Please log in first.

Clear message

    PaulHowarth/Blog/2022-04

Paul's Blog Entries for April 2022

Friday 1st April 2022

Fedora Project

  • Updated perl-Perl-PrereqScanner-NotQuiteLite to 0.9915 in F-36 and Rawhide:

    • Add 'optional' option

Local Packages

  • Updated perl-Perl-PrereqScanner-NotQuiteLite to 0.9915 as per the Fedora version

Sunday 3rd April 2022

Fedora Project

  • Updated perl-PPIx-QuoteLike to 0.021 in Rawhide:

    • Recognize postfix deref in '@{[ ... ]}' for determining minimum Perl version; this recognizes all forms of postfix dereference, including ->%*, ->&*, and ->** (NOTE: for now, this remains a PPIx::QuoteLike::Token::Interpolation)

    • Require PPI 1.238 for postfix deref support, and prune code that dealt with PPI's old behaviour

    • Postfix %*, &*, and ** do not interpolate

    • Correct perl_version_introduced() for interpolated postfix scalar deref

Local Packages

  • Updated perl-PPIx-QuoteLike to 0.021 as per the Fedora version

  • Updated perl-PPIx-Regexp to 0.084:

    • Require PPI 1.238 for postfix deref support, and recode the postfix deref logic in terms of 1.238's functionality

    • Parse '@{[ ... ]}' as code, not interpolation; this is more in line with what it actually represents, and allows correct versioning of postfix dereferences (but it is an incompatible change)

Monday 4th April 2022

Fedora Project

  • Updated perl-Compress-Raw-Lzma to 2.103 in Rawhide (no changes)

Local Packages

  • Updated perl-Compress-Raw-Bzip2 to 2.103:

    • Silence uninitialized warnings (GH#5)

  • Updated perl-Compress-Raw-Lzma to 2.103 as per the Fedora version

  • Updated perl-Compress-Raw-Zlib to 2.103:

  • I updated the packaging to use the bundled zlib if the system zlib is not 1.2.12 or later; as of this time, it still has not been updated in Fedora (Bug #2068066)

  • Updated perl-IO-Compress to 2.103:

    • Fix for inflateSyncs return code change

    • Add constant for ZIP_CM_AES

    • Point links to rfcs to ietf.org (GH#37)

    • Rename test file to fix manifest warning (GH#36)

    • Add perl 5.34 to CI

    • Fix for calling nextStream on an IO::Uncompress::Zip object in Transparent mode dies when input is uncompressed (GH#34)

    • IO::Compress: Generalize for EBCDIC (GH#32)

    • IO::Compress: Fix misspelling in 112utf8-zip.t

    • Update cpanm path on MacOS

  • Updated perl-IO-Compress-Lzma to 2.103 (no changes)

Friday 8th April 2022

Fedora Project

Local Packages

  • New package perl-Parse-Distname (0.05)

  • Updated libgpg-error to 1.45 (https://dev.gnupg.org/T5802)

    • Support the "sysopen" mode parameter for gpgrt_fopen so that file names longer than MAX_PATH can be supported under Windows

    • gpgrt_access and gpgrt_mkdir now support file names longer than MAX_PATH

    • gpgrt_fopen now maps "/dev/null" to "nul" on Windows

    • Published some internal helper functions for Windows

    • New symbols: gpgrt_free_wchar, gpgrt_fname_to_wchar, gpgrt_utf8_to_wchar, gpgrt_wchar_to_utf8

  • Updated perl-DateTime-Locale to 1.34:

    • Rebuilt all locale data with the data from CLDR 41.0.0

  • Updated perl-Perl-PrereqScanner-NotQuiteLite to 0.9916:

    • Ignore core modules with undef version correctly

    • Drop URI::cpan dependency and use Parse::Distname to parse cpan URI

Saturday 9th April 2022

Local Packages

Sunday 10th April 2022

Football

Local Packages

  • Updated perl-IO-Compress to 2.105:

    • Remove WeakDecrypt

  • Updated perl-XML-LibXSLT to 2.000000:

