Skip to contentSkip to conversation

bind: 9.10..3-P3 -> 9.10.5-P3

PATCH In review [email protected] 3 participants 10 messages Jul 12, 2017 – Jul 21, 2017

lore
Share & tools
lore
#0 lore raw

cover bind: 9.10..3-P3 -> 9.10.5-P3

From: Kai Kang <[email protected]>

The following changes since commit 81498aac9560fbeaeb58eaada32ce80e0ea51628:

yocto-project-qs: Updated Next Steps list (2017-07-12 00:28:16 +0100)

are available in the git repository at:

git://git.pokylinux.org/poky-contrib kangkai/bind
http://git.pokylinux.org/cgit.cgi/poky-contrib/log/?h=kangkai/bind

Kai Kang (1):
bind: 9.10..3-P3 -> 9.10.5-P3

 ...0001-build-use-pkg-config-to-find-libxml2.patch |   10 +-
 .../bind/bind/CVE-2016-1285.patch                  |  154 ---
 .../bind/bind/CVE-2016-1286_1.patch                |   79 --
 .../bind/bind/CVE-2016-1286_2.patch                |  317 ------
 .../bind/bind/CVE-2016-2088.patch                  |  247 -----
 .../bind/bind/CVE-2016-2775.patch                  |   90 --
 .../bind/bind/CVE-2016-2776.patch                  |  123 ---
 .../bind/bind/CVE-2016-6170.patch                  | 1090 --------------------
 .../bind/bind/CVE-2016-8864.patch                  |  219 ----
 .../bind/bind/bind-confgen-build-unix.o-once.patch |   10 +-
 .../bind/bind/mips1-not-support-opcode.diff        |  104 --
 .../use-python3-and-fix-install-lib-path.patch     |   36 +
 .../bind/{bind_9.10.3-P3.bb => bind_9.10.5-P3.bb}  |   25 +-
 13 files changed, 61 insertions(+), 2443 deletions(-)
 delete mode 100644 meta/recipes-connectivity/bind/bind/CVE-2016-1285.patch
 delete mode 100644 meta/recipes-connectivity/bind/bind/CVE-2016-1286_1.patch
 delete mode 100644 meta/recipes-connectivity/bind/bind/CVE-2016-1286_2.patch
 delete mode 100644 meta/recipes-connectivity/bind/bind/CVE-2016-2088.patch
 delete mode 100644 meta/recipes-connectivity/bind/bind/CVE-2016-2775.patch
 delete mode 100644 meta/recipes-connectivity/bind/bind/CVE-2016-2776.patch
 delete mode 100644 meta/recipes-connectivity/bind/bind/CVE-2016-6170.patch
 delete mode 100644 meta/recipes-connectivity/bind/bind/CVE-2016-8864.patch
 delete mode 100644 meta/recipes-connectivity/bind/bind/mips1-not-support-opcode.diff
 create mode 100644 meta/recipes-connectivity/bind/bind/use-python3-and-fix-install-lib-path.patch
 rename meta/recipes-connectivity/bind/{bind_9.10.3-P3.bb => bind_9.10.5-P3.bb} (85%)
Signature · 1 line
2.10.1
#1 lore raw

PATCH 1/1 bind: 9.10..3-P3 -> 9.10.5-P3

From: Kai Kang <[email protected]>

Upgrade bind from 9.10.3-P3 to 9.10.5-P3

* Update md5sum of LIC_FILES_CHKSUM that it update year in file COPYRIGHT
* Remvoe mips1-not-support-opcode.diff which has been merged
* Remove CVE patches that there are backported from upstream
* Use python3 for build and make sure install .py files to right directory

