PR#1: Update to bison 3.6.3 (#1792738) - rpms/bison

rpms / bison

#1 Update to bison 3.6.3 (#1792738)

Closed 3 years ago by submachine. Opened 4 years ago by defolos.

rpms/ defolos/bison master into master

Use macros where applicable and drop unecessary rm $RPM_BUILD_ROOT

Dan Čermák • 3 years ago

e34480f

Add source file verification using %gpgverify

Dan Čermák • 3 years ago

d95f0a7

Update to bison 3.6.4 (#1792738, #1847608)

Dan Čermák • 3 years ago

7811e6b

bison.spec

file modified

+21 -12

		`@@ -1,16 +1,22 @@`
		`Summary: A GNU general-purpose parser generator`
		`Name: bison`
		`- Version: 3.5`
		`- Release: 2%{?dist}`
		`+ Version: 3.6.4`
		`+ Release: 1%{?dist}`
		`License: GPLv3+`
		`- Source: ftp://ftp.gnu.org/pub/gnu/bison/bison-%{version}.tar.xz`
		`+ Source0: https://ftp.gnu.org/gnu/%{name}/%{name}-%{version}.tar.xz`
		`+ Source1: https://ftp.gnu.org/gnu/%{name}/%{name}-%{version}.tar.xz.sig`
		`+ # genereted from https://ftp.gnu.org/gnu/gnu-keyring.gpg via:`
		`+ # curl https://ftp.gnu.org/gnu/gnu-keyring.gpg \| gpg2 --import`
		`+ # gpg2 --export --export-options export-minimal 7DF84374B1EE1F9764BBE25D0DDCAA3278D5264E > gpgkey-7DF84374B1EE1F9764BBE25D0DDCAA3278D5264E.gpg`
		`+ Source2: gpgkey-7DF84374B1EE1F9764BBE25D0DDCAA3278D5264E.gpg`

		`# testsuite dependency`
		`BuildRequires: gcc-c++`
		`BuildRequires: autoconf`
		`BuildRequires: flex`
		`+ BuildRequires: gnupg2`

		`- URL: http://www.gnu.org/software/bison/`
		`+ URL: http://www.gnu.org/software/%{name}/`
		`BuildRequires: m4 >= 1.4`
		`#java-1.7.0-openjdk-devel`
		`Requires: m4 >= 1.4`
		`@@ -68,25 +74,25 @@`
		`Bison manual section for more information.`

		`%prep`
		`- %setup -q`
		`+ %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'`
		`+ %autosetup`

		`%build`
		`%configure`
		`- make`
		`+ %make_build`

		`%check`
		`make check`
		`#make maintainer-check`

		`%install`
		`- rm -rf $RPM_BUILD_ROOT`
		`- %makeinstall`
		`+ %make_install`

		`# Remove unpackaged files.`
		`- rm -f $RPM_BUILD_ROOT/%{_bindir}/yacc`
		`- rm -f $RPM_BUILD_ROOT/%{_infodir}/dir`
		`- rm -f $RPM_BUILD_ROOT/%{_mandir}/man1/yacc*`
		`- rm -rf $RPM_BUILD_ROOT/%{_docdir}/%{name}/examples/*`
		`+ rm -f %{_buildroot}/%{_bindir}/yacc`
		`+ rm -f %{_buildroot}/%{_infodir}/dir`
		`+ rm -f %{_buildroot}/%{_mandir}/man1/yacc*`
		`+ rm -rf %{_buildroot}/%{_docdir}/%{name}/examples/*`

		`%find_lang %{name}`
		`%find_lang %{name}-runtime`
		`@@ -113,6 +119,9 @@`
		`%{_libdir}/liby.a`

		`%changelog`
		`+ * Sun Jul 5 2020 Dan Čermák <dan.cermak@cgc-instruments.com> - 3.6.4-1`
		`+ - Update to bison 3.6.4 (#1792738, #1847608)`
		`+`
		`* Tue Jan 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.5-2`
		`- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild`

gpgkey-7DF84374B1EE1F9764BBE25D0DDCAA3278D5264E.gpg

file added

empty or binary file added

sources

file modified

+2 -1

		`@@ -1,1 +1,2 @@`
		`- SHA512 (bison-3.5.tar.xz) = 309ba77cfbf5d5ca697f522ac18ca9b55a1ec4e690b87220c97ffb1137b8bd8b22aa14c111166f0f4bf001e88f4bcbfd0583bc09810c246f0dc60fd6e8478950`
		`+ SHA512 (bison-3.6.4.tar.xz) = 041cd87f4ca6b012031719a49aa81e62d3c0817c6364289732e6a3cb9a0762498760e0f2ce84c03ca9e9b74eb74bdffd1b8b86d2b4a6e4a0d8c8a4b864b672dc`
		`+ SHA512 (bison-3.6.4.tar.xz.sig) = 6ad8df66219c3e828f10d4a4b8d8b083c124af81976030c57630b9a2d290415581b1165b65672b8f2caa8804f06d4ac9708c66bc3e7a8759f784bd47dab9ccd2`