    • Add lib/XML/LibXSLT/Quick.pm

    • Clean-ups

Monday 11th April 2022

Fedora Project

  • Updated perl-JSON-PP to 4.08 in Rawhide:

    • Remove unneeded utf8::upgrade and downgrade (GH#59)

    • Core boolean support (GH#62, GH#63)

    • EBCDIC support (GH#64)

    • Shorten a test name (GH#65)

Local Packages

  • Updated perl-JSON-PP to 4.08 as per the Fedora version

Tuesday 12th April 2022

Fedora Project

  • Updated perl-Config-General to 2.65 in Rawhide:

  • Updated perl-Math-Pari to 2.030523 (see Changes for details)

  • Retired perl-Crypt-RSA from Rawhide

  • The perl-Crypt-RSA package was introduced in Fedora as part of the dependency chain for perl-Net-SSH-Perl. That package has since moved to using perl-CryptX instead so there is nothing left in Fedora that depends on perl-Crypt-RSA.

  • The last release of Crypt-RSA was in 2009. Dana Jacobsen created an alternative implementation (https://metacpan.org/dist/Alt-Crypt-RSA-BigInt) that avoided the need for Math::Pari, which would be a big win itself due to the difficulty in packaging that module, but that implementation doesn't look to have gained any traction.

  • I am therefore retiring the perl-Crypt-RSA package, along with some other packages that are only used as part of the dependency tree for perl-Crypt-RSA:

    • perl-Crypt-Primes

    • perl-Crypt-Random

    • perl-Math-Pari

    • libpari23

Wednesday 13th April 2022

Local Packages

Thursday 14th April 2022

Fedora Project

  • Retired perl-Crypt-Primes, perl-Crypt-Random, perl-Math-Pari and libpari23 from Rawhide

Saturday 16th April 2022

Fedora Project

  • Updated perl-PPIx-QuoteLike to 0.022 in Rawhide:

    • Remove 'postderef' argument to new(); postfix dereference is always recognized

Local Packages

  • Updated perl-PPIx-QuoteLike to 0.022 as per the Fedora version

Monday 18th April 2022

Local Packages

  • Updated perl-PPIx-Regexp to 0.085:

    • Remove 'postderef' argument to PPIx::Regexp->new(); postfix dereference is always recognized

  • Updated perl-Test-Harness to 3.44:

    • Let the aggregator finish gracefully after bailout

    • Make prove respect HARNESS_VERBOSE if no verbosity flags are passed

    • Move timer initialization
    • Fix YAMLish behaviour with empty values

    • Fix eintr error handling in TAP::Parser::Multiplexer

    • Parse out signal name and core dump
    • Remove ASCII-isms to better work on EBCDIC

    • Fix failing SEGV test on Windows

    • Fix skipping SEGV test

  • Updated xz (5.2.5) to fix arbitrary-file-write vulnerability in xzgrep (Bug #2073310, CVE-2022-1271)

Tuesday 19th April 2022

Fedora Project

  • Updated perl-DateTime to 1.58 in Rawhide:

    • Fixed tests so that they ignore the value set in the 'PERL_DATETIME_DEFAULT_TZ' environment variable, if one exists (GH#128)

Local Packages

  • Updated perl-DateTime to 1.58 as per the Fedora version

Thursday 21st April 2022

Local Packages

  • Rebuilt libmetalink (0.1.3) to sync with Rawhide

  • Updated perl-Module-CoreList to 5.20220420:

    • Updated for v5.35.11

Monday 25th April 2022

Fedora Project

  • Updated perl-IO-Compress-Lzma to 2.103 in Rawhide (no changes)

  • Updated perl-PPI to 1.273 in Rawhide:

    • Whitespace in signatures is now preserved (GH#257)

  • Updated proftpd to 1.3.7d in F-34, F-35, F-36 and Rawhide:

    • Fix crash with long lines in AuthGroupFile due to large realloc(3) (GH#1321)

    • NLST did not behave consistently for relative paths (GH#1325)

    • Implement AllowForeignAddress class matching for passive data transfers (GH#1346)

    • DeleteAbortedStores removed successfully transferred files unexpectedly (Bug #4467)