---
 ...0001-build-use-pkg-config-to-find-libxml2.patch |   10 +-
 .../bind/bind/CVE-2016-1285.patch                  |  154 ---
 .../bind/bind/CVE-2016-1286_1.patch                |   79 --
 .../bind/bind/CVE-2016-1286_2.patch                |  317 ------
 .../bind/bind/CVE-2016-2088.patch                  |  247 -----
 .../bind/bind/CVE-2016-2775.patch                  |   90 --
 .../bind/bind/CVE-2016-2776.patch                  |  123 ---
 .../bind/bind/CVE-2016-6170.patch                  | 1090 --------------------
 .../bind/bind/CVE-2016-8864.patch                  |  219 ----
 .../bind/bind/bind-confgen-build-unix.o-once.patch |   10 +-
 .../bind/bind/mips1-not-support-opcode.diff        |  104 --
 .../use-python3-and-fix-install-lib-path.patch     |   36 +
 .../bind/{bind_9.10.3-P3.bb => bind_9.10.5-P3.bb}  |   25 +-
 13 files changed, 61 insertions(+), 2443 deletions(-)
 delete mode 100644 meta/recipes-connectivity/bind/bind/CVE-2016-1285.patch
 delete mode 100644 meta/recipes-connectivity/bind/bind/CVE-2016-1286_1.patch
 delete mode 100644 meta/recipes-connectivity/bind/bind/CVE-2016-1286_2.patch
 delete mode 100644 meta/recipes-connectivity/bind/bind/CVE-2016-2088.patch
 delete mode 100644 meta/recipes-connectivity/bind/bind/CVE-2016-2775.patch
 delete mode 100644 meta/recipes-connectivity/bind/bind/CVE-2016-2776.patch
 delete mode 100644 meta/recipes-connectivity/bind/bind/CVE-2016-6170.patch
 delete mode 100644 meta/recipes-connectivity/bind/bind/CVE-2016-8864.patch
 delete mode 100644 meta/recipes-connectivity/bind/bind/mips1-not-support-opcode.diff
 create mode 100644 meta/recipes-connectivity/bind/bind/use-python3-and-fix-install-lib-path.patch
 rename meta/recipes-connectivity/bind/{bind_9.10.3-P3.bb => bind_9.10.5-P3.bb} (85%)
meta/recipes-connectivity/bind/bind/0001-build-use-pkg-config-to-find-libxml2.patch +7 -3
index 805cbb3..1e23c0f 100644
@@ -7,15 +7,19 @@ Signed-off-by: Ross Burton <[email protected]>
 Update context for version 9.10.3-P2.
 
 Signed-off-by: Kai Kang <[email protected]>
+
+Update context for version 9.10.5-P3.
+
+Signed-off-by: Kai Kang <[email protected]>
 ---
  configure.in | 23 +++--------------------
  1 file changed, 3 insertions(+), 20 deletions(-)
 
 diff --git a/configure.in b/configure.in
-index 0db826d..75819eb 100644
+index 4da73a4..6f2a754 100644
 --- a/configure.in
 +++ b/configure.in
-@@ -2107,26 +2107,9 @@ case "$use_libxml2" in
+@@ -2282,26 +2282,9 @@ case "$use_libxml2" in
  		DST_LIBXML2_INC=""
  		;;
  	auto|yes)
@@ -25,7 +29,7 @@ index 0db826d..75819eb 100644
 -			libxml2_cflags=`xml2-config --cflags`
 -			;;
 -		*)
--			if test "$use_libxml2" = "yes" ; then
+-			if test "yes" = "$use_libxml2" ; then
 -				AC_MSG_RESULT(no)
 -				AC_MSG_ERROR(required libxml2 version not available)
 -			else
meta/recipes-connectivity/bind/bind/CVE-2016-1285.patch deleted +0 -154

154 lines not on this page · raw message

meta/recipes-connectivity/bind/bind/CVE-2016-1286_1.patch deleted +0 -79

79 lines not on this page · raw message

meta/recipes-connectivity/bind/bind/CVE-2016-1286_2.patch deleted +0 -317

317 lines not on this page · raw message

meta/recipes-connectivity/bind/bind/CVE-2016-2088.patch deleted +0 -247

247 lines not on this page · raw message

meta/recipes-connectivity/bind/bind/CVE-2016-2775.patch deleted +0 -90

90 lines not on this page · raw message

meta/recipes-connectivity/bind/bind/CVE-2016-2776.patch deleted +0 -123

123 lines not on this page · raw message

meta/recipes-connectivity/bind/bind/CVE-2016-6170.patch deleted +0 -1090

1,090 lines not on this page · raw message

meta/recipes-connectivity/bind/bind/CVE-2016-8864.patch deleted +0 -219

219 lines not on this page · raw message

meta/recipes-connectivity/bind/bind/bind-confgen-build-unix.o-once.patch +7 -3
index 096d5d8..8bc4ea3 100644
@@ -17,24 +17,28 @@ problem.
 Upstream-Status: Pending
 
