This patch enabled that we can compress any firmware files on disk. This
will save some space since /lib/firmware is becoming larger with every
release.
From formerly 828MiB, this is now using ~349MiB which is a saving of
about 480MiB on disk. This is helping us a lot fighting to contain the
distribution to 2GB on /.
Some other firmware that is installed in other packages is not
compressed with this patch which is a bit sad, but potentially not worth
the effort.
In order to ship this change with a Core Update, it might be intuitive
to remove /lib/firmware first and then extract the new update with all
new files. However, I do not know if this all will compress as well as
before since now the files are already individually compressed. It might
be a challenge to ship this.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
For details see:
https://downloads.isc.org/isc/bind9/9.16.27/doc/arm/html/notes.html#notes-for-bind-9-16-27
"Security Fixes
The rules for acceptance of records into the cache have been
tightened to prevent the possibility of poisoning if forwarders send
records outside the configured bailiwick. (CVE-2021-25220)
ISC would like to thank Xiang Li, Baojun Liu, and Chaoyi Lu from
Network and Information Security Lab, Tsinghua University, and
Changgen Zou from Qi An Xin Group Corp. for bringing this
vulnerability to our attention. [GL #2950]
TCP connections with keep-response-order enabled could leave the TCP
sockets in the CLOSE_WAIT state when the client did not properly
shut down the connection. (CVE-2022-0396) [GL #3112]
Feature Changes
DEBUG(1)-level messages were added when starting and ending the BIND
9 task-exclusive mode that stops normal DNS operation (e.g. for
reconfiguration, interface scans, and other events that require
exclusive access to a shared resource). [GL #3137]
Bug Fixes
The max-transfer-time-out and max-transfer-idle-out options were not
implemented when the BIND 9 networking stack was refactored in 9.16.
The missing functionality has been re-implemented and outgoing zone
transfers now time out properly when not progressing. [GL #1897]
TCP connections could hang indefinitely if the other party did not
read sent data, causing the TCP write buffers to fill. This has been
fixed by adding a “write” timer. Connections that are hung while
writing now time out after the tcp-idle-timeout period has elapsed.
[GL #3132]
The statistics counter representing the current number of clients
awaiting recursive resolution results (RecursClients) could
be miscalculated in certain resolution scenarios, potentially
causing the value of the counter to drop below zero. This has been
fixed. [GL #3147]"
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
For details see:
https://github.com/oetiker/rrdtool-1.x/releases/tag/v1.8.0
"Bugfixes
python bindings: properly convert double values of rrd info
failed to expand 'Py_UNUSED', Invalid usage when expanding 'Py_UNUSED'
document --showtime in xport help output
fix --use-nan-for-all-missing-data
update rrdruby.pod
add missing rrdruby.pod and rrdpython.pod to dist
Set first_weekday to 0 (Sunday), when HAVE__NL_TIME_WEEK_1STDAY is not defined
fix median calculation for all NaN inputs
fix potential leak in xport during failure
fix many warnings raised by Cppcheck
fix many compiler warnings from latest gcc
ensure proper initialization in rrd_daemon
cleanup testsuite
better testing
avoid invalid read in rrd_client
add symbols from rrdc to librrd
Fix duplicate write_changes_to_disk() calls when HAVE_LIBRADOS is true and HAVE_MMAP is false
documentation updates
for SMIN example in docs
fix for pyton3 compatibility
freemem only for valid status <Christian Kr"oger>
fix double meaning of time 0 as uninitialized value
fix for zfs not supporting fallocate. this makes resize work on zfs
add rrdrados.pod to dist
fetch - do not call rrd_freemem on uninitialized pointers
use separate pango fontmap per thread
switch to python 3
do not leak filename when opening a broken file
fix leaks in rrdcached
avoid segfault when flushing cache
escape json in legend entries
fix leak in xport
make rrdcgi param parsing more robust
fix race in journal_write"
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
On an IPFire installation that has been around since Core Update 110
(released April 28, 2017), these files have been identified as being
orphaned, comparing to a fresh installation of Core Update 164.
To avoid such a list of files agglomerating, persons responsible for a
Core Update should check whether an updated package contains deleted
files in its rootfile. If so, they should be deleted on existing systems
via update.sh as well.
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
This was introduced in b1c25d7a84, and
subsequently broke the nightly builds, and I failed to spot this in the
first place. :-/
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
It is not necessary to have this key present on IPFire systems anymore,
since it has not been in use for years, and we can expect systems to be
sufficiently up-to-date, so they no longer need to rely on old updates
or add-ons signed with this key.
Also, given the current key was generated in 2018, we should consider a
Pakfire key rollover soon.