    • Keepalive socket options should be set using IPPROTO_TCP, not SOL_SOCKET (GH#1401)

    • TCP keepalive SocketOptions should apply to control as well as data connection (GH#1402)

    • ProFTPD always used the same PassivePorts port for first transfer (GH#1396)

    • Name-based virtual hosts not working as expected after upgrade from 1.3.7a to 1.3.7b (GH#1369)

  • Updated proftpd to 1.3.8rc3 in EPEL-9:

    • Support SSH hostkey rotation via OpenSSH extensions (GH#1323)

    • NLST did not behave consistently for relative paths (GH#1325)

    • Support AES Galois Counter Mode (AES-GCM) in SSH; support for the "aes128-gcm@openssh.com" and "aes256-gcm@openssh.com" ciphers has been added to mod_sftp (Bug #3759)

    • Implement an LDAPConnectTimeout directive, to configure the timeout used when connecting to LDAP servers (GH#1333)

    • Implement OpenSSH "Encrypt-Then-MAC" (ETM) algorithm extensions (GH#1330)

    • Implement AllowForeignAddress class matching for passive data transfers (GH#1346)

    • Implement support for PCRE2 (GH#1353)

    • ProFTPD wouldn't start with several locales (Bug #4466)

    • Auth sources providing space-bearing user/group names caused compliance issues with MLSD/MLST responses (GH#1367)

    • DeleteAbortedStores removed successfully transferred files unexpectedly (Bug #4467)

    • Omit EPRT/EPSV from FEAT response when denied by <Limit> configuration (GH#1383)

    • Support uploading to symlinked files (GH#1379)

    • Keepalive socket options should be set using IPPROTO_TCP, not SOL_SOCKET (GH#1401)

    • TCP keepalive SocketOptions should apply to control as well as data connection (GH#1402)

    • ProFTPD always used the same PassivePorts port for first transfer (GH#1396)

    • mod_sftp needs to handle unknown SSH messages in an RFC-compliant manner, ignoring rather than disconnecting (GH#1410)

    • Improve handling of some globally applied configuration directives (GH#1418)

    • Name-based virtual hosts not working as expected after upgrade from 1.3.7a to 1.3.7b (GH#1369)

Local Packages

  • Updated perl-DateTime-Locale to 1.35:

    • The code passed to DateTime::Locale->load is now validated and untainted before using it to load and eval data from the filesystem (based on GH#30)

  • Updated perl-PPI to 1.273 as per the Fedora version

  • Updated proftpd to 1.3.7d as per the Fedora version

  • Updated proftpd to 1.3.8rc3 as per the EPEL-9 version

Tuesday 26th April 2022

Fedora Project

  • Took ownership of mcrcon and updated it to 0.7.2 in Rawhide

    • Set default address to localhost

    • Add -w option for rcon command throttling

    • Deprecate -i flag for invoking terminal mode

    • Add workaround to prevent server-side bug (https://bugs.mojang.com/browse/MC-154617)

    • Quit gracefully when Ctrl-D or Ctrl+C is pressed

    • Remove "exit" and "quit" as quitting commands (these are actual rcon commands on some servers)

    • Suppress compiler warning (strncpy)

    • Fix erroneous string length in packet building function
    • Fix typo in ANSI escape sequence for LCYAN

    • Make stdout and stderr unbuffered

  • Updated python-paramiko to 2.10.4 in F-34, F-35, F-36 and Rawhide:

    • Update 'camelCase' method calls against the 'threading' module to be 'snake_case'; this and related tweaks should fix some deprecation warnings under Python 3.10 (GH#1838, GH#1870, GH#2028)

    • '~paramiko.pkey.PKey' instances' '__eq__' did not have the usual safety guard in place to ensure they were being compared to another 'PKey' object, causing occasional spurious 'BadHostKeyException', among other things (GH#1964, GH#2023, GH#2024)

    • Servers offering certificate variants of hostkey algorithms (e.g. 'ssh-rsa-cert-v01@openssh.com') could not have their host keys verified by Paramiko clients, as it only ever considered non-cert key types for that part of connection handshaking (GH#2035)