 Signed-off-by: Robert Yang <[email protected]>
+
+Update context(trailing whitespace) for version 9.10.5-P3.
+
+Signed-off-by: Kai Kang <[email protected]>
 ---
  bin/confgen/Makefile.in |    4 ++--
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/bin/confgen/Makefile.in b/bin/confgen/Makefile.in
-index 8b3e5aa..4868a24 100644
+index dca272f..02becce 100644
 --- a/bin/confgen/Makefile.in
 +++ b/bin/confgen/Makefile.in
 @@ -74,11 +74,11 @@ rndc-confgen.@O@: rndc-confgen.c
  ddns-confgen.@O@: ddns-confgen.c
  	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -c ${srcdir}/ddns-confgen.c
  
--rndc-confgen@EXEEXT@: rndc-confgen.@O@ util.@O@ keygen.@O@ ${UOBJS} ${CONFDEPLIBS} 
+-rndc-confgen@EXEEXT@: rndc-confgen.@O@ util.@O@ keygen.@O@ ${UOBJS} ${CONFDEPLIBS}
 +rndc-confgen@EXEEXT@: rndc-confgen.@O@ util.@O@ keygen.@O@ ${CONFDEPLIBS} $(SUBDIRS)
  	export BASEOBJS="rndc-confgen.@O@ util.@O@ keygen.@O@ ${UOBJS}"; \
  	${FINALBUILDCMD}
  
--ddns-confgen@EXEEXT@: ddns-confgen.@O@ util.@O@ keygen.@O@ ${UOBJS} ${CONFDEPLIBS} 
+-ddns-confgen@EXEEXT@: ddns-confgen.@O@ util.@O@ keygen.@O@ ${UOBJS} ${CONFDEPLIBS}
 +ddns-confgen@EXEEXT@: ddns-confgen.@O@ util.@O@ keygen.@O@ ${CONFDEPLIBS} $(SUBDIRS)
  	export BASEOBJS="ddns-confgen.@O@ util.@O@ keygen.@O@ ${UOBJS}"; \
  	${FINALBUILDCMD}
meta/recipes-connectivity/bind/bind/mips1-not-support-opcode.diff deleted +0 -104

104 lines not on this page · raw message

meta/recipes-connectivity/bind/bind/use-python3-and-fix-install-lib-path.patch new file +36 -0
new file mode 100644
index 0000000..9829f15
@@ -0,0 +1,36 @@
+Use python3 rather default python which maybe links to python2 for oe. And add
+option for setup.py to install files to right directory.
+
+Upstream-Status: Inappropriate [OE specific]
+
+Signed-off-by: Kai Kang <[email protected]>
+---
+diff --git a/bin/python/Makefile.in b/bin/python/Makefile.in
+index a43a3c1..2e727f2 100644
+--- a/bin/python/Makefile.in
++++ b/bin/python/Makefile.in
+@@ -55,9 +55,9 @@ install:: ${TARGETS} installdirs
+ 	${INSTALL_DATA} ${srcdir}/dnssec-coverage.8 ${DESTDIR}${mandir}/man8
+ 	if test -n "${PYTHON}" ; then \
+ 		if test -n "${DESTDIR}" ; then \
+-			${PYTHON} ${srcdir}/setup.py install --root=${DESTDIR} --prefix=${prefix} ; \
++			${PYTHON} ${srcdir}/setup.py install --root=${DESTDIR} --prefix=${prefix} --install-lib=${PYTHON_SITEPACKAGES_DIR} ; \
+ 		else \
+-			${PYTHON} ${srcdir}/setup.py install --prefix=${prefix} ; \
++			${PYTHON} ${srcdir}/setup.py install --prefix=${prefix} --install-lib=${PYTHON_SITEPACKAGES_DIR} ; \
+ 		fi \
+ 	fi
+ 
+diff --git a/configure.in b/configure.in
+index 314bb90..867923e 100644
+--- a/configure.in
++++ b/configure.in
+@@ -227,7 +227,7 @@ AC_ARG_WITH(python,
+ [  --with-python=PATH      specify path to python interpreter],
+     use_python="$withval", use_python="unspec")
+ 
+-python="python python3 python3.5 python3.4 python3.3 python3.2 python2 python2.7"
++python="python3 python3.5 python3.4 python3.3 python3.2 python2 python2.7"
+ 
+ testargparse='try: import argparse
+ except: exit(1)'
meta/recipes-connectivity/bind/bind_9.10.5-P3.bb renamed from meta/recipes-connectivity/bind/bind_9.10.3-P3.bb +11 -14
similarity index 85%
rename from meta/recipes-connectivity/bind/bind_9.10.3-P3.bb
rename to meta/recipes-connectivity/bind/bind_9.10.5-P3.bb
index 7eb79b0..e6e1e8d 100644
@@ -3,14 +3,13 @@ HOMEPAGE = "http://www.isc.org/sw/bind/"
 SECTION = "console/network"
 
