RECOMMENDED is removed. It becomes ABI_DEPENDS.
BUILDLINK_RECOMMENDED.foo becomes BUILDLINK_ABI_DEPENDS.foo.
BUILDLINK_DEPENDS.foo becomes BUILDLINK_API_DEPENDS.foo.
BUILDLINK_DEPENDS does not change.
IGNORE_RECOMMENDED (which defaulted to "no") becomes USE_ABI_DEPENDS
which defaults to "yes".
Added to obsolete.mk checking for IGNORE_RECOMMENDED.
I did not manually go through and fix any aesthetic tab/spacing issues.
I have tested the above patch on DragonFly building and packaging
subversion and pkglint and their many dependencies.
I have also tested USE_ABI_DEPENDS=no on my NetBSD workstation (where I
have used IGNORE_RECOMMENDED for a long time). I have been an active user
of IGNORE_RECOMMENDED since it was available.
As suggested, I removed the documentation sentences suggesting bumping for
"security" issues.
As discussed on tech-pkg.
I will commit to revbump, pkglint, pkg_install, createbuildlink separately.
Note that if you use wip, it will fail! I will commit to pkgsrc-wip
later (within day).
developer is officially maintaining the package.
The rationale for changing this from "tech-pkg" to "pkgsrc-users" is
that it implies that any user can try to maintain the package (by
submitting patches to the mailing list). Since the folks most likely
to care about the package are the folks that want to use it or are
already using it, this would leverage the energy of users who aren't
developers.
"io-xpm.c in the gdk-pixbuf XPM image rendering library allows attackers
to cause a denial of service (infinite loop) via a crafted XPM image
with a large number of colors."
"Integer overflow in io-xpm.c in gdk-pixbuf allows attackers to cause a
denial of service (crash) or execute arbitrary code via an XPM file with
large height, width, and colour values, a different vulnerability than
CVE-2005-3186."
"Integer overflow in the gdk-pixbuf XPM image rendering library allows
attackers to execute arbitrary code via an XPM file with a number of
colors that causes insufficient memory to be allocated, which leads to
a heap-based buffer overflow."
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2975http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2976http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3186
Several changes are involved since they are all interrelated. These
changes affect about 1000 files.
The first major change is rewriting bsd.builtin.mk as well as all of
the builtin.mk files to follow the new example in bsd.builtin.mk.
The loop to include all of the builtin.mk files needed by the package
is moved from bsd.builtin.mk and into bsd.buildlink3.mk. bsd.builtin.mk
is now included by each of the individual builtin.mk files and provides
some common logic for all of the builtin.mk files. Currently, this
includes the computation for whether the native or pkgsrc version of
the package is preferred. This causes USE_BUILTIN.* to be correctly
set when one builtin.mk file includes another.
The second major change is teach the builtin.mk files to consider
files under ${LOCALBASE} to be from pkgsrc-controlled packages. Most
of the builtin.mk files test for the presence of built-in software by
checking for the existence of certain files, e.g. <pthread.h>, and we
now assume that if that file is under ${LOCALBASE}, then it must be
from pkgsrc. This modification is a nod toward LOCALBASE=/usr. The
exceptions to this new check are the X11 distribution packages, which
are handled specially as noted below.
The third major change is providing builtin.mk and version.mk files
for each of the X11 distribution packages in pkgsrc. The builtin.mk
file can detect whether the native X11 distribution is the same as
the one provided by pkgsrc, and the version.mk file computes the
version of the X11 distribution package, whether it's built-in or not.
The fourth major change is that the buildlink3.mk files for X11 packages
that install parts which are part of X11 distribution packages, e.g.
Xpm, Xcursor, etc., now use imake to query the X11 distribution for
whether the software is already provided by the X11 distribution.
This is more accurate than grepping for a symbol name in the imake
config files. Using imake required sprinkling various builtin-imake.mk
helper files into pkgsrc directories. These files are used as input
to imake since imake can't use stdin for that purpose.
The fifth major change is in how packages note that they use X11.
Instead of setting USE_X11, package Makefiles should now include
x11.buildlink3.mk instead. This causes the X11 package buildlink3
and builtin logic to be executed at the correct place for buildlink3.mk
and builtin.mk files that previously set USE_X11, and fixes packages
that relied on buildlink3.mk files to implicitly note that X11 is
needed. Package buildlink3.mk should also include x11.buildlink3.mk
when linking against the package libraries requires also linking
against the X11 libraries. Where it was obvious, redundant inclusions
of x11.buildlink3.mk have been removed.