upstream-key.gpg

file removed

-48

		`@@ -1,48 +0,0 @@`
		`- -----BEGIN PGP PUBLIC KEY BLOCK-----`
		`- Version: GnuPG v1.4.1 (GNU/Linux)`
		`-`
		`- mQGiBD8yt+oRBADkmVuWjrl0k0lrYOdaczAslirKeiayAd8868d7V6GzfFc/HES4`
		`- tFhi+okVybTAUJ6i4oKmIV0c5pNyzZ3TErHYFb40RP0FgW39SMgAIQ/H/kBMSjrq`
		`- jQNQi9TsXolNc2v+8rkYGRkR20PiIUwKxeZvgB6tyMNFTb9/NrwqNM+E2wCgobBp`
		`- 1S/UnaRfYRt+CYH91TTTPWUD/jW/S9ddc0yXOwx2f99f+gIJ6KIQmRihP3LvTdlf`
		`- vWwv1M8y9uWteXP11rcmvdRryL40irKP3gUnBHo7h3+vicTlG/YV0lvVPzo12mgO`
		`- 6yEO1eJmxYYkqeQ4Tzy95SG1xuoEYK6daOHPAZTBdoUCHJXaJhxbllPSgx6F0taT`
		`- S4u9BADgXDuE1lduOsQeIa8LadO7MtRdCC+lpuh6OErNnHgVCBnOJzIWY6Vtw0mZ`
		`- nvKvwQCTbgwC5ZF2VdcfKfnNsz1Uc/tie7bGo4rz1CnHMokRT6+CMpkSg0+8CAFM`
		`- LSYIZP0Bs4YCD1XxoVef/3xqULSzY9tEc0hB/eCOfuXCFiHbuLQcUGF1bCBFZ2dl`
		`- cnQgPGVnZ2VydEBnbnUub3JnPohdBBMRAgAdBQI/MrfrBQkB4TOABQsHCgMEAxUD`
		`- AgMWAgECF4AACgkQ1h7LNGmkcmsIhwCdEqoVFmJzghAzkqwDlO+zO8vwNZMAn13H`
		`- cKAWAkQ1XttffFpQ4g63o5CYuQENBD8yt+0QBACVjyAOjVJIv/H7mCYAIdx1mF+U`
		`- BOIZzEKsJnqIR+8DZvDsmY6dvkvDEETlMlE3D+mH+CuNylDsHChDKBVTonrKsPdl`
		`- woVjkh2lQ5x67U929cNpJ3O5+Y3DxiANj1NPV3rgUePO/HxqFnRZdWtw6kXcnDgQ`
		`- ELVhB2ngzU1Jxfu9YwADBgP/UkK5GfBuhqY/5UessEZNs2vzRoVe/jsj4AF0zUfO`
		`- 37FbUllURV+3bK6knN6L/l77mDGh/oHqBr4drewxWN9EQMB8lhKHVunazmQ7kTcZ`
		`- O8xnZQubASTnM6Hd7OL4wJAcpVyQOBaVsPDOf0vlqCHX+xj1T+mxJPhqZrHqmJeV`
		`- j2iITAQYEQIADAUCPzK37QUJAeEzgAAKCRDWHss0aaRya+jOAJ96m9tB9UFY36ou`
		`- H9CzH0gE60M9mACfXqEHT1kDN+s5z64kiKr0lNe3+9GZAaIEQuEYHxEEAP1h6Eyn`
		`- sdMRGwx3/tlUoeHFjVe7fkN/JzlL5Z6oao+Y/Yf2ESBg/XB0/8FaS7CTQMHKChip`
		`- a9Wivp+GiqzKCewULYLApLUS5WO+xJ8wGPIShIUh33Vups7rR7JGqQ98pxbTk8E/`
		`- 36zRUH6R6g0H9DPZbUxKZDWELKKSegYu3FQ7AKCpqJc9Vq8GTgFflXlGYffSENVk`
		`- CwP/VMH3PtBfPRgwqiUrydXT95zogct+RivNzwzIsKxi+0w1BhYdCLNgXD7TA3lT`
		`- QsgLytskVer1T1dmp6bwH5ZW05iTzSOQqq8EI4sA5AYq5JIvUmIRYKg5R+LGuDxP`
		`- 8Ruvw53NSE1hLtsC+qiQxHqcDK+t2vf8nSU7bcom92OuDZoD/3JEYfumdlrt/BR/`
		`- Vv/dqG9kKLCoXNbuV+X4Aq8RTSOszopBUc+TJIqZNaAq13n4XUDqznhmlWq0d5x2`
		`- CWQimDQzMn/2vjacJ/MNTdxcw+7s/rjnFy/LBWT/cRuUxgk3B+wlDHp4z5V1HLWF`
		`- ed49y4OHWxF7qvONM3ccwABW/xnvtCBQYXVsIEVnZ2VydCA8ZWdnZXJ0QGNzLnVj`
		`- bGEuZWR1PohkBBMRAgAkBQJC4RgfAhsDBQkFo5qABgsJCAcDAgMVAgMDFgIBAh4B`
		`- AheAAAoJELk/YMa1xM4TocEAoI6ngp3vBGXrLRkFFibu5kNbFoIvAKClFUC21RFB`
		`- xrC1eZoD2/df9IG/pLkCDQRC4RguEAgAutFBZGkpmjmVPG16cZDdXcAEEyKxse+s`
		`- W3ftiv/h8x2cvEmy8x3A2tuCWf5gSJ3viawdkAp5w9d42IoC4O3COF3B7nRpR6FU`
		`- 6o193OXLrJhNjmBV5iGgyLZfkxuA686J7BP2yxUSzwJjAhyk1S+70sg3cygMLDT0`
		`- EsID1n0Y5HWFHP5DkfNhIh0Kh4gqsCQBytO8cD/hsVSSbz+9ttDSV/LIzcCUgkJe`
		`- O5HkxSnd/3CYB2FBIzlM0XIWvEoZ/z6shroIySIGZlxnbZXFO//nVEC4EHQ7JKyj`
		`- 7X+HvH2lumkjSnX51X0hmqBjeRvFK2gIu59DyZRTHiXtXE4Mdy+kXwADBQf+Ptps`
		`- V+WJ1BuemoEmaDgNCuO+JxH1D04/ux7PXCxZKU1+k4vtwdDPXSDpWxpGD8XWgN9C`
		`- if06GWHejBTgTRQoy4ygiBAo8B/vUQZdBL80z6rUuIOVg/EBUDiJV0Pz6Z7dwKfv`
		`- Bb2+F8flhqJDdPLs6VxYddd5ZemXbBBe2KanIsyP7Pk586sTzuU7PMTcEMcizkzg`
		`- HiMTY8zBd8+dBM7hn30/NORLsEfJpf+E4eC72TpJK4ZRfZpk03rMWBoZFziCfxjL`
		`- XUOB44tQK0yn53vreX1jcc5urmI4z7j7yD3sypkYCwn7gpwyxPB9A6zDf9HyvWpf`
		`- um6/jkof6fvV+OcRrYhPBBgRAgAPBQJC4RguAhsMBQkFo5qAAAoJELk/YMa1xM4T`
		`- y7QAmgPizj1fRazw/BFTyStLPjUAFXNlAKCnTTwKv96JkWTxcIILLfibPRmnFw==`
		`- =rfoO`
		`- -----END PGP PUBLIC KEY BLOCK-----`