 LICENSE = "ISC & BSD"
-LIC_FILES_CHKSUM = "file://COPYRIGHT;md5=0a95f52a0ab6c5f52dedc9a45e7abb3f"
+LIC_FILES_CHKSUM = "file://COPYRIGHT;md5=dba46507446198119bcde32a4feaab43"
 
 DEPENDS = "openssl libcap"
 
 SRC_URI = "ftp://ftp.isc.org/isc/bind9/${PV}/${BPN}-${PV}.tar.gz \
            file://conf.patch \
            file://make-etc-initd-bind-stop-work.patch \
-           file://mips1-not-support-opcode.diff \
            file://dont-test-on-host.patch \
            file://generate-rndc-key.sh \
            file://named.service \
@@ -21,21 +20,14 @@ SRC_URI = "ftp://ftp.isc.org/isc/bind9/${PV}/${BPN}-${PV}.tar.gz \
            file://bind-ensure-searching-for-json-headers-searches-sysr.patch \
            file://0001-gen.c-extend-DIRNAMESIZE-from-256-to-512.patch \
            file://0001-lib-dns-gen.c-fix-too-long-error.patch \
-           file://CVE-2016-1285.patch \
-           file://CVE-2016-1286_1.patch \
-           file://CVE-2016-1286_2.patch \
-           file://CVE-2016-2088.patch \
-           file://CVE-2016-2775.patch \
-           file://CVE-2016-2776.patch \
-           file://CVE-2016-8864.patch \
-           file://CVE-2016-6170.patch \
+           file://use-python3-and-fix-install-lib-path.patch \
            "
 
 UPSTREAM_CHECK_URI = "ftp://ftp.isc.org/isc/bind9/"
 UPSTREAM_CHECK_REGEX = "(?P<pver>9(\.\d+)+(-P\d+)*)/"
 
-SRC_URI[md5sum] = "bcf7e772b616f7259420a3edc5df350a"
-SRC_URI[sha256sum] = "690810d1fbb72afa629e74638d19cd44e28d2b2e5eb63f55c705ad85d1a4cb83"
+SRC_URI[md5sum] = "d79cafbd9ac76239ee532dd89d05cc83"
+SRC_URI[sha256sum] = "8d7e96b5b0bbac7b900d4c4bbb82e0956b4e509433c5fa392bb72a929b96606a"
 
 ENABLE_IPV6 = "--enable-ipv6=${@bb.utils.contains('DISTRO_FEATURES', 'ipv6', 'yes', 'no', d)}"
 EXTRA_OECONF = " ${ENABLE_IPV6} --with-libtool --enable-threads \
@@ -44,7 +36,10 @@ EXTRA_OECONF = " ${ENABLE_IPV6} --with-libtool --enable-threads \
                  --sysconfdir=${sysconfdir}/bind \
                  --with-openssl=${STAGING_LIBDIR}/.. \
                "
-inherit autotools update-rc.d systemd useradd pkgconfig
+
+inherit autotools update-rc.d systemd useradd pkgconfig python3-dir
+
+export PYTHON_SITEPACKAGES_DIR
 
