* update wget to 1.25.0-1
This commit is contained in:
parent
a1054e8ed5
commit
4e3e65e4bb
@ -1,9 +1,13 @@
|
||||
pkgbase = wget
|
||||
pkgdesc = Network utility to retrieve files from the Web
|
||||
pkgver = 1.24.5
|
||||
pkgrel = 3
|
||||
pkgver = 1.25.0
|
||||
pkgrel = 1
|
||||
url = https://www.gnu.org/software/wget/wget.html
|
||||
arch = x86_64
|
||||
arch = powerpc64le
|
||||
arch = powerpc64
|
||||
arch = powerpc
|
||||
arch = riscv64
|
||||
license = GPL3
|
||||
checkdepends = perl-http-daemon
|
||||
checkdepends = perl-io-socket-ssl
|
||||
@ -22,17 +26,14 @@ pkgbase = wget
|
||||
depends = libnettle.so
|
||||
optdepends = ca-certificates: HTTPS downloads
|
||||
backup = etc/wgetrc
|
||||
source = https://ftp.gnu.org/gnu/wget/wget-1.24.5.tar.lz
|
||||
source = https://ftp.gnu.org/gnu/wget/wget-1.24.5.tar.lz.sig
|
||||
source = CVE-2024-38428.patch
|
||||
source = https://ftp.gnu.org/gnu/wget/wget-1.25.0.tar.lz
|
||||
source = https://ftp.gnu.org/gnu/wget/wget-1.25.0.tar.lz.sig
|
||||
validpgpkeys = AC404C1C0BF735C63FF4D562263D6DF2E163E1EA
|
||||
validpgpkeys = 7845120B07CBD8D6ECE5FF2B2A1743EDA91A35B6
|
||||
validpgpkeys = 1CB27DBC98614B2D5841646D08302DB6A2670428
|
||||
sha256sums = 57a107151e4ef94fdf94affecfac598963f372f13293ed9c74032105390b36ee
|
||||
sha256sums = 19225cc756b0a088fc81148dc6a40a0c8f329af7fd8483f1c7b2fe50f4e08a1f
|
||||
sha256sums = SKIP
|
||||
sha256sums = 9da45c5d34163fe0c0cc8d75402b2d1e6a752b794e52187da5d9141b825db24f
|
||||
b2sums = 8057e5992ddaf39b3daffbde99871ddec1328c6bbafbc6b9f1d3cd294bb928b2a80f813024d4cd664c396f84477f1d93d5a21c60c6fe2932f9196d29bb9aa896
|
||||
b2sums = 58edd7393b5109804d7a6ce77466d30e1fba3c5ae4b5b8634758c9ebd7fa95cf106d35ad0b4f9151833d88b0221fc488a1005ec0b98417766bf2092309744954
|
||||
b2sums = SKIP
|
||||
b2sums = fb0cf748b4f5aa34e0b43cc7c010e8f95324433fb3298365065708f8d092ab63c57f778fc1bfa17a121c651a6cd3296331992c5abe3958c368d523d11b3db067
|
||||
|
||||
pkgname = wget
|
||||
|
||||
@ -1,4 +1,4 @@
|
||||
[wget]
|
||||
source = "git"
|
||||
git = "https://git.savannah.gnu.org/git/wget.git"
|
||||
git = "https://gitlab.com/gnuwget/wget.git"
|
||||
prefix = "v"
|
||||
|
||||
@ -1,75 +0,0 @@
|
||||
From ed0c7c7e0e8f7298352646b2fd6e06a11e242ace Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Tim=20R=C3=BChsen?= <tim.ruehsen@gmx.de>
|
||||
Date: Sun, 2 Jun 2024 12:40:16 +0200
|
||||
Subject: Properly re-implement userinfo parsing (rfc2396)
|
||||
|
||||
* src/url.c (url_skip_credentials): Properly re-implement userinfo parsing (rfc2396)
|
||||
|
||||
The reason why the implementation is based on RFC 2396, an outdated standard,
|
||||
is that the whole file is based on that RFC, and mixing standard here might be
|
||||
dangerous.
|
||||
---
|
||||
src/url.c | 40 ++++++++++++++++++++++++++++++++++------
|
||||
1 file changed, 34 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/src/url.c b/src/url.c
|
||||
index 69e948b..07c3bc8 100644
|
||||
--- a/src/url.c
|
||||
+++ b/src/url.c
|
||||
@@ -41,6 +41,7 @@ as that of the covered work. */
|
||||
#include "url.h"
|
||||
#include "host.h" /* for is_valid_ipv6_address */
|
||||
#include "c-strcase.h"
|
||||
+#include "c-ctype.h"
|
||||
|
||||
#ifdef HAVE_ICONV
|
||||
# include <iconv.h>
|
||||
@@ -526,12 +527,39 @@ scheme_leading_string (enum url_scheme scheme)
|
||||
static const char *
|
||||
url_skip_credentials (const char *url)
|
||||
{
|
||||
- /* Look for '@' that comes before terminators, such as '/', '?',
|
||||
- '#', or ';'. */
|
||||
- const char *p = (const char *)strpbrk (url, "@/?#;");
|
||||
- if (!p || *p != '@')
|
||||
- return url;
|
||||
- return p + 1;
|
||||
+ /*
|
||||
+ * This whole file implements https://www.rfc-editor.org/rfc/rfc2396 .