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Acked-by: Michael Tremer <michael.tremer@ipfire.org>
- In sysvinit-2.97 (Dec2020) a patch was added which allows init to load configuration data
from files stored in /etc/inittab.d/
This modification would have come in with Core Update 155.
- When sysvinit was updated from 2.88dsf to 2.98 the /etc/inittab.d/ directory in the
rootfile was commented out.
Sysvinit looks to see if there are any files in inittab.d but as that directory does not
exist then the message "No inittab.d directory found" is written during the boot and is
also shown in the log summary.
- This patch uncomments the directory so that it will be present. No files will be placed
in it but its prescence will stop the error message being shown during boot.
Fixes: Bug #12797
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
This script appeared in the rootfiles for Core Updates 65 and 66, being
released in late 2012 and early 2013. It is not used elsewhere, and
there is no sense in keeping it around on IPFire installations.
Should this patch be accepted, a corresponding 'rm' statement is
necessary in the update.sh script of the Core Update it will go into.
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Reviewed-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
OpenSSL Security Advisory [15 March 2022]
============================================
Infinite loop in BN_mod_sqrt() reachable when parsing certificates
(CVE-2022-0778)
==================================================================================
Severity: High
The BN_mod_sqrt() function, which computes a modular square root,
contains
a bug that can cause it to loop forever for non-prime moduli.
Internally this function is used when parsing certificates that contain
elliptic curve public keys in compressed form or explicit elliptic curve
parameters with a base point encoded in compressed form.
It is possible to trigger the infinite loop by crafting a certificate
that
has invalid explicit curve parameters.
Since certificate parsing happens prior to verification of the
certificate
signature, any process that parses an externally supplied certificate
may thus
be subject to a denial of service attack. The infinite loop can also be
reached when parsing crafted private keys as they can contain explicit
elliptic curve parameters.
Thus vulnerable situations include:
- TLS clients consuming server certificates
- TLS servers consuming client certificates
- Hosting providers taking certificates or private keys from customers
- Certificate authorities parsing certification requests from
subscribers
- Anything else which parses ASN.1 elliptic curve parameters
Also any other applications that use the BN_mod_sqrt() where the
attacker
can control the parameter values are vulnerable to this DoS issue.
In the OpenSSL 1.0.2 version the public key is not parsed during initial
parsing of the certificate which makes it slightly harder to trigger
the infinite loop. However any operation which requires the public key
from the certificate will trigger the infinite loop. In particular the
attacker can use a self-signed certificate to trigger the loop during
verification of the certificate signature.
This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was
addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022.
OpenSSL 1.0.2 users should upgrade to 1.0.2zd (premium support customers
only)
OpenSSL 1.1.1 users should upgrade to 1.1.1n
OpenSSL 3.0 users should upgrade to 3.0.2
This issue was reported to OpenSSL on the 24th February 2022 by Tavis
Ormandy
from Google. The fix was developed by David Benjamin from Google and
Tomáš Mráz
from OpenSSL.
Note
====
OpenSSL 1.0.2 is out of support and no longer receiving public updates.
Extended
support is available for premium support customers:
https://www.openssl.org/support/contracts.html
OpenSSL 1.1.0 is out of support and no longer receiving updates of any
kind.
It is affected by the issue.
Users of these versions should upgrade to OpenSSL 3.0 or 1.1.1.
References
==========
URL for this Security Advisory:
https://www.openssl.org/news/secadv/20220315.txt
Note: the online version of the advisory may be updated with additional
details
over time.
For details of OpenSSL severity classifications please see:
https://www.openssl.org/policies/secpolicy.html
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
This file contains our custom settings:
* Always load microcodes as early as possible
* We now compress the initrd using Zstandard which is substanstically
faster than XZ, but offers better compression ratios
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
To solve the behavior discribed in bug 12404 I added the path
/var/ipfire/cups to the backup.