"David Costanzo has reported a vulnerability in GdkPixbuf, which can be
exploited by malicious people to crash certain applications on a user's
system.
The vulnerability is caused due to a double free error in the BMP loader.
This can be exploited to crash an application linked against GdkPixbuf
when a specially crafted BMP image is processed."
Bump PKGREVISION. Patch from Fedora.
Schwarz tried to compile it with a compiler that errors out when the code
does something as pointless as checking if a pointer is positive.
PR#28889 and http://bugzilla.gnome.org/show_bug.cgi?id=156186
in the process. (More information on tech-pkg.)
Bump PKGREVISION and BUILDLINK_DEPENDS of all packages using libtool and
installing .la files.
Bump PKGREVISION (only) of all packages depending directly on the above
via a buildlink3 include.
All library names listed by *.la files no longer need to be listed
in the PLIST, e.g., instead of:
lib/libfoo.a
lib/libfoo.la
lib/libfoo.so
lib/libfoo.so.0
lib/libfoo.so.0.1
one simply needs:
lib/libfoo.la
and bsd.pkg.mk will automatically ensure that the additional library
names are listed in the installed package +CONTENTS file.
Also make LIBTOOLIZE_PLIST default to "yes".
by moving the inclusion of buildlink3.mk files outside of the protected
region. This bug would be seen by users that have set PREFER_PKGSRC
or PREFER_NATIVE to non-default values.
BUILDLINK_PACKAGES should be ordered so that for any package in the
list, that package doesn't depend on any packages to the left of it
in the list. This ordering property is used to check for builtin
packages in the correct order. The problem was that including a
buildlink3.mk file for <pkg> correctly ensured that <pkg> was removed
from BUILDLINK_PACKAGES and appended to the end. However, since the
inclusion of any other buildlink3.mk files within that buildlink3.mk
was in a region that was protected against multiple inclusion, those
dependencies weren't also moved to the end of BUILDLINK_PACKAGES.
generated files.
(Not portability) changes since 0.18:
* Made the GIF loader handle animations with frames whose bounds go outside
of the base image's bounds (Federico).
* Made the GIF loader handle zero-sized frames that GifBuilder and
similar crap spits sometimes (Federico).
* The PNM loader doesn't abort() anymore if it cannot allocate memory
(Federico).
* Fixed a g_object_unref() -> gdk_pixbuf_unref() thinko (Federico).
* Merged the patch from Red Hat Linux 8.0 to fix the crash on
corrupted/short GIFs - Ximian 29040 (patch by Elliot Lee).
* Fixed the RGB 565 LSB -> MSB case in gdk-pixbuf-drawable - 79463
(Federico).
* Fixed the update region notification in the BMP loader (Federico).
* Merged the BMP loader changes from GTK+ HEAD -- check all reallocs,
fix 16bpp BI_RGB thinko, properly handle BI_RLE4 and skips and jumps
(changes by Matthias Clasen).
* Merged the ICO loader changes from GTK+ HEAD (changes by Matthias
Clasen).
* Merged changes from gtk+/gdk-pixbuf HEAD into the JPEG loader --
fixes CMYK JPEG problems (changes by Matthias Clasen).
headers in ${BUILDLINK_DIR}, simply create BUILDLINK_CPPFLAGS.<pkg>
variables whose values are appended to CPPFLAGS, which are automatically
passed to the configure and build processes.
BUILDLINK_TRANSFORM.<pkg> has little use in buildlink2 since packages are
now told that the software may be found where it really is installed, not
in ${BUILDLINK_DIR} as was the case with buildlink1. Eventually, these
variables will be declared unsupported by buildlink2.
-being here, update to 0.18.0
changes:
* Fixed the RGB 565 MSB -> MSB case in gdk-pixbuf-drawable - #79190
* Fixed alignment issues in the BMP loader - #84083 (Federico).
* Merged pixops.c from GTK+ HEAD as of 2002/Jun/18 (Federico).
buildlink2.mk files back into the main trunk. This provides sufficient
buildlink2 infrastructure to start merging other packages from the
buildlink2 branch that have already been converted to use the buildlink2
framework.