Local Packages

  • Updated mcrcon (0.7.2) to use distribution LDFLAGS as well as CFLAGS

Wednesday 27th April 2022

Local Packages

  • Updated curl to 7.83.0:

    • curl: Add %header{name} experimental support in -w handling

    • curl: Add %{header_json} experimental support in -w handling

    • curl: Add --no-clobber

    • curl: Add --remove-on-error

    • header api: Add curl_easy_header and curl_easy_nextheader

    • msh3: Add support for QUIC and HTTP/3 using msh3

    • appveyor: Add Cygwin build
    • appveyor: Only add MSYS2 to PATH where required

    • BearSSL: Add CURLOPT_SSL_CIPHER_LIST support

    • BearSSL: Add CURLOPT_SSL_CTX_FUNCTION support

    • BINDINGS.md: Add Hollywood binding

    • CI: Do not use buildconf; instead, just use: autoreconf -fi

    • CI: Install Python package impacket to run SMB test 1451

    • configure.ac: Move -pthread CFLAGS setting back where it used to be

    • configure: Bump the copyright year range in the generated output

    • conncache: Include the zone id in the "bundle" hashkey (CVE-2022-27775)

    • connecache: Remove duplicate connc->closure_handle check

    • connect: Make Curl_getconnectinfo work with conn cache from share handle

    • connect: Use TCP_KEEPALIVE only if TCP_KEEPIDLE is not defined

    • cookie.d: Clarify when cookies are sent

    • cookies: Improve error handling for reading cookiefile

    • curl/system.h: Update ifdef condition for MCST-LCC compiler

    • curl: Error out if -T and -d are used for the same URL

    • curl: Error out when options need features not present in libcurl

    • curl: Escape '?' in generated --libcurl code

    • curl: Fix segmentation fault for empty output file names

    • curl_easy_header: Fix typos in documentation

    • CURLINFO_PRIMARY_PORT.3: Clarify which port this is

    • CURLOPT*TLSAUTH.3: They only work with OpenSSL or GnuTLS

    • CURLOPT_DISALLOW_USERNAME_IN_URL.3: Use uppercase URL

    • CURLOPT_PREQUOTE.3: Only works for FTP file transfers, not dirs

    • CURLOPT_PROGRESSFUNCTION.3: Fix typo in example

    • CURLOPT_UNRESTRICTED_AUTH.3: Extended explanation

    • CURLSHOPT_UNLOCKFUNC.3: Fix the callback prototype

    • docs/HYPER.md: Updated to reflect current hyper build needs

    • docs/opts: Mention Schannel client cert type is P12

    • docs: Fix missing semicolon in example code
    • docs: Lots of minor language polish
    • English: Use American spelling consistently

    • fail.d: Tweak the description

    • firefox-db2pem.sh: Make the shell script safer

    • ftp: Fix error message for partial file upload

    • gen.pl: Change wording for mutexed options

    • GHA: Add openssl3 jobs moved over from Zuul
    • GHA: Build hyper with nightly rustc
    • GHA: Move bearssl jobs over from Zuul
    • GHA: Move the event-based test over from Zuul
    • gtls: Fix build for disabled TLS-SRP

    • http2: Handle DONE called for the paused stream

    • http2: RST the stream if we stop it on our own will

    • http: Avoid auth/cookie on redirects same host diff port (CVE-2022-27776)

    • http: Close the stream (not connection) on time condition abort
    • http: Reject header contents with nul bytes
    • http: Return error on colon-less HTTP headers
    • http: streamclose "already downloaded"

    • hyper: Fix status_line() return code

    • hyper: Fix tests 580 and 581 for hyper
    • hyper: No h2c support
    • infof: Consistent capitalization of warning messages

    • ipv4/6.d: Clarify that they are about using IP addresses

    • json.d: Fix typo (overriden → overridden)

    • keepalive-time.d: It takes many probes to detect brokenness

    • lib/warnless.[ch]: Only check for WIN32 and ignore _WIN32

    • lib670: Avoid double check result

    • lib: #ifdef on USE_HTTP2 better

    • lib: Fix some misuse of curlx_convert_wchar_to_UTF8

    • lib: Remove exclamation marks
    • libssh2: Compare sha256 strings case sensitively
    • libssh2: Make the md5 comparison fail if wrong length
    • libssh: Fix build with old libssh versions
    • libssh: Fix double close