Signed-off-by: Daniel Weismueller <daniel.weismueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from 1.50.0 to 1.50.4
- Update of rootfile
- Changelog
Overview of changes in 1.50.4, 09-02-2022
* Tweak synthetic space sizes
* itemize: Try harder to avoid NULL fonts
* docs: Some additions
* Pass synthetic slant to harfbuzz
* Make sloped carets work with uneven scales
* Fix serialiation on arm
* Avoid an uninitialized variable warning
* Reinstate previous behavior of pango_attr_list_splice
* Deprecated pango_coverage_ref/unref
* Fix serialization on non-glibc systems
* Fix allow-breaks handling
Overview of changes in 1.50.3, 21-12-2021
* pango-view: Add --serialize-to option for easy bug reporting
* Revert a transformation change that broke metrics for vertical text
* Handle fonts without space glyph (such as icon fonts) better
* Fix some corner cases of line width accounting
* Fix line height with emulated Small Caps
Overview of changes in 1.50.2, 16-12-2021
* Fix a problem with font fallback for Arabic
* Fix handling of fonts without a space glyph
* Various documentation improvements
* Fix build issues
Overview of changes in 1.50.1, 10-12-2021
* Fix a crash in tab handling
* Fix tab positioning without line wrapping
* Fix an assertion failure found by fuzzing
* Make underlines work again for broken fonts
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from 3.21.6 to 3.22.2
- Update of rootfile
- Changelog
HPLIP 3.22.2 - This release has the following changes:
Added support for following new Distro's:
Elementary OS 6.1
RHEL 8.5
Linux Mint 20.3
Added support for the following new Printers:
HP LaserJet Tank MFP 1602a
HP LaserJet Tank MFP 1602w
HP LaserJet Tank MFP 1604w
HP LaserJet Tank MFP 2602dn
HP LaserJet Tank MFP 2602sdn
HP LaserJet Tank MFP 2602sdw
HP LaserJet Tank MFP 2602dw
HP LaserJet Tank MFP 2604dw
HP LaserJet Tank MFP 2604sdw
HP LaserJet Tank MFP 2603dw
HP LaserJet Tank MFP 2603sdw
HP LaserJet Tank MFP 2605sdw
HP LaserJet Tank MFP 2606dn
HP LaserJet Tank MFP 2606sdn
HP LaserJet Tank MFP 2606sdw
HP LaserJet Tank MFP 2606dw
HP LaserJet Tank MFP 2606dc
HP LaserJet Tank MFP 1005
HP LaserJet Tank MFP 1005w
HP LaserJet Tank MFP 1005nw
HP LaserJet Tank 1502a
HP LaserJet Tank 1502w
HP LaserJet Tank 1504w
HP LaserJet Tank 2502dw
HP LaserJet Tank 2502dn
HP LaserJet Tank 2504dw
HP LaserJet Tank 2503dw
HP LaserJet Tank 2506dw
HP LaserJet Tank 2506d
HP LaserJet Tank 2506dn
HP LaserJet Tank 1020
HP LaserJet Tank 1020w
HP LaserJet Tank 1020nw
HPLIP 3.21.12- This release has the following changes:
Added support for following new Distro's:
MX Linux 21
Elementary OS 6
Fedora 35
HPLIP 3.21.10 - This release has the following changes:
Added support for following new Distro's:
Ubuntu 21.10
Debian 11
Zorin 15
Zorin 16
Added support for the following new Printers:
HP ENVY Inspire 7200e series
HP ENVY Inspire 7900e series
HP LaserJet MFP M140a
HP LaserJet MFP M139a
HP LaserJet MFP M141a
HP LaserJet MFP M142a
HP LaserJet MFP M140w
HP LaserJet MFP M140we
HP LaserJet MFP M139w
HP LaserJet MFP M139we
HP LaserJet MFP M141w
HP LaserJet MFP M141we
HP LaserJet MFP M142we
HP LaserJet MFP M142w
HP LaserJet M109a
HP LaserJet M110a
HP LaserJet M111a
HP LaserJet M112a
HP LaserJet M109w
HP LaserJet M109we
HP LaserJet M110w
HP LaserJet M110we
HP LaserJet M111w
HP LaserJet M111we
HP LaserJet M112we
HP LaserJet M112w
HP DesignJet Z6 Pro 64in
HP DesignJet Z9 Pro 64in
HP PageWide XL Pro 5200 PS MFP series
HP PageWide XL Pro 8200 PS MFP series
HP PageWide XL 3920 MFP
HP PageWide XL 4200 Printer
HP PageWide XL 4200 Multifunction Printer
HP PageWide XL 4700 Printer
HP PageWide XL 4700 Multifunction Printer
HP PageWide XL 5200 Printer
HP PageWide XL 5200 Multifunction Printer
HP PageWide XL 8200 Printer
HPLIP 3.21.8 - This release has the following changes:
Added support for following new Distro's:
Linux Mint 20.2
RHEL 8.4
Manjaro 21.0.7
Added support for the following new Printers:
HP Smart Tank 500 series
HP Smart Tank 530 series
HP Smart Tank Plus 570 series
HP Smart Tank 7600
HP Smart Tank 750
HP Smart Tank 790
HP Smart Tank Plus 710-720
HP Smart Tank Plus 7000
HP Smart Tank Plus 660-670
HP Smart Tank Plus 6000
HP DeskJet Ink Advantage Ultra 4800 All-in-One Printer series
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from 1.18.188 to 1.22.64
- Update of rootfile
- Ran aws in shell and got help response so it is working in principle
- Changelog is too large, with nearly 1700 lines, to include here as there appears to be
a new release nearly every day. so there are a huge number of releases between 1.18.188
from Dec 2nd 2020 to 1.22.64 from Feb 28 2022. It appears that only at weekends no
releases are done. Full changelog can be viewed at
https://github.com/aws/aws-cli/blob/develop/CHANGELOG.rst
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from 2017.3.23 to 2021.8.22
- Update of rootfile
- Added link to mkfs.ntfs in lfs to provide the binary in sbin as the new package places it
in usr/sbin
- Ran find-dependencies and no problems flagged up.