 # PACKAGECONFIGs readline and libedit should NOT be set at same time
 PACKAGECONFIG ?= "readline"
@@ -70,7 +65,7 @@ RDEPENDS_${PN}-dev = ""
 PACKAGE_BEFORE_PN += "${PN}-utils"
 FILES_${PN}-utils = "${bindir}/host ${bindir}/dig"
 FILES_${PN}-dev += "${bindir}/isc-config.h"
-FILES_${PN} += "${sbindir}/generate-rndc-key.sh"
+FILES_${PN} += "${sbindir}/generate-rndc-key.sh ${PYTHON_SITEPACKAGES_DIR}"
 
 do_install_prepend() {
 	# clean host path in isc-config.sh before the hardlink created
@@ -107,6 +102,8 @@ do_install_append() {
 		install -d ${D}${sysconfdir}/tmpfiles.d
 		echo "d /run/named 0755 bind bind - -" > ${D}${sysconfdir}/tmpfiles.d/bind.conf
 	fi
+
+    rm -f ${D}${PYTHON_SITEPACKAGES_DIR}/isc/*.pyc
 }
 
 CONFFILES_${PN} = " \
Signature · 1 line
2.10.1
author
#2 lore raw
In reply to [email protected]
Quoted 10 lines · On 2017年07月12日 09:25, [email protected] wrote:

From: Kai Kang <[email protected]>

The following changes since commit 81498aac9560fbeaeb58eaada32ce80e0ea51628:

   yocto-project-qs: Updated Next Steps list (2017-07-12 00:28:16 +0100)

are available in the git repository at:

git://git.pokylinux.org/poky-contrib kangkai/bind
http://git.pokylinux.org/cgit.cgi/poky-contrib/log/?h=kangkai/bind

Oops. Duplicate dot in commit subject. Updated in poky-contrib.

--Kai

Quoted 30 lines

Kai Kang (1):

   bind: 9.10..3-P3 -> 9.10.5-P3
  ...0001-build-use-pkg-config-to-find-libxml2.patch |   10 +-
  .../bind/bind/CVE-2016-1285.patch                  |  154 ---
  .../bind/bind/CVE-2016-1286_1.patch                |   79 --
  .../bind/bind/CVE-2016-1286_2.patch                |  317 ------
  .../bind/bind/CVE-2016-2088.patch                  |  247 -----
  .../bind/bind/CVE-2016-2775.patch                  |   90 --
  .../bind/bind/CVE-2016-2776.patch                  |  123 ---
  .../bind/bind/CVE-2016-6170.patch                  | 1090 --------------------
  .../bind/bind/CVE-2016-8864.patch                  |  219 ----
  .../bind/bind/bind-confgen-build-unix.o-once.patch |   10 +-
  .../bind/bind/mips1-not-support-opcode.diff        |  104 --
  .../use-python3-and-fix-install-lib-path.patch     |   36 +
  .../bind/{bind_9.10.3-P3.bb => bind_9.10.5-P3.bb}  |   25 +-
  13 files changed, 61 insertions(+), 2443 deletions(-)

delete mode 100644 meta/recipes-connectivity/bind/bind/CVE-2016-1285.patch
delete mode 100644 meta/recipes-connectivity/bind/bind/CVE-2016-1286_1.patch delete mode 100644 meta/recipes-connectivity/bind/bind/CVE-2016-1286_2.patch delete mode 100644 meta/recipes-connectivity/bind/bind/CVE-2016-2088.patch
delete mode 100644 meta/recipes-connectivity/bind/bind/CVE-2016-2775.patch
delete mode 100644 meta/recipes-connectivity/bind/bind/CVE-2016-2776.patch
delete mode 100644 meta/recipes-connectivity/bind/bind/CVE-2016-6170.patch
delete mode 100644 meta/recipes-connectivity/bind/bind/CVE-2016-8864.patch
delete mode 100644 meta/recipes-connectivity/bind/bind/mips1-not-support-opcode.diff create mode 100644 meta/recipes-connectivity/bind/bind/use-python3-and-fix-install-lib-path.patch rename meta/recipes-connectivity/bind/{bind_9.10.3-P3.bb => bind_9.10.5-P3.bb} (85%)

Signature · 2 lines
Regards,
Neil | Kai Kang
#3 lore raw
Quoted 2 lines · Kang Kai
Quoted 2 lines

Kai Kang (1):

   bind: 9.10..3-P3 -> 9.10.5-P3

Why not 9.11.1?

Alex

author
#4 lore raw
Quoted 5 lines · Alexander Kanavin
Quoted 2 lines · Kang Kai
Quoted 2 lines

Kai Kang (1):

   bind: 9.10..3-P3 -> 9.10.5-P3

Why not 9.11.1?