    • libssh: Improve fix for missing SSH_S_ stat macros

    • libssh: Unstick SFTP transfers when done event-based

    • macos: Set .plist version in autoconf

    • mbedtls: Remove 'protocols' array from backend when ALPN is not used

    • mbedtls: Remove server_fd from backend

    • mk-ca-bundle.pl: Use stricter logic to process the certificates

    • mk-ca-bundle.vbs: Delete this script in favor of mk-ca-bundle.pl

    • mlc_config.json: Add file to ignore known troublesome URLs

    • mqtt: Better handling of TCP disconnect mid-message
    • ngtcp2: Add client certificate authentication for OpenSSL

    • ngtcp2: Avoid busy loop in low CWND situation

    • ngtcp2: Deal with sub-millisecond timeout
    • ngtcp2: Disconnect the QUIC connection properly

    • ngtcp2: Enlarge H3_SEND_SIZE

    • ngtcp2: Fix HTTP/3 upload stall and avoid busy loop
    • ngtcp2: Fix memory leak

    • ngtcp2: Fix QUIC_IDLE_TIMEOUT

    • ngtcp2: Make curl 1ms faster

    • ngtcp2: Remove remote_addr, which is not used in a meaningful way

    • ngtcp2: Update to work after recent ngtcp2 updates

    • ngtcp2: Use token when detecting :status header field

    • nonblock: Restore setsockopt method to curlx_nonblock

    • openssl: Check SSL_get_peer_cert_chain return value

    • openssl: Enable CURLOPT_SSL_EC_CURVES with BoringSSL

    • openssl: Fix CN check error code
    • options: Remove mistaken space before paren in prototype
    • perl: Removed a double semicolon at end of line

    • pop3/smtp: return *WEIRD_SERVER_REPLY when not understood

    • projects/README: Converted to markdown

    • projects: Update VC version names for VS2017, VS2022

    • rtsp: Don't let CSeq error override earlier errors

    • runtests: Add 'bearssl' as testable feature
    • runtests: Make 'oldlibssh' be before 0.9.4
    • schannel: Remove dead code that will never run

    • scripts/copyright.pl: Ignore the new mlc_config.json file

    • scripts: Move three scripts from lib/ to scripts/

    • test1135: Sync with recent API updates

    • test1459: Disable for oldlibssh

    • test375: Fix line endings on Windows

    • test386: Fix an incorrect test markup tag

    • test718: Edited slightly to return better HTTP

    • tests/server/util.h: Align WIN32 condition with util.c

    • tests: Refactor server/socksd.c to support --unix-socket

    • timediff.[ch]: Add curlx helper functions for timeval conversions

    • tls: Make mbedtls and NSS check for h2, not nghttp2

    • tool and tests: Force flush of all buffers at end of program

    • tool_cb_hdr: Turn the Location: into a terminal hyperlink

    • tool_getparam: Error out on missing -K file

    • tool_listhelp.c: Uppercase URL

    • tool_operate: Fix a scan-build warning

    • tool_paramhlp: Use feof(3) to identify EOF correctly when using fread(3)

    • transfer: Redirects to other protocols or ports clear auth (CVE-2022-27774)

    • unit1620: Call global_init before calling Curl_open

    • url: Check sasl additional parameters for connection reuse (CVE-2022-22576)

    • vtls: Provide a unified ALPN-disagree string for all backends
    • vtls: Use a backend standard message for "ALPN: offers %s"
    • vtls: Use a generic "ALPN, server accepted" message

    • winbuild/README.md: Fix up dead link

    • winbuild: Add a Visual Studio example to the README

    • wolfssl: Fix compiler error without IPv6

  • Cleaned up and rebuilt demoroniser

  • Cleaned up and rebuilt plusnet-fttc

Thursday 28th April 2022

Local Packages

  • Updated perl-Parse-Distname (0.05) to incorporate feedback from package review (Bug #2073377)

Previous Month: March 2022
Next Month: May 2022

Recent