defolos commented 4 years ago

Update bison to 3.6.3 and add source file verification via gpg

defolos commented 3 years ago

Ping?

codonell commented 3 years ago

Thanks for the PR, Arjun has been out for a while and he'll be back next week, and we're already looking at updating to 3.6.4 since that was released on 2020-06-15.

Because we want to update to 3.6.4 I'm going to drop this pull-request.

rebased onto 7811e6b

3 years ago

defolos commented 3 years ago

I have updated this PR to include the version bump to 3.6.4. and added a reference that this fixes CVE-2020-14150 (https://bugzilla.redhat.com/show_bug.cgi?id=1847608) as well.

codonell commented 3 years ago

@defolos Awesome! Arjun is back in the office so he'll get to review this.

defolos commented 3 years ago

Yeah, I just bumped the version, which is not sufficient in this case (see the simple-koji-ci failure): there is a bunch of new files that still need to be added to the %files section. I'll try to takle this soon-ish or @submachine if he beats me to it ;-)

submachine commented 3 years ago

Yeah, I just bumped the version, which is not sufficient in this case (see the simple-koji-ci failure): there is a bunch of new files that still need to be added to the %files section. I'll try to takle this soon-ish or @submachine if he beats me to it ;-)

Hi, sorry, I've been AFK for a rather long time (months).

Thanks! I see you're already part-way through this. Since you're already working on it, I'm happy to look at your proposed update when it comes on here. Otherwise, updating this is on my TODO list and if you don't find time, I'll be happy to pick it back up mid-week.

submachine commented 3 years ago

Just spoke to @defolos on Freenode IRC. I'll be taking this one to completion and update here. Thanks for your work, @defolos!

submachine commented 3 years ago

Dan included three commits in this PR. My review:

Update to bison 3.6.4 (#1792738, #1847608)

Looks okay. Also adds Akim Demaille's exported gpg key, which leads into the next commit:

Add source file verification using %gpgverify

Looks okay. The GNU project maintainer keyring is 2.5M. Dan exported Akim's (primary bison maintainer) key and added a comment on how to reproduce the file. I verified it separately and the key file generated by me matches the one I exported from the GNU maintainer keyring.