- Changelog
Stable Version 2021.8.22 (August 30, 2021)
Fixed compile error when building with libfuse < 2.8.0
Fixed obsolete macros in configure.ac
Signalled support of UTIME_OMIT to external libfuse2
Fixed an improper macro usage in ntfscp.c
Updated the repository change in the README
Fixed vulnerability threats caused by maliciously tampered NTFS partitions
Stable Version 2017.3.23AR.6 (February 1, 2021)
Used kernel cacheing on read-only mounts or with lowntfs-3g
Avoided information leak when processing garbled compressed data
Defined option posix_nlink to compute a Posix compliant st_nlink
Recovered space when an index root is shortened
Replaced ENODATA with ENOATTR in xattrs functions for macOS
Added support for 'position' argument in macOS xattr functions
Changed default xattr access method to 'openxattr' for macOS builds
Allowed redefining the target location of the ntfsprogs tools
Fixed updating the allocated size when attribute lies in an extent
Enabled actions on directories in reparse plugins
Inserted the reparse tag in the bad reparse symlink
Supported use of WSL special files
Dropped rejecting having both EA and reparse data
Enabled Creating special files the same way as WSL
Checked the locations of MFT and MFTMirr at startup
Stable Version 2017.3.23AR.5 (April 1, 2020)
Processed the request argument of ioctl() as unsigned
Accepted alternative recording of cluster size
Fixed a poorly sized string in ntfsinfo
Fixed ntfsfallocate on a void file
Decoded execlink reparse points
Fixed object type returned in readdir() for reparse points
Exported the translations of Windows paths to current ones
Stable Version 2017.3.23AR.4 (March 1, 2019)
Fixed reporting an error when failed to build the mountpoint
Reverted accessing reparse directory through internal plugins
Cleaned object ids beyond the updated part
Fixed reacting to missing plugin
Returned a low level error when an ioctl fails
Truncated SSD trimming zones to granularity supported by the device
Stable Version 2017.3.23AR.3 (September 1, 2018)
Made sure log file buffers are properly aligned
Made reparse directories visible through internal plugins
Added an option to ntfscp to copy the modification time
Renamed undeleted files to avoid overwriting existing ones
Extended the allowed cluster size to 2MB
Allocated full clusters for reading and rescuing in ntfsclone
Prevented locally defined headers from interfering with ntfs-3g ones
Attempted mounting read-only after failed permission to read-write
Fixed collecting the label argument in mkntfs
Stable Version 2017.3.23AR.2 (March 1, 2018)
Made sure log file buffers are properly aligned
Checked log file blocks more recent than temporary ones
Processed redo log actions associated to undoing a CompensationlogRecord
Allowed setting a file object id without defining its birth ids
Documented read-only mount when Windows is hibernated
Stopped checking matches of MFTMirr against MFT at record 16
Filtered out reparse flags for selecting plugins
Delayed updating the MFT runlist when resizing in read-only mode
Double-checked whether record 15 is an extent of MFT
Checked whether the device to mount was forced read-only
Stable Version 2017.3.23AR.1 (October 1, 2017)
Bypassed cluster allocation errors using --ignore-fs-check in ntfsclone
Upgraded ntfsrecover to support log files for Windows 10
Fixed the computation of highest_vcn when applying a runlist fixup
Fixed updating the vcn of subtree in ntfsrecover
Relaxed checks on security descriptors
Enabled directory operations in plugins
Decoded more reparse tags in ntfsinfo
Logged falling back to mounting read-only
Fixed compiling on MacOSX (Erik Larsson)
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from 1.11 (2005) to 1.14 (2020)
- Update of rootfile
- find-dependencies run and no problems flagged
- Package was originally provided by Dug Song in source forge and with a github repository
No response was received from Dug Song to requests for updates and fixes so Oliver Falk
forked the repository and has been working on it and now the Dug Song repository is no
longer present and the old repoistory url redirects to the new ofalk repository
https://github.com/ofalk/libdnet
- Issues raised in this new repository are being actively responded to
- Changelog comment is
Finally release 1.14 with latest fixes included.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