If bind 9.11.x is needed, we could add its recipe. But I think the 9.10.x version should be kept for compatibility.

Thanks,
Kai

Quoted 3 lines

Alex

Signature · 2 lines
Regards,
Neil | Kai Kang
#5 lore raw
Quoted 5 lines · Kang Kai
Quoted 3 lines
Quoted 1 line
Quoted 1 line
   bind: 9.10..3-P3 -> 9.10.5-P3

Why not 9.11.1?

If bind 9.11.x is needed, we could add its recipe. But I think the 9.10.x version should be kept for compatibility.

The policy in oe-core master is to update to latest stable upstream releases, so please provide an update to 9.11.x. If you want to keep 9.10.x, you can do that, but please provide a more specific reason.

Alex

#6 lore raw
Quoted 8 lines · Alexander Kanavin
Quoted 7 lines · Kang Kai
Quoted 5 lines
Quoted 2 lines
Quoted 2 lines
   bind: 9.10..3-P3 -> 9.10.5-P3

Why not 9.11.1?

Quoted 7 lines
Quoted 2 lines

If bind 9.11.x is needed, we could add its recipe. But I think the 9.10.x version should be kept for compatibility.

The policy in oe-core master is to update to latest stable upstream releases, so please provide an update to 9.11.x. If you want to keep 9.10.x, you can do that, but please provide a more specific reason.

if there are ABI incompatible changes then we have to scope the impact and plan the upgrade accordingly, if its backward compatible then yes its the norm.

#7 lore raw
Quoted 7 lines · Khem Raj
Quoted 3 lines

The policy in oe-core master is to update to latest stable upstream releases, so please provide an update to 9.11.x. If you want to keep 9.10.x, you can do that, but please provide a more specific reason.

if there are ABI incompatible changes then we have to scope the impact and plan the upgrade accordingly, if its backward compatible then yes its the norm.

What I'm saying is that it should not be a "9.10 now, 9.11 maybe later" when working with a master branch. The proper way is to "investigate and plan the upgrade to 9.11, update to 9.10 only if necessary, based on that investigation".

Alex

author
#8 lore raw
Quoted 8 lines · Alexander Kanavin
Quoted 7 lines · Khem Raj
Quoted 3 lines

The policy in oe-core master is to update to latest stable upstream releases, so please provide an update to 9.11.x. If you want to keep 9.10.x, you can do that, but please provide a more specific reason.

if there are ABI incompatible changes then we have to scope the impact and plan the upgrade accordingly, if its backward compatible then yes its the norm.

It doesn't mention that api changes in 9.11 from release notes pages of 9.11.0rc1 and 9.11.0.

https://kb.isc.org/article/AA-01409
https://kb.isc.org/article/AA-01432/81/BIND-9.11.0-Release-Notes.html

But it suggests not to use 9.11 until the second maintenance release(9.11.2 if I understand correctly) for production systems:

| We recommend that administrators run one of our older, stable branches, such as a 9.9 or 9.10-based release on larger-scale critical production systems, while testing the new 9.11 branch until the second maintenance release.

https://www.isc.org/downloads/bind/bind-9-11-new-features/

--Kai

Quoted 6 lines

What I'm saying is that it should not be a "9.10 now, 9.11 maybe later" when working with a master branch. The proper way is to "investigate and plan the upgrade to 9.11, update to 9.10 only if necessary, based on that investigation".

Alex

Signature · 2 lines
Regards,
Neil | Kai Kang
#9 lore raw
Quoted 11 lines · Kang Kai

It doesn't mention that api changes in 9.11 from release notes pages of 9.11.0rc1 and 9.11.0.

https://kb.isc.org/article/AA-01409
https://kb.isc.org/article/AA-01432/81/BIND-9.11.0-Release-Notes.html

But it suggests not to use 9.11 until the second maintenance release(9.11.2 if I understand correctly) for production systems:

| We recommend that administrators run one of our older, stable branches, such as a 9.9 or 9.10-based release on larger-scale critical production systems, while testing the new 9.11 branch until the second maintenance release.

https://www.isc.org/downloads/bind/bind-9-11-new-features/

Fair enough, let's stick with 9.10 for now then.

Alex