducible regardless of the build system filesystem, and document
how the value is computed and that it is just an approximation.
Closes: #650077
* Use strftime() instead of «date -R» in dpkg-genchanges, as the latter
is not specified by POSIX and is not widely portable.
* Warn on obsolete '<' and '>' operators in dpkg --compare-versions.
* Trim end of line whitespace from dpkg and dselect config file parsers.
Reported by Christoph Biedl <email address hidden>.
* Do not silently eat a standalone ‘-’ in the libdpkg command-line parser.
* Fix short-lived memory leaks in dpkg-deb and libdpkg. Closes: #769515
* Fix «dpkg-deb -b» filename generation when the package does not contain
an Architecture field. Regression introduced in dpkg 1.16.2.
* Fix «dpkg --audit» to report missing and empty architecture fields.
Regression introduced in dpkg 1.16.2.
* Add support to dpkg-deb for reading the archive from standard input,
except for --raw-extract which does not yet support it. Closes: #616614
Based on a patch by Johannes Schauer <email address hidden>.
* Add ‘.mailmap’ to the default dpkg-source ignore lists.
* Set the SE Linux context on «dpkg-statoverride --update». Closes: #690361
* Do not fail on dpkg-query -W and -l when multiple arguments match the
same package. Closes: #588505
* Change dpkg-maintscript-helper to handle symlinks and pathnames ending in
slash. For the former error out, for the latter strip it. Closes: #771752
* Support moving a conffile not being shipped anymore. Closes: #767003
Thanks to Mathias Behrle <email address hidden>.
* Add a new dpkg-buildflags sanitize feature area:
- Add new “address”, “thread”, “leak” and “undefined” features, all
disabled by default. Closes: #760741
* Do not accept unknown user or group names on «dpkg-statoverride --add».
Regression introduced in dpkg 1.17.11. Closes: #775124
* Normalize dpkg-parsechangelog command-line parsing, so that «-ovalue»,
«-o value», «--option=value» and «--option value» will all be accepted.
Closes: #693951
* Add dpkg --ctrl-tarfile forwarding command for dpkg-deb.
* Disable dependency checks on dpkg-buildpackage -S -nc.
* Make dependency checks fatal for dpkg-buildpackage -S.
* Update amd64 GNU cpu regex in cputable to match amd64 too, in addition
to x86_64. This is required for FreeBSD.
* Use badusage() instead of ohshit() for command-line errors.
* Use the original template symbols file when diffing in dpkg-gensymbols.
We should not create a new template symbols file, because the output
might change (different sorting order for example) relative to the
original. Closes: #773718
* Do not leak kvm descriptors in start-stop-daemon on GNU/kFreeBSD systems.
Based on a patch by Jeff Epler <email address hidden>. Closes: #779467
* Switch start-stop-daemon to use a monotonic clock if available. This
makes the timeout checks resilient to abrupt system clock changes.
Suggested by Jose M Calhariz <email address hidden>. Closes: #783014
* Fix perl warning in dpkg-genchanges when parsing BY-HAND file entries.
Regression introduced in dpkg 1.17.7. Closes: #781074
* Use the checksums files list order when building the Files field to match
the other Checksum fields in dpkg-genchanges.
* Skip files based on the architecture from the filename in dpkg-genchanges.
* Allow binary packages not found in debian/control in dpkg-genchanges,
which could allow injecting debug .debs for example.
* Annotate any non-deb binary descriptions (not just udebs) with their
package type in dpkg-genchanges.
* Remove outdated local copy of the Debian README.mirrors.txt file from
dselect ftp access method, and print a message pointing to the current
URL instead. Closes: #784966
* Cleanup default dpkg-shlibdeps shared library directory search list:
- Do not add cross-root directories (/<triplet>/ and /usr/<triplet>/).
- Remove ancient multilib /emul/ia32-linux/ paths.
- Reorder directory precedence to:
«dpkg-shlibdeps -l» > ENV{LD_LIBRARY_PATHS} > cross-multiarch >
DEFAULT_LIBRARY_PATH > ld.so.conf > DEFAULT_MULTILIB_PATH
* When upgrading, copy over the cached arch-qualified package name. This
fixes wrong output when cross-grading.
* Consider foreign packages ambiguous in need of an arch-qualifier.
* Perl modules:
- Rename and deprecate Dpkg::Gettext _g function with new g_.
- Assume in Dpkg::Arch that the abitable is always present, and bump
libdpkg-perl Depends on dpkg to 1.16.3, the version introducing the file.
- Remove support for GCC_TARGET environment variable from Dpkg::Shlibs.