|
||||
+ * RFC 2396 is outdated since 2005 and needs a rewrite or a thorough re-visit.
|
||||
+ *
|
||||
+ * The RFC says
|
||||
+ * server = [ [ userinfo "@" ] hostport ]
|
||||
+ * userinfo = *( unreserved | escaped | ";" | ":" | "&" | "=" | "+" | "$" | "," )
|
||||
+ * unreserved = alphanum | mark
|
||||
+ * mark = "-" | "_" | "." | "!" | "~" | "*" | "'" | "(" | ")"
|
||||
+ */
|
||||
+ static const char *allowed = "-_.!~*'();:&=+$,";
|
||||
+
|
||||
+ for (const char *p = url; *p; p++)
|
||||
+ {
|
||||
+ if (c_isalnum(*p))
|
||||
+ continue;
|
||||
+
|
||||
+ if (strchr(allowed, *p))
|
||||
+ continue;
|
||||
+
|
||||
+ if (*p == '%' && c_isxdigit(p[1]) && c_isxdigit(p[2]))
|
||||
+ {
|
||||
+ p += 2;
|
||||
+ continue;
|
||||
+ }
|
||||
+
|
||||
+ if (*p == '@')
|
||||
+ return p + 1;
|
||||
+
|
||||
+ break;
|
||||
+ }
|
||||
+
|
||||
+ return url;
|
||||
}
|
||||
|
||||
/* Parse credentials contained in [BEG, END). The region is expected
|
||||
--
|
||||
cgit v1.1
|
||||
|
||||
@ -4,8 +4,8 @@
|
||||
# Contributor: Eric Bélanger <eric@archlinux.org>
|
||||
|
||||
pkgname=wget
|
||||
pkgver=1.24.5
|
||||
pkgrel=3.1
|
||||
pkgver=1.25.0
|
||||
pkgrel=1
|
||||
pkgdesc='Network utility to retrieve files from the Web'
|
||||
url='https://www.gnu.org/software/wget/wget.html'
|
||||
arch=(x86_64 powerpc64le powerpc64 powerpc riscv64)
|
||||
@ -15,14 +15,11 @@ depends=('glibc' 'zlib' 'gnutls' 'libidn2' 'libidn2.so' 'util-linux-libs' 'libuu
|
||||
checkdepends=('perl-http-daemon' 'perl-io-socket-ssl' 'python')
|
||||
optdepends=('ca-certificates: HTTPS downloads')
|
||||
backup=('etc/wgetrc')
|
||||
source=(https://ftp.gnu.org/gnu/${pkgname}/${pkgname}-${pkgver}.tar.lz{,.sig}
|
||||
CVE-2024-38428.patch)
|
||||
sha256sums=('57a107151e4ef94fdf94affecfac598963f372f13293ed9c74032105390b36ee'
|
||||
'SKIP'
|
||||
'9da45c5d34163fe0c0cc8d75402b2d1e6a752b794e52187da5d9141b825db24f')
|
||||
b2sums=('8057e5992ddaf39b3daffbde99871ddec1328c6bbafbc6b9f1d3cd294bb928b2a80f813024d4cd664c396f84477f1d93d5a21c60c6fe2932f9196d29bb9aa896'
|
||||
'SKIP'
|
||||
'fb0cf748b4f5aa34e0b43cc7c010e8f95324433fb3298365065708f8d092ab63c57f778fc1bfa17a121c651a6cd3296331992c5abe3958c368d523d11b3db067')
|
||||
source=(https://ftp.gnu.org/gnu/${pkgname}/${pkgname}-${pkgver}.tar.lz{,.sig})
|
||||
sha256sums=('19225cc756b0a088fc81148dc6a40a0c8f329af7fd8483f1c7b2fe50f4e08a1f'
|
||||
'SKIP')
|
||||
b2sums=('58edd7393b5109804d7a6ce77466d30e1fba3c5ae4b5b8634758c9ebd7fa95cf106d35ad0b4f9151833d88b0221fc488a1005ec0b98417766bf2092309744954'
|
||||
'SKIP')
|
||||
validpgpkeys=(
|
||||
'AC404C1C0BF735C63FF4D562263D6DF2E163E1EA' # Giuseppe Scrivano <gscrivano@gnu.org>
|
||||
'7845120B07CBD8D6ECE5FF2B2A1743EDA91A35B6' # Darshit Shah <darnir@gnu.org>
|
||||
@ -31,7 +28,6 @@ validpgpkeys=(
|
||||
|
||||
prepare() {
|
||||
cd ${pkgname}-${pkgver}
|
||||
patch -Np1 -i ../CVE-2024-38428.patch
|
||||
cat >> doc/sample.wgetrc <<EOF
|
||||
|
||||
# default root certs location
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user