This was a temporary workaround for very old gcc toolchains. See #453267.
- Prefer multiarch paths to multilib ones in Dpkg::Shlibs.
Thanks to Helmut Grohne <email address hidden>. Closes: #772184
- Enable sub-second timestamps in Dpkg::Source::Patch by using Time::HiRes.
- Use TMPDIR instead of manually setting DIR on tempfile() call in
Dpkg::Source::Package::V2.
- Switch Dpkg::Checksums from using checksum programs to the more portable
Digest modules. Obsolete the 'program' property, and add a 'name' one.
- Add support for $DEFAULT_TEXT_DOMAIN to Dpkg::Gettext, so that the Dpkg
perl modules can always produce localized messages.
- Fix OpenPGP Armor Header Line parsing in Dpkg::Control::Hash. We should
only accept [\r\t ] as trailing whitespace, although RFC4880 does not
clarify what whitespace really maps to, we should really match the GnuPG
implementation anyway, as that's what we use to verify the signatures.
Reported by Jann Horn <email address hidden>. Fixes CVE-2015-0840.
- Pass PATCH_GET environment variable instead of -g0 to the patch command
in Dpkg::Source::Patch. This allows using non-GNU patch programs, like
FreeBSD's patch.
- Accept an %opts argument for the Dpkg::Control::Info constructor, and
accept either passing a filename option as undef, or a scalar undef.
Closes: #782019
- Do not print on undef filehandle in Dpkg::Control::Info output().
Thanks to Roderich Schupp <email address hidden>. Closes: #781887
- Always sort the Dpkg::Dist::Files files list on output, instead of
preserving the insertion order, which is not reproducible with parallel
builds. Reported by Jérémy Bobbio <email address hidden>.
- Add new filter() method to Dpkg::Substvars.
- Kill the process when reaching timeout in Dpkg::IPC::wait_child().
* Test suite:
- Check perl code compilation, warnings and strictness.
- Fix dpkg-divert unit test to work on BSD «rm -rf» that cannot traverse
directories with mode 000.
- Fix dpkg-divert unit test to work when there is no /dev/full.
- Skip test cases when there is no c++filt available.
- Add test cases for Dpkg::Conf and Dpkg::Checksums.
- Handle libtool executables in progname unit test.
- Do not use a timeout when testing cat I/O, speeds up test suite by 5s.
- Reduce timeout test from 5 seconds to 1, to speed up test suite by 4s.
* Build system:
- Bump gettext version to 0.19:
+ Use --add-location=file in msgmerge and xgettext commands.
+ Use --porefs=noline for po4a command.
- Wrap file references in man page PO files with po4a --porefs=wrap.
- Fix support for cross-building dpkg:
+ Assume a working C99 snprintf on SUS >= v3.
+ Do not try to run the va_copy configure check, just check that the
symbol is available.
- Check that HAVE_DECL_SYS_SIGLIST is 0 instead of undefined, to fix a
build failure on uclibc based systems. Closes: #777044
Based on a patch by Alex Potapenko <email address hidden>.
- Use single suffix rules instead of non-portable %-pattern rules.
- Pass CC to the test suite, so that we can use a non-gcc compiler.
- Call AM_PROG_AR to detect the correct system archiver to use.
- Pass -Wall to automake in AM_INIT_AUTOMAKE, not implied by foreign.
* Packaging:
- Remove old trigger related Breaks and Conflicts from dpkg.
- Only use stackprotectorstrong when building dpkg with gcc >= 4.9.
- Switch to debhelper compatibility level 9.
- Name each public-domain license with a different name.
- Add missing public modules to dpkg-dev package description.
- Get rid of backward compatibility pseudo-tags from bug reports.
- Install doc/README.feature-removal-schedule only on affected packages
and debian/usertags everywhere.
* Documentation:
- Document arch-qualifiers for dependency fields in deb-control(5) and
deb-src-control(5). Reported by Johannes Schauer <email address hidden>.
Closes: #768842
- Document versioned Provides in deb-control(5).
- Document the version when dpkg-deb --raw-extract got introduced.
- Document dpkg --log format, add missing actions and describe the startup
messages. Closes: #773398
- Document when and how the dpkg-maintscript-helper package name argument
is or should be arch-qualified. Closes: #776072
- Fix and update Arch substvar description in deb-substvars(5).
- Document that current build flag feature areas only work on Debian and
derivatives in dpkg-buildflags(1).
- Use “wildcard characters” instead of “wildchars” in dpkg-query(1).
- Document dpkg-query --search behavior in man page. Closes: #775379
- Document postinst “triggered” argument in debian/dpkg.postinst comment
header.
- Document Dpkg::IPC function signatures.
- Document the obsolete --compare-versions '<' and '>' operators in the
dpkg(1) man page. Thanks to Tomas Pospisek <email address hidden>.
Closes: #776551
- Move dpkg-divert, dpkg-statoverride and update-alternatives man pages
from section 8 to 1, to match their installation path.
- Capitalize dpkg-parsechangelog(1) option descriptions.
- Mark dpkg-parsechangelog(1) --format values in bold.
- Place short options before long ones in dpkg-mergechangelogs(1) and
dselect(1) man pages.
- Properly terminate a bold marking in dpkg(1).
- Document in man pages the dpkg version when new features were introduced.
- Document that timestamps are reset for files patched with source format
“3.0 (quilt)” too.
- Document in dpkg-buildpackage(1) that using dpkg-source is sometimes
better than -S. Suggested by Johannes Schauer <email address hidden>.
- Document dselect -? option.
- Document in dpkg-buildflags(1) that DEB_VENDOR influences the execution.
- Document that dpkg performs sanity checks on PATH.
- Mark some words and commands as non-hyphenable in man pages.
- Separate multi-line hanging tag paragraphs with .TQ in man pages.
- Mark field names in bold in man pages.
- Use various groff escape sequences for quoting characters.
- Lowercase warning and note admonitions in start-stop-daemon(8).
- Mark dselect(1) color attributes in bold.
- Say output instead of display for dpkg-deb tar-file option in dpkg(1).
- Say archive instead of filename for dpkg-deb option in dpkg(1).
- Say control-field-name instead of control-file-field in dpkg-deb(1).
- Fix option values and pathname markup in dpkg-deb(1).
- Use .TQ to separate different but related options in dpkg(1).
- Clarify that dpkg-buildpackage -jN forces parallel builds, regardless of
the packaging or upstream build systems supporting them. Closes: #780866
- Remove unneeded update-alternatives references from options descriptions.
- Document that apt might expect Packages.xz too in dpkg-scanpackages(1).
- Say METHODS instead of FUNCTIONS or OBJECT FOO in POD section titles.
- Document dpkg version when perl module versions got bumped.
* Output message fixes and improvements:
- Remove trailing newline from string literal in warning calls.
- Say “execute” instead of “exec” in Dpkg::Changelog::Parse error message.
- Say “package” instead of “it” in dpkg-name warning message.
- Uppercase field names in error messages.
- Expand EOF and eof into “end of file” in error messages.
- Use “<enter>” instead of “return” or “enter” in input prompts.
- Say directory instead of dir in output messages.
- Merge the same dpkg-scanpackages warning messages into a single line.
- Clarify dpkg-genchanges changes description open error.
- Add missing preposition in Dpkg::Source::Patch error message.
- Improve available state sorting order strings in dselect panel.
- Say “changelog-file” instead of “changelogfile” in --help output.
- Say “command” instead of “action” for dselect.
- Improve commands listing in «dselect --help» output, by printing them
before options and listing them one on each line with a description.
- Improve dselect color-spec --help output.
- Move "(default)" annotations in scripts --help output after option
description.
- Consistently use proper quotation marks ("" or '', and not the
unbalanced `' pair) all over the place.
- Use syserr() instead of an ad-hoc error message in dpkg-scansources.
- Say substvars instead of varlist in dpkg-shlibdeps error messages.
- Fix error messages on invalid uid/git/mode command-line syntax errors
in dpkg-statoverride, to not say they are from the statoverride file.
- Fix error message on empty dsc file in dpkg-genchanges.
- Mention “(^Z)” instead of “char” for the MSDOS end of file character.
[ Raphaël Hertzog ]
* Drop myself from Uploaders.
[ Updated programs translations ]
* Simplified Chinese (Zhou Mo). Closes: #782326
* Turkish (Mert Dirik). Closes: #785096
* Vietnamese (Trần Ngọc Quân).
[ Updated scripts translations ]
* German (Helge Kreutzmann).
[ Updated manpages translations ]
* German (Helge Kreutzmann).
-- Adam Conrad <email address hidden> Mon, 27 Jul 2015 15:45:43 -0600
-
dpkg (1.17.25ubuntu1) vivid; urgency=medium
* Merge with Debian, pulling in the upstream fix for CVE-2015-0840,
a couple of updated translations, and several trivial bug fixes.
-- Adam Conrad <email address hidden> Fri, 10 Apr 2015 21:36:44 -